src/edu/internet2/middleware/shibboleth/idp/provider/SAMLv1_AttributeQueryHandler.java

   1 /*
   2  * The Shibboleth License, Version 1. Copyright (c) 2002 University Corporation for Advanced Internet Development, Inc.
   3  * All rights reserved Redistribution and use in source and binary forms, with or without modification, are permitted
   4  * provided that the following conditions are met: Redistributions of source code must retain the above copyright
   5  * notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above
   6  * copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials
   7  * provided with the distribution, if any, must include the following acknowledgment: "This product includes software
   8  * developed by the University Corporation for Advanced Internet Development <http://www.ucaid.edu> Internet2 Project.
   9  * Alternately, this acknowledegement may appear in the software itself, if and wherever such third-party
  10  * acknowledgments normally appear. Neither the name of Shibboleth nor the names of its contributors, nor Internet2, nor
  11  * the University Corporation for Advanced Internet Development, Inc., nor UCAID may be used to endorse or promote
  12  * products derived from this software without specific prior written permission. For written permission, please contact
  13  * shibboleth@shibboleth.org Products derived from this software may not be called Shibboleth, Internet2, UCAID, or the
  14  * University Corporation for Advanced Internet Development, nor may Shibboleth appear in their name, without prior
  15  * written permission of the University Corporation for Advanced Internet Development. THIS SOFTWARE IS PROVIDED BY THE
  16  * COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE
  18  * DISCLAIMED AND THE ENTIRE RISK OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS WITH LICENSEE. IN NO
  19  * EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY CORPORATION FOR ADVANCED INTERNET DEVELOPMENT, INC.
  20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  21  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
  23  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 package edu.internet2.middleware.shibboleth.idp.provider;
  27
  28 import java.io.IOException;
  29 import java.net.URI;
  30 import java.net.URISyntaxException;
  31 import java.security.Principal;
  32 import java.security.cert.X509Certificate;
  33 import java.util.ArrayList;
  34 import java.util.Arrays;
  35 import java.util.Collections;
  36 import java.util.Date;
  37 import java.util.Iterator;
  38
  39 import javax.security.auth.x500.X500Principal;
  40 import javax.servlet.ServletException;
  41 import javax.servlet.http.HttpServletRequest;
  42 import javax.servlet.http.HttpServletResponse;
  43
  44 import org.apache.log4j.Logger;
  45 import org.opensaml.SAMLAssertion;
  46 import org.opensaml.SAMLAttribute;
  47 import org.opensaml.SAMLAttributeDesignator;
  48 import org.opensaml.SAMLAttributeQuery;
  49 import org.opensaml.SAMLAttributeStatement;
  50 import org.opensaml.SAMLAudienceRestrictionCondition;
  51 import org.opensaml.SAMLCondition;
  52 import org.opensaml.SAMLException;
  53 import org.opensaml.SAMLRequest;
  54 import org.opensaml.SAMLResponse;
  55 import org.opensaml.SAMLStatement;
  56 import org.opensaml.SAMLSubject;
  57
  58 import sun.misc.BASE64Decoder;
  59 import edu.internet2.middleware.shibboleth.aa.AAException;
  60 import edu.internet2.middleware.shibboleth.common.InvalidNameIdentifierException;
  61 import edu.internet2.middleware.shibboleth.common.NameIdentifierMappingException;
  62 import edu.internet2.middleware.shibboleth.common.RelyingParty;
  63 import edu.internet2.middleware.shibboleth.common.ShibBrowserProfile;
  64 import edu.internet2.middleware.shibboleth.idp.IdPProtocolHandler;
  65 import edu.internet2.middleware.shibboleth.idp.IdPProtocolSupport;
  66 import edu.internet2.middleware.shibboleth.metadata.EntityDescriptor;
  67
  68 /**
  69  * @author Walter Hoehn
  70  */
  71 public class SAMLv1_AttributeQueryHandler extends BaseServiceHandler implements IdPProtocolHandler {
  72
  73         private static Logger   log     = Logger.getLogger(SAMLv1_AttributeQueryHandler.class.getName());
  74
  75         /*
  76          * @see edu.internet2.middleware.shibboleth.idp.ProtocolHandler#getHandlerName()
  77          */
  78         public String getHandlerName() {
  79
  80                 return "SAML v1.1 Attribute Query";
  81         }
  82
  83         private String getEffectiveName(HttpServletRequest req, RelyingParty relyingParty, IdPProtocolSupport support)
  84                         throws InvalidProviderCredentialException {
  85
  86                 X509Certificate credential = getCredentialFromProvider(req);
  87
  88                 if (credential == null || credential.getSubjectX500Principal().getName(X500Principal.RFC2253).equals("")) {
  89                         log.info("Request is from an unauthenticated service provider.");
  90                         return null;
  91
  92                 } else {
  93                         log.info("Request contains credential: ("
  94                                         + credential.getSubjectX500Principal().getName(X500Principal.RFC2253) + ").");
  95                         // Mockup old requester name for requests from < 1.2 targets
  96                         if (fromLegacyProvider(req)) {
  97                                 String legacyName = ShibBrowserProfile.getHostNameFromDN(credential.getSubjectX500Principal());
  98                                 if (legacyName == null) {
  99                                         log.error("Unable to extract legacy requester name from certificate subject.");
