12:10 p.m.
Author: marcelkolsteren
Date: 2009-08-29 13:10:40 -0400 (Sat, 29 Aug 2009)
New Revision: 753
Added:
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/resources/jbid_test_keystore.jks
Modified:
identity-federation/trunk/jboss-identity-seam/src/main/java/org/jboss/identity/seam/federation/SamlAuthenticationFilter.java
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/webapp/WEB-INF/components.xml
Log:
JBID-182: Seam authentication filter: signature validation still based on HTTP/Redirect
binding
Modified:
identity-federation/trunk/jboss-identity-seam/src/main/java/org/jboss/identity/seam/federation/SamlAuthenticationFilter.java
===================================================================
---
identity-federation/trunk/jboss-identity-seam/src/main/java/org/jboss/identity/seam/federation/SamlAuthenticationFilter.java 2009-08-29
07:09:51 UTC (rev 752)
+++
identity-federation/trunk/jboss-identity-seam/src/main/java/org/jboss/identity/seam/federation/SamlAuthenticationFilter.java 2009-08-29
17:10:40 UTC (rev 753)
@@ -27,10 +27,8 @@
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
-import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
import java.net.URL;
-import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
@@ -51,14 +49,14 @@
import javax.servlet.http.HttpServletResponse;
import javax.xml.bind.JAXBElement;
import javax.xml.bind.JAXBException;
+import javax.xml.crypto.MarshalException;
+import javax.xml.crypto.dsig.XMLSignatureException;
import org.jboss.identity.federation.api.saml.v2.common.IDGenerator;
+import org.jboss.identity.federation.api.saml.v2.common.SAMLDocumentHolder;
import org.jboss.identity.federation.api.saml.v2.request.SAML2Request;
-import org.jboss.identity.federation.api.saml.v2.response.SAML2Response;
-import org.jboss.identity.federation.web.util.HTTPRedirectUtil;
-import org.jboss.identity.federation.web.util.PostBindingUtil;
-import org.jboss.identity.federation.web.util.RedirectBindingSignatureUtil;
-import org.jboss.identity.federation.web.util.RedirectBindingUtil;
+import org.jboss.identity.federation.api.saml.v2.response.SAML2Response;
+import org.jboss.identity.federation.api.util.XMLSignatureUtil;
import org.jboss.identity.federation.core.exceptions.ConfigurationException;
import org.jboss.identity.federation.core.exceptions.ParsingException;
import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants;
@@ -72,6 +70,9 @@
import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType;
import org.jboss.identity.federation.saml.v2.protocol.ResponseType;
import org.jboss.identity.federation.saml.v2.protocol.StatusType;
+import org.jboss.identity.federation.web.util.HTTPRedirectUtil;
+import org.jboss.identity.federation.web.util.PostBindingUtil;
+import org.jboss.identity.federation.web.util.RedirectBindingUtil;
import org.jboss.seam.annotations.Logger;
import org.jboss.seam.annotations.Name;
import org.jboss.seam.annotations.Scope;
@@ -86,6 +87,7 @@
import org.jboss.seam.servlet.ServletRequestSessionMap;
import org.jboss.seam.util.Base64;
import org.jboss.seam.web.AbstractFilter;
+import org.w3c.dom.Document;
import org.xml.sax.SAXException;
/**
@@ -245,12 +247,6 @@
{
String samlResponse = request.getParameter("SAMLResponse");
- if (signatureRequired && !validateSignature(request))
- {
- log.error("Invalid signature");
- throw new RuntimeException("Validity Checks failed");
- }
-
// deal with SAML response from IDP
byte[] base64DecodedResponse = Base64.decode(samlResponse);
InputStream is = new ByteArrayInputStream(base64DecodedResponse);
@@ -271,6 +267,12 @@
throw new RuntimeException(e);
}
+ if (signatureRequired &&
!validateSignature(saml2Response.getSamlDocumentHolder()))
+ {
+ log.error("Invalid signature");
+ throw new RuntimeException("Validity Checks failed");
+ }
+
StatusType statusType = responseType.getStatus();
if (statusType == null)
{
@@ -384,53 +386,41 @@
return user;
}
- private boolean validateSignature(HttpServletRequest request)
- {
- // Check if there is a signature
- String signature = request.getParameter("Signature");
- if (signature == null || signature.length() == 0)
