[SIDP-248] - Signing code in profile handlers and encoders should not just check that a signing credential is supplied, but that a signing key is available in that credential.
[SIDP-249] - PreviousSession INFO message printed as ERROR message
[SIDP-250] - AuthenticationEngine::returnToAuthenticationEngine() static method called before servlet init() when clustered.
+[SIDP-251[ - NPE when SAML1 Attribute Query Handler hit with GET request
[SIDP-252] - IdPSessionFilter throws ArrayIndexOutOfBoundsException on validation of unexpected cookie
Changes in Release 2.1.0
*/
protected void encodeResponse(BaseSAMLProfileRequestContext requestContext) throws ProfileException {
try {
- SAMLMessageEncoder encoder = getMessageEncoders().get(requestContext.getPeerEntityEndpoint().getBinding());
- if (encoder == null) {
- log.error("No outbound message encoder configured for binding {}", requestContext
- .getPeerEntityEndpoint().getBinding());
- throw new ProfileException("No outbound message encoder configured for binding "
- + requestContext.getPeerEntityEndpoint().getBinding());
+ SAMLMessageEncoder encoder = null;
+
+ Endpoint endpoint = requestContext.getPeerEntityEndpoint();
+ if (endpoint == null) {
+ log.error("No peer endpoint available for peer. Unable to send response.");
+ throw new ProfileException("No peer endpoint available for peer. Unable to send response.");
+ }
+
+ if (endpoint != null) {
+ encoder = getMessageEncoders().get(endpoint.getBinding());
+ if (encoder == null) {
+ log.error("No outbound message encoder configured for binding: {}", requestContext
+ .getPeerEntityEndpoint().getBinding());
+ throw new ProfileException("No outbound message encoder configured for binding: "
+ + requestContext.getPeerEntityEndpoint().getBinding());
+ }
}
AbstractSAMLProfileConfiguration profileConfig = (AbstractSAMLProfileConfiguration) requestContext
ResponseAbstractType response) {
response.setID(getIdGenerator().generateIdentifier());
- if (requestContext != null) {
- SAMLObject samlMessage = requestContext.getInboundSAMLMessage();
- if (samlMessage != null && samlMessage instanceof RequestAbstractType) {
- response.setInResponseTo(((RequestAbstractType) samlMessage).getID());
- }
+ SAMLObject samlMessage = requestContext.getInboundSAMLMessage();
+ if (samlMessage != null && samlMessage instanceof RequestAbstractType) {
+ response.setInResponseTo(((RequestAbstractType) samlMessage).getID());
}
response.setVersion(SAMLVersion.VERSION_11);
/** {@inheritDoc} */
public String toString() {
StringBuilder entryString = new StringBuilder(super.toString());
-
+
NameIdentifier nameIdentifier = null;
StringBuilder assertionIds = new StringBuilder();
List<Assertion> assertions = samlResponse.getAssertions();
- if(assertions != null && !assertions.isEmpty()){
- for(Assertion assertion : assertions){
+ if (assertions != null && !assertions.isEmpty()) {
+ for (Assertion assertion : assertions) {
assertionIds.append(assertion.getID());
assertionIds.append(",");
-
- if(nameIdentifier == null){
+
+ if (nameIdentifier == null) {
List<Statement> statements = assertion.getStatements();
- if(statements != null && !statements.isEmpty()){
- for(Statement statement : statements){
- if(statement instanceof SubjectStatement){
- if(((SubjectStatement)statement).getSubject() != null){
- nameIdentifier = ((SubjectStatement)statement).getSubject().getNameIdentifier();
+ if (statements != null && !statements.isEmpty()) {
+ for (Statement statement : statements) {
+ if (statement instanceof SubjectStatement) {
+ if (((SubjectStatement) statement).getSubject() != null) {
+ nameIdentifier = ((SubjectStatement) statement).getSubject()
+ .getNameIdentifier();
}
}
}
}
}
}
-
- if(nameIdentifier != null){
+
+ if (nameIdentifier != null) {
entryString.append(nameIdentifier.getNameIdentifier());
}
entryString.append("|");
-
+
entryString.append(assertionIds.toString());
entryString.append("|");
-
+
return entryString.toString();
}
}
public void processRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport) throws ProfileException {
Response samlResponse;
- ArtifactResolutionRequestContext requestContext = decodeRequest(inTransport, outTransport);
+ ArtifactResolutionRequestContext requestContext = new ArtifactResolutionRequestContext();
+ decodeRequest(requestContext, inTransport, outTransport);
try {
if (requestContext.getProfileConfiguration() == null) {
*
* @param inTransport inbound message transport
* @param outTransport outbound message transport
- *
- * @return the created request context
+ * @param requestContext request context to which decoded information should be added
*
* @throws ProfileException throw if there is a problem decoding the request
*/
- protected ArtifactResolutionRequestContext decodeRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport)
- throws ProfileException {
+ protected void decodeRequest(ArtifactResolutionRequestContext requestContext, HTTPInTransport inTransport,
+ HTTPOutTransport outTransport) throws ProfileException {
log.debug("Decoding message with decoder binding {}", getInboundBinding());
- ArtifactResolutionRequestContext requestContext = new ArtifactResolutionRequestContext();
