October 2009 - jboss-identity-commits

JBoss Identity SVN: r875 - in identity-federation/trunk/jboss-identity-webapps/employee-post-sig: .settings and 7 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-27 13:28:26 -0400 (Tue, 27 Oct 2009) New Revision: 875 Modified: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/resources/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/lib/ Log: propset Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/resources ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/lib ___________________________________________________________________ Name: svn:ignore - .settings .metadata .classpath target .property + target .settings .project

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r874 - in identity-federation/trunk/jboss-identity-bindings/src/test: resources/config and 1 other directory.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-27 13:27:20 -0400 (Tue, 27 Oct 2009) New Revision: 874 Removed: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-1.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-2.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-3.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-4.xml Log: JBID-197: remove redundant test Deleted: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java 2009-10-27 17:18:50 UTC (rev 873) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java 2009-10-27 17:27:20 UTC (rev 874) @@ -1,186 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.test.identity.federation.bindings.config; - -import java.io.InputStream; -import java.util.List; - -import javax.xml.bind.JAXBElement; -import javax.xml.bind.Unmarshaller; - -import junit.framework.TestCase; - -import org.jboss.identity.federation.core.config.AuthPropertyType; -import org.jboss.identity.federation.core.config.IDPType; -import org.jboss.identity.federation.core.config.KeyProviderType; -import org.jboss.identity.federation.core.config.KeyValueType; -import org.jboss.identity.federation.core.config.PropertyType; -import org.jboss.identity.federation.core.config.SPType; -import org.jboss.identity.federation.core.config.STSType; -import org.jboss.identity.federation.core.config.ServiceProviderType; -import org.jboss.identity.federation.core.config.ServiceProvidersType; -import org.jboss.identity.federation.core.config.TokenProviderType; -import org.jboss.identity.federation.core.config.TokenProvidersType; -import org.jboss.identity.federation.core.config.TrustType; -import org.jboss.identity.federation.core.util.JAXBUtil; - -/** - * Unit Test the various config - * - * @author Anil.Saldhana(a)redhat.com - * @since Jan 21, 2009 - */ -public class ConfigUnitTestCase extends TestCase -{ - String config = "config/test-config-"; - - @SuppressWarnings("unchecked") - public void test01() throws Exception - { - Object object = this.unmarshall(config + "1.xml"); - assertNotNull("IDP is not null", object); - assertTrue(object instanceof JAXBElement); - - IDPType idp = ((JAXBElement<IDPType>) object).getValue(); - assertEquals("300000", 300000L, idp.getAssertionValidity()); - assertEquals("org.jboss.identity.federation.bindings.tomcat.TomcatRoleGenerator", idp.getRoleGenerator()); - - TrustType trust = idp.getTrust(); - assertNotNull("Trust is not null", trust); - String domains = trust.getDomains(); - assertTrue("localhost trusted", domains.indexOf("localhost") > -1); - assertTrue("jboss.com trusted", domains.indexOf("jboss.com") > -1); - } - - @SuppressWarnings("unchecked") - public void test02() throws Exception - { - Object object = this.unmarshall(config + "2.xml"); - assertNotNull("IDP is not null", object); - assertTrue(object instanceof JAXBElement); - - IDPType idp = ((JAXBElement<IDPType>) object).getValue(); - assertEquals("20000", 20000L, idp.getAssertionValidity()); - assertEquals("somefqn", idp.getRoleGenerator()); - assertTrue(idp.isEncrypt()); - KeyProviderType kp = idp.getKeyProvider(); - assertNotNull("KeyProvider is not null", kp); - assertEquals("SomeClass", "SomeClass", kp.getClassName()); - List<AuthPropertyType> authProps = kp.getAuth(); - AuthPropertyType authProp = authProps.get(0); - assertEquals("SomeKey", "SomeKey", authProp.getKey()); - assertEquals("SomeValue", "SomeValue", authProp.getValue()); - - authProp = authProps.get(1); - assertEquals("DBURL", "DBURL", authProp.getKey()); - assertEquals("SomeDBURL", "SomeDBURL", authProp.getValue()); - - List<KeyValueType> validatingAliases = kp.getValidatingAlias(); - assertEquals("Validating Alias length is 2", 2, validatingAliases.size()); - - KeyValueType kv = validatingAliases.get(0); - assertEquals("localhost", kv.getKey()); - assertEquals("localhostalias", kv.getValue()); - - kv = validatingAliases.get(1); - assertEquals("jboss.com", kv.getKey()); - assertEquals("jbossalias", kv.getValue()); - - TrustType trust = idp.getTrust(); - assertNotNull("Trust is not null", trust); - String domains = trust.getDomains(); - assertTrue("localhost trusted", domains.indexOf("localhost") > -1); - assertTrue("jboss.com trusted", domains.indexOf("jboss.com") > -1); - } - - @SuppressWarnings("unchecked") - public void test03() throws Exception - { - Object object = this.unmarshall(config + "3.xml"); - assertNotNull("SP is null", object); - assertTrue(object instanceof JAXBElement); - - SPType sp = ((JAXBElement<SPType>) object).getValue(); - assertEquals("http://localhost:8080/idp", sp.getIdentityURL()); - assertEquals("http://localhost:8080/sales", sp.getServiceURL()); - } - - /** - * <p> - * Tests the parsing of a Security Token Service configuration. - * </p> - * - * @throws Exception if an error occurs while running the test. - */ - @SuppressWarnings("unchecked") - public void test04() throws Exception - { - Object object = this.unmarshall(this.config + "4.xml"); - assertNotNull("Found a null STS configuration", object); - assertTrue("Unexpected configuration type", object instanceof JAXBElement); - - STSType stsType = ((JAXBElement<STSType>) object).getValue(); - // general STS configurations. - assertEquals("Unexpected STS name", "Test STS", stsType.getSTSName()); - assertEquals("Unexpected token timeout value", 7200, stsType.getTokenTimeout()); - assertTrue("Encryption of tokens should have been enabled", stsType.isEncryptToken()); - // we don't verify all values of the key provider config as it has been done in the other test scenarios. - assertNotNull("Unexpected null key provider", stsType.getKeyProvider()); - // request handler and configurations based on the token type. - assertEquals("Unexpected request handler class", "org.jboss.identity.federation.wstrust.Handler", stsType - .getRequestHandler()); - // configuration of the token providers. - TokenProvidersType tokenProviders = stsType.getTokenProviders(); - assertNotNull("Unexpected null list of token providers", tokenProviders); - assertEquals("Unexpected number of token providers", 1, tokenProviders.getTokenProvider().size()); - TokenProviderType tokenProvider = tokenProviders.getTokenProvider().get(0); - assertNotNull("Unexpected null token provider", tokenProvider); - assertEquals("Unexpected provider class name", "org.jboss.SpecialTokenProvider", tokenProvider.getProviderClass()); - assertEquals("Unexpected token type", "specialToken", tokenProvider.getTokenType()); - assertEquals("Unexpected token element name", "SpecialToken", tokenProvider.getTokenElement()); - assertEquals("Unexpected token namespace", "http://www.tokens.org", tokenProvider.getTokenElementNS()); - List<PropertyType> properties = tokenProvider.getProperty(); - assertEquals("Invalid number of properties", 2, properties.size()); - // configuration of the service providers. - ServiceProvidersType serviceProviders = stsType.getServiceProviders(); - assertNotNull("Unexpected null list of service providers", serviceProviders); - assertEquals("Unexpected number of service providers", 1, serviceProviders.getServiceProvider().size()); - ServiceProviderType serviceProvider = serviceProviders.getServiceProvider().get(0); - assertNotNull("Unexpected null service provider", serviceProvider); - assertEquals("Unexpected provider endpoint", "http://provider.endpoint/provider", serviceProvider.getEndpoint()); - assertEquals("Unexpected truststore alias", "providerAlias", serviceProvider.getTruststoreAlias()); - assertEquals("Unexpected token type", "specialToken", serviceProvider.getTokenType()); - } - - private Object unmarshall(String configFile) throws Exception - { - String schema = "schema/config/jboss-identity-fed.xsd"; - - ClassLoader tcl = Thread.currentThread().getContextClassLoader(); - InputStream is = tcl.getResourceAsStream(configFile); - assertNotNull("Inputstream not null", is); - - Unmarshaller un = JAXBUtil.getValidatingUnmarshaller("org.jboss.identity.federation.core.config", - schema); - return un.unmarshal(is); - } -} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-1.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-1.xml 2009-10-27 17:18:50 UTC (rev 873) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-1.xml 2009-10-27 17:27:20 UTC (rev 874) @@ -1,6 +0,0 @@ -<JBossIDP xmlns="urn:jboss:identity-federation:config:1.0"> -<IdentityURL>http://localhost:8080/idp</IdentityURL> -<Trust> - <Domains>localhost,jboss.com,jboss.org</Domains> -</Trust> -</JBossIDP> \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-2.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-2.xml 2009-10-27 17:18:50 UTC (rev 873) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-2.xml 2009-10-27 17:27:20 UTC (rev 874) @@ -1,15 +0,0 @@ -<JBossIDP xmlns="urn:jboss:identity-federation:config:1.0" - AssertionValidity="20000" - RoleGenerator="somefqn" - Encrypt="true"> -<IdentityURL>http://localhost:8080/idp</IdentityURL> -<Trust> - <Domains>localhost,jboss.com,jboss.org</Domains> -</Trust> -<KeyProvider ClassName="SomeClass"> - <Auth Key="SomeKey" Value="SomeValue" /> - <Auth Key="DBURL" Value="SomeDBURL" /> - <ValidatingAlias Key="localhost" Value="localhostalias"/> - <ValidatingAlias Key="jboss.com" Value="jbossalias"/> -</KeyProvider> -</JBossIDP> \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-3.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-3.xml 2009-10-27 17:18:50 UTC (rev 873) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-3.xml 2009-10-27 17:27:20 UTC (rev 874) @@ -1,14 +0,0 @@ -<JBossSP xmlns="urn:jboss:identity-federation:config:1.0"> -<IdentityURL>http://localhost:8080/idp</IdentityURL> -<Trust> - <Domains>localhost,jboss.com,jboss.org</Domains> -</Trust> -<KeyProvider ClassName="SomeClass"> - <Auth Key="SomeKey" Value="SomeValue" /> - <Auth Key="DBURL" Value="SomeDBURL" /> - <ValidatingAlias Key="localhost" Value="localhostalias"/> - <ValidatingAlias Key="jboss.com" Value="jbossalias"/> -</KeyProvider> - -<ServiceURL>http://localhost:8080/sales</ServiceURL> -</JBossSP> \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-4.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-4.xml 2009-10-27 17:18:50 UTC (rev 873) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/config/test-config-4.xml 2009-10-27 17:27:20 UTC (rev 874) @@ -1,24 +0,0 @@ -<JBossSTS xmlns="urn:jboss:identity-federation:config:1.0" - STSName="Test STS" TokenTimeout="7200" EncryptToken="true"> - <KeyProvider ClassName="SomeClass"> - <ValidatingAlias Key="localhost" Value="localhostalias"/> - <ValidatingAlias Key="jboss.com" Value="jbossalias"/> - <SigningAlias>issueralias</SigningAlias> - </KeyProvider> - <RequestHandler>org.jboss.identity.federation.wstrust.Handler</RequestHandler> - <TokenProviders> - <TokenProvider - ProviderClass="org.jboss.SpecialTokenProvider" - TokenType="specialToken" - TokenElement="SpecialToken" - TokenElementNS="http://www.tokens.org"> - <Property Name="Property1" Value="Value1"/> - <Property Name="Property2" Value="Value2"/> - </TokenProvider> - </TokenProviders> - <ServiceProviders> - <ServiceProvider Endpoint="http://provider.endpoint/provider" - TokenType="specialToken" - TruststoreAlias="providerAlias"/> - </ServiceProviders> -</JBossSTS> \ No newline at end of file

