1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17 package edu.internet2.middleware.shibboleth.idp.profile.saml2;
18
19 import java.util.Collection;
20 import java.util.List;
21 import java.util.Map;
22
23 import org.joda.time.DateTime;
24 import org.opensaml.Configuration;
25 import org.opensaml.common.SAMLObjectBuilder;
26 import org.opensaml.common.SAMLVersion;
27 import org.opensaml.common.binding.encoding.SAMLMessageEncoder;
28 import org.opensaml.common.xml.SAMLConstants;
29 import org.opensaml.saml2.core.Assertion;
30 import org.opensaml.saml2.core.AttributeQuery;
31 import org.opensaml.saml2.core.AttributeStatement;
32 import org.opensaml.saml2.core.Audience;
33 import org.opensaml.saml2.core.AudienceRestriction;
34 import org.opensaml.saml2.core.AuthnRequest;
35 import org.opensaml.saml2.core.Conditions;
36 import org.opensaml.saml2.core.Issuer;
37 import org.opensaml.saml2.core.NameID;
38 import org.opensaml.saml2.core.NameIDPolicy;
39 import org.opensaml.saml2.core.ProxyRestriction;
40 import org.opensaml.saml2.core.Response;
41 import org.opensaml.saml2.core.Statement;
42 import org.opensaml.saml2.core.Status;
43 import org.opensaml.saml2.core.StatusCode;
44 import org.opensaml.saml2.core.StatusMessage;
45 import org.opensaml.saml2.core.StatusResponseType;
46 import org.opensaml.saml2.core.Subject;
47 import org.opensaml.saml2.core.SubjectConfirmation;
48 import org.opensaml.saml2.core.SubjectConfirmationData;
49 import org.opensaml.saml2.encryption.Encrypter;
50 import org.opensaml.saml2.encryption.Encrypter.KeyPlacement;
51 import org.opensaml.saml2.metadata.Endpoint;
52 import org.opensaml.saml2.metadata.SPSSODescriptor;
53 import org.opensaml.security.MetadataCredentialResolver;
54 import org.opensaml.security.MetadataCriteria;
55 import org.opensaml.ws.message.encoder.MessageEncodingException;
56 import org.opensaml.ws.transport.http.HTTPInTransport;
57 import org.opensaml.xml.XMLObjectBuilder;
58 import org.opensaml.xml.encryption.EncryptionException;
59 import org.opensaml.xml.encryption.EncryptionParameters;
60 import org.opensaml.xml.encryption.KeyEncryptionParameters;
61 import org.opensaml.xml.io.Marshaller;
62 import org.opensaml.xml.io.MarshallingException;
63 import org.opensaml.xml.security.CriteriaSet;
64 import org.opensaml.xml.security.SecurityConfiguration;
65 import org.opensaml.xml.security.SecurityException;
66 import org.opensaml.xml.security.SecurityHelper;
67 import org.opensaml.xml.security.credential.Credential;
68 import org.opensaml.xml.security.credential.UsageType;
69 import org.opensaml.xml.security.criteria.EntityIDCriteria;
70 import org.opensaml.xml.security.criteria.KeyAlgorithmCriteria;
71 import org.opensaml.xml.security.criteria.UsageCriteria;
72 import org.opensaml.xml.signature.Signature;
73 import org.opensaml.xml.signature.SignatureException;
74 import org.opensaml.xml.signature.Signer;
75 import org.opensaml.xml.util.DatatypeHelper;
76 import org.opensaml.xml.util.Pair;
77 import org.opensaml.xml.util.XMLHelper;
78 import org.slf4j.Logger;
79 import org.slf4j.LoggerFactory;
80 import org.w3c.dom.Element;
81
82 import edu.internet2.middleware.shibboleth.common.attribute.AttributeRequestException;
83 import edu.internet2.middleware.shibboleth.common.attribute.BaseAttribute;
84 import edu.internet2.middleware.shibboleth.common.attribute.encoding.AttributeEncodingException;
85 import edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder;
86 import edu.internet2.middleware.shibboleth.common.attribute.provider.SAML2AttributeAuthority;
87 import edu.internet2.middleware.shibboleth.common.log.AuditLogEntry;
88 import edu.internet2.middleware.shibboleth.common.profile.ProfileException;
89 import edu.internet2.middleware.shibboleth.common.profile.provider.BaseSAMLProfileRequestContext;
90 import edu.internet2.middleware.shibboleth.common.relyingparty.provider.CryptoOperationRequirementLevel;
91 import edu.internet2.middleware.shibboleth.common.relyingparty.provider.saml2.AbstractSAML2ProfileConfiguration;
92 import edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler;
93 import edu.internet2.middleware.shibboleth.idp.session.ServiceInformation;
94 import edu.internet2.middleware.shibboleth.idp.session.Session;
95
96
97 public abstract class AbstractSAML2ProfileHandler extends AbstractSAMLProfileHandler {
98
99
100 public static final SAMLVersion SAML_VERSION = SAMLVersion.VERSION_20;
