Repository: cxf Updated Branches: refs/heads/2.7.x-fixes 9a0f2b28f -> 748b97767
Save roles from SAML SSO to allow authorization Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/748b9776 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/748b9776 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/748b9776 Branch: refs/heads/2.7.x-fixes Commit: 748b9776711a54e2a44792e721bc228409176a0f Parents: 9a0f2b2 Author: Colm O hEigeartaigh <[email protected]> Authored: Wed Mar 26 15:00:33 2014 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Wed Mar 26 15:00:33 2014 +0000 ---------------------------------------------------------------------- .../saml/sso/AbstractServiceProviderFilter.java | 40 ++++++++++++++------ 1 file changed, 28 insertions(+), 12 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/748b9776/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java index 1e9556f..5f7a19a 100644 --- a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java +++ b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java @@ -23,8 +23,11 @@ import java.io.StringReader; import java.net.URI; import java.net.URLEncoder; import java.security.Principal; +import java.util.HashSet; +import java.util.List; import java.util.Map; import java.util.ResourceBundle; +import java.util.Set; import java.util.UUID; import java.util.logging.Level; import java.util.logging.Logger; @@ -36,11 +39,11 @@ import javax.ws.rs.core.UriBuilder; import org.w3c.dom.Document; import org.w3c.dom.Element; - import org.apache.cxf.common.i18n.BundleUtils; import org.apache.cxf.common.logging.LogUtils; import org.apache.cxf.common.security.SimplePrincipal; import org.apache.cxf.helpers.DOMUtils; +import org.apache.cxf.interceptor.security.SAMLSecurityContext; import org.apache.cxf.jaxrs.ext.RequestHandler; import org.apache.cxf.jaxrs.impl.HttpHeadersImpl; import org.apache.cxf.jaxrs.impl.UriInfoImpl; @@ -52,6 +55,7 @@ import org.apache.cxf.rs.security.saml.sso.state.RequestState; import org.apache.cxf.rs.security.saml.sso.state.ResponseState; import org.apache.cxf.security.SecurityContext; import org.apache.cxf.staxutils.StaxUtils; +import org.apache.cxf.ws.security.SecurityConstants; import org.apache.ws.security.saml.ext.AssertionWrapper; import org.apache.ws.security.saml.ext.OpenSAMLUtil; import org.opensaml.saml2.core.AuthnRequest; @@ -177,19 +181,31 @@ public abstract class AbstractServiceProviderFilter extends AbstractSSOSpHandler // don't worry about roles/claims for now, just set a basic SecurityContext Subject subject = SAMLUtils.getSubject(m, assertionWrapper); final String name = subject.getName(); - if (name != null) { - final SecurityContext sc = new SecurityContext() { - - public Principal getUserPrincipal() { - return new SimplePrincipal(name); - } - - public boolean isUserInRole(String role) { - return false; + String roleAttributeName = (String)m.getContextualProperty( + SecurityConstants.SAML_ROLE_ATTRIBUTENAME); + if (roleAttributeName == null || roleAttributeName.length() == 0) { + roleAttributeName = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";; + } + List<String> roles = + org.apache.cxf.ws.security.wss4j.SAMLUtils.parseRolesInAssertion(assertionWrapper, roleAttributeName); + final Set<Principal> userRoles; + if (roles != null) { + userRoles = new HashSet<Principal>(); + for (String role : roles) { + userRoles.add(new SimplePrincipal(role)); } - }; - m.put(SecurityContext.class, sc); + } else { + userRoles = null; + } + + SAMLSecurityContext context = + new SAMLSecurityContext(new SimplePrincipal(name), userRoles); + context.setIssuer(org.apache.cxf.ws.security.wss4j.SAMLUtils.getIssuer(assertionWrapper)); + context.setAssertionElement( + org.apache.cxf.ws.security.wss4j.SAMLUtils.getAssertionElement(assertionWrapper)); + + m.put(SecurityContext.class, context); } }
