2 * The Shibboleth License, Version 1. Copyright (c) 2002 University Corporation for Advanced Internet Development, Inc.
3 * All rights reserved Redistribution and use in source and binary forms, with or without modification, are permitted
4 * provided that the following conditions are met: Redistributions of source code must retain the above copyright
5 * notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the
6 * above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other
7 * materials provided with the distribution, if any, must include the following acknowledgment: "This product includes
8 * software developed by the University Corporation for Advanced Internet Development <http://www.ucaid.edu>Internet2
9 * Project. Alternately, this acknowledegement may appear in the software itself, if and wherever such third-party
10 * acknowledgments normally appear. Neither the name of Shibboleth nor the names of its contributors, nor Internet2,
11 * nor the University Corporation for Advanced Internet Development, Inc., nor UCAID may be used to endorse or promote
12 * products derived from this software without specific prior written permission. For written permission, please
13 * contact shibboleth@shibboleth.org Products derived from this software may not be called Shibboleth, Internet2,
14 * UCAID, or the University Corporation for Advanced Internet Development, nor may Shibboleth appear in their name,
15 * without prior written permission of the University Corporation for Advanced Internet Development. THIS SOFTWARE IS
16 * PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND WITH ALL FAULTS. ANY EXPRESS OR IMPLIED WARRANTIES,
17 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
18 * NON-INFRINGEMENT ARE DISCLAIMED AND THE ENTIRE RISK OF SATISFACTORY QUALITY, PERFORMANCE, ACCURACY, AND EFFORT IS
19 * WITH LICENSEE. IN NO EVENT SHALL THE COPYRIGHT OWNER, CONTRIBUTORS OR THE UNIVERSITY CORPORATION FOR ADVANCED
20 * INTERNET DEVELOPMENT, INC. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
22 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
23 * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24 * POSSIBILITY OF SUCH DAMAGE.
27 package edu.internet2.middleware.shibboleth.metadata.provider;
29 import java.net.MalformedURLException;
31 import java.security.NoSuchAlgorithmException;
32 import java.text.ParseException;
33 import java.text.SimpleDateFormat;
34 import java.util.ArrayList;
35 import java.util.Arrays;
36 import java.util.Collections;
37 import java.util.HashMap;
38 import java.util.Iterator;
40 import java.util.TimeZone;
42 import org.apache.commons.codec.binary.Hex;
43 import org.apache.log4j.Logger;
44 import org.apache.xml.security.encryption.EncryptionMethod;
45 import org.apache.xml.security.exceptions.XMLSecurityException;
46 import org.apache.xml.security.keys.KeyInfo;
47 import org.opensaml.SAMLAttribute;
48 import org.opensaml.SAMLBinding;
49 import org.opensaml.SAMLBrowserProfile;
50 import org.opensaml.SAMLException;
51 import org.opensaml.XML;
52 import org.opensaml.artifact.Artifact;
53 import org.opensaml.artifact.SAMLArtifactType0001;
54 import org.opensaml.artifact.SAMLArtifactType0002;
55 import org.opensaml.artifact.Util;
56 import org.w3c.dom.Attr;
57 import org.w3c.dom.Element;
58 import org.w3c.dom.NamedNodeMap;
59 import org.w3c.dom.Node;
60 import org.w3c.dom.NodeList;
62 import edu.internet2.middleware.shibboleth.common.Constants;
63 import edu.internet2.middleware.shibboleth.metadata.*;
66 * @author Scott Cantor
68 public class XMLMetadataProvider implements Metadata {
70 private static Logger log = Logger.getLogger(XMLMetadataProvider.class.getName());
71 private Map /* <String,ArrayList<EntityDescriptor> > */ sites = new HashMap();
72 private Map /* <String,ArrayList<EntityDescriptor> > */ sources = new HashMap();
73 private XMLEntityDescriptor rootProvider = null;
74 private XMLEntitiesDescriptor rootGroup = null;
76 public XMLMetadataProvider(Element e) throws SAMLException {
77 if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"EntitiesDescriptor"))
78 rootGroup=new XMLEntitiesDescriptor(e,this, Long.MAX_VALUE, null);
79 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"EntityDescriptor"))
80 rootProvider=new XMLEntityDescriptor(e,this, Long.MAX_VALUE, null);
81 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"SiteGroup"))
82 rootGroup=new XMLEntitiesDescriptor(e,this, Long.MAX_VALUE, null);
83 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"OriginSite"))
84 rootProvider=new XMLEntityDescriptor(e,this, Long.MAX_VALUE, null);
85 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"DestinationSite"))
86 rootProvider=new XMLEntityDescriptor(e,this, Long.MAX_VALUE, null);
88 log.error("Construction requires a valid SAML metadata file");
89 throw new MetadataException("Construction requires a valid SAML metadata file");
93 public EntityDescriptor lookup(String id) {
94 ArrayList list = (ArrayList)sites.get(id);
96 long now = System.currentTimeMillis();
97 for (int i=0; i<list.size(); i++) {
98 if (now < ((XMLEntityDescriptor)list.get(i)).getValidUntil())
99 return (EntityDescriptor)list.get(i);
105 public EntityDescriptor lookup(Artifact artifact) {
106 ArrayList list = null;
108 if (artifact instanceof SAMLArtifactType0001) {
109 list = (ArrayList)sources.get(((SAMLArtifactType0001)artifact).getSourceId());
