[jboss-cvs] Picketlink SVN: r1085 - in trust/trunk/jbossws/src: test/java/org/picketlink/test/trust/jbossws and 3 other directories.
jboss-cvs-commits at lists.jboss.org
jboss-cvs-commits at lists.jboss.org
Tue Jul 12 20:52:18 EDT 2011
Author: anil.saldhana at jboss.com
Date: 2011-07-12 20:52:18 -0400 (Tue, 12 Jul 2011)
New Revision: 1085
Added:
trust/trunk/jbossws/src/test/java/org/picketlink/test/trust/jbossws/handler/
trust/trunk/jbossws/src/test/java/org/picketlink/test/trust/jbossws/handler/SAML2HandlerUnitTestCase.java
trust/trunk/jbossws/src/test/resources/jbossws/xml/
trust/trunk/jbossws/src/test/resources/jbossws/xml/wsse-saml.xml
Modified:
trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SAML2Handler.java
trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SecurityActions.java
Log:
PLFED-171: add group principal to subject if roles
Modified: trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SAML2Handler.java
===================================================================
--- trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SAML2Handler.java 2011-07-12 21:11:12 UTC (rev 1084)
+++ trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SAML2Handler.java 2011-07-13 00:52:18 UTC (rev 1085)
@@ -21,6 +21,10 @@
*/
package org.picketlink.trust.jbossws.handler;
+import java.security.acl.Group;
+import java.util.ArrayList;
+import java.util.List;
+
import javax.security.auth.Subject;
import javax.xml.namespace.QName;
import javax.xml.soap.SOAPMessage;
@@ -30,7 +34,11 @@
import org.jboss.security.SecurityContext;
import org.picketlink.identity.federation.bindings.jboss.subject.PicketLinkPrincipal;
import org.picketlink.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants;
+import org.picketlink.identity.federation.core.saml.v2.util.AssertionUtil;
+import org.picketlink.identity.federation.core.util.StringUtil;
import org.picketlink.identity.federation.core.wstrust.SamlCredential;
+import org.picketlink.identity.federation.core.wstrust.plugins.saml.SAMLUtil;
+import org.picketlink.identity.federation.saml.v2.assertion.AssertionType;
import org.picketlink.trust.jbossws.SAML2Constants;
import org.picketlink.trust.jbossws.Util;
import org.w3c.dom.Document;
@@ -59,12 +67,26 @@
SOAPMessageContext ctx = (SOAPMessageContext) msgContext;
SOAPMessage soapMessage = ctx.getMessage();
+ if(soapMessage == null)
+ throw new IllegalStateException("SOAP Message is null");
+
// retrieve the assertion
Document document = soapMessage.getSOAPPart();
Element soapHeader = Util.findOrCreateSoapHeader(document.getDocumentElement());
Element assertion = Util.findElement(soapHeader, new QName(assertionNS, "Assertion"));
if (assertion != null)
{
+ AssertionType assertionType = null;
+ try
+ {
+ assertionType = SAMLUtil.fromElement(assertion);
+ if(AssertionUtil.hasExpired(assertionType))
+ throw new RuntimeException("Assertion has expired");
+ }
+ catch(Exception e )
+ {
+ log.error("Exception in parsing the assertion:",e);
+ }
SamlCredential credential = new SamlCredential(assertion);
if (log.isTraceEnabled())
{
@@ -75,15 +97,41 @@
Element nameID = Util.findElement(subject, new QName(assertionNS, "NameID"));
String username = getUsername(nameID);
// set SecurityContext
- Subject s = new Subject();
- SecurityContext sc = SecurityActions.createSecurityContext(new PicketLinkPrincipal(username), credential, s);
+ Subject theSubject = new Subject();
+ SecurityContext sc = SecurityActions.createSecurityContext(new PicketLinkPrincipal(username), credential, theSubject);
SecurityActions.setSecurityContext(sc);
+
+ if(assertionType != null )
+ {
+ List<String> roleKeys = new ArrayList<String>();
+ String roleKey = SecurityActions.getSystemProperty("picketlink.rolekey", "Role");
+ if(StringUtil.isNotNull(roleKey))
+ {
+ roleKeys.addAll(StringUtil.tokenize(roleKey));
+ }
+
+ if(trace)
+ log.trace("Rolekeys to extract roles from the assertion:" + roleKeys);
+
+ List<String> roles = AssertionUtil.getRoles(assertionType, roleKeys);
+ if(roles.size() > 0 )
+ {
+ if(trace)
+ log.trace("Roles in the assertion:" + roles);
+ Group roleGroup = SecurityActions.group(roles);
+ theSubject.getPrincipals().add(roleGroup);
+ }
+ else
+ {
+ if(trace)
+ log.trace("Did not find roles in the assertion");
+ }
+ }
}
else
{
log.warn("We did not find any assertion");
- }
-
+ }
return true;
}
Modified: trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SecurityActions.java
===================================================================
--- trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SecurityActions.java 2011-07-12 21:11:12 UTC (rev 1084)
+++ trust/trunk/jbossws/src/main/java/org/picketlink/trust/jbossws/handler/SecurityActions.java 2011-07-13 00:52:18 UTC (rev 1085)
@@ -24,12 +24,17 @@
import java.security.AccessController;
import java.security.Principal;
import java.security.PrivilegedAction;
+import java.security.acl.Group;
+import java.util.List;
import javax.security.auth.Subject;
+import org.jboss.security.SecurityConstants;
import org.jboss.security.SecurityContext;
import org.jboss.security.SecurityContextAssociation;
import org.jboss.security.SecurityContextFactory;
+import org.jboss.security.SimplePrincipal;
+import org.picketlink.identity.federation.bindings.jboss.subject.PicketLinkGroup;
/**
* Privileged actions.
