[jboss-identity-commits] JBoss Identity SVN: r244 - in identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings: util and 1 other directory.
jboss-identity-commits at lists.jboss.org
jboss-identity-commits at lists.jboss.org
Thu Jan 22 16:19:38 EST 2009
Author: anil.saldhana at jboss.com
Date: 2009-01-22 16:19:38 -0500 (Thu, 22 Jan 2009)
New Revision: 244
Modified:
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java
identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java
Log:
use config
Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java
===================================================================
--- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-01-22 20:46:48 UTC (rev 243)
+++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-01-22 21:19:38 UTC (rev 244)
@@ -31,17 +31,24 @@
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletResponse;
+import org.apache.catalina.Context;
+import org.apache.catalina.Lifecycle;
+import org.apache.catalina.LifecycleException;
+import org.apache.catalina.LifecycleListener;
import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
+import org.apache.catalina.util.LifecycleSupport;
import org.apache.catalina.valves.ValveBase;
import org.apache.log4j.Logger;
import org.jboss.identity.federation.api.saml.v2.common.IDGenerator;
import org.jboss.identity.federation.api.saml.v2.request.SAML2Request;
import org.jboss.identity.federation.api.saml.v2.response.SAML2Response;
+import org.jboss.identity.federation.bindings.config.IDP;
import org.jboss.identity.federation.bindings.interfaces.RoleGenerator;
import org.jboss.identity.federation.bindings.tomcat.TomcatRoleGenerator;
import org.jboss.identity.federation.bindings.util.HTTPRedirectUtil;
import org.jboss.identity.federation.bindings.util.RedirectBindingUtil;
+import org.jboss.identity.federation.bindings.util.ValveUtil;
import org.jboss.identity.federation.core.saml.v2.constants.JBossSAMLURIConstants;
import org.jboss.identity.federation.core.saml.v2.holders.IDPInfoHolder;
import org.jboss.identity.federation.core.saml.v2.holders.IssuerInfoHolder;
@@ -56,26 +63,18 @@
* @author Anil.Saldhana at redhat.com
* @since Dec 9, 2008
*/
-public class IDPRedirectValve extends ValveBase
+public class IDPRedirectValve extends ValveBase implements Lifecycle
{
- private static Logger log = Logger.getLogger(IDPRedirectValve.class); ;
+ private static Logger log = Logger.getLogger(IDPRedirectValve.class);
+ protected IDP idpConfiguration = null;
+
private RoleGenerator rg = new TomcatRoleGenerator();
private long assertionValidity = 5000; // 5minutes in seconds
- private String identityURL = null;
-
- public void setAssertionValidity(String validity)
- {
- assertionValidity = Long.parseLong(validity);
- }
+ private String identityURL = null;
- public void setIdentityURL(String url)
- {
- this.identityURL = url;
- }
-
public IDPRedirectValve()
{
super();
@@ -224,4 +223,103 @@
{
return request.getParameter("SAMLRequest");
}
+
+ //***************Catalina Lifecyle methods
+ /**
+ * The lifecycle event support for this component.
+ */
+ protected LifecycleSupport lifecycle = new LifecycleSupport(this);
+
+ /**
+ * Has this component been started yet?
+ */
+ private boolean started = false;
+
+
+
+ /**
+ * Add a lifecycle event listener to this component.
+ *
+ * @param listener The listener to add
+ */
+ public void addLifecycleListener(LifecycleListener listener)
+ {
+ lifecycle.addLifecycleListener(listener);
+ }
+
+
+ /**
+ * Get the lifecycle listeners associated with this lifecycle. If this
+ * Lifecycle has no listeners registered, a zero-length array is returned.
+ */
+ public LifecycleListener[] findLifecycleListeners()
+ {
+ return lifecycle.findLifecycleListeners();
+ }
+
+
+ /**
+ * Remove a lifecycle event listener from this component.