111 else if (artifact instanceof SAMLArtifactType0002) {
112 list = (ArrayList)sources.get(((SAMLArtifactType0002)artifact).getSourceLocation().toString());
115 log.error("unsupported artifact type (" + artifact.getTypeCode().toString() + ")");
119 long now = System.currentTimeMillis();
120 for (int i=0; i<list.size(); i++) {
121 if (now < ((XMLEntityDescriptor)list.get(i)).getValidUntil())
122 return (EntityDescriptor)list.get(i);
128 class XMLEndpoint implements Endpoint {
129 private Element root = null;
130 private String binding = null;
131 private String location = null;
132 private String resploc = null;
134 XMLEndpoint(Element e) {
136 binding = XML.assign(e.getAttributeNS(null,"Binding"));
137 location = XML.assign(e.getAttributeNS(null,"Location"));
138 resploc = XML.assign(e.getAttributeNS(null,"ResponseLocation"));
141 XMLEndpoint(String binding, String location) {
142 this.binding = binding;
143 this.location = location;
146 public String getBinding() {
150 public String getLocation() {
154 public String getResponseLocation() {
158 public Element getElement() {
163 class XMLIndexedEndpoint extends XMLEndpoint implements IndexedEndpoint {
164 private int index = 0;
166 XMLIndexedEndpoint(Element e) {
168 index = Integer.parseInt(e.getAttributeNS(null,"index"));
171 public int getIndex() {
176 class XMLEndpointManager implements EndpointManager {
177 private ArrayList endpoints = new ArrayList();
178 Endpoint soft = null; // Soft default (not explicit)
179 Endpoint hard = null; // Hard default (explicit)
181 public Iterator getEndpoints() {
182 return endpoints.iterator();
185 public Endpoint getDefaultEndpoint() {
186 if (hard != null) return hard;
187 if (soft != null) return soft;
188 if (!endpoints.isEmpty()) return (Endpoint)endpoints.get(0);
192 public Endpoint getEndpointByIndex(int index) {
193 for (int i=0; i < endpoints.size(); i++) {
194 if (endpoints.get(i) instanceof IndexedEndpoint && index==((IndexedEndpoint)endpoints.get(i)).getIndex())
195 return (Endpoint)endpoints.get(i);
200 public Endpoint getEndpointByBinding(String binding) {
201 for (int i=0; i < endpoints.size(); i++) {
202 if (binding.equals(((Endpoint)endpoints.get(i)).getBinding()))
203 return (Endpoint)endpoints.get(i);
208 protected void add(Endpoint e) {
210 if (hard == null && e.getElement() != null) {
211 String v=XML.assign(e.getElement().getAttributeNS(null,"isDefault"));
212 if (v != null && (v.equals("1") || v.equals("true"))) // explicit default
214 else if (v == null && soft == null) // implicit default
217 else if (hard == null && soft == null) {
218 // No default yet, so this one qualifies as an implicit.
224 class XMLKeyDescriptor implements KeyDescriptor {
226 private int use = KeyDescriptor.UNSPECIFIED;
227 private KeyInfo keyInfo = null;
228 private ArrayList /* <XMLEncryptionMethod> */ methods = new ArrayList();
230 XMLKeyDescriptor(Element e) {
231 if (XML.safeCompare(e.getAttributeNS(null,"use"),"encryption"))
232 use = KeyDescriptor.ENCRYPTION;
233 else if (XML.safeCompare(e.getAttributeNS(null,"use"),"signing"))
234 use = KeyDescriptor.SIGNING;
236 e = XML.getFirstChildElement(e);
238 keyInfo = new KeyInfo(e, null);
240 catch (XMLSecurityException e1) {
241 log.error("unable to process ds:KeyInfo element: " + e1.getMessage());
244 e = XML.getNextSiblingElement(e);
245 while (e != null && XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"EncryptionMethod")) {
246 methods.add(new XMLEncryptionMethod(e));
250 public int getUse() {
254 public Iterator getEncryptionMethods() {
255 return methods.iterator();
258 public KeyInfo getKeyInfo() {
263 class XMLEncryptionMethod implements EncryptionMethod {
266 String params = null;
269 public XMLEncryptionMethod(Element e) {
270 alg = XML.assign(e.getAttributeNS(null, "Algorithm"));
271 e = XML.getFirstChildElement(e);
273 if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.XMLENC_NS,"KeySize")) {
274 if (e.hasChildNodes())
275 size = Integer.parseInt(e.getFirstChild().getNodeValue());
277 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.XMLENC_NS,"OAEParams")) {
278 if (e.hasChildNodes())
279 params = XML.assign(e.getFirstChild().getNodeValue());
281 e = XML.getNextSiblingElement(e);
285 public String getAlgorithm() {
289 public int getKeySize() {
293 public byte[] getOAEPparams() {
294 return params.getBytes();
297 public Iterator getEncryptionMethodInformation() {
301 public void setKeySize(int arg0) {
302 throw new UnsupportedOperationException("EncryptionMethod implementation is read-only.");
305 public void setOAEPparams(byte[] arg0) {
306 throw new UnsupportedOperationException("EncryptionMethod implementation is read-only.");
309 public void addEncryptionMethodInformation(Element arg0) {
310 throw new UnsupportedOperationException("EncryptionMethod implementation is read-only.");
313 public void removeEncryptionMethodInformation(Element arg0) {
314 throw new UnsupportedOperationException("EncryptionMethod implementation is read-only.");
318 class XMLOrganization implements Organization {
319 private Element root = null;
320 private HashMap /* <String,String> */ names = new HashMap();
321 private HashMap /* <String,String> */ displays = new HashMap();
322 private HashMap /* <String,URL> */ urls = new HashMap();
324 public XMLOrganization(Element e) throws MetadataException {
326 e=XML.getFirstChildElement(e);
