Author: coheigea Date: Mon Dec 16 15:28:10 2013 New Revision: 1551232 URL: http://svn.apache.org/r1551232 Log: Merged revisions 1551229 via git cherry-pick from https://svn.apache.org/repos/asf/cxf/branches/2.7.x-fixes
........ r1551229 | coheigea | 2013-12-16 15:20:35 +0000 (Mon, 16 Dec 2013) | 10 lines Merged revisions 1551228 via git cherry-pick from https://svn.apache.org/repos/asf/cxf/trunk ........ r1551228 | coheigea | 2013-12-16 15:18:58 +0000 (Mon, 16 Dec 2013) | 2 lines Validation fix in the STS ........ ........ Modified: cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java cxf/branches/2.6.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java Modified: cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java URL: http://svn.apache.org/viewvc/cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java?rev=1551232&r1=1551231&r2=1551232&view=diff ============================================================================== --- cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java (original) +++ cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java Mon Dec 16 15:28:10 2013 @@ -145,6 +145,29 @@ public class SAMLTokenValidator implemen SAMLTokenPrincipal samlPrincipal = new SAMLTokenPrincipal(assertion); response.setPrincipal(samlPrincipal); + if (!assertion.isSigned()) { + LOG.log(Level.WARNING, "The received assertion is not signed, and therefore not trusted"); + return response; + } + + RequestData requestData = new RequestData(); + requestData.setSigVerCrypto(sigCrypto); + WSSConfig wssConfig = WSSConfig.getNewInstance(); + requestData.setWssConfig(wssConfig); + requestData.setCallbackHandler(callbackHandler); + requestData.setMsgContext(tokenParameters.getWebServiceContext().getMessageContext()); + + WSDocInfo docInfo = new WSDocInfo(validateTargetElement.getOwnerDocument()); + + // Verify the signature + Signature sig = assertion.getSignature(); + KeyInfo keyInfo = sig.getKeyInfo(); + SAMLKeyInfo samlKeyInfo = + SAMLUtil.getCredentialFromKeyInfo( + keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData, docInfo), sigCrypto + ); + assertion.verifySignature(samlKeyInfo); + SecurityToken secToken = null; byte[] signatureValue = assertion.getSignatureValue(); if (tokenParameters.getTokenStore() != null && signatureValue != null @@ -161,6 +184,7 @@ public class SAMLTokenValidator implemen } if (secToken == null) { +<<<<<<< HEAD if (!assertion.isSigned()) { LOG.log(Level.WARNING, "The received assertion is not signed, and therefore not trusted"); return response; @@ -177,6 +201,8 @@ public class SAMLTokenValidator implemen requestData, new WSDocInfo(validateTargetElement.getOwnerDocument()) ); +======= +>>>>>>> 4b3dbb3... Validation fix in the STS // Validate the assertion against schemas/profiles validateAssertion(assertion); @@ -197,7 +223,6 @@ public class SAMLTokenValidator implemen if (!certConstraints.matches(cert)) { return response; } - } // Get the realm of the SAML token Modified: cxf/branches/2.6.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java URL: http://svn.apache.org/viewvc/cxf/branches/2.6.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java?rev=1551232&r1=1551231&r2=1551232&view=diff ============================================================================== --- cxf/branches/2.6.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java (original) +++ cxf/branches/2.6.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java Mon Dec 16 15:28:10 2013 @@ -348,6 +348,127 @@ public class SAMLTokenValidatorTest exte assertTrue(validatorResponse.getToken().getState() == STATE.INVALID); } +<<<<<<< HEAD +======= + @org.junit.Test + public void testSAML2AssertionWithRolesNoCaching() throws Exception { + TokenValidator samlTokenValidator = new SAMLTokenValidator(); + TokenValidatorParameters validatorParameters = createValidatorParameters(); + TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements(); + + // Create a ValidateTarget consisting of a SAML Assertion + Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties()); + CallbackHandler callbackHandler = new PasswordCallbackHandler(); + Element samlToken = + createSAMLAssertionWithRoles(WSConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", + callbackHandler, "manager"); + Document doc = samlToken.getOwnerDocument(); + samlToken = (Element)doc.appendChild(samlToken); + + ReceivedToken validateTarget = new ReceivedToken(samlToken); + tokenRequirements.setValidateTarget(validateTarget); + validatorParameters.setToken(validateTarget); + + // Disable