src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_1ArtifactQueryHandler.java

   1 /*
   2  * The Shibboleth License, Version 1. Copyright (c) 2002 University Corporation for Advanced Internet Development, Inc.
   3  * All rights reserved Redistribution and use in source and binary forms, with or without modification, are permitted
   4  * provided that the following conditions are met: Redistributions of source code must retain the above copyright
   5  * notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above
   6  * copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials
   7  * provided with the distribution, if any, must include the following acknowledgment: "This product includes software
   8  * developed by the University Corporation for Advanced Internet Development <http://www.ucaid.edu> Internet2 Project.
   9  * Alternately, this acknowledegement may appear in the software itself, if and wherever such third-party
  10  * acknowledgments normally appear. Neither the name of Shibboleth nor the names of its contributors, nor Internet2, nor
  11  * the University Corporation for Advanced Internet Development, Inc., nor UCAID may be used to endorse or promote
  12  * products derived from this software without specific prior written permission. For written permission, please contact
  13  * shibboleth@shibboleth.org Products derived from this software may not be called Shibboleth, Internet2, UCAID, or the
  14  * University Corporation for Advanced Internet Development, nor may Shibboleth appear in their name, without prior
  15  * written permission of the University Corporation for Advanced Internet Development. THIS SOFTWARE IS PROVIDED BY THE
  16  * COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE
  18  * DISCLAIMED AND THE ENTIRE RISK OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. IN NO
  19  * EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC.
  20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  21  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
  23  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 package edu.internet2.middleware.shibboleth.idp.provider;
  27
  28 import java.io.IOException;
  29 import java.security.cert.X509Certificate;
  30 import java.util.ArrayList;
  31 import java.util.Iterator;
  32
  33 import javax.security.auth.x500.X500Principal;
  34 import javax.servlet.ServletException;
  35 import javax.servlet.http.HttpServletRequest;
  36 import javax.servlet.http.HttpServletResponse;
  37
  38 import org.apache.log4j.Logger;
  39 import org.opensaml.SAMLAssertion;
  40 import org.opensaml.SAMLException;
  41 import org.opensaml.SAMLRequest;
  42 import org.opensaml.SAMLResponse;
  43
  44 import sun.misc.BASE64Decoder;
  45 import edu.internet2.middleware.shibboleth.artifact.ArtifactMapper;
  46 import edu.internet2.middleware.shibboleth.artifact.ArtifactMapping;
  47 import edu.internet2.middleware.shibboleth.artifact.provider.MemoryArtifactMapper;
  48 import edu.internet2.middleware.shibboleth.common.ShibbolethConfigurationException;
  49 import edu.internet2.middleware.shibboleth.idp.IdPProtocolHandler;
  50 import edu.internet2.middleware.shibboleth.idp.IdPProtocolSupport;
  51 import edu.internet2.middleware.shibboleth.metadata.EntityDescriptor;
  52
  53 /**
  54  * @author Walter Hoehn
  55  */
  56 public class SAMLv1_1ArtifactQueryHandler extends BaseServiceHandler implements IdPProtocolHandler {
  57
  58         // TODO figure out how to refactor this
  59         private ArtifactMapper  artifactMapper;
  60
  61         private static Logger   log     = Logger.getLogger(SAMLv1_1ArtifactQueryHandler.class.getName());
  62
  63         SAMLv1_1ArtifactQueryHandler() throws ShibbolethConfigurationException {
  64                 //TODO move the mapper out into protocol support
  65                 artifactMapper = new MemoryArtifactMapper();
  66         }
  67
  68         /*
  69          * (non-Javadoc)
  70          *
  71          * @see edu.internet2.middleware.shibboleth.idp.ProtocolHandler#getHandlerName()
  72          */
  73         public String getHandlerName() {
  74
  75                 return "SAML v1.1 Artifact Query";
  76         }
  77
  78         /*
  79          * @see edu.internet2.middleware.shibboleth.idp.ProtocolHandler#processRequest(javax.servlet.http.HttpServletRequest,
  80          *      javax.servlet.http.HttpServletResponse, edu.internet2.middleware.shibboleth.idp.ProtocolSupport)
  81          */
  82         public SAMLResponse processRequest(HttpServletRequest request, HttpServletResponse response,
  83                         SAMLRequest samlRequest, IdPProtocolSupport support) throws SAMLException, IOException, ServletException {
  84
  85                 log.info("Recieved a request to dereference an assertion artifact.");
  86
  87                 // TODO how about signatures on artifact dereferencing
  88                 // Pull credential from request
  89                 X509Certificate credential = getCredentialFromProvider(request);