328 if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"OrganizationName")) {
329 if (e.hasChildNodes()) {
330 names.put(e.getAttributeNS(XML.XML_NS,"lang"),XML.assign(e.getFirstChild().getNodeValue()));
333 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"OrganizationDisplayName")) {
334 if (e.hasChildNodes()) {
335 displays.put(e.getAttributeNS(XML.XML_NS,"lang"),XML.assign(e.getFirstChild().getNodeValue()));
338 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"OrganizationURL")) {
339 if (e.hasChildNodes()) {
342 u = new URL(e.getFirstChild().getNodeValue());
344 catch (MalformedURLException e1) {
345 throw new MetadataException("OrganizationURL was invalid: " + e1);
347 urls.put(e.getAttributeNS(XML.XML_NS,"lang"),u);
350 e=XML.getNextSiblingElement(e);
354 public String getName() {
355 return getName("en");
358 public String getName(String lang) {
359 return (String)names.get(lang);
362 public String getDisplayName() {
363 return getDisplayName("en");
366 public String getDisplayName(String lang) {
367 return (String)displays.get(lang);
370 public URL getURL() {
374 public URL getURL(String lang) {
375 return (URL)urls.get(lang);
380 class XMLContactPerson implements ContactPerson {
381 private Element root = null;
383 private String company = null;
384 private String givenName = null;
385 private String surName = null;
386 private ArrayList /* <String> */ emails = new ArrayList();
387 private ArrayList /* <String> */ telephones = new ArrayList();
389 public XMLContactPerson(Element e) throws MetadataException {
391 String rawType = null;
393 // Old metadata or new?
394 if (XML.isElementNamed(root, edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"Contact")) {
395 rawType = root.getAttributeNS(null,"Type");
396 surName = XML.assign(root.getAttributeNS(null,"Name"));
397 if (XML.isEmpty(surName)) {
398 throw new MetadataException("Contact is missing Name attribute.");
400 if (root.hasAttributeNS(null,"Email"))
401 emails.add(e.getAttributeNS(null,"Email"));
404 rawType = root.getAttributeNS(null,"contactType");
406 e=XML.getFirstChildElement(root);
408 if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"Company")) {
409 if (e.hasChildNodes())
410 company=XML.assign(e.getFirstChild().getNodeValue());
412 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"GivenName")) {
413 if (e.hasChildNodes())
414 givenName=XML.assign(e.getFirstChild().getNodeValue());
416 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"SurName")) {
417 if (e.hasChildNodes())
418 surName=XML.assign(e.getFirstChild().getNodeValue());
420 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"EmailAddress")) {
421 if (e.hasChildNodes())
422 emails.add(XML.assign(e.getFirstChild().getNodeValue()));
424 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"TelephoneNumber")) {
425 if (e.hasChildNodes())
426 telephones.add(XML.assign(e.getFirstChild().getNodeValue()));
428 e=XML.getNextSiblingElement(e);
432 if (rawType.equalsIgnoreCase("TECHNICAL")) {
433 type = ContactPerson.TECHNICAL;
434 } else if (rawType.equalsIgnoreCase("SUPPORT")) {
435 type = ContactPerson.SUPPORT;
436 } else if (rawType.equalsIgnoreCase("ADMINISTRATIVE")) {
437 type = ContactPerson.ADMINISTRATIVE;
438 } else if (rawType.equalsIgnoreCase("BILLING")) {
439 type = ContactPerson.BILLING;
440 } else if (rawType.equalsIgnoreCase("OTHER")) {
441 type = ContactPerson.OTHER;
443 throw new MetadataException("Contact has unknown contact type.");
447 public int getType() {
451 public String getGivenName() {
455 public String getSurName() {
459 public String getCompany() {
463 public Iterator getEmailAddresses() {
464 return emails.iterator();
467 public Iterator getTelephoneNumbers() {
468 return telephones.iterator();
471 public Element getElement() {
476 class Role implements RoleDescriptor {
477 private Element root = null;
478 private XMLEntityDescriptor provider = null;
479 private URL errorURL = null;
480 private Organization org = null;
481 private ArrayList /* <ContactPerson> */ contacts = new ArrayList();
482 private long validUntil = Long.MAX_VALUE;
483 protected ArrayList /* <String> */ protocolEnum = new ArrayList();
484 protected ArrayList /* <KeyDescriptor> */ keys = new ArrayList();
486 public Role(XMLEntityDescriptor provider, long validUntil, Element e) throws MetadataException {
488 this.validUntil = validUntil;
489 this.provider = provider;
491 // Check the root element namespace. If SAML2, assume it's the std schema.
492 if (e != null && edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
494 if (e.hasAttributeNS(null,"validUntil")) {
495 SimpleDateFormat formatter = null;
496 String dateTime = XML.assign(e.getAttributeNS(null,"validUntil"));
497 int dot = dateTime.indexOf('.');
499 formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
501 formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
502 formatter.setTimeZone(TimeZone.getTimeZone("UTC"));
504 validUntil=Math.min(validUntil,formatter.parse(dateTime).getTime());
506 catch (ParseException e1) {
507 log.warn("Role descriptor contains invalid expiration time");
511 if (e.hasAttributeNS(null,"errorURL")) {
513 errorURL=new URL(e.getAttributeNS(null,"errorURL"));
515 catch (MalformedURLException e1) {
516 log.error("Role descriptor contains malformed errorURL");
520 // Chop the protocol list into pieces...assume any whitespace can appear in between.
