Author: anil.saldhana(a)jboss.com Date: 2009-01-22 16:19:38 -0500 (Thu, 22 Jan 2009) New Revision: 244 Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java Log: use config Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-01-22 20:46:48 UTC (rev 243) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-01-22 21:19:38 UTC (rev 244) @@ -31,17 +31,24 @@ import javax.servlet.ServletException; import javax.servlet.http.HttpServletResponse; +import org.apache.catalina.Context; +import org.apache.catalina.Lifecycle; +import org.apache.catalina.LifecycleException; +import org.apache.catalina.LifecycleListener; import org.apache.catalina.connector.Request; import org.apache.catalina.connector.Response; +import org.apache.catalina.util.LifecycleSupport; import org.apache.catalina.valves.ValveBase; import org.apache.log4j.Logger; import org.jboss.identity.federation.api.saml.v2.common.IDGenerator; import org.jboss.identity.federation.api.saml.v2.request.SAML2Request; import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; +import org.jboss.identity.federation.bindings.config.IDP; import org.jboss.identity.federation.bindings.interfaces.RoleGenerator; import org.jboss.identity.federation.bindings.tomcat.TomcatRoleGenerator; import org.jboss.identity.federation.bindings.util.HTTPRedirectUtil; import org.jboss.identity.federation.bindings.util.RedirectBindingUtil; +import org.jboss.identity.federation.bindings.util.ValveUtil; import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants; import org.jboss.identity.federation.core.saml.v2.holders.IDPInfoHolder; import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder; @@ -56,26 +63,18 @@ * @author Anil.Saldhana(a)redhat.com * @since Dec 9, 2008 */ -public class IDPRedirectValve extends ValveBase +public class IDPRedirectValve extends ValveBase implements Lifecycle { - private static Logger log = Logger.getLogger(IDPRedirectValve.class); ; + private static Logger log = Logger.getLogger(IDPRedirectValve.class); + protected IDP idpConfiguration = null; + private RoleGenerator rg = new TomcatRoleGenerator(); private long assertionValidity = 5000; // 5minutes in seconds - private String identityURL = null; - - public void setAssertionValidity(String validity) - { - assertionValidity = Long.parseLong(validity); - } + private String identityURL = null; - public void setIdentityURL(String url) - { - this.identityURL = url; - } - public IDPRedirectValve() { super(); @@ -224,4 +223,103 @@ { return request.getParameter("SAMLRequest"); } + + //***************Catalina Lifecyle methods + /** + * The lifecycle event support for this component. + */ + protected LifecycleSupport lifecycle = new LifecycleSupport(this); + + /** + * Has this component been started yet? + */ + private boolean started = false; + + + + /** + * Add a lifecycle event listener to this component. + * + * @param listener The listener to add + */ + public void addLifecycleListener(LifecycleListener listener) + { + lifecycle.addLifecycleListener(listener); + } + + + /** + * Get the lifecycle listeners associated with this lifecycle. If this + * Lifecycle has no listeners registered, a zero-length array is returned. + */ + public LifecycleListener[] findLifecycleListeners() + { + return lifecycle.findLifecycleListeners(); + } + + + /** + * Remove a lifecycle event listener from this component. + * + * @param listener The listener to add + */ + public void removeLifecycleListener(LifecycleListener listener) + { + lifecycle.removeLifecycleListener(listener); + } + + + /** + * Prepare for the beginning of active use of the public methods of this + * component. This method should be called after <code>configure()</code>, + * and before any of the public methods of the component are utilized. + * + * @exception LifecycleException if this component detects a fatal error + * that prevents this component from being used + */ + public void start() throws LifecycleException + { + // Validate and update our current component state + if (started) + throw new LifecycleException + ("IDPRedirectValve already Started"); + lifecycle.fireLifecycleEvent(START_EVENT, null); + started = true; + + String configFile = "WEB-INF/jboss-idfed.xml"; + Context context = (Context) getContainer(); + InputStream is = context.getServletContext().getResourceAsStream(configFile); + if(is == null) + throw new RuntimeException(configFile + " missing"); + try + { + idpConfiguration = ValveUtil.getIDPConfiguration(is); + this.identityURL = idpConfiguration.getIdentityURL(); + log.trace("Identity Provider URL=" + this.identityURL); + this.assertionValidity = idpConfiguration.getAssertionValidity(); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + + /** + * Gracefully terminate the active use of the public methods of this + * component. This method should be the last one called on a given + * instance of this component. + * + * @exception LifecycleException if this component detects a fatal error + * that needs to be reported + */ + public void stop() throws LifecycleException + { + // Validate and update our current component state + if (!started) + throw new LifecycleException + ("IDPRedirectValve NotStarted"); + lifecycle.fireLifecycleEvent(STOP_EVENT, null); + started = false; + } } \ No newline at end