101
102
103 private Logger log = LoggerFactory.getLogger(AbstractSAML2ProfileHandler.class);
104
105
106 private SAMLObjectBuilder<Response> responseBuilder;
107
108
109 private SAMLObjectBuilder<Status> statusBuilder;
110
111
112 private SAMLObjectBuilder<StatusCode> statusCodeBuilder;
113
114
115 private SAMLObjectBuilder<StatusMessage> statusMessageBuilder;
116
117
118 private SAMLObjectBuilder<Assertion> assertionBuilder;
119
120
121 private SAMLObjectBuilder<Issuer> issuerBuilder;
122
123
124 private SAMLObjectBuilder<Subject> subjectBuilder;
125
126
127 private SAMLObjectBuilder<SubjectConfirmation> subjectConfirmationBuilder;
128
129
130 private SAMLObjectBuilder<SubjectConfirmationData> subjectConfirmationDataBuilder;
131
132
133 private SAMLObjectBuilder<Conditions> conditionsBuilder;
134
135
136 private SAMLObjectBuilder<AudienceRestriction> audienceRestrictionBuilder;
137
138
139 private SAMLObjectBuilder<ProxyRestriction> proxyRestrictionBuilder;
140
141
142 private SAMLObjectBuilder<Audience> audienceBuilder;
143
144
145 private XMLObjectBuilder<Signature> signatureBuilder;
146
147
148 @SuppressWarnings("unchecked")
149 protected AbstractSAML2ProfileHandler() {
150 super();
151
152 responseBuilder = (SAMLObjectBuilder<Response>) getBuilderFactory().getBuilder(Response.DEFAULT_ELEMENT_NAME);
153 statusBuilder = (SAMLObjectBuilder<Status>) getBuilderFactory().getBuilder(Status.DEFAULT_ELEMENT_NAME);
154 statusCodeBuilder = (SAMLObjectBuilder<StatusCode>) getBuilderFactory().getBuilder(
155 StatusCode.DEFAULT_ELEMENT_NAME);
156 statusMessageBuilder = (SAMLObjectBuilder<StatusMessage>) getBuilderFactory().getBuilder(
157 StatusMessage.DEFAULT_ELEMENT_NAME);
158 issuerBuilder = (SAMLObjectBuilder<Issuer>) getBuilderFactory().getBuilder(Issuer.DEFAULT_ELEMENT_NAME);
159 assertionBuilder = (SAMLObjectBuilder<Assertion>) getBuilderFactory()
160 .getBuilder(Assertion.DEFAULT_ELEMENT_NAME);
161 subjectBuilder = (SAMLObjectBuilder<Subject>) getBuilderFactory().getBuilder(Subject.DEFAULT_ELEMENT_NAME);
162 subjectConfirmationBuilder = (SAMLObjectBuilder<SubjectConfirmation>) getBuilderFactory().getBuilder(
163 SubjectConfirmation.DEFAULT_ELEMENT_NAME);
164 subjectConfirmationDataBuilder = (SAMLObjectBuilder<SubjectConfirmationData>) getBuilderFactory().getBuilder(
165 SubjectConfirmationData.DEFAULT_ELEMENT_NAME);
166 conditionsBuilder = (SAMLObjectBuilder<Conditions>) getBuilderFactory().getBuilder(
167 Conditions.DEFAULT_ELEMENT_NAME);
168 audienceRestrictionBuilder = (SAMLObjectBuilder<AudienceRestriction>) getBuilderFactory().getBuilder(
169 AudienceRestriction.DEFAULT_ELEMENT_NAME);
170 proxyRestrictionBuilder = (SAMLObjectBuilder<ProxyRestriction>) getBuilderFactory().getBuilder(
171 ProxyRestriction.DEFAULT_ELEMENT_NAME);
172 audienceBuilder = (SAMLObjectBuilder<Audience>) getBuilderFactory().getBuilder(Audience.DEFAULT_ELEMENT_NAME);
173 signatureBuilder = (XMLObjectBuilder<Signature>) getBuilderFactory().getBuilder(Signature.DEFAULT_ELEMENT_NAME);
174 }
175
176
177 protected void populateRequestContext(BaseSAMLProfileRequestContext requestContext) throws ProfileException {
178 BaseSAML2ProfileRequestContext saml2Request = (BaseSAML2ProfileRequestContext) requestContext;
179 try {
180 super.populateRequestContext(requestContext);
181 } catch (ProfileException e) {
182 if (saml2Request.getFailureStatus() == null) {
183 saml2Request.setFailureStatus(buildStatus(StatusCode.REQUESTER_URI, null, e.getMessage()));
184 }
185 throw e;
186 }
187 }
188
189
190
191
192
193
194
195
196
197
198
199
200 protected void populateUserInformation(BaseSAMLProfileRequestContext requestContext) {
201 Session userSession = getUserSession(requestContext.getInboundMessageTransport());
202 if (userSession == null) {
203 NameID subject = (NameID) requestContext.getSubjectNameIdentifier();
204 if (subject != null && subject.getValue() != null) {
205 userSession = getUserSession(subject.getValue());
206 }
207 }
208
209 if (userSession != null) {
210 requestContext.setUserSession(userSession);
211 requestContext.setPrincipalName(userSession.getPrincipalName());
212 ServiceInformation serviceInfo = userSession.getServicesInformation().get(
213 requestContext.getInboundMessageIssuer());
214 if (serviceInfo != null) {
215 requestContext.setPrincipalAuthenticationMethod(serviceInfo.getAuthenticationMethod()
216 .getAuthenticationMethod());