 100                                 }
 101
 102                                 log.info("Request from legacy service provider: (" + legacyName + ").");
 103                                 return legacyName;
 104
 105                         } else {
 106
 107                                 // See if we have metadata for this provider
 108                                 EntityDescriptor provider = support.lookup(relyingParty.getProviderId());
 109                                 if (provider == null) {
 110                                         log.info("No metadata found for provider: (" + relyingParty.getProviderId() + ").");
 111                                         log.info("Treating remote provider as unauthenticated.");
 112                                         return null;
 113                                 }
 114
 115                                 // Make sure that the suppplied credential is valid for the
 116                                 // selected relying party
 117                                 if (isValidCredential(provider, credential)) {
 118                                         log.info("Supplied credential validated for this provider.");
 119                                         log.info("Request from service provider: (" + relyingParty.getProviderId() + ").");
 120                                         return relyingParty.getProviderId();
 121                                 } else {
 122                                         log.error("Supplied credential ("
 123                                                         + credential.getSubjectX500Principal().getName(X500Principal.RFC2253)
 124                                                         + ") is NOT valid for provider (" + relyingParty.getProviderId() + ").");
 125                                         throw new InvalidProviderCredentialException("Invalid credential.");
 126                                 }
 127                         }
 128                 }
 129         }
 130
 131         /*
 132          * @see edu.internet2.middleware.shibboleth.idp.ProtocolHandler#processRequest(javax.servlet.http.HttpServletRequest,
 133          *      javax.servlet.http.HttpServletResponse, org.opensaml.SAMLRequest,
 134          *      edu.internet2.middleware.shibboleth.idp.ProtocolSupport)
 135          */
 136         public SAMLResponse processRequest(HttpServletRequest request, HttpServletResponse response,
 137                         SAMLRequest samlRequest, IdPProtocolSupport support) throws SAMLException, IOException, ServletException {
 138
 139                 // TODO negate this and throw an error if it isn't
 140                 if (samlRequest.getQuery() != null && (samlRequest.getQuery() instanceof SAMLAttributeQuery)) {
 141                         log.info("Recieved an attribute query.");
 142                         // processAttributeQuery(samlRequest, request, response);
 143
 144                 }
 145
 146                 RelyingParty relyingParty = null;
 147
 148                 SAMLAttributeQuery attributeQuery = (SAMLAttributeQuery) samlRequest.getQuery();
 149
 150                 if (!fromLegacyProvider(request)) {
 151                         log.info("Remote provider has identified itself as: (" + attributeQuery.getResource() + ").");
 152                 }
 153
 154                 // This is the requester name that will be passed to subsystems
 155                 String effectiveName = null;
 156
 157                 X509Certificate credential = getCredentialFromProvider(request);
 158                 if (credential == null || credential.getSubjectX500Principal().getName(X500Principal.RFC2253).equals("")) {
 159                         log.info("Request is from an unauthenticated service provider.");
 160                 } else {
 161
 162                         // Identify a Relying Party
 163                         relyingParty = support.getServiceProviderMapper().getRelyingParty(attributeQuery.getResource());
 164
 165                         try {
 166                                 effectiveName = getEffectiveName(request, relyingParty, support);
 167                         } catch (InvalidProviderCredentialException ipc) {
 168                                 //TODO no, throw an exception
 169                                 //sendSAMLFailureResponse(response, samlRequest, new SAMLException(SAMLException.RESPONDER,
 170                                 //              "Invalid credentials for request."));
 171                                 return null;
 172                         }
 173                 }
 174
 175                 if (effectiveName == null) {
 176                         log.debug("Using default Relying Party for unauthenticated provider.");
 177                         relyingParty = support.getServiceProviderMapper().getRelyingParty(null);
 178                 }
 179
 180                 // Fail if we can't honor SAML Subject Confirmation
 181                 if (!fromLegacyProvider(request)) {
 182                         Iterator iterator = attributeQuery.getSubject().getConfirmationMethods();
 183                         boolean hasConfirmationMethod = false;
 184                         while (iterator.hasNext()) {
 185                                 log.info("Request contains SAML Subject Confirmation method: (" + (String) iterator.next() + ").");
 186                         }
 187                         if (hasConfirmationMethod) { throw new SAMLException(SAMLException.REQUESTER,
 188                                         "This SAML authority cannot honor requests containing the supplied SAML Subject Confirmation Method."); }
 189                 }
 190
 191                 // Map Subject to local principal