@@ -138,4 +143,25 @@
}
});
}
+
+ /**
+ * Given a {@link List} of role names, construct a group principal of type {@link Group}
+ * @param roles
+ * @return
+ */
+ static Group group(final List<String> roles)
+ {
+ return AccessController.doPrivileged(new PrivilegedAction<Group>()
+ {
+ public Group run()
+ {
+ Group theGroup = new PicketLinkGroup(SecurityConstants.ROLES_IDENTIFIER);
+ for(String role: roles)
+ {
+ theGroup.addMember(new SimplePrincipal(role));
+ }
+ return theGroup;
+ }
+ });
+ }
}
\ No newline at end of file
Added: trust/trunk/jbossws/src/test/java/org/picketlink/test/trust/jbossws/handler/SAML2HandlerUnitTestCase.java
===================================================================
--- trust/trunk/jbossws/src/test/java/org/picketlink/test/trust/jbossws/handler/SAML2HandlerUnitTestCase.java (rev 0)
+++ trust/trunk/jbossws/src/test/java/org/picketlink/test/trust/jbossws/handler/SAML2HandlerUnitTestCase.java 2011-07-13 00:52:18 UTC (rev 1085)
@@ -0,0 +1,193 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2008, Red Hat Middleware LLC, and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.picketlink.test.trust.jbossws.handler;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.acl.Group;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+import javax.security.auth.Subject;
+import javax.xml.bind.JAXBContext;
+import javax.xml.namespace.QName;
+import javax.xml.soap.SOAPException;
+import javax.xml.soap.SOAPMessage;
+import javax.xml.ws.handler.MessageContext;
+import javax.xml.ws.handler.soap.SOAPMessageContext;
+
+import org.jboss.security.SecurityContext;
+import org.jboss.security.SecurityContextAssociation;
+import org.jboss.security.SimplePrincipal;
+import org.junit.Test;
+import org.picketlink.identity.federation.core.util.SOAPUtil;
+import org.picketlink.trust.jbossws.handler.SAML2Handler;
+
+/**
+ * Unit test the {@link SAML2Handler}
+ * @author Anil.Saldhana at redhat.com
+ * @since Jul 12, 2011
+ */
+public class SAML2HandlerUnitTestCase
+{
+ @Test
+ public void testIn() throws Exception
+ {
+ DelegatingHandler handler = new DelegatingHandler();
+ SAML2HandlerUnitTestCaseMessageContext msgContext = new SAML2HandlerUnitTestCaseMessageContext();
+ SOAPMessage soapMessage = get();
+
+ System.setProperty("picketlink.rolekey", "Role,Roles,Membership");
+ msgContext.setMessage(soapMessage);
+ handler.handleInbound(msgContext);
+
+ SecurityContext securityContext = SecurityContextAssociation.getSecurityContext();
+ assertNotNull(securityContext);
+ assertEquals("admin", securityContext.getUtil().getUserName());
+ Subject subject = securityContext.getUtil().getSubject();
+ Set<Group> groups = subject.getPrincipals(Group.class);
+ assertEquals(1, groups.size());
+ Group grp = groups.iterator().next();
+ assertTrue(grp.isMember(new SimplePrincipal("meco")));
+ }
+
+ private SOAPMessage get() throws SOAPException, IOException
+ {
+ InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream("jbossws/xml/wsse-saml.xml");
+ SOAPMessage soapMessage = SOAPUtil.getSOAPMessage(is);
+ return soapMessage;
+ }
+
+ private static class DelegatingHandler extends SAML2Handler
+ {
+ @Override
+ protected boolean handleInbound(MessageContext msgContext)
+ {
+ return super.handleInbound(msgContext);
+ }
+ }
+
+ private static class SAML2HandlerUnitTestCaseMessageContext implements SOAPMessageContext
+ {
+ private Map<String,Object> map = new HashMap<String, Object>();
+
+ private Map<String,Scope> scopes = new HashMap<String, MessageContext.Scope>();
+
+ private SOAPMessage msg;
+
+ public int size()
+ {
+ return 0;
+ }
+
+ public boolean isEmpty()
+ {
+ return false;
+ }
+
+ public boolean containsKey(Object key)
+ {
+ return map.containsKey(key);
+ }
+
+ public boolean containsValue(Object value)
+ {
+ return map.containsValue(value);
+ }
+
+ public Object get(Object key)
+ {
+ return map.get(key);
+ }
+
+ public Object put(String key, Object value)