217 }
218 }
219 }
220
221
222
223
224
225
226
227
228 protected void checkSamlVersion(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) throws ProfileException {
229 SAMLVersion version = requestContext.getInboundSAMLMessage().getVersion();
230 if (version.getMajorVersion() < 2) {
231 requestContext.setFailureStatus(buildStatus(StatusCode.VERSION_MISMATCH_URI,
232 StatusCode.REQUEST_VERSION_TOO_LOW_URI, null));
233 throw new ProfileException("SAML request version too low");
234 } else if (version.getMajorVersion() > 2 || version.getMinorVersion() > 0) {
235 requestContext.setFailureStatus(buildStatus(StatusCode.VERSION_MISMATCH_URI,
236 StatusCode.REQUEST_VERSION_TOO_HIGH_URI, null));
237 throw new ProfileException("SAML request version too high");
238 }
239 }
240
241
242
243
244
245
246
247
248
249
250
251
252 protected Response buildResponse(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext,
253 String subjectConfirmationMethod, List<Statement> statements) throws ProfileException {
254
255 DateTime issueInstant = new DateTime();
256
257 Response samlResponse = responseBuilder.buildObject();
258 samlResponse.setIssueInstant(issueInstant);
259 populateStatusResponse(requestContext, samlResponse);
260
261 Assertion assertion = null;
262 if (statements != null && !statements.isEmpty()) {
263 assertion = buildAssertion(requestContext, issueInstant);
264 assertion.getStatements().addAll(statements);
265 assertion.setSubject(buildSubject(requestContext, subjectConfirmationMethod, issueInstant));
266
267 postProcessAssertion(requestContext, assertion);
268
269 signAssertion(requestContext, assertion);
270
271 if (isEncryptAssertion(requestContext)) {
272 if (log.isDebugEnabled()) {
273 log.debug("Attempting to encrypt assertion to relying party '{}'",
274 requestContext.getInboundMessageIssuer());
275 try {
276 Element assertionDOM =
277 Configuration.getMarshallerFactory().getMarshaller(assertion).marshall(assertion);
278 log.debug("Assertion to be encrypted is:\n{}", XMLHelper.prettyPrintXML(assertionDOM));
279 } catch (MarshallingException e) {
280 log.warn("Error attempting to marshall Assertion for debug log", e);
281 }
282 }
283
284 try {
285 Encrypter encrypter = getEncrypter(requestContext.getInboundMessageIssuer());
286 samlResponse.getEncryptedAssertions().add(encrypter.encrypt(assertion));
287 } catch (SecurityException e) {
288 log.error("Unable to construct encrypter", e);
289 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null,
290 "Unable to encrypt assertion"));
291 throw new ProfileException("Unable to construct encrypter", e);
292 } catch (EncryptionException e) {
293 log.error("Unable to encrypt assertion", e);
294 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null,
295 "Unable to encrypt assertion"));
296 throw new ProfileException("Unable to encrypt assertion", e);
297 }
298 } else {
299 samlResponse.getAssertions().add(assertion);
300 }
301 }
302
303 Status status = buildStatus(StatusCode.SUCCESS_URI, null, null);
304 samlResponse.setStatus(status);
305
306 postProcessResponse(requestContext, samlResponse);
307
308 return samlResponse;
309 }
310
311
312
313
314
315
316
317
318 protected boolean isEncryptAssertion(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext)
319 throws ProfileException {
320
321 SAMLMessageEncoder encoder = getOutboundMessageEncoder(requestContext);
322 try {
323 return requestContext.getProfileConfiguration().getEncryptAssertion() == CryptoOperationRequirementLevel.always
324 || (requestContext.getProfileConfiguration().getEncryptAssertion() == CryptoOperationRequirementLevel.conditional && !encoder
325 .providesMessageConfidentiality(requestContext));
326 } catch (MessageEncodingException e) {
327 log.error("Unable to determine if outbound encoding '{}' can provide confidentiality",
328 encoder.getBindingURI());
329 throw new ProfileException("Unable to determine if assertions should be encrypted");
330 }
331 }
332
333
334
335
336
337
338
339
340
341 protected void postProcessResponse(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext, Response samlResponse)
342 throws ProfileException {
343 }
344
345
346
347
348
349
350
351
352
353 protected void postProcessAssertion(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext, Assertion assertion)
354 throws ProfileException {
355 }
356
357
358
359
360
361
362
363
364