 192                 Principal principal;
 193                 try {
 194                         principal = support.getNameMapper().getPrincipal(attributeQuery.getSubject().getName(), relyingParty,
 195                                         relyingParty.getIdentityProvider());
 196
 197                         log.info("Request is for principal (" + principal.getName() + ").");
 198
 199                         SAMLAttribute[] attrs;
 200                         Iterator requestedAttrsIterator = attributeQuery.getDesignators();
 201                         if (requestedAttrsIterator.hasNext()) {
 202                                 log.info("Request designates specific attributes, resolving this set.");
 203                                 ArrayList requestedAttrs = new ArrayList();
 204                                 while (requestedAttrsIterator.hasNext()) {
 205                                         SAMLAttributeDesignator attribute = (SAMLAttributeDesignator) requestedAttrsIterator.next();
 206                                         try {
 207                                                 log.debug("Designated attribute: (" + attribute.getName() + ")");
 208                                                 requestedAttrs.add(new URI(attribute.getName()));
 209                                         } catch (URISyntaxException use) {
 210                                                 log
 211                                                                 .error("Request designated an attribute name that does not conform to the required URI syntax ("
 212                                                                                 + attribute.getName() + ").  Ignoring this attribute");
 213                                         }
 214                                 }
 215
 216                                 attrs = support.getReleaseAttributes(principal, effectiveName, null, (URI[]) requestedAttrs
 217                                                 .toArray(new URI[0]));
 218                         } else {
 219                                 log.info("Request does not designate specific attributes, resolving all available.");
 220                                 attrs = support.getReleaseAttributes(principal, effectiveName, null);
 221                         }
 222
 223                         log.info("Found " + attrs.length + " attribute(s) for " + principal.getName());
 224
 225                         SAMLResponse samlResponse = null;
 226
 227                         if (attrs == null || attrs.length == 0) {
 228                                 // No attribute found
 229                                 samlResponse = new SAMLResponse(samlRequest.getId(), null, null, null);
 230                         } else {
 231
 232                                 //      SAMLAttributeQuery attributeQuery = (SAMLAttributeQuery) samlRequest.getQuery();
 233
 234                                 //TODO catch clonenotsupportedexception
 235                                 //TODO no, put the use inside this blcok so we don't have to init
 236                                 // Reference requested subject
 237                                 SAMLSubject rSubject = null;
 238                                 try {
 239                                         rSubject = (SAMLSubject) attributeQuery.getSubject().clone();
 240                                 } catch (CloneNotSupportedException e1) {
 241                                         // TODO Auto-generated catch block
 242                                         e1.printStackTrace();
 243                                 }
 244                                 ArrayList audiences = new ArrayList();
 245                                 if (relyingParty.getProviderId() != null) {
 246                                         audiences.add(relyingParty.getProviderId());
 247                                 }
 248                                 if (relyingParty.getName() != null && !relyingParty.getName().equals(relyingParty.getProviderId())) {
 249                                         audiences.add(relyingParty.getName());
 250                                 }
 251                                 SAMLCondition condition = new SAMLAudienceRestrictionCondition(audiences);
 252
 253                                 // Put all attributes into an assertion
 254                                 SAMLStatement statement = new SAMLAttributeStatement(rSubject, Arrays.asList(attrs));
 255
 256                                 // Set assertion expiration to longest attribute expiration
 257                                 long max = 0;
 258                                 for (int i = 0; i < attrs.length; i++) {
 259                                         if (max < attrs[i].getLifetime()) {
 260                                                 max = attrs[i].getLifetime();
 261                                         }
 262                                 }
 263                                 Date now = new Date();
 264                                 Date then = new Date(now.getTime() + (max * 1000)); // max is in
 265                                 // seconds
 266
 267                                 SAMLAssertion sAssertion = new SAMLAssertion(relyingParty.getIdentityProvider().getProviderId(), now,
 268                                                 then, Collections.singleton(condition), null, Collections.singleton(statement));
 269
 270                                 samlResponse = new SAMLResponse(samlRequest.getId(), null, Collections.singleton(sAssertion), null);
 271                                 IdPProtocolSupport.addSignatures(samlResponse, relyingParty, support.lookup(relyingParty