+ {
+ return map.put(key, value);
+ }
+
+ public Object remove(Object key)
+ {
+ return map.remove(key);
+ }
+
+ public void putAll(Map<? extends String, ? extends Object> m)
+ {
+ map.putAll(m);
+ }
+
+ public void clear()
+ {
+ map.clear();
+ }
+
+ public Set<String> keySet()
+ {
+ return map.keySet();
+ }
+
+ public Collection<Object> values()
+ {
+ return map.values();
+ }
+
+ public Set<java.util.Map.Entry<String, Object>> entrySet()
+ {
+ return map.entrySet();
+ }
+
+ public Scope getScope(String arg0)
+ {
+ return scopes.get(arg0);
+ }
+
+ public void setScope(String arg0, Scope arg1)
+ {
+ scopes.put(arg0, arg1);
+ }
+
+ public Object[] getHeaders(QName arg0, JAXBContext arg1, boolean arg2)
+ {
+ throw new RuntimeException("NYI");
+ }
+
+ public SOAPMessage getMessage()
+ {
+ return msg;
+ }
+
+ public Set<String> getRoles()
+ {
+ throw new RuntimeException("NYI");
+ }
+
+ public void setMessage(SOAPMessage arg0)
+ {
+ msg =arg0;
+ }
+ }
+}
\ No newline at end of file
Added: trust/trunk/jbossws/src/test/resources/jbossws/xml/wsse-saml.xml
===================================================================
--- trust/trunk/jbossws/src/test/resources/jbossws/xml/wsse-saml.xml (rev 0)
+++ trust/trunk/jbossws/src/test/resources/jbossws/xml/wsse-saml.xml 2011-07-13 00:52:18 UTC (rev 1085)
@@ -0,0 +1,58 @@
+<env:Envelope xmlns:env='http://schemas.xmlsoap.org/soap/envelope/'>
+ " +
+ <env:Header>
+ <wsse:Security
+ xmlns:wsse='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
+ <saml:Assertion xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'
+ xmlns='urn:oasis:names:tc:SAML:2.0:assertion' ID='ID_7069926b-792e-4f90-8727-0e16ec9c3073'
+ IssueInstant='2011-07-13T00:16:13.990Z' Version='2.0'>
+ <Issuer xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'>PicketLinkSTS</Issuer>
+ <saml:Subject>
+ <saml:NameID NameQualifier='urn:picketlink:identity-federation'
+ xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'>admin</saml:NameID>
+ <saml:SubjectConfirmation Method='urn:oasis:names:tc:SAML:2.0:cm:bearer' />
+ </saml:Subject>
+ <saml:Conditions NotBefore='2011-07-13T00:16:13.990Z'
+ NotOnOrAfter='2030-07-13T02:16:13.990Z'>
+ <saml:AudienceRestriction>
+ <saml:Audience>http://services.testcorp.org/provider1
+ </saml:Audience>
+ </saml:AudienceRestriction>
+ </saml:Conditions>
+ <saml:AuthnStatement AuthnInstant="2011-06-06T21:30:07Z"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+ <saml:AuthnContext xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+ <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password
+ </saml:AuthnContextClassRef>
+ </saml:AuthnContext>
+ </saml:AuthnStatement>
+ <saml:AttributeStatement xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+ <saml:Attribute Name="FGADataset"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+ <saml:AttributeValue xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">1234
+ </saml:AttributeValue>
+ <saml:AttributeValue xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">4768
+ </saml:AttributeValue>
+ </saml:Attribute>
+ <saml:Attribute Name="Roles"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE:groups">
+ <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:type="xs:string">meco</saml:AttributeValue>
+ <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:type="xs:string">aispoc_grp1</saml:AttributeValue>
+ <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:type="xs:string">grp-poc</saml:AttributeValue>
+ </saml:Attribute>
+ <saml:Attribute Name="Membership"
+ NameFormat="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE:groups">
+ <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:type="xs:string">meco</saml:AttributeValue>
+ </saml:Attribute>
+ </saml:AttributeStatement>
+ </saml:Assertion>
+ </wsse:Security>
+ </env:Header>
+ <env:Body />
+</env:Envelope>
\ No newline at end of file
More information about the jboss-cvs-commits
mailing list