src/edu/internet2/middleware/shibboleth/aa/AASaml.java

   1 /*
   2  * The Shibboleth License, Version 1.
   3  * Copyright (c) 2002
   4  * University Corporation for Advanced Internet Development, Inc.
   5  * All rights reserved
   6  *
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * Redistributions of source code must retain the above copyright notice, this
  12  * list of conditions and the following disclaimer.
  13  *
  14  * Redistributions in binary form must reproduce the above copyright notice,
  15  * this list of conditions and the following disclaimer in the documentation
  16  * and/or other materials provided with the distribution, if any, must include
  17  * the following acknowledgment: "This product includes software developed by
  18  * the University Corporation for Advanced Internet Development
  19  * <http://www.ucaid.edu>Internet2 Project. Alternately, this acknowledegement
  20  * may appear in the software itself, if and wherever such third-party
  21  * acknowledgments normally appear.
  22  *
  23  * Neither the name of Shibboleth nor the names of its contributors, nor
  24  * Internet2, nor the University Corporation for Advanced Internet Development,
  25  * Inc., nor UCAID may be used to endorse or promote products derived from this
  26  * software without specific prior written permission. For written permission,
  27  * please contact shibboleth@shibboleth.org
  28  *
  29  * Products derived from this software may not be called Shibboleth, Internet2,
  30  * UCAID, or the University Corporation for Advanced Internet Development, nor
  31  * may Shibboleth appear in their name, without prior written permission of the
  32  * University Corporation for Advanced Internet Development.
  33  *
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  36  * AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  37  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
  38  * PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK
  39  * OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE.
  40  * IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY
  41  * CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT,
  42  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  43  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  44  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  45  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  46  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  47  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  48  */
  49
  50 package edu.internet2.middleware.shibboleth.aa;
  51
  52 /**
  53  *  Attribute Authority & Release Policy
  54  *  SAML Layer for AA
  55  *
  56  * @author     Parviz Dousti (dousti@cmu.edu)
  57  * @created    June, 2002
  58  */
  59
  60
  61 import java.io.IOException;
  62 import java.util.Arrays;
  63 import java.util.Collection;
  64 import java.util.Collections;
  65 import java.util.Date;
  66 import java.util.Iterator;
  67
  68 import javax.servlet.http.HttpServletRequest;
  69 import javax.servlet.http.HttpServletResponse;
  70
  71 import org.apache.log4j.Logger;
  72 import org.opensaml.SAMLAssertion;
  73 import org.opensaml.SAMLAttributeQuery;
  74 import org.opensaml.SAMLAttributeStatement;
  75 import org.opensaml.SAMLAudienceRestrictionCondition;
  76 import org.opensaml.SAMLBinding;
  77 import org.opensaml.SAMLCondition;
  78 import org.opensaml.SAMLException;
  79 import org.opensaml.SAMLQuery;
  80 import org.opensaml.SAMLRequest;
  81 import org.opensaml.SAMLResponse;
  82 import org.opensaml.SAMLStatement;
  83 import org.opensaml.SAMLSubject;
  84 import sun.misc.BASE64Decoder;
  85
  86 import edu.internet2.middleware.shibboleth.common.SAMLBindingFactory;
  87
  88
  89 public class AASaml {
  90
  91     String[] policies;
  92     String myName;
  93     StringBuffer sharName;
  94     SAMLRequest sreq;
  95     SAMLAttributeQuery aquery;
  96     SAMLBinding binding;
  97     private static Logger log = Logger.getLogger(AASaml.class.getName());
  98
  99     public AASaml(String myName, String[] policies) throws SAMLException {
 100         binding = SAMLBindingFactory.getInstance(SAMLBinding.SAML_SOAP_HTTPS);
 101         this.myName = myName;
 102         this.policies = policies;
 103     }
 104
 105     public void receive(HttpServletRequest req) throws SAMLException {
 106         sharName=new StringBuffer();
 107         sreq = binding.receive(req, sharName);
 108         SAMLQuery q = sreq.getQuery();
 109         if (q == null || !(q instanceof SAMLAttributeQuery))
 110             throw new SAMLException(SAMLException.REQUESTER,"AASaml.receive() can only respond to a SAML Attribute Query");
 111         aquery = (SAMLAttributeQuery)q;
 112     }
 113
 114     public String getNameQualifier(){
 115         return aquery.getSubject().getNameQualifier();
 116     }
 117
 118     public String getHandle(){
 119         return aquery.getSubject().getName();
 120     }
 121
 122     public String getFormat(){
 123         return aquery.getSubject().getFormat();