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r873 - in identity-federation/trunk: jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp and 17 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-27 13:18:50 -0400 (Tue, 27 Oct 2009) New Revision: 873 Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.project identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings/org.eclipse.jdt.core.prefs identity-federation/trunk/jboss-identity-webapps/employee-post-sig/pom.xml identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/resources/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/MANIFEST.MF identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/context.xml identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/jbid_test_keystore.jks identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/context.xml identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jboss-idfed.xml identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/lib/ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/web.xml identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/error.jsp identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/index.jsp identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/login.jsp identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/logout.jsp identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/piechart.gif identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/jbid-handlers.xml identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/jbid-handlers.xml Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/web.xml identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/index.jsp identity-federation/trunk/jboss-identity-webapps/pom.xml identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/web.xml identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/index.jsp identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/web.xml identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/index.jsp Log: JBID-40: saml2 logout Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-27 17:18:50 UTC (rev 873) @@ -626,7 +626,14 @@ if(trace) log.trace(e); } } - } + }/* + else + { + //User Principal is null + + //TODO: Send a formal unauthorized message + throw new ServletException("Unauthorized"); + }*/ } protected void sendErrorResponseToSP(String referrer, Response response, String relayState, Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java 2009-10-27 17:18:50 UTC (rev 873) @@ -21,18 +21,18 @@ */ package org.jboss.identity.federation.bindings.tomcat.sp; -import java.io.ByteArrayInputStream; -import java.io.ByteArrayOutputStream; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + import java.io.IOException; import java.io.InputStream; -import java.security.GeneralSecurityException; import java.security.Principal; import java.util.Arrays; import java.util.List; +import java.util.Set; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServletResponse; -import javax.xml.bind.JAXBException; +import javax.servlet.RequestDispatcher; +import javax.xml.transform.TransformerException; +import javax.xml.transform.TransformerFactoryConfigurationError; import org.apache.catalina.Session; import org.apache.catalina.authenticator.Constants; @@ -47,21 +47,29 @@ import org.jboss.identity.federation.bindings.util.ValveUtil; import org.jboss.identity.federation.core.config.TrustType; import org.jboss.identity.federation.core.exceptions.ConfigurationException; +import org.jboss.identity.federation.core.exceptions.ProcessingException; +import org.jboss.identity.federation.core.interfaces.ProtocolContext; import org.jboss.identity.federation.core.saml.v2.common.SAMLDocumentHolder; -import org.jboss.identity.federation.core.saml.v2.exceptions.AssertionExpiredException; import org.jboss.identity.federation.core.saml.v2.exceptions.IssuerNotTrustedException; import org.jboss.identity.federation.core.saml.v2.holders.DestinationInfoHolder; -import org.jboss.identity.federation.saml.v2.assertion.EncryptedElementType; -import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; +import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerRequest; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerResponse; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerResponse; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler.HANDLER_TYPE; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest.GENERATE_REQUEST_TYPE; +import org.jboss.identity.federation.core.saml.v2.util.DocumentUtil; +import org.jboss.identity.federation.saml.v2.SAML2Object; +import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; import org.jboss.identity.federation.web.constants.GeneralConstants; +import org.jboss.identity.federation.web.core.HTTPContext; import org.jboss.identity.federation.web.util.PostBindingUtil; import org.jboss.identity.federation.web.util.ServerDetector; -import org.xml.sax.SAXException; +import org.w3c.dom.Document; - -import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; - /** * Authenticator at the Service Provider * that handles HTTP/Post binding of SAML 2 @@ -76,6 +84,8 @@ private boolean trace = log.isTraceEnabled(); private boolean jbossEnv = false; + private String logOutPage = "/logout.jsp"; + public SPPostFormAuthenticator() { super(); @@ -88,108 +98,329 @@ { SPUtil spUtil = new SPUtil(); + //Eagerly look for Global LogOut + String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); + boolean logOutRequest = isNotNull(gloStr) && "true".equalsIgnoreCase(gloStr); + + String samlRequest = request.getParameter(GeneralConstants.SAML_REQUEST_KEY); + String samlResponse = request.getParameter(GeneralConstants.SAML_RESPONSE_KEY); + Principal principal = request.getUserPrincipal(); - if (principal != null) - { - if(trace) - log.trace("Already authenticated '" + principal.getName() + "'"); + + //If we have already authenticated the user and there is no request from IDP or logout from user + if(principal != null && !(logOutRequest || isNotNull(samlRequest) || isNotNull(samlResponse) ) ) return true; - } - + + SAML2Request saml2Request = new SAML2Request(); + Session session = request.getSessionInternal(true); String relayState = request.getParameter(GeneralConstants.RELAY_STATE); - //Try to get the username - try + boolean willSendRequest = false; + + if(!isNotNull(samlRequest) && !isNotNull(samlResponse)) { - principal = (GenericPrincipal) process(request,response); - - if(principal == null) + //Neither saml request nor response from IDP + //So this is a user request + + //Ask the handler chain to generate the saml request + Set<SAML2Handler> handlers = chain.handlers(); + + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), null, + HANDLER_TYPE.SP); + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + saml2HandlerResponse.setDestination(identityURL); + + //Reset the state + try { - AuthnRequestType authnRequest = spUtil.createSAMLRequest(serviceURL, identityURL); - sendRequestToIDP(authnRequest, relayState, response); - return false; + for(SAML2Handler handler: handlers) + { + handler.reset(); + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + + if(logOutRequest) + saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.LOGOUT); + else + saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.AUTH); + handler.generateSAMLRequest(saml2HandlerRequest, saml2HandlerResponse); + } } + catch(ProcessingException pe) + { + throw new RuntimeException(pe); + } - String username = principal.getName(); - String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; + willSendRequest = saml2HandlerResponse.getSendRequest(); - //Map to JBoss specific principal - if(spConfiguration.getServerEnvironment().equalsIgnoreCase("JBOSS") || jbossEnv) + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + if(destination != null && + samlResponseDocument != null) { - GenericPrincipal gp = (GenericPrincipal) principal; - //Push a context - ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); - principal = context.getRealm().authenticate(username, password); - ServiceProviderSAMLContext.clear(); - } - - session.setNote(Constants.SESS_USERNAME_NOTE, username); - session.setNote(Constants.SESS_PASSWORD_NOTE, password); - request.setUserPrincipal(principal); - register(request, response, principal, Constants.FORM_METHOD, username, password); - - return true; + try + { + sendRequestToIDP(destination, samlResponseDocument, relayState, response, + willSendRequest); + return false; + } + catch (Exception e) + { + if(trace) + log.trace("Exception:",e); + throw new IOException("Server Error"); + } + } } - catch(AssertionExpiredException aie) + + //See if we got a response from IDP + if(isNotNull(samlResponse) ) { - if(trace) - log.trace("Assertion has expired. Issuing a new saml2 request to the IDP"); + boolean isValid = false; try - { - AuthnRequestType authnRequest = spUtil.createSAMLRequest(serviceURL, identityURL); - sendRequestToIDP(authnRequest, relayState, response); + { + isValid = this.validate(request); } catch (Exception e) { - if(trace) log.trace("Exception:",e); + log.error("Exception:",e); + throw new IOException(); } - return false; + if(!isValid) + throw new IOException("Validity check failed"); + + //deal with SAML response from IDP + InputStream decodedResponseStream = PostBindingUtil.base64DecodeAsStream(samlResponse); + try + { + SAML2Response saml2Response = new SAML2Response(); + + SAML2Object samlObject = saml2Response.getSAML2ObjectFromStream(decodedResponseStream); + SAMLDocumentHolder documentHolder = saml2Response.getSamlDocumentHolder(); + + Set<SAML2Handler> handlers = chain.handlers(); + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), documentHolder, + HANDLER_TYPE.SP); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + //Deal with handler chains + for(SAML2Handler handler : handlers) + { + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } + } + + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + willSendRequest = saml2HandlerResponse.getSendRequest(); + + + if(destination != null && + samlResponseDocument != null) + { + sendRequestToIDP(destination, samlResponseDocument, relayState, response, willSendRequest); + } + else + { + //See if the session has been invalidated + + boolean sessionValidity = session.isValid(); + if(!sessionValidity) + { + //we are invalidated. + RequestDispatcher dispatch = context.getServletContext().getRequestDispatcher(this.logOutPage); + if(dispatch == null) + log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); + else + dispatch.forward(request, response); + return false; + } + + + //We got a response with the principal + List<String> roles = saml2HandlerResponse.getRoles(); + if(principal == null) + principal = (Principal) session.getSession().getAttribute(GeneralConstants.PRINCIPAL_ID); + + String username = principal.getName(); + String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; + + //Map to JBoss specific principal + if((new ServerDetector()).isJboss() || jbossEnv) + { + GenericPrincipal gp = (GenericPrincipal) principal; + //Push a context + ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); + principal = context.getRealm().authenticate(username, password); + ServiceProviderSAMLContext.clear(); + } + else + { + //tomcat env + principal = spUtil.createGenericPrincipal(request, principal.getName(), roles); + } + + session.setNote(Constants.SESS_USERNAME_NOTE, username); + session.setNote(Constants.SESS_PASSWORD_NOTE, password); + request.setUserPrincipal(principal); + register(request, response, principal, Constants.FORM_METHOD, username, password); + + return true; + } + + + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new IOException("Server Exception"); + } } - catch(Exception e) + + + if(isNotNull(samlRequest)) { - if(trace) - log.trace("Exception :",e); - response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); - } + //we got a logout request + //deal with SAML response from IDP + InputStream is = PostBindingUtil.base64DecodeAsStream(samlRequest); + + try + { + SAML2Object samlObject = saml2Request.getSAML2ObjectFromStream(is); + SAMLDocumentHolder documentHolder = saml2Request.getSamlDocumentHolder(); + + Set<SAML2Handler> handlers = chain.handlers(); + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), documentHolder, + HANDLER_TYPE.SP); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + //Deal with handler chains + for(SAML2Handler handler : handlers) + { + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } + } + + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + willSendRequest = saml2HandlerResponse.getSendRequest(); + + + if(destination != null && + samlResponseDocument != null) + { + sendRequestToIDP(destination, samlResponseDocument, relayState, response, willSendRequest); + return true; + } + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new IOException("Server Exception"); + } + }//end else logoutrequest + //fallback - return super.authenticate(request, response, loginConfig); - } + return super.authenticate(request, response, loginConfig); + } - protected void sendRequestToIDP(AuthnRequestType authnRequest, String relayState, Response response) - throws IOException, SAXException, JAXBException,GeneralSecurityException + /** + * Send the request to the IDP + * @param destination idp url + * @param samlDocument request or response document + * @param relayState + * @param response + * @param willSendRequest are we sending Request or Response to IDP + * @throws ProcessingException + * @throws ConfigurationException + */ + protected void sendRequestToIDP( + String destination, Document samlDocument,String relayState, Response response, + boolean willSendRequest) + throws ProcessingException, ConfigurationException { - SAML2Request saml2Request = new SAML2Request(); - ByteArrayOutputStream baos = new ByteArrayOutputStream(); - saml2Request.marshall(authnRequest, baos); + try + { + String samlMessage = DocumentUtil.getDocumentAsString(samlDocument); + samlMessage = PostBindingUtil.base64Encode(samlMessage); + PostBindingUtil.sendPost(new DestinationInfoHolder(destination, samlMessage, relayState), + response, willSendRequest); + } + catch (TransformerFactoryConfigurationError e) + { + throw new ConfigurationException(e); + } + catch (TransformerException e) + { + throw new ProcessingException(e); + } + catch (IOException e) + { + throw new ProcessingException(e); + } + } - String samlMessage = PostBindingUtil.base64Encode(baos.toString()); - String destination = authnRequest.getDestination(); - PostBindingUtil.sendPost(new DestinationInfoHolder(destination, samlMessage, relayState), - response, true); - } - - protected AuthnRequestType createSAMLRequestMessage(String relayState, Response response) - throws ServletException, ConfigurationException - { - //create a saml request - if(this.serviceURL == null) - throw new ServletException("serviceURL is not configured"); - - SPUtil spUtil = new SPUtil(); - return spUtil.createSAMLRequest(serviceURL, identityURL); - } - - protected String getDestination(String urlEncodedRequest, String urlEncodedRelayState) - { - StringBuilder sb = new StringBuilder(); - sb.append("?SAMLRequest=").append(urlEncodedRequest); - if(isNotNull(urlEncodedRelayState)) - sb.append("&RelayState=").append(urlEncodedRelayState); - return sb.toString(); - } - + /** + * Trust handling + * @param issuer + * @throws IssuerNotTrustedException + */ protected void isTrusted(String issuer) throws IssuerNotTrustedException { try @@ -217,65 +448,17 @@ protected ResponseType decryptAssertion(ResponseType responseType) { throw new RuntimeException("This authenticator does not handle encryption"); - } - - private Principal process(Request request, Response response) - throws JAXBException, SAXException, IssuerNotTrustedException, - AssertionExpiredException, ConfigurationException, GeneralSecurityException - { - Principal userPrincipal = null; - - String samlResponse = request.getParameter("SAMLResponse"); - if(isNotNull(samlResponse) ) - { - boolean isValid = false; - try - { - isValid = this.validate(request); - } - catch (IOException e) - { - throw new GeneralSecurityException(e); - } - if(!isValid) - throw new GeneralSecurityException("Validity check failed"); - - //deal with SAML response from IDP - byte[] base64DecodedResponse = PostBindingUtil.base64Decode(samlResponse); - InputStream is = new ByteArrayInputStream(base64DecodedResponse); - - SAML2Response saml2Response = new SAML2Response(); - - ResponseType responseType = saml2Response.getResponseType(is); - - SAMLDocumentHolder samlDocumentHolder = saml2Response.getSamlDocumentHolder(); - - boolean validSignature = this.verifySignature(samlDocumentHolder); - - if(validSignature == false) - throw new IssuerNotTrustedException("Signature in saml document is invalid"); - - this.isTrusted(responseType.getIssuer().getValue()); - - List<Object> assertions = responseType.getAssertionOrEncryptedAssertion(); - if(assertions.size() == 0) - throw new IllegalStateException("No assertions in reply from IDP"); - - Object assertion = assertions.get(0); - if(assertion instanceof EncryptedElementType) - { - responseType = this.decryptAssertion(responseType); - } - - SPUtil spUtil = new SPUtil(); - return spUtil.handleSAMLResponse(request, responseType); - } - return userPrincipal; } - + + /** + * Verify Signature + * @param samlDocumentHolder + * @return + * @throws IssuerNotTrustedException + */ protected boolean verifySignature(SAMLDocumentHolder samlDocumentHolder) throws IssuerNotTrustedException { //this authenticator does not deal with signatures. return true; - } + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-27 17:18:50 UTC (rev 873) @@ -117,349 +117,280 @@ return true; SAML2Request saml2Request = new SAML2Request(); - + Session session = request.getSessionInternal(true); String relayState = request.getParameter(GeneralConstants.RELAY_STATE); - - - - - /* if(!logOutRequest) - {*/ - /* if (principal != null) - { - if(trace) - log.trace("Already authenticated '" + principal.getName() + "'"); - return true; - }*/ - - /* //Try to get the username + + if(!isNotNull(samlRequest) && !isNotNull(samlResponse)) + { + //Neither saml request nor response from IDP + //So this is a user request + + //Ask the handler chain to generate the saml request + Set<SAML2Handler> handlers = chain.handlers(); + + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), null, + HANDLER_TYPE.SP); + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + saml2HandlerResponse.setDestination(identityURL); + + //Reset the state try { - principal = (GenericPrincipal) process(request,response); - - if(principal == null) + for(SAML2Handler handler: handlers) { - String destination = createSAMLRequestMessage( relayState, response); - HTTPRedirectUtil.sendRedirectForRequestor(destination, response); - - return false; - } - - String username = principal.getName(); - String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; - - //Map to JBoss specific principal - if(spConfiguration.getServerEnvironment().equalsIgnoreCase("JBOSS") || jbossEnv) - { - GenericPrincipal gp = (GenericPrincipal) principal; - //Push a context - ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); - principal = context.getRealm().authenticate(username, password); - ServiceProviderSAMLContext.clear(); - } - - session.setNote(Constants.SESS_USERNAME_NOTE, username); - session.setNote(Constants.SESS_PASSWORD_NOTE, password); - request.setUserPrincipal(principal); - register(request, response, principal, Constants.FORM_METHOD, username, password); - - return true; + handler.reset(); + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + + if(logOutRequest) + saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.LOGOUT); + else + saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.AUTH); + handler.generateSAMLRequest(saml2HandlerRequest, saml2HandlerResponse); + } } - catch(AssertionExpiredException aie) + catch(ProcessingException pe) { - if(trace) - log.trace("Assertion has expired. Issuing a new saml2 request to the IDP"); + throw new RuntimeException(pe); + } + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + if(destination != null && + samlResponseDocument != null) + { try { - String destination = createSAMLRequestMessage( relayState, response); - HTTPRedirectUtil.sendRedirectForRequestor(destination, response); + String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + + String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); + String destinationURL = destination + + getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + + HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + return false; } catch (Exception e) { - if(trace) log.trace("Exception:",e); - } - return false; - } - catch(Exception e) - { - if(trace) - log.trace("Exception :",e); + if(trace) + log.trace("Exception:",e); + throw new IOException("Server Error"); + } } } - else - {*/ - if(!isNotNull(samlRequest) && !isNotNull(samlResponse)) + + //See if we got a response from IDP + if(isNotNull(samlResponse) ) + { + boolean isValid = false; + try { - //Neither saml request nor response from IDP - //So this is a user request + isValid = this.validate(request); + } + catch (Exception e) + { + log.error("Exception:",e); + throw new IOException(); + } + if(!isValid) + throw new IOException("Validity check failed"); - //Ask the handler chain to generate the saml request - Set<SAML2Handler> handlers = chain.handlers(); + //deal with SAML response from IDP + InputStream base64DecodedResponse = RedirectBindingUtil.base64DeflateDecode(samlResponse); + try + { + SAML2Response saml2Response = new SAML2Response(); + + SAML2Object samlObject = saml2Response.getSAML2ObjectFromStream(base64DecodedResponse); + SAMLDocumentHolder documentHolder = saml2Response.getSamlDocumentHolder(); + + Set<SAML2Handler> handlers = chain.handlers(); IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); //Create the request/response SAML2HandlerRequest saml2HandlerRequest = new DefaultSAML2HandlerRequest(protocolContext, - holder.getIssuer(), null, + holder.getIssuer(), documentHolder, HANDLER_TYPE.SP); + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); - saml2HandlerResponse.setDestination(identityURL); - - //Reset the state - try + //Deal with handler chains + for(SAML2Handler handler : handlers) { - for(SAML2Handler handler: handlers) + if(saml2HandlerResponse.isInError()) { - handler.reset(); - if(saml2HandlerResponse.isInError()) - { - response.sendError(saml2HandlerResponse.getErrorCode()); - break; - } - - if(logOutRequest) - saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.LOGOUT); - else - saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.AUTH); - handler.generateSAMLRequest(saml2HandlerRequest, saml2HandlerResponse); - } + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } } - catch(ProcessingException pe) - { - throw new RuntimeException(pe); - } + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); relayState = saml2HandlerResponse.getRelayState(); String destination = saml2HandlerResponse.getDestination(); - + + if(destination != null && samlResponseDocument != null) { - try - { - String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); - String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); - String destinationURL = destination + - getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); + String destinationURL = destination + + getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); - HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); - return false; - } - catch (Exception e) - { - if(trace) - log.trace("Exception:",e); - throw new IOException("Server Error"); - } - } - } - - //See if we got a response from IDP - if(isNotNull(samlResponse) ) - { - boolean isValid = false; - try - { - isValid = this.validate(request); + HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); } - catch (Exception e) + else { - log.error("Exception:",e); - throw new IOException(); - } - if(!isValid) - throw new IOException("Validity check failed"); + //See if the session has been invalidated - //deal with SAML response from IDP - InputStream base64DecodedResponse = RedirectBindingUtil.base64DeflateDecode(samlResponse); - - try - { - SAML2Response saml2Response = new SAML2Response(); - - SAML2Object samlObject = saml2Response.getSAML2ObjectFromStream(base64DecodedResponse); - SAMLDocumentHolder documentHolder = saml2Response.getSamlDocumentHolder(); - - Set<SAML2Handler> handlers = chain.handlers(); - IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); - ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); - //Create the request/response - SAML2HandlerRequest saml2HandlerRequest = - new DefaultSAML2HandlerRequest(protocolContext, - holder.getIssuer(), documentHolder, - HANDLER_TYPE.SP); - - SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); - - //Deal with handler chains - for(SAML2Handler handler : handlers) + boolean sessionValidity = session.isValid(); + if(!sessionValidity) { - if(saml2HandlerResponse.isInError()) - { - response.sendError(saml2HandlerResponse.getErrorCode()); - break; - } - if(samlObject instanceof RequestAbstractType) - { - handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); - } + //we are invalidated. + RequestDispatcher dispatch = context.getServletContext().getRequestDispatcher(this.logOutPage); + if(dispatch == null) + log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); else - { - handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); - } - } + dispatch.forward(request, response); + return false; + } - Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); - relayState = saml2HandlerResponse.getRelayState(); - String destination = saml2HandlerResponse.getDestination(); + //We got a response with the principal + List<String> roles = saml2HandlerResponse.getRoles(); + if(principal == null) + principal = (Principal) session.getSession().getAttribute(GeneralConstants.PRINCIPAL_ID); + String username = principal.getName(); + String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; - if(destination != null && - samlResponseDocument != null) + //Map to JBoss specific principal + if((new ServerDetector()).isJboss() || jbossEnv) { - String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); - - String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); - String destinationURL = destination + - getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); - - HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + GenericPrincipal gp = (GenericPrincipal) principal; + //Push a context + ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); + principal = context.getRealm().authenticate(username, password); + ServiceProviderSAMLContext.clear(); } else { - //See if the session has been invalidated - - boolean sessionValidity = session.isValid(); - if(!sessionValidity) - { - //we are invalidated. - RequestDispatcher dispatch = context.getServletContext().getRequestDispatcher(this.logOutPage); - if(dispatch == null) - log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); - else - dispatch.forward(request, response); - return false; - } - - - //We got a response with the principal - List<String> roles = saml2HandlerResponse.getRoles(); - if(principal == null) - principal = (Principal) session.getSession().getAttribute(GeneralConstants.PRINCIPAL_ID); - - String username = principal.getName(); - String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; - - //Map to JBoss specific principal - if((new ServerDetector()).isJboss() || jbossEnv) - { - GenericPrincipal gp = (GenericPrincipal) principal; - //Push a context - ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); - principal = context.getRealm().authenticate(username, password); - ServiceProviderSAMLContext.clear(); - } - else - { - //tomcat env - SPUtil spUtil = new SPUtil(); - principal = spUtil.createGenericPrincipal(request, principal.getName(), roles); - } - - session.setNote(Constants.SESS_USERNAME_NOTE, username); - session.setNote(Constants.SESS_PASSWORD_NOTE, password); - request.setUserPrincipal(principal); - register(request, response, principal, Constants.FORM_METHOD, username, password); - - return true; + //tomcat env + SPUtil spUtil = new SPUtil(); + principal = spUtil.createGenericPrincipal(request, principal.getName(), roles); } - - } - catch (Exception e) - { - if(trace) - log.trace("Server Exception:", e); - throw new IOException("Server Exception"); - } + session.setNote(Constants.SESS_USERNAME_NOTE, username); + session.setNote(Constants.SESS_PASSWORD_NOTE, password); + request.setUserPrincipal(principal); + register(request, response, principal, Constants.FORM_METHOD, username, password); + + return true; } - if(isNotNull(samlRequest)) - { - //we got a logout request - - //deal with SAML response from IDP - InputStream is = RedirectBindingUtil.base64DeflateDecode(samlRequest); - - try - { - SAML2Object samlObject = saml2Request.getSAML2ObjectFromStream(is); - SAMLDocumentHolder documentHolder = saml2Request.getSamlDocumentHolder(); + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new IOException("Server Exception"); + } + } - Set<SAML2Handler> handlers = chain.handlers(); - IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); - ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); - //Create the request/response - SAML2HandlerRequest saml2HandlerRequest = - new DefaultSAML2HandlerRequest(protocolContext, - holder.getIssuer(), documentHolder, - HANDLER_TYPE.SP); - SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + if(isNotNull(samlRequest)) + { + //we got a logout request - //Deal with handler chains - for(SAML2Handler handler : handlers) - { - if(saml2HandlerResponse.isInError()) - { - response.sendError(saml2HandlerResponse.getErrorCode()); - break; - } - if(samlObject instanceof RequestAbstractType) - { - handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); - } - else - { - handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); - } - } + //deal with SAML response from IDP + InputStream is = RedirectBindingUtil.base64DeflateDecode(samlRequest); - Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); - relayState = saml2HandlerResponse.getRelayState(); + try + { + SAML2Object samlObject = saml2Request.getSAML2ObjectFromStream(is); + SAMLDocumentHolder documentHolder = saml2Request.getSamlDocumentHolder(); - String destination = saml2HandlerResponse.getDestination(); + Set<SAML2Handler> handlers = chain.handlers(); + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), documentHolder, + HANDLER_TYPE.SP); + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); - if(destination != null && - samlResponseDocument != null) - { - String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + //Deal with handler chains + for(SAML2Handler handler : handlers) + { + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } + } - String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); - String destinationURL = destination + - getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); - HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); - return true; - } - } - catch (Exception e) - { - if(trace) - log.trace("Server Exception:", e); - throw new IOException("Server Exception"); - } - }//end else logoutrequest - /* }*/ + String destination = saml2HandlerResponse.getDestination(); + + if(destination != null && + samlResponseDocument != null) + { + String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + + String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); + String destinationURL = destination + + getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + + HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + return true; + } + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new IOException("Server Exception"); + } + }//end else logoutrequest + //fallback return super.authenticate(request, response, loginConfig); } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-27 17:18:50 UTC (rev 873) @@ -21,7 +21,9 @@ */ package org.jboss.identity.federation.web.util; +import java.io.ByteArrayInputStream; import java.io.IOException; +import java.io.InputStream; import java.io.PrintWriter; import javax.servlet.http.HttpServletResponse; @@ -44,17 +46,43 @@ private static Logger log = Logger.getLogger(PostBindingUtil.class); private static boolean trace = log.isTraceEnabled(); + /** + * Apply base64 encoding on the message + * @param stringToEncode + * @return + */ public static String base64Encode(String stringToEncode) throws IOException { return Base64.encodeBytes(stringToEncode.getBytes("UTF-8"), Base64.DONT_BREAK_LINES); } - + + /** + * Apply base64 decoding on the message and return the byte array + * @param encodedString + * @return + */ public static byte[] base64Decode(String encodedString) { + if(encodedString == null) + throw new IllegalArgumentException("encodedString is null"); + return Base64.decode(encodedString); } /** + * Apply base64 decoding on the message and return the stream + * @param encodedString + * @return + */ + public static InputStream base64DecodeAsStream(String encodedString) + { + if(encodedString == null) + throw new IllegalArgumentException("encodedString is null"); + + return new ByteArrayInputStream(base64Decode(encodedString)); + } + + /** * Send the response to the redirected destination while * adding the character encoding of "UTF-8" as well as * adding headers for cache-control and Pragma Added: identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/jbid-handlers.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/web.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/web.xml 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/WEB-INF/web.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -1,35 +1,48 @@ -<?xml version="1.0" encoding="UTF-8"?> -<web-app version="2.4" - xmlns="http://java.sun.com/xml/ns/j2ee" +<?xml version="1.0" encoding="ISO-8859-1"?> +<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee - http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> + xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" + version="2.5"> - <description>Employee Application</description> + <display-name>Test Employee Application</display-name> + <description> + Just a Test SP + </description> - <security-constraint> - <display-name>Restricted</display-name> - <web-resource-collection> - <web-resource-name>Restricted Access</web-resource-name> - <url-pattern>/*</url-pattern> - </web-resource-collection> - <auth-constraint> - <role-name>Employee</role-name> - </auth-constraint> - <user-data-constraint> - <transport-guarantee>NONE</transport-guarantee> - </user-data-constraint> - </security-constraint> +  + <security-constraint> + <web-resource-collection> + <web-resource-name>EMPLOYEE Application</web-resource-name> + <url-pattern>/*</url-pattern> + </web-resource-collection> + <auth-constraint> + <role-name>manager</role-name> + </auth-constraint> + </security-constraint> - <security-role> - <role-name>Employee</role-name> - </security-role> +  + <security-constraint> + <web-resource-collection> + <web-resource-name>freezone</web-resource-name> + <url-pattern>/freezone/*</url-pattern> + </web-resource-collection> + </security-constraint> - <login-config> - <auth-method>FORM</auth-method> - <form-login-config> - <form-login-page>/login.jsp</form-login-page> - <form-error-page>/error.jsp</form-error-page> - </form-login-config> - </login-config> +  + <login-config> + <auth-method>FORM</auth-method> + <realm-name>Tomcat EMPLOYEE Application</realm-name> + <form-login-config> + <form-login-page>/jsp/login.jsp</form-login-page> + <form-error-page>/jsp/loginerror.jsp</form-error-page> + </form-login-config> + </login-config> + +  + <security-role> + <description> + The role that is required to log in to the EMPLOYEE Application + </description> + <role-name>manager</role-name> + </security-role> </web-app> Modified: identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/index.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/index.jsp 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/employee/src/main/webapp/index.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -7,7 +7,7 @@ Here is your cartoon of the day: <br/> <img src="careermap.jpg"/> +<br/> +<a href="?GLO=true">Click to LogOut</a> -<br/> -<a href="logout.jsp">Click to LogOut</a> </div> Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.project =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.project (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.project 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,13 @@ +<projectDescription> + <name>sales-post-sig</name> + <comment>JBoss Identity Samples contains the samples for Federated Identity Needs.</comment> + <projects/> + <buildSpec> + <buildCommand> + <name>org.eclipse.jdt.core.javabuilder</name> + </buildCommand> + </buildSpec> + <natures> + <nature>org.eclipse.jdt.core.javanature</nature> + </natures> +</projectDescription> \ No newline at end of file Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings/org.eclipse.jdt.core.prefs =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings/org.eclipse.jdt.core.prefs (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/.settings/org.eclipse.jdt.core.prefs 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,5 @@ +#Fri Aug 14 00:41:14 CDT 2009 +org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.5 +eclipse.preferences.version=1 +org.eclipse.jdt.core.compiler.source=1.5 +org.eclipse.jdt.core.compiler.compliance=1.5 Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/pom.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/pom.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/pom.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,38 @@ +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> + <parent> + <groupId>org.jboss.identity</groupId> + <artifactId>jboss-identity-federation-webapps</artifactId> + <version>1.0.0.beta2-SNAPSHOT</version> + <relativePath>../</relativePath> + </parent> + + <modelVersion>4.0.0</modelVersion> + <artifactId>employee-post-sig</artifactId> + <packaging>war</packaging> + <name>JBoss Identity Federation Employee App with http post signature</name> + <url>http://labs.jboss.org/portal/jbosssecurity/</url> + <description>JBoss Identity Samples contains the samples for Federated Identity Needs.</description> + <licenses> + <license> + <name>lgpl</name> + <url>http://repository.jboss.com/licenses/lgpl.txt</url> + </license> + </licenses> + <organization> + <name>JBoss Inc.</name> + <url>http://www.jboss.org</url> + </organization> + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-war-plugin</artifactId> + <version>2.0.2</version> + <configuration> + <warName>employee-post-sig</warName> + <warSourceExcludes>WEB-INF/lib/*.jar</warSourceExcludes> + </configuration> + </plugin> + </plugins> + </build> +</project> Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/resources ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/MANIFEST.MF =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/MANIFEST.MF (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/MANIFEST.MF 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,3 @@ +Manifest-Version: 1.0 +Class-Path: + Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/context.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/context.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/context.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<Context> + <Valve className="org.jboss.identity.federation.bindings.tomcat.sp.SPPostFormAuthenticator" + /> +</Context> Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/jbid_test_keystore.jks =================================================================== (Binary files differ) Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/META-INF/jbid_test_keystore.jks ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/context.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/context.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/context.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<Context> + <Valve className="org.jboss.identity.federation.bindings.tomcat.sp.SPPostFormAuthenticator" + /> +</Context> Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jboss-idfed.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jboss-idfed.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/jboss-idfed.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,13 @@ +<JBossSP xmlns="urn:jboss:identity-federation:config:1.0" ServerEnvironment="tomcat"> + <IdentityURL>http://localhost:8080/idp-sig/</IdentityURL> + <ServiceURL>http://localhost:8080/sales-post-sig/</ServiceURL> + <KeyProvider ClassName="org.jboss.identity.federation.core.impl.KeyStoreKeyManager"> + <Auth Key="KeyStoreURL" Value="/jbid_test_keystore.jks" /> + <Auth Key="KeyStorePass" Value="store123" /> + <Auth Key="SigningKeyPass" Value="test123" /> + <Auth Key="SigningKeyAlias" Value="servercert" /> + <ValidatingAlias Key="localhost" Value="servercert"/> + <ValidatingAlias Key="127.0.0.1" Value="servercert"/> + </KeyProvider> + +</JBossSP> Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/lib ___________________________________________________________________ Name: svn:ignore + .settings .metadata .classpath target .property Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/web.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/web.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/WEB-INF/web.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,48 @@ +<?xml version="1.0" encoding="ISO-8859-1"?> +<web-app xmlns="http://java.sun.com/xml/ns/javaee" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" + version="2.5"> + + <display-name>Fedbridge Test SALES Application</display-name> + <description> + Just a Test SP for Fedbridge Project + </description> + +  + <security-constraint> + <web-resource-collection> + <web-resource-name>SALES Application</web-resource-name> + <url-pattern>/*</url-pattern> + </web-resource-collection> + <auth-constraint> + <role-name>manager</role-name> + </auth-constraint> + </security-constraint> + +  + <security-constraint> + <web-resource-collection> + <web-resource-name>freezone</web-resource-name> + <url-pattern>/freezone/*</url-pattern> + </web-resource-collection> + </security-constraint> + +  + <login-config> + <auth-method>FORM</auth-method> + <realm-name>Tomcat SALES Application</realm-name> + <form-login-config> + <form-login-page>/jsp/login.jsp</form-login-page> + <form-error-page>/jsp/loginerror.jsp</form-error-page> + </form-login-config> + </login-config> + +  + <security-role> + <description> + The role that is required to log in to the Manager Application + </description> + <role-name>manager</role-name> + </security-role> +</web-app> Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/error.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/error.jsp (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/error.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,12 @@ +<html> <head> <title>Error!</title></head> +<body> + +<font size='4' color='red'> + The username and password you supplied are not valid. +</p> +Click <a href='<%= response.encodeURL("login.jsp") %>'>here</a> +to retry login + +</body> +</form> +</html> Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/index.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/index.jsp (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/index.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,14 @@ +<div align="center"> +<h1>SalesTool</h1> +<br/> +Welcome to the Sales Tool, <%=request.getUserPrincipal().getName()%> + +<br/> +Here is your sales chart: +<br/> +<img src="piechart.gif"/> + +<br/> +<a href="?GLO=true">Click to LogOut</a> + +</div> Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/login.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/login.jsp (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/login.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,16 @@ +<html><head><title>Login Page</title></head> +<body> +<font size='5' color='blue'>Please Login</font><hr> + +<form action='j_security_check' method='post'> +<table> + <tr><td>Name:</td> + <td><input type='text' name='j_username'></td></tr> + <tr><td>Password:</td> + <td><input type='password' name='j_password' size='8'></td> + </tr> +</table> +<br> + <input type='submit' value='login'> +</form></body> + </html> Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/logout.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/logout.jsp (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/logout.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<% + session.invalidate(); +%> +You are logged out. Added: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/piechart.gif =================================================================== (Binary files differ) Property changes on: identity-federation/trunk/jboss-identity-webapps/employee-post-sig/src/main/webapp/piechart.gif ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Modified: identity-federation/trunk/jboss-identity-webapps/pom.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/pom.xml 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/pom.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -26,6 +26,7 @@ <module>sales</module> <module>sales-sig</module> <module>sales-post-sig</module> + <module>employee-post-sig</module> <module>sales-standalone</module> <module>employee</module> <module>circleoftrust</module> Added: identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/jbid-handlers.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/web.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/web.xml 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/WEB-INF/web.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -1,41 +1,48 @@ -<?xml version="1.0" encoding="UTF-8"?> -<web-app version="2.4" - xmlns="http://java.sun.com/xml/ns/j2ee" +<?xml version="1.0" encoding="ISO-8859-1"?> +<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee - http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> + xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" + version="2.5"> - <description>Sales Application</description> + <display-name>Fedbridge Test SALES Application</display-name> + <description> + Just a Test SP for Fedbridge Project + </description> - <security-constraint> - <display-name>Restricted</display-name> - <web-resource-collection> - <web-resource-name>Restricted Access</web-resource-name> - <url-pattern>/*</url-pattern> - </web-resource-collection> - <auth-constraint> - <role-name>Sales</role-name> - </auth-constraint> - <user-data-constraint> - <transport-guarantee>NONE</transport-guarantee> - </user-data-constraint> - </security-constraint> +  + <security-constraint> + <web-resource-collection> + <web-resource-name>SALES Application</web-resource-name> + <url-pattern>/*</url-pattern> + </web-resource-collection> + <auth-constraint> + <role-name>manager</role-name> + </auth-constraint> + </security-constraint> - <security-role> - <role-name>Sales</role-name> - </security-role> - <security-role> - <role-name>Employee</role-name> - </security-role> - <security-role> - <role-name>manager</role-name> - </security-role> +  + <security-constraint> + <web-resource-collection> + <web-resource-name>freezone</web-resource-name> + <url-pattern>/freezone/*</url-pattern> + </web-resource-collection> + </security-constraint> - <login-config> - <auth-method>FORM</auth-method> - <form-login-config> - <form-login-page>/login.jsp</form-login-page> - <form-error-page>/error.jsp</form-error-page> - </form-login-config> - </login-config> +  + <login-config> + <auth-method>FORM</auth-method> + <realm-name>Tomcat SALES Application</realm-name> + <form-login-config> + <form-login-page>/jsp/login.jsp</form-login-page> + <form-error-page>/jsp/loginerror.jsp</form-error-page> + </form-login-config> + </login-config> + +  + <security-role> + <description> + The role that is required to log in to the Manager Application + </description> + <role-name>manager</role-name> + </security-role> </web-app> Modified: identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/index.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/index.jsp 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/sales/src/main/webapp/index.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -9,5 +9,6 @@ <img src="piechart.gif"/> <br/> -<a href="logout.jsp">Click to LogOut</a> +<a href="?GLO=true">Click to LogOut</a> + </div> Added: identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/jbid-handlers.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -0,0 +1,4 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/web.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/web.xml 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/WEB-INF/web.xml 2009-10-27 17:18:50 UTC (rev 873) @@ -1,40 +1,48 @@ -<?xml version="1.0" encoding="UTF-8"?> -<web-app version="2.4" - xmlns="http://java.sun.com/xml/ns/j2ee" +<?xml version="1.0" encoding="ISO-8859-1"?> +<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee - http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> + xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" + version="2.5"> - <description>Sales Application</description> + <display-name>Fedbridge Test SALES Application</display-name> + <description> + Just a Test SP for Fedbridge Project + </description> - <security-constraint> - <display-name>Restricted</display-name> - <web-resource-collection> - <web-resource-name>Restricted Access</web-resource-name> - <url-pattern>/*</url-pattern> - </web-resource-collection> - <auth-constraint> - <role-name>Sales</role-name> - <role-name>manager</role-name> - </auth-constraint> - <user-data-constraint> - <transport-guarantee>NONE</transport-guarantee> - </user-data-constraint> - </security-constraint> +  + <security-constraint> + <web-resource-collection> + <web-resource-name>SALES Application</web-resource-name> + <url-pattern>/*</url-pattern> + </web-resource-collection> + <auth-constraint> + <role-name>manager</role-name> + </auth-constraint> + </security-constraint> - <security-role> - <role-name>Sales</role-name> - </security-role> +  + <security-constraint> + <web-resource-collection> + <web-resource-name>freezone</web-resource-name> + <url-pattern>/freezone/*</url-pattern> + </web-resource-collection> + </security-constraint> - <security-role> - <role-name>manager</role-name> - </security-role> +  + <login-config> + <auth-method>FORM</auth-method> + <realm-name>Tomcat SALES Application</realm-name> + <form-login-config> + <form-login-page>/jsp/login.jsp</form-login-page> + <form-error-page>/jsp/loginerror.jsp</form-error-page> + </form-login-config> + </login-config> - <login-config> - <auth-method>FORM</auth-method> - <form-login-config> - <form-login-page>/login.jsp</form-login-page> - <form-error-page>/error.jsp</form-error-page> - </form-login-config> - </login-config> +  + <security-role> + <description> + The role that is required to log in to the Manager Application + </description> + <role-name>manager</role-name> + </security-role> </web-app> Modified: identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/index.jsp =================================================================== --- identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/index.jsp 2009-10-26 21:25:37 UTC (rev 872) +++ identity-federation/trunk/jboss-identity-webapps/sales-post-sig/src/main/webapp/index.jsp 2009-10-27 17:18:50 UTC (rev 873) @@ -9,5 +9,6 @@ <img src="piechart.gif"/> <br/> -<a href="logout.jsp">Click to LogOut</a> +<a href="?GLO=true">Click to LogOut</a> + </div>

