Author: anil.saldhana(a)jboss.com Date: 2011-06-24 17:56:04 -0400 (Fri, 24 Jun 2011) New Revision: 1035 Added: federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/SAML11AssertionWriter.java federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java Modified: federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SAML20TokenRoleAttributeProvider.java federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SecurityActions.java federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/BaseWriter.java federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAMLUtil.java Log: wst saml11 token provider Modified: federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SAML20TokenRoleAttributeProvider.java =================================================================== --- federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SAML20TokenRoleAttributeProvider.java 2011-06-24 19:10:12 UTC (rev 1034) +++ federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SAML20TokenRoleAttributeProvider.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -8,11 +8,10 @@ import javax.security.auth.Subject; import org.apache.log4j.Logger; -import org.jboss.security.SecurityContextAssociation; import org.picketlink.identity.federation.core.wstrust.plugins.saml.SAML20TokenAttributeProvider; import org.picketlink.identity.federation.saml.v2.assertion.AttributeStatementType; +import org.picketlink.identity.federation.saml.v2.assertion.AttributeStatementType.ASTChoiceType; import org.picketlink.identity.federation.saml.v2.assertion.AttributeType; -import org.picketlink.identity.federation.saml.v2.assertion.AttributeStatementType.ASTChoiceType; /** * <p> @@ -45,12 +44,12 @@ public class SAML20TokenRoleAttributeProvider implements SAML20TokenAttributeProvider { private static Logger logger = Logger.getLogger(SAML20TokenRoleAttributeProvider.class); - + /** * The name of the principal in JBoss that is expected to include user roles */ public static final String JBOSS_ROLE_PRINCIPAL_NAME = "Roles"; - + /** * The default attribute name in the SAML Token that will carry the user's roles, if not configured otherwise */ @@ -60,12 +59,12 @@ * The name of the attribute in the SAML Token that will carry the user's roles */ private String tokenRoleAttributeName; - + public void setProperties(Map<String, String> properties) { String roleAttrKey = this.getClass().getName() + ".tokenRoleAttributeName"; tokenRoleAttributeName = properties.get(roleAttrKey); - if( tokenRoleAttributeName == null ) + if (tokenRoleAttributeName == null) { tokenRoleAttributeName = DEFAULT_TOKEN_ROLE_ATTRIBUTE_NAME; } @@ -73,8 +72,8 @@ public AttributeStatementType getAttributeStatement() { - Subject subject = SecurityContextAssociation.getSecurityContext().getSubjectInfo().getAuthenticatedSubject(); - if( subject == null ) + Subject subject = SecurityActions.getSecurityContext().getSubjectInfo().getAuthenticatedSubject(); + if (subject == null) { if (logger.isDebugEnabled()) logger.debug("No authentication Subject found, cannot provide any user roles!"); @@ -82,28 +81,29 @@ } else { - AttributeStatementType attributeStatement = new AttributeStatementType(); - AttributeType rolesAttribute = new AttributeType( tokenRoleAttributeName ); - attributeStatement.addAttribute( new ASTChoiceType(rolesAttribute) ); - - //List<Object> roles = rolesAttribute.getAttributeValue(); - for( Principal rolePrincipal : subject.getPrincipals() ) - { - if( JBOSS_ROLE_PRINCIPAL_NAME.equalsIgnoreCase( rolePrincipal.getName() ) ) - { - Group simpleGroup = (Group)rolePrincipal; - Enumeration<? extends Principal> members = simpleGroup.members(); - while( members.hasMoreElements() ) - { - Principal role = (Principal)members.nextElement(); - rolesAttribute.addAttributeValue( role.getName() ); - //roles.add( role.getName() ); - } - } - } - if (logger.isDebugEnabled()) - logger.debug("Returning an AttributeStatement with a [" + tokenRoleAttributeName + "] attribute containing: " + rolesAttribute.getAttributeValue()); - return attributeStatement; + AttributeStatementType attributeStatement = new AttributeStatementType(); + AttributeType rolesAttribute = new AttributeType(tokenRoleAttributeName); + attributeStatement.addAttribute(new ASTChoiceType(rolesAttribute)); + + //List<Object> roles = rolesAttribute.getAttributeValue(); + for (Principal rolePrincipal : subject.getPrincipals()) + { + if (JBOSS_ROLE_PRINCIPAL_NAME.equalsIgnoreCase(rolePrincipal.getName())) + { + Group simpleGroup = (Group) rolePrincipal; + Enumeration<? extends Principal> members = simpleGroup.members(); + while (members.hasMoreElements()) + { + Principal role = members.nextElement(); + rolesAttribute.addAttributeValue(role.getName()); + //roles.add( role.getName() ); + } + } + } + if (logger.isDebugEnabled()) + logger.debug("Returning an AttributeStatement with a [" + tokenRoleAttributeName + + "] attribute containing: " + rolesAttribute.getAttributeValue()); + return attributeStatement; } } } \ No newline at end of file Modified: federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SecurityActions.java =================================================================== --- federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SecurityActions.java 2011-06-24 19:10:12 UTC (rev 1034) +++ federation/trunk/picketlink-bindings-jboss/src/main/java/org/picketlink/identity/federation/bindings/jboss/auth/SecurityActions.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -27,6 +27,7 @@ import java.security.PrivilegedExceptionAction; import org.jboss.security.SecurityContext; +import org.jboss.security.SecurityContextAssociation; import org.jboss.security.SecurityContextFactory; /** @@ -37,6 +38,17 @@ */ class SecurityActions { + static SecurityContext getSecurityContext() + { + return AccessController.doPrivileged(new PrivilegedAction<SecurityContext>() + { + public SecurityContext run() + { + return SecurityContextAssociation.getSecurityContext(); + } + }); + } + static SecurityContext createSecurityContext() throws PrivilegedActionException { return AccessController.doPrivileged(new PrivilegedExceptionAction<SecurityContext>() Modified: federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java =================================================================== --- federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java 2011-06-24 19:10:12 UTC (rev 1034) +++ federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/util/AssertionUtil.