365 protected Assertion buildAssertion(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext, DateTime issueInstant) {
366 Assertion assertion = assertionBuilder.buildObject();
367 assertion.setID(getIdGenerator().generateIdentifier());
368 assertion.setIssueInstant(issueInstant);
369 assertion.setVersion(SAMLVersion.VERSION_20);
370 assertion.setIssuer(buildEntityIssuer(requestContext));
371
372 Conditions conditions = buildConditions(requestContext, issueInstant);
373 assertion.setConditions(conditions);
374
375 return assertion;
376 }
377
378
379
380
381
382
383
384
385 protected Issuer buildEntityIssuer(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) {
386 Issuer issuer = issuerBuilder.buildObject();
387 issuer.setFormat(Issuer.ENTITY);
388 issuer.setValue(requestContext.getLocalEntityId());
389
390 return issuer;
391 }
392
393
394
395
396
397
398
399
400
401
402 protected Conditions buildConditions(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext, DateTime issueInstant) {
403 AbstractSAML2ProfileConfiguration profileConfig = requestContext.getProfileConfiguration();
404
405 Conditions conditions = conditionsBuilder.buildObject();
406 conditions.setNotBefore(issueInstant);
407 conditions.setNotOnOrAfter(issueInstant.plus(profileConfig.getAssertionLifetime()));
408
409 Collection<String> audiences;
410
411
412 AudienceRestriction audienceRestriction = audienceRestrictionBuilder.buildObject();
413
414 Audience audience = audienceBuilder.buildObject();
415 audience.setAudienceURI(requestContext.getInboundMessageIssuer());
416 audienceRestriction.getAudiences().add(audience);
417 audiences = profileConfig.getAssertionAudiences();
418 if (audiences != null && audiences.size() > 0) {
419 for (String audienceUri : audiences) {
420 audience = audienceBuilder.buildObject();
421 audience.setAudienceURI(audienceUri);
422 audienceRestriction.getAudiences().add(audience);
423 }
424 }
425 conditions.getAudienceRestrictions().add(audienceRestriction);
426
427
428 audiences = profileConfig.getProxyAudiences();
429 if (audiences != null && audiences.size() > 0) {
430 ProxyRestriction proxyRestriction = proxyRestrictionBuilder.buildObject();
431 for (String audienceUri : audiences) {
432 audience = audienceBuilder.buildObject();
433 audience.setAudienceURI(audienceUri);
434 proxyRestriction.getAudiences().add(audience);
435 }
436
437 proxyRestriction.setProxyCount(profileConfig.getProxyCount());
438 conditions.getConditions().add(proxyRestriction);
439 }
440
441 return conditions;
442 }
443
444
445
446
447
448
449
450 protected void populateStatusResponse(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext,
451 StatusResponseType response) {
452 response.setID(getIdGenerator().generateIdentifier());
453
454 response.setInResponseTo(requestContext.getInboundSAMLMessageId());
455 response.setIssuer(buildEntityIssuer(requestContext));
456
457 response.setVersion(SAMLVersion.VERSION_20);
458 }
459
460
461
462
463
464
465
466
467 protected void resolveAttributes(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) throws ProfileException {
468 AbstractSAML2ProfileConfiguration profileConfiguration = requestContext.getProfileConfiguration();
469 SAML2AttributeAuthority attributeAuthority = profileConfiguration.getAttributeAuthority();
470 try {
471 log.debug("Resolving attributes for principal '{}' for SAML request from relying party '{}'",
472 requestContext.getPrincipalName(), requestContext.getInboundMessageIssuer());
473 Map<String, BaseAttribute> principalAttributes = attributeAuthority.getAttributes(requestContext);
474
475 requestContext.setAttributes(principalAttributes);
476 } catch (AttributeRequestException e) {
477 log.warn(
478 "Error resolving attributes for principal '{}'. No name identifier or attribute statement will be included in response",
479 requestContext.getPrincipalName());
480 }
481 }
482
483
484
485
486
487
488
489
490
491
492 protected AttributeStatement buildAttributeStatement(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext)
493 throws ProfileException {
494 if (requestContext.getAttributes() == null) {
495 return null;
496 }
497
498 log.debug("Creating attribute statement in response to SAML request '{}' from relying party '{}'",
499 requestContext.getInboundSAMLMessageId(), requestContext.getInboundMessageIssuer());
500
501 AbstractSAML2ProfileConfiguration profileConfiguration = requestContext.getProfileConfiguration();