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r872 - in identity-federation/trunk: jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp and 4 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-26 17:25:37 -0400 (Mon, 26 Oct 2009) New Revision: 872 Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPSAMLDebugValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java Log: use constants Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-10-26 21:25:37 UTC (rev 872) @@ -284,7 +284,7 @@ private boolean hasSAMLRequestMessage(Request request) { - return request.getParameter("SAMLRequest") != null; + return request.getParameter(GeneralConstants.SAML_REQUEST_KEY) != null; } private RequestAbstractType getSAMLRequest(Request request) throws ParsingException, IOException @@ -443,7 +443,7 @@ private String getSAMLMessage(Request request) { - return request.getParameter("SAMLRequest"); + return request.getParameter(GeneralConstants.SAML_REQUEST_KEY); } //***************Catalina Lifecyle methods Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPSAMLDebugValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPSAMLDebugValve.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPSAMLDebugValve.java 2009-10-26 21:25:37 UTC (rev 872) @@ -29,6 +29,7 @@ import org.apache.catalina.connector.Response; import org.apache.catalina.valves.ValveBase; import org.apache.log4j.Logger; +import org.jboss.identity.federation.web.constants.GeneralConstants; /** * Debug Valve on the IDP end that will @@ -46,9 +47,10 @@ throws IOException, ServletException { StringBuilder builder = new StringBuilder(); - String param = request.getParameter("SAMLRequest"); + String param = request.getParameter(GeneralConstants.SAML_REQUEST_KEY); builder.append("Method = " + request.getMethod()).append("\n"); builder.append("SAMLRequest=" + param).append("\n"); + builder.append("SAMLResponse=" + request.getParameter(GeneralConstants.SAML_RESPONSE_KEY)).append("\n"); builder.append("Parameter exists?="+ param != null).append("\n"); String debugInfo = builder.toString(); if(debugEnabled) Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-26 21:25:37 UTC (rev 872) @@ -182,8 +182,8 @@ if(isNotNull(relayState)) relayState = RedirectBindingUtil.urlDecode(relayState); - String samlRequestMessage = request.getParameter("SAMLRequest"); - String samlResponseMessage = request.getParameter("SAMLResponse"); + String samlRequestMessage = request.getParameter(GeneralConstants.SAML_REQUEST_KEY); + String samlResponseMessage = request.getParameter(GeneralConstants.SAML_RESPONSE_KEY); String signature = request.getParameter("Signature"); String sigAlg = request.getParameter("SigAlg"); @@ -197,9 +197,9 @@ { if(trace) log.trace("Storing the SAMLRequest/SAMLResponse and RelayState in session"); if(isNotNull(samlRequestMessage)) - session.setNote("SAMLRequest", samlRequestMessage); + session.setNote(GeneralConstants.SAML_REQUEST_KEY, samlRequestMessage); if(isNotNull(samlResponseMessage)) - session.setNote("SAMLResponse", samlResponseMessage); + session.setNote(GeneralConstants.SAML_RESPONSE_KEY, samlResponseMessage); if(isNotNull(relayState)) session.setNote(GeneralConstants.RELAY_STATE, relayState.trim()); if(isNotNull(signature)) @@ -263,9 +263,9 @@ * we can retrieve the original saml message as well as * any relay state from the SP */ - samlRequestMessage = (String) session.getNote("SAMLRequest"); + samlRequestMessage = (String) session.getNote(GeneralConstants.SAML_REQUEST_KEY); - samlResponseMessage = (String) session.getNote("SAMLResponse"); + samlResponseMessage = (String) session.getNote(GeneralConstants.SAML_RESPONSE_KEY); relayState = (String) session.getNote(GeneralConstants.RELAY_STATE); signature = (String) session.getNote("Signature"); sigAlg = (String) session.getNote("sigAlg"); @@ -283,9 +283,9 @@ } if(isNotNull(samlRequestMessage)) - session.removeNote("SAMLRequest"); + session.removeNote(GeneralConstants.SAML_REQUEST_KEY); if(isNotNull(samlResponseMessage)) - session.removeNote("SAMLResponse"); + session.removeNote(GeneralConstants.SAML_RESPONSE_KEY); if(isNotNull(relayState)) session.removeNote(GeneralConstants.RELAY_STATE); Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-26 21:25:37 UTC (rev 872) @@ -107,8 +107,8 @@ String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); boolean logOutRequest = isNotNull(gloStr) && "true".equalsIgnoreCase(gloStr); - String samlRequest = request.getParameter("SAMLRequest"); - String samlResponse = request.getParameter("SAMLResponse"); + String samlRequest = request.getParameter(GeneralConstants.SAML_REQUEST_KEY); + String samlResponse = request.getParameter(GeneralConstants.SAML_RESPONSE_KEY); Principal principal = request.getUserPrincipal(); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-26 21:25:37 UTC (rev 872) @@ -54,6 +54,9 @@ String ROLE_VALIDATOR = "ROLE_VALIDATOR"; String ROLE_VALIDATOR_IGNORE = "ROLE_VALIDATOR_IGNORE"; + String SAML_REQUEST_KEY = "SAMLRequest"; + String SAML_RESPONSE_KEY = "SAMLResponse"; + String SENDER_PUBLIC_KEY = "SENDER_PUBLIC_KEY"; String SIGN_OUTGOING_MESSAGES = "SIGN_OUTGOING_MESSAGES"; Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-26 21:25:37 UTC (rev 872) @@ -155,8 +155,8 @@ Principal userPrincipal = (Principal) session.getAttribute(GeneralConstants.PRINCIPAL_ID);; - String samlRequest = request.getParameter("SAMLRequest"); - String samlResponse = request.getParameter("SAMLResponse"); + String samlRequest = request.getParameter(GeneralConstants.SAML_REQUEST_KEY); + String samlResponse = request.getParameter(GeneralConstants.SAML_RESPONSE_KEY); //Eagerly look for Global LogOut String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java 2009-10-26 21:25:37 UTC (rev 872) @@ -69,7 +69,7 @@ if(username == null || passwd == null) { - String samlMessage = request.getParameter("SAMLRequest"); + String samlMessage = request.getParameter(GeneralConstants.SAML_REQUEST_KEY); if(samlMessage == null || "".equals(samlMessage)) response.sendError(HttpServletResponse.SC_BAD_REQUEST); @@ -145,8 +145,10 @@ private void saveRequest(HttpServletRequest request, HttpSession session) { //Save the SAMLRequest and relayState - session.setAttribute("SAMLRequest", request.getParameter("SAMLRequest")); - session.setAttribute("SAMLResponse", request.getParameter("SAMLResponse")); + session.setAttribute(GeneralConstants.SAML_REQUEST_KEY, + request.getParameter(GeneralConstants.SAML_REQUEST_KEY)); + session.setAttribute(GeneralConstants.SAML_RESPONSE_KEY, + request.getParameter(GeneralConstants.SAML_RESPONSE_KEY)); String relayState = request.getParameter(GeneralConstants.RELAY_STATE); if(relayState != null && !"".equals(relayState)) Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-26 21:25:37 UTC (rev 872) @@ -244,8 +244,8 @@ //Some issue with filters and servlets HttpSession session = request.getSession(false); - String samlRequestMessage = (String) session.getAttribute("SAMLRequest"); - String samlResponseMessage = (String) session.getAttribute("SAMLResponse"); + String samlRequestMessage = (String) session.getAttribute(GeneralConstants.SAML_REQUEST_KEY); + String samlResponseMessage = (String) session.getAttribute(GeneralConstants.SAML_RESPONSE_KEY); String relayState = (String) session.getAttribute(GeneralConstants.RELAY_STATE); String referer = request.getHeader("Referer"); @@ -276,8 +276,8 @@ log.trace("saml Request message=" + samlRequestMessage + "::relay state="+ relayState); log.trace("saml Response message=" + samlResponseMessage + "::relay state="+ relayState); } - session.removeAttribute("SAMLRequest"); - session.removeAttribute("SAMLResponse"); + session.removeAttribute(GeneralConstants.SAML_REQUEST_KEY); + session.removeAttribute(GeneralConstants.SAML_RESPONSE_KEY); if(isNotNull(relayState)) session.removeAttribute(GeneralConstants.RELAY_STATE); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-26 21:04:11 UTC (rev 871) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-26 21:25:37 UTC (rev 872) @@ -29,6 +29,7 @@ import org.apache.log4j.Logger; import org.jboss.identity.federation.api.util.Base64; import org.jboss.identity.federation.core.saml.v2.holders.DestinationInfoHolder; +import org.jboss.identity.federation.web.constants.GeneralConstants; import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; @@ -66,7 +67,8 @@ boolean request) throws IOException { - String key = request ? "SAMLRequest" : "SAMLResponse"; + String key = request ? GeneralConstants.SAML_REQUEST_KEY + : GeneralConstants.SAML_RESPONSE_KEY; String relayState = holder.getRelayState(); String destination = holder.getDestination();