521 protocolEnum.addAll(Arrays.asList(e.getAttributeNS(null,"protocolSupportEnumeration").split("\\s")));
523 e = XML.getFirstChildElement(root,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"KeyDescriptor");
525 keys.add(new XMLKeyDescriptor(e));
526 e = XML.getNextSiblingElement(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"KeyDescriptor");
529 e = XML.getFirstChildElement(root,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"Organization");
531 org=new XMLOrganization(e);
533 e = XML.getFirstChildElement(root,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"ContactPerson");
535 contacts.add(new XMLContactPerson(e));
536 e = XML.getNextSiblingElement(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"ContactPerson");
541 public EntityDescriptor getEntityDescriptor() {
545 public Iterator getProtocolSupportEnumeration() {
546 return protocolEnum.iterator();
549 public boolean hasSupport(String version) {
550 return protocolEnum.contains(version);
553 public boolean isValid() {
554 return System.currentTimeMillis() < validUntil;
557 public URL getErrorURL() {
558 return (errorURL != null) ? errorURL : provider.getErrorURL();
561 public Iterator getKeyDescriptors() {
562 return keys.iterator();
565 public Organization getOrganization() {
566 return (org != null) ? org : provider.getOrganization();
569 public Iterator getContactPersons() {
570 return (contacts.isEmpty()) ? provider.getContactPersons() : contacts.iterator();
573 public Element getElement() {
578 class SSORole extends Role implements SSODescriptor {
579 private XMLEndpointManager artifact = new XMLEndpointManager();
580 private XMLEndpointManager logout = new XMLEndpointManager();
581 private XMLEndpointManager nameid = new XMLEndpointManager();
582 private ArrayList /* <String> */ formats = new ArrayList();
584 public SSORole(XMLEntityDescriptor provider, long validUntil, Element e) throws MetadataException {
585 super(provider, validUntil, e);
587 // Check the root element namespace. If SAML2, assume it's the std schema.
588 if (edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
590 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"ArtifactResolutionService");
591 for (i=0; i<nlist.getLength(); i++)
592 artifact.add(new XMLIndexedEndpoint((Element)nlist.item(i)));
594 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"SingleLogoutService");
595 for (i=0; i<nlist.getLength(); i++)
596 logout.add(new XMLEndpoint((Element)nlist.item(i)));
598 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"ManageNameIDService");
599 for (i=0; i<nlist.getLength(); i++)
600 nameid.add(new XMLEndpoint((Element)nlist.item(i)));
602 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"NameIDFormat");
603 for (i=0; i<nlist.getLength(); i++) {
604 if (nlist.item(i).hasChildNodes())
605 formats.add(nlist.item(i).getNodeValue());
609 // For old style, we just do SAML 1.1 compatibility with Shib handles.
610 protocolEnum.add(XML.SAML11_PROTOCOL_ENUM);
611 formats.add(Constants.SHIB_NAMEID_FORMAT_URI);
615 public EndpointManager getArtifactResolutionServiceManager() {
619 public EndpointManager getSingleLogoutServiceManager() {
623 public EndpointManager getManageNameIDServiceManager() {
627 public Iterator getNameIDFormats() {
628 return formats.iterator();
632 class IDPRole extends SSORole implements IDPSSODescriptor, ScopedRoleDescriptor {
633 private ArrayList /* <Scope> */ scopes = new ArrayList();
634 private XMLEndpointManager sso = new XMLEndpointManager();
635 private XMLEndpointManager mapping = new XMLEndpointManager();
636 private XMLEndpointManager idreq = new XMLEndpointManager();
637 private ArrayList /* <String> */ attrprofs = new ArrayList();
638 private ArrayList /* <SAMLAttribute> */ attrs = new ArrayList();
639 private boolean wantAuthnRequestsSigned = false;
640 private String sourceId = null;
642 public IDPRole(XMLEntityDescriptor provider, long validUntil, Element e) throws SAMLException {
643 super(provider, validUntil, e);
644 NodeList domains=null;
646 // Check the root element namespace. If SAML2, assume it's the std schema.
647 if (edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
648 String flag=XML.assign(e.getAttributeNS(null,"WantAuthnRequestsSigned"));
649 wantAuthnRequestsSigned=(XML.safeCompare(flag,"1") || XML.safeCompare(flag,"true"));
651 // Check for extensions.
652 Element ext=XML.getFirstChildElement(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"Extensions");
654 Element ext1=XML.getFirstChildElement(ext,XML.SAML_ARTIFACT_SOURCEID,"SourceID");
655 if (ext1 != null && ext1.hasChildNodes())
656 sourceId=ext1.getFirstChild().getNodeValue();
657 // Save off any domain elements for later.
658 domains = ext.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIBMETA_NS,"Domain");
662 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"SingleSignOnService");
663 for (i=0; i<nlist.getLength(); i++)
664 sso.add(new XMLEndpoint((Element)(nlist.item(i))));
666 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"NameIDMappingService");
667 for (i=0; i<nlist.getLength(); i++)
668 mapping.add(new XMLEndpoint((Element)(nlist.item(i))));
670 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AssertionIDRequestService");
671 for (i=0; i<nlist.getLength(); i++)
672 idreq.add(new XMLEndpoint((Element)(nlist.item(i))));
674 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AttributeProfile");
675 for (i=0; i<nlist.getLength(); i++) {
676 if (nlist.item(i).hasChildNodes())
677 attrprofs.add(nlist.item(i).getFirstChild().getNodeValue());
680 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"Attribute");
681 for (i=0; i<nlist.getLength(); i++) {
682 // For now, we need to convert these to plain SAML 1.1 attributes.
