Marshall assertions before trying to sign
[java-idp.git] / src / edu / internet2 / middleware / shibboleth / idp / profile / saml2 / AbstractSAML2ProfileHandler.java
index 4832935..a96cf64 100644 (file)
@@ -22,6 +22,7 @@ import java.util.List;
 import java.util.Map;
 
 import org.joda.time.DateTime;
+import org.opensaml.Configuration;
 import org.opensaml.common.SAMLObjectBuilder;
 import org.opensaml.common.SAMLVersion;
 import org.opensaml.saml2.core.Assertion;
@@ -53,6 +54,8 @@ import org.opensaml.saml2.metadata.SPSSODescriptor;
 import org.opensaml.saml2.metadata.SSODescriptor;
 import org.opensaml.ws.transport.http.HTTPInTransport;
 import org.opensaml.xml.XMLObjectBuilder;
+import org.opensaml.xml.io.Marshaller;
+import org.opensaml.xml.io.MarshallingException;
 import org.opensaml.xml.security.SecurityException;
 import org.opensaml.xml.security.SecurityHelper;
 import org.opensaml.xml.security.credential.Credential;
@@ -426,18 +429,19 @@ public abstract class AbstractSAML2ProfileHandler extends AbstractSAMLProfileHan
         boolean signAssertion = false;
 
         AbstractSAML2ProfileConfiguration profileConfig = requestContext.getProfileConfiguration();
+        if (profileConfig.getSignAssertions()) {
+            signAssertion = true;
+            log.debug("IdP relying party configuration {} indicates to sign assertions: {}", requestContext
+                    .getRelyingPartyConfiguration().getRelyingPartyId(), signAssertion);
+        }
 
-        if (requestContext.getPeerEntityRoleMetadata() instanceof SPSSODescriptor) {
+        if (!signAssertion && requestContext.getPeerEntityRoleMetadata() instanceof SPSSODescriptor) {
             SPSSODescriptor ssoDescriptor = (SPSSODescriptor) requestContext.getPeerEntityRoleMetadata();
             if (ssoDescriptor.getWantAssertionsSigned() != null) {
                 signAssertion = ssoDescriptor.getWantAssertionsSigned().booleanValue();
                 log.debug("Entity metadata for relying party {} indicates to sign assertions: {}", requestContext
                         .getInboundMessageIssuer(), signAssertion);
             }
-        } else if (profileConfig.getSignAssertions()) {
-            signAssertion = true;
-            log.debug("IdP relying party configuration {} indicates to sign assertions: {}", requestContext
-                    .getRelyingPartyConfiguration().getRelyingPartyId(), signAssertion);
         }
 
         if (!signAssertion) {
@@ -471,7 +475,14 @@ public abstract class AbstractSAML2ProfileHandler extends AbstractSAMLProfileHan
 
         assertion.setSignature(signature);
 
-        Signer.signObject(signature);
+        Marshaller assertionMarshaller = Configuration.getMarshallerFactory().getMarshaller(assertion);
+        try {
+            assertionMarshaller.marshall(assertion);
+            Signer.signObject(signature);
+        } catch (MarshallingException e) {
+            log.error("Unable to marshall assertion for signing", e);
+            throw new ProfileException("Unable to marshall assertion for signing", e);
+        }
     }
 
     /**
@@ -588,7 +599,9 @@ public abstract class AbstractSAML2ProfileHandler extends AbstractSAMLProfileHan
                     if (encoder instanceof SAML2NameIDAttributeEncoder) {
                         nameIdEncoder = (SAML2NameIDAttributeEncoder) encoder;
                         if (supportedNameFormats.contains(nameIdEncoder.getNameFormat())) {
-                            log.debug("Using attribute {} suppoting NameID format {} to create the NameID for principal.{}",
+                            log
+                                    .debug(
+                                            "Using attribute {} suppoting NameID format {} to create the NameID for principal.{}",
                                             attribute.getId(), nameIdEncoder.getNameFormat());
                             return nameIdEncoder.encode(attribute);
                         }
@@ -620,42 +633,45 @@ public abstract class AbstractSAML2ProfileHandler extends AbstractSAMLProfileHan
 
         // Determine name formats supported by both SP and IdP
         RoleDescriptor relyingPartyRole = requestContext.getPeerEntityRoleMetadata();
-        if(relyingPartyRole != null){
+        if (relyingPartyRole != null) {
             List<String> relyingPartySupportedFormats = getEntitySupportedFormats(relyingPartyRole);
-            if(relyingPartySupportedFormats != null && !relyingPartySupportedFormats.isEmpty()){
+            if (relyingPartySupportedFormats != null && !relyingPartySupportedFormats.isEmpty()) {
                 nameFormats.addAll(relyingPartySupportedFormats);
-                
+
                 RoleDescriptor assertingPartyRole = requestContext.getLocalEntityRoleMetadata();
-                if(assertingPartyRole != null){
+                if (assertingPartyRole != null) {
                     List<String> assertingPartySupportedFormats = getEntitySupportedFormats(assertingPartyRole);
-                    if(assertingPartySupportedFormats != null && !assertingPartySupportedFormats.isEmpty()){
+                    if (assertingPartySupportedFormats != null && !assertingPartySupportedFormats.isEmpty()) {
                         nameFormats.retainAll(assertingPartySupportedFormats);
                     }
                 }
-            }                     
+            }
         }
 
         if (nameFormats.isEmpty()) {
             nameFormats.add("urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified");
         }
-        
+
         // If authn request and name ID policy format specified, make sure it's in the list of supported formats
         String nameFormat = null;
         if (requestContext.getInboundSAMLMessage() instanceof AuthnRequest) {
             AuthnRequest authnRequest = (AuthnRequest) requestContext.getInboundSAMLMessage();
             if (authnRequest.getNameIDPolicy() != null) {
                 nameFormat = DatatypeHelper.safeTrimOrNullString(authnRequest.getNameIDPolicy().getFormat());
-                if(nameFormat != null && nameFormats.contains(nameFormat)){
-                    nameFormats.clear();
-                    nameFormats.add(nameFormat);
-                } else {
-                    requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI,
-                            StatusCode.INVALID_NAMEID_POLICY_URI, "Format not supported: " + nameFormat));
-                    throw new ProfileException("NameID format required by relying party is not supported");
+                if (nameFormat != null) {
+                    if (nameFormats.contains(nameFormat)) {
+                        nameFormats.clear();
+                        nameFormats.add(nameFormat);
+                    } else {
+                        requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI,
+                                StatusCode.INVALID_NAMEID_POLICY_URI, "Format not supported: " + nameFormat));
+                        throw new ProfileException("NameID format required by relying party is not supported");
+                    }
                 }
+
             }
         }
-        
+
         return nameFormats;
     }