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r871 - in identity-federation/trunk: jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp and 7 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-26 17:04:11 -0400 (Mon, 26 Oct 2009) New Revision: 871 Added: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectTomcatWorkflowUnitTestCase.java Removed: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/RolesGenerationHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java identity-federation/trunk/jboss-identity-web/src/test/java/org/jboss/test/identity/federation/web/workflow/saml2/SAML2LogoutWorkflowUnitTestCase.java Log: JBID-40: saml logout profile Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-10-26 21:04:11 UTC (rev 871) @@ -64,6 +64,7 @@ import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.util.ConfigurationUtil; import org.jboss.identity.federation.web.util.HTTPRedirectUtil; import org.jboss.identity.federation.web.util.RedirectBindingUtil; @@ -131,7 +132,8 @@ ResponseType errorResponseType = this.getErrorResponse(referer, JBossSAMLURIConstants.STATUS_AUTHNFAILED.get()); try { - send(errorResponseType, request.getParameter("RelayState"), response); + send(errorResponseType, + request.getParameter(GeneralConstants.RELAY_STATE), response); } catch (ParsingException e) { @@ -162,7 +164,7 @@ this.isTrusted(requestAbstractType.getIssuer().getValue()); ResponseType responseType = this.getResponse(request, userPrincipal); - send(responseType, request.getParameter("RelayState"), response); + send(responseType, request.getParameter(GeneralConstants.RELAY_STATE), response); } catch (Exception e) { @@ -172,7 +174,7 @@ ResponseType errorResponseType = this.getErrorResponse(referer, JBossSAMLURIConstants.STATUS_RESPONDER.get()); try { - send(errorResponseType, request.getParameter("RelayState"), response); + send(errorResponseType, request.getParameter(GeneralConstants.RELAY_STATE), response); } catch (ParsingException e1) { Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-26 21:04:11 UTC (rev 871) @@ -177,7 +177,7 @@ public void invoke(Request request, Response response) throws IOException, ServletException { String referer = request.getHeader("Referer"); - String relayState = request.getParameter("RelayState"); + String relayState = request.getParameter(GeneralConstants.RELAY_STATE); if(isNotNull(relayState)) relayState = RedirectBindingUtil.urlDecode(relayState); @@ -201,7 +201,7 @@ if(isNotNull(samlResponseMessage)) session.setNote("SAMLResponse", samlResponseMessage); if(isNotNull(relayState)) - session.setNote("RelayState", relayState.trim()); + session.setNote(GeneralConstants.RELAY_STATE, relayState.trim()); if(isNotNull(signature)) session.setNote("Signature", signature.trim()); if(isNotNull(sigAlg)) @@ -266,7 +266,7 @@ samlRequestMessage = (String) session.getNote("SAMLRequest"); samlResponseMessage = (String) session.getNote("SAMLResponse"); - relayState = (String) session.getNote("RelayState"); + relayState = (String) session.getNote(GeneralConstants.RELAY_STATE); signature = (String) session.getNote("Signature"); sigAlg = (String) session.getNote("sigAlg"); @@ -288,7 +288,7 @@ session.removeNote("SAMLResponse"); if(isNotNull(relayState)) - session.removeNote("RelayState"); + session.removeNote(GeneralConstants.RELAY_STATE); if(isNotNull(signature)) session.removeNote("Signature"); Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java 2009-10-26 21:04:11 UTC (rev 871) @@ -54,6 +54,7 @@ import org.jboss.identity.federation.saml.v2.assertion.EncryptedElementType; import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.util.PostBindingUtil; import org.jboss.identity.federation.web.util.ServerDetector; import org.xml.sax.SAXException; @@ -96,7 +97,7 @@ } Session session = request.getSessionInternal(true); - String relayState = request.getParameter("RelayState"); + String relayState = request.getParameter(GeneralConstants.RELAY_STATE); //Try to get the username try Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-26 21:04:11 UTC (rev 871) @@ -103,21 +103,27 @@ @Override public boolean authenticate(Request request, Response response, LoginConfig loginConfig) throws IOException { + //Eagerly look for Global LogOut + String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); + boolean logOutRequest = isNotNull(gloStr) && "true".equalsIgnoreCase(gloStr); + + String samlRequest = request.getParameter("SAMLRequest"); + String samlResponse = request.getParameter("SAMLResponse"); + Principal principal = request.getUserPrincipal(); + //If we have already authenticated the user and there is no request from IDP or logout from user + if(principal != null && !(logOutRequest || isNotNull(samlRequest) || isNotNull(samlResponse) ) ) + return true; + SAML2Request saml2Request = new SAML2Request(); Session session = request.getSessionInternal(true); - String relayState = request.getParameter("RelayState"); + String relayState = request.getParameter(GeneralConstants.RELAY_STATE); - String samlRequest = request.getParameter("SAMLRequest"); - String samlResponse = request.getParameter("SAMLResponse"); - //Eagerly look for Global LogOut - String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); - boolean logOutRequest = isNotNull(gloStr) && "true".equalsIgnoreCase(gloStr); - + /* if(!logOutRequest) {*/ /* if (principal != null) @@ -242,6 +248,7 @@ getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + return false; } catch (Exception e) { @@ -249,7 +256,6 @@ log.trace("Exception:",e); throw new IOException("Server Error"); } - return true; } } @@ -327,6 +333,21 @@ } else { + //See if the session has been invalidated + + boolean sessionValidity = session.isValid(); + if(!sessionValidity) + { + //we are invalidated. + RequestDispatcher dispatch = context.getServletContext().getRequestDispatcher(this.logOutPage); + if(dispatch == null) + log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); + else + dispatch.forward(request, response); + return false; + } + + //We got a response with the principal List<String> roles = saml2HandlerResponse.getRoles(); if(principal == null) @@ -359,19 +380,7 @@ return true; } - //See if the session has been invalidated - - boolean sessionValidity = session.isValid(); - if(!sessionValidity) - { - //we are invalidated. - RequestDispatcher dispatch = context.getServletContext().getRequestDispatcher(this.logOutPage); - if(dispatch == null) - log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); - else - dispatch.forward(request, response); - return false; - } + } catch (Exception e) { Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-10-26 21:04:11 UTC (rev 871) @@ -46,6 +46,7 @@ import org.jboss.identity.federation.core.util.XMLEncryptionUtil; import org.jboss.identity.federation.saml.v2.assertion.EncryptedElementType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.util.RedirectBindingSignatureUtil; import org.w3c.dom.Document; import org.w3c.dom.Element; @@ -113,7 +114,8 @@ //Construct the url again String reqFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "SAMLResponse"); - String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "RelayState"); + String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, + GeneralConstants.RELAY_STATE); String sigAlgFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "SigAlg"); StringBuilder sb = new StringBuilder(); Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java 2009-10-26 21:04:11 UTC (rev 871) @@ -114,7 +114,7 @@ public boolean isValid() { - return false; + return this.valid; } public void recycle() Added: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectTomcatWorkflowUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectTomcatWorkflowUnitTestCase.java (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectTomcatWorkflowUnitTestCase.java 2009-10-26 21:04:11 UTC (rev 871) @@ -0,0 +1,151 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.test.identity.federation.bindings.workflow; + +import java.net.URL; +import java.security.Principal; +import java.util.ArrayList; +import java.util.List; + +import junit.framework.TestCase; + +import org.apache.catalina.realm.GenericPrincipal; +import org.jboss.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve; +import org.jboss.identity.federation.bindings.tomcat.sp.SPRedirectFormAuthenticator; +import org.jboss.identity.federation.web.constants.GeneralConstants; +import org.jboss.identity.federation.web.util.RedirectBindingUtil; +import org.jboss.test.identity.federation.bindings.mock.*; + +/** + * Unit test for the Workflow for the SAML2 Redirect Binding + * @author Anil.Saldhana(a)redhat.com + * @since Oct 20, 2009 + */ +public class SAML2RedirectTomcatWorkflowUnitTestCase extends TestCase +{ + private String profile = "saml2/redirect"; + private ClassLoader tcl = Thread.currentThread().getContextClassLoader(); + private String employee = "http://localhost:8080/employee/"; + + private String SAML_REQUEST_KEY = "SAMLRequest="; + + private String SAML_RESPONSE_KEY = "SAMLResponse="; + + public void testSAML2Redirect() throws Exception + { + MockCatalinaContextClassLoader mclSPEmp = setupTCL(profile + "/sp/employee"); + Thread.currentThread().setContextClassLoader(mclSPEmp); + + SPRedirectFormAuthenticator sp = new SPRedirectFormAuthenticator(); + + MockCatalinaContext context = new MockCatalinaContext(); + MockCatalinaRequest request = new MockCatalinaRequest(); + + request.setParameter(GeneralConstants.RELAY_STATE, null); + + MockCatalinaResponse response = new MockCatalinaResponse(); + MockCatalinaLoginConfig loginConfig = new MockCatalinaLoginConfig(); + + sp.setContainer(context); + sp.testStart(); + + sp.authenticate(request, response, loginConfig); + + String redirectStr = response.redirectString; + assertNotNull("Redirect String is null?", redirectStr); + String saml = redirectStr.substring(redirectStr.indexOf(SAML_REQUEST_KEY) + + SAML_REQUEST_KEY.length()); + + MockCatalinaSession session = new MockCatalinaSession(); + + //Now send it to IDP + MockCatalinaRealm realm = new MockCatalinaRealm("anil", "test", new Principal() + { + public String getName() + { + return "anil"; + } + }); + + List<String> roles = new ArrayList<String>(); + roles.add("manager"); + roles.add("employee"); + + MockCatalinaContextClassLoader mclIDP = setupTCL(profile + "/idp/"); + Thread.currentThread().setContextClassLoader(mclIDP); + + request = new MockCatalinaRequest(); + request.setRemoteAddr(employee); + request.setSession(session); + request.setParameter("SAMLRequest", RedirectBindingUtil.urlDecode(saml)); + request.setUserPrincipal(new GenericPrincipal(realm, "anil", "test", roles) ); + request.setMethod("GET"); + + response = new MockCatalinaResponse(); + + IDPWebBrowserSSOValve idp = new IDPWebBrowserSSOValve(); + + idp.setSignOutgoingMessages(false); + + idp.setContainer(context); + idp.start(); + idp.invoke(request, response); + + redirectStr = response.redirectString; + String samlResponse = RedirectBindingUtil.urlDecode(redirectStr.substring(redirectStr.indexOf(SAML_RESPONSE_KEY) + + SAML_RESPONSE_KEY.length())); + + mclSPEmp = setupTCL(profile + "/sp/employee"); + Thread.currentThread().setContextClassLoader(mclSPEmp); + + sp = new SPRedirectFormAuthenticator(); + + context = new MockCatalinaContext(); + + context.setRealm(realm); + request = new MockCatalinaRequest(); + request.setContext(context); + + request.setMethod("GET"); + request.setParameter("SAMLResponse", samlResponse); + request.setParameter("RelayState", null); + request.setSession(session); + + response = new MockCatalinaResponse(); + loginConfig = new MockCatalinaLoginConfig(); + + sp.setContainer(context); + sp.testStart(); + + assertTrue("Employee app auth success", sp.authenticate(request, response, loginConfig) ); + } + + private MockCatalinaContextClassLoader setupTCL(String resource) + { + URL[] urls = new URL[] {tcl.getResource(resource)}; + + MockCatalinaContextClassLoader mcl = new MockCatalinaContextClassLoader(urls); + mcl.setDelegate(tcl); + mcl.setProfile(resource); + return mcl; + } +} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java 2009-10-26 21:04:11 UTC (rev 871) @@ -1,149 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.test.identity.federation.bindings.workflow; - -import java.net.URL; -import java.security.Principal; -import java.util.ArrayList; -import java.util.List; - -import junit.framework.TestCase; - -import org.apache.catalina.realm.GenericPrincipal; -import org.jboss.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve; -import org.jboss.identity.federation.bindings.tomcat.sp.SPRedirectFormAuthenticator; -import org.jboss.identity.federation.web.util.RedirectBindingUtil; -import org.jboss.test.identity.federation.bindings.mock.*; - -/** - * @author Anil.Saldhana(a)redhat.com - * @since Oct 20, 2009 - */ -public class SAML2RedirectWorkflowUnitTestCase extends TestCase -{ - private String profile = "saml2/redirect"; - private ClassLoader tcl = Thread.currentThread().getContextClassLoader(); - private String employee = "http://localhost:8080/employee/"; - - private String SAML_REQUEST_KEY = "SAMLRequest="; - - private String SAML_RESPONSE_KEY = "SAMLResponse="; - - public void testSAML2Redirect() throws Exception - { - MockCatalinaContextClassLoader mclSPEmp = setupTCL(profile + "/sp/employee"); - Thread.currentThread().setContextClassLoader(mclSPEmp); - - SPRedirectFormAuthenticator sp = new SPRedirectFormAuthenticator(); - - MockCatalinaContext context = new MockCatalinaContext(); - MockCatalinaRequest request = new MockCatalinaRequest(); - - request.setParameter("RelayState", null); - - MockCatalinaResponse response = new MockCatalinaResponse(); - MockCatalinaLoginConfig loginConfig = new MockCatalinaLoginConfig(); - - sp.setContainer(context); - sp.testStart(); - - sp.authenticate(request, response, loginConfig); - - String redirectStr = response.redirectString; - assertNotNull("Redirect String is null?", redirectStr); - String saml = redirectStr.substring(redirectStr.indexOf(SAML_REQUEST_KEY) + - SAML_REQUEST_KEY.length()); - - MockCatalinaSession session = new MockCatalinaSession(); - - //Now send it to IDP - MockCatalinaRealm realm = new MockCatalinaRealm("anil", "test", new Principal() - { - public String getName() - { - return "anil"; - } - }); - - List<String> roles = new ArrayList<String>(); - roles.add("manager"); - roles.add("employee"); - - MockCatalinaContextClassLoader mclIDP = setupTCL(profile + "/idp/"); - Thread.currentThread().setContextClassLoader(mclIDP); - - request = new MockCatalinaRequest(); - request.setRemoteAddr(employee); - request.setSession(session); - request.setParameter("SAMLRequest", RedirectBindingUtil.urlDecode(saml)); - request.setUserPrincipal(new GenericPrincipal(realm, "anil", "test", roles) ); - request.setMethod("GET"); - - response = new MockCatalinaResponse(); - - IDPWebBrowserSSOValve idp = new IDPWebBrowserSSOValve(); - - idp.setSignOutgoingMessages(false); - - idp.setContainer(context); - idp.start(); - idp.invoke(request, response); - - redirectStr = response.redirectString; - String samlResponse = RedirectBindingUtil.urlDecode(redirectStr.substring(redirectStr.indexOf(SAML_RESPONSE_KEY) + - SAML_RESPONSE_KEY.length())); - - mclSPEmp = setupTCL(profile + "/sp/employee"); - Thread.currentThread().setContextClassLoader(mclSPEmp); - - sp = new SPRedirectFormAuthenticator(); - - context = new MockCatalinaContext(); - - context.setRealm(realm); - request = new MockCatalinaRequest(); - request.setContext(context); - - request.setMethod("GET"); - request.setParameter("SAMLResponse", samlResponse); - request.setParameter("RelayState", null); - request.setSession(session); - - response = new MockCatalinaResponse(); - loginConfig = new MockCatalinaLoginConfig(); - - sp.setContainer(context); - sp.testStart(); - - assertTrue("Employee app auth success", sp.authenticate(request, response, loginConfig) ); - } - - private MockCatalinaContextClassLoader setupTCL(String resource) - { - URL[] urls = new URL[] {tcl.getResource(resource)}; - - MockCatalinaContextClassLoader mcl = new MockCatalinaContextClassLoader(urls); - mcl.setDelegate(tcl); - mcl.setProfile(resource); - return mcl; - } -} \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-26 21:04:11 UTC (rev 871) @@ -45,7 +45,8 @@ String LOGOUT_PAGE = "LOGOUT_PAGE"; - String PRINCIPAL_ID = "jboss_identity.principal"; + String PRINCIPAL_ID = "jboss_identity.principal"; + String RELAY_STATE = "RelayState"; String ROLES = "ROLES"; String ROLES_ID = "jboss_identity.roles"; Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/RolesGenerationHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/RolesGenerationHandler.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/RolesGenerationHandler.java 2009-10-26 21:04:11 UTC (rev 871) @@ -41,7 +41,7 @@ import org.jboss.identity.federation.web.core.HTTPContext; /** - * Handles the generation of roles + * Handles the generation of roles on the IDP Side * @author Anil.Saldhana(a)redhat.com * @since Oct 7, 2009 */ Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java 2009-10-26 21:04:11 UTC (rev 871) @@ -294,7 +294,7 @@ responseType = this.decryptAssertion(responseType); } - Principal userPrincipal = handleSAMLResponse(responseType); + Principal userPrincipal = handleSAMLResponse(responseType, response); if(userPrincipal == null) { response.setError(403, "User Principal not determined: Forbidden"); @@ -318,7 +318,7 @@ } @SuppressWarnings("unchecked") - private Principal handleSAMLResponse(ResponseType responseType) + private Principal handleSAMLResponse(ResponseType responseType, SAML2HandlerResponse response) throws ProcessingException { if(responseType == null) @@ -368,6 +368,8 @@ roles.add(roleName); } + response.setRoles(roles); + Principal principal = new Principal() { public String getName() Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-26 21:04:11 UTC (rev 871) @@ -223,7 +223,7 @@ HttpSession session = httpContext.getRequest().getSession(false); String sessionID = session.getId(); - String relayState = httpContext.getRequest().getParameter("RelayState"); + String relayState = httpContext.getRequest().getParameter(GeneralConstants.RELAY_STATE); LogoutRequestType logOutRequest = (LogoutRequestType) request.getSAML2Object(); String issuer = logOutRequest.getIssuer().getValue(); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java 2009-10-26 21:04:11 UTC (rev 871) @@ -148,9 +148,9 @@ session.setAttribute("SAMLRequest", request.getParameter("SAMLRequest")); session.setAttribute("SAMLResponse", request.getParameter("SAMLResponse")); - String relayState = request.getParameter("RelayState"); + String relayState = request.getParameter(GeneralConstants.RELAY_STATE); if(relayState != null && !"".equals(relayState)) - session.setAttribute("RelayState", relayState ); + session.setAttribute(GeneralConstants.RELAY_STATE, relayState ); session.setAttribute("Referer", request.getHeader("Referer")); } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-26 21:04:11 UTC (rev 871) @@ -246,7 +246,7 @@ String samlRequestMessage = (String) session.getAttribute("SAMLRequest"); String samlResponseMessage = (String) session.getAttribute("SAMLResponse"); - String relayState = (String) session.getAttribute("RelayState"); + String relayState = (String) session.getAttribute(GeneralConstants.RELAY_STATE); String referer = request.getHeader("Referer"); @@ -280,7 +280,7 @@ session.removeAttribute("SAMLResponse"); if(isNotNull(relayState)) - session.removeAttribute("RelayState"); + session.removeAttribute(GeneralConstants.RELAY_STATE); SAMLDocumentHolder samlDocumentHolder = null; SAML2Object samlObject = null; Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java 2009-10-26 21:04:11 UTC (rev 871) @@ -43,6 +43,7 @@ import org.jboss.identity.federation.core.saml.v2.util.SignatureUtil; import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; import org.w3c.dom.Document; import org.xml.sax.SAXException; @@ -226,7 +227,8 @@ { //Construct the url again String reqFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "SAMLRequest"); - String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "RelayState"); + String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, + GeneralConstants.RELAY_STATE); String sigAlgFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString, "SigAlg"); StringBuilder sb = new StringBuilder(); Modified: identity-federation/trunk/jboss-identity-web/src/test/java/org/jboss/test/identity/federation/web/workflow/saml2/SAML2LogoutWorkflowUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/test/java/org/jboss/test/identity/federation/web/workflow/saml2/SAML2LogoutWorkflowUnitTestCase.java 2009-10-22 17:18:41 UTC (rev 870) +++ identity-federation/trunk/jboss-identity-web/src/test/java/org/jboss/test/identity/federation/web/workflow/saml2/SAML2LogoutWorkflowUnitTestCase.java 2009-10-26 21:04:11 UTC (rev 871) @@ -127,6 +127,20 @@ assertEquals("Match Employee URL", employee, lor.getIssuer().getValue()); } + /** + * In this test case, we preload the IDP with 2 active participants + * namely the Sales app and Employee App. After this, the employee app + * issues a logout request. The IDP is supposed to receive this logout request, + * a) note that there are 2 session participants + * b) issue a logout request to the sales app + * c) the sales app invalidates its session + * d) the sales app issues a logout response (status response type) to the IDP + * e) the IDP sees that we have 1 participant left and because it is the same as the + * original logout requestor, invalidates its session and sends the logout success + * to the employee app. + * f) employee app invalidates its session + * @throws Exception + */ public void testSAML2LogOutFromIDPServlet() throws Exception { MockHttpSession session = new MockHttpSession();