683 Element src=(Element)(nlist.item(i));
684 Element copy=e.getOwnerDocument().createElementNS(XML.SAML_NS,"Attribute");
685 copy.setAttributeNS(null,"AttributeName",src.getAttributeNS(null,"Name"));
686 copy.setAttributeNS(null,"AttributeNamespace",src.getAttributeNS(null,"NameFormat"));
687 src=XML.getFirstChildElement(src,edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"AttributeValue");
688 while (src != null) {
689 src=XML.getNextSiblingElement(src,edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"AttributeValue");
690 Element val=e.getOwnerDocument().createElementNS(XML.SAML_NS,"AttributeValue");
691 NamedNodeMap attrs = src.getAttributes();
692 for (int j=0; j<attrs.getLength(); j++)
693 val.setAttributeNodeNS((Attr)(e.getOwnerDocument().importNode(attrs.item(j),true)));
694 while (src.hasChildNodes())
695 val.appendChild(src.getFirstChild());
696 copy.appendChild(val);
698 attrs.add(SAMLAttribute.getInstance(copy));
702 attrprofs.add(Constants.SHIB_ATTRIBUTE_NAMESPACE_URI);
704 domains = e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"Domain");
705 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"HandleService");
706 for (i=0; i<nlist.getLength(); i++) {
707 // Manufacture an endpoint for the "Shib" binding.
709 new XMLEndpoint(Constants.SHIB_AUTHNREQUEST_PROFILE_URI,((Element)nlist.item(i)).getAttributeNS(null,"Location"))
712 // We're going to "mock up" a KeyDescriptor that contains the specified Name as a ds:KeyName.
713 Element kd=e.getOwnerDocument().createElementNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"KeyDescriptor");
714 Element ki=e.getOwnerDocument().createElementNS(XML.XMLSIG_NS,"KeyInfo");
715 Element kn=e.getOwnerDocument().createElementNS(XML.XMLSIG_NS,"KeyName");
717 e.getOwnerDocument().createTextNode(((Element)nlist.item(i)).getAttributeNS(null,"Name"))
721 kd.setAttributeNS(null,"use","signing");
722 keys.add(new XMLKeyDescriptor(kd));
726 if (domains != null) {
727 for (int i=0; i < domains.getLength(); i++) {
728 String dom=(domains.item(i).hasChildNodes()) ? domains.item(i).getFirstChild().getNodeValue() : null;
730 String regexp=XML.assign(((Element)domains.item(i)).getAttributeNS(null,"regexp"));
732 new Scope(dom,(XML.safeCompare(regexp,"true") || XML.safeCompare(regexp,"1")))
739 public Iterator getScopes() {
740 return scopes.iterator();
743 public boolean getWantAuthnRequestsSigned() {
744 return wantAuthnRequestsSigned;
747 public EndpointManager getSingleSignOnServiceManager() {
751 public EndpointManager getNameIDMappingServiceManager() {
755 public EndpointManager getAssertionIDRequestServiceManager() {
759 public Iterator getAttributeProfiles() {
760 return attrprofs.iterator();
763 public Iterator getAttributes() {
764 return attrs.iterator();
768 class AARole extends SSORole implements AttributeAuthorityDescriptor, ScopedRoleDescriptor {
769 private ArrayList /* <Scope> */ scopes = new ArrayList();
770 private XMLEndpointManager query = new XMLEndpointManager();
771 private XMLEndpointManager idreq = new XMLEndpointManager();
772 private ArrayList /* <String> */ attrprofs = new ArrayList();
773 private ArrayList /* <String> */ formats = new ArrayList();
774 private ArrayList /* <SAMLAttribute> */ attrs = new ArrayList();
776 public AARole(XMLEntityDescriptor provider, long validUntil, Element e) throws SAMLException {
777 super(provider, validUntil, e);
778 NodeList domains=null;
780 // Check the root element namespace. If SAML2, assume it's the std schema.
781 if (edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
783 // Check for extensions.
784 Element ext=XML.getFirstChildElement(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"Extensions");
786 // Save off any domain elements for later.
787 domains = ext.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIBMETA_NS,"Domain");
791 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AttributeService");
792 for (i=0; i<nlist.getLength(); i++)
793 query.add(new XMLEndpoint((Element)(nlist.item(i))));
795 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AssertionIDRequestService");
796 for (i=0; i<nlist.getLength(); i++)
797 idreq.add(new XMLEndpoint((Element)(nlist.item(i))));
799 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AttributeProfile");
800 for (i=0; i<nlist.getLength(); i++) {
801 if (nlist.item(i).hasChildNodes())
802 attrprofs.add(nlist.item(i).getFirstChild().getNodeValue());
805 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"Attribute");
806 for (i=0; i<nlist.getLength(); i++) {
807 // For now, we need to convert these to plain SAML 1.1 attributes.
808 Element src=(Element)(nlist.item(i));
809 Element copy=e.getOwnerDocument().createElementNS(XML.SAML_NS,"Attribute");
810 copy.setAttributeNS(null,"AttributeName",src.getAttributeNS(null,"Name"));
811 copy.setAttributeNS(null,"AttributeNamespace",src.getAttributeNS(null,"NameFormat"));
812 src=XML.getFirstChildElement(src,edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"AttributeValue");
813 while (src != null) {
814 src=XML.getNextSiblingElement(src,edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"AttributeValue");
815 Element val=e.getOwnerDocument().createElementNS(XML.SAML_NS,"AttributeValue");
816 NamedNodeMap attrs = src.getAttributes();
817 for (int j=0; j<attrs.getLength(); j++)
818 val.setAttributeNodeNS((Attr)(e.getOwnerDocument().importNode(attrs.item(j),true)));
819 while (src.hasChildNodes())
820 val.appendChild(src.getFirstChild());
821 copy.appendChild(val);
823 attrs.add(SAMLAttribute.getInstance(copy));
827 // For old style, we just do SAML 1.1 compatibility with Shib handles.