caching + validatorParameters.setTokenStore(null); + + assertTrue(samlTokenValidator.canHandleToken(validateTarget)); + + TokenValidatorResponse validatorResponse = + samlTokenValidator.validateToken(validatorParameters); + assertTrue(validatorResponse != null); + assertTrue(validatorResponse.getToken() != null); + assertTrue(validatorResponse.getToken().getState() == STATE.VALID); + + Principal principal = validatorResponse.getPrincipal(); + assertTrue(principal != null && principal.getName() != null); + Set<Principal> roles = validatorResponse.getRoles(); + assertTrue(roles != null && !roles.isEmpty()); + assertTrue(roles.iterator().next().getName().equals("manager")); + } + + @org.junit.Test + public void testSAML2AssertionWithRolesCaching() throws Exception { + TokenValidator samlTokenValidator = new SAMLTokenValidator(); + TokenValidatorParameters validatorParameters = createValidatorParameters(); + TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements(); + + // Create a ValidateTarget consisting of a SAML Assertion + Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties()); + CallbackHandler callbackHandler = new PasswordCallbackHandler(); + Element samlToken = + createSAMLAssertionWithRoles(WSConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", + callbackHandler, "employee"); + Document doc = samlToken.getOwnerDocument(); + samlToken = (Element)doc.appendChild(samlToken); + + ReceivedToken validateTarget = new ReceivedToken(samlToken); + tokenRequirements.setValidateTarget(validateTarget); + validatorParameters.setToken(validateTarget); + + assertTrue(samlTokenValidator.canHandleToken(validateTarget)); + + TokenValidatorResponse validatorResponse = + samlTokenValidator.validateToken(validatorParameters); + assertTrue(validatorResponse != null); + assertTrue(validatorResponse.getToken() != null); + assertTrue(validatorResponse.getToken().getState() == STATE.VALID); + + Principal principal = validatorResponse.getPrincipal(); + assertTrue(principal != null && principal.getName() != null); + Set<Principal> roles = validatorResponse.getRoles(); + assertTrue(roles != null && !roles.isEmpty()); + assertTrue(roles.iterator().next().getName().equals("employee")); + } + + /** + * Test an invalid SAML 2 Assertion + */ + @org.junit.Test + public void testInvalidSAML2Assertion() throws Exception { + TokenValidator samlTokenValidator = new SAMLTokenValidator(); + TokenValidatorParameters validatorParameters = createValidatorParameters(); + TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements(); + + // Create a ValidateTarget consisting of a SAML Assertion + Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties()); + CallbackHandler callbackHandler = new PasswordCallbackHandler(); + Element samlToken = + createSAMLAssertion(WSConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", callbackHandler); + Document doc = samlToken.getOwnerDocument(); + samlToken = (Element)doc.appendChild(samlToken); + + ReceivedToken validateTarget = new ReceivedToken(samlToken); + tokenRequirements.setValidateTarget(validateTarget); + validatorParameters.setToken(validateTarget); + + assertTrue(samlTokenValidator.canHandleToken(validateTarget)); + + TokenValidatorResponse validatorResponse = + samlTokenValidator.validateToken(validatorParameters); + assertTrue(validatorResponse != null); + assertTrue(validatorResponse.getToken() != null); + assertTrue(validatorResponse.getToken().getState() == STATE.VALID); + + // Replace "alice" with "bob". + Element nameID = + (Element)samlToken.getElementsByTagNameNS(WSConstants.SAML2_NS, "NameID").item(0); + nameID.setTextContent("bob"); + + // Now validate again + validateTarget = new ReceivedToken(samlToken); + tokenRequirements.setValidateTarget(validateTarget); + validatorParameters.setToken(validateTarget); + + assertTrue(samlTokenValidator.canHandleToken(validateTarget)); + + validatorResponse = samlTokenValidator.validateToken(validatorParameters); + assertTrue(validatorResponse != null); + assertTrue(validatorResponse.getToken() != null); + assertTrue(validatorResponse.getToken().getState() != STATE.VALID); + } + +>>>>>>> 15187c1... Merged revisions 1551228 via git cherry-pick from private TokenValidatorParameters createValidatorParameters() throws WSSecurityException { TokenValidatorParameters parameters = new TokenValidatorParameters(); @@ -520,5 +641,5 @@ public class SAMLTokenValidatorTest exte } } - + }