502 SAML2AttributeAuthority attributeAuthority = profileConfiguration.getAttributeAuthority();
503 try {
504 if (requestContext.getInboundSAMLMessage() instanceof AttributeQuery) {
505 return attributeAuthority.buildAttributeStatement((AttributeQuery) requestContext
506 .getInboundSAMLMessage(), requestContext.getAttributes().values());
507 } else {
508 return attributeAuthority.buildAttributeStatement(null, requestContext.getAttributes().values());
509 }
510 } catch (AttributeRequestException e) {
511 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null, "Error resolving attributes"));
512 String msg = "Error encoding attributes for principal " + requestContext.getPrincipalName();
513 log.error(msg, e);
514 throw new ProfileException(msg, e);
515 }
516 }
517
518
519
520
521
522
523
524
525 protected void resolvePrincipal(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) throws ProfileException {
526 AbstractSAML2ProfileConfiguration profileConfiguration = requestContext.getProfileConfiguration();
527 if (profileConfiguration == null) {
528 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, StatusCode.REQUEST_DENIED_URI,
529 "Error resolving principal"));
530 String msg = "Unable to resolve principal, no SAML 2 profile configuration for relying party "
531 + requestContext.getInboundMessageIssuer();
532 log.warn(msg);
533 throw new ProfileException(msg);
534 }
535 SAML2AttributeAuthority attributeAuthority = profileConfiguration.getAttributeAuthority();
536 log.debug("Resolving principal name for subject of SAML request '{}' from relying party '{}'",
537 requestContext.getInboundSAMLMessageId(), requestContext.getInboundMessageIssuer());
538
539 try {
540 String principal = attributeAuthority.getPrincipal(requestContext);
541 requestContext.setPrincipalName(principal);
542 } catch (AttributeRequestException e) {
543 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, StatusCode.UNKNOWN_PRINCIPAL_URI,
544 "Error resolving principal"));
545 String msg = "Error resolving principal name for SAML request '" + requestContext.getInboundSAMLMessageId()
546 + "' from relying party '" + requestContext.getInboundMessageIssuer() + "'. Cause: "
547 + e.getMessage();
548 log.warn(msg);
549 throw new ProfileException(msg, e);
550 }
551 }
552
553
554
555
556
557
558
559
560
561
562
563 protected void signAssertion(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext, Assertion assertion)
564 throws ProfileException {
565 log.debug("Determining if SAML assertion to relying party '{}' should be signed",
566 requestContext.getInboundMessageIssuer());
567
568 boolean signAssertion = isSignAssertion(requestContext);
569
570 if (!signAssertion) {
571 return;
572 }
573
574 AbstractSAML2ProfileConfiguration profileConfig = requestContext.getProfileConfiguration();
575
576 log.debug("Determining signing credntial for assertion to relying party '{}'",
577 requestContext.getInboundMessageIssuer());
578 Credential signatureCredential = profileConfig.getSigningCredential();
579 if (signatureCredential == null) {
580 signatureCredential = requestContext.getRelyingPartyConfiguration().getDefaultSigningCredential();
581 }
582
583 if (signatureCredential == null) {
584 String msg = "No signing credential is specified for relying party configuration "
585 + requestContext.getRelyingPartyConfiguration().getProviderId();
586 log.warn(msg);
587 throw new ProfileException(msg);
588 }
589
590 log.debug("Signing assertion to relying party {}", requestContext.getInboundMessageIssuer());
591 Signature signature = signatureBuilder.buildObject(Signature.DEFAULT_ELEMENT_NAME);
592
593 signature.setSigningCredential(signatureCredential);
594 try {
595
596
597 SecurityHelper.prepareSignatureParams(signature, signatureCredential, null, null);
598 } catch (SecurityException e) {
599 String msg = "Error preparing signature for signing";
600 log.error(msg);
601 throw new ProfileException(msg, e);
602 }
603
604 assertion.setSignature(signature);
605
606 Marshaller assertionMarshaller = Configuration.getMarshallerFactory().getMarshaller(assertion);
607 try {
608 assertionMarshaller.marshall(assertion);
609 Signer.signObject(signature);
610 } catch (MarshallingException e) {
611 String errMsg = "Unable to marshall assertion for signing";
612 log.error(errMsg, e);
613 throw new ProfileException(errMsg, e);
614 } catch (SignatureException e) {