828 protocolEnum.add(XML.SAML11_PROTOCOL_ENUM);
829 formats.add(Constants.SHIB_NAMEID_FORMAT_URI);
830 attrprofs.add(Constants.SHIB_ATTRIBUTE_NAMESPACE_URI);
832 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"AttributeAuthority");
833 for (i=0; i<nlist.getLength(); i++) {
834 // Manufacture an endpoint for the SOAP binding.
838 ((Element)nlist.item(i)).getAttributeNS(null,"Location")
842 // We're going to "mock up" a KeyDescriptor that contains the specified Name as a ds:KeyName.
843 Element kd=e.getOwnerDocument().createElementNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"KeyDescriptor");
844 Element ki=e.getOwnerDocument().createElementNS(XML.XMLSIG_NS,"KeyInfo");
845 Element kn=e.getOwnerDocument().createElementNS(XML.XMLSIG_NS,"KeyName");
847 e.getOwnerDocument().createTextNode(((Element)nlist.item(i)).getAttributeNS(null,"Name"))
851 kd.setAttributeNS(null,"use","signing");
852 keys.add(new XMLKeyDescriptor(kd));
856 if (domains != null) {
857 for (int i=0; i < domains.getLength(); i++) {
858 String dom=(domains.item(i).hasChildNodes()) ? domains.item(i).getFirstChild().getNodeValue() : null;
860 String regexp=XML.assign(((Element)domains.item(i)).getAttributeNS(null,"regexp"));
862 new Scope(dom,(XML.safeCompare(regexp,"true") || XML.safeCompare(regexp,"1")))
869 public Iterator getScopes() {
870 return scopes.iterator();
873 public EndpointManager getAttributeServiceManager() {
877 public EndpointManager getAssertionIDRequestServiceManager() {
881 public Iterator getAttributeProfiles() {
882 return attrprofs.iterator();
885 public Iterator getAttributes() {
886 return attrs.iterator();
890 class SPRole extends SSORole implements SPSSODescriptor {
891 private boolean authnRequestsSigned = false;
892 private boolean wantAssertionsSigned = false;
893 private XMLEndpointManager asc = new XMLEndpointManager();
895 public SPRole(XMLEntityDescriptor provider, long validUntil, Element e) throws MetadataException {
896 super(provider, validUntil, e);
897 // TODO Auto-generated constructor stub
899 // Check the root element namespace. If SAML2, assume it's the std schema.
900 if (edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
901 String flag=XML.assign(e.getAttributeNS(null,"AuthnRequestsSigned"));
902 authnRequestsSigned=(XML.safeCompare(flag,"1") || XML.safeCompare(flag,"true"));
903 flag=XML.assign(e.getAttributeNS(null,"WantAssertionsSigned"));
904 wantAssertionsSigned=(XML.safeCompare(flag,"1") || XML.safeCompare(flag,"true"));
907 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AssertionConsumerService");
908 for (i=0; i<nlist.getLength(); i++)
909 asc.add(new XMLIndexedEndpoint((Element)(nlist.item(i))));
912 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"Attribute");
913 for (i=0; i<nlist.getLength(); i++) {
914 // For now, we need to convert these to plain SAML 1.1 attributes.
915 Element src=(Element)(nlist.item(i));
916 Element copy=e.getOwnerDocument().createElementNS(XML.SAML_NS,"Attribute");
917 copy.setAttributeNS(null,"AttributeName",src.getAttributeNS(null,"Name"));
918 copy.setAttributeNS(null,"AttributeNamespace",src.getAttributeNS(null,"NameFormat"));
919 src=XML.getFirstChildElement(src,edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"AttributeValue");
920 while (src != null) {
921 src=XML.getNextSiblingElement(src,edu.internet2.middleware.shibboleth.common.XML.SAML2ASSERT_NS,"AttributeValue");
922 Element val=e.getOwnerDocument().createElementNS(XML.SAML_NS,"AttributeValue");
923 NamedNodeMap attrs = src.getAttributes();
924 for (int j=0; j<attrs.getLength(); j++)
925 val.setAttributeNodeNS((Attr)(e.getOwnerDocument().importNode(attrs.item(j),true)));
926 while (src.hasChildNodes())
927 val.appendChild(src.getFirstChild());
928 copy.appendChild(val);
930 attrs.add(SAMLAttribute.getInstance(copy));
936 NodeList nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"AssertionConsumerServiceURL");
937 for (i=0; i<nlist.getLength(); i++) {
938 // Manufacture an endpoint for the POST profile.
940 new XMLEndpoint(SAMLBrowserProfile.PROFILE_POST_URI,((Element)nlist.item(i)).getAttributeNS(null,"Location"))
944 nlist=e.getElementsByTagNameNS(edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"AttributeRequester");
945 for (i=0; i<nlist.getLength(); i++) {
946 // We're going to "mock up" a KeyDescriptor that contains the specified Name as a ds:KeyName.