+ *
+ * @param listener The listener to add
+ */
+ public void removeLifecycleListener(LifecycleListener listener)
+ {
+ lifecycle.removeLifecycleListener(listener);
+ }
+
+
+ /**
+ * Prepare for the beginning of active use of the public methods of this
+ * component. This method should be called after <code>configure()</code>,
+ * and before any of the public methods of the component are utilized.
+ *
+ * @exception LifecycleException if this component detects a fatal error
+ * that prevents this component from being used
+ */
+ public void start() throws LifecycleException
+ {
+ // Validate and update our current component state
+ if (started)
+ throw new LifecycleException
+ ("IDPRedirectValve already Started");
+ lifecycle.fireLifecycleEvent(START_EVENT, null);
+ started = true;
+
+ String configFile = "WEB-INF/jboss-idfed.xml";
+ Context context = (Context) getContainer();
+ InputStream is = context.getServletContext().getResourceAsStream(configFile);
+ if(is == null)
+ throw new RuntimeException(configFile + " missing");
+ try
+ {
+ idpConfiguration = ValveUtil.getIDPConfiguration(is);
+ this.identityURL = idpConfiguration.getIdentityURL();
+ log.trace("Identity Provider URL=" + this.identityURL);
+ this.assertionValidity = idpConfiguration.getAssertionValidity();
+ }
+ catch (Exception e)
+ {
+ throw new RuntimeException(e);
+ }
+ }
+
+
+ /**
+ * Gracefully terminate the active use of the public methods of this
+ * component. This method should be the last one called on a given
+ * instance of this component.
+ *
+ * @exception LifecycleException if this component detects a fatal error
+ * that needs to be reported
+ */
+ public void stop() throws LifecycleException
+ {
+ // Validate and update our current component state
+ if (!started)
+ throw new LifecycleException
+ ("IDPRedirectValve NotStarted");
+ lifecycle.fireLifecycleEvent(STOP_EVENT, null);
+ started = false;
+ }
}
\ No newline at end of file
Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java
===================================================================
--- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-01-22 20:46:48 UTC (rev 243)
+++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-01-22 21:19:38 UTC (rev 244)
@@ -21,16 +21,15 @@
*/
package org.jboss.identity.federation.bindings.tomcat.idp;
-import java.io.InputStream;
-import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.PublicKey;
+import org.apache.catalina.LifecycleException;
import org.apache.catalina.connector.Request;
import org.apache.log4j.Logger;
+import org.jboss.identity.federation.bindings.config.KeyProvider;
+import org.jboss.identity.federation.bindings.interfaces.TrustKeyManager;
import org.jboss.identity.federation.bindings.util.RedirectBindingSignatureUtil;
-import org.jboss.identity.federation.bindings.util.ValveUtil;
-import org.jboss.identity.federation.bindings.util.cert.KeyStoreUtil;
import org.jboss.identity.federation.core.saml.v2.util.SignatureUtil;
@@ -41,17 +40,13 @@
* @since Jan 14, 2009
*/
public class IDPRedirectWithSignatureValve extends IDPRedirectValve
-{
- private static Logger log = Logger.getLogger(IDPRedirectWithSignatureValve.class);
- private String keyStore;
- private char[] keypass;
- private String alias;
- private String keyStorePass;
+{
+ private static Logger log = Logger.getLogger(IDPRedirectWithSignatureValve.class);
- private KeyStore ks = null;
-
private boolean ignoreSignature = false;
+ private TrustKeyManager keyManager;
+
public IDPRedirectWithSignatureValve()
{
super();
@@ -61,28 +56,33 @@
{
if(val != null && val.length() > 0)
this.ignoreSignature = Boolean.valueOf(val);
- }
-
- public void setKeyStore(String keyStore)
- {
- this.keyStore = keyStore;
- }
+ }
- public void setKeyStorePass(String keyStorePass)
