Author: anil.saldhana(a)jboss.com Date: 2009-11-06 12:28:15 -0500 (Fri, 06 Nov 2009) New Revision: 908 Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/interfaces/IMetadataProvider.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/AbstractMetadataProvider.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntitiesMetadataProvider.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntityMetadataProvider.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/MetaDataBuilderDelegate.java identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/SecurityActions.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/MetadataServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SOAPSAMLXACMLServlet.java identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SecurityActions.java Removed: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/AbstractMetadataProvider.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntitiesMetadataProvider.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntityMetadataProvider.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/IMetadataProvider.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/SecurityActions.java identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/SOAPSAMLXACMLServlet.java identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/MetaDataBuilder.java identity-federation/trunk/jboss-identity-webapps/metadata/resources/WEB-INF/web.xml Log: move classes out of bindings into core/web Deleted: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/AbstractMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/AbstractMetadataProvider.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/AbstractMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -1,43 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.identity.federation.bindings.providers; - -import java.util.Map; - -/** - * Abstract Metadata provider - * @author Anil.Saldhana(a)redhat.com - * @since Apr 21, 2009 - */ -public abstract class AbstractMetadataProvider -{ - protected Map<String, String> options; - - /** - * @see IMetadataProvider#init(Map) - * @param options - */ - public void init(Map<String,String> options) - { - this.options = options; - } -} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntitiesMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntitiesMetadataProvider.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntitiesMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -1,63 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.identity.federation.bindings.providers; - -import java.io.InputStream; -import java.security.PublicKey; - -import org.jboss.identity.federation.saml.v2.metadata.EntitiesDescriptorType; - -/** - * File based provider that handles multiple entities - * @author Anil.Saldhana(a)redhat.com - * @since Apr 21, 2009 - */ -public class FileBasedEntitiesMetadataProvider extends AbstractMetadataProvider -implements IMetadataProvider<EntitiesDescriptorType> -{ - public EntitiesDescriptorType getMetaData() - { - throw new RuntimeException("NYI"); - } - - public boolean isMultiple() - { - return true; - } - - public void injectEncryptionKey(PublicKey publicKey) - { - } - - public void injectFileStream(InputStream fileStream) - { - } - - public void injectSigningKey(PublicKey publicKey) - { - } - - public String requireFileInjection() - { - return null; - } -} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntityMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntityMetadataProvider.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/FileBasedEntityMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -1,112 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.identity.federation.bindings.providers; - -import java.io.InputStream; -import java.security.PublicKey; -import java.util.Map; - -import javax.xml.bind.JAXBElement; - -import org.jboss.identity.federation.api.saml.v2.metadata.MetaDataBuilder; -import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; - -/** - * A file based metadata provider that - * just looks for the passed in file name - * @author Anil.Saldhana(a)redhat.com - * @since Apr 21, 2009 - */ -public class FileBasedEntityMetadataProvider extends AbstractMetadataProvider -implements IMetadataProvider<EntityDescriptorType> -{ - - private static final String FILENAME_KEY = "FileName"; - private String fileName; - private InputStream metadataFileStream; - @SuppressWarnings("unused") - private PublicKey encryptionKey; - @SuppressWarnings("unused") - private PublicKey signingKey; - - @Override - public void init(Map<String, String> options) - { - super.init(options); - fileName = options.get(FILENAME_KEY); - if(fileName == null) - throw new IllegalStateException("FileName option not set"); - } - - /** - * @see IMetadataProvider#getMetaData() - */ - @SuppressWarnings("unchecked") - public EntityDescriptorType getMetaData() - { - EntityDescriptorType edt = null; - - if(this.metadataFileStream == null) - throw new RuntimeException("Metadata file is not injected"); - - try - { - JAXBElement<EntityDescriptorType> j = - (JAXBElement<EntityDescriptorType>) MetaDataBuilder.getUnmarshaller().unmarshal(metadataFileStream); - edt = j.getValue(); - //TODO: use the signing and enc key data - } - catch(Exception e) - { - throw new RuntimeException(e); - } - return edt; - } - - /** - * @see IMetadataProvider#isMultiple() - */ - public boolean isMultiple() - { - return false; - } - - public void injectEncryptionKey(PublicKey publicKey) - { - this.encryptionKey = publicKey; - } - - public void injectFileStream(InputStream fileStream) - { - this.metadataFileStream = fileStream; - } - - public void injectSigningKey(PublicKey publicKey) - { - this.signingKey = publicKey; - } - - public String requireFileInjection() - { - return this.fileName; - } -} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/IMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/IMetadataProvider.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/IMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -1,78 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.identity.federation.bindings.providers; - -import java.io.InputStream; -import java.security.PublicKey; -import java.util.Map; - -/** - * MetadataProvider - * @author Anil.Saldhana(a)redhat.com - * @since Apr 21, 2009 - */ -public interface IMetadataProvider<T> -{ - /** - * Initialize the provider with options - * @param options - */ - void init(Map<String,String> options); - - /** - * Is multiple descriptors attached? - * @return - */ - boolean isMultiple(); - - /** - * Get the Metadata descriptors - * @return - */ - T getMetaData(); - - /** - * Provider indicates that it requires - * an injection of File instance - * @return File Name (need injection) or null - */ - String requireFileInjection(); - - /** - * Inject a File instance depending on - * @see #requireFileInjection() method - * @param fileStream - */ - void injectFileStream(InputStream fileStream); - - /** - * Inject a public key used for signing - * @param publicKey - */ - void injectSigningKey(PublicKey publicKey); - - /** - * Inject a public key used for encryption - * @param publicKey - */ - void injectEncryptionKey(PublicKey publicKey); -} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/SecurityActions.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/SecurityActions.