requestContext.setCommunicationProfileId(getProfileId());
MetadataProvider metadataProvider = getMetadataProvider();
requestContext.setMessageDecoder(decoder);
decoder.decode(requestContext);
log.debug("Decoded request");
- return requestContext;
} catch (MessageDecodingException e) {
log.error("Error decoding artifact resolve message", e);
requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER, null, "Error decoding message"));
- throw new ProfileException("Error decoding artifact resolve message",e);
+ throw new ProfileException("Error decoding artifact resolve message", e);
} catch (SecurityException e) {
log.error("Message did not meet security requirements", e);
requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER, StatusCode.REQUEST_DENIED,
/** {@inheritDoc} */
public void processRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport) throws ProfileException {
- AttributeQueryContext requestContext = null;
+ AttributeQueryContext requestContext = new AttributeQueryContext();
Response samlResponse;
try {
- requestContext = decodeRequest(inTransport, outTransport);
-
+ decodeRequest(requestContext, inTransport, outTransport);
+
if (requestContext.getProfileConfiguration() == null) {
log.error("SAML 1 Attribute Query profile is not configured for relying party "
+ requestContext.getInboundMessageIssuer());
*
* @param inTransport inbound message transport
* @param outTransport outbound message transport
- *
- * @return the created request context
+ * @param requestContext the request context to which decoded information should be added
*
* @throws ProfileException throw if there is a problem decoding the request
*/
- protected AttributeQueryContext decodeRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport)
- throws ProfileException {
+ protected void decodeRequest(AttributeQueryContext requestContext, HTTPInTransport inTransport,
+ HTTPOutTransport outTransport) throws ProfileException {
log.debug("Decoding message with decoder binding {}", getInboundBinding());
- AttributeQueryContext requestContext = new AttributeQueryContext();
requestContext.setCommunicationProfileId(getProfileId());
MetadataProvider metadataProvider = getMetadataProvider();
"Invalid SAML Attribute Request message."));
throw new ProfileException("Invalid SAML Attribute Request message.");
}
-
- return requestContext;
} catch (MessageDecodingException e) {
log.error("Error decoding attribute query message", e);
requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER, null, "Error decoding message"));
HttpServletRequest httpRequest = ((HttpServletRequestAdapter) inTransport).getWrappedRequest();
HttpServletResponse httpResponse = ((HttpServletResponseAdapter) outTransport).getWrappedResponse();
+ ShibbolethSSORequestContext requestContext = new ShibbolethSSORequestContext();
- ShibbolethSSORequestContext requestContext = decodeRequest(inTransport, outTransport);
+ decodeRequest(requestContext, inTransport, outTransport);
ShibbolethSSOLoginContext loginContext = requestContext.getLoginContext();
RelyingPartyConfiguration rpConfig = getRelyingPartyConfiguration(loginContext.getRelyingPartyId());
*
* @param inTransport inbound message transport
* @param outTransport outbound message transport
- *
- * @return the created request context
+ * @param requestContext the request context to which decoded information should be added
*
* @throws ProfileException throw if there is a problem decoding the request
*/
- protected ShibbolethSSORequestContext decodeRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport)
- throws ProfileException {
+ protected void decodeRequest(ShibbolethSSORequestContext requestContext, HTTPInTransport inTransport,
+ HTTPOutTransport outTransport) throws ProfileException {
log.debug("Decoding message with decoder binding {}", getInboundBinding());
HttpServletRequest httpRequest = ((HttpServletRequestAdapter) inTransport).getWrappedRequest();
- ShibbolethSSORequestContext requestContext = new ShibbolethSSORequestContext();
requestContext.setCommunicationProfileId(getProfileId());
requestContext.setMetadataProvider(getMetadataProvider());
loginContext.setAuthenticationEngineURL(authenticationManagerPath);
loginContext.setProfileHandlerURL(HttpHelper.getRequestUriWithoutContext(httpRequest));
requestContext.setLoginContext(loginContext);
-
- return requestContext;
}
/**
endpoint.setBinding(getSupportedOutboundBindings().get(0));
log.warn("Generating endpoint for anonymous relying party. ACS url {} and binding {}", new Object[] {
requestContext.getInboundMessageIssuer(), endpoint.getLocation(), endpoint.getBinding(), });
- }else{
- log.warn("Unable to generate endpoint for anonymous party. No ACS url provided.");
+ } else {
+ log.warn("Unable to generate endpoint for anonymous party. No ACS url provided.");
}
} else {
ShibbolethSSOEndpointSelector endpointSelector = new ShibbolethSSOEndpointSelector();
Subject statementSubject;
Endpoint endpoint = selectEndpoint(requestContext);
- if(endpoint.getBinding().equals(SAMLConstants.SAML1_ARTIFACT_BINDING_URI)){
+ if (endpoint.getBinding().equals(SAMLConstants.SAML1_ARTIFACT_BINDING_URI)) {
statementSubject = buildSubject(requestContext, "urn:oasis:names:tc:SAML:1.0:cm:artifact");