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r870 - in identity-federation/trunk: jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/request and 1 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-22 13:18:41 -0400 (Thu, 22 Oct 2009) New Revision: 870 Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/request/SAML2Request.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java Log: add info to the log out request Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java 2009-10-22 04:52:54 UTC (rev 869) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java 2009-10-22 17:18:41 UTC (rev 870) @@ -204,6 +204,7 @@ LogoutRequestType lor = (LogoutRequestType) saml2Request.getRequestType(stream); assertEquals("Match Employee URL", employee, destination); + assertEquals("Destination exists", employee, lor.getDestination()); //Let us feed the LogOutRequest to the SPFilter MockCatalinaContextClassLoader mclSPEmp = setupTCL(profile + "/sp/employee"); Modified: identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/request/SAML2Request.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/request/SAML2Request.java 2009-10-22 04:52:54 UTC (rev 869) +++ identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/request/SAML2Request.java 2009-10-22 17:18:41 UTC (rev 870) @@ -37,6 +37,7 @@ import org.jboss.identity.federation.core.constants.JBossIdentityFederationConstants; import org.jboss.identity.federation.core.exceptions.ConfigurationException; import org.jboss.identity.federation.core.exceptions.ParsingException; +import org.jboss.identity.federation.core.saml.v2.common.IDGenerator; import org.jboss.identity.federation.core.saml.v2.common.SAMLDocumentHolder; import org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLAuthnRequestFactory; import org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLBaseFactory; @@ -240,6 +241,7 @@ org.jboss.identity.federation.saml.v2.protocol.ObjectFactory of = new org.jboss.identity.federation.saml.v2.protocol.ObjectFactory(); LogoutRequestType lrt = of.createLogoutRequestType(); + lrt.setID(IDGenerator.create("ID_")); lrt.setIssueInstant(XMLTimeUtil.getIssueInstant()); //Create an issuer Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-22 04:52:54 UTC (rev 869) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-22 17:18:41 UTC (rev 870) @@ -266,6 +266,12 @@ LogoutRequestType lort = saml2Request.createLogoutRequest(request.getIssuer().getValue()); + + long assertionValidity = (Long) request.getOptions().get(GeneralConstants.ASSERTIONS_VALIDITY); + + lort.setNotOnOrAfter(XMLTimeUtil.add(lort.getIssueInstant(), assertionValidity)); + lort.setDestination(participant); + response.setResultingDocument(saml2Request.convert(lort)); response.setSendRequest(true); } @@ -368,6 +374,7 @@ { LogoutRequestType lot = samlRequest.createLogoutRequest(request.getIssuer().getValue()); + response.setResultingDocument(samlRequest.convert(lot)); response.setSendRequest(true); }

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r869 - identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-22 00:52:54 -0400 (Thu, 22 Oct 2009) New Revision: 869 Added: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java Log: JBID-40: SAML2 Logout Added: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2LogoutTomcatWorkflowUnitTestCase.java 2009-10-22 04:52:54 UTC (rev 869) @@ -0,0 +1,335 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.test.identity.federation.bindings.workflow; + +import java.io.ByteArrayOutputStream; +import java.io.InputStream; +import java.io.PrintWriter; +import java.io.StringWriter; +import java.net.URL; +import java.security.Principal; +import java.util.ArrayList; +import java.util.List; + +import javax.servlet.http.HttpSession; +import javax.servlet.http.HttpSessionEvent; + +import junit.framework.TestCase; + +import org.apache.catalina.deploy.LoginConfig; +import org.apache.catalina.realm.GenericPrincipal; +import org.jboss.identity.federation.api.saml.v2.request.SAML2Request; +import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; +import org.jboss.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve; +import org.jboss.identity.federation.bindings.tomcat.sp.SPRedirectFormAuthenticator; +import org.jboss.identity.federation.saml.v2.protocol.LogoutRequestType; +import org.jboss.identity.federation.saml.v2.protocol.StatusResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; +import org.jboss.identity.federation.web.core.IdentityServer; +import org.jboss.identity.federation.web.util.RedirectBindingUtil; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaContext; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaContextClassLoader; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaLoginConfig; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaRealm; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaRequest; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaResponse; +import org.jboss.test.identity.federation.bindings.mock.MockCatalinaSession; + +/** + * Unit test the SAML2 Logout Mechanism for Tomcat bindings + * @author Anil.Saldhana(a)redhat.com + * @since Oct 21, 2009 + */ +public class SAML2LogoutTomcatWorkflowUnitTestCase extends TestCase +{ + private String profile = "saml2/logout"; + private ClassLoader tcl = Thread.currentThread().getContextClassLoader(); + + private String IDP = "http://localhost:8080/idp/"; + private String employee = "http://localhost:8080/employee/"; + private String sales = "http://localhost:8080/sales/"; + + + private String RELAY_STATE_KEY = "RelayState="; + private String SAML_REQUEST_KEY = "SAMLRequest="; + private String SAML_RESPONSE_KEY = "SAMLResponse="; + + /** + * Test that the SP Redirect Authenticator generates the logout request + * to the IDP when there is a parameter "GLO" set to true + * @see {@code GeneralConstants#GLOBAL_LOGOUT} + * @throws Exception + */ + public void testSPLogOutRequestGeneration() throws Exception + { + MockCatalinaSession session = new MockCatalinaSession(); + session.setAttribute(GeneralConstants.PRINCIPAL_ID, new Principal() + { + public String getName() + { + return "anil"; + } + }); + List<String> rolesList = new ArrayList<String>(); + rolesList.add("manager"); + session.setAttribute(GeneralConstants.ROLES_ID, rolesList); + + + MockCatalinaContext context = new MockCatalinaContext(); + session.setServletContext(context); + + //Let us feed the LogOutRequest to the SPFilter + MockCatalinaContextClassLoader mclSPEmp = setupTCL(profile + "/sp/employee"); + Thread.currentThread().setContextClassLoader(mclSPEmp); + + SPRedirectFormAuthenticator sp = new SPRedirectFormAuthenticator(); + sp.setContainer(context); + sp.testStart(); + + MockCatalinaRequest catalinaRequest = new MockCatalinaRequest(); + MockCatalinaResponse response = new MockCatalinaResponse(); + MockCatalinaLoginConfig loginConfig = new MockCatalinaLoginConfig(); + + ByteArrayOutputStream filterbaos = new ByteArrayOutputStream(); + response.setWriter(new PrintWriter(filterbaos)); + catalinaRequest.setParameter(GeneralConstants.GLOBAL_LOGOUT, "true"); + sp.authenticate(catalinaRequest, response, loginConfig); + + String redirectStr = response.redirectString; + String logoutRequest = redirectStr.substring(redirectStr.indexOf(SAML_REQUEST_KEY) + + SAML_REQUEST_KEY.length()) ; + + + InputStream stream = RedirectBindingUtil.urlBase64DeflateDecode(logoutRequest); + + SAML2Request saml2Request = new SAML2Request(); + LogoutRequestType lor = + (LogoutRequestType) saml2Request.getRequestType(stream); + assertEquals("Match Employee URL", employee, lor.getIssuer().getValue()); + } + + public void testSAML2LogOutFromIDPServlet() throws Exception + { + MockCatalinaSession session = new MockCatalinaSession(); + + MockCatalinaContextClassLoader mclIDP = setupTCL(profile + "/idp"); + Thread.currentThread().setContextClassLoader(mclIDP); + + MockCatalinaContext catalinaContext = new MockCatalinaContext(); + session.setServletContext(catalinaContext); + + IdentityServer server = this.getIdentityServer(session); + catalinaContext.setAttribute("IDENTITY_SERVER", server); + + IDPWebBrowserSSOValve idp = new IDPWebBrowserSSOValve(); + + idp.setContainer(catalinaContext); + idp.setSignOutgoingMessages(false); + idp.start(); + + //Assume that we already have the principal and roles set in the session + MockCatalinaRealm realm = new MockCatalinaRealm("anil", "test", new Principal() + { + public String getName() + { + return "anil"; + } + }); + List<String> roles = new ArrayList<String>(); + roles.add("manager"); + roles.add("employee"); + + List<String> rolesList = new ArrayList<String>(); + rolesList.add("manager"); + + MockCatalinaRequest request = new MockCatalinaRequest(); + session.clear(); + request.setSession(session); + + request.addHeader("Referer", sales); + + GenericPrincipal genericPrincipal =new GenericPrincipal(realm, "anil", "test", roles) ; + request.setUserPrincipal(genericPrincipal); + + String samlMessage = RedirectBindingUtil.deflateBase64Encode(createLogOutRequest(sales).getBytes()); + request.setParameter("SAMLRequest", samlMessage); + + + + MockCatalinaResponse response = new MockCatalinaResponse(); + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + response.setWriter(new PrintWriter(baos)); + + // The IDP is preloaded with 2 participants : "http://localhost:8080/sales/" + // and "http://localhost:8080/employee" + + //Lets start the workflow with get + request.setMethod("GET"); + idp.invoke(request, response); + + String redirectStr = response.redirectString; + + System.out.println("RedirectStr from IDP=" + redirectStr); + + String destination = redirectStr.substring(0,redirectStr.indexOf(SAML_REQUEST_KEY) -1); + String relayState = redirectStr.substring(redirectStr.indexOf(RELAY_STATE_KEY) + + RELAY_STATE_KEY.length()) ; + String logoutRequest = redirectStr.substring(redirectStr.indexOf(SAML_REQUEST_KEY) + + SAML_REQUEST_KEY.length(),redirectStr.indexOf(RELAY_STATE_KEY) - 1 ) ; + + + System.out.println("LogO=" + logoutRequest); + InputStream stream = RedirectBindingUtil.urlBase64DeflateDecode(logoutRequest); + + SAML2Request saml2Request = new SAML2Request(); + LogoutRequestType lor = + (LogoutRequestType) saml2Request.getRequestType(stream); + assertEquals("Match Employee URL", employee, destination); + + //Let us feed the LogOutRequest to the SPFilter + MockCatalinaContextClassLoader mclSPEmp = setupTCL(profile + "/sp/employee"); + Thread.currentThread().setContextClassLoader(mclSPEmp); + + MockCatalinaContext context = new MockCatalinaContext(); + context.setRealm(realm); + session.setServletContext(context); + + SPRedirectFormAuthenticator sp = new SPRedirectFormAuthenticator(); + sp.setContainer(context); + sp.testStart(); + + request = new MockCatalinaRequest(); + request.setSession(session); + request.setParameter("SAMLRequest", RedirectBindingUtil.urlDecode(logoutRequest)); + request.setParameter("RelayState", relayState); + + MockCatalinaResponse filterResponse = new MockCatalinaResponse(); + ByteArrayOutputStream filterbaos = new ByteArrayOutputStream(); + filterResponse.setWriter(new PrintWriter(filterbaos)); + + + sp.authenticate(request, response, new LoginConfig()); + + redirectStr = response.redirectString; + + System.out.println("Redirect String from SP=" + redirectStr); + + destination = redirectStr.substring(0,redirectStr.indexOf(SAML_RESPONSE_KEY) -1); + relayState = redirectStr.substring(redirectStr.indexOf(RELAY_STATE_KEY) + + RELAY_STATE_KEY.length()) ; + assertNotNull("RelayState exists",relayState); + String logoutResponse = redirectStr.substring(redirectStr.indexOf(SAML_RESPONSE_KEY) + + SAML_RESPONSE_KEY.length(),redirectStr.indexOf(RELAY_STATE_KEY) - 1 ) ; + + System.out.println("Logout Response from SP=" + logoutResponse); + + stream = RedirectBindingUtil.urlBase64DeflateDecode(logoutResponse); + + SAML2Response saml2Response = new SAML2Response(); + StatusResponseType statusResponse = + (StatusResponseType) saml2Request.getSAML2ObjectFromStream(stream); + assertEquals("Match IDP URL", IDP, destination); + + //Now the SP (employee app) has logged out and sending a status response to IDP + Thread.currentThread().setContextClassLoader(mclIDP); + + session.clear(); + request.clear(); + + request.setMethod("GET"); + request.setSession(session); + request.setUserPrincipal(genericPrincipal); + request.setParameter("SAMLResponse", RedirectBindingUtil.urlDecode(logoutResponse)); + request.setParameter("RelayState", relayState); + + idp.invoke(request, response); + + destination = redirectStr.substring(0,redirectStr.indexOf(SAML_RESPONSE_KEY) -1); + relayState = redirectStr.substring(redirectStr.indexOf(RELAY_STATE_KEY) + + RELAY_STATE_KEY.length()) ; + logoutResponse = redirectStr.substring(redirectStr.indexOf(SAML_RESPONSE_KEY) + + SAML_RESPONSE_KEY.length(),redirectStr.indexOf(RELAY_STATE_KEY) - 1 ) ; + + + System.out.println("LogO=" + logoutResponse); + stream = RedirectBindingUtil.urlBase64DeflateDecode(logoutResponse); + + saml2Response = new SAML2Response(); + statusResponse = + (StatusResponseType) saml2Request.getSAML2ObjectFromStream(stream); + assertEquals("Match IDP URL", IDP, destination); + + //Now we should have got a full success report from IDP + MockCatalinaContextClassLoader mclSPSales = setupTCL(profile + "/sp/employee"); + Thread.currentThread().setContextClassLoader(mclSPSales); + sp = new SPRedirectFormAuthenticator(); + sp.setContainer(context); + sp.testStart(); + + session.clear(); + request.clear(); + request.setSession(session); + request.setUserPrincipal(genericPrincipal); + request.setParameter("SAMLResponse", RedirectBindingUtil.urlDecode(logoutResponse)); + request.setParameter("RelayState", relayState); + request.setContext(context); + + sp.authenticate(request, response, new LoginConfig()); + + assertEquals(0, server.stack().getParticipants(session.getId())); + assertEquals(0, server.stack().getNumOfParticipantsInTransit(session.getId())); + + //Finally the session should be invalidated + assertTrue(session.isInvalidated()); + } + + private MockCatalinaContextClassLoader setupTCL(String resource) + { + URL[] urls = new URL[] {tcl.getResource(resource)}; + + MockCatalinaContextClassLoader mcl = new MockCatalinaContextClassLoader(urls); + mcl.setDelegate(tcl); + mcl.setProfile(resource); + return mcl; + } + + private String createLogOutRequest(String url) throws Exception + { + SAML2Request samlRequest = new SAML2Request(); + LogoutRequestType lot = + samlRequest.createLogoutRequest(url); + StringWriter sw = new StringWriter(); + samlRequest.marshall(lot, sw); + return sw.toString(); + } + + //Get the Identity server with 2 participants + private IdentityServer getIdentityServer(HttpSession session) + { + IdentityServer server = new IdentityServer(); + server.sessionCreated(new HttpSessionEvent(session)); + + server.stack().register(session.getId(), sales); + server.stack().register(session.getId(), employee); + return server; + } +} \ No newline at end of file