615 String msg = "Unable to sign assertion";
616 log.error(msg, e);
617 throw new ProfileException(msg, e);
618 }
619 }
620
621
622
623
624
625
626
627
628 protected boolean isSignAssertion(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) throws ProfileException {
629
630 SAMLMessageEncoder encoder = getOutboundMessageEncoder(requestContext);
631 AbstractSAML2ProfileConfiguration profileConfig = requestContext.getProfileConfiguration();
632
633 try {
634 boolean signAssertion = profileConfig.getSignAssertions() == CryptoOperationRequirementLevel.always
635 || (profileConfig.getSignAssertions() == CryptoOperationRequirementLevel.conditional && !encoder
636 .providesMessageIntegrity(requestContext));
637
638 log.debug("IdP relying party configuration '{}' indicates to sign assertions: {}", requestContext
639 .getRelyingPartyConfiguration().getRelyingPartyId(), signAssertion);
640
641 if (!signAssertion && requestContext.getPeerEntityRoleMetadata() instanceof SPSSODescriptor) {
642 SPSSODescriptor ssoDescriptor = (SPSSODescriptor) requestContext.getPeerEntityRoleMetadata();
643 if (ssoDescriptor.getWantAssertionsSigned() != null) {
644 signAssertion = ssoDescriptor.getWantAssertionsSigned().booleanValue();
645 log.debug("Entity metadata for relying party '{} 'indicates to sign assertions: {}",
646 requestContext.getInboundMessageIssuer(), signAssertion);
647 }
648 }
649
650 return signAssertion;
651 } catch (MessageEncodingException e) {
652 log.error("Unable to determine if outbound encoding '{}' provides message integrity protection",
653 encoder.getBindingURI());
654 throw new ProfileException("Unable to determine if outbound assertion should be signed");
655 }
656 }
657
658
659
660
661
662
663
664
665
666
667
668 protected Status buildStatus(String topLevelCode, String secondLevelCode, String failureMessage) {
669 Status status = statusBuilder.buildObject();
670
671 StatusCode statusCode = statusCodeBuilder.buildObject();
672 statusCode.setValue(DatatypeHelper.safeTrimOrNullString(topLevelCode));
673 status.setStatusCode(statusCode);
674
675 if (secondLevelCode != null) {
676 StatusCode secondLevelStatusCode = statusCodeBuilder.buildObject();
677 secondLevelStatusCode.setValue(DatatypeHelper.safeTrimOrNullString(secondLevelCode));
678 statusCode.setStatusCode(secondLevelStatusCode);
679 }
680
681 if (failureMessage != null) {
682 StatusMessage msg = statusMessageBuilder.buildObject();
683 msg.setMessage(failureMessage);
684 status.setStatusMessage(msg);
685 }
686
687 return status;
688 }
689
690
691
692
693
694
695
696
697
698
699
700
701
702 protected Subject buildSubject(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext, String confirmationMethod,
703 DateTime issueInstant) throws ProfileException {
704 Subject subject = subjectBuilder.buildObject();
705 subject.getSubjectConfirmations().add(
706 buildSubjectConfirmation(requestContext, confirmationMethod, issueInstant));
707
708 NameID nameID = buildNameId(requestContext);
709 if (nameID == null) {
710 return subject;
711 }
712
713 requestContext.setSubjectNameIdentifier(nameID);
714
715 if (isEncryptNameID(requestContext)) {
716 log.debug("Attempting to encrypt NameID to relying party '{}'", requestContext.getInboundMessageIssuer());
717 try {
718 Encrypter encrypter = getEncrypter(requestContext.getInboundMessageIssuer());
719 subject.setEncryptedID(encrypter.encrypt(nameID));
720 } catch (SecurityException e) {
721 log.error("Unable to construct encrypter", e);
722 requestContext
723 .setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null, "Unable to encrypt NameID"));
724 throw new ProfileException("Unable to construct encrypter", e);
725 } catch (EncryptionException e) {
726 log.error("Unable to encrypt NameID", e);
727 requestContext
728 .setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null, "Unable to encrypt NameID"));
729 throw new ProfileException("Unable to encrypt NameID", e);
730 }
731 } else {
732 subject.setNameID(nameID);
733 }
734
735 return subject;
736 }
737
738
739
740
741
742
743
744
745 protected boolean isEncryptNameID(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) throws ProfileException {
746
747 boolean nameIdEncRequiredByAuthnRequest = isRequestRequiresEncryptNameID(requestContext);
748
749 SAMLMessageEncoder encoder = getOutboundMessageEncoder(requestContext);
750 boolean nameIdEncRequiredByConfig = false;
