org.opensaml.saml.saml2.core.SubjectConfirmationData Java Examples

/**
 * New subject element.
 *
 * @param nameIdFormat the name id format
 * @param nameIdValue the name id value
 * @param recipient the recipient
 * @param notOnOrAfter the not on or after
 * @param inResponseTo the in response to
 * @return the subject
 */
public Subject newSubject(final String nameIdFormat, final String nameIdValue,
                          final String recipient, final DateTime notOnOrAfter,
                          final String inResponseTo) {

    final SubjectConfirmation confirmation = newSamlObject(SubjectConfirmation.class);
    confirmation.setMethod(SubjectConfirmation.METHOD_BEARER);

    final SubjectConfirmationData data = newSamlObject(SubjectConfirmationData.class);
    data.setRecipient(recipient);
    data.setNotOnOrAfter(notOnOrAfter);
    data.setInResponseTo(inResponseTo);

    confirmation.setSubjectConfirmationData(data);

    final Subject subject = newSamlObject(Subject.class);
    subject.setNameID(getNameID(nameIdFormat, nameIdValue));
    subject.getSubjectConfirmations().add(confirmation);
    return subject;
}
 

private SubjectConfirmation createSubjectConfirmation(String method, DateTime notOnOrAfter, String inResponseTo,
        String recipient) {
    SubjectConfirmation result = createSamlElement(SubjectConfirmation.class);
    result.setMethod(method);

    SubjectConfirmationData subjectConfirmationData = createSamlElement(SubjectConfirmationData.class);
    result.setSubjectConfirmationData(subjectConfirmationData);

    subjectConfirmationData.setInResponseTo(inResponseTo);
    subjectConfirmationData.setNotOnOrAfter(notOnOrAfter);
    subjectConfirmationData.setRecipient(recipient);

    return result;

}
 

/**
   * Validate a (Bearer) Subject Confirmation
   */
private void validateSubjectConfirmation(Message m,
                                         Conditions cs,
                                         SubjectConfirmationData subjectConfData) {
    if (subjectConfData == null) {
        if (!subjectConfirmationDataRequired
            && cs.getNotOnOrAfter() != null && !cs.getNotOnOrAfter().isBeforeNow()) {
            return;
        }
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }

    // Recipient must match assertion consumer URL
    String recipient = subjectConfData.getRecipient();
    if (recipient == null || !recipient.equals(getAbsoluteTargetAddress(m))) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }

    // We must have a NotOnOrAfter timestamp
    if (subjectConfData.getNotOnOrAfter() == null
        || subjectConfData.getNotOnOrAfter().isBeforeNow()) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }

    //TODO: replay cache, same as with SAML SSO case

    // Check address
    if (subjectConfData.getAddress() != null
        && (clientAddress == null || !subjectConfData.getAddress().equals(clientAddress))) {
        throw ExceptionUtils.toNotAuthorizedException(null, null);
    }


}
 

public void validate(Subject subject, String expectedInResponseTo) {
    if (subject == null) {
        throw new SamlResponseValidationException("Subject is missing from the assertion.");
    }

    if (subject.getSubjectConfirmations().size() != 1) {
        throw new SamlResponseValidationException("Exactly one subject confirmation is expected.");
    }

    SubjectConfirmation subjectConfirmation = subject.getSubjectConfirmations().get(0);
    if (!METHOD_BEARER.equals(subjectConfirmation.getMethod())) {
        throw new SamlResponseValidationException("Subject confirmation method must be 'bearer'.");
    }

    SubjectConfirmationData subjectConfirmationData = subjectConfirmation.getSubjectConfirmationData();
    if (subjectConfirmationData == null) {
        throw new SamlResponseValidationException("Subject confirmation data is missing from the assertion.");
    }

    timeRestrictionValidator.validateNotBefore(subjectConfirmationData.getNotBefore());

    DateTime notOnOrAfter = subjectConfirmationData.getNotOnOrAfter();
    if (notOnOrAfter == null) {
        throw new SamlResponseValidationException("Subject confirmation data must contain 'NotOnOrAfter'.");
    }

    timeRestrictionValidator.validateNotOnOrAfter(notOnOrAfter);

    String actualInResponseTo = subjectConfirmationData.getInResponseTo();
    if (actualInResponseTo == null) {
        throw new SamlResponseValidationException("Subject confirmation data must contain 'InResponseTo'.");
    }

    if (!expectedInResponseTo.equals(actualInResponseTo)) {
        throw new SamlResponseValidationException(String.format("'InResponseTo' must match requestId. Expected %s but was %s", expectedInResponseTo, actualInResponseTo));
    }

    if (subject.getNameID() == null) {
        throw new SamlResponseValidationException("NameID is missing from the subject of the assertion.");
    }
}
 

private static Response getAuthResponse(String recipient) throws Exception {
    // IdP entity ID
    final Issuer issuer = build(Issuer.DEFAULT_ELEMENT_NAME);
    issuer.setValue("http://idp.example.com/post");

    final Assertion assertion = build(Assertion.DEFAULT_ELEMENT_NAME);
    final Subject subject = build(Subject.DEFAULT_ELEMENT_NAME);
    final SubjectConfirmation subjectConfirmation = build(SubjectConfirmation.DEFAULT_ELEMENT_NAME);
    final SubjectConfirmationData data = build(SubjectConfirmationData.DEFAULT_ELEMENT_NAME);

    data.setInResponseTo(requestIdManager.newId());
    data.setNotOnOrAfter(DateTime.now().plusMinutes(1));
    data.setRecipient(recipient);

    subjectConfirmation.setSubjectConfirmationData(data);
    subjectConfirmation.setMethod("urn:oasis:names:tc:SAML:2.0:cm:bearer");

    subject.getSubjectConfirmations().add(subjectConfirmation);

    assertion.setSubject(subject);

    assertion.setIssuer(XMLObjectSupport.cloneXMLObject(issuer));
    assertion.setIssueInstant(DateTime.now());
    assertion.setID(requestIdManager.newId());

    final AuthnStatement authnStatement = build(AuthnStatement.DEFAULT_ELEMENT_NAME);
    authnStatement.setSessionIndex("1");
    assertion.getAuthnStatements().add(authnStatement);

    final Conditions conditions = build(Conditions.DEFAULT_ELEMENT_NAME);
    conditions.setNotBefore(DateTime.now().minusMinutes(1));
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(1));

    final AudienceRestriction audienceRestriction = build(AudienceRestriction.DEFAULT_ELEMENT_NAME);
    final Audience audience = build(Audience.DEFAULT_ELEMENT_NAME);
    // Set SP entity ID as an audience.
    audience.setAudienceURI(spEntityId);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);

    assertion.setConditions(conditions);

    sign(assertion, idpCredential, signatureAlgorithm);

    final Response response = build(Response.DEFAULT_ELEMENT_NAME);
    response.getAssertions().add(assertion);

    response.setID(requestIdManager.newId());
    response.setIssuer(issuer);
    response.setIssueInstant(DateTime.now());

    final Status status = build(Status.DEFAULT_ELEMENT_NAME);
    final StatusCode statusCode = build(StatusCode.DEFAULT_ELEMENT_NAME);
    statusCode.setValue(StatusCode.SUCCESS);
    status.setStatusCode(statusCode);
    response.setStatus(status);

    return response;
}