 272                                                 .getProviderId()), false);
 273                         }
 274
 275                         if (log.isDebugEnabled()) { // This takes some processing, so only do it if we need to
 276                                 try {
 277                                         log.debug("Dumping generated SAML Response:"
 278                                                         + System.getProperty("line.separator")
 279                                                         + new String(
 280                                                                         new BASE64Decoder().decodeBuffer(new String(samlResponse.toBase64(), "ASCII")),
 281                                                                         "UTF8"));
 282                                 } catch (SAMLException e) {
 283                                         log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 284                                 } catch (IOException e) {
 285                                         log.error("Encountered an error while decoding SAMLReponse for logging purposes.");
 286                                 }
 287                         }
 288
 289                         log.info("Successfully responded about " + principal.getName());
 290
 291                         if (effectiveName == null) {
 292                                 if (fromLegacyProvider(request)) {
 293                                         support.getTransactionLog().info(
 294                                                         "Attribute assertion issued to anonymous legacy provider at (" + request.getRemoteAddr()
 295                                                                         + ") on behalf of principal (" + principal.getName() + ").");
 296                                 } else {
 297                                         support.getTransactionLog().info(
 298                                                         "Attribute assertion issued to anonymous provider at (" + request.getRemoteAddr()
 299                                                                         + ") on behalf of principal (" + principal.getName() + ").");
 300                                 }
 301                         } else {
 302                                 if (fromLegacyProvider(request)) {
 303                                         support.getTransactionLog().info(
 304                                                         "Attribute assertion issued to legacy provider (" + effectiveName
 305                                                                         + ") on behalf of principal (" + principal.getName() + ").");
 306                                 } else {
 307                                         support.getTransactionLog().info(
 308                                                         "Attribute assertion issued to provider (" + effectiveName + ") on behalf of principal ("
 309                                                                         + principal.getName() + ").");
 310                                 }
 311                         }
 312                 } catch (InvalidNameIdentifierException e) {
 313                         // TODO Auto-generated catch block
 314                         e.printStackTrace();
 315                 } catch (NameIdentifierMappingException e) {
 316                         // TODO Auto-generated catch block
 317                         e.printStackTrace();
 318                 } catch (AAException e) {
 319                         //TODO get rid of AAException, I think
 320                         // TODO Auto-generated catch block
 321                         e.printStackTrace();
 322                 }
 323
 324                 /*
 325                  * this needs to go in here for no passthru sendSAMLFailureResponse(response, samlRequest, new
 326                  * SAMLException(SAMLException.RESPONDER, "General error processing request."));
 327                  */
 328
 329                 // TODO not NULL!!!
 330                 return null;
 331
 332                 /*
 333                  * throw new SAMLException(SAMLException.REQUESTER, "Identity Provider unable to respond to this SAML Request
 334                  * type."); } catch (InvalidNameIdentifierException invalidNameE) { log.info("Could not associate the request
 335                  * subject with a principal: " + invalidNameE); try { // TODO once again, ifgure out passThruErrors if (false) { //
 336                  * if (relyingParty.passThruErrors()) { sendSAMLFailureResponse(response, samlRequest, new
 337                  * SAMLException(Arrays.asList(invalidNameE .getSAMLErrorCodes()), "The supplied Subject was unrecognized.",
 338                  * invalidNameE)); } else { sendSAMLFailureResponse(response, samlRequest, new
 339                  * SAMLException(Arrays.asList(invalidNameE .getSAMLErrorCodes()), "The supplied Subject was unrecognized.")); }
 340                  * return; } catch (Exception ee) { log.fatal("Could not construct a SAML error response: " + ee); throw new
 341                  * ServletException("Identity Provider response failure."); }
 342                  */
 343
 344         }
 345
 346         private static boolean fromLegacyProvider(HttpServletRequest request) {
 347
 348                 String version = request.getHeader("Shibboleth");
 349                 if (version != null) {
 350                         log.debug("Request from Shibboleth version: " + version);
 351                         return false;
 352                 }
 353                 log.debug("No version header found.");
 354                 return true;
 355         }
 356
 357 }