751 try {
752 nameIdEncRequiredByConfig = requestContext.getProfileConfiguration().getEncryptNameID() == CryptoOperationRequirementLevel.always
753 || (requestContext.getProfileConfiguration().getEncryptNameID() == CryptoOperationRequirementLevel.conditional && !encoder
754 .providesMessageConfidentiality(requestContext));
755 } catch (MessageEncodingException e) {
756 String msg = "Unable to determine if outbound encoding '" + encoder.getBindingURI()
757 + "' provides message confidentiality protection";
758 log.error(msg);
759 throw new ProfileException(msg);
760 }
761
762 return nameIdEncRequiredByAuthnRequest || nameIdEncRequiredByConfig;
763 }
764
765
766
767
768
769
770
771 protected boolean isRequestRequiresEncryptNameID(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) {
772 boolean nameIdEncRequiredByAuthnRequest = false;
773 if (requestContext.getInboundSAMLMessage() instanceof AuthnRequest) {
774 AuthnRequest authnRequest = (AuthnRequest) requestContext.getInboundSAMLMessage();
775 NameIDPolicy policy = authnRequest.getNameIDPolicy();
776 if (policy != null && DatatypeHelper.safeEquals(policy.getFormat(), NameID.ENCRYPTED)) {
777 nameIdEncRequiredByAuthnRequest = true;
778 }
779 }
780 return nameIdEncRequiredByAuthnRequest;
781 }
782
783
784
785
786
787
788
789
790
791
792 protected SubjectConfirmation buildSubjectConfirmation(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext,
793 String confirmationMethod, DateTime issueInstant) {
794 SubjectConfirmationData confirmationData = subjectConfirmationDataBuilder.buildObject();
795 HTTPInTransport inTransport = (HTTPInTransport) requestContext.getInboundMessageTransport();
796 confirmationData.setAddress(inTransport.getPeerAddress());
797 confirmationData.setInResponseTo(requestContext.getInboundSAMLMessageId());
798 confirmationData.setNotOnOrAfter(issueInstant.plus(requestContext.getProfileConfiguration()
799 .getAssertionLifetime()));
800
801 Endpoint relyingPartyEndpoint = requestContext.getPeerEntityEndpoint();
802 if (relyingPartyEndpoint != null) {
803 if (relyingPartyEndpoint.getResponseLocation() != null) {
804 confirmationData.setRecipient(relyingPartyEndpoint.getResponseLocation());
805 } else {
806 confirmationData.setRecipient(relyingPartyEndpoint.getLocation());
807 }
808 }
809
810 SubjectConfirmation subjectConfirmation = subjectConfirmationBuilder.buildObject();
811 subjectConfirmation.setMethod(confirmationMethod);
812 subjectConfirmation.setSubjectConfirmationData(confirmationData);
813
814 return subjectConfirmation;
815 }
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831 protected NameID buildNameId(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) throws ProfileException {
832 Pair<BaseAttribute, SAML2NameIDEncoder> nameIdAttributeAndEncoder = null;
833 try {
834 nameIdAttributeAndEncoder = selectNameIDAttributeAndEncoder(SAML2NameIDEncoder.class, requestContext);
835 } catch (ProfileException e) {
836 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, StatusCode.INVALID_NAMEID_POLICY_URI,
837 "Required NameID format not supported"));
838 throw e;
839 }
840
841 if (nameIdAttributeAndEncoder == null) {
842 return null;
843 }
844
845 BaseAttribute<?> nameIdAttribute = nameIdAttributeAndEncoder.getFirst();
846 requestContext.setNameIdentifierAttribute(nameIdAttribute);
847 SAML2NameIDEncoder nameIdEncoder = nameIdAttributeAndEncoder.getSecond();
848
849 log.debug(
850 "Using attribute '{}' supporting NameID format '{}' to create the NameID for relying party '{}'",
851 new Object[] { nameIdAttribute.getId(), nameIdEncoder.getNameFormat(),
852 requestContext.getInboundMessageIssuer(), });
853 try {
854
855 NameID nameId = nameIdEncoder.encode(nameIdAttribute);
856 if (nameId.getNameQualifier() == null) {
857 nameId.setNameQualifier(requestContext.getRelyingPartyConfiguration().getProviderId());
858 }
859 return nameId;
860 } catch (AttributeEncodingException e) {
861 log.error("Unable to encode NameID attribute", e);
862 requestContext.setFailureStatus(buildStatus(StatusCode.RESPONDER_URI, null, "Unable to construct NameID"));
863 throw new ProfileException("Unable to encode NameID attribute", e);
864 }
865 }
866
867
868
869
870
871
872
873
874 protected Response buildErrorResponse(BaseSAML2ProfileRequestContext<?, ?, ?> requestContext) {
875 Response samlResponse = responseBuilder.buildObject();