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/providers/SecurityActions.java 2009-11-06 17:28:15 UTC (rev 908) @@ -1,57 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.identity.federation.bindings.providers; - -import java.security.AccessController; -import java.security.PrivilegedAction; - -/** - * Privileged Blocks - * @author Anil.Saldhana(a)redhat.com - * @since Mar 17, 2009 - */ -class SecurityActions -{ - static void setSystemProperty( final String key, final String value) - { - AccessController.doPrivileged(new PrivilegedAction<Object>() - { - public Object run() - { - System.setProperty(key, value); - return null; - } - }); - } - - static ClassLoader getContextClassLoader() - { - return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() - { - public ClassLoader run() - { - return Thread.currentThread().getContextClassLoader(); - } - }); - } - -} \ No newline at end of file Deleted: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/MetadataServlet.java 2009-11-06 17:28:15 UTC (rev 908) @@ -1,202 +0,0 @@ -/* - * JBoss, Home of Professional Open Source. - * Copyright 2008, Red Hat Middleware LLC, and individual contributors - * as indicated by the @author tags. See the copyright.txt file in the - * distribution for a full listing of individual contributors. - * - * This is free software; you can redistribute it and/or modify it - * under the terms of the GNU Lesser General Public License as - * published by the Free Software Foundation; either version 2.1 of - * the License, or (at your option) any later version. - * - * This software is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this software; if not, write to the Free - * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA - * 02110-1301 USA, or see the FSF site: http://www.fsf.org. - */ -package org.jboss.identity.federation.bindings.servlets; - -import java.io.IOException; -import java.io.InputStream; -import java.io.OutputStream; -import java.security.cert.Certificate; -import java.util.HashMap; -import java.util.List; -import java.util.Map; - -import javax.servlet.ServletConfig; -import javax.servlet.ServletContext; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.xml.bind.JAXBElement; - -import org.apache.log4j.Logger; -import org.jboss.identity.federation.api.saml.v2.metadata.KeyDescriptorMetaDataBuilder; -import org.jboss.identity.federation.api.saml.v2.metadata.MetaDataBuilder; -import org.jboss.identity.federation.api.util.KeyUtil; -import org.jboss.identity.federation.bindings.providers.IMetadataProvider; -import org.jboss.identity.federation.core.config.KeyProviderType; -import org.jboss.identity.federation.core.config.KeyValueType; -import org.jboss.identity.federation.core.config.MetadataProviderType; -import org.jboss.identity.federation.core.config.ProviderType; -import org.jboss.identity.federation.core.interfaces.TrustKeyManager; -import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLConstants; -import org.jboss.identity.federation.core.util.XMLEncryptionUtil; -import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; -import org.jboss.identity.federation.saml.v2.metadata.KeyDescriptorType; -import org.jboss.identity.federation.saml.v2.metadata.RoleDescriptorType; -import org.jboss.identity.federation.web.constants.GeneralConstants; -import org.jboss.identity.federation.web.util.ConfigurationUtil; -import org.jboss.identity.xmlsec.w3.xmldsig.KeyInfoType; - - -import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; - -/** - * Metadata servlet for the IDP/SP - * @author Anil.Saldhana(a)redhat.com - * @since Apr 22, 2009 - */ -public class MetadataServlet extends HttpServlet -{ - private static final long serialVersionUID = 1L; - private static Logger log = Logger.getLogger(MetadataServlet.class); - private boolean trace = log.isTraceEnabled(); - - private String configFileLocation = GeneralConstants.CONFIG_FILE_LOCATION; - private transient MetadataProviderType metadataProviderType = null; - - private transient IMetadataProvider<?> metadataProvider = null; - - private transient EntityDescriptorType metadata; - - private String signingAlias = null; - private String encryptingAlias = null; - private TrustKeyManager keyManager; - - @SuppressWarnings("unchecked") - @Override - public void init(ServletConfig config) throws ServletException - { - super.init(config); - try - { - ServletContext context = config.getServletContext(); - String configL = config.getInitParameter("configFile"); - if(isNotNull(configL)) - configFileLocation = configL; - if(trace) - log.trace("Config File Location="+ configFileLocation); - InputStream is = context.getResourceAsStream(configFileLocation); - if(is == null) - throw new RuntimeException(configFileLocation + " missing"); - - //Look for signing alias - signingAlias = config.getInitParameter("signingAlias"); - encryptingAlias = config.getInitParameter("encryptingAlias"); - - ProviderType providerType = ConfigurationUtil.getIDPConfiguration(is); - metadataProviderType = providerType.getMetaDataProvider(); - String fqn = metadataProviderType.getClassName(); - ClassLoader tcl = SecurityActions.getContextClassLoader(); - Class<?> clazz = tcl.loadClass(fqn); - metadataProvider = (IMetadataProvider) clazz.newInstance(); - List<KeyValueType> keyValues = metadataProviderType.getOption(); - Map<String,String> options = new HashMap<String,String>(); - if(keyValues != null) - { - for(KeyValueType kvt: keyValues) - options.put(kvt.getKey(), kvt.getValue()); - } - metadataProvider.init(options); - if(metadataProvider.isMultiple()) - throw new RuntimeException("Multiple Entities not currently supported"); - - /** - * Since a metadata provider does not have access to the servlet context. - * It may be difficult to get to the resource from the TCL. - */ - String fileInjectionStr = metadataProvider.requireFileInjection(); - if(isNotNull(fileInjectionStr)) - { - metadataProvider.injectFileStream(context.getResourceAsStream(fileInjectionStr)); - } - - metadata = (EntityDescriptorType) metadataProvider.getMetaData(); - - //Get the trust manager information - KeyProviderType keyProvider = providerType.getKeyProvider(); - signingAlias = keyProvider.getSigningAlias(); - String keyManagerClassName = keyProvider.getClassName(); - if(keyManagerClassName == null) - throw new RuntimeException("KeyManager class name is null"); - - clazz = tcl.loadClass(keyManagerClassName); - this.keyManager = (TrustKeyManager) clazz.newInstance(); - keyManager.setAuthProperties(keyProvider.getAuth()); - - Certificate cert = keyManager.getCertificate(signingAlias); - KeyInfoType keyInfo = KeyUtil.getKeyInfo(cert); - - //TODO: Assume just signing key for now - KeyDescriptorType keyDescriptor = KeyDescriptorMetaDataBuilder.createKeyDescriptor(keyInfo, - null, 0, true, false); - - updateKeyDescriptor(metadata, keyDescriptor); - - //encryption - if(this.encryptingAlias != null) - { - cert = keyManager.getCertificate(encryptingAlias); - keyInfo = KeyUtil.getKeyInfo(cert); - String certAlgo = cert.getPublicKey().getAlgorithm(); - keyDescriptor = KeyDescriptorMetaDataBuilder.createKeyDescriptor(keyInfo, - XMLEncryptionUtil.getEncryptionURL(certAlgo), - XMLEncryptionUtil.getEncryptionKeySize(certAlgo), false, true); - updateKeyDescriptor(metadata, keyDescriptor); - } - } catch(Exception e) - { - log.error("Exception in starting servlet:",e); - throw new ServletException("Unable to start servlet"); - } - - } - - - @Override - protected void doGet(HttpServletRequest req, HttpServletResponse resp) - throws ServletException, IOException - { - resp.setContentType(JBossSAMLConstants.METADATA_MIME.get()); - OutputStream os = resp.getOutputStream(); - JAXBElement<?