  90                 if (credential == null || credential.getSubjectX500Principal().getName(X500Principal.RFC2253).equals("")) {
  91                         // The spec says that mutual authentication is required for the
  92                         // artifact profile
  93                         log.info("Request is from an unauthenticated serviceprovider.");
  94                         throw new SAMLException(SAMLException.REQUESTER,
  95                                         "SAML Artifacts cannot be dereferenced for unauthenticated requesters.");
  96                 }
  97                 log.info("Request contains credential: (" + credential.getSubjectX500Principal().getName(X500Principal.RFC2253)
  98                                 + ").");
  99                 ArrayList assertions = new ArrayList();
 100                 Iterator artifacts = samlRequest.getArtifacts();
 101
 102                 // TODO error if not artifacts
 103
 104                 int queriedArtifacts = 0;
 105                 StringBuffer dereferencedArtifacts = new StringBuffer();
 106                 // for // transaction // log
 107                 while (artifacts.hasNext()) {
 108                         queriedArtifacts++;
 109                         String artifact = (String) artifacts.next();
 110                         log.debug("Attempting to dereference artifact: (" + artifact + ").");
 111                         ArtifactMapping mapping = artifactMapper.recoverAssertion(artifact);
 112                         if (mapping != null) {
 113                                 SAMLAssertion assertion = mapping.getAssertion(); // See if we have metadata for this provider
 114                                 EntityDescriptor provider = support.lookup(mapping.getServiceProviderId());
 115                                 if (provider == null) {
 116                                         log.info("No metadata found for provider: (" + mapping.getServiceProviderId() + ").");
 117                                         throw new SAMLException(SAMLException.REQUESTER, "Invalid service provider.");
 118                                 }
 119                                 // Make sure that the suppplied credential is valid for the // provider to which theartifact was issued
 120                                 if (!isValidCredential(provider, credential)) {
 121                                         log.error("Supplied credential ("
 122                                                         + credential.getSubjectX500Principal().getName(X500Principal.RFC2253)
 123                                                         + ") is NOT valid for provider (" + mapping.getServiceProviderId()
 124                                                         + "), to whom this artifact was issued.");
 125                                         throw new SAMLException(SAMLException.REQUESTER, "Invalid credential.");
 126                                 }
 127                                 log.debug("Supplied credential validated for the provider to which this artifact was issued.");
 128                                 assertions.add(assertion);
 129                                 dereferencedArtifacts.append("(" + artifact + ")");
 130                         }
 131                 } // The spec requires that if any artifacts are dereferenced, they must
 132                 // all be dereferenced
 133                 if (assertions.size() > 0 && assertions.size() != queriedArtifacts) { throw new SAMLException(
 134                                 SAMLException.REQUESTER, "Unable to successfully dereference all artifacts."); }
 135                 // Create and send response
 136                 // The spec says that we should send "success" in the case where no // artifacts match
 137                 SAMLResponse samlResponse = new SAMLResponse(samlRequest.getId(), null, assertions, null);
 138                 if (log.isDebugEnabled()) {
 139                         try {
 140                                 log.debug("Dumping generated SAML Response:"
 141                                                 + System.getProperty("line.separator")
 142                                                 + new String(new BASE64Decoder().decodeBuffer(new String(samlResponse.toBase64(), "ASCII")),
 143                                                                 "UTF8"));
 144                         } catch (SAMLException e) {
 145                                 log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 146                         } catch (IOException e) {
 147                                 log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 148                         }
 149                 }
 150
 151                 support.getTransactionLog().info(
 152                                 "Succesfully dereferenced the following artifacts: " + dereferencedArtifacts.toString());
 153                 return samlResponse;
 154         }
 155
 156 }