[jboss-identity-commits] JBoss Identity SVN: r859 - in identity-federation/trunk: jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/impl and 6 other directories.

Author: anil.saldhana(a)jboss.com Date: 2009-10-14 00:37:39 -0400 (Wed, 14 Oct 2009) New Revision: 859 Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/impl/DefaultSAML2HandlerResponse.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/interfaces/SAML2HandlerResponse.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/core/IdentityServer.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java Log: JBID:40: saml logout Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPWebBrowserSSOValve.java 2009-10-14 04:37:39 UTC (rev 859) @@ -204,9 +204,9 @@ if(this.signOutgoingMessages) webRequestUtil.send(samlErrorResponse, referer, relayState, response, true, - this.keyManager.getSigningKey()); + this.keyManager.getSigningKey(), false); else - webRequestUtil.send(samlErrorResponse, referer,relayState, response, false,null); + webRequestUtil.send(samlErrorResponse, referer,relayState, response, false,null, false); } catch (GeneralSecurityException e) @@ -330,9 +330,9 @@ if(this.signOutgoingMessages) webRequestUtil.send(samlResponse, destination,relayState, response, true, - this.keyManager.getSigningKey()); + this.keyManager.getSigningKey(), false); else - webRequestUtil.send(samlResponse, destination, relayState, response, false,null); + webRequestUtil.send(samlResponse, destination, relayState, response, false,null, false); } catch (ParsingException e) { @@ -377,9 +377,9 @@ if(this.signOutgoingMessages) webRequestUtil.send(samlResponse, referrer, relayState, response, true, - this.keyManager.getSigningKey()); + this.keyManager.getSigningKey(), false); else - webRequestUtil.send(samlResponse, referrer, relayState, response, false,null); + webRequestUtil.send(samlResponse, referrer, relayState, response, false,null, false); } catch (ParsingException e1) { Modified: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/impl/DefaultSAML2HandlerResponse.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/impl/DefaultSAML2HandlerResponse.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/impl/DefaultSAML2HandlerResponse.java 2009-10-14 04:37:39 UTC (rev 859) @@ -41,6 +41,9 @@ private int errorCode; private String errorMessage; private boolean errorMode; + private boolean sendRequest; + + /** * @see SAML2HandlerResponse#getRelayState() @@ -140,4 +143,14 @@ { return this.errorMode; } + + public boolean getSendRequest() + { + return this.sendRequest; + } + + public void setSendRequest(boolean request) + { + this.sendRequest = request; + } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/interfaces/SAML2HandlerResponse.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/interfaces/SAML2HandlerResponse.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/v2/interfaces/SAML2HandlerResponse.java 2009-10-14 04:37:39 UTC (rev 859) @@ -108,4 +108,8 @@ * @return */ String getErrorMessage(); + + void setSendRequest(boolean request); + + boolean getSendRequest(); } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/core/IdentityServer.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/core/IdentityServer.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/core/IdentityServer.java 2009-10-14 04:37:39 UTC (rev 859) @@ -26,9 +26,13 @@ import java.util.Stack; import java.util.concurrent.ConcurrentHashMap; +import javax.servlet.ServletContext; +import javax.servlet.http.HttpSession; import javax.servlet.http.HttpSessionEvent; import javax.servlet.http.HttpSessionListener; +import org.jboss.identity.federation.web.constants.GeneralConstants; + /** * Represents an Identity Server * @author Anil.Saldhana(a)redhat.com @@ -68,7 +72,7 @@ { String result = null; Stack<String> stack = sessionParticipantsMap.get(sessionID); - if(stack != null) + if(stack != null && stack.isEmpty() == false) { result = stack.pop(); } @@ -83,6 +87,11 @@ public void register(String sessionID, String participant) { Stack<String> stack = sessionParticipantsMap.get(sessionID); + if(stack == null) + { + stack = new Stack<String>(); + sessionParticipantsMap.put(sessionID, stack ); + } if(stack.contains(participant) == false) stack.push(participant); } @@ -110,6 +119,11 @@ public boolean registerTransitParticipant(String sessionID, String participant) { Set<String> transitSet = inTransitMap.get(sessionID); + if(transitSet == null) + { + transitSet = new HashSet<String>(); + inTransitMap.put(sessionID, transitSet); + } if(transitSet != null) return transitSet.add(participant); return false; @@ -180,6 +194,18 @@ */ public void sessionCreated(HttpSessionEvent sessionEvent) { + HttpSession session = sessionEvent.getSession(); + //Ensure that the IdentityServer instance is set on the servlet context + ServletContext servletContext = session.getServletContext(); + + IdentityServer idserver = (IdentityServer) servletContext.getAttribute(GeneralConstants.IDENTITY_SERVER); + + if(idserver == null) + servletContext.setAttribute(GeneralConstants.IDENTITY_SERVER, this); + + if(idserver != this) + throw new IllegalStateException("Identity Server mismatch"); + String id = sessionEvent.getSession().getId(); stack.put(id); } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/filters/SPFilter.java 2009-10-14 04:37:39 UTC (rev 859) @@ -241,7 +241,8 @@ { try { - this.sendToDestination(samlResponseDocument, relayState, destination, response); + this.sendToDestination(samlResponseDocument, relayState, destination, response, + saml2HandlerResponse.getSendRequest()); } catch (Exception e) { @@ -272,6 +273,9 @@ byte[] base64DecodedResponse = PostBindingUtil.base64Decode(samlResponse); InputStream is = new ByteArrayInputStream(base64DecodedResponse); + //Are we going to send Request to IDP? + boolean willSendRequest = true; + try { SAML2Response saml2Response = new SAML2Response(); @@ -301,6 +305,7 @@ if(samlObject instanceof RequestAbstractType) { handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = false; } else { @@ -317,7 +322,7 @@ if(destination != null && samlResponseDocument != null) { - this.sendToDestination(samlResponseDocument, relayState, destination, response); + this.sendToDestination(samlResponseDocument, relayState, destination, response, willSendRequest); return; } /*ResponseType responseType = saml2Response.getResponseType(is); @@ -380,8 +385,77 @@ log.trace("AssertionExpiredException:", e); throw new ServletException("Assertion expired Exception"); } */ - } + } + if(isNotNull(samlRequest)) + { + //we got a logout request + + //deal with SAML response from IDP + byte[] base64DecodedRequest = PostBindingUtil.base64Decode(samlRequest); + InputStream is = new ByteArrayInputStream(base64DecodedRequest); + + //Are we going to send Request to IDP? + boolean willSendRequest = false; + + try + { + SAML2Request saml2Request = new SAML2Request(); + SAML2Object samlObject = saml2Request.getSAML2ObjectFromStream(is); + SAMLDocumentHolder documentHolder = saml2Request.getSamlDocumentHolder(); + + Set<SAML2Handler> handlers = chain.handlers(); + IssuerInfoHolder holder = new IssuerInfoHolder(this.serviceURL); + ProtocolContext protocolContext = new HTTPContext(request,response, context); + //Create the request/response + SAML2HandlerRequest saml2HandlerRequest = + new DefaultSAML2HandlerRequest(protocolContext, + holder.getIssuer(), documentHolder, + HANDLER_TYPE.SP); + + SAML2HandlerResponse saml2HandlerResponse = new DefaultSAML2HandlerResponse(); + + //Deal with handler chains + for(SAML2Handler handler : handlers) + { + if(saml2HandlerResponse.isInError()) + { + response.sendError(saml2HandlerResponse.getErrorCode()); + break; + } + if(samlObject instanceof RequestAbstractType) + { + handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = false; + } + else + { + handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + } + } + + Document samlResponseDocument = saml2HandlerResponse.getResultingDocument(); + String relayState = saml2HandlerResponse.getRelayState(); + + String destination = saml2HandlerResponse.getDestination(); + + + if(destination != null && + samlResponseDocument != null) + { + this.sendToDestination(samlResponseDocument, relayState, destination, response, willSendRequest); + return; + } + } + catch (Exception e) + { + if(trace) + log.trace("Server Exception:", e); + throw new ServletException("Server Exception"); + } + + } + } } @@ -526,7 +600,8 @@ protected void sendToDestination(Document samlDocument, String relayState, String destination, - HttpServletResponse response) + HttpServletResponse response, + boolean request) throws IOException, SAXException, JAXBException,GeneralSecurityException { String samlMessage; @@ -543,7 +618,7 @@ throw new ProcessingException(e); } PostBindingUtil.sendPost(new DestinationInfoHolder(destination, samlMessage, relayState), - response, true); + response, request); } protected boolean validate(HttpServletRequest request) throws IOException, GeneralSecurityException Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2AuthenticationHandler.java 2009-10-14 04:37:39 UTC (rev 859) @@ -27,6 +27,7 @@ import java.util.List; import java.util.Map; +import javax.servlet.ServletContext; import javax.servlet.http.HttpSession; import javax.xml.bind.JAXBElement; import javax.xml.bind.JAXBException; @@ -58,6 +59,7 @@ import org.jboss.identity.federation.saml.v2.protocol.StatusType; import org.jboss.identity.federation.web.constants.GeneralConstants; import org.jboss.identity.federation.web.core.HTTPContext; +import org.jboss.identity.federation.web.core.IdentityServer; import org.jboss.identity.federation.web.interfaces.IRoleValidator; import org.w3c.dom.Document; import org.xml.sax.SAXException; @@ -140,6 +142,9 @@ public void handleRequestType( SAML2HandlerRequest request, SAML2HandlerResponse response ) throws ProcessingException { + HTTPContext httpContext = (HTTPContext) request.getContext(); + ServletContext servletContext = httpContext.getServletContext(); + AuthnRequestType art = (AuthnRequestType) request.getSAML2Object(); HttpSession session = BaseSAML2Handler.getHttpSession(request); Principal userPrincipal = (Principal) session.getAttribute(GeneralConstants.PRINCIPAL_ID); @@ -154,12 +159,17 @@ attribs, assertionValidity); + //Update the Identity Server + IdentityServer identityServer = (IdentityServer) servletContext.getAttribute(GeneralConstants.IDENTITY_SERVER); + identityServer.stack().register(session.getId(), destination); + response.setDestination(destination); response.setResultingDocument(samlResponse); } catch(Exception e) { - throw new ProcessingException(e); + log.error("Exception in processing authentication:", e); + throw new ProcessingException("authentication issue"); } } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/handlers/saml2/SAML2LogOutHandler.java 2009-10-14 04:37:39 UTC (rev 859) @@ -189,6 +189,8 @@ { throw new ProcessingException(e); } + + httpSession.invalidate(); } else { @@ -205,6 +207,7 @@ { LogoutRequestType lort = saml2Request.createLogoutRequest(request.getIssuer().getValue()); response.setResultingDocument(saml2Request.convert(lort)); + response.setSendRequest(true); } catch(Exception e) { @@ -246,6 +249,7 @@ generateSuccessStatusResponseType(logOutRequest.getID(), request, response, originalIssuer); + response.setSendRequest(false); } else { @@ -263,6 +267,7 @@ LogoutRequestType lort = saml2Request.createLogoutRequest(request.getIssuer().getValue()); response.setResultingDocument(saml2Request.convert(lort)); + response.setSendRequest(true); } } catch(ParserConfigurationException pe) @@ -364,6 +369,7 @@ LogoutRequestType lot = samlRequest.createLogoutRequest(request.getIssuer().getValue()); response.setResultingDocument(samlRequest.convert(lot)); + response.setSendRequest(true); } catch (Exception e) { @@ -451,6 +457,7 @@ response.setRelayState(relayState); response.setDestination(logOutRequest.getIssuer().getValue()); + response.setSendRequest(false); } } } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPLoginServlet.java 2009-10-14 04:37:39 UTC (rev 859) @@ -146,6 +146,8 @@ { //Save the SAMLRequest and relayState session.setAttribute("SAMLRequest", request.getParameter("SAMLRequest")); + session.setAttribute("SAMLResponse", request.getParameter("SAMLResponse")); + String