> jaxbEl = MetaDataBuilder.getObjectFactory().createEntityDescriptor(metadata); - try - { - MetaDataBuilder.getMarshaller().marshal(jaxbEl , os); - } - catch (Exception e) - { - throw new RuntimeException(e); - } - } - - private void updateKeyDescriptor(EntityDescriptorType entityD, KeyDescriptorType keyD) - { - List<RoleDescriptorType> objs = entityD.getRoleDescriptorOrIDPSSODescriptorOrSPSSODescriptor(); - if(objs != null) - { - for(RoleDescriptorType roleD: objs) - { - roleD.getKeyDescriptor().add(keyD); - } - } - } -} \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/SOAPSAMLXACMLServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/SOAPSAMLXACMLServlet.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-bindings/src/main/java/org/jboss/identity/federation/bindings/servlets/SOAPSAMLXACMLServlet.java 2009-11-06 17:28:15 UTC (rev 908) @@ -21,267 +21,14 @@ */ package org.jboss.identity.federation.bindings.servlets; -import java.io.IOException; -import java.io.InputStream; -import java.io.OutputStream; -import java.security.PrivilegedActionException; -import java.util.ArrayList; -import java.util.List; -import javax.servlet.ServletConfig; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServlet; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.xml.bind.JAXBElement; -import javax.xml.bind.JAXBException; -import javax.xml.bind.Marshaller; -import javax.xml.bind.Unmarshaller; -import javax.xml.bind.helpers.DefaultValidationEventHandler; - -import org.apache.log4j.Logger; -import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; -import org.jboss.identity.federation.core.factories.SOAPFactory; -import org.jboss.identity.federation.core.factories.XACMLContextFactory; -import org.jboss.identity.federation.core.saml.v2.common.IDGenerator; -import org.jboss.identity.federation.core.saml.v2.factories.SAMLAssertionFactory; -import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder; -import org.jboss.identity.federation.core.saml.v2.util.DocumentUtil; -import org.jboss.identity.federation.core.saml.v2.util.JAXBElementMappingUtil; -import org.jboss.identity.federation.core.saml.v2.util.SOAPSAMLXACMLUtil; -import org.jboss.identity.federation.core.saml.v2.util.XMLTimeUtil; -import org.jboss.identity.federation.core.util.JAXBUtil; -import org.jboss.identity.federation.org.xmlsoap.schemas.soap.envelope.Body; -import org.jboss.identity.federation.org.xmlsoap.schemas.soap.envelope.Envelope; -import org.jboss.identity.federation.org.xmlsoap.schemas.soap.envelope.Fault; -import org.jboss.identity.federation.saml.v2.assertion.AssertionType; -import org.jboss.identity.federation.saml.v2.assertion.StatementAbstractType; -import org.jboss.identity.federation.saml.v2.profiles.xacml.assertion.XACMLAuthzDecisionStatementType; -import org.jboss.identity.federation.saml.v2.profiles.xacml.protocol.XACMLAuthzDecisionQueryType; -import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; -import org.jboss.security.xacml.core.JBossPDP; -import org.jboss.security.xacml.core.JBossRequestContext; -import org.jboss.security.xacml.core.model.context.RequestType; -import org.jboss.security.xacml.core.model.context.ResponseType; -import org.jboss.security.xacml.core.model.context.ResultType; -import org.jboss.security.xacml.interfaces.PolicyDecisionPoint; -import org.jboss.security.xacml.interfaces.RequestContext; -import org.jboss.security.xacml.interfaces.ResponseContext; -import org.w3c.dom.Document; -import org.w3c.dom.Element; - /** * Servlet that can read SOAP 1.1 messages that contain * an XACML query in saml payload * @author Anil.Saldhana(a)redhat.com * @since Jan 27, 2009 */ -public class SOAPSAMLXACMLServlet extends HttpServlet -{ - private static Logger log = Logger.getLogger(SOAPSAMLXACMLServlet.class); - private boolean trace = log.isTraceEnabled(); - - private static final long serialVersionUID = 1L; - - private String policyConfigFileName = null; - - private String issuerId = null; - private String issuer = null; - - boolean debug = false; - - private transient PolicyDecisionPoint pdp = null; - - public void init(ServletConfig config) throws ServletException - { - issuerId = config.getInitParameter("issuerID"); - if(issuerId == null) - issuerId = "issue-id:1"; - - issuer = config.getInitParameter("issuer"); - if(issuer == null) - issuer = "urn:jboss-identity"; - - policyConfigFileName = config.getInitParameter("policyConfigFileName"); - if(policyConfigFileName == null) - policyConfigFileName = "policyConfig.xml"; - - String debugStr = config.getInitParameter("debug"); - try - { - debug = Boolean.parseBoolean(debugStr); - } - catch(Exception ignore) - { - debug = false; - } - - if(trace) - { - log.trace("Issuer=" + issuer + " :: issuerID=" + issuerId); - log.trace("PolicyConfig File:" + policyConfigFileName); - log.trace("Debug="+debug); - } - - if(debug) - { - SecurityActions.setSystemProperty("jaxb.debug", "true"); - } - - try - { - pdp = this.getPDP(); - } - catch (PrivilegedActionException e) - { - log("Exception loading PDP::",e); - throw new ServletException("Unable to load PDP"); - } - super.init(config); - } - - - @SuppressWarnings("unchecked") - @Override - protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException - { - JAXBElement<RequestAbstractType> jaxbRequestType = null; - - Envelope envelope = null; - XACMLAuthzDecisionQueryType xacmlRequest = null; - - try - { - Document inputDoc = DocumentUtil.getDocument(req.getInputStream()); - if(debug && trace) - log.trace("Received SOAP:"+DocumentUtil.getDocumentAsString(inputDoc)); - - Unmarshaller un = JAXBUtil.getUnmarshaller(SOAPSAMLXACMLUtil.getPackage()); - if(debug) - un.setEventHandler(new DefaultValidationEventHandler()); - - Object unmarshalledObject = un.unmarshal(DocumentUtil.getNodeAsStream(inputDoc)); - - if(unmarshalledObject instanceof JAXBElement) - { - JAXBElement<?> jaxbElement = (JAXBElement<?>) unmarshalledObject; - Object element = jaxbElement.getValue(); - if(element instanceof Envelope) - { - envelope = (Envelope)element; - Body soapBody = envelope.getBody(); - Object samlRequest = soapBody.getAny().get(0); - if(samlRequest instanceof JAXBElement) - { - jaxbRequestType = (JAXBElement<RequestAbstractType>)samlRequest; - jaxbRequestType = (JAXBElement<RequestAbstractType>)samlRequest; - xacmlRequest = (XACMLAuthzDecisionQueryType) jaxbRequestType.getValue(); - } - else - if(samlRequest instanceof Element) - { - Element elem = (Element) samlRequest; - xacmlRequest = SOAPSAMLXACMLUtil.getXACMLQueryType(elem); - } - } - else if(element instanceof XACMLAuthzDecisionQueryType) - { - xacmlRequest = (XACMLAuthzDecisionQueryType) element; - } - } - if(xacmlRequest == null) - throw new IOException("XACML Request not parsed"); - - RequestType requestType = xacmlRequest.getRequest(); - - RequestContext requestContext = new JBossRequestContext(); - requestContext.setRequest(requestType); - - //pdp evaluation is thread safe - ResponseContext responseContext = pdp.evaluate(requestContext); - - ResponseType responseType = new ResponseType(); - ResultType resultType = responseContext.getResult(); - responseType.getResult().add(resultType); - - XACMLAuthzDecisionStatementType xacmlStatement = - XACMLContextFactory.createXACMLAuthzDecisionStatementType(requestType, responseType); - - //Place the xacml statement in an assertion - //Then the assertion goes inside a SAML Response - - String ID = IDGenerator.create("ID_"); - SAML2Response saml2Response = new SAML2Response(); - IssuerInfoHolder issuerInfo = new IssuerInfoHolder(this.issuer); - - List<StatementAbstractType> statements = new ArrayList<StatementAbstractType>(); - statements.add(xacmlStatement); - - AssertionType assertion = SAMLAssertionFactory.createAssertion(ID, - issuerInfo.getIssuer(), - XMLTimeUtil.getIssueInstant(), - null, - null, - statements); - - JAXBElement<?