947 Element kd=e.getOwnerDocument().createElementNS(edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"KeyDescriptor");
948 Element ki=e.getOwnerDocument().createElementNS(XML.XMLSIG_NS,"KeyInfo");
949 Element kn=e.getOwnerDocument().createElementNS(XML.XMLSIG_NS,"KeyName");
951 e.getOwnerDocument().createTextNode(((Element)nlist.item(i)).getAttributeNS(null,"Name"))
955 kd.setAttributeNS(null,"use","signing");
956 keys.add(new XMLKeyDescriptor(kd));
961 public boolean getAuthnRequestsSigned() {
962 return authnRequestsSigned;
965 public boolean getWantAssertionsSigned() {
966 return wantAssertionsSigned;
969 public EndpointManager getAssertionConsumerServiceManager() {
973 public Iterator getAttributeConsumingServices() {
974 // TODO Auto-generated method stub
978 public AttributeConsumingService getDefaultAttributeConsumingService() {
979 // TODO Auto-generated method stub
983 public AttributeConsumingService getAttributeConsumingServiceByID(String id) {
984 // TODO Auto-generated method stub
989 class XMLEntityDescriptor implements EntityDescriptor {
990 private Element root = null;
991 private EntitiesDescriptor parent = null;
992 private String id = null;
993 private URL errorURL = null;
994 private Organization org = null;
995 private ArrayList /* <ContactPerson> */ contacts = new ArrayList();
996 private ArrayList /* <RoleDescriptor> */ roles = new ArrayList();
997 private AffiliationDescriptor affiliation = null;
998 private HashMap /* <String,String> */ locs = new HashMap();
999 private long validUntil = 0;
1001 public XMLEntityDescriptor(Element e, XMLMetadataProvider wrapper, long validUntil, EntitiesDescriptor parent) throws SAMLException {
1003 this.parent = parent;
1004 this.validUntil = validUntil;
1006 // Check the root element namespace. If SAML2, assume it's the std schema.
1007 if (edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
1008 id=e.getAttributeNS(null,"entityID");
1010 if (e.hasAttributeNS(null,"validUntil")) {
1011 SimpleDateFormat formatter = null;
1012 String dateTime = XML.assign(e.getAttributeNS(null,"validUntil"));
1013 int dot = dateTime.indexOf('.');
1015 formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
1017 formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
1018 formatter.setTimeZone(TimeZone.getTimeZone("UTC"));
1020 validUntil=Math.min(validUntil,formatter.parse(dateTime).getTime());
1022 catch (ParseException e1) {
1023 log.warn("Entity descriptor contains invalid expiration time");
1027 Element child=XML.getFirstChildElement(e);
1028 while (child != null) {
1029 // Process the various kinds of children that we care about...
1030 if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"ContactPerson")) {
1031 contacts.add(new XMLContactPerson(child));
1033 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"Organization")) {
1034 org=new XMLOrganization(child);
1036 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AdditionalMetadataLocation")) {
1037 Node loc=child.getFirstChild();
1039 locs.put(child.getAttributeNS(null,"namespace"),loc.getNodeValue());
1041 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"IDPSSODescriptor")) {
1042 roles.add(new IDPRole(this,validUntil,child));
1044 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"AttributeAuthorityDescriptor")) {
1045 roles.add(new AARole(this,validUntil,child));
1047 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"SPSSODescriptor")) {
1048 roles.add(new SPRole(this,validUntil,child));
1050 child = XML.getNextSiblingElement(child);
1054 id=e.getAttributeNS(null,"Name");
1055 if (e.hasAttributeNS(null,"ErrorURL")) {
1057 errorURL=new URL(e.getAttributeNS(null,"ErrorURL"));
1059 catch (MalformedURLException e1) {
1060 log.error("Site descriptor contains invalid ErrorURL");
1064 boolean idp=false,aa=false,sp=false; // only want to build a role once
1065 Element child=XML.getFirstChildElement(e);
1066 while (child != null) {
1067 // Process the various kinds of OriginSite children that we care about...
1068 if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"Contact")) {
1069 contacts.add(new XMLContactPerson(child));
1071 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"HandleService") && !idp) {
1072 // Create the IDP role if needed.
1073 roles.add(new IDPRole(this, validUntil, e));
1076 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"AttributeAuthority") && !aa) {
1077 // Create the AA role if needed.
1078 roles.add(new AARole(this, validUntil, e));
1081 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"AssertionConsumerServiceURL") && !sp) {
1082 // Create the SP role if needed.
1083 roles.add(new SPRole(this, validUntil, e));
1086 else if (XML.isElementNamed(child,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"AttributeRequester") && !sp) {
1087 // Create the SP role if needed.
1088 roles.add(new SPRole(this, validUntil, e));
1091 child = XML.getNextSiblingElement(child);
1095 // Each map entry is a list of the descriptors with this ID.
1097 if (wrapper.sites.containsKey(id)) {
1098 list = (ArrayList)wrapper.sites.get(id);
1101 list = new ArrayList();
1102 wrapper.sites.put(id,list);
1106 // Look for an IdP role, and register the artifact source ID and endpoints.
