Repository: cxf-fediz Updated Branches: refs/heads/master d45d94f06 -> 601548914
FEDIZ-159 - whr propagation can be disabled Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/60154891 Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/60154891 Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/60154891 Branch: refs/heads/master Commit: 6015489148d93797c80a7173128fe35bae5aa651 Parents: d45d94f Author: Colm O hEigeartaigh <[email protected]> Authored: Mon Mar 14 16:05:01 2016 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Mon Mar 14 16:05:01 2016 +0000 ---------------------------------------------------------------------- .../AbstractTrustedIdpProtocolHandler.java | 130 +++++++++++++++++++ .../TrustedIdpOIDCProtocolHandler.java | 81 +----------- .../TrustedIdpSAMLProtocolHandler.java | 67 +--------- .../TrustedIdpWSFedProtocolHandler.java | 23 ++-- 4 files changed, 149 insertions(+), 152 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/60154891/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpProtocolHandler.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpProtocolHandler.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpProtocolHandler.java new file mode 100644 index 0000000..fb3ec72 --- /dev/null +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpProtocolHandler.java @@ -0,0 +1,130 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.cxf.fediz.service.idp.protocols; + +import java.io.IOException; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.Collections; +import java.util.Map; + +import javax.servlet.http.HttpServletRequest; + +import org.apache.cxf.fediz.core.exception.ProcessingException; +import org.apache.cxf.fediz.core.util.CertsUtils; +import org.apache.cxf.fediz.service.idp.domain.TrustedIdp; +import org.apache.cxf.fediz.service.idp.spi.TrustedIdpProtocolHandler; +import org.apache.wss4j.common.crypto.CertificateStore; +import org.apache.wss4j.common.crypto.Crypto; +import org.apache.wss4j.common.ext.WSSecurityException; +import org.apache.xml.security.exceptions.Base64DecodingException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public abstract class AbstractTrustedIdpProtocolHandler implements TrustedIdpProtocolHandler { + + private static final Logger LOG = LoggerFactory.getLogger(AbstractTrustedIdpProtocolHandler.class); + + @Override + public boolean canHandleRequest(HttpServletRequest request) { + // TODO Auto-generated method stub + return false; + } + + protected Crypto getCrypto(String certificate) throws ProcessingException { + if (certificate == null) { + return null; + } + + boolean isCertificateLocation = !certificate.startsWith("-----BEGIN CERTIFICATE"); + if (isCertificateLocation) { + try { + X509Certificate cert = CertsUtils.getX509Certificate(certificate); + if (cert == null) { + return null; + } + return new CertificateStore(new X509Certificate[]{cert}); + } catch (CertificateException ex) { + // Maybe it's a WSS4J properties file... + return CertsUtils.createCrypto(certificate); + } + } + + // Here the certificate is encoded in the configuration file + X509Certificate cert; + try { + cert = CertsUtils.parseCertificate(certificate); + } catch (Exception ex) { + LOG.error("Failed to parse trusted certificate", ex); + throw new ProcessingException("Failed to parse trusted certificate"); + } + return new CertificateStore(Collections.singletonList(cert).toArray(new X509Certificate[0])); + } + + protected X509Certificate getCertificate(String certificate) + throws CertificateException, WSSecurityException, ProcessingException, Base64DecodingException, IOException { + if (certificate == null) { + return null; + } + + boolean isCertificateLocation = !certificate.startsWith("-----BEGIN CERTIFICATE"); + if (isCertificateLocation) { + try { + return CertsUtils.getX509Certificate(certificate); + } catch (CertificateException ex) { + // Maybe it's a WSS4J properties file... + Crypto crypto = CertsUtils.createCrypto(certificate); + if (crypto != null) { + return CertsUtils.getX509Certificate(crypto, null); + } + } + } + + // Here the certificate is encoded in the configuration file + try { + return CertsUtils.parseCertificate(certificate); + } catch (Exception ex) { + LOG.error("Failed to parse trusted certificate", ex); + throw new ProcessingException("Failed to parse trusted certificate"); + } + } + + protected String getProperty(TrustedIdp trustedIdp, String property) { + Map<String, String> parameters = trustedIdp.getParameters(); + + if (parameters != null && parameters.containsKey(property)) { + return parameters.get(property); + } + + return null; + } + + // Is a property configured. Defaults to the boolean "defaultValue" if not + protected boolean isBooleanPropertyConfigured(TrustedIdp trustedIdp, String property, boolean defaultValue) { + Map<String, String> parameters = trustedIdp.getParameters(); + + if (parameters != null && parameters.containsKey(property)) { + return Boolean.parseBoolean(parameters.get(property)); + } + + return defaultValue; + } + +} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/60154891/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java index 6fb33da..0f40056 100644 --- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java @@ -27,7 +27,6 @@ import java.net.URLEncoder; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.util.ArrayList; -import java.util.Collections; import java.util.Date; import java.util.List; import java.util.Map; @@ -35,7 +34,6 @@ import java.util.Map; import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; import javax.security.auth.callback.UnsupportedCallbackException; -import javax.servlet.http.HttpServletRequest; import javax.ws.rs.core.Form; import javax.ws.rs.core.Response; @@ -44,12 +42,10 @@ import org.w3c.dom.Element; import org.apache.cxf.fediz.core.FederationConstants; import org.apache.cxf.fediz.core.exception.ProcessingException; -import org.apache.cxf.fediz.core.util.CertsUtils; import org.apache.cxf.fediz.core.util.DOMUtils; import org.apache.cxf.fediz.service.idp.IdpConstants; import org.apache.cxf.fediz.service.idp.domain.Idp; import org.apache.cxf.fediz.service.idp.domain.TrustedIdp; -import org.apache.cxf.fediz.service.idp.spi.TrustedIdpProtocolHandler; import org.apache.cxf.fediz.service.idp.util.WebUtils; import org.apache.cxf.interceptor.LoggingInInterceptor; import org.apache.cxf.interceptor.LoggingOutInterceptor; @@ -68,7 +64,6 @@ import org.apache.cxf.rs.security.oauth2.common.ClientAccessToken; import org.apache.cxf.rs.security.oauth2.provider.OAuthJSONProvider; import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants; import org.apache.cxf.ws.security.tokenstore.SecurityToken; -import org.apache.wss4j.common.crypto.CertificateStore; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.saml.SAMLCallback; @@ -86,7 +81,7 @@ import org.springframework.stereotype.Component; import org.springframework.webflow.execution.RequestContext; @Component -public class TrustedIdpOIDCProtocolHandler implements TrustedIdpProtocolHandler { +public class TrustedIdpOIDCProtocolHandler extends AbstractTrustedIdpProtocolHandler { /** * The client_id value to send to the OIDC IdP. @@ -130,12 +125,6 @@ public class TrustedIdpOIDCProtocolHandler implements TrustedIdpProtocolHandler private static final Logger LOG = LoggerFactory.getLogger(TrustedIdpOIDCProtocolHandler.class); @Override - public boolean canHandleRequest(HttpServletRequest request) { - // TODO Auto-generated method stub - return false; - } - - @Override public String getProtocol() { return PROTOCOL; } @@ -384,64 +373,6 @@ public class TrustedIdpOIDCProtocolHandler implements TrustedIdpProtocolHandler return false; } - private Crypto getCrypto(String certificate) throws ProcessingException { - if (certificate == null) { - return null; - } - - boolean isCertificateLocation = !certificate.startsWith("-----BEGIN