> jaxbResponse = JAXBElementMappingUtil.get(saml2Response.createResponseType(ID, issuerInfo, assertion)); - - //Create a SOAP Envelope to hold the SAML response - envelope = this.createEnvelope(jaxbResponse); - } - catch (JAXBException e) - { - String id = IDGenerator.create(); - log.error(id + "::Exception parsing SOAP:", e); - envelope = this.createEnvelope(this.createFault("Parsing Error. Reference::" + id)); - } - catch (Exception e) - { - String id = IDGenerator.create(); - log.error(id + "::Exception:", e); - envelope = this.createEnvelope(this.createFault("Server Error. Reference::" + id)); - } - finally - { - resp.setContentType("text/xml;charset=utf-8");; - OutputStream os = resp.getOutputStream(); - try - { - if(envelope == null) - throw new IllegalStateException("SOAPEnvelope is null"); - JAXBElement<?> jaxbEnvelope = JAXBElementMappingUtil.get(envelope); - Marshaller marshaller = JAXBUtil.getMarshaller(SOAPSAMLXACMLUtil.getPackage()); - marshaller.marshal(jaxbEnvelope, os); - } - catch (JAXBException e) - { - log("marshalling exception",e); - } - } - } - - private PolicyDecisionPoint getPDP() throws PrivilegedActionException - { - ClassLoader tcl = SecurityActions.getContextClassLoader(); - InputStream is = tcl.getResourceAsStream(this.policyConfigFileName); - if(is == null) - throw new IllegalStateException(policyConfigFileName + " could not be located"); - return new JBossPDP(is); - } - - private Envelope createEnvelope(Object obj) - { - Envelope envelope = SOAPFactory.getObjectFactory().createEnvelope(); - Body body = SOAPFactory.getObjectFactory().createBody(); - body.getAny().add(obj); - envelope.setBody(body); - return envelope; - } - - private JAXBElement<Fault> createFault(String msg) - { - Fault fault = SOAPFactory.getObjectFactory().createFault(); - fault.setFaultstring(msg); - return SOAPFactory.getObjectFactory().createFault(fault); - } +public class SOAPSAMLXACMLServlet extends org.jboss.identity.federation.web.servlets.saml.SOAPSAMLXACMLServlet +{ + private static final long serialVersionUID = 1L; } \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/MetaDataBuilder.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/MetaDataBuilder.java 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-fed-api/src/main/java/org/jboss/identity/federation/api/saml/v2/metadata/MetaDataBuilder.java 2009-11-06 17:28:15 UTC (rev 908) @@ -27,15 +27,12 @@ import javax.xml.bind.Marshaller; import javax.xml.bind.Unmarshaller; -import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLConstants; -import org.jboss.identity.federation.core.util.JAXBUtil; +import org.jboss.identity.federation.core.saml.md.providers.MetaDataBuilderDelegate; import org.jboss.identity.federation.saml.v2.assertion.AttributeType; import org.jboss.identity.federation.saml.v2.metadata.EndpointType; import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; import org.jboss.identity.federation.saml.v2.metadata.IDPSSODescriptorType; import org.jboss.identity.federation.saml.v2.metadata.KeyDescriptorType; -import org.jboss.identity.federation.saml.v2.metadata.LocalizedNameType; -import org.jboss.identity.federation.saml.v2.metadata.LocalizedURIType; import org.jboss.identity.federation.saml.v2.metadata.ObjectFactory; import org.jboss.identity.federation.saml.v2.metadata.OrganizationType; import org.jboss.identity.federation.saml.v2.metadata.SPSSODescriptorType; @@ -47,10 +44,7 @@ * @since Apr 19, 2009 */ public class MetaDataBuilder -{ - private static ObjectFactory oFact = new ObjectFactory(); - - private static String pkgName = "org.jboss.identity.federation.saml.v2.metadata"; +{ /** * Create an Endpoint (SingleSignOnEndpoint or SingleLogoutEndpoint) * @param binding @@ -61,11 +55,7 @@ public static EndpointType createEndpoint(String binding, String location, String responseLocation) { - EndpointType endpoint = oFact.createEndpointType(); - endpoint.setBinding(binding); - endpoint.setLocation(location); - endpoint.setResponseLocation(responseLocation); - return endpoint; + return MetaDataBuilderDelegate.createEndpoint(binding, location, responseLocation); } /** @@ -79,35 +69,7 @@ public static OrganizationType createOrganization(String organizationName, String organizationDisplayName, String organizationURL, String lang) { - if(organizationName == null) - throw new IllegalArgumentException("organizationName is null"); - if(organizationDisplayName == null) - throw new IllegalArgumentException("organizationDisplayName is null"); - if(organizationURL == null) - throw new IllegalArgumentException("organizationURL is null"); - if(lang == null) - lang = JBossSAMLConstants.LANG_EN.get(); - - //orgName - LocalizedNameType orgName = oFact.createLocalizedNameType(); - orgName.setValue(organizationName); - orgName.setLang(lang); - - //orgDisplayName - LocalizedNameType orgDisplayName = oFact.createLocalizedNameType(); - orgDisplayName.setValue(organizationDisplayName); - orgDisplayName.setLang(lang); - - //orgURL - LocalizedURIType orgURL = oFact.createLocalizedURIType(); - orgURL.setValue(organizationURL); - orgURL.setLang(lang); - - OrganizationType orgType = oFact.createOrganizationType(); - orgType.getOrganizationName().add(orgName); - orgType.getOrganizationDisplayName().add(orgDisplayName); - orgType.getOrganizationURL().add(orgURL); - return orgType; + return MetaDataBuilderDelegate.createOrganization(organizationName, organizationDisplayName, organizationURL, lang); } /** @@ -117,9 +79,7 @@ */ public static EntityDescriptorType createEntityDescriptor(SSODescriptorType idpOrSPDescriptor) { - EntityDescriptorType entity = oFact.createEntityDescriptorType(); - entity.getRoleDescriptorOrIDPSSODescriptorOrSPSSODescriptor().add(idpOrSPDescriptor); - return entity; + return MetaDataBuilderDelegate.createEntityDescriptor(idpOrSPDescriptor); } /** @@ -139,14 +99,8 @@ List<AttributeType> attributes, OrganizationType org) { - IDPSSODescriptorType idp = oFact.createIDPSSODescriptorType(); - idp.getSingleSignOnService().add(ssoEndPoint); - idp.getSingleLogoutService().add(sloEndPoint); - idp.getAttribute().addAll(attributes); - idp.getKeyDescriptor().add(keyDescriptorType); - idp.setWantAuthnRequestsSigned(requestsSigned); - idp.setOrganization(org); - return idp; + return MetaDataBuilderDelegate.createIDPSSODescriptor(requestsSigned, + keyDescriptorType, ssoEndPoint, sloEndPoint, attributes, org); } /** @@ -165,12 +119,8 @@ List<AttributeType> attributes, OrganizationType org) { - SPSSODescriptorType sp = oFact.createSPSSODescriptorType(); - sp.getSingleLogoutService().add(sloEndPoint); - sp.getKeyDescriptor().add(keyDescriptorType); - sp.setAuthnRequestsSigned(requestsSigned); - sp.setOrganization(org); - return sp; + return MetaDataBuilderDelegate.createSPSSODescriptor(requestsSigned, keyDescriptorType, + sloEndPoint, attributes, org); } /** @@ -180,7 +130,7 @@ */ public static Marshaller getMarshaller() throws JAXBException { - return JAXBUtil.getMarshaller(pkgName); + return MetaDataBuilderDelegate.getMarshaller(); } /** @@ -190,7 +140,7 @@ */ public static Unmarshaller getUnmarshaller() throws JAXBException { - return JAXBUtil.getUnmarshaller(pkgName); + return MetaDataBuilderDelegate.getUnmarshaller(); } /** @@ -199,6 +149,6 @@ */ public static ObjectFactory getObjectFactory() { - return oFact; + return MetaDataBuilderDelegate.getObjectFactory(); } } \ No newline at end of file Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/interfaces/IMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/interfaces/IMetadataProvider.