Adding more SAML SSO tests
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/2e5b5533 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/2e5b5533 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/2e5b5533 Branch: refs/heads/2.7.x-fixes Commit: 2e5b553313e09917e1bb9ae281e0603ac6c134b5 Parents: df1e1db Author: Colm O hEigeartaigh <[email protected]> Authored: Thu Jan 15 13:29:50 2015 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Thu Jan 15 14:24:21 2015 +0000 ---------------------------------------------------------------------- .../saml/sso/SAMLResponseValidatorTest.java | 135 +++++++++++++++++++ 1 file changed, 135 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/2e5b5533/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java b/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java index 56f910a..6ed7f0e 100644 --- a/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java +++ b/rt/rs/security/sso/saml/src/test/java/org/apache/cxf/rs/security/saml/sso/SAMLResponseValidatorTest.java @@ -653,6 +653,141 @@ public class SAMLResponseValidatorTest extends org.junit.Assert { } } + @org.junit.Test + public void testFutureAuthnInstant() throws Exception { + DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + docBuilderFactory.setNamespaceAware(true); + DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); + Document doc = docBuilder.newDocument(); + + Status status = + SAML2PResponseComponentBuilder.createStatus( + SAMLProtocolResponseValidator.SAML2_STATUSCODE_SUCCESS, null + ); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse( + "http://cxf.apache.org/saml";, "http://cxf.apache.org/issuer";, status + ); + + // Create an AuthenticationAssertion + SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); + callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + callbackHandler.setIssuer("http://cxf.apache.org/issuer";); + callbackHandler.setConfirmationMethod(SAML2Constants.CONF_SENDER_VOUCHES); + callbackHandler.setAuthnInstant(new DateTime().plusDays(1)); + + SAMLCallback samlCallback = new SAMLCallback(); + SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); + SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback); + + response.getAssertions().add(assertion.getSaml2()); + + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + assertNotNull(policyElement); + + Response marshalledResponse = (Response)OpenSAMLUtil.fromDom(policyElement); + + // Validate the Response + SAMLProtocolResponseValidator validator = new SAMLProtocolResponseValidator(); + try { + validator.validateSamlResponse(marshalledResponse, null, null); + fail("Expected failure on an invalid Assertion AuthnInstant"); + } catch (WSSecurityException ex) { + // expected + } + } + + @org.junit.Test + public void testStaleSessionNotOnOrAfter() throws Exception { + DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + docBuilderFactory.setNamespaceAware(true); + DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); + Document doc = docBuilder.newDocument(); + + Status status = + SAML2PResponseComponentBuilder.createStatus( + SAMLProtocolResponseValidator.SAML2_STATUSCODE_SUCCESS, null + ); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse( + "http://cxf.apache.org/saml";, "http://cxf.apache.org/issuer";, status + ); + + // Create an AuthenticationAssertion + SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); + callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + callbackHandler.setIssuer("http://cxf.apache.org/issuer";); + callbackHandler.setConfirmationMethod(SAML2Constants.CONF_SENDER_VOUCHES); + callbackHandler.setSessionNotOnOrAfter(new DateTime().minusDays(1)); + + SAMLCallback samlCallback = new SAMLCallback(); + SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); + SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback); + + response.getAssertions().add(assertion.getSaml2()); + + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + assertNotNull(policyElement); + + Response marshalledResponse = (Response)OpenSAMLUtil.fromDom(policyElement); + + // Validate the Response + SAMLProtocolResponseValidator validator = new SAMLProtocolResponseValidator(); + try { + validator.validateSamlResponse(marshalledResponse, null, null); + fail("Expected failure on an invalid SessionNotOnOrAfter"); + } catch (WSSecurityException ex) { + // expected + } + } + + @org.junit.Test + public void testInvalidSubjectLocality() throws Exception { + DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance(); + docBuilderFactory.setNamespaceAware(true); + DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); + Document doc = docBuilder.newDocument(); + + Status status = + SAML2PResponseComponentBuilder.createStatus( + SAMLProtocolResponseValidator.SAML2_STATUSCODE_SUCCESS, null + ); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse( + "http://cxf.apache.org/saml";, "http://cxf.apache.org/issuer";, status + ); + + // Create an AuthenticationAssertion + SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); + callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + callbackHandler.setIssuer("http://cxf.apache.org/issuer";); + callbackHandler.setConfirmationMethod(SAML2Constants.CONF_SENDER_VOUCHES); + callbackHandler.setSubjectLocality("xyz.123", null); + + SAMLCallback samlCallback = new SAMLCallback(); + SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); + SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback); + + response.getAssertions().add(assertion.getSaml2()); + + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + assertNotNull(policyElement); + + Response marshalledResponse = (Response)OpenSAMLUtil.fromDom(policyElement); + + // Validate the Response + SAMLProtocolResponseValidator validator = new SAMLProtocolResponseValidator(); + try { + validator.validateSamlResponse(marshalledResponse, null, null); + fail("Expected failure on an invalid SessionNotOnOrAfter"); + } catch (WSSecurityException ex) { + // expected + } + } + /** * Sign a SAML Response */