- }else{
+ } else {
statementSubject = buildSubject(requestContext, "urn:oasis:names:tc:SAML:1.0:cm:bearer");
}
statement.setSubject(statementSubject);
protected void populateStatusResponse(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext,
StatusResponseType response) {
response.setID(getIdGenerator().generateIdentifier());
-
- if (requestContext != null && requestContext.getInboundSAMLMessage() != null) {
- response.setInResponseTo(requestContext.getInboundSAMLMessageId());
- response.setIssuer(buildEntityIssuer(requestContext));
- }
-
+
+ response.setInResponseTo(requestContext.getInboundSAMLMessageId());
+ response.setIssuer(buildEntityIssuer(requestContext));
+
response.setVersion(SAMLVersion.VERSION_20);
}
return kekCredentialResolver.resolveSingle(criteriaSet);
}
-
/**
* Writes an audit log entry indicating the successful response to the attribute request.
getAduitLog().info(auditLogEntry.toString());
}
-
+
/** SAML 1 specific audit log entry. */
protected class SAML2AuditLogEntry extends AuditLogEntry {
NameID nameIdentifier = null;
StringBuilder assertionIds = new StringBuilder();
- if(samlResponse instanceof Response){
- List<Assertion> assertions = ((Response)samlResponse).getAssertions();
- if(assertions != null && !assertions.isEmpty()){
- for(Assertion assertion : assertions){
- assertionIds.append(assertion.getID());
- assertionIds.append(",");
-
- if(nameIdentifier == null){
- if(assertion.getSubject() != null){
- nameIdentifier = assertion.getSubject().getNameID();
+ if (samlResponse instanceof Response) {
+ List<Assertion> assertions = ((Response) samlResponse).getAssertions();
+ if (assertions != null && !assertions.isEmpty()) {
+ for (Assertion assertion : assertions) {
+ assertionIds.append(assertion.getID());
+ assertionIds.append(",");
+
+ if (nameIdentifier == null) {
+ if (assertion.getSubject() != null) {
+ nameIdentifier = assertion.getSubject().getNameID();
+ }
}
}
}
}
- }
-
- if(nameIdentifier != null){
+
+ if (nameIdentifier != null) {
entryString.append(nameIdentifier.getValue());
}
entryString.append("|");
-
+
entryString.append(assertionIds.toString());
entryString.append("|");
-
+
return entryString.toString();
}
}
public void processRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport) throws ProfileException {
ArtifactResponse samlResponse;
- ArtifactResolutionRequestContext requestContext = decodeRequest(inTransport, outTransport);
-
+ ArtifactResolutionRequestContext requestContext = new ArtifactResolutionRequestContext();
try {
+ decodeRequest(requestContext, inTransport, outTransport);
+
if (requestContext.getProfileConfiguration() == null) {
log.error("SAML 2 Artifact Resolve profile is not configured for relying party "
+ requestContext.getInboundMessageIssuer());
*
* @param inTransport inbound message transport
* @param outTransport outbound message transport
- *
- * @return the created request context
+ * @param requestContext request context to which decoded information should be added
*
* @throws ProfileException throw if there is a problem decoding the request
*/
- protected ArtifactResolutionRequestContext decodeRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport)
- throws ProfileException {
+ protected void decodeRequest(ArtifactResolutionRequestContext requestContext, HTTPInTransport inTransport,
+ HTTPOutTransport outTransport) throws ProfileException {
log.debug("Decoding message with decoder binding {}", getInboundBinding());
- ArtifactResolutionRequestContext requestContext = new ArtifactResolutionRequestContext();
requestContext.setCommunicationProfileId(getProfileId());
MetadataProvider metadataProvider = getMetadataProvider();
requestContext.setMessageDecoder(decoder);
decoder.decode(requestContext);
log.debug("Decoded request");
- return requestContext;
} catch (MessageDecodingException e) {
log.error("Error decoding artifact resolve message", e);
requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null, "Error decoding message"));
*/
protected void populateSAMLMessageInformation(BaseSAMLProfileRequestContext requestContext) throws ProfileException {
ArtifactResolve samlMessage = (ArtifactResolve) requestContext.getInboundSAMLMessage();
- ((ArtifactResolutionRequestContext) requestContext).setArtifact(samlMessage.getArtifact().getArtifact());
+ if(samlMessage != null && samlMessage.getArtifact() != null){
+ ((ArtifactResolutionRequestContext) requestContext).setArtifact(samlMessage.getArtifact().getArtifact());
+ }
}
/**
public void processRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport) throws ProfileException {
Response samlResponse;
- AttributeQueryContext requestContext = null;
+ AttributeQueryContext requestContext = new AttributeQueryContext();
try {
- requestContext = decodeRequest(inTransport, outTransport);
-
+ decodeRequest(requestContext, inTransport, outTransport);
+
if (requestContext.getProfileConfiguration() == null) {
log.error("SAML 2 Attribute Query profile is not configured for relying party "
+ requestContext.getInboundMessageIssuer());
* Decodes an incoming request and populates a created request context with the resultant information.