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/interfaces/IMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,78 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.interfaces; + +import java.io.InputStream; +import java.security.PublicKey; +import java.util.Map; + +/** + * MetadataProvider + * @author Anil.Saldhana(a)redhat.com + * @since Apr 21, 2009 + */ +public interface IMetadataProvider<T> +{ + /** + * Initialize the provider with options + * @param options + */ + void init(Map<String,String> options); + + /** + * Is multiple descriptors attached? + * @return + */ + boolean isMultiple(); + + /** + * Get the Metadata descriptors + * @return + */ + T getMetaData(); + + /** + * Provider indicates that it requires + * an injection of File instance + * @return File Name (need injection) or null + */ + String requireFileInjection(); + + /** + * Inject a File instance depending on + * @see #requireFileInjection() method + * @param fileStream + */ + void injectFileStream(InputStream fileStream); + + /** + * Inject a public key used for signing + * @param publicKey + */ + void injectSigningKey(PublicKey publicKey); + + /** + * Inject a public key used for encryption + * @param publicKey + */ + void injectEncryptionKey(PublicKey publicKey); +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/AbstractMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/AbstractMetadataProvider.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/AbstractMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,43 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.saml.md.providers; + +import java.util.Map; + +/** + * Abstract Metadata provider + * @author Anil.Saldhana(a)redhat.com + * @since Apr 21, 2009 + */ +public abstract class AbstractMetadataProvider +{ + protected Map<String, String> options; + + /** + * @see IMetadataProvider#init(Map) + * @param options + */ + public void init(Map<String,String> options) + { + this.options = options; + } +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntitiesMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntitiesMetadataProvider.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntitiesMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,64 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.saml.md.providers; + +import java.io.InputStream; +import java.security.PublicKey; + +import org.jboss.identity.federation.core.interfaces.IMetadataProvider; +import org.jboss.identity.federation.saml.v2.metadata.EntitiesDescriptorType; + +/** + * File based provider that handles multiple entities + * @author Anil.Saldhana(a)redhat.com + * @since Apr 21, 2009 + */ +public class FileBasedEntitiesMetadataProvider extends AbstractMetadataProvider +implements IMetadataProvider<EntitiesDescriptorType> +{ + public EntitiesDescriptorType getMetaData() + { + throw new RuntimeException("NYI"); + } + + public boolean isMultiple() + { + return true; + } + + public void injectEncryptionKey(PublicKey publicKey) + { + } + + public void injectFileStream(InputStream fileStream) + { + } + + public void injectSigningKey(PublicKey publicKey) + { + } + + public String requireFileInjection() + { + return null; + } +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntityMetadataProvider.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntityMetadataProvider.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/FileBasedEntityMetadataProvider.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,112 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.saml.md.providers; + +import java.io.InputStream; +import java.security.PublicKey; +import java.util.Map; + +import javax.xml.bind.JAXBElement; + +import org.jboss.identity.federation.core.interfaces.IMetadataProvider; +import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; + +/** + * A file based metadata provider that + * just looks for the passed in file name + * @author Anil.Saldhana(a)redhat.com + * @since Apr 21, 2009 + */ +public class FileBasedEntityMetadataProvider extends AbstractMetadataProvider +implements IMetadataProvider<EntityDescriptorType> +{ + + private static final String FILENAME_KEY = "FileName"; + private String fileName; + private InputStream metadataFileStream; + @SuppressWarnings("unused") + private PublicKey encryptionKey; + @SuppressWarnings("unused") + private PublicKey signingKey; + + @Override + public void init(Map<String, String> options) + { + super.init(options); + fileName = options.get(FILENAME_KEY); + if(fileName == null) + throw new IllegalStateException("FileName option not set"); + } + + /** + * @see IMetadataProvider#getMetaData() + */ + @SuppressWarnings("unchecked") + public EntityDescriptorType getMetaData() + { + EntityDescriptorType edt = null; + + if(this.metadataFileStream == null) + throw new RuntimeException("Metadata file is not injected"); + + try + { + JAXBElement<EntityDescriptorType> j = + (JAXBElement<EntityDescriptorType>) MetaDataBuilderDelegate.getUnmarshaller().unmarshal(metadataFileStream); + edt = j.getValue(); + //TODO: use the signing and enc key data + } + catch(Exception e) + { + throw new RuntimeException(e); + } + return edt; + } + + /** + * @see IMetadataProvider#isMultiple() + */ + public boolean isMultiple() + { + return false; + } + + public void injectEncryptionKey(PublicKey publicKey) + { + this.encryptionKey = publicKey; + } + + public void injectFileStream(InputStream fileStream) + { + this.metadataFileStream = fileStream; + } + + public void injectSigningKey(PublicKey publicKey) + { + this.signingKey = publicKey; + } + + public String requireFileInjection() + { + return this.fileName; + } +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/MetaDataBuilderDelegate.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/MetaDataBuilderDelegate.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/MetaDataBuilderDelegate.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,204 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.saml.md.providers; + +import java.util.List; + +import javax.xml.bind.JAXBException; +import javax.xml.bind.Marshaller; +import javax.xml.bind.Unmarshaller; + +import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLConstants; +import org.jboss.identity.federation.core.util.JAXBUtil; +import org.jboss.identity.federation.saml.v2.assertion.AttributeType; +import org.jboss.identity.federation.saml.v2.metadata.EndpointType; +import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; +import org.jboss.identity.federation.saml.v2.metadata.IDPSSODescriptorType; +import org.jboss.identity.federation.saml.v2.metadata.KeyDescriptorType; +import org.jboss.identity.federation.saml.v2.metadata.LocalizedNameType; +import org.jboss.identity.federation.saml.v2.metadata.LocalizedURIType; +import org.jboss.identity.federation.saml.v2.metadata.ObjectFactory; +import org.jboss.identity.federation.saml.v2.metadata.OrganizationType; +import org.jboss.identity.federation.saml.v2.metadata.SPSSODescriptorType; +import org.jboss.identity.federation.saml.v2.metadata.SSODescriptorType; + +/** + * SAML2 Metadata Builder API + * @author Anil.Saldhana(a)redhat.com + * @since Apr 19, 2009 + */ +public class MetaDataBuilderDelegate +{ + private static ObjectFactory oFact = new ObjectFactory(); + + private static String pkgName = "org.jboss.identity.federation.saml.v2.metadata"; + /** + * Create an Endpoint (SingleSignOnEndpoint or SingleLogoutEndpoint) + * @param binding + * @param location + * @param responseLocation + * @return + */ + public static EndpointType createEndpoint(String binding, String