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -36,6 +36,7 @@ import org.picketlink.identity.federation.core.saml.v2.writers.SAMLAssertionWriter; import org.picketlink.identity.federation.core.util.StaxUtil; import org.picketlink.identity.federation.core.util.XMLSignatureUtil; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AssertionType; import org.picketlink.identity.federation.saml.v2.assertion.AssertionType; import org.picketlink.identity.federation.saml.v2.assertion.AttributeStatementType; import org.picketlink.identity.federation.saml.v2.assertion.AttributeStatementType.ASTChoiceType; @@ -80,6 +81,19 @@ * @param issuer * @return */ + public static SAML11AssertionType createSAML11Assertion(String id, XMLGregorianCalendar issueInstant, String issuer) + { + SAML11AssertionType assertion = new SAML11AssertionType(id, issueInstant); + assertion.setIssuer(issuer); + return assertion; + } + + /** + * Create an assertion + * @param id + * @param issuer + * @return + */ public static AssertionType createAssertion(String id, NameIDType issuer) { XMLGregorianCalendar issueInstant = null; Modified: federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/BaseWriter.java =================================================================== --- federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/BaseWriter.java 2011-06-24 19:10:12 UTC (rev 1034) +++ federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/BaseWriter.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -36,7 +36,7 @@ import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLConstants; import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants; import org.picketlink.identity.federation.core.util.StaxUtil; -import org.picketlink.identity.federation.core.util.StringUtil; +import org.picketlink.identity.federation.core.util.StringUtil; import org.picketlink.identity.federation.saml.v2.assertion.AttributeType; import org.picketlink.identity.federation.saml.v2.assertion.NameIDType; import org.picketlink.identity.federation.saml.v2.metadata.LocalizedNameType; @@ -49,18 +49,22 @@ public class BaseWriter { protected static String PROTOCOL_PREFIX = "samlp"; + protected static String ASSERTION_PREFIX = "saml"; + protected static String XACML_SAML_PREFIX = "xacml-saml"; + protected static String XACML_SAML_PROTO_PREFIX = "xacml-samlp"; + protected static String XSI_PREFIX = "xsi"; - - protected XMLStreamWriter writer = null; - + + protected XMLStreamWriter writer = null; + public BaseWriter(XMLStreamWriter writer) throws ProcessingException { this.writer = writer; } - + /** * Write {@code NameIDType} to stream * @param nameIDType @@ -68,44 +72,44 @@ * @param out * @throws ProcessingException */ - public void write( NameIDType nameIDType, QName tag ) throws ProcessingException + public void write(NameIDType nameIDType, QName tag) throws ProcessingException { - StaxUtil.writeStartElement( writer, tag.getPrefix(), tag.getLocalPart() , tag.getNamespaceURI() ); - + StaxUtil.writeStartElement(writer, tag.getPrefix(), tag.getLocalPart(), tag.getNamespaceURI()); + URI format = nameIDType.getFormat(); - if( format != null ) + if (format != null) { - StaxUtil.writeAttribute( writer, JBossSAMLConstants.FORMAT.get(), format.toASCIIString() ); - } - + StaxUtil.writeAttribute(writer, JBossSAMLConstants.FORMAT.get(), format.toASCIIString()); + } + String spProvidedID = nameIDType.getSPProvidedID(); - if( StringUtil.isNotNull( spProvidedID )) + if (StringUtil.isNotNull(spProvidedID)) { - StaxUtil.writeAttribute( writer, JBossSAMLConstants.SP_PROVIDED_ID.get(), spProvidedID ); + StaxUtil.writeAttribute(writer, JBossSAMLConstants.SP_PROVIDED_ID.get(), spProvidedID); } - + String spNameQualifier = nameIDType.getSPNameQualifier(); - if( StringUtil.isNotNull( spNameQualifier )) + if (StringUtil.isNotNull(spNameQualifier)) { - StaxUtil.writeAttribute( writer, JBossSAMLConstants.SP_NAME_QUALIFIER.get(), spNameQualifier ); + StaxUtil.writeAttribute(writer, JBossSAMLConstants.SP_NAME_QUALIFIER.get(), spNameQualifier); } - + String nameQualifier = nameIDType.getNameQualifier(); - if( StringUtil.isNotNull( nameQualifier )) + if (StringUtil.isNotNull(nameQualifier)) { - StaxUtil.writeAttribute( writer, JBossSAMLConstants.NAME_QUALIFIER.get(), nameQualifier ); - } - + StaxUtil.writeAttribute(writer, JBossSAMLConstants.NAME_QUALIFIER.get(), nameQualifier); + } + String value = nameIDType.getValue(); - if( StringUtil.isNotNull( value )) + if (StringUtil.isNotNull(value)) { - StaxUtil.writeCharacters( writer, value ); + StaxUtil.writeCharacters(writer, value); } - - StaxUtil.writeEndElement( writer); - StaxUtil.flush( writer ); + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); } - + /** * Write an {@code AttributeType} to stream * @@ -117,13 +121,13 @@ { StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.ATTRIBUTE.get(), ASSERTION_NSURI.get()); - writeAttributeTypeWithoutRootTag(attributeType); - + writeAttributeTypeWithoutRootTag(attributeType); + StaxUtil.writeEndElement(writer); StaxUtil.flush(writer); } - - public void writeAttributeTypeWithoutRootTag( AttributeType attributeType ) throws ProcessingException + + public void writeAttributeTypeWithoutRootTag(AttributeType attributeType) throws ProcessingException { String attributeName = attributeType.getName(); if (attributeName != null) @@ -171,32 +175,34 @@ { if (attributeValue instanceof String) { - writeStringAttributeValue( (String) attributeValue ); + writeStringAttributeValue((String) attributeValue); } else throw new RuntimeException("Unsupported attribute value:" + attributeValue.getClass().getName()); } } } - - public void writeStringAttributeValue( String attributeValue ) throws ProcessingException + + public void writeStringAttributeValue(String attributeValue) throws ProcessingException { - StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.ATTRIBUTE_VALUE.get(), ASSERTION_NSURI.get()); + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.ATTRIBUTE_VALUE.get(), + ASSERTION_NSURI.get()); StaxUtil.writeNameSpace(writer, JBossSAMLURIConstants.XSI_PREFIX.get(), JBossSAMLURIConstants.XSI_NSURI.get()); StaxUtil.writeNameSpace(writer, "xs", JBossSAMLURIConstants.XMLSCHEMA_NSURI.get()); StaxUtil.writeAttribute(writer, JBossSAMLURIConstants.XSI_NSURI.get(), "type", "xs:string"); - StaxUtil.writeCharacters(writer, attributeValue ); + StaxUtil.writeCharacters(writer, attributeValue); StaxUtil.writeEndElement(writer); } - - - public void writeLocalizedNameType( LocalizedNameType localizedNameType, QName startElement ) throws ProcessingException + public void writeLocalizedNameType(LocalizedNameType