*
* @param inTransport inbound message transport
- * @param outTransport outbound message transport
- *
- * @return the created request context
+ * @param outTransport outbound message transport *
+ * @param requestContext request context to which decoded information should be added
*
* @throws ProfileException throw if there is a problem decoding the request
*/
- protected AttributeQueryContext decodeRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport)
- throws ProfileException {
+ protected void decodeRequest(AttributeQueryContext requestContext, HTTPInTransport inTransport,
+ HTTPOutTransport outTransport) throws ProfileException {
log.debug("Decoding message with decoder binding {}", getInboundBinding());
- AttributeQueryContext requestContext = new AttributeQueryContext();
requestContext.setCommunicationProfileId(getProfileId());
MetadataProvider metadataProvider = getMetadataProvider();
"Invalid SAML AttributeQuery message."));
throw new ProfileException("Invalid SAML AttributeQuery message.");
}
-
- return requestContext;
} catch (MessageDecodingException e) {
log.error("Error decoding attribute query message", e);
requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null, "Error decoding message"));
import edu.internet2.middleware.shibboleth.idp.authn.LoginContext;
import edu.internet2.middleware.shibboleth.idp.authn.PassiveAuthenticationException;
import edu.internet2.middleware.shibboleth.idp.authn.Saml2LoginContext;
+import edu.internet2.middleware.shibboleth.idp.profile.saml1.ShibbolethSSOProfileHandler.ShibbolethSSORequestContext;
import edu.internet2.middleware.shibboleth.idp.session.Session;
/** SAML 2.0 SSO request profile handler. */
protected void performAuthentication(HTTPInTransport inTransport, HTTPOutTransport outTransport)
throws ProfileException {
HttpServletRequest servletRequest = ((HttpServletRequestAdapter) inTransport).getWrappedRequest();
+ SSORequestContext requestContext = new SSORequestContext();
try {
- SSORequestContext requestContext = decodeRequest(inTransport, outTransport);
+ decodeRequest(requestContext, inTransport, outTransport);
String relyingPartyId = requestContext.getInboundMessageIssuer();
RelyingPartyConfiguration rpConfig = getRelyingPartyConfiguration(relyingPartyId);
*
* @param inTransport inbound transport
* @param outTransport outbound transport
- *
- * @return request context with decoded information
+ * @param requestContext request context to which decoded information should be added
*
* @throws ProfileException thrown if the incoming message failed decoding
*/
- protected SSORequestContext decodeRequest(HTTPInTransport inTransport, HTTPOutTransport outTransport)
- throws ProfileException {
+ protected void decodeRequest(SSORequestContext requestContext, HTTPInTransport inTransport,
+ HTTPOutTransport outTransport) throws ProfileException {
log.debug("Decoding message with decoder binding {}", getInboundBinding());
- SSORequestContext requestContext = new SSORequestContext();
+
requestContext.setCommunicationProfileId(getProfileId());
requestContext.setMetadataProvider(getMetadataProvider());
"Invalid SAML AuthnRequest message."));
throw new ProfileException("Invalid SAML AuthnRequest message.");
}
-
- return requestContext;
} catch (MessageDecodingException e) {
log.error("Error decoding authentication request message", e);
throw new ProfileException("Error decoding authentication request message", e);
return endpoint;
}
-
/**
* Deserailizes an authentication request from a string.
projects / java-idp.git / commitdiff