of file Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-01-22 20:46:48 UTC (rev 243) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-01-22 21:19:38 UTC (rev 244) @@ -21,16 +21,15 @@ */ package org.jboss.identity.federation.bindings.tomcat.idp; -import java.io.InputStream; -import java.security.KeyStore; import java.security.PrivateKey; import java.security.PublicKey; +import org.apache.catalina.LifecycleException; import org.apache.catalina.connector.Request; import org.apache.log4j.Logger; +import org.jboss.identity.federation.bindings.config.KeyProvider; +import org.jboss.identity.federation.bindings.interfaces.TrustKeyManager; import org.jboss.identity.federation.bindings.util.RedirectBindingSignatureUtil; -import org.jboss.identity.federation.bindings.util.ValveUtil; -import org.jboss.identity.federation.bindings.util.cert.KeyStoreUtil; import org.jboss.identity.federation.core.saml.v2.util.SignatureUtil; @@ -41,17 +40,13 @@ * @since Jan 14, 2009 */ public class IDPRedirectWithSignatureValve extends IDPRedirectValve -{ - private static Logger log = Logger.getLogger(IDPRedirectWithSignatureValve.class); - private String keyStore; - private char[] keypass; - private String alias; - private String keyStorePass; +{ + private static Logger log = Logger.getLogger(IDPRedirectWithSignatureValve.class); - private KeyStore ks = null; - private boolean ignoreSignature = false; + private TrustKeyManager keyManager; + public IDPRedirectWithSignatureValve() { super(); @@ -61,28 +56,33 @@ { if(val != null && val.length() > 0) this.ignoreSignature = Boolean.valueOf(val); - } - - public void setKeyStore(String keyStore) - { - this.keyStore = keyStore; - } + } - public void setKeyStorePass(String keyStorePass) - { - this.keyStorePass = keyStorePass; - } + @Override + public void start() throws LifecycleException + { + super.start(); + KeyProvider keyProvider = this.idpConfiguration.getKeyProvider(); + try + { + ClassLoader tcl = SecurityActions.getContextClassLoader(); + String keyManagerClassName = keyProvider.getClassName(); + if(keyManagerClassName == null) + throw new RuntimeException("KeyManager class name is null"); + + Class<?> clazz = tcl.loadClass(keyManagerClassName); + this.keyManager = (TrustKeyManager) clazz.newInstance(); + keyManager.setAuthProperties(keyProvider.getAuth()); + keyManager.setValidatingAlias(keyProvider.getValidatingAlias()); + } + catch(Exception e) + { + log.error("Exception reading configuration:",e); + throw new LifecycleException(e.getLocalizedMessage()); + } + log.trace("Key Provider=" + keyProvider.getClassName()); + } - public void setKeyPass(String keypass) - { - this.keypass = keypass.toCharArray(); - } - - public void setAlias(String alias) - { - this.alias = alias; - } - protected boolean validate(Request request) throws Exception { boolean result = super.validate(request); @@ -115,7 +115,7 @@ } sb.append("&SigAlg=").append(sigAlgFromURL); - PublicKey validatingKey = getValidatingKey(); + PublicKey validatingKey = keyManager.getValidatingKey(request.getRemoteAddr()); boolean isValid = SignatureUtil.validate(sb.toString().getBytes("UTF-8"), sigValue, validatingKey); return isValid; } @@ -126,7 +126,7 @@ try { //Get the signing key - PrivateKey signingKey = getSigningKey(); + PrivateKey signingKey = keyManager.getSigningKey(); StringBuffer sb = new StringBuffer(); String url = RedirectBindingSignatureUtil.getSAMLResponseURLWithSignature(urlEncodedResponse, urlEncodedRelayState, signingKey); sb.append("?").append(url); @@ -137,25 +137,4 @@ throw new RuntimeException(e); } } - - - protected PrivateKey getSigningKey() throws Exception - { - if(ks == null) - { - InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStore); - ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); - } - return (PrivateKey) ks.getKey(alias, keypass); - } - - protected PublicKey getValidatingKey() throws Exception - { - if(ks == null) - { - InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStore); - ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); - } - return KeyStoreUtil.getPublicKey(ks, alias, keypass); - } } \ No newline at end of file Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java 2009-01-22 20:46:48 UTC (rev 243) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java 2009-01-22 21:19:38 UTC (rev 244) @@ -29,7 +29,8 @@ import javax.xml.bind.JAXBElement; import javax.xml.bind.Unmarshaller; -import org.jboss.identity.federation.bindings.config.SP; +import org.jboss.identity.federation.bindings.config.IDP; +import org.jboss.identity.federation.bindings.config.SP; import org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLBaseFactory; /** @@ -72,6 +73,18 @@ } @SuppressWarnings("unchecked") + public static IDP getIDPConfiguration(InputStream is) throws Exception + { + if(is == null) + throw new IllegalArgumentException("inputstream is null"); + String schema = "schema/config/jboss-identity-fed.xsd"; + + Unmarshaller un = JBossSAMLBaseFactory.getValidatingUnmarshaller("org.jboss.identity.federation.bindings.config", schema); + JAXBElement<IDP> jaxbSp = (JAXBElement<IDP>) un.unmarshal(is); + return jaxbSp.getValue(); + } + + @SuppressWarnings("unchecked") public static SP getSPConfiguration(InputStream is) throws Exception { if(is == null)