localizedNameType, QName startElement) + throws ProcessingException { - StaxUtil.writeStartElement(writer, startElement.getPrefix(), startElement.getLocalPart(), startElement.getNamespaceURI() ); - StaxUtil.writeAttribute(writer, new QName( JBossSAMLURIConstants.XML.get(), "lang", "xml" ), localizedNameType.getLang() ); - StaxUtil.writeCharacters(writer, localizedNameType.getValue() ); + StaxUtil.writeStartElement(writer, startElement.getPrefix(), startElement.getLocalPart(), + startElement.getNamespaceURI()); + StaxUtil.writeAttribute(writer, new QName(JBossSAMLURIConstants.XML.get(), "lang", "xml"), + localizedNameType.getLang()); + StaxUtil.writeCharacters(writer, localizedNameType.getValue()); StaxUtil.writeEndElement(writer); } } \ No newline at end of file Added: federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/SAML11AssertionWriter.java =================================================================== --- federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/SAML11AssertionWriter.java (rev 0) +++ federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/saml/v2/writers/SAML11AssertionWriter.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -0,0 +1,472 @@ +/* + * JBoss, Home of Professional Open Source. Copyright 2008, Red Hat Middleware LLC, and individual contributors as + * indicated by the @author tags. See the copyright.txt file in the distribution for a full listing of individual + * contributors. + * + * This is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any + * later version. + * + * This software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied + * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more + * details. + * + * You should have received a copy of the GNU Lesser General Public License along with this software; if not, write to + * the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA, or see the FSF site: + * http://www.fsf.org. + */ +package org.picketlink.identity.federation.core.saml.v2.writers; + +import static org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants.ASSERTION_NSURI; + +import java.net.URI; +import java.util.List; +import java.util.Set; + +import javax.xml.datatype.XMLGregorianCalendar; +import javax.xml.namespace.QName; +import javax.xml.stream.XMLStreamWriter; + +import org.picketlink.identity.federation.core.exceptions.ProcessingException; +import org.picketlink.identity.federation.core.saml.v1.SAML11Constants; +import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLConstants; +import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants; +import org.picketlink.identity.federation.core.util.StaxUtil; +import org.picketlink.identity.federation.core.util.StringUtil; +import org.picketlink.identity.federation.core.wstrust.WSTrustConstants; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AdviceType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AssertionType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AttributeStatementType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AttributeType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AudienceRestrictionCondition; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AuthenticationStatementType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AuthorizationDecisionStatementType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11ConditionAbstractType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11ConditionsType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11NameIdentifierType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11StatementAbstractType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11SubjectType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11SubjectType.SAML11SubjectTypeChoice; +import org.picketlink.identity.federation.saml.v2.assertion.AuthnContextClassRefType; +import org.picketlink.identity.federation.saml.v2.assertion.AuthnContextDeclRefType; +import org.picketlink.identity.federation.saml.v2.assertion.AuthnContextDeclType; +import org.picketlink.identity.federation.saml.v2.assertion.AuthnContextType; +import org.picketlink.identity.federation.saml.v2.assertion.AuthnContextType.AuthnContextTypeSequence; +import org.picketlink.identity.federation.saml.v2.assertion.BaseIDAbstractType; +import org.picketlink.identity.federation.saml.v2.assertion.KeyInfoConfirmationDataType; +import org.picketlink.identity.federation.saml.v2.assertion.NameIDType; +import org.picketlink.identity.federation.saml.v2.assertion.StatementAbstractType; +import org.picketlink.identity.federation.saml.v2.assertion.SubjectConfirmationDataType; +import org.picketlink.identity.federation.saml.v2.assertion.SubjectConfirmationType; +import org.picketlink.identity.federation.saml.v2.assertion.URIType; +import org.picketlink.identity.federation.saml.v2.profiles.xacml.assertion.XACMLAuthzDecisionStatementType; +import org.picketlink.identity.xmlsec.w3.xmldsig.KeyInfoType; +import org.picketlink.identity.xmlsec.w3.xmldsig.X509CertificateType; +import org.picketlink.identity.xmlsec.w3.xmldsig.X509DataType; +import org.w3c.dom.Element; + +/** + * Write the SAML 11 Assertion to stream + * + * @author Anil.Saldhana(a)redhat.com + * @since June 24, 2011 + */ +public class SAML11AssertionWriter extends BaseWriter +{ + public SAML11AssertionWriter(XMLStreamWriter writer) throws ProcessingException + { + super(writer); + } + + /** + * Write an {@code SAML11AssertionType} to stream + * + * @param assertion + * @param out + * @throws ProcessingException + */ + public void write(SAML11AssertionType assertion) throws ProcessingException + { + String ns = SAML11Constants.ASSERTION_11_NSURI; + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.ASSERTION.get(), ns); + StaxUtil.writeNameSpace(writer, ASSERTION_PREFIX, ns); + StaxUtil.writeDefaultNameSpace(writer, ns); + + // Attributes + StaxUtil.writeAttribute(writer, JBossSAMLConstants.ID.get(), assertion.getID()); + StaxUtil.writeAttribute(writer, SAML11Constants.MAJOR_VERSION, assertion.getMajorVersion() + ""); + StaxUtil.writeAttribute(writer, SAML11Constants.MINOR_VERSION, assertion.getMinorVersion() + ""); + StaxUtil.writeAttribute(writer, JBossSAMLConstants.ISSUE_INSTANT.get(), assertion.getIssueInstant().toString()); + + String issuer = assertion.getIssuer(); + if (issuer != null) + { + StaxUtil.writeAttribute(writer, SAML11Constants.ISSUER, issuer); + } + + SAML11ConditionsType conditions = assertion.getConditions(); + if (conditions != null) + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.CONDITIONS.get(), ns); + + StaxUtil.writeAttribute(writer, JBossSAMLConstants.NOT_BEFORE.get(), conditions.getNotBefore().toString()); + StaxUtil.writeAttribute(writer, JBossSAMLConstants.NOT_ON_OR_AFTER.get(), conditions.getNotOnOrAfter() + .toString()); + + List<SAML11ConditionAbstractType> typeOfConditions = conditions.get(); + if (typeOfConditions != null) + { + for (SAML11ConditionAbstractType typeCondition : typeOfConditions) + { + if (typeCondition instanceof SAML11AudienceRestrictionCondition) + { + SAML11AudienceRestrictionCondition art = (SAML11AudienceRestrictionCondition) typeCondition; + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, SAML11Constants.AUDIENCE_RESTRICTION_CONDITION, + ns); + List<URI> audiences = art.get(); + if (audiences != null) + { + for (URI audience : audiences) + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.AUDIENCE.get(), ns); + StaxUtil.writeCharacters(writer, audience.toString()); + StaxUtil.writeEndElement(writer); + } + } + + StaxUtil.writeEndElement(writer); + } + } + } + + StaxUtil.writeEndElement(writer); + } + + SAML11AdviceType advice = assertion.getAdvice(); + if (advice != null) + throw new RuntimeException("Advice needs to be handled"); + + List<SAML11StatementAbstractType> statements = assertion.getStatements(); + if (statements != null) + { + for (SAML11StatementAbstractType statement : statements) + { + if (statement instanceof SAML11AuthenticationStatementType) + { + write((SAML11AuthenticationStatementType) statement); + } + else if (statement instanceof SAML11AttributeStatementType) + { + write((SAML11AttributeStatementType) statement); + } + else if (statement instanceof SAML11AuthorizationDecisionStatementType) + { + write((SAML11AuthorizationDecisionStatementType) statement); + } + else + throw new RuntimeException("unknown statement type=" + statement.getClass().getName()); + } + } + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + /** + * Write an {@code StatementAbstractType} to stream + * + * @param statement + * @param out + * @throws ProcessingException + */ + public void write(StatementAbstractType statement) throws ProcessingException + { + // TODO: handle this section + throw new RuntimeException("NYI"); + } + + public void write(SAML11AttributeStatementType statement) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.ATTRIBUTE_STATEMENT.get(), + SAML11Constants.ASSERTION_11_NSURI); + + List<SAML11AttributeType> attributes = statement.get(); + if (attributes != null) + { + for (SAML11AttributeType attr : attributes) + { + throw new RuntimeException("NYI"); + } + } + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + /** + * Write an {@code AuthnStatementType} to stream + * + * @param authnStatement + * @param out + * @throws ProcessingException + */ + public void write(SAML11AuthenticationStatementType authnStatement) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.AUTHN_STATEMENT.get(), + SAML11Constants.ASSERTION_11_NSURI); + + XMLGregorianCalendar authnInstant = authnStatement.getAuthenticationInstant(); + if (authnInstant != null) + { + StaxUtil.writeAttribute(writer, SAML11Constants.AUTHENTICATION_INSTANT, authnInstant.toString()); + } + + URI authMethod = authnStatement.getAuthenticationMethod(); + if (authMethod != null) + { + StaxUtil.writeAttribute(writer, SAML11Constants.AUTHENTICATION_METHOD, authMethod.toString()); + } + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + public void write(SAML11AuthorizationDecisionStatementType xacmlStat) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.STATEMENT.get(), ASSERTION_NSURI.get()); + + StaxUtil.writeNameSpace(writer, ASSERTION_PREFIX, ASSERTION_NSURI.get()); + StaxUtil.writeNameSpace(writer, XACML_SAML_PREFIX, JBossSAMLURIConstants.XACML_SAML_NSURI.get()); + StaxUtil.writeNameSpace(writer, XACML_SAML_PROTO_PREFIX, JBossSAMLURIConstants.XACML_SAML_PROTO_NSURI.get()); + StaxUtil.writeNameSpace(writer, XSI_PREFIX, JBossSAMLURIConstants.XSI_NSURI.get()); + + StaxUtil.writeAttribute(writer, new QName(JBossSAMLURIConstants.XSI_NSURI.get(), JBossSAMLConstants.TYPE.get(), + XSI_PREFIX), XACMLAuthzDecisionStatementType.XSI_TYPE); + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + /** + * Write an {@code AuthnContextType} to stream + * + * @param authContext + * @param out + * @throws ProcessingException + */ + public void write(AuthnContextType authContext) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.AUTHN_CONTEXT.get(), + ASSERTION_NSURI.get()); + + AuthnContextTypeSequence sequence = authContext.getSequence(); + if (sequence != null) + { + AuthnContextClassRefType authnContextClassRefType = sequence.getClassRef(); + if (authnContextClassRefType != null) + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.AUTHN_CONTEXT_CLASS_REF.get(), + ASSERTION_NSURI.get()); + StaxUtil.writeCharacters(writer, authnContextClassRefType.getValue().toASCIIString()); + StaxUtil.writeEndElement(writer); + } + + Set<URIType> uriTypes = sequence.getURIType(); + if (uriTypes != null) + { + for (URIType uriType : uriTypes) + { + if (uriType instanceof AuthnContextDeclType) + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, + JBossSAMLConstants.AUTHN_CONTEXT_DECLARATION.get(), ASSERTION_NSURI.get()); + StaxUtil.writeCharacters(writer, uriType.getValue().toASCIIString()); + StaxUtil.writeEndElement(writer); + } + if (uriType instanceof AuthnContextDeclRefType) + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, + JBossSAMLConstants.AUTHN_CONTEXT_DECLARATION_REF.get(), ASSERTION_NSURI.get()); + StaxUtil.writeCharacters(writer, uriType.getValue().toASCIIString()); + StaxUtil.writeEndElement(writer); + } + } + } + } + + Set<URI> authAuthorities = authContext.getAuthenticatingAuthority(); + if (authAuthorities != null) + { + for (URI aa : authAuthorities) + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.AUTHENTICATING_AUTHORITY.get(), + ASSERTION_NSURI.get()); + StaxUtil.writeCharacters(writer, aa.toASCIIString()); + StaxUtil.writeEndElement(writer); + } + } + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + /** + * write an {@code SubjectType} to stream + * + * @param subject + * @param out + * @throws ProcessingException + */ + public void write(SAML11SubjectType subject) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.SUBJECT.get(), + SAML11Constants.ASSERTION_11_NSURI); + + SAML11SubjectTypeChoice choice = subject.getChoice(); + if (choice != null) + { + SAML11NameIdentifierType nameid = choice.getNameID(); + if (nameid != null) + { + write(nameid); + } + } + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + private void write(BaseIDAbstractType baseId) throws ProcessingException + { + throw new RuntimeException("NYI"); + } + + private void write(SubjectConfirmationType subjectConfirmationType) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.SUBJECT_CONFIRMATION.get(), + ASSERTION_NSURI.get()); + + StaxUtil.writeAttribute(writer, JBossSAMLConstants.METHOD.get(), subjectConfirmationType.getMethod()); + + BaseIDAbstractType baseID = subjectConfirmationType.getBaseID(); + if (baseID != null) + { + write(baseID); + } + NameIDType nameIDType = subjectConfirmationType.getNameID(); + if (nameIDType != null) + { + write(nameIDType, new QName(ASSERTION_NSURI.get(), JBossSAMLConstants.NAMEID.get(), ASSERTION_PREFIX)); + } + SubjectConfirmationDataType subjectConfirmationData = subjectConfirmationType.getSubjectConfirmationData(); + if (subjectConfirmationData != null) + { + write(subjectConfirmationData); + } + StaxUtil.writeEndElement(writer); + } + + private void write(SubjectConfirmationDataType subjectConfirmationData) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, JBossSAMLConstants.SUBJECT_CONFIRMATION_DATA.get(), + ASSERTION_NSURI.get()); + + // Let us look at attributes + String inResponseTo = subjectConfirmationData.getInResponseTo(); + if (StringUtil.isNotNull(inResponseTo)) + { + StaxUtil.writeAttribute(writer, JBossSAMLConstants.IN_RESPONSE_TO.get(), inResponseTo); + } + + XMLGregorianCalendar notBefore = subjectConfirmationData.getNotBefore(); + if (notBefore != null) + { + StaxUtil.writeAttribute(writer, JBossSAMLConstants.NOT_BEFORE.get(), notBefore.toString()); + } + + XMLGregorianCalendar notOnOrAfter = subjectConfirmationData.getNotOnOrAfter(); + if (notOnOrAfter != null) + { + StaxUtil.writeAttribute(writer, JBossSAMLConstants.NOT_ON_OR_AFTER.get(), notOnOrAfter.toString()); + } + + String recipient = subjectConfirmationData.getRecipient(); + if (StringUtil.isNotNull(recipient)) + { + StaxUtil.writeAttribute(writer, JBossSAMLConstants.RECIPIENT.get(), recipient); + } + + String address = subjectConfirmationData.getAddress(); + if (StringUtil.isNotNull(address)) + { + StaxUtil.writeAttribute(writer, JBossSAMLConstants.ADDRESS.get(), address); + } + + if (subjectConfirmationData instanceof KeyInfoConfirmationDataType) + { + KeyInfoConfirmationDataType kicd = (KeyInfoConfirmationDataType) subjectConfirmationData; + KeyInfoType keyInfo = (KeyInfoType) kicd.getAnyType(); + if (keyInfo.getContent() == null || keyInfo.getContent().size() == 0) + throw new ProcessingException("Invalid KeyInfo object: content cannot be empty"); + StaxUtil.writeStartElement(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, + WSTrustConstants.XMLDSig.KEYINFO, WSTrustConstants.XMLDSig.DSIG_NS); + StaxUtil.writeNameSpace(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, WSTrustConstants.XMLDSig.DSIG_NS); + // write the keyInfo content. + Object content = keyInfo.getContent().get(0); + if (content instanceof Element) + { + Element element = (Element) keyInfo.getContent().get(0); + StaxUtil.writeDOMNode(this.writer, element); + } + else if (content instanceof X509DataType) + { + X509DataType type = (X509DataType) content; + if (type.getDataObjects().size() == 0) + throw new ProcessingException("X509Data cannot be empy"); + StaxUtil.writeStartElement(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, + WSTrustConstants.XMLDSig.X509DATA, WSTrustConstants.XMLDSig.DSIG_NS); + Object obj = type.getDataObjects().get(0); + if (obj instanceof Element) + { + Element element = (Element) obj; + StaxUtil.writeDOMElement(this.writer, element); + } + else if (obj instanceof X509CertificateType) + { + X509CertificateType cert = (X509CertificateType) obj; + StaxUtil.writeStartElement(this.writer, WSTrustConstants.XMLDSig.DSIG_PREFIX, + WSTrustConstants.XMLDSig.X509CERT, WSTrustConstants.XMLDSig.DSIG_NS); + StaxUtil.writeCharacters(this.writer, new String(cert.getEncodedCertificate())); + StaxUtil.writeEndElement(this.writer); + } + StaxUtil.writeEndElement(this.writer); + } + StaxUtil.writeEndElement(this.writer); + } + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } + + public void write(SAML11NameIdentifierType nameid) throws ProcessingException + { + StaxUtil.writeStartElement(writer, ASSERTION_PREFIX, SAML11Constants.NAME_IDENTIFIER, + SAML11Constants.ASSERTION_11_NSURI); + + URI format = nameid.getFormat(); + if (format != null) + { + StaxUtil.writeAttribute(writer, SAML11Constants.FORMAT, format.toString()); + } + String nameQualifier = nameid.getNameQualifier(); + if (StringUtil.isNotNull(nameQualifier)) + { + StaxUtil.writeAttribute(writer, SAML11Constants.NAME_QUALIFIER, nameQualifier); + } + + StaxUtil.writeCharacters(writer, nameid.getValue()); + + StaxUtil.writeEndElement(writer); + StaxUtil.flush(writer); + } +} \ No newline at end of file Added: federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java =================================================================== --- federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java (rev 0) +++ federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAML11TokenProvider.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -0,0 +1,438 @@ +/* + * JBoss, Home of Professional Open Source. Copyright 2009, Red Hat Middleware LLC, and individual contributors as + * indicated by the @author tags. See the copyright.txt file in the distribution for a full listing of individual + * contributors. + * + * This is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any + * later version. + * + * This software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied + * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more + * details. + * + * You should have received a copy of the GNU Lesser General Public License along with this software; if not, write to + * the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA, or see the FSF site: + * http://www.fsf.org. + */ +package org.picketlink.identity.federation.core.wstrust.plugins.saml; + +import java.net.URI; +import java.security.Principal; +import java.security.PrivilegedActionException; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import javax.xml.datatype.XMLGregorianCalendar; +import javax.xml.namespace.QName; + +import org.apache.log4j.Logger; +import org.picketlink.identity.federation.core.exceptions.ProcessingException; +import org.picketlink.identity.federation.core.interfaces.ProtocolContext; +import