- {
- log.error("Signature Value missing in response from IDP");
- return false;
- }
- String sigAlg = request.getParameter("sigAlg");
- if (sigAlg == null || sigAlg.length() == 0)
- {
- log.error("Signature Algorithm missing in the response from IDP");
- return false;
- }
-
+ private boolean validateSignature(SAMLDocumentHolder documentHolder)
+ {
try
{
- if("GET".equalsIgnoreCase(request.getMethod()))
- {
- String queryString = request.getQueryString();
- byte[] sigValue =
RedirectBindingSignatureUtil.getSignatureValueFromSignedURL(queryString);
-
- return RedirectBindingSignatureUtil.validateSignature(queryString,
this.publicKeyOfIDP, sigValue);
- }
- return true;
+ Document samlDocument = documentHolder.getSamlDocument();
+ return XMLSignatureUtil.validate(samlDocument, this.publicKeyOfIDP);
}
- catch (UnsupportedEncodingException e)
+ catch (MarshalException e)
{
throw new RuntimeException(e);
}
- catch (GeneralSecurityException e)
+ catch (XMLSignatureException e)
{
throw new RuntimeException(e);
}
- catch (IOException e)
- {
- throw new RuntimeException(e);
- }
}
private PublicKey getPublicKeyOfIDP()
{
+ final String classPathPrefix = "classpath:";
+
try
{
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
- keyStore.load(new URL(keyStoreURL).openStream(), keyStorePass != null ?
keyStorePass.toCharArray() : null);
+ InputStream keyStoreStream;
+ if (keyStoreURL.startsWith(classPathPrefix))
+ {
+ keyStoreStream = getClass().getClassLoader().getResourceAsStream(
+ keyStoreURL.substring(classPathPrefix.length()));
+ }
+ else
+ {
+ keyStoreStream = new URL(keyStoreURL).openStream();
+ }
+ keyStore.load(keyStoreStream, keyStorePass != null ? keyStorePass.toCharArray()
: null);
return keyStore.getCertificate(idpCertificateAlias).getPublicKey();
}
catch (KeyStoreException e)
@@ -505,16 +495,16 @@
throw new RuntimeException(e);
}
}
-
+
private AuthnRequestType createSAMLRequest(String serviceURL, String identityURL)
throws ConfigurationException
{
- if(serviceURL == null)
+ if (serviceURL == null)
throw new IllegalArgumentException("serviceURL is null");
- if(identityURL == null)
+ if (identityURL == null)
throw new IllegalArgumentException("identityURL is null");
-
+
SAML2Request saml2Request = new SAML2Request();
String id = IDGenerator.create("ID_");
- return saml2Request.createAuthnRequestType(id, serviceURL, identityURL,
serviceURL);
+ return saml2Request.createAuthnRequestType(id, serviceURL, identityURL,
serviceURL);
}
}
Added:
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/resources/jbid_test_keystore.jks
===================================================================
(Binary files differ)
Property changes on:
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/resources/jbid_test_keystore.jks
___________________________________________________________________
Name: svn:mime-type
+ application/octet-stream
Modified:
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/webapp/WEB-INF/components.xml
===================================================================
---
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/webapp/WEB-INF/components.xml 2009-08-29
07:09:51 UTC (rev 752)
+++
identity-federation/trunk/jboss-identity-webapps/seam-sp/src/main/webapp/WEB-INF/components.xml 2009-08-29
17:10:40 UTC (rev 753)
@@ -12,10 +12,10 @@
name="org.jboss.identity.seam.federation.samlAuthenticationFilter">
<property
name="identityProviderURL">http://localhost:8080/idp-sig-no-val</property>
<property
name="singleSignOnServiceURL">http://localhost:8080/idp-sig-no-val/</property>
- <property
name="keyStoreURL">file:/etc/keystores/samlkeystore</property>
- <property name="keyStorePass">jajaja</property>
- <property name="idpCertificateAlias">saml</property>
+ <property
name="keyStoreURL">classpath:/jbid_test_keystore.jks</property>
+ <property name="keyStorePass">store123</property>
+ <property name="idpCertificateAlias">servercert</property>
<property name="binding">HTTP_Post</property>
- <property name="signatureRequired">false</property>
+ <property name="signatureRequired">true</property>
</component>
</components>
\ No newline at end of file