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r868 - in identity-federation/trunk: jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp and 6 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-22 00:50:43 -0400 (Thu, 22 Oct 2009) New Revision: 868 Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/util/StringUtil.java Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/CircleOfTrustServlet.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/KeyDescriptorMetaDataBuilder.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java Log: string util Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/CircleOfTrustServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/CircleOfTrustServlet.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/CircleOfTrustServlet.java 2009-10-22 04:50:43 UTC (rev 868) @@ -43,6 +43,9 @@ import org.jboss.identity.federation.core.saml.v2.metadata.store.IMetadataConfigurationStore; import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Circle of trust establishing servlet that accesses * the metadata urls of the various sites and updates @@ -62,7 +65,7 @@ super.init(config); String cstr = config.getInitParameter("configProvider"); - if(cstr != null && cstr.length() > 0) + if(isNotNull(cstr)) { ClassLoader tcl; try Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java 2009-10-22 04:50:43 UTC (rev 868) @@ -55,6 +55,9 @@ import org.jboss.identity.federation.web.util.ConfigurationUtil; import org.jboss.identity.xmlsec.w3.xmldsig.KeyInfoType; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Metadata servlet for the IDP/SP * @author Anil.Saldhana(a)redhat.com @@ -86,7 +89,7 @@ { ServletContext context = config.getServletContext(); String configL = config.getInitParameter("configFile"); - if(configL != null && configL.length() > 0) + if(isNotNull(configL)) configFileLocation = configL; if(trace) log.trace("Config File Location="+ configFileLocation); @@ -120,7 +123,7 @@ * It may be difficult to get to the resource from the TCL. */ String fileInjectionStr = metadataProvider.requireFileInjection(); - if(fileInjectionStr != null && fileInjectionStr.length() > 0) + if(isNotNull(fileInjectionStr)) { metadataProvider.injectFileStream(context.getResourceAsStream(fileInjectionStr)); } Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-10-22 04:50:43 UTC (rev 868) @@ -69,6 +69,8 @@ import org.jboss.identity.federation.web.util.RedirectBindingUtil; import org.xml.sax.SAXException; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Valve at the IDP that supports the HTTP/Redirect Binding * @author Anil.Saldhana(a)redhat.com @@ -232,7 +234,7 @@ String destination = responseType.getDestination(); if(trace) log.trace("IDP:Destination=" + destination); - if(relayState != null && relayState.length() > 0) + if(isNotNull(relayState)) relayState = RedirectBindingUtil.urlEncode(relayState); String finalDest = destination + this.getDestination(urlEncodedResponse, relayState); @@ -263,7 +265,7 @@ { StringBuilder sb = new StringBuilder(); sb.append("?SAMLResponse=").append(urlEncodedResponse); - if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if(isNotNull(urlEncodedRelayState)) sb.append("&RelayState=").append(urlEncodedRelayState); return sb.toString(); } Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-10-22 04:50:43 UTC (rev 868) @@ -61,6 +61,9 @@ import org.xml.sax.SAXException; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + + /** * Valve at the Identity Provider that supports * SAML2 HTTP/Redirect binding with digital signature support @@ -89,7 +92,7 @@ */ public void setIgnoreSignature(String val) { - if(val != null && val.length() > 0) + if(isNotNull(val)) this.ignoreSignature = Boolean.valueOf(val); } Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-22 04:50:43 UTC (rev 868) @@ -88,6 +88,9 @@ import org.jboss.identity.federation.web.util.RedirectBindingUtil; import org.w3c.dom.Document; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + + /** * Generic Web Browser SSO valve for the IDP * @@ -185,8 +188,8 @@ String signature = request.getParameter("Signature"); String sigAlg = request.getParameter("SigAlg"); - boolean containsSAMLRequestMessage = this.isNotNull(samlRequestMessage); - boolean containsSAMLResponseMessage = this.isNotNull(samlResponseMessage); + boolean containsSAMLRequestMessage = isNotNull(samlRequestMessage); + boolean containsSAMLResponseMessage = isNotNull(samlResponseMessage); Session session = request.getSessionInternal(); @@ -284,12 +287,12 @@ if(isNotNull(samlResponseMessage)) session.removeNote("SAMLResponse"); - if(relayState != null && relayState.length() > 0) + if(isNotNull(relayState)) session.removeNote("RelayState"); - if(signature != null && signature.length() > 0) + if(isNotNull(signature)) session.removeNote("Signature"); - if(sigAlg != null && sigAlg.length() > 0) + if(isNotNull(sigAlg)) session.removeNote("sigAlg"); boolean willSendRequest = false; @@ -659,7 +662,7 @@ String queryString, SessionHolder holder, boolean isPost) throws IOException, GeneralSecurityException { - if (holder.samlRequest == null || holder.samlRequest.length() == 0) + if (!isNotNull(holder.samlRequest)) { return false; } @@ -667,7 +670,7 @@ if (!this.ignoreIncomingSignatures && !isPost) { String sig = holder.signature; - if (sig == null || sig.length() == 0) + if (!isNotNull(sig)) { log.error("Signature received from SP is null:" + remoteAddress); return false; @@ -895,9 +898,4 @@ */ response.recycle(); } - - private boolean isNotNull(String str) - { - return str != null && !"".equals(str); - } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPPostFormAuthenticator.java 2009-10-22 04:50:43 UTC (rev 868) @@ -58,6 +58,9 @@ import org.jboss.identity.federation.web.util.ServerDetector; import org.xml.sax.SAXException; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Authenticator at the Service Provider * that handles HTTP/Post binding of SAML 2 @@ -181,7 +184,7 @@ { StringBuilder sb = new StringBuilder(); sb.append("?SAMLRequest=").append(urlEncodedRequest); - if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if(isNotNull(urlEncodedRelayState)) sb.append("&RelayState=").append(urlEncodedRelayState); return sb.toString(); } @@ -222,7 +225,7 @@ Principal userPrincipal = null; String samlResponse = request.getParameter("SAMLResponse"); - if(samlResponse != null && samlResponse.length() > 0 ) + if(isNotNull(samlResponse) ) { boolean isValid = false; try Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-22 04:50:43 UTC (rev 868) @@ -21,6 +21,8 @@ */ package org.jboss.identity.federation.bindings.tomcat.sp; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.InputStream; @@ -44,8 +46,6 @@ import org.apache.log4j.Logger; import org.jboss.identity.federation.api.saml.v2.request.SAML2Request; import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; -import org.jboss.identity.federation.api.util.Base64; -import org.jboss.identity.federation.api.util.DeflateUtil; import org.jboss.identity.federation.bindings.tomcat.sp.holder.ServiceProviderSAMLContext; import org.jboss.identity.federation.bindings.util.ValveUtil; import org.jboss.identity.federation.core.config.TrustType; @@ -65,7 +65,6 @@ import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest.GENERATE_REQUEST_TYPE; import org.jboss.identity.federation.core.saml.v2.util.DocumentUtil; import org.jboss.identity.federation.saml.v2.SAML2Object; -import org.jboss.identity.federation.saml.v2.assertion.EncryptedElementType; import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; @@ -487,7 +486,7 @@ sb.append("?SAMLRequest=").append(urlEncodedRequest); else sb.append("?SAMLResponse=").append(urlEncodedRequest); - if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if(isNotNull(urlEncodedRelayState)) sb.append("&RelayState=").append(urlEncodedRelayState); return sb.toString(); } @@ -537,50 +536,4 @@ { throw new RuntimeException("This authenticator does not handle encryption"); } - - private Principal process(Request request, Response response) - throws IOException, GeneralSecurityException, - ConfigurationException, ParsingException - { - Principal userPrincipal = null; - - String samlResponse = request.getParameter("SAMLResponse"); - if(samlResponse != null && samlResponse.length() > 0 ) - { - boolean isValid = this.validate(request); - - if(!isValid) - throw new GeneralSecurityException("Validity Checks failed"); - - //deal with SAML response from IDP - byte[] base64DecodedResponse = Base64.decode(samlResponse); - InputStream is = DeflateUtil.decode(base64DecodedResponse); - - SAML2Response saml2Response = new SAML2Response(); - - ResponseType responseType = saml2Response.getResponseType(is); - - this.isTrusted(responseType.getIssuer().getValue()); - - List<Object> assertions = responseType.getAssertionOrEncryptedAssertion(); - if(assertions.size() == 0) - throw new IllegalStateException("No assertions in reply from IDP"); - - Object assertion = assertions.get(0); - if(assertion instanceof EncryptedElementType) - { - responseType = this.decryptAssertion(responseType); - } - - SPUtil spUtil = new SPUtil(); - return spUtil.handleSAMLResponse(request, responseType); - } - return userPrincipal; - } - - - private boolean isNotNull(String str) - { - return str != null && !"".equals(str); - } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-10-22 04:50:43 UTC (rev 868) @@ -50,6 +50,9 @@ import org.w3c.dom.Document; import org.w3c.dom.Element; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Tomcat Authenticator for the HTTP/Redirect binding with Signature support * @author Anil.Saldhana(a)redhat.com @@ -116,7 +119,7 @@ StringBuilder sb = new StringBuilder(); sb.append("SAMLResponse=").append(reqFromURL); - if(relayStateFromURL != null && relayStateFromURL.length() > 0) + if(isNotNull(relayStateFromURL)) { sb.append("&RelayState=").append(relayStateFromURL); } Modified: identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/KeyDescriptorMetaDataBuilder.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/KeyDescriptorMetaDataBuilder.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/KeyDescriptorMetaDataBuilder.java 2009-10-22 04:50:43 UTC (rev 868) @@ -29,6 +29,8 @@ import org.jboss.identity.xmlsec.w3.xmldsig.KeyInfoType; import org.jboss.identity.xmlsec.w3.xmlenc.EncryptionMethodType; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * MetaDataBuilder for the KeyDescriptor * @author Anil.Saldhana(a)redhat.com @@ -53,7 +55,7 @@ KeyDescriptorType keyDescriptor = getObjectFactory().createKeyDescriptorType(); - if(algorithm != null && algorithm.length() > 0) + if(isNotNull(algorithm)) { EncryptionMethodType encryptionMethod = new EncryptionMethodType(); encryptionMethod.setAlgorithm(algorithm); Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/util/StringUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/util/StringUtil.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/util/StringUtil.java 2009-10-22 04:50:43 UTC (rev 868) @@ -0,0 +1,40 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.util; + +/** + * Utility dealing with Strings + * @author Anil.Saldhana(a)redhat.com + * @since Oct 21, 2009 + */ +public class StringUtil +{ + /** + * Check whether the passed string is null or empty + * @param str + * @return + */ + public static boolean isNotNull(String str) + { + return str != null && !"".equals(str); + } +} \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-22 04:50:43 UTC (rev 868) @@ -108,6 +108,8 @@ import org.w3c.dom.Document; import org.xml.sax.SAXException; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * A service provider filter for web container agnostic * providers @@ -255,7 +257,7 @@ } //See if we got a response from IDP - if(samlResponse != null && samlResponse.length() > 0 ) + if(isNotNull(samlResponse)) { boolean isValid = false; try @@ -732,9 +734,4 @@ } return principal; } - - private boolean isNotNull(String str) - { - return str != null && !"".equals(str); - } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-22 04:50:43 UTC (rev 868) @@ -82,6 +82,9 @@ import org.jboss.identity.federation.web.util.RedirectBindingSignatureUtil; import org.w3c.dom.Document; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * SAML Web Browser SSO - POST binding * @author Anil.Saldhana(a)redhat.com @@ -276,7 +279,7 @@ session.removeAttribute("SAMLRequest"); session.removeAttribute("SAMLResponse"); - if(relayState != null && relayState.length() > 0) + if(isNotNull(relayState)) session.removeAttribute("RelayState"); SAMLDocumentHolder samlDocumentHolder = null; Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java 2009-10-22 04:50:43 UTC (rev 868) @@ -67,6 +67,8 @@ import org.w3c.dom.Document; import org.xml.sax.SAXException; +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Request Util * <b> Not thread safe</b> @@ -355,7 +357,7 @@ if(trace) log.trace("IDP:Destination=" + destination); - if(relayState != null && relayState.length() > 0) + if(isNotNull(relayState)) relayState = RedirectBindingUtil.urlEncode(relayState); String finalDest = destination + getDestination(urlEncodedResponse, relayState, @@ -402,7 +404,7 @@ sb.append("?SAMLRequest=").append(urlEncodedResponse); else sb.append("?SAMLResponse=").append(urlEncodedResponse); - if (urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if (isNotNull(urlEncodedRelayState)) sb.append("&RelayState=").append(urlEncodedRelayState); } return sb.toString(); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-22 04:50:43 UTC (rev 868) @@ -30,6 +30,9 @@ import org.jboss.identity.federation.api.util.Base64; import org.jboss.identity.federation.core.saml.v2.holders.DestinationInfoHolder; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + /** * Utility for the HTTP/Post binding * @author Anil.Saldhana(a)redhat.com @@ -90,7 +93,7 @@ builder.append("<FORM METHOD=\"POST\" ACTION=\"" + destination + "\">"); builder.append("<INPUT TYPE=\"HIDDEN\" NAME=\""+ key +"\"" + " VALUE=\"" + samlMessage + "\"/>"); - if (relayState != null && relayState.length() > 0) + if (isNotNull(relayState)) { builder.append("<INPUT TYPE=\"HIDDEN\" NAME=\"RelayState\" " + "VALUE=\"" + relayState + "\"/>"); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java 2009-10-22 04:12:47 UTC (rev 867) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingSignatureUtil.java 2009-10-22 04:50:43 UTC (rev 868) @@ -45,6 +45,8 @@ import org.jboss.identity.federation.saml.v2.protocol.ResponseType; import org.w3c.dom.Document; import org.xml.sax.SAXException; + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; /** @@ -78,7 +80,7 @@ String urlEncodedRequest = RedirectBindingUtil.deflateBase64URLEncode(sw.toString()); String urlEncodedRelayState = null; - if(relayState != null && relayState.length() > 0 ) + if(isNotNull(relayState)) urlEncodedRelayState = URLEncoder.encode(relayState, "UTF-8"); byte[] sigValue = computeSignature("SAMLRequest=" + urlEncodedRequest, urlEncodedRelayState, signingKey); @@ -134,7 +136,7 @@ String urlEncodedResponse = RedirectBindingUtil.deflateBase64URLEncode(responseString); String urlEncodedRelayState = null; - if(relayState != null && relayState.length() > 0 ) + if(isNotNull(relayState)) urlEncodedRelayState = URLEncoder.encode(relayState, "UTF-8"); byte[] sigValue = computeSignature("SAMLResponse=" + urlEncodedResponse, urlEncodedRelayState, signingKey); @@ -230,7 +232,7 @@ StringBuilder sb = new StringBuilder(); sb.append("SAMLRequest=").append(reqFromURL); - if(relayStateFromURL != null && relayStateFromURL.length() > 0) + if(isNotNull(relayStateFromURL)) { sb.append("&RelayState=").append(relayStateFromURL); } @@ -248,7 +250,7 @@ { StringBuilder sb = new StringBuilder(); sb.append(requestOrResponseKeyValuePair); - if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if(isNotNull(urlEncodedRelayState)) { sb.append("&RelayState=").append(urlEncodedRelayState); } @@ -271,7 +273,7 @@ { StringBuilder sb = new StringBuilder(); sb.append("SAMLRequest=").append(urlEncodedRequest); - if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if(isNotNull(urlEncodedRelayState)) { sb.append("&").append("RelayState=").append(urlEncodedRelayState); } @@ -296,7 +298,7 @@ { StringBuilder sb = new StringBuilder(); sb.append("SAMLResponse=").append(urlEncodedResponse); - if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) + if(isNotNull(urlEncodedRelayState)) { sb.append("&").append("RelayState=").append(urlEncodedRelayState); }