876 samlResponse.setIssueInstant(new DateTime());
877 populateStatusResponse(requestContext, samlResponse);
878
879 samlResponse.setStatus(requestContext.getFailureStatus());
880
881 return samlResponse;
882 }
883
884
885
886
887
888
889
890
891
892
893
894
895 protected Encrypter getEncrypter(String peerEntityId) throws SecurityException {
896 SecurityConfiguration securityConfiguration = Configuration.getGlobalSecurityConfiguration();
897
898 EncryptionParameters dataEncParams = SecurityHelper
899 .buildDataEncryptionParams(null, securityConfiguration, null);
900
901 Credential keyEncryptionCredential = getKeyEncryptionCredential(peerEntityId);
902 if (keyEncryptionCredential == null) {
903 log.error("Could not resolve a key encryption credential for peer entity: {}", peerEntityId);
904 throw new SecurityException("Could not resolve key encryption credential");
905 }
906 String wrappedJCAKeyAlgorithm = SecurityHelper.getKeyAlgorithmFromURI(dataEncParams.getAlgorithm());
907 KeyEncryptionParameters keyEncParams = SecurityHelper.buildKeyEncryptionParams(keyEncryptionCredential,
908 wrappedJCAKeyAlgorithm, securityConfiguration, null, null);
909
910 Encrypter encrypter = new Encrypter(dataEncParams, keyEncParams);
911 encrypter.setKeyPlacement(KeyPlacement.INLINE);
912 return encrypter;
913 }
914
915
916
917
918
919
920
921
922
923
924 protected Credential getKeyEncryptionCredential(String peerEntityId) throws SecurityException {
925 MetadataCredentialResolver kekCredentialResolver = getMetadataCredentialResolver();
926
927 CriteriaSet criteriaSet = new CriteriaSet();
928 criteriaSet.add(new EntityIDCriteria(peerEntityId));
929 criteriaSet.add(new MetadataCriteria(SPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS));
930 criteriaSet.add(new UsageCriteria(UsageType.ENCRYPTION));
931
932
933
934
935
936 criteriaSet.add(new KeyAlgorithmCriteria("RSA"));
937
938 return kekCredentialResolver.resolveSingle(criteriaSet);
939 }
940
941
942
943
944
945
946 protected void writeAuditLogEntry(BaseSAMLProfileRequestContext context) {
947 SAML2AuditLogEntry auditLogEntry = new SAML2AuditLogEntry();
948 auditLogEntry.setSAMLResponse((StatusResponseType) context.getOutboundSAMLMessage());
949 auditLogEntry.setMessageProfile(getProfileId());
950 auditLogEntry.setPrincipalAuthenticationMethod(context.getPrincipalAuthenticationMethod());
951 auditLogEntry.setPrincipalName(context.getPrincipalName());
952 auditLogEntry.setAssertingPartyId(context.getLocalEntityId());
953 auditLogEntry.setRelyingPartyId(context.getInboundMessageIssuer());
954 auditLogEntry.setRequestBinding(context.getMessageDecoder().getBindingURI());
955 auditLogEntry.setRequestId(context.getInboundSAMLMessageId());
956 auditLogEntry.setResponseBinding(context.getMessageEncoder().getBindingURI());
957 auditLogEntry.setResponseId(context.getOutboundSAMLMessageId());
958 if (context.getReleasedAttributes() != null) {
959 auditLogEntry.getReleasedAttributes().addAll(context.getReleasedAttributes());
960 }
961
962 if (context.getNameIdentifierAttribute() != null) {
963 Object idValue = context.getNameIdentifierAttribute().getValues().iterator().next();
964 if(idValue != null){
965 auditLogEntry.setNameIdValue(idValue.toString());
966 }
967 }
968
969 getAduitLog().info(auditLogEntry.toString());
970 }
971
972
973 protected class SAML2AuditLogEntry extends AuditLogEntry {
974
975
976 private StatusResponseType samlResponse;
977
978
979
980
981
982
983 public StatusResponseType getSAMLResponse() {
984 return samlResponse;
985 }
986
987
988
989
990
991
992 public void setSAMLResponse(StatusResponseType response) {
993 samlResponse = response;
994 }
995
996
997 public String toString() {
998 StringBuilder entryString = new StringBuilder(super.toString());
999
1000 StringBuilder assertionIds = new StringBuilder();
1001
1002 if (samlResponse instanceof Response) {
1003 List<Assertion> assertions = ((Response) samlResponse).getAssertions();
1004 if (assertions != null && !assertions.isEmpty()) {
1005 for (Assertion assertion : assertions) {
1006 assertionIds.append(assertion.getID());
1007 assertionIds.append(",");
1008 }
1009 }
1010 }
1011
1012 if (getNameIdValue() != null) {
1013 entryString.append(getNameIdValue());
1014 }
1015 entryString.append("|");
1016
1017 entryString.append(assertionIds.toString());
1018 entryString.append("|");
1019
1020 return entryString.toString();
1021 }
1022 }
1023 }