org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider; +import org.picketlink.identity.federation.core.saml.v1.SAML11Constants; +import org.picketlink.identity.federation.core.saml.v2.common.IDGenerator; +import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLConstants; +import org.picketlink.identity.federation.core.saml.v2.factories.SAMLAssertionFactory; +import org.picketlink.identity.federation.core.saml.v2.util.AssertionUtil; +import org.picketlink.identity.federation.core.saml.v2.util.StatementUtil; +import org.picketlink.identity.federation.core.sts.AbstractSecurityTokenProvider; +import org.picketlink.identity.federation.core.wstrust.SecurityToken; +import org.picketlink.identity.federation.core.wstrust.StandardSecurityToken; +import org.picketlink.identity.federation.core.wstrust.WSTrustConstants; +import org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext; +import org.picketlink.identity.federation.core.wstrust.WSTrustUtil; +import org.picketlink.identity.federation.core.wstrust.wrappers.Lifetime; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AssertionType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AudienceRestrictionCondition; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11ConditionsType; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11StatementAbstractType; +import org.picketlink.identity.federation.saml.v2.assertion.AssertionType; +import org.picketlink.identity.federation.saml.v2.assertion.KeyInfoConfirmationDataType; +import org.picketlink.identity.federation.saml.v2.assertion.NameIDType; +import org.picketlink.identity.federation.saml.v2.assertion.StatementAbstractType; +import org.picketlink.identity.federation.saml.v2.assertion.SubjectConfirmationType; +import org.picketlink.identity.federation.saml.v2.assertion.SubjectType; +import org.picketlink.identity.federation.ws.policy.AppliesTo; +import org.picketlink.identity.federation.ws.trust.RequestedReferenceType; +import org.picketlink.identity.federation.ws.trust.StatusType; +import org.picketlink.identity.federation.ws.wss.secext.KeyIdentifierType; +import org.w3c.dom.Element; + +/** + * <p> + * A {@code SecurityTokenProvider} implementation that handles WS-Trust SAML 2.0 token requests. + * </p> + * + * @author <a href="mailto:sguilhen@redhat.com">Stefan Guilhen</a> + */ +public class SAML11TokenProvider extends AbstractSecurityTokenProvider implements SecurityTokenProvider +{ + protected static Logger logger = Logger.getLogger(SAML11TokenProvider.class); + + private SAML20TokenAttributeProvider attributeProvider; + + /* + * (non-Javadoc) + * + * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider#initialize(java.util.Map) + */ + public void initialize(Map<String, String> properties) + { + super.initialize(properties); + + // Check if an attribute provider has been set. + String attributeProviderClassName = this.properties.get(ATTRIBUTE_PROVIDER); + if (attributeProviderClassName == null) + { + if (logger.isDebugEnabled()) + logger.debug("No attribute provider set"); + } + else + { + try + { + Object object = SecurityActions.instantiateClass(attributeProviderClassName); + if (object instanceof SAML20TokenAttributeProvider) + { + this.attributeProvider = (SAML20TokenAttributeProvider) object; + this.attributeProvider.setProperties(this.properties); + } + else + logger.warn("Attribute provider not installed: " + attributeProviderClassName + + "is not an instance of SAML20TokenAttributeProvider"); + } + catch (PrivilegedActionException pae) + { + logger.warn("Error instantiating attribute provider: " + pae.getMessage()); + pae.printStackTrace(); + } + } + } + + /* + * (non-Javadoc) + * + * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider# + * cancelToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext) + */ + public void cancelToken(ProtocolContext protoContext) throws ProcessingException + { + if (!(protoContext instanceof WSTrustRequestContext)) + return; + + WSTrustRequestContext context = (WSTrustRequestContext) protoContext; + + // get the assertion that must be canceled. + Element token = context.getRequestSecurityToken().getCancelTargetElement(); + if (token == null) + throw new ProcessingException("Invalid cancel request: missing required CancelTarget"); + Element assertionElement = (Element) token.getFirstChild(); + if (!this.isAssertion(assertionElement)) + throw new ProcessingException("CancelTarget doesn't not contain a SAMLV2.0 assertion"); + + // get the assertion ID and add it to the canceled assertions set. + String assertionId = assertionElement.getAttribute("ID"); + this.revocationRegistry.revokeToken(SAMLUtil.SAML11_TOKEN_TYPE, assertionId); + } + + /* + * (non-Javadoc) + * + * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider# + * issueToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext) + */ + public void issueToken(ProtocolContext protoContext) throws ProcessingException + { + if (!(protoContext instanceof WSTrustRequestContext)) + return; + + WSTrustRequestContext context = (WSTrustRequestContext) protoContext; + // generate an id for the new assertion. + String assertionID = IDGenerator.create("ID_"); + + // lifetime and audience restrictions. + Lifetime lifetime = context.getRequestSecurityToken().getLifetime(); + SAML11AudienceRestrictionCondition restriction = null; + AppliesTo appliesTo = context.getRequestSecurityToken().getAppliesTo(); + if (appliesTo != null) + { + restriction = new SAML11AudienceRestrictionCondition(); + restriction.add(URI.create(WSTrustUtil.parseAppliesTo(appliesTo))); + } + SAML11ConditionsType conditions = new SAML11ConditionsType(); + conditions.setNotBefore(lifetime.getCreated()); + conditions.setNotOnOrAfter(lifetime.getExpires()); + conditions.add(restriction); + + // the assertion principal (default is caller principal) + Principal principal = context.getCallerPrincipal(); + + String confirmationMethod = null; + KeyInfoConfirmationDataType keyInfoDataType = null; + // if there is a on-behalf-of principal, we have the sender vouches confirmation method. + if (context.getOnBehalfOfPrincipal() != null) + { + principal = context.getOnBehalfOfPrincipal(); + confirmationMethod = SAMLUtil.SAML11_SENDER_VOUCHES_URI; + } + // if there is a proof-of-possession token in the context, we have the holder of key confirmation method. + else if (context.getProofTokenInfo() != null) + { + confirmationMethod = SAMLUtil.SAML11_HOLDER_OF_KEY_URI; + keyInfoDataType = SAMLAssertionFactory.createKeyInfoConfirmation(context.getProofTokenInfo()); + } + else + confirmationMethod = SAMLUtil.SAML11_BEARER_URI; + + SubjectConfirmationType subjectConfirmation = SAMLAssertionFactory.createSubjectConfirmation(null, + confirmationMethod, keyInfoDataType); + + // create a subject using the caller principal or on-behalf-of principal. + String subjectName = principal == null ? "ANONYMOUS" : principal.getName(); + NameIDType nameID = SAMLAssertionFactory.createNameID(null, "urn:picketlink:identity-federation", subjectName); + SubjectType subject = SAMLAssertionFactory.createSubject(nameID, subjectConfirmation); + + // create the attribute statements if necessary. + List<StatementAbstractType> statements = null; + Map<String, Object> claimedAttributes = context.getClaimedAttributes(); + if (claimedAttributes != null) + { + statements = new ArrayList<StatementAbstractType>(); + statements.add(StatementUtil.createAttributeStatement(claimedAttributes)); + } + /* + // create the SAML assertion. + NameIDType issuerID = SAMLAssertionFactory.createNameID(null, null, context.getTokenIssuer()); + AssertionType assertion = SAMLAssertionFactory.createAssertion(assertionID, issuerID, lifetime.getCreated(), + conditions, subject, statements); + + if (this.attributeProvider != null) + { + AttributeStatementType attributeStatement = this.attributeProvider.getAttributeStatement(); + if (attributeStatement != null) + { + assertion.addStatement(attributeStatement); + } + } + + // convert the constructed assertion to element. + Element assertionElement = null; + try + { + assertionElement = SAMLUtil.toElement(assertion); + } + catch (Exception e) + { + throw new ProcessingException("Failed to marshall SAMLV2 assertion", e); + } + + SecurityToken token = new StandardSecurityToken(context.getRequestSecurityToken().getTokenType().toString(), + assertionElement, assertionID); + context.setSecurityToken(token); + + // set the SAML assertion attached reference. + KeyIdentifierType keyIdentifier = WSTrustUtil.createKeyIdentifier(SAMLUtil.SAML11_VALUE_TYPE, "#" + assertionID); + Map<QName, String> attributes = new HashMap<QName, String>(); + attributes.put(new QName(WSTrustConstants.WSSE11_NS, "TokenType", WSTrustConstants.WSSE.PREFIX_11), + SAMLUtil.SAML11_TOKEN_TYPE); + RequestedReferenceType attachedReference = WSTrustUtil.createRequestedReference(keyIdentifier, attributes); + context.setAttachedReference(attachedReference);*/ + } + + /* + * (non-Javadoc) + * + * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider# + * renewToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext) + */ + public void renewToken(ProtocolContext protoContext) throws ProcessingException + { + if (!(protoContext instanceof WSTrustRequestContext)) + return; + + WSTrustRequestContext context = (WSTrustRequestContext) protoContext; + // get the specified assertion that must be renewed. + Element token = context.getRequestSecurityToken().getRenewTargetElement(); + if (token == null) + throw new ProcessingException("Invalid renew request: missing required RenewTarget"); + Element oldAssertionElement = (Element) token.getFirstChild(); + if (!this.isAssertion(oldAssertionElement)) + throw new ProcessingException("RenewTarget doesn't not contain a SAMLV1.1 assertion"); + + // get the JAXB representation of the old assertion. + SAML11AssertionType oldAssertion = null; + try + { + oldAssertion = SAMLUtil.saml11FromElement(oldAssertionElement); + } + catch (Exception je) + { + throw new ProcessingException("Error unmarshalling assertion", je); + } + + // canceled assertions cannot be renewed. + if (this.revocationRegistry.isRevoked(SAMLUtil.SAML11_TOKEN_TYPE, oldAssertion.getID())) + throw new ProcessingException("Assertion with id " + oldAssertion.getID() + + " has been canceled and cannot be renewed"); + + // adjust the lifetime for the renewed assertion. + SAML11ConditionsType conditions = oldAssertion.getConditions(); + conditions.setNotBefore(context.getRequestSecurityToken().getLifetime().getCreated()); + conditions.setNotOnOrAfter(context.getRequestSecurityToken().getLifetime().getExpires()); + + // create a new unique ID for the renewed assertion. + String assertionID = IDGenerator.create("ID_"); + + List<SAML11StatementAbstractType> statements = new ArrayList<SAML11StatementAbstractType>(); + statements.addAll(oldAssertion.getStatements()); + + // create the new assertion. + XMLGregorianCalendar created = context.getRequestSecurityToken().getLifetime().getCreated(); + + SAML11AssertionType newAssertion = AssertionUtil.createSAML11Assertion(assertionID, created, + oldAssertion.getIssuer()); + newAssertion.addAllStatements(oldAssertion.getStatements()); + + // create a security token with the new assertion. + Element assertionElement = null; + try + { + assertionElement = SAMLUtil.toElement(newAssertion); + } + catch (Exception e) + { + throw new ProcessingException("Failed to marshall SAMLV2 assertion", e); + } + SecurityToken securityToken = new StandardSecurityToken(context.getRequestSecurityToken().getTokenType() + .toString(), assertionElement, assertionID); + context.setSecurityToken(securityToken); + + // set the SAML assertion attached reference. + KeyIdentifierType keyIdentifier = WSTrustUtil.createKeyIdentifier(SAMLUtil.SAML11_VALUE_TYPE, "#" + assertionID); + Map<QName, String> attributes = new HashMap<QName, String>(); + attributes.put(new QName(WSTrustConstants.WSSE11_NS, "TokenType"), SAMLUtil.SAML11_TOKEN_TYPE); + RequestedReferenceType attachedReference = WSTrustUtil.createRequestedReference(keyIdentifier, attributes); + context.setAttachedReference(attachedReference); + } + + /* + * (non-Javadoc) + * + * @see org.picketlink.identity.federation.core.wstrust.SecurityTokenProvider# + * validateToken(org.picketlink.identity.federation.core.wstrust.WSTrustRequestContext) + */ + public void validateToken(ProtocolContext protoContext) throws ProcessingException + { + if (!