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r867 - in identity-federation/trunk: jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp and 16 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-22 00:12:47 -0400 (Thu, 22 Oct 2009) New Revision: 867 Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jbid-handlers.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jboss-idfed.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/roles.properties identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jbid-handlers.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jboss-idfed.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/roles.properties identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jbid-handlers.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jboss-idfed.xml identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/roles.properties Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPUtil.java identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaContext.java identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaRequest.java identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaResponse.java identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingUtil.java Log: JBID-40: SAML2 Logout Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-22 04:12:47 UTC (rev 867) @@ -28,7 +28,10 @@ import java.security.PublicKey; import java.util.ArrayList; import java.util.Arrays; +import java.util.HashMap; import java.util.List; +import java.util.Map; +import java.util.Set; import java.util.StringTokenizer; import javax.servlet.ServletException; @@ -49,20 +52,40 @@ import org.jboss.identity.federation.core.config.KeyProviderType; import org.jboss.identity.federation.core.exceptions.ConfigurationException; import org.jboss.identity.federation.core.exceptions.ParsingException; +import org.jboss.identity.federation.core.handler.config.Handlers; import org.jboss.identity.federation.core.impl.DelegatedAttributeManager; import org.jboss.identity.federation.core.interfaces.AttributeManager; +import org.jboss.identity.federation.core.interfaces.ProtocolContext; import org.jboss.identity.federation.core.interfaces.RoleGenerator; import org.jboss.identity.federation.core.interfaces.TrustKeyConfigurationException; import org.jboss.identity.federation.core.interfaces.TrustKeyManager; import org.jboss.identity.federation.core.interfaces.TrustKeyProcessingException; +import org.jboss.identity.federation.core.saml.v2.common.SAMLDocumentHolder; import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants; import org.jboss.identity.federation.core.saml.v2.exceptions.IssueInstantMissingException; import org.jboss.identity.federation.core.saml.v2.exceptions.IssuerNotTrustedException; -import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; +import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerChain; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerChainConfig; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerRequest; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerResponse; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerChain; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerChainConfig; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerResponse; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler.HANDLER_TYPE; +import org.jboss.identity.federation.core.saml.v2.util.HandlerUtil; +import org.jboss.identity.federation.saml.v2.SAML2Object; import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; +import org.jboss.identity.federation.saml.v2.protocol.StatusResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; +import org.jboss.identity.federation.web.core.HTTPContext; +import org.jboss.identity.federation.web.core.IdentityServer; import org.jboss.identity.federation.web.util.ConfigurationUtil; import org.jboss.identity.federation.web.util.IDPWebRequestUtil; import org.jboss.identity.federation.web.util.RedirectBindingSignatureUtil; +import org.jboss.identity.federation.web.util.RedirectBindingUtil; import org.w3c.dom.Document; /** @@ -81,7 +104,7 @@ protected IDPType idpConfiguration = null; - private RoleGenerator rg = new TomcatRoleGenerator(); + private RoleGenerator roleGenerator = new TomcatRoleGenerator(); private long assertionValidity = 5000; // 5 seconds in miliseconds @@ -96,6 +119,10 @@ private transient DelegatedAttributeManager attribManager = new DelegatedAttributeManager(); private List<String> attributeKeys = new ArrayList<String>(); + private transient SAML2HandlerChain chain = null; + + private Context context = null; + //Set a list of attributes we are interested in separated by comma public void setAttributeList(String attribList) { @@ -135,7 +162,7 @@ try { Class<?> clazz = SecurityActions.getContextClassLoader().loadClass(rgName); - rg = (RoleGenerator) clazz.newInstance(); + roleGenerator = (RoleGenerator) clazz.newInstance(); } catch (Exception e) { @@ -148,23 +175,33 @@ { String referer = request.getHeader("Referer"); String relayState = request.getParameter("RelayState"); - String samlMessage = request.getParameter("SAMLRequest"); + + if(isNotNull(relayState)) + relayState = RedirectBindingUtil.urlDecode(relayState); + + String samlRequestMessage = request.getParameter("SAMLRequest"); + String samlResponseMessage = request.getParameter("SAMLResponse"); + String signature = request.getParameter("Signature"); String sigAlg = request.getParameter("SigAlg"); - boolean containsSAMLRequestMessage = samlMessage != null; + boolean containsSAMLRequestMessage = this.isNotNull(samlRequestMessage); + boolean containsSAMLResponseMessage = this.isNotNull(samlResponseMessage); Session session = request.getSessionInternal(); - if(containsSAMLRequestMessage) + if(containsSAMLRequestMessage || containsSAMLResponseMessage) { - if(trace) log.trace("Storing the SAMLRequest and RelayState in session"); - session.setNote("SAMLRequest", samlMessage); - if(relayState != null && relayState.length() > 0) + if(trace) log.trace("Storing the SAMLRequest/SAMLResponse and RelayState in session"); + if(isNotNull(samlRequestMessage)) + session.setNote("SAMLRequest", samlRequestMessage); + if(isNotNull(samlResponseMessage)) + session.setNote("SAMLResponse", samlResponseMessage); + if(isNotNull(relayState)) session.setNote("RelayState", relayState.trim()); - if(signature != null && signature.length() > 0) + if(isNotNull(signature)) session.setNote("Signature", signature.trim()); - if(sigAlg != null && sigAlg.length() > 0) + if(isNotNull(sigAlg)) session.setNote("sigAlg", sigAlg.trim()); } @@ -223,20 +260,30 @@ * we can retrieve the original saml message as well as * any relay state from the SP */ - samlMessage = (String) session.getNote("SAMLRequest"); + samlRequestMessage = (String) session.getNote("SAMLRequest"); + + samlResponseMessage = (String) session.getNote("SAMLResponse"); relayState = (String) session.getNote("RelayState"); signature = (String) session.getNote("Signature"); sigAlg = (String) session.getNote("sigAlg"); if(trace) { - log.trace("Retrieved saml message and relay state from session"); - log.trace("saml message=" + samlMessage + "::relay state="+ relayState); - log.trace("Signature=" + signature + "::sigAlg="+ sigAlg); + StringBuilder builder = new StringBuilder(); + builder.append("Retrieved saml messages and relay state from session"); + builder.append("saml Request message=").append(samlRequestMessage); + builder.append("::").append("SAMLResponseMessage="); + builder.append(samlResponseMessage).append(":").append("relay state=").append(relayState); + + builder.append("Signature=").append(signature).append("::sigAlg=").append(sigAlg); + log.trace(builder.toString()); } - session.removeNote("SAMLRequest"); - + if(isNotNull(samlRequestMessage)) + session.removeNote("SAMLRequest"); + if(isNotNull(samlResponseMessage)) + session.removeNote("SAMLResponse"); + if(relayState != null && relayState.length() > 0) session.removeNote("RelayState"); @@ -244,27 +291,101 @@ session.removeNote("Signature"); if(sigAlg != null && sigAlg.length() > 0) session.removeNote("sigAlg"); + + boolean willSendRequest = false; + + SAMLDocumentHolder samlDocumentHolder = null; + SAML2Object samlObject = null; + + Document samlResponse = null; + String destination = null; + //Send valid saml response after processing the request - if(samlMessage != null) + if(samlRequestMessage != null) { //Get the SAML Request Message RequestAbstractType requestAbstractType = null; - Document samlResponse = null; - String destination = null; + try { - requestAbstractType = webRequestUtil.getSAMLRequest(samlMessage); + samlDocumentHolder = webRequestUtil.getSAMLDocumentHolder(samlRequestMessage); + samlObject = (SAML2Object) samlDocumentHolder.getSamlObject(); + + boolean isPost = webRequestUtil.hasSAMLRequestInPostProfile(); boolean isValid = validate(request.getRemoteAddr(), request.getQueryString(), - new SessionHolder(samlMessage, signature, sigAlg), isPost); + new SessionHolder(samlRequestMessage, signature, sigAlg), isPost); + if(!isValid) throw new GeneralSecurityException("Validation check failed"); + + String issuer = null; + IssuerInfoHolder idpIssuer = new IssuerInfoHolder(this.identityURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + idpIssuer.getIssuer(), samlDocumentHolder, + HANDLER_TYPE.IDP); + saml2HandlerRequest.setRelayState(relayState); + //Set the options on the handler request + Map<String, Object> requestOptions = new HashMap<String, Object>(); + requestOptions.put(GeneralConstants.ROLE_GENERATOR, roleGenerator); + requestOptions.put(GeneralConstants.ASSERTIONS_VALIDITY, this.assertionValidity); + requestOptions.put(GeneralConstants.CONFIGURATION, this.idpConfiguration); + + Map<String,Object> attribs = this.attribManager.getAttributes(userPrincipal, attributeKeys); + requestOptions.put(GeneralConstants.ATTRIBUTES, attribs); + + saml2HandlerRequest.setOptions(requestOptions); + + List<String> roles = roleGenerator.generateRoles(userPrincipal); + session.getSession().setAttribute(GeneralConstants.ROLES_ID, roles); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + Set<SAML2Handler> handlers = chain.handlers(); + + if(samlObject instanceof RequestAbstractType) + { + requestAbstractType = (RequestAbstractType) samlObject; + issuer = requestAbstractType.getIssuer().getValue(); + webRequestUtil.isTrusted(issuer); + + if(handlers != null) + { + for(SAML2Handler handler: handlers) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = saml2HandlerResponse.getSendRequest(); + } + } + } + else + throw new RuntimeException("Unknown type:" + samlObject.getClass().getName()); + + samlResponse = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + destination = saml2HandlerResponse.getDestination(); + + + + + /*requestAbstractType = webRequestUtil.getSAMLRequest(samlRequestMessage); + boolean isPost = webRequestUtil.hasSAMLRequestInPostProfile(); + boolean isValid = validate(request.getRemoteAddr(), + request.getQueryString(), + new SessionHolder(samlRequestMessage, signature, sigAlg), isPost); + if(!isValid) + throw new GeneralSecurityException("Validation check failed"); + webRequestUtil.isTrusted(requestAbstractType.getIssuer().getValue()); - List<String> roles = rg.generateRoles(userPrincipal); + List<String> roles = roleGenerator.generateRoles(userPrincipal); log.trace("Roles have been determined:Creating response"); @@ -274,7 +395,7 @@ samlResponse = webRequestUtil.getResponse(destination, userPrincipal, roles, - this.identityURL, this.assertionValidity, this.signOutgoingMessages); + this.identityURL, this.assertionValidity, this.signOutgoingMessages); */ } catch (IssuerNotTrustedException e) { @@ -339,9 +460,10 @@ if(this.signOutgoingMessages) webRequestUtil.send(samlResponse, destination,relayState, response, true, - this.keyManager.getSigningKey(), false); + this.keyManager.getSigningKey(), willSendRequest); else - webRequestUtil.send(samlResponse, destination, relayState, response, false,null, false); + webRequestUtil.send(samlResponse, destination, relayState, response, false,null, + willSendRequest); } catch (ParsingException e) { @@ -354,9 +476,142 @@ } return; } + else if(isNotNull(samlResponseMessage)) + { + StatusResponseType statusResponseType = null; + try + { + samlDocumentHolder = webRequestUtil.getSAMLDocumentHolder(samlResponseMessage); + samlObject = (SAML2Object) samlDocumentHolder.getSamlObject(); + + boolean isPost = webRequestUtil.hasSAMLRequestInPostProfile(); + boolean isValid = validate(request.getRemoteAddr(), + request.getQueryString(), + new SessionHolder(samlResponseMessage, signature, sigAlg), isPost); + + if(!isValid) + throw new GeneralSecurityException("Validation check failed"); + + String issuer = null; + IssuerInfoHolder idpIssuer = new IssuerInfoHolder(this.identityURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + idpIssuer.getIssuer(), samlDocumentHolder, + HANDLER_TYPE.IDP); + saml2HandlerRequest.setRelayState(relayState); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + Set<SAML2Handler> handlers = chain.handlers(); + + if(samlObject instanceof StatusResponseType) + { + statusResponseType = (StatusResponseType) samlObject; + issuer = statusResponseType.getIssuer().getValue(); + webRequestUtil.isTrusted(issuer); + + if(handlers != null) + { + for(SAML2Handler handler: handlers) + { + handler.reset(); + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = saml2HandlerResponse.getSendRequest(); + } + } + } + else + throw new RuntimeException("Unknown type:" + samlObject.getClass().getName()); + + samlResponse = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + destination = saml2HandlerResponse.getDestination(); + } + catch (IssuerNotTrustedException e) + { + if(trace) log.trace("Exception in processing request:",e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_REQUEST_DENIED.get(), + this.identityURL, this.signOutgoingMessages); + } + catch (ParsingException e) + { + if(trace) log.trace("Exception in processing request:",e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), + this.identityURL, this.signOutgoingMessages); + } + catch (ConfigurationException e) + { + if(trace) log.trace("Exception in processing request:",e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), + this.identityURL, this.signOutgoingMessages); + } + catch (IssueInstantMissingException e) + { + if(trace) log.trace("Exception in processing request:",e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), + this.identityURL, this.signOutgoingMessages); + } + catch(GeneralSecurityException e) + { + if(trace) log.trace("Exception in processing request:", e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), + this.identityURL, this.signOutgoingMessages); + } + catch(Exception e) + { + if(trace) log.trace("Exception in processing request:",e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), + this.identityURL, this.signOutgoingMessages); + } + finally + { + try + { + if(webRequestUtil.hasSAMLRequestInPostProfile()) + recycle(response); + + if(this.signOutgoingMessages) + webRequestUtil.send(samlResponse, destination,relayState, response, true, + this.keyManager.getSigningKey(), willSendRequest); + else + webRequestUtil.send(samlResponse, destination, relayState, response, false,null, + willSendRequest); + } + catch (ParsingException e) + { + if(trace) log.trace("Parsing exception:", e); + } + catch (GeneralSecurityException e) + { + if(trace) log.trace("Security Exception:",e); + } + } + return; + } else { - log.error("No SAML Request Message"); + log.error("No SAML Request or Response Message"); if(trace) log.trace("Referer="+referer); try @@ -499,6 +754,8 @@ */ public void start() throws LifecycleException { + Handlers handlers = null; + // Validate and update our current component state if (started) throw new LifecycleException @@ -506,8 +763,11 @@ lifecycle.fireLifecycleEvent(START_EVENT, null); started = true; + //Get the chain from config + chain = new DefaultSAML2HandlerChain(); + String configFile = "/WEB-INF/jboss-idfed.xml"; - Context context = (Context) getContainer(); + context = (Context) getContainer(); InputStream is = context.getServletContext().getResourceAsStream(configFile); if(is == null) throw new RuntimeException(configFile + " missing"); @@ -525,6 +785,21 @@ AttributeManager delegate = (AttributeManager) tcl.loadClass(attributeManager).newInstance(); this.attribManager.setDelegate(delegate); } + //Get the handlers + handlers = ConfigurationUtil.getHandlers(context.getServletContext().getResourceAsStream("/WEB-INF/jbid-handlers.xml")); + chain.addAll(HandlerUtil.getHandlers(handlers)); + + Map<String, Object> chainConfigOptions = new HashMap<String, Object>(); + chainConfigOptions.put(GeneralConstants.ROLE_GENERATOR, roleGenerator); + chainConfigOptions.put(GeneralConstants.CONFIGURATION, idpConfiguration); + + SAML2HandlerChainConfig handlerChainConfig = new DefaultSAML2HandlerChainConfig(chainConfigOptions); + Set<SAML2Handler> samlHandlers = chain.handlers(); + + for(SAML2Handler handler: samlHandlers) + { + handler.initChainConfig(handlerChainConfig); + } } catch (Exception e) { @@ -564,6 +839,16 @@ "facsimileTelephoneNumber"}; this.attributeKeys.addAll(Arrays.asList(ak)); + + //The Identity Server on the servlet context gets set + //in the implementation of IdentityServer + //Create an Identity Server and set it on the context + IdentityServer identityServer = (IdentityServer) context.getServletContext().getAttribute(GeneralConstants.IDENTITY_SERVER); + if(identityServer == null) + { + identityServer = new IdentityServer(); + context.getServletContext().setAttribute(GeneralConstants.IDENTITY_SERVER, identityServer); + } } @@ -610,4 +895,9 @@ */ response.recycle(); } + + private boolean isNotNull(String str) + { + return str != null && !"".equals(str); + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java 2009-10-22 04:12:47 UTC (rev 867) @@ -24,12 +24,25 @@ import java.io.IOException; import java.io.InputStream; import java.security.GeneralSecurityException; +import java.util.HashMap; +import java.util.Map; +import java.util.Set; +import javax.servlet.ServletContext; + import org.apache.catalina.LifecycleException; import org.apache.catalina.authenticator.FormAuthenticator; import org.apache.catalina.connector.Request; import org.apache.log4j.Logger; import org.jboss.identity.federation.core.config.SPType; +import org.jboss.identity.federation.core.handler.config.Handlers; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerChain; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerChainConfig; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerChain; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerChainConfig; +import org.jboss.identity.federation.core.saml.v2.util.HandlerUtil; +import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.util.ConfigurationUtil; /** @@ -48,6 +61,8 @@ protected String identityURL = null; protected String configFile = "/WEB-INF/jboss-idfed.xml"; + + protected transient SAML2HandlerChain chain = null; public BaseFormAuthenticator() { @@ -80,10 +95,26 @@ public void start() throws LifecycleException { super.start(); + processStart(); + } + + //Mock test purpose + public void testStart() throws LifecycleException + { + processStart(); + } + + private void processStart() throws LifecycleException + { + Handlers handlers = null; - InputStream is = context.getServletContext().getResourceAsStream(configFile); + ServletContext servletContext = context.getServletContext(); + InputStream is = servletContext.getResourceAsStream(configFile); if(is == null) throw new RuntimeException(configFile + " missing"); + + //Get the chain from config + chain = new DefaultSAML2HandlerChain(); try { spConfiguration = ConfigurationUtil.getSPConfiguration(is); @@ -95,24 +126,30 @@ { throw new RuntimeException(e); } - } - - //Mock test purpose - public void testStart() throws LifecycleException - { - InputStream is = context.getServletContext().getResourceAsStream(configFile); - if(is == null) - throw new RuntimeException(configFile + " missing"); + + //Get the chain from config + chain = new DefaultSAML2HandlerChain(); try { - spConfiguration = ConfigurationUtil.getSPConfiguration(is); - this.identityURL = spConfiguration.getIdentityURL(); - this.serviceURL = spConfiguration.getServiceURL(); - if(trace) log.trace("Identity Provider URL=" + this.identityURL); + //Get the handlers + handlers = ConfigurationUtil.getHandlers(servletContext.getResourceAsStream("/WEB-INF/jbid-handlers.xml")); + chain.addAll(HandlerUtil.getHandlers(handlers)); + + Map<String, Object> chainConfigOptions = new HashMap<String, Object>(); + chainConfigOptions.put(GeneralConstants.CONFIGURATION, spConfiguration); + chainConfigOptions.put(GeneralConstants.ROLE_VALIDATOR_IGNORE, "false"); //No validator as tomcat realm does validn + + SAML2HandlerChainConfig handlerChainConfig = new DefaultSAML2HandlerChainConfig(chainConfigOptions); + Set<SAML2Handler> samlHandlers = chain.handlers(); + + for(SAML2Handler handler: samlHandlers) + { + handler.initChainConfig(handlerChainConfig); + } } - catch (Exception e) + catch(Exception e) { - throw new RuntimeException(e); - } - } + throw new RuntimeException(e); + } + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-10-22 04:12:47 UTC (rev 867) @@ -28,8 +28,10 @@ import java.security.Principal; import java.util.Arrays; import java.util.List; +import java.util.Set; import java.util.StringTokenizer; +import javax.servlet.RequestDispatcher; import javax.servlet.ServletException; import javax.xml.bind.JAXBException; @@ -44,19 +46,35 @@ import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; import org.jboss.identity.federation.api.util.Base64; import org.jboss.identity.federation.api.util.DeflateUtil; -import org.jboss.identity.federation.core.config.TrustType; import org.jboss.identity.federation.bindings.tomcat.sp.holder.ServiceProviderSAMLContext; -import org.jboss.identity.federation.web.util.HTTPRedirectUtil; -import org.jboss.identity.federation.web.util.RedirectBindingUtil; -import org.jboss.identity.federation.web.util.ServerDetector; import org.jboss.identity.federation.bindings.util.ValveUtil; +import org.jboss.identity.federation.core.config.TrustType; import org.jboss.identity.federation.core.exceptions.ConfigurationException; import org.jboss.identity.federation.core.exceptions.ParsingException; -import org.jboss.identity.federation.core.saml.v2.exceptions.AssertionExpiredException; +import org.jboss.identity.federation.core.exceptions.ProcessingException; +import org.jboss.identity.federation.core.interfaces.ProtocolContext; +import org.jboss.identity.federation.core.saml.v2.common.SAMLDocumentHolder; import org.jboss.identity.federation.core.saml.v2.exceptions.IssuerNotTrustedException; +import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerRequest; +import org.jboss.identity.federation.core.saml.v2.impl.DefaultSAML2HandlerResponse; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerResponse; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2Handler.HANDLER_TYPE; +import org.jboss.identity.federation.core.saml.v2.interfaces.SAML2HandlerRequest.GENERATE_REQUEST_TYPE; +import org.jboss.identity.federation.core.saml.v2.util.DocumentUtil; +import org.jboss.identity.federation.saml.v2.SAML2Object; import org.jboss.identity.federation.saml.v2.assertion.EncryptedElementType; import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; +import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; +import org.jboss.identity.federation.web.constants.GeneralConstants; +import org.jboss.identity.federation.web.core.HTTPContext; +import org.jboss.identity.federation.web.util.HTTPRedirectUtil; +import org.jboss.identity.federation.web.util.RedirectBindingUtil; +import org.jboss.identity.federation.web.util.ServerDetector; +import org.w3c.dom.Document; import org.xml.sax.SAXException; /** @@ -74,6 +92,8 @@ private boolean jbossEnv = false; + private String logOutPage = "/logout.jsp"; + public SPRedirectFormAuthenticator() { super(); @@ -84,71 +104,354 @@ @Override public boolean authenticate(Request request, Response response, LoginConfig loginConfig) throws IOException { - Principal principal = request.getUserPrincipal(); - if (principal != null) - { - if(trace) - log.trace("Already authenticated '" + principal.getName() + "'"); - return true; - } + Principal principal = request.getUserPrincipal(); + SAML2Request saml2Request = new SAML2Request(); + Session session = request.getSessionInternal(true); String relayState = request.getParameter("RelayState"); - - //Try to get the username - try - { - principal = (GenericPrincipal) process(request,response); + + String samlRequest = request.getParameter("SAMLRequest"); + String samlResponse = request.getParameter("SAMLResponse"); + + //Eagerly look for Global LogOut + String gloStr = request.getParameter(GeneralConstants.GLOBAL_LOGOUT); + boolean logOutRequest = isNotNull(gloStr) && "true".equalsIgnoreCase(gloStr); + + + /* if(!logOutRequest) + {*/ + /* if (principal != null) + { + if(trace) + log.trace("Already authenticated '" + principal.getName() + "'"); + return true; + }*/ - if(principal == null) + /* //Try to get the username + try { - String destination = createSAMLRequestMessage( relayState, response); - HTTPRedirectUtil.sendRedirectForRequestor(destination, response); + principal = (GenericPrincipal) process(request,response); + if(principal == null) + { + String destination = createSAMLRequestMessage( relayState, response); + HTTPRedirectUtil.sendRedirectForRequestor(destination, response); + + return false; + } + + String username = principal.getName(); + String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; + + //Map to JBoss specific principal + if(spConfiguration.getServerEnvironment().equalsIgnoreCase("JBOSS") || jbossEnv) + { + GenericPrincipal gp = (GenericPrincipal) principal; + //Push a context + ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); + principal = context.getRealm().authenticate(username, password); + ServiceProviderSAMLContext.clear(); + } + + session.setNote(Constants.SESS_USERNAME_NOTE, username); + session.setNote(Constants.SESS_PASSWORD_NOTE, password); + request.setUserPrincipal(principal); + register(request, response, principal, Constants.FORM_METHOD, username, password); + + return true; + } + catch(AssertionExpiredException aie) + { + if(trace) + log.trace("Assertion has expired. Issuing a new saml2 request to the IDP"); + try + { + String destination = createSAMLRequestMessage( relayState, response); + HTTPRedirectUtil.sendRedirectForRequestor(destination, response); + } + catch (Exception e) + { + if(trace) log.trace("Exception:",e); + } return false; } - - String username = principal.getName(); - String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; - - //Map to JBoss specific principal - if(spConfiguration.getServerEnvironment().equalsIgnoreCase("JBOSS") || jbossEnv) + catch(Exception e) { - GenericPrincipal gp = (GenericPrincipal) principal; - //Push a context - ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); - principal = context.getRealm().authenticate(username, password); - ServiceProviderSAMLContext.clear(); - } - - session.setNote(Constants.SESS_USERNAME_NOTE, username); - session.setNote(Constants.SESS_PASSWORD_NOTE, password); - request.setUserPrincipal(principal); - register(request, response, principal, Constants.FORM_METHOD, username, password); - - return true; + if(trace) + log.trace("Exception :",e); + } } - catch(AssertionExpiredException aie) - { - if(trace) - log.trace("Assertion has expired. Issuing a new saml2 request to the IDP"); - try + else + {*/ + if(!isNotNull(samlRequest) && !isNotNull(samlResponse)) { - String destination = createSAMLRequestMessage( relayState, response); - HTTPRedirectUtil.sendRedirectForRequestor(destination, response); + //Neither saml request nor response from IDP + //So this is a user request + + //Ask the handler chain to generate the saml request + Set<SAML2Handler> handlers = chain.handlers(); + + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), null, + HANDLER_TYPE.SP); + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + saml2HandlerResponse.setDestination(identityURL); + + //Reset the state + try + { + for(SAML2Handler handler: handlers) + { + handler.reset(); + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + + if(logOutRequest) + saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.LOGOUT); + else + saml2HandlerRequest.setTypeOfRequestToBeGenerated(GENERATE_REQUEST_TYPE.AUTH); + handler.generateSAMLRequest(saml2HandlerRequest, saml2HandlerResponse); + } + } + catch(ProcessingException pe) + { + throw new RuntimeException(pe); + } + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + if(destination != null && + samlResponseDocument != null) + { + try + { + String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + + String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); + String destinationURL = destination + + getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + + HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + } + catch (Exception e) + { + if(trace) + log.trace("Exception:",e); + throw new IOException("Server Error"); + } + return true; + } } - catch (Exception e) + + //See if we got a response from IDP + if(isNotNull(samlResponse) ) { - if(trace) log.trace("Exception:",e); - } - return false; - } - catch(Exception e) - { - if(trace) - log.trace("Exception :",e); - } + boolean isValid = false; + try + { + isValid = this.validate(request); + } + catch (Exception e) + { + log.error("Exception:",e); + throw new IOException(); + } + if(!isValid) + throw new IOException("Validity check failed"); + //deal with SAML response from IDP + InputStream base64DecodedResponse = RedirectBindingUtil.base64DeflateDecode(samlResponse); + + try + { + SAML2Response saml2Response = new SAML2Response(); + + SAML2Object samlObject = saml2Response.getSAML2ObjectFromStream(base64DecodedResponse); + SAMLDocumentHolder documentHolder = saml2Response.getSamlDocumentHolder(); + + Set<SAML2Handler> handlers = chain.handlers(); + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), documentHolder, + HANDLER_TYPE.SP); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + //Deal with handler chains + for(SAML2Handler handler : handlers) + { + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } + } + + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + + if(destination != null && + samlResponseDocument != null) + { + String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + + String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); + String destinationURL = destination + + getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + + HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + } + else + { + //We got a response with the principal + List<String> roles = saml2HandlerResponse.getRoles(); + if(principal == null) + principal = (Principal) session.getSession().getAttribute(GeneralConstants.PRINCIPAL_ID); + + String username = principal.getName(); + String password = ServiceProviderSAMLContext.EMPTY_PASSWORD; + + //Map to JBoss specific principal + if((new ServerDetector()).isJboss() || jbossEnv) + { + GenericPrincipal gp = (GenericPrincipal) principal; + //Push a context + ServiceProviderSAMLContext.push(username, Arrays.asList(gp.getRoles())); + principal = context.getRealm().authenticate(username, password); + ServiceProviderSAMLContext.clear(); + } + else + { + //tomcat env + SPUtil spUtil = new SPUtil(); + principal = spUtil.createGenericPrincipal(request, principal.getName(), roles); + } + + session.setNote(Constants.SESS_USERNAME_NOTE, username); + session.setNote(Constants.SESS_PASSWORD_NOTE, password); + request.setUserPrincipal(principal); + register(request, response, principal, Constants.FORM_METHOD, username, password); + + return true; + } + + //See if the session has been invalidated + + boolean sessionValidity = session.isValid(); + if(!sessionValidity) + { + //we are invalidated. + RequestDispatcher dispatch = context.getServletContext().getRequestDispatcher(this.logOutPage); + if(dispatch == null) + log.error("Cannot dispatch to the logout page: no request dispatcher:" + this.logOutPage); + else + dispatch.forward(request, response); + return false; + } + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new IOException("Server Exception"); + } + } + + + if(isNotNull(samlRequest)) + { + //we got a logout request + + //deal with SAML response from IDP + InputStream is = RedirectBindingUtil.base64DeflateDecode(samlRequest); + + try + { + SAML2Object samlObject = saml2Request.getSAML2ObjectFromStream(is); + SAMLDocumentHolder documentHolder = saml2Request.getSamlDocumentHolder(); + + Set<SAML2Handler> handlers = chain.handlers(); + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context.getServletContext()); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), documentHolder, + HANDLER_TYPE.SP); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + //Deal with handler chains + for(SAML2Handler handler : handlers) + { + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } + } + + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + + if(destination != null && + samlResponseDocument != null) + { + String samlMsg = DocumentUtil.getDocumentAsString(samlResponseDocument); + + String base64Request = RedirectBindingUtil.deflateBase64URLEncode(samlMsg.getBytes("UTF-8")); + String destinationURL = destination + + getDestination(base64Request, relayState, saml2HandlerResponse.getSendRequest()); + + HTTPRedirectUtil.sendRedirectForRequestor(destinationURL, response); + return true; + } + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new IOException("Server Exception"); + } + }//end else logoutrequest + /* }*/ + //fallback return super.authenticate(request, response, loginConfig); } @@ -169,17 +472,21 @@ saml2Request.marshall(authnRequest, baos); String base64Request = RedirectBindingUtil.deflateBase64URLEncode(baos.toByteArray()); - String destination = authnRequest.getDestination() + getDestination(base64Request, relayState); + String destination = authnRequest.getDestination() + getDestination(base64Request, relayState, true); if(trace) log.trace("Sending to destination="+destination); return destination; } - protected String getDestination(String urlEncodedRequest, String urlEncodedRelayState) + protected String getDestination(String urlEncodedRequest, String urlEncodedRelayState, + boolean sendRequest) { StringBuilder sb = new StringBuilder(); - sb.append("?SAMLRequest=").append(urlEncodedRequest); + if(sendRequest) + sb.append("?SAMLRequest=").append(urlEncodedRequest); + else + sb.append("?SAMLResponse=").append(urlEncodedRequest); if(urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) sb.append("&RelayState=").append(urlEncodedRelayState); return sb.toString(); @@ -270,4 +577,10 @@ } return userPrincipal; } + + + private boolean isNotNull(String str) + { + return str != null && !"".equals(str); + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-10-22 04:12:47 UTC (rev 867) @@ -140,7 +140,7 @@ } @Override - protected String getDestination(String urlEncodedRequest, String urlEncodedRelayState) + protected String getDestination(String urlEncodedRequest, String urlEncodedRelayState, boolean sendRequest) { try { Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPUtil.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPUtil.java 2009-10-22 04:12:47 UTC (rev 867) @@ -128,7 +128,7 @@ return this.createGenericPrincipal(request, userName, roles); } - private Principal createGenericPrincipal(Request request, String username, List<String> roles) + public Principal createGenericPrincipal(Request request, String username, List<String> roles) { Context ctx = request.getContext(); return new GenericPrincipal(ctx.getRealm(), username, null, roles); Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaContext.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaContext.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaContext.java 2009-10-22 04:12:47 UTC (rev 867) @@ -150,8 +150,7 @@ } public String getName() - { - + { throw new RuntimeException("NYI"); } Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaRequest.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaRequest.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaRequest.java 2009-10-22 04:12:47 UTC (rev 867) @@ -25,6 +25,8 @@ import java.util.HashMap; import java.util.Map; +import javax.servlet.http.HttpSession; + import org.apache.catalina.Session; import org.apache.catalina.connector.Request; @@ -61,6 +63,11 @@ { return principal; } + + public Principal getUserPrincipal() + { + return principal; + } @Override public void setUserPrincipal(Principal arg0) @@ -131,4 +138,20 @@ { this.session = s; } + + public HttpSession getSession(boolean b) + { + return this.session.getSession(); + } + + public HttpSession getSession() + { + return this.session.getSession(); + } + + public void clear() + { + this.params.clear(); + this.session = null; + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaResponse.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaResponse.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaResponse.java 2009-10-22 04:12:47 UTC (rev 867) @@ -22,6 +22,7 @@ package org.jboss.test.identity.federation.bindings.mock; import java.io.IOException; +import java.io.Writer; import java.util.HashMap; import java.util.Map; @@ -37,6 +38,8 @@ private Map<String, String> headers = new HashMap<String, String>(); private int status; public String redirectString; + @SuppressWarnings("unused") + private Writer mywriter; @Override public void setCharacterEncoding(String charset) @@ -71,6 +74,10 @@ public boolean isCommitted() { return false; - } - + } + + public void setWriter(Writer w) + { + this.mywriter = w; + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/mock/MockCatalinaSession.java 2009-10-22 04:12:47 UTC (rev 867) @@ -286,4 +286,9 @@ this.attribs.put(arg0, arg1); } + + public void clear() + { + this.notes.clear(); + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/workflow/SAML2RedirectWorkflowUnitTestCase.java 2009-10-22 04:12:47 UTC (rev 867) @@ -40,7 +40,7 @@ */ public class SAML2RedirectWorkflowUnitTestCase extends TestCase { - private String profile = "saml2/logout"; + private String profile = "saml2/redirect"; private ClassLoader tcl = Thread.currentThread().getContextClassLoader(); private String employee = "http://localhost:8080/employee/"; @@ -70,8 +70,8 @@ String redirectStr = response.redirectString; assertNotNull("Redirect String is null?", redirectStr); - String saml = RedirectBindingUtil.urlDecode(redirectStr.substring(redirectStr.indexOf(SAML_REQUEST_KEY) + - SAML_REQUEST_KEY.length()) ); + String saml = redirectStr.substring(redirectStr.indexOf(SAML_REQUEST_KEY) + + SAML_REQUEST_KEY.length()); MockCatalinaSession session = new MockCatalinaSession(); @@ -94,7 +94,7 @@ request = new MockCatalinaRequest(); request.setRemoteAddr(employee); request.setSession(session); - request.setParameter("SAMLRequest", saml); + request.setParameter("SAMLRequest", RedirectBindingUtil.urlDecode(saml)); request.setUserPrincipal(new GenericPrincipal(realm, "anil", "test", roles) ); request.setMethod("GET"); @@ -113,9 +113,8 @@ SAML_RESPONSE_KEY.length())); mclSPEmp = setupTCL(profile + "/sp/employee"); - Thread.currentThread().setContextClassLoader(mclSPEmp); + Thread.currentThread().setContextClassLoader(mclSPEmp); - sp = new SPRedirectFormAuthenticator(); context = new MockCatalinaContext(); @@ -124,6 +123,7 @@ request = new MockCatalinaRequest(); request.setContext(context); + request.setMethod("GET"); request.setParameter("SAMLResponse", samlResponse); request.setParameter("RelayState", null); request.setSession(session); Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jbid-handlers.xml 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1,5 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jboss-idfed.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jboss-idfed.xml (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/WEB-INF/jboss-idfed.xml 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1,9 @@ +<JBossIDP xmlns="urn:jboss:identity-federation:config:1.0" + AttributeManager="" + RoleGenerator="org.jboss.identity.federation.core.impl.EmptyRoleGenerator"> +<IdentityURL>http://localhost:8080/idp/</IdentityURL> +<Trust> + <Domains>localhost,jboss.com,jboss.org</Domains> +</Trust> + +</JBossIDP> Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/roles.properties =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/roles.properties (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/idp/roles.properties 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1 @@ +manager=manager \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jbid-handlers.xml 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1,4 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jboss-idfed.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jboss-idfed.xml (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/WEB-INF/jboss-idfed.xml 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1,6 @@ +<JBossSP xmlns="urn:jboss:identity-federation:config:1.0" + AttributeManager=""> +<IdentityURL>http://localhost:8080/idp/</IdentityURL> +<ServiceURL>http://localhost:8080/employee/</ServiceURL> + +</JBossSP> \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/roles.properties =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/roles.properties (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/employee/roles.properties 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1 @@ +manager=manager \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jbid-handlers.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jbid-handlers.xml (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jbid-handlers.xml 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1,4 @@ +<Handlers xmlns="urn:jboss:identity-federation:handler:config:1.0"> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2LogOutHandler"/> + <Handler class="org.jboss.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler"/> +</Handlers> \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jboss-idfed.xml =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jboss-idfed.xml (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/WEB-INF/jboss-idfed.xml 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1,6 @@ +<JBossSP xmlns="urn:jboss:identity-federation:config:1.0" + AttributeManager=""> +<IdentityURL>http://localhost:8080/idp/</IdentityURL> +<ServiceURL>http://localhost:8080/sales/</ServiceURL> + +</JBossSP> \ No newline at end of file Added: identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/roles.properties =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/roles.properties (rev 0) +++ identity-federation/trunk/jboss-identity-bindings/src/test/resources/saml2/redirect/sp/sales/roles.properties 2009-10-22 04:12:47 UTC (rev 867) @@ -0,0 +1 @@ +manager=manager \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/constants/GeneralConstants.java 2009-10-22 04:12:47 UTC (rev 867) @@ -51,6 +51,7 @@ String ROLE_GENERATOR = "ROLE_GENERATOR"; String ROLE_VALIDATOR = "ROLE_VALIDATOR"; + String ROLE_VALIDATOR_IGNORE = "ROLE_VALIDATOR_IGNORE"; String SENDER_PUBLIC_KEY = "SENDER_PUBLIC_KEY"; String SIGN_OUTGOING_MESSAGES = "SIGN_OUTGOING_MESSAGES"; Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-22 04:12:47 UTC (rev 867) @@ -325,31 +325,7 @@ this.sendToDestination(samlResponseDocument, relayState, destination, response, willSendRequest); return; } - /*ResponseType responseType = saml2Response.getResponseType(is); - SAMLDocumentHolder samlDocumentHolder = saml2Response.getSamlDocumentHolder(); - - boolean validSignature = this.verifySignature(samlDocumentHolder); - - if(validSignature == false) - throw new IssuerNotTrustedException("Signature in saml document is invalid"); - - this.isTrusted(responseType.getIssuer().getValue()); - - List<Object> assertions = responseType.getAssertionOrEncryptedAssertion(); - if(assertions.size() == 0) - throw new IllegalStateException("No assertions in reply from IDP"); - - Object assertion = assertions.get(0); - if(assertion instanceof EncryptedElementType) - { - responseType = this.decryptAssertion(responseType); - } - - userPrincipal = handleSAMLResponse(request, responseType); - if(userPrincipal == null) - response.sendError(HttpServletResponse.SC_FORBIDDEN);*/ - //See if the session has been invalidated try { @@ -373,18 +349,7 @@ log.trace("Server Exception:", e); throw new ServletException("Server Exception"); } - /*catch (IssuerNotTrustedException e) - { - if(trace) - log.trace("IssuerNotTrustedException:", e); - throw new ServletException("Issuer Not Trusted Exception"); - } - catch (AssertionExpiredException e) - { - if(trace) - log.trace("AssertionExpiredException:", e); - throw new ServletException("Assertion expired Exception"); - } */ + } if(isNotNull(samlRequest)) Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java 2009-10-22 04:12:47 UTC (rev 867) @@ -117,10 +117,12 @@ if(getType() == HANDLER_TYPE.IDP) { idp.generateSAMLRequest(request, response); + response.setSendRequest(true); } else { sp.generateSAMLRequest(request, response); + response.setSendRequest(true); } } @@ -148,6 +150,9 @@ AuthnRequestType art = (AuthnRequestType) request.getSAML2Object(); HttpSession session = BaseSAML2Handler.getHttpSession(request); Principal userPrincipal = (Principal) session.getAttribute(GeneralConstants.PRINCIPAL_ID); + if(userPrincipal == null) + userPrincipal = httpContext.getRequest().getUserPrincipal(); + List<String> roles = (List<String>) session.getAttribute(GeneralConstants.ROLES_ID); try { @@ -266,6 +271,7 @@ issuerValue, response.getDestination(), issuerValue); response.setResultingDocument(samlRequest.convert(authn)); + response.setSendRequest(true); } catch (Exception e) { @@ -368,19 +374,23 @@ { return userName; } - }; - //Validate the roles - IRoleValidator roleValidator = - (IRoleValidator) handlerChainConfig.getParameter(GeneralConstants.ROLE_VALIDATOR); - if(roleValidator == null) - throw new ProcessingException("Role Validator not provided"); - - boolean validRole = roleValidator.userInRole(principal, roles); - if(!validRole) + }; + + if(handlerChainConfig.getParameter(GeneralConstants.ROLE_VALIDATOR_IGNORE) == null) { - if(trace) - log.trace("Invalid role:" + roles); - principal = null; + //Validate the roles + IRoleValidator roleValidator = + (IRoleValidator) handlerChainConfig.getParameter(GeneralConstants.ROLE_VALIDATOR); + if(roleValidator == null) + throw new ProcessingException("Role Validator not provided"); + + boolean validRole = roleValidator.userInRole(principal, roles); + if(!validRole) + { + if(trace) + log.trace("Invalid role:" + roles); + principal = null; + } } return principal; } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-22 04:12:47 UTC (rev 867) @@ -514,7 +514,7 @@ } return; - } + } } protected void sendErrorResponseToSP(String referrer, HttpServletResponse response, String relayState, Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java 2009-10-22 04:12:47 UTC (rev 867) @@ -359,7 +359,7 @@ relayState = RedirectBindingUtil.urlEncode(relayState); String finalDest = destination + getDestination(urlEncodedResponse, relayState, - supportSignature); + supportSignature, sendRequest); if(trace) log.trace("Redirecting to="+ finalDest); HTTPRedirectUtil.sendRedirectForResponder(finalDest, response); } @@ -380,7 +380,7 @@ * @return */ public String getDestination(String urlEncodedResponse, String urlEncodedRelayState, - boolean supportSignature) + boolean supportSignature, boolean sendRequest) { StringBuilder sb = new StringBuilder(); @@ -398,7 +398,10 @@ } else { - sb.append("?SAMLResponse=").append(urlEncodedResponse); + if(sendRequest) + sb.append("?SAMLRequest=").append(urlEncodedResponse); + else + sb.append("?SAMLResponse=").append(urlEncodedResponse); if (urlEncodedRelayState != null && urlEncodedRelayState.length() > 0) sb.append("&RelayState=").append(urlEncodedRelayState); } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingUtil.java 2009-10-21 21:00:58 UTC (rev 866) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/RedirectBindingUtil.java 2009-10-22 04:12:47 UTC (rev 867) @@ -106,6 +106,18 @@ } /** + * Apply deflate compression followed by base64 encoding + * @param stringToEncode + * @return + * @throws IOException + */ + public static String deflateBase64Encode(byte[] stringToEncode) throws IOException + { + byte[] deflatedMsg = DeflateUtil.encode(stringToEncode); + return Base64.encodeBytes(deflatedMsg); + } + + /** * Apply URL decoding, followed by base64 decoding followed by deflate decompression * @param encodedString * @return