relayState = request.getParameter("RelayState"); if(relayState != null && !"".equals(relayState)) session.setAttribute("RelayState", relayState ); Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/IDPServlet.java 2009-10-14 04:37:39 UTC (rev 859) @@ -127,6 +127,7 @@ super.init(config); String configFile = "/WEB-INF/jboss-idfed.xml"; context = config.getServletContext(); + InputStream is = context.getResourceAsStream(configFile); if(is == null) throw new RuntimeException(configFile + " missing"); @@ -221,6 +222,8 @@ } } + //The Identity Server on the servlet context gets set + //in the implementation of IdentityServer //Create an Identity Server and set it on the context IdentityServer identityServer = (IdentityServer) context.getAttribute(GeneralConstants.IDENTITY_SERVER); if(identityServer == null) @@ -260,6 +263,8 @@ webRequestUtil.setAttributeManager(this.attribManager); webRequestUtil.setAttributeKeys(attributeKeys); + boolean willSendRequest = true; + if(userPrincipal != null) { if(trace) @@ -321,6 +326,7 @@ { handler.reset(); handler.handleStatusResponseType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = saml2HandlerResponse.getSendRequest(); } } } @@ -402,6 +408,7 @@ for(SAML2Handler handler: handlers) { handler.handleRequestType(saml2HandlerRequest, saml2HandlerResponse); + willSendRequest = saml2HandlerResponse.getSendRequest(); } } } @@ -519,9 +526,9 @@ if(this.signOutgoingMessages) webRequestUtil.send(samlResponse, destination,relayState, response, true, - this.keyManager.getSigningKey()); + this.keyManager.getSigningKey(), willSendRequest); else - webRequestUtil.send(samlResponse, destination, relayState, response, false,null); + webRequestUtil.send(samlResponse, destination, relayState, response, false,null, willSendRequest); } catch (ParsingException e) { @@ -548,9 +555,9 @@ { if(this.signOutgoingMessages) webRequestUtil.send(samlResponse, referrer, relayState, response, true, - this.keyManager.getSigningKey()); + this.keyManager.getSigningKey(), false); else - webRequestUtil.send(samlResponse, referrer, relayState, response, false,null); + webRequestUtil.send(samlResponse, referrer, relayState, response, false,null, false); } catch (ParsingException e1) { Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/IDPWebRequestUtil.java 2009-10-14 04:37:39 UTC (rev 859) @@ -321,7 +321,8 @@ String relayState, HttpServletResponse response, boolean supportSignature, - PrivateKey signingKey) throws IOException, GeneralSecurityException + PrivateKey signingKey, + boolean sendRequest) throws IOException, GeneralSecurityException { if(responseDoc == null) throw new IllegalArgumentException("responseType is null"); @@ -359,7 +360,7 @@ String samlResponse = PostBindingUtil.base64Encode(new String(responseBytes)); PostBindingUtil.sendPost(new DestinationInfoHolder(destination, - samlResponse, relayState), response, false); + samlResponse, relayState), response, sendRequest); } } Modified: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-13 23:16:21 UTC (rev 858) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/util/PostBindingUtil.java 2009-10-14 04:37:39 UTC (rev 859) @@ -60,10 +60,10 @@ */ public static void sendPost(DestinationInfoHolder holder, HttpServletResponse response, - boolean sendToIDP) + boolean request) throws IOException { - String key = sendToIDP ? "SAMLRequest" : "SAMLResponse"; + String key = request ? "SAMLRequest" : "SAMLResponse"; String relayState = holder.getRelayState(); String destination = holder.getDestination(); @@ -79,10 +79,10 @@ builder.append("<HTML>"); builder.append("<HEAD>"); - if(sendToIDP) - builder.append("<TITLE>HTTP Post Binding To Identity Provider</TITLE>"); + if(request) + builder.append("<TITLE>HTTP Post Binding (Request)</TITLE>"); else - builder.append("<TITLE>HTTP Post Binding Response To Service Provider</TITLE>"); + builder.append("<TITLE>HTTP Post Binding Response (Response)</TITLE>"); builder.append("</HEAD>"); builder.append("<BODY Onload=\"document.forms[0].submit()\">");