(protoContext instanceof WSTrustRequestContext)) + return; + + WSTrustRequestContext context = (WSTrustRequestContext) protoContext; + if (logger.isTraceEnabled()) + logger.trace("SAML V2.0 token validation started"); + + // get the SAML assertion that must be validated. + Element token = context.getRequestSecurityToken().getValidateTargetElement(); + if (token == null) + throw new ProcessingException("Bad validate request: missing required ValidateTarget"); + + String code = WSTrustConstants.STATUS_CODE_VALID; + String reason = "SAMLV2.0 Assertion successfuly validated"; + + AssertionType assertion = null; + Element assertionElement = (Element) token.getFirstChild(); + if (!this.isAssertion(assertionElement)) + { + code = WSTrustConstants.STATUS_CODE_INVALID; + reason = "Validation failure: supplied token is not a SAMLV2.0 Assertion"; + } + else + { + try + { + assertion = SAMLUtil.fromElement(assertionElement); + } + catch (Exception e) + { + throw new ProcessingException("Unmarshalling error:", e); + } + } + + // check if the assertion has been canceled before. + if (this.revocationRegistry.isRevoked(SAMLUtil.SAML11_TOKEN_TYPE, assertion.getID())) + { + code = WSTrustConstants.STATUS_CODE_INVALID; + reason = "Validation failure: assertion with id " + assertion.getID() + " has been canceled"; + } + + // check the assertion lifetime. + try + { + if (AssertionUtil.hasExpired(assertion)) + { + code = WSTrustConstants.STATUS_CODE_INVALID; + reason = "Validation failure: assertion expired or used before its lifetime period"; + } + } + catch (Exception ce) + { + code = WSTrustConstants.STATUS_CODE_INVALID; + reason = "Validation failure: unable to verify assertion lifetime: " + ce.getMessage(); + } + + // construct the status and set it on the request context. + StatusType status = new StatusType(); + status.setCode(code); + status.setReason(reason); + context.setStatus(status); + } + + /** + * <p> + * Checks whether the specified element is a SAMLV2.0 assertion or not. + * </p> + * + * @param element + * the {@code Element} being verified. + * @return {@code true} if the element is a SAMLV2.0 assertion; {@code false} otherwise. + */ + private boolean isAssertion(Element element) + { + return element == null ? false : "Assertion".equals(element.getLocalName()) + && SAML11Constants.ASSERTION_11_NSURI.equals(element.getNamespaceURI()); + } + + /** + * @see {@code SecurityTokenProvider#supports(String)} + */ + public boolean supports(String namespace) + { + return WSTrustConstants.BASE_NAMESPACE.equals(namespace); + } + + /** + * @see org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#tokenType() + */ + public String tokenType() + { + return SAMLUtil.SAML11_TOKEN_TYPE; + } + + /** + * @see org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#getSupportedQName() + */ + public QName getSupportedQName() + { + return new QName(tokenType(), JBossSAMLConstants.ASSERTION.get()); + } + + /** + * @see org.picketlink.identity.federation.core.interfaces.SecurityTokenProvider#family() + */ + public String family() + { + return SecurityTokenProvider.FAMILY_TYPE.WS_TRUST.toString(); + } +} \ No newline at end of file Modified: federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAMLUtil.java =================================================================== --- federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAMLUtil.java 2011-06-24 19:10:12 UTC (rev 1034) +++ federation/trunk/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/plugins/saml/SAMLUtil.java 2011-06-24 21:56:04 UTC (rev 1035) @@ -23,14 +23,17 @@ import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; +import java.security.GeneralSecurityException; import org.picketlink.identity.federation.core.exceptions.ConfigurationException; import org.picketlink.identity.federation.core.exceptions.ParsingException; import org.picketlink.identity.federation.core.exceptions.ProcessingException; import org.picketlink.identity.federation.core.parsers.saml.SAMLParser; import org.picketlink.identity.federation.core.saml.v2.util.DocumentUtil; +import org.picketlink.identity.federation.core.saml.v2.writers.SAML11AssertionWriter; import org.picketlink.identity.federation.core.saml.v2.writers.SAMLAssertionWriter; import org.picketlink.identity.federation.core.util.StaxUtil; +import org.picketlink.identity.federation.saml.v1.assertion.SAML11AssertionType; import org.picketlink.identity.federation.saml.v2.assertion.AssertionType; import org.w3c.dom.Document; import org.w3c.dom.Element; @@ -45,12 +48,22 @@ public class SAMLUtil { + public static final String SAML11_BEARER_URI = "urn:oasis:names:tc:SAML:1.0:cm:bearer"; + + public static final String SAML11_HOLDER_OF_KEY_URI = "urn:oasis:names:tc:SAML:1.0:cm:holder-of-key"; + + public static final String SAML11_SENDER_VOUCHES_URI = "urn:oasis:names:tc:SAML:1.0:cm:sender-vouches"; + public static final String SAML2_BEARER_URI = "urn:oasis:names:tc:SAML:2.0:cm:bearer"; public static final String SAML2_HOLDER_OF_KEY_URI = "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"; public static final String SAML2_SENDER_VOUCHES_URI = "urn:oasis:names:tc:SAML:2.0:cm:sender-vouches"; + public static final String SAML11_TOKEN_TYPE = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"; + + public static final String SAML11_VALUE_TYPE = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID"; + public static final String SAML2_TOKEN_TYPE = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"; public static final String SAML2_VALUE_TYPE = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID"; @@ -80,6 +93,29 @@ /** * <p> + * Utility method that marshals the specified {@code AssertionType} object into an {@code Element} instance. + * </p> + * + * @param assertion + * an {@code AssertionType} object representing the SAML assertion to be marshaled. + * @return a reference to the {@code Element} that contains the marshaled SAML assertion. + * @throws Exception + * if an error occurs while marshaling the assertion. + */ + public static Element toElement(SAML11AssertionType assertion) throws Exception + { + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + SAML11AssertionWriter writer = new SAML11AssertionWriter(StaxUtil.getXMLStreamWriter(baos)); + writer.write(assertion); + + ByteArrayInputStream bis = new ByteArrayInputStream(baos.toByteArray()); + Document document = DocumentUtil.getDocument(bis); + + return document.getDocumentElement(); + } + + /** + * <p> * Utility method that unmarshals the specified {@code Element} into an {@code AssertionType} instance. * </p> * @@ -97,4 +133,16 @@ AssertionType assertion = (AssertionType) samlParser.parse(DocumentUtil.getNodeAsStream(assertionElement)); return assertion; } -} + + /** + * Given a {@link Element} that represents a SAML 1.1 assertion, convert it into a {@link SAML11AssertionType} + * @param assertionElement + * @return + * @throws GeneralSecurityException + */ + public static SAML11AssertionType saml11FromElement(Element assertionElement) throws GeneralSecurityException + { + SAMLParser samlParser = new SAMLParser(); + return (SAML11AssertionType) samlParser.parse(DocumentUtil.getNodeAsStream(assertionElement)); + } +} \ No newline at end of file