location, + String responseLocation) + { + EndpointType endpoint = oFact.createEndpointType(); + endpoint.setBinding(binding); + endpoint.setLocation(location); + endpoint.setResponseLocation(responseLocation); + return endpoint; + } + + /** + * Create an Organization + * @param organizationName + * @param organizationDisplayName + * @param organizationURL + * @param lang + * @return + */ + public static OrganizationType createOrganization(String organizationName, + String organizationDisplayName, String organizationURL, String lang) + { + if(organizationName == null) + throw new IllegalArgumentException("organizationName is null"); + if(organizationDisplayName == null) + throw new IllegalArgumentException("organizationDisplayName is null"); + if(organizationURL == null) + throw new IllegalArgumentException("organizationURL is null"); + if(lang == null) + lang = JBossSAMLConstants.LANG_EN.get(); + + //orgName + LocalizedNameType orgName = oFact.createLocalizedNameType(); + orgName.setValue(organizationName); + orgName.setLang(lang); + + //orgDisplayName + LocalizedNameType orgDisplayName = oFact.createLocalizedNameType(); + orgDisplayName.setValue(organizationDisplayName); + orgDisplayName.setLang(lang); + + //orgURL + LocalizedURIType orgURL = oFact.createLocalizedURIType(); + orgURL.setValue(organizationURL); + orgURL.setLang(lang); + + OrganizationType orgType = oFact.createOrganizationType(); + orgType.getOrganizationName().add(orgName); + orgType.getOrganizationDisplayName().add(orgDisplayName); + orgType.getOrganizationURL().add(orgURL); + return orgType; + } + + /** + * Create an Entity Descriptor + * @param idpOrSPDescriptor a descriptor for either the IDP or SSO + * @return + */ + public static EntityDescriptorType createEntityDescriptor(SSODescriptorType idpOrSPDescriptor) + { + EntityDescriptorType entity = oFact.createEntityDescriptorType(); + entity.getRoleDescriptorOrIDPSSODescriptorOrSPSSODescriptor().add(idpOrSPDescriptor); + return entity; + } + + /** + * Create a IDP SSO metadata descriptor + * @param requestsSigned + * @param keyDescriptorType + * @param ssoEndPoint + * @param sloEndPoint + * @param attributes + * @param org + * @return + */ + public static IDPSSODescriptorType createIDPSSODescriptor(boolean requestsSigned, + KeyDescriptorType keyDescriptorType, + EndpointType ssoEndPoint, + EndpointType sloEndPoint, + List<AttributeType> attributes, + OrganizationType org) + { + IDPSSODescriptorType idp = oFact.createIDPSSODescriptorType(); + idp.getSingleSignOnService().add(ssoEndPoint); + idp.getSingleLogoutService().add(sloEndPoint); + idp.getAttribute().addAll(attributes); + idp.getKeyDescriptor().add(keyDescriptorType); + idp.setWantAuthnRequestsSigned(requestsSigned); + idp.setOrganization(org); + return idp; + } + + /** + * Create a IDP SSO metadata descriptor + * @param requestsSigned + * @param keyDescriptorType + * @param ssoEndPoint + * @param sloEndPoint + * @param attributes + * @param org + * @return + */ + public static SPSSODescriptorType createSPSSODescriptor(boolean requestsSigned, + KeyDescriptorType keyDescriptorType, + EndpointType sloEndPoint, + List<AttributeType> attributes, + OrganizationType org) + { + SPSSODescriptorType sp = oFact.createSPSSODescriptorType(); + sp.getSingleLogoutService().add(sloEndPoint); + sp.getKeyDescriptor().add(keyDescriptorType); + sp.setAuthnRequestsSigned(requestsSigned); + sp.setOrganization(org); + return sp; + } + + /** + * Get the marshaller + * @return + * @throws JAXBException + */ + public static Marshaller getMarshaller() throws JAXBException + { + return JAXBUtil.getMarshaller(pkgName); + } + + /** + * Get the Unmarshaller + * @return + * @throws JAXBException + */ + public static Unmarshaller getUnmarshaller() throws JAXBException + { + return JAXBUtil.getUnmarshaller(pkgName); + } + + /** + * Get the ObjectFactory for method chaining + * @return + */ + public static ObjectFactory getObjectFactory() + { + return oFact; + } +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/SecurityActions.java =================================================================== --- identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/SecurityActions.java (rev 0) +++ identity-federation/trunk/jboss-identity-fed-core/src/main/java/org/jboss/identity/federation/core/saml/md/providers/SecurityActions.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,57 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.core.saml.md.providers; + +import java.security.AccessController; +import java.security.PrivilegedAction; + +/** + * Privileged Blocks + * @author Anil.Saldhana(a)redhat.com + * @since Mar 17, 2009 + */ +class SecurityActions +{ + static void setSystemProperty( final String key, final String value) + { + AccessController.doPrivileged(new PrivilegedAction<Object>() + { + public Object run() + { + System.setProperty(key, value); + return null; + } + }); + } + + static ClassLoader getContextClassLoader() + { + return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() + { + public ClassLoader run() + { + return Thread.currentThread().getContextClassLoader(); + } + }); + } + +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/MetadataServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/MetadataServlet.java (rev 0) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/MetadataServlet.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,202 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.web.servlets.saml; + +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.security.cert.Certificate; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import javax.servlet.ServletConfig; +import javax.servlet.ServletContext; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.xml.bind.JAXBElement; + +import org.apache.log4j.Logger; +import org.jboss.identity.federation.api.saml.v2.metadata.KeyDescriptorMetaDataBuilder; +import org.jboss.identity.federation.api.saml.v2.metadata.MetaDataBuilder; +import org.jboss.identity.federation.api.util.KeyUtil; +import org.jboss.identity.federation.core.config.KeyProviderType; +import org.jboss.identity.federation.core.config.KeyValueType; +import org.jboss.identity.federation.core.config.MetadataProviderType; +import org.jboss.identity.federation.core.config.ProviderType; +import org.jboss.identity.federation.core.interfaces.IMetadataProvider; +import org.jboss.identity.federation.core.interfaces.TrustKeyManager; +import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLConstants; +import org.jboss.identity.federation.core.util.XMLEncryptionUtil; +import org.jboss.identity.federation.saml.v2.metadata.EntityDescriptorType; +import org.jboss.identity.federation.saml.v2.metadata.KeyDescriptorType; +import org.jboss.identity.federation.saml.v2.metadata.RoleDescriptorType; +import org.jboss.identity.federation.web.constants.GeneralConstants; +import org.jboss.identity.federation.web.util.ConfigurationUtil; +import org.jboss.identity.xmlsec.w3.xmldsig.KeyInfoType; + + +import static org.jboss.identity.federation.core.util.StringUtil.isNotNull; + +/** + * Metadata servlet for the IDP/SP + * @author Anil.Saldhana(a)redhat.com + * @since Apr 22, 2009 + */ +public class MetadataServlet extends HttpServlet +{ + private static final long serialVersionUID = 1L; + private static Logger log = Logger.getLogger(MetadataServlet.class); + private boolean trace = log.isTraceEnabled(); + + private String configFileLocation = GeneralConstants.CONFIG_FILE_LOCATION; + private transient MetadataProviderType metadataProviderType = null; + + private transient IMetadataProvider<?