[jboss-identity-commits] JBoss Identity SVN: r224 - identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp.
Author: anil.saldhana(a)jboss.com
Date: 2009-01-16 16:37:00 -0500 (Fri, 16 Jan 2009)
New Revision: 224
Modified:
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java
Log:
add sig verification at SP end
Modified:
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java
===================================================================
---
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-01-16
21:04:55 UTC (rev 223)
+++
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-01-16
21:37:00 UTC (rev 224)
@@ -182,6 +182,11 @@
sb.append("&RelayState=").append(urlEncodedRelayState);
return sb.toString();
}
+
+ protected boolean validate(Request request) throws Exception
+ {
+ return request.getParameter("SAMLResponse") != null;
+ }
private Principal process(Request request, Response response) throws Exception
{
@@ -190,6 +195,8 @@
String samlResponse = request.getParameter("SAMLResponse");
if(samlResponse != null && samlResponse.length() > 0 )
{
+ this.validate(request);
+
//deal with SAML response from IDP
byte[] base64DecodedResponse = Base64.decode(samlResponse);
InputStream is = DeflateUtil.decode(base64DecodedResponse);
Modified:
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java
===================================================================
---
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-01-16
21:04:55 UTC (rev 223)
+++
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-01-16
21:37:00 UTC (rev 224)
@@ -29,8 +29,10 @@
import java.security.PrivateKey;
import java.security.PublicKey;
+import org.apache.catalina.connector.Request;
import org.jboss.identity.federation.bindings.util.RedirectBindingSignatureUtil;
import org.jboss.identity.federation.bindings.util.cert.KeyStoreUtil;
+import org.jboss.identity.federation.core.saml.v2.util.SignatureUtil;
/**
* Tomcat Authenticator for the HTTP/Redirect
@@ -64,7 +66,38 @@
{
this.alias = alias;
}
+
+ protected boolean validate(Request request) throws Exception
+ {
+ boolean result = super.validate(request);
+ if( result == false)
+ return result;
+
+ String queryString = request.getQueryString();
+ //Check if there is a signature
+ byte[] sigValue =
RedirectBindingSignatureUtil.getSignatureValueFromSignedURL(queryString);
+ if(sigValue == null)
+ return false;
+
+ //Construct the url again
+ String reqFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString,
"SAMLResponse");
+ String relayStateFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString,
"RelayState");
+ String sigAlgFromURL = RedirectBindingSignatureUtil.getTokenValue(queryString,
"SigAlg");
+ StringBuilder sb = new StringBuilder();
+ sb.append("SAMLResponse=").append(reqFromURL);
+
+ if(relayStateFromURL != null && relayStateFromURL.length() > 0)
+ {
+ sb.append("&RelayState=").append(relayStateFromURL);
+ }
+ sb.append("&SigAlg=").append(sigAlgFromURL);
+
+ PublicKey validatingKey = getValidatingKey();
+ boolean isValid = SignatureUtil.validate(sb.toString().getBytes("UTF-8"),
sigValue, validatingKey);
+ return isValid;
+ }
+
@Override
protected String getDestination(String urlEncodedRequest, String
urlEncodedRelayState)
{