 124     }
 125
 126     public String getResource(){
 127         return aquery.getResource();
 128     }
 129
 130     public String getShar(){
 131         return sharName.toString();
 132     }
 133
 134     public Iterator getDesignators() {
 135         return aquery.getDesignators();
 136     }
 137
 138
 139     public void respond(HttpServletResponse resp, Collection attrs, SAMLException exception)
 140         throws IOException {
 141         SAMLException ourSE = null;
 142         SAMLResponse sResp = null;
 143
 144         try {
 145             if(attrs == null || attrs.size() == 0) {
 146                         sResp = new SAMLResponse(sreq.getId(),
 147                                                  /* recipient URL*/ null,
 148                                                  /* no attrs -> no assersion*/ null,
 149                                                  exception);
 150
 151             } else {
 152
 153                 // Determine max lifetime, and filter via query if necessary.
 154                         Date now = new Date();
 155                         Date then = null;
 156                 long min = 0;
 157
 158                         SAMLSubject rSubject = (SAMLSubject)aquery.getSubject().clone();
 159                         SAMLCondition condition = new SAMLAudienceRestrictionCondition(Arrays.asList(policies));
 160                         SAMLStatement statement = new SAMLAttributeStatement(rSubject, attrs);
 161
 162                         if(min > 0)
 163                             then = new Date(now.getTime() + (min*1000));
 164
 165                         SAMLAssertion sAssertion = new SAMLAssertion(
 166                                 myName,
 167                                                      now,
 168                                                      then,
 169                                                      Collections.singleton(condition),
 170                                                      null,
 171                                                      Collections.singleton(statement)
 172                                  );
 173
 174                         sResp = new SAMLResponse(sreq.getId(),
 175                                                  /* recipient URL*/ null,
 176                                                  Collections.singleton(sAssertion),
 177                                                  exception);
 178             }
 179         } catch (SAMLException se) {
 180             ourSE = se;
 181         } catch (CloneNotSupportedException ex) {
 182             ourSE = new SAMLException(SAMLException.RESPONDER, ex);
 183
 184         } finally{
 185
 186                 if (log.isDebugEnabled()) {
 187                                 try {
 188                                         log.debug(
 189                                                 "Dumping generated SAML Response:"
 190                                                 + System.getProperty("line.separator")
 191                                                 + new String(new BASE64Decoder().decodeBuffer(new String(sResp.toBase64(), "ASCII")), "UTF8"));
 192                                 }
 193                 catch (SAMLException e) {
 194                     log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 195                 }
 196                 catch (IOException e) {
 197                                         log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 198                                 }
 199                         }
 200
 201             binding.respond(resp,sResp,ourSE);
 202         }
 203     }
 204
 205     public void fail(HttpServletResponse resp, SAMLException exception)
 206         throws IOException{
 207         try{
 208             SAMLResponse sResp = new SAMLResponse((sreq!=null) ? sreq.getId() : null,
 209                                                   /* recipient URL*/ null,
 210                                                   /* an assersion*/ null,
 211                                                   exception);
 212                 if (log.isDebugEnabled()) {
 213                         try {
 214                                 log.debug(
 215                                         "Dumping generated SAML Error Response:"
 216                                         + System.getProperty("line.separator")
 217                                         + new String(new BASE64Decoder().decodeBuffer(new String(sResp.toBase64(), "ASCII")), "UTF8"));
 218                                 } catch (IOException e) {
 219                                         log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 220                                 }
 221                         }
 222             binding.respond(resp, sResp, null);
 223             log.debug("Returning SAML Error Response.");
 224         }catch(SAMLException se){
 225             binding.respond(resp, null, exception);
 226             log.info("AA failed to make an error message: "+se);
 227         }
 228     }
 229 }