> metadataProvider = null; + + private transient EntityDescriptorType metadata; + + private String signingAlias = null; + private String encryptingAlias = null; + private TrustKeyManager keyManager; + + @SuppressWarnings("unchecked") + @Override + public void init(ServletConfig config) throws ServletException + { + super.init(config); + try + { + ServletContext context = config.getServletContext(); + String configL = config.getInitParameter("configFile"); + if(isNotNull(configL)) + configFileLocation = configL; + if(trace) + log.trace("Config File Location="+ configFileLocation); + InputStream is = context.getResourceAsStream(configFileLocation); + if(is == null) + throw new RuntimeException(configFileLocation + " missing"); + + //Look for signing alias + signingAlias = config.getInitParameter("signingAlias"); + encryptingAlias = config.getInitParameter("encryptingAlias"); + + ProviderType providerType = ConfigurationUtil.getIDPConfiguration(is); + metadataProviderType = providerType.getMetaDataProvider(); + String fqn = metadataProviderType.getClassName(); + ClassLoader tcl = SecurityActions.getContextClassLoader(); + Class<?> clazz = tcl.loadClass(fqn); + metadataProvider = (IMetadataProvider) clazz.newInstance(); + List<KeyValueType> keyValues = metadataProviderType.getOption(); + Map<String,String> options = new HashMap<String,String>(); + if(keyValues != null) + { + for(KeyValueType kvt: keyValues) + options.put(kvt.getKey(), kvt.getValue()); + } + metadataProvider.init(options); + if(metadataProvider.isMultiple()) + throw new RuntimeException("Multiple Entities not currently supported"); + + /** + * Since a metadata provider does not have access to the servlet context. + * It may be difficult to get to the resource from the TCL. + */ + String fileInjectionStr = metadataProvider.requireFileInjection(); + if(isNotNull(fileInjectionStr)) + { + metadataProvider.injectFileStream(context.getResourceAsStream(fileInjectionStr)); + } + + metadata = (EntityDescriptorType) metadataProvider.getMetaData(); + + //Get the trust manager information + KeyProviderType keyProvider = providerType.getKeyProvider(); + signingAlias = keyProvider.getSigningAlias(); + String keyManagerClassName = keyProvider.getClassName(); + if(keyManagerClassName == null) + throw new RuntimeException("KeyManager class name is null"); + + clazz = tcl.loadClass(keyManagerClassName); + this.keyManager = (TrustKeyManager) clazz.newInstance(); + keyManager.setAuthProperties(keyProvider.getAuth()); + + Certificate cert = keyManager.getCertificate(signingAlias); + KeyInfoType keyInfo = KeyUtil.getKeyInfo(cert); + + //TODO: Assume just signing key for now + KeyDescriptorType keyDescriptor = KeyDescriptorMetaDataBuilder.createKeyDescriptor(keyInfo, + null, 0, true, false); + + updateKeyDescriptor(metadata, keyDescriptor); + + //encryption + if(this.encryptingAlias != null) + { + cert = keyManager.getCertificate(encryptingAlias); + keyInfo = KeyUtil.getKeyInfo(cert); + String certAlgo = cert.getPublicKey().getAlgorithm(); + keyDescriptor = KeyDescriptorMetaDataBuilder.createKeyDescriptor(keyInfo, + XMLEncryptionUtil.getEncryptionURL(certAlgo), + XMLEncryptionUtil.getEncryptionKeySize(certAlgo), false, true); + updateKeyDescriptor(metadata, keyDescriptor); + } + } catch(Exception e) + { + log.error("Exception in starting servlet:",e); + throw new ServletException("Unable to start servlet"); + } + + } + + + @Override + protected void doGet(HttpServletRequest req, HttpServletResponse resp) + throws ServletException, IOException + { + resp.setContentType(JBossSAMLConstants.METADATA_MIME.get()); + OutputStream os = resp.getOutputStream(); + JAXBElement<?> jaxbEl = MetaDataBuilder.getObjectFactory().createEntityDescriptor(metadata); + try + { + MetaDataBuilder.getMarshaller().marshal(jaxbEl , os); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } + + private void updateKeyDescriptor(EntityDescriptorType entityD, KeyDescriptorType keyD) + { + List<RoleDescriptorType> objs = entityD.getRoleDescriptorOrIDPSSODescriptorOrSPSSODescriptor(); + if(objs != null) + { + for(RoleDescriptorType roleD: objs) + { + roleD.getKeyDescriptor().add(keyD); + } + } + } +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SOAPSAMLXACMLServlet.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SOAPSAMLXACMLServlet.java (rev 0) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SOAPSAMLXACMLServlet.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,287 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.web.servlets.saml; + +import java.io.IOException; +import java.io.InputStream; +import java.io.OutputStream; +import java.security.PrivilegedActionException; +import java.util.ArrayList; +import java.util.List; + +import javax.servlet.ServletConfig; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.xml.bind.JAXBElement; +import javax.xml.bind.JAXBException; +import javax.xml.bind.Marshaller; +import javax.xml.bind.Unmarshaller; +import javax.xml.bind.helpers.DefaultValidationEventHandler; + +import org.apache.log4j.Logger; +import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; +import org.jboss.identity.federation.core.factories.SOAPFactory; +import org.jboss.identity.federation.core.factories.XACMLContextFactory; +import org.jboss.identity.federation.core.saml.v2.common.IDGenerator; +import org.jboss.identity.federation.core.saml.v2.factories.SAMLAssertionFactory; +import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder; +import org.jboss.identity.federation.core.saml.v2.util.DocumentUtil; +import org.jboss.identity.federation.core.saml.v2.util.JAXBElementMappingUtil; +import org.jboss.identity.federation.core.saml.v2.util.SOAPSAMLXACMLUtil; +import org.jboss.identity.federation.core.saml.v2.util.XMLTimeUtil; +import org.jboss.identity.federation.core.util.JAXBUtil; +import org.jboss.identity.federation.org.xmlsoap.schemas.soap.envelope.Body; +import org.jboss.identity.federation.org.xmlsoap.schemas.soap.envelope.Envelope; +import org.jboss.identity.federation.org.xmlsoap.schemas.soap.envelope.Fault; +import org.jboss.identity.federation.saml.v2.assertion.AssertionType; +import org.jboss.identity.federation.saml.v2.assertion.StatementAbstractType; +import org.jboss.identity.federation.saml.v2.profiles.xacml.assertion.XACMLAuthzDecisionStatementType; +import org.jboss.identity.federation.saml.v2.profiles.xacml.protocol.XACMLAuthzDecisionQueryType; +import org.jboss.identity.federation.saml.v2.protocol.RequestAbstractType; +import org.jboss.security.xacml.core.JBossPDP; +import org.jboss.security.xacml.core.JBossRequestContext; +import org.jboss.security.xacml.core.model.context.RequestType; +import org.jboss.security.xacml.core.model.context.ResponseType; +import org.jboss.security.xacml.core.model.context.ResultType; +import org.jboss.security.xacml.interfaces.PolicyDecisionPoint; +import org.jboss.security.xacml.interfaces.RequestContext; +import org.jboss.security.xacml.interfaces.ResponseContext; +import org.w3c.dom.Document; +import org.w3c.dom.Element; + +/** + * Servlet that can read SOAP 1.1 messages that contain + * an XACML query in saml payload + * @author Anil.Saldhana(a)redhat.com + * @since Jan 27, 2009 + */ +public class SOAPSAMLXACMLServlet extends HttpServlet +{ + private static Logger log = Logger.getLogger(SOAPSAMLXACMLServlet.class); + private boolean trace = log.isTraceEnabled(); + + private static final long serialVersionUID = 1L; + + private String policyConfigFileName = null; + + private String issuerId = null; + private String issuer = null; + + boolean debug = false; + + private transient