org.opensaml.saml2.metadata.EntityDescriptor Java Examples

/** {@inheritDoc} */
protected void processChildElement(XMLObject parentSAMLObject, XMLObject childSAMLObject)
        throws UnmarshallingException {
    EntitiesDescriptor entitiesDescriptor = (EntitiesDescriptor) parentSAMLObject;

    if (childSAMLObject instanceof Extensions) {
        entitiesDescriptor.setExtensions((Extensions) childSAMLObject);
    } else if (childSAMLObject instanceof EntitiesDescriptor) {
        entitiesDescriptor.getEntitiesDescriptors().add((EntitiesDescriptor) childSAMLObject);
    } else if (childSAMLObject instanceof EntityDescriptor) {
        entitiesDescriptor.getEntityDescriptors().add((EntityDescriptor) childSAMLObject);
    } else if (childSAMLObject instanceof Signature) {
        entitiesDescriptor.setSignature((Signature) childSAMLObject);
    } else {
        super.processChildElement(parentSAMLObject, childSAMLObject);
    }
}
 

/** {@inheritDoc} */
public EntityDescriptor getEntityDescriptor(String entityID) throws MetadataProviderException {
    Lock readLock = providerLock.readLock();
    readLock.lock();

    EntityDescriptor descriptor = null;
    try {
        for (MetadataProvider provider : providers) {
            log.debug("Checking child metadata provider for entity descriptor with entity ID: {}", entityID);
            try {
                descriptor = provider.getEntityDescriptor(entityID);
                if (descriptor != null) {
                    break;
                }
            } catch (MetadataProviderException e) {
                log.warn("Error retrieving metadata from provider of type {}, proceeding to next provider",
                        provider.getClass().getName(), e);
                continue;
            }
        }
    } finally {
        readLock.unlock();
    }

    return descriptor;
}
 

/** {@inheritDoc} */
public void doFilter(XMLObject metadata) throws FilterException {
    SignableXMLObject signableMetadata = (SignableXMLObject) metadata;

    if (!signableMetadata.isSigned()){
        if (getRequireSignature()) {
            throw new FilterException("Metadata root element was unsigned and signatures are required.");
        }
    }
    
    if (signableMetadata instanceof EntityDescriptor) {
        processEntityDescriptor((EntityDescriptor) signableMetadata);
    } else if (signableMetadata instanceof EntitiesDescriptor) {
        processEntityGroup((EntitiesDescriptor) signableMetadata);
    } else {
        log.error("Internal error, metadata object was of an unsupported type: {}", metadata.getClass().getName());
    }
}
 

/** {@inheritDoc} */
public EntityDescriptor getEntityDescriptor(String entityID) throws MetadataProviderException {
    if (!isInitialized()) {
        throw new MetadataProviderException("Metadata provider has not been initialized");
    }

    if (DatatypeHelper.isEmpty(entityID)) {
        log.debug("EntityDescriptor entityID was null or empty, skipping search for it");
        return null;
    }

    EntityDescriptor descriptor = doGetEntityDescriptor(entityID);
    if (descriptor == null) {
        log.debug("Metadata document does not contain an EntityDescriptor with the ID {}", entityID);
        return null;
    } else if (!isValid(descriptor)) {
        log.debug("Metadata document contained an EntityDescriptor with the ID {}, but it was no longer valid",
                entityID);
        return null;
    }

    return descriptor;
}
 

/**
 * Filters entity descriptor roles.
 * 
 * @param descriptor entity descriptor to filter
 * 
 * @throws FilterException thrown if an effective role name can not be determined
 */
protected void filterEntityDescriptor(EntityDescriptor descriptor) throws FilterException {
    List<RoleDescriptor> roles = descriptor.getRoleDescriptors();

    if (roles != null && !roles.isEmpty()) {
        Iterator<RoleDescriptor> rolesItr = roles.iterator();
        QName roleName;
        while (rolesItr.hasNext()) {
            roleName = getRoleName(rolesItr.next());
            if (!roleWhiteList.contains(roleName)) {
                log.trace("Filtering out role {} from entity {}", roleName, descriptor.getEntityID());
                rolesItr.remove();
            }
        }
    }
}
 