1108 for (int i=0; i<roles.size(); i++) {
1109 if (roles.get(i) instanceof IDPRole) {
1110 idp = (IDPRole)roles.get(i);
1111 if (idp.sourceId != null) {
1112 if (wrapper.sources.containsKey(idp.sourceId)) {
1113 list = (ArrayList)wrapper.sources.get(idp.sourceId);
1116 list = new ArrayList();
1117 wrapper.sources.put(idp.sourceId,list);
1124 sourceId = new String(Hex.encodeHex(Util.generateSourceId(id)));
1126 catch (NoSuchAlgorithmException e1) {
1127 log.error("caught exception while encoding sourceId: " + e1.getMessage());
1130 if (wrapper.sources.containsKey(sourceId)) {
1131 list = (ArrayList)wrapper.sources.get(sourceId);
1134 list = new ArrayList();
1135 wrapper.sources.put(sourceId,list);
1139 Iterator locs=idp.getArtifactResolutionServiceManager().getEndpoints();
1140 while (locs.hasNext()) {
1141 String loc=((Endpoint)locs.next()).getLocation();
1142 if (wrapper.sources.containsKey(loc)) {
1143 list = (ArrayList)wrapper.sources.get(loc);
1146 list = new ArrayList();
1147 wrapper.sources.put(loc,list);
1155 public String getId() {
1159 public boolean isValid() {
1160 return System.currentTimeMillis() < validUntil;
1163 public Iterator getRoleDescriptors() {
1164 return roles.iterator();
1167 public RoleDescriptor getRoleByType(Class type, String protocol) {
1168 for (int i=0; i<roles.size(); i++) {
1169 RoleDescriptor role = (RoleDescriptor)roles.get(i);
1170 if (type.isInstance(role) && role.hasSupport(protocol))
1176 public IDPSSODescriptor getIDPSSODescriptor(String protocol) {
1177 return (IDPSSODescriptor)getRoleByType(IDPSSODescriptor.class, protocol);
1180 public SPSSODescriptor getSPSSODescriptor(String protocol) {
1181 return (SPSSODescriptor)getRoleByType(SPSSODescriptor.class, protocol);
1184 public AuthnAuthorityDescriptor getAuthnAuthorityDescriptor(String protocol) {
1185 return (AuthnAuthorityDescriptor)getRoleByType(AuthnAuthorityDescriptor.class, protocol);
1188 public AttributeAuthorityDescriptor getAttributeAuthorityDescriptor(String protocol) {
1189 return (AttributeAuthorityDescriptor)getRoleByType(AttributeAuthorityDescriptor.class, protocol);
1192 public PDPDescriptor getPDPDescriptor(String protocol) {
1193 return (PDPDescriptor)getRoleByType(PDPDescriptor.class, protocol);
1196 public AffiliationDescriptor getAffiliationDescriptor() {
1200 public Organization getOrganization() {
1204 public Iterator getContactPersons() {
1205 return contacts.iterator();
1208 public Map getAdditionalMetadataLocations() {
1209 return Collections.unmodifiableMap(locs);
1212 public EntitiesDescriptor getEntitiesDescriptor() {
1216 public Element getElement() {
1220 public long getValidUntil() {
1224 public URL getErrorURL() {
1229 class XMLEntitiesDescriptor implements EntitiesDescriptor {
1230 private Element root = null;
1231 private EntitiesDescriptor parent = null;
1232 private String name = null;
1233 private ArrayList /* <EntitiesDescriptor> */ groups = new ArrayList();
1234 private ArrayList /* <EntityDescriptor> */ providers = new ArrayList();
1235 private long validUntil = Long.MAX_VALUE;
1237 public XMLEntitiesDescriptor(Element e, XMLMetadataProvider wrapper, long validUntil, EntitiesDescriptor parent) throws SAMLException {
1239 this.parent = parent;
1240 this.validUntil = validUntil;
1241 name = XML.assign(e.getAttributeNS(null, "Name"));
1243 // Check the root element namespace. If SAML2, assume it's the std schema.
1244 if (edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS.equals(e.getNamespaceURI())) {
1246 if (e.hasAttributeNS(null,"validUntil")) {
1247 SimpleDateFormat formatter = null;
1248 String dateTime = XML.assign(e.getAttributeNS(null,"validUntil"));
1249 int dot = dateTime.indexOf('.');
1251 formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
1253 formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'");
1254 formatter.setTimeZone(TimeZone.getTimeZone("UTC"));
1256 validUntil=Math.min(validUntil,formatter.parse(dateTime).getTime());
1258 catch (ParseException e1) {
1259 log.warn("Entities descriptor contains invalid expiration time");
1263 e = XML.getFirstChildElement(e);
1265 if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"EntitiesDescriptor"))
1266 groups.add(new XMLEntitiesDescriptor(e, wrapper, this.validUntil, this));
1267 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SAML2META_NS,"EntityDescriptor"))
1268 providers.add(new XMLEntityDescriptor(e, wrapper, this.validUntil, this));
1269 e = XML.getNextSiblingElement(e);
1273 e = XML.getFirstChildElement(e);
1275 if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"SiteGroup"))
1276 groups.add(new XMLEntitiesDescriptor(e, wrapper, this.validUntil, this));
1277 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"OriginSite"))
1278 providers.add(new XMLEntityDescriptor(e, wrapper, this.validUntil, this));
1279 else if (XML.isElementNamed(e,edu.internet2.middleware.shibboleth.common.XML.SHIB_NS,"DestinationSite"))
1280 providers.add(new XMLEntityDescriptor(e, wrapper, this.validUntil, this));
1281 e = XML.getNextSiblingElement(e);
1286 public String getName() {
1290 public boolean isValid() {
1291 return System.currentTimeMillis() < validUntil;
1294 public EntitiesDescriptor getEntitiesDescriptor() {
1298 public Iterator getEntitiesDescriptors() {
1299 return groups.iterator();
1302 public Iterator getEntityDescriptors() {
1303 return providers.iterator();
1306 public Element getElement() {