16 years, 9 months

1
0
0 / 0

JBoss Identity SVN: r866 - in identity-federation/trunk: jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp and 1 other directories.

by jboss-identity-commits＠lists.jboss.org

Author: anil.saldhana(a)jboss.com Date: 2009-10-21 17:00:58 -0400 (Wed, 21 Oct 2009) New Revision: 866 Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java Log: minor Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-21 16:57:31 UTC (rev 865) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-21 21:00:58 UTC (rev 866) @@ -345,11 +345,11 @@ } catch (ParsingException e) { - if(trace) log.trace(e); + if(trace) log.trace("Parsing exception:", e); } catch (GeneralSecurityException e) { - if(trace) log.trace(e); + if(trace) log.trace("Security Exception:",e); } } return; Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java 2009-10-21 16:57:31 UTC (rev 865) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/BaseFormAuthenticator.java 2009-10-21 21:00:58 UTC (rev 866) @@ -97,6 +97,7 @@ } } + //Mock test purpose public void testStart() throws LifecycleException { InputStream is = context.getServletContext().getResourceAsStream(configFile); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-21 16:57:31 UTC (rev 865) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-21 21:00:58 UTC (rev 866) @@ -419,46 +419,11 @@ relayState = saml2HandlerResponse.getRelayState(); destination = saml2HandlerResponse.getDestination(); - - - //requestAbstractType = webRequestUtil.getSAMLRequest(samlMessage); - - - /*//RequestAbstractType - if(requestAbstractType != null) - { - List<String> roles = (List<String>) session.getAttribute(ROLES_ID); - if(roles == null) - { - roles = rg.generateRoles(userPrincipal); - session.setAttribute(ROLES_ID, roles); - } - - if(trace) - log.trace("Roles have been determined:Creating response"); - - if(requestAbstractType instanceof LogoutRequestType) - { - LogoutRequestType lot = (LogoutRequestType) requestAbstractType; - - } - - AuthnRequestType art = (AuthnRequestType) requestAbstractType; - destination = art.getAssertionConsumerServiceURL(); - - samlResponse = - webRequestUtil.getResponse(destination, - userPrincipal, roles, - this.identityURL, this.assertionValidity, this.signOutgoingMessages); - } - else - { - //status response type - }*/ + } catch (IssuerNotTrustedException e) { - if(trace) log.trace(e); + if(trace) log.trace("Exception:",e); samlResponse = webRequestUtil.getErrorResponse(referer, @@ -467,7 +432,7 @@ } catch (ParsingException e) { - if(trace) log.trace(e); + if(trace) log.trace("Exception:",e); samlResponse = webRequestUtil.getErrorResponse(referer, @@ -476,7 +441,7 @@ } catch (ConfigurationException e) { - if(trace) log.trace(e); + if(trace) log.trace("Exception:",e); samlResponse = webRequestUtil.getErrorResponse(referer, @@ -485,7 +450,7 @@ } catch (IssueInstantMissingException e) { - if(trace) log.trace(e); + if(trace) log.trace("Exception:",e); samlResponse = webRequestUtil.getErrorResponse(referer, @@ -494,13 +459,22 @@ } catch(GeneralSecurityException e) { - if(trace) log.trace(e); + if(trace) log.trace("Security Exception:",e); samlResponse = webRequestUtil.getErrorResponse(referer, JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), this.identityURL, this.signOutgoingMessages); } + catch(Exception e) + { + if(trace) log.trace("Exception:",e); + + samlResponse = + webRequestUtil.getErrorResponse(referer, + JBossSAMLURIConstants.STATUS_AUTHNFAILED.get(), + this.identityURL, this.signOutgoingMessages); + } } else

16 years, 9 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

jboss-identity-commits October 2009