/** {@inheritDoc} */
protected void processChildElement(XMLObject parentSAMLObject, XMLObject childSAMLObject)
        throws UnmarshallingException {
    EntityDescriptor entityDescriptor = (EntityDescriptor) parentSAMLObject;

    if (childSAMLObject instanceof Extensions) {
        entityDescriptor.setExtensions((Extensions) childSAMLObject);
    } else if (childSAMLObject instanceof Signature) {
        entityDescriptor.setSignature((Signature) childSAMLObject);
    } else if (childSAMLObject instanceof RoleDescriptor) {
        entityDescriptor.getRoleDescriptors().add((RoleDescriptor) childSAMLObject);
    } else if (childSAMLObject instanceof AffiliationDescriptor) {
        entityDescriptor.setAffiliationDescriptor((AffiliationDescriptor) childSAMLObject);
    } else if (childSAMLObject instanceof Organization) {
        entityDescriptor.setOrganization((Organization) childSAMLObject);
    } else if (childSAMLObject instanceof ContactPerson) {
        entityDescriptor.getContactPersons().add((ContactPerson) childSAMLObject);
    } else if (childSAMLObject instanceof AdditionalMetadataLocation) {
        entityDescriptor.getAdditionalMetadataLocations().add((AdditionalMetadataLocation) childSAMLObject);
    } else {
        super.processChildElement(parentSAMLObject, childSAMLObject);
    }
}
 

/** {@inheritDoc} */
protected void processAttribute(XMLObject samlObject, Attr attribute) throws UnmarshallingException {
    EntityDescriptor entityDescriptor = (EntityDescriptor) samlObject;

    if (attribute.getLocalName().equals(EntityDescriptor.ENTITY_ID_ATTRIB_NAME)) {
        entityDescriptor.setEntityID(attribute.getValue());
    } else if (attribute.getLocalName().equals(EntityDescriptor.ID_ATTRIB_NAME)) {
        entityDescriptor.setID(attribute.getValue());
        attribute.getOwnerElement().setIdAttributeNode(attribute, true);
    } else if (attribute.getLocalName().equals(TimeBoundSAMLObject.VALID_UNTIL_ATTRIB_NAME)
            && !DatatypeHelper.isEmpty(attribute.getValue())) {
        entityDescriptor.setValidUntil(new DateTime(attribute.getValue(), ISOChronology.getInstanceUTC()));
    } else if (attribute.getLocalName().equals(CacheableSAMLObject.CACHE_DURATION_ATTRIB_NAME)) {
        entityDescriptor.setCacheDuration(XMLHelper.durationToLong(attribute.getValue()));
    } else {
        QName attribQName = XMLHelper.getNodeQName(attribute);
        if (attribute.isId()) {
            entityDescriptor.getUnknownAttributes().registerID(attribQName);
        }
        entityDescriptor.getUnknownAttributes().put(attribQName, attribute.getValue());
    }
}
 

/**
 * Populates the peer's entity metadata if a metadata provide is present in the message context. Populates the
 * peer's role descriptor if the entity metadata was available and the role name is present in the message context.
 * 
 * @param messageContext current message context
 * 
 * @throws MessageDecodingException thrown if there is a problem populating the message context
 */
protected void populateRelyingPartyMetadata(SAMLMessageContext messageContext) throws MessageDecodingException {
    MetadataProvider metadataProvider = messageContext.getMetadataProvider();
    try {
        if (metadataProvider != null) {
            EntityDescriptor relyingPartyMD = metadataProvider.getEntityDescriptor(messageContext
                    .getInboundMessageIssuer());
            messageContext.setPeerEntityMetadata(relyingPartyMD);

