Repository: cxf Updated Branches: refs/heads/master f801fab2f -> 187ace78d
Adding more SAML SSO tests Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/187ace78 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/187ace78 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/187ace78 Branch: refs/heads/master Commit: 187ace78dba4c71294960157ceed78f27b0be256 Parents: f801fab Author: Colm O hEigeartaigh <[email protected]> Authored: Thu Jan 15 13:29:50 2015 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Thu Jan 15 13:30:36 2015 +0000 ---------------------------------------------------------------------- .../saml/sso/SAMLResponseValidatorTest.java | 135 +++++++++++++++++++ 1 file changed, 135 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/187ace78/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java b/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java index f8aa84b..6717813 100644 --- a/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java +++ b/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java @@ -657,6 +657,141 @@ public class SAMLResponseValidatorTest extends org.junit.Assert { } } + @org.junit.Test + public void testFutureAuthnInstant() throws Exception { + DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + docBuilderFactory.setNamespaceAware(true); + DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); + Document doc = docBuilder.newDocument(); + + Status status = + SAML2PResponseComponentBuilder.createStatus( + SAMLProtocolResponseValidator.SAML2_STATUSCODE_SUCCESS, null + ); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse( + "http://cxf.apache.org/saml";, "http://cxf.apache.org/issuer";, status + ); + + // Create an AuthenticationAssertion + SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); + callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + callbackHandler.setIssuer("http://cxf.apache.org/issuer";); + callbackHandler.setConfirmationMethod(SAML2Constants.CONF_SENDER_VOUCHES); + callbackHandler.setAuthnInstant(new DateTime().plusDays(1)); + + SAMLCallback samlCallback = new SAMLCallback(); + SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); + SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback); + + response.getAssertions().add(assertion.getSaml2()); + + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + assertNotNull(policyElement); + + Response marshalledResponse = (Response)OpenSAMLUtil.fromDom(policyElement); + + // Validate the Response + SAMLProtocolResponseValidator validator = new SAMLProtocolResponseValidator(); + try { + validator.validateSamlResponse(marshalledResponse, null, null); + fail("Expected failure on an invalid Assertion AuthnInstant"); + } catch (WSSecurityException ex) { + // expected + } + } + + @org.junit.Test + public void testStaleSessionNotOnOrAfter() throws Exception { + DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + docBuilderFactory.setNamespaceAware(true); + DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); + Document doc = docBuilder.newDocument(); + + Status status = + SAML2PResponseComponentBuilder.createStatus( + SAMLProtocolResponseValidator.SAML2_STATUSCODE_SUCCESS, null + ); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse( + "http://cxf.apache.org/saml";, "http://cxf.apache.org/issuer";, status + ); + + // Create an AuthenticationAssertion + SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); + callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + callbackHandler.setIssuer("http://cxf.apache.org/issuer";); + callbackHandler.setConfirmationMethod(SAML2Constants.CONF_SENDER_VOUCHES); + callbackHandler.setSessionNotOnOrAfter(new DateTime().minusDays(1)); + + SAMLCallback samlCallback = new SAMLCallback(); + SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); + SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback); + + response.getAssertions().add(assertion.getSaml2()); + + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + assertNotNull(policyElement); + + Response marshalledResponse = (Response)OpenSAMLUtil.fromDom(policyElement); + + // Validate the Response + SAMLProtocolResponseValidator validator = new SAMLProtocolResponseValidator(); + try { + validator.validateSamlResponse(marshalledResponse, null, null); + fail("Expected failure on an invalid SessionNotOnOrAfter"); + } catch (WSSecurityException ex) { + // expected + } + } + + @org.junit.Test + public void testInvalidSubjectLocality() throws Exception { + DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + docBuilderFactory.setNamespaceAware(true); + DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); + Document doc = docBuilder.newDocument(); + + Status status = + SAML2PResponseComponentBuilder.createStatus( + SAMLProtocolResponseValidator.SAML2_STATUSCODE_SUCCESS, null + ); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse( + "http://cxf.apache.org/saml";, "http://cxf.apache.org/issuer";, status + ); + + // Create an AuthenticationAssertion + SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); + callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + callbackHandler.setIssuer("http://cxf.apache.org/issuer";); + callbackHandler.setConfirmationMethod(SAML2Constants.CONF_SENDER_VOUCHES); + callbackHandler.setSubjectLocality("xyz.123", null); + + SAMLCallback samlCallback = new SAMLCallback(); + SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); + SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback); + + response.getAssertions().add(assertion.getSaml2()); + + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + assertNotNull(policyElement); + + Response marshalledResponse = (Response)OpenSAMLUtil.fromDom(policyElement); + + // Validate the Response + SAMLProtocolResponseValidator validator = new SAMLProtocolResponseValidator(); + try { + validator.validateSamlResponse(marshalledResponse, null, null); + fail("Expected failure on an invalid SessionNotOnOrAfter"); + } catch (WSSecurityException ex) { + // expected + } + } + /** * Sign a SAML Response * @throws Exception