PolicyDecisionPoint pdp = null; + + public void init(ServletConfig config) throws ServletException + { + issuerId = config.getInitParameter("issuerID"); + if(issuerId == null) + issuerId = "issue-id:1"; + + issuer = config.getInitParameter("issuer"); + if(issuer == null) + issuer = "urn:jboss-identity"; + + policyConfigFileName = config.getInitParameter("policyConfigFileName"); + if(policyConfigFileName == null) + policyConfigFileName = "policyConfig.xml"; + + String debugStr = config.getInitParameter("debug"); + try + { + debug = Boolean.parseBoolean(debugStr); + } + catch(Exception ignore) + { + debug = false; + } + + if(trace) + { + log.trace("Issuer=" + issuer + " :: issuerID=" + issuerId); + log.trace("PolicyConfig File:" + policyConfigFileName); + log.trace("Debug="+debug); + } + + if(debug) + { + SecurityActions.setSystemProperty("jaxb.debug", "true"); + } + + try + { + pdp = this.getPDP(); + } + catch (PrivilegedActionException e) + { + log("Exception loading PDP::",e); + throw new ServletException("Unable to load PDP"); + } + super.init(config); + } + + + @SuppressWarnings("unchecked") + @Override + protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException + { + JAXBElement<RequestAbstractType> jaxbRequestType = null; + + Envelope envelope = null; + XACMLAuthzDecisionQueryType xacmlRequest = null; + + try + { + Document inputDoc = DocumentUtil.getDocument(req.getInputStream()); + if(debug && trace) + log.trace("Received SOAP:"+DocumentUtil.getDocumentAsString(inputDoc)); + + Unmarshaller un = JAXBUtil.getUnmarshaller(SOAPSAMLXACMLUtil.getPackage()); + if(debug) + un.setEventHandler(new DefaultValidationEventHandler()); + + Object unmarshalledObject = un.unmarshal(DocumentUtil.getNodeAsStream(inputDoc)); + + if(unmarshalledObject instanceof JAXBElement) + { + JAXBElement<?> jaxbElement = (JAXBElement<?>) unmarshalledObject; + Object element = jaxbElement.getValue(); + if(element instanceof Envelope) + { + envelope = (Envelope)element; + Body soapBody = envelope.getBody(); + Object samlRequest = soapBody.getAny().get(0); + if(samlRequest instanceof JAXBElement) + { + jaxbRequestType = (JAXBElement<RequestAbstractType>)samlRequest; + jaxbRequestType = (JAXBElement<RequestAbstractType>)samlRequest; + xacmlRequest = (XACMLAuthzDecisionQueryType) jaxbRequestType.getValue(); + } + else + if(samlRequest instanceof Element) + { + Element elem = (Element) samlRequest; + xacmlRequest = SOAPSAMLXACMLUtil.getXACMLQueryType(elem); + } + } + else if(element instanceof XACMLAuthzDecisionQueryType) + { + xacmlRequest = (XACMLAuthzDecisionQueryType) element; + } + } + if(xacmlRequest == null) + throw new IOException("XACML Request not parsed"); + + RequestType requestType = xacmlRequest.getRequest(); + + RequestContext requestContext = new JBossRequestContext(); + requestContext.setRequest(requestType); + + //pdp evaluation is thread safe + ResponseContext responseContext = pdp.evaluate(requestContext); + + ResponseType responseType = new ResponseType(); + ResultType resultType = responseContext.getResult(); + responseType.getResult().add(resultType); + + XACMLAuthzDecisionStatementType xacmlStatement = + XACMLContextFactory.createXACMLAuthzDecisionStatementType(requestType, responseType); + + //Place the xacml statement in an assertion + //Then the assertion goes inside a SAML Response + + String ID = IDGenerator.create("ID_"); + SAML2Response saml2Response = new SAML2Response(); + IssuerInfoHolder issuerInfo = new IssuerInfoHolder(this.issuer); + + List<StatementAbstractType> statements = new ArrayList<StatementAbstractType>(); + statements.add(xacmlStatement); + + AssertionType assertion = SAMLAssertionFactory.createAssertion(ID, + issuerInfo.getIssuer(), + XMLTimeUtil.getIssueInstant(), + null, + null, + statements); + + JAXBElement<?> jaxbResponse = JAXBElementMappingUtil.get(saml2Response.createResponseType(ID, issuerInfo, assertion)); + + //Create a SOAP Envelope to hold the SAML response + envelope = this.createEnvelope(jaxbResponse); + } + catch (JAXBException e) + { + String id = IDGenerator.create(); + log.error(id + "::Exception parsing SOAP:", e); + envelope = this.createEnvelope(this.createFault("Parsing Error. Reference::" + id)); + } + catch (Exception e) + { + String id = IDGenerator.create(); + log.error(id + "::Exception:", e); + envelope = this.createEnvelope(this.createFault("Server Error. Reference::" + id)); + } + finally + { + resp.setContentType("text/xml;charset=utf-8");; + OutputStream os = resp.getOutputStream(); + try + { + if(envelope == null) + throw new IllegalStateException("SOAPEnvelope is null"); + JAXBElement<?> jaxbEnvelope = JAXBElementMappingUtil.get(envelope); + Marshaller marshaller = JAXBUtil.getMarshaller(SOAPSAMLXACMLUtil.getPackage()); + marshaller.marshal(jaxbEnvelope, os); + } + catch (JAXBException e) + { + log("marshalling exception",e); + } + } + } + + private PolicyDecisionPoint getPDP() throws PrivilegedActionException + { + ClassLoader tcl = SecurityActions.getContextClassLoader(); + InputStream is = tcl.getResourceAsStream(this.policyConfigFileName); + if(is == null) + throw new IllegalStateException(policyConfigFileName + " could not be located"); + return new JBossPDP(is); + } + + private Envelope createEnvelope(Object obj) + { + Envelope envelope = SOAPFactory.getObjectFactory().createEnvelope(); + Body body = SOAPFactory.getObjectFactory().createBody(); + body.getAny().add(obj); + envelope.setBody(body); + return envelope; + } + + private JAXBElement<Fault> createFault(String msg) + { + Fault fault = SOAPFactory.getObjectFactory().createFault(); + fault.setFaultstring(msg); + return SOAPFactory.getObjectFactory().createFault(fault); + } +} \ No newline at end of file Added: identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SecurityActions.java =================================================================== --- identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SecurityActions.java (rev 0) +++ identity-federation/trunk/jboss-identity-web/src/main/java/org/jboss/identity/federation/web/servlets/saml/SecurityActions.java 2009-11-06 17:28:15 UTC (rev 908) @@ -0,0 +1,57 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.web.servlets.saml; + +import java.security.AccessController; +import java.security.PrivilegedAction; + +/** + * Privileged Blocks + * @author Anil.Saldhana(a)redhat.com + * @since Mar 17, 2009 + */ +class SecurityActions +{ + static void setSystemProperty( final String key, final String value) + { + AccessController.doPrivileged(new PrivilegedAction<Object>() + { + public Object run() + { + System.setProperty(key, value); + return null; + } + }); + } + + static ClassLoader getContextClassLoader() + { + return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() + { + public ClassLoader run() + { + return Thread.currentThread().getContextClassLoader(); + } + }); + } + +} \ No newline at end of file Modified: identity-federation/trunk/jboss-identity-webapps/metadata/resources/WEB-INF/web.xml =================================================================== --- identity-federation/trunk/jboss-identity-webapps/metadata/resources/WEB-INF/web.xml 2009-11-05 19:23:37 UTC (rev 907) +++ identity-federation/trunk/jboss-identity-webapps/metadata/resources/WEB-INF/web.xml 2009-11-06 17:28:15 UTC (rev 908) @@ -11,7 +11,7 @@ <servlet> <servlet-name>metadata</servlet-name> - <servlet-class>org.jboss.identity.federation.bindings.servlets.MetadataServlet</servlet-class> + <servlet-class>org.jboss.identity.federation.web.servlets.saml.MetadataServlet</servlet-class> </servlet> <servlet-mapping>