            QName relyingPartyRole = messageContext.getPeerEntityRole();
            if (relyingPartyMD != null && relyingPartyRole != null) {
                List<RoleDescriptor> roles = relyingPartyMD.getRoleDescriptors(relyingPartyRole,
                        SAMLConstants.SAML11P_NS);
                if (roles != null && roles.size() > 0) {
                    messageContext.setPeerEntityRoleMetadata(roles.get(0));
                }
            }
        }
    } catch (MetadataProviderException e) {
        log.error("Error retrieving metadata for relying party " + messageContext.getInboundMessageIssuer(), e);
        throw new MessageDecodingException("Error retrieving metadata for relying party "
                + messageContext.getInboundMessageIssuer(), e);
    }
}
 

public Document marshallerMetadata(EntityDescriptor entityDescriptor) {
	Document document = null;
	try {
		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

		DocumentBuilder documentBuilder = factory.newDocumentBuilder();

		document = documentBuilder.newDocument();

		Marshaller marshaller = marshallerFactory.getMarshaller(entityDescriptor);
		marshaller.marshall(entityDescriptor, document);
	} catch (Exception e) {
		e.printStackTrace();
	}

	return document;

}
 

public EntityDescriptor getEntityDescriptor(File file)
		throws Exception {
	try {
		FilesystemMetadataProvider filesystemMetadataProvider = new FilesystemMetadataProvider(
				file);
		filesystemMetadataProvider.setRequireValidMetadata(true); // Enable
		// validation
		filesystemMetadataProvider.setParserPool(new BasicParserPool());
		filesystemMetadataProvider.initialize();
		EntityDescriptor entityDescriptor = (EntityDescriptorImpl) filesystemMetadataProvider.getMetadata();
		return entityDescriptor;
	} catch (MetadataProviderException e) {
		logger.error("元数据解析出错", e);
		throw new Exception("元数据文件解析出错", e);
	}

}
 

public EntityDescriptor getEntityDescriptor(Element elementMetadata)
		throws Exception {
	try {
		DOMMetadataProvider dOMMetadataProvider = new DOMMetadataProvider(elementMetadata);
		dOMMetadataProvider.setRequireValidMetadata(true); // Enable
															// validation
		dOMMetadataProvider.setParserPool(new BasicParserPool());
		dOMMetadataProvider.initialize();
		EntityDescriptor entityDescriptor = (EntityDescriptorImpl) dOMMetadataProvider.getMetadata();
		return entityDescriptor;
	} catch (MetadataProviderException e) {
		logger.error("元数据解析出错", e);
		throw new Exception("元数据解析出错", e);
	}

}
 

/**
 * Populates the peer's entity metadata if a metadata provide is present in the message context. Populates the
 * peer's role descriptor if the entity metadata was available and the role name is present in the message context.
 * 
 * @param messageContext current message context
 * 
 * @throws MessageDecodingException thrown if there is a problem populating the message context
 */
protected void populateRelyingPartyMetadata(SAMLMessageContext messageContext) throws MessageDecodingException {
    MetadataProvider metadataProvider = messageContext.getMetadataProvider();
    try {
        if (metadataProvider != null) {
            EntityDescriptor relyingPartyMD = metadataProvider.getEntityDescriptor(messageContext
                    .getInboundMessageIssuer());
            messageContext.setPeerEntityMetadata(relyingPartyMD);

            QName relyingPartyRole = messageContext.getPeerEntityRole();
            if (relyingPartyMD != null && relyingPartyRole != null) {
                List<RoleDescriptor> roles = relyingPartyMD.getRoleDescriptors(relyingPartyRole,
                        SAMLConstants.SAML11P_NS);
                if (roles != null && roles.size() > 0) {
                    messageContext.setPeerEntityRoleMetadata(roles.get(0));
                }
            }
        }
    } catch (MetadataProviderException e) {
        log.error("Error retrieving metadata for relying party " + messageContext.getInboundMessageIssuer(), e);
        throw new MessageDecodingException("Error retrieving metadata for relying party "
                + messageContext.getInboundMessageIssuer(), e);
    }
}
 

@SneakyThrows
private boolean isLocal(ExtendedMetadataDelegate delegate) {
    delegate.initialize();
    XMLObject metadata = delegate.getDelegate().getMetadata();

    List<EntityDescriptor> descriptors = EntityDescriptor.class.isAssignableFrom(metadata.getClass())
            ? Collections.singletonList((EntityDescriptor) metadata)
            : (EntitiesDescriptor.class.isAssignableFrom(metadata.getClass())
                ? ((EntitiesDescriptor) metadata).getEntityDescriptors()
                : Collections.emptyList());

    return descriptors.stream()
                    .anyMatch(ed -> isLocal(delegate, ed.getEntityID()));
}
 

/** {@inheritDoc} */
protected void marshallAttributes(XMLObject samlElement, Element domElement) {
    EntityDescriptor entityDescriptor = (EntityDescriptor) samlElement;

    // Set the entityID attribute
    if (entityDescriptor.getEntityID() != null) {
        domElement.setAttributeNS(null, EntityDescriptor.ENTITY_ID_ATTRIB_NAME, entityDescriptor.getEntityID());
    }

    // Set the ID attribute
    if (entityDescriptor.getID() != null) {
        domElement.setAttributeNS(null, EntityDescriptor.ID_ATTRIB_NAME, entityDescriptor.getID());
        domElement.setIdAttributeNS(null, EntityDescriptor.ID_ATTRIB_NAME, true);
    }

    // Set the validUntil attribute
    if (entityDescriptor.getValidUntil() != null) {
        log.debug("Writting validUntil attribute to EntityDescriptor DOM element");
        String validUntilStr = Configuration.getSAMLDateFormatter().print(entityDescriptor.getValidUntil());
        domElement.setAttributeNS(null, TimeBoundSAMLObject.VALID_UNTIL_ATTRIB_NAME, validUntilStr);
    }

    // Set the cacheDuration attribute
    if (entityDescriptor.getCacheDuration() != null) {
        log.debug("Writting cacheDuration attribute to EntityDescriptor DOM element");
        String cacheDuration = XMLHelper.longToDuration(entityDescriptor.getCacheDuration());
        domElement.setAttributeNS(null, CacheableSAMLObject.CACHE_DURATION_ATTRIB_NAME, cacheDuration);
    }

    Attr attribute;
    for (Entry<QName, String> entry : entityDescriptor.getUnknownAttributes().entrySet()) {
        attribute = XMLHelper.constructAttribute(domElement.getOwnerDocument(), entry.getKey());
        attribute.setValue(entry.getValue());
        domElement.setAttributeNodeNS(attribute);
        if (Configuration.isIDAttribute(entry.getKey())
                || entityDescriptor.getUnknownAttributes().isIDAttribute(entry.getKey())) {
            attribute.getOwnerElement().setIdAttributeNode(attribute, true);
        }
    }
}
 

protected String getFileName(EntityDescriptor entityDescriptor) {
    StringBuilder fileName = new StringBuilder();
    for (Character c : entityDescriptor.getEntityID().toCharArray()) {
        if (Character.isJavaIdentifierPart(c)) {
            fileName.append(c);
        }
    }
    if (fileName.length() > 0) {
        fileName.append("_sp.xml");
        return fileName.toString();
    } else {
        return "default_sp.xml";
    }
}
 

public EntityDescriptor buildEntityDescriptor(String entityId,RoleDescriptor roleDescriptor){
    EntityDescriptor entityDescriptor = new EntityDescriptorBuilder().buildObject();
    entityDescriptor.setEntityID(entityId);
    entityDescriptor.getRoleDescriptors().add(roleDescriptor);
    
    return entityDescriptor;
}
 

/** {@inheritDoc} */
public void doFilter(XMLObject metadata) throws FilterException {
    if (metadata == null) {
        return;
    }

    if (metadata instanceof EntitiesDescriptor) {
        filterEntitiesDescriptor((EntitiesDescriptor) metadata);
    } else {
        filterEntityDescriptor((EntityDescriptor) metadata);
    }
}
 

/**
 * Gets the identified roles from an EntityDescriptor. This method should not check if the provider is initialized,
 * if arguments are null, if the roles are valid, etc. All of this is done by the invoker of this method.
 * 
 * @param entityID ID of the entity from which to retrieve the roles, never null
 * @param roleName name of the roles to search for, never null
 * 
 * @return the modifiable list of identified roles or an empty list if no roles exists
 * 
 * @throws MetadataProviderException thrown if there is a problem searching for the roles
 */
protected List<RoleDescriptor> doGetRole(String entityID, QName roleName) throws MetadataProviderException {
    EntityDescriptor entity = doGetEntityDescriptor(entityID);
    if (entity == null) {
        log.debug("Metadata document did not contain a descriptor for entity {}", entityID);
        return Collections.emptyList();
    }

    List<RoleDescriptor> descriptors = entity.getRoleDescriptors(roleName);
    if (descriptors != null && !descriptors.isEmpty()) {
        return new ArrayList<RoleDescriptor>(descriptors);
    }

    return Collections.emptyList();
}
 

/**
 * Displays stored metadata.
 *
 * @param entityId entity ID of metadata to display
 * @return model and view
 * @throws MetadataProviderException in case metadata can't be located
 * @throws MarshallingException      in case de-serialization into string fails
 */
@RequestMapping(value = "/display")
public ModelAndView displayMetadata(@RequestParam("entityId") String entityId) throws MetadataProviderException, MarshallingException {

    EntityDescriptor entityDescriptor = metadataManager.getEntityDescriptor(entityId);
    ExtendedMetadata extendedMetadata = metadataManager.getExtendedMetadata(entityId);

    if (entityDescriptor == null) {
        throw new MetadataProviderException("Metadata with ID " + entityId + " not found");
    }

    return displayMetadata(entityDescriptor, extendedMetadata);

}
 

protected ModelAndView displayMetadata(EntityDescriptor entityDescriptor, ExtendedMetadata extendedMetadata) throws MarshallingException {

        MetadataForm metadata = new MetadataForm();
        String fileName = getFileName(entityDescriptor);

        metadata.setLocal(extendedMetadata.isLocal());
        metadata.setSecurityProfile(extendedMetadata.getSecurityProfile());
        metadata.setSslSecurityProfile(extendedMetadata.getSslSecurityProfile());
        metadata.setSerializedMetadata(getMetadataAsString(entityDescriptor, extendedMetadata));
        metadata.setConfiguration(getConfiguration(fileName, extendedMetadata));
        metadata.setEntityId(entityDescriptor.getEntityID());
        metadata.setAlias(extendedMetadata.getAlias());
        metadata.setRequireArtifactResolveSigned(extendedMetadata.isRequireArtifactResolveSigned());
        metadata.setRequireLogoutRequestSigned(extendedMetadata.isRequireLogoutRequestSigned());
        metadata.setRequireLogoutResponseSigned(extendedMetadata.isRequireLogoutResponseSigned());
        metadata.setEncryptionKey(extendedMetadata.getEncryptionKey());
        metadata.setSigningKey(extendedMetadata.getSigningKey());
        metadata.setTlsKey(extendedMetadata.getTlsKey());
        metadata.setSslHostnameVerification(extendedMetadata.getSslHostnameVerification());

        metadata.setSignMetadata(extendedMetadata.isSignMetadata());
        metadata.setSigningAlgorithm(extendedMetadata.getSigningAlgorithm());

        metadata.setIncludeDiscovery(extendedMetadata.isIdpDiscoveryEnabled());
        metadata.setCustomDiscoveryURL(extendedMetadata.getIdpDiscoveryResponseURL());
        metadata.setCustomDiscoveryResponseURL(extendedMetadata.getIdpDiscoveryURL());

        // TODO other fields nameIDs

        ModelAndView model = new ModelAndView(new InternalResourceView("/WEB-INF/security/metadataView.jsp", true));
        model.addObject("metadata", metadata);
        model.addObject("storagePath", fileName);

        return model;

    }
 

/** Constructor. */
public AbstractMetadataProvider() {
    super();
    indexedDescriptors = new ConcurrentHashMap<String, EntityDescriptor>();
    failFastInitialization = true;
    initialized = false;
}
 

/** {@inheritDoc} */
public List<EntityDescriptor> getEntityDescriptors() {
    ArrayList<EntityDescriptor> descriptors = new ArrayList<EntityDescriptor>();
    for (XMLObject descriptor : childDescriptors) {
        if (descriptor instanceof EntityDescriptor) {
            descriptors.add((EntityDescriptor) descriptor);
        }
    }

    return descriptors;
}
 

/**
 * Gets the validUntil time of the metadata, if present.
 * 
 * @param metadata metadata from which to get the validUntil instant
 * 
 * @return the valid until instant or null if it is not present
 * 
 * @throws FilterException thrown if the given XML object is not an {@link EntitiesDescriptor} or
 *             {@link EntityDescriptor}
 */
protected DateTime getValidUntil(XMLObject metadata) throws FilterException {
    if (metadata instanceof EntitiesDescriptor) {
        return ((EntitiesDescriptor) metadata).getValidUntil();
    } else if (metadata instanceof EntityDescriptor) {
        return ((EntityDescriptor) metadata).getValidUntil();
    } else {
        log.error("Metadata root element was not an EntitiesDescriptor or EntityDescriptor it was a {}", metadata
                .getElementQName());
        throw new FilterException("Metadata root element was not an EntitiesDescriptor or EntityDescriptor");
    }
}
 

/**
 * Checks that at least either Valid Until or Cache Duration is present when Entity Descriptor is root element.
 * 
 * @param entityDescriptor
 * @throws ValidationException
 */
protected void validateRoot(EntityDescriptor entityDescriptor) throws ValidationException {
    if (entityDescriptor.getParent() == null && entityDescriptor.getValidUntil() == null
            && entityDescriptor.getCacheDuration() == null) {
        throw new ValidationException("Must have either ValidUntil or CacheDuration when is root element.");
    }
}
 

/**
 * Checks that an AffiliationDescriptor OR one or more RoleDescriptors are present.
 * 
 * @param entityDescriptor
 * @throws ValidationException
 */
protected void validateDescriptors(EntityDescriptor entityDescriptor) throws ValidationException {
    if ((entityDescriptor.getRoleDescriptors() == null || entityDescriptor.getRoleDescriptors().size() < 1)
            && entityDescriptor.getAffiliationDescriptor() == null) {
        throw new ValidationException("Must have an AffiliationDescriptor or one or more RoleDescriptors.");
    }

    if (entityDescriptor.getAffiliationDescriptor() != null && entityDescriptor.getRoleDescriptors() != null
            && entityDescriptor.getRoleDescriptors().size() > 0) {
        throw new ValidationException("Cannot have an AffiliationDescriptor AND RoleDescriptors");
    }
}
 

/**
 * Checks that EntityID is present and valid.
 * 
 * @param entityDescriptor
 * @throws ValidationException
 */
protected void validateEntityID(EntityDescriptor entityDescriptor) throws ValidationException {
    if (DatatypeHelper.isEmpty(entityDescriptor.getEntityID())) {
        throw new ValidationException("Entity ID required.");
    } else if (entityDescriptor.getEntityID().length() > 1024) {
        throw new ValidationException("Max Entity ID length is 1024.");
    }
}
 

/** {@inheritDoc} */
public EntityDescriptor buildObject(String namespaceURI, String localName, String namespacePrefix) {
    return new EntityDescriptorImpl(namespaceURI, localName, namespacePrefix);
}
 

public EntityDescriptor getEntityDescriptor(String strMetadata)
		throws Exception {
	InputStream inputStream = StringUtil.String2InputStream(strMetadata);
	return getEntityDescriptor(inputStream);
}
 

protected String getMetadataAsString(EntityDescriptor descriptor, ExtendedMetadata extendedMetadata) throws MarshallingException {
    return SAMLUtil.getMetadataAsString(metadataManager, keyManager, descriptor, extendedMetadata);
}
 

/** {@inheritDoc} */
public EntityDescriptor getLocalEntityMetadata() {
    return localEntityMetadata;
}