- {
- this.keyStorePass = keyStorePass;
- }
+ @Override
+ public void start() throws LifecycleException
+ {
+ super.start();
+ KeyProvider keyProvider = this.idpConfiguration.getKeyProvider();
+ try
+ {
+ ClassLoader tcl = SecurityActions.getContextClassLoader();
+ String keyManagerClassName = keyProvider.getClassName();
+ if(keyManagerClassName == null)
+ throw new RuntimeException("KeyManager class name is null");
+
+ Class<?> clazz = tcl.loadClass(keyManagerClassName);
+ this.keyManager = (TrustKeyManager) clazz.newInstance();
+ keyManager.setAuthProperties(keyProvider.getAuth());
+ keyManager.setValidatingAlias(keyProvider.getValidatingAlias());
+ }
+ catch(Exception e)
+ {
+ log.error("Exception reading configuration:",e);
+ throw new LifecycleException(e.getLocalizedMessage());
+ }
+ log.trace("Key Provider=" + keyProvider.getClassName());
+ }
- public void setKeyPass(String keypass)
- {
- this.keypass = keypass.toCharArray();
- }
-
- public void setAlias(String alias)
- {
- this.alias = alias;
- }
-
protected boolean validate(Request request) throws Exception
{
boolean result = super.validate(request);
@@ -115,7 +115,7 @@
}
sb.append("&SigAlg=").append(sigAlgFromURL);
- PublicKey validatingKey = getValidatingKey();
+ PublicKey validatingKey = keyManager.getValidatingKey(request.getRemoteAddr());
boolean isValid = SignatureUtil.validate(sb.toString().getBytes("UTF-8"), sigValue, validatingKey);
return isValid;
}
@@ -126,7 +126,7 @@
try
{
//Get the signing key
- PrivateKey signingKey = getSigningKey();
+ PrivateKey signingKey = keyManager.getSigningKey();
StringBuffer sb = new StringBuffer();
String url = RedirectBindingSignatureUtil.getSAMLResponseURLWithSignature(urlEncodedResponse, urlEncodedRelayState, signingKey);
sb.append("?").append(url);
@@ -137,25 +137,4 @@
throw new RuntimeException(e);
}
}
-
-
- protected PrivateKey getSigningKey() throws Exception
- {
- if(ks == null)
- {
- InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStore);
- ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray());
- }
- return (PrivateKey) ks.getKey(alias, keypass);
- }
-
- protected PublicKey getValidatingKey() throws Exception
- {
- if(ks == null)
- {
- InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStore);
- ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray());
- }
- return KeyStoreUtil.getPublicKey(ks, alias, keypass);
- }
}
\ No newline at end of file
Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java
===================================================================
--- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java 2009-01-22 20:46:48 UTC (rev 243)
+++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java 2009-01-22 21:19:38 UTC (rev 244)
@@ -29,7 +29,8 @@
import javax.xml.bind.JAXBElement;
import javax.xml.bind.Unmarshaller;
-import org.jboss.identity.federation.bindings.config.SP;
+import org.jboss.identity.federation.bindings.config.IDP;
+import org.jboss.identity.federation.bindings.config.SP;
import org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLBaseFactory;
/**
@@ -72,6 +73,18 @@
}
@SuppressWarnings("unchecked")
+ public static IDP getIDPConfiguration(InputStream is) throws Exception
+ {
+ if(is == null)
+ throw new IllegalArgumentException("inputstream is null");
+ String schema = "schema/config/jboss-identity-fed.xsd";
+
+ Unmarshaller un = JBossSAMLBaseFactory.getValidatingUnmarshaller("org.jboss.identity.federation.bindings.config", schema);
+ JAXBElement<IDP> jaxbSp = (JAXBElement<IDP>) un.unmarshal(is);
+ return jaxbSp.getValue();
+ }
+
+ @SuppressWarnings("unchecked")
public static SP getSPConfiguration(InputStream is) throws Exception
{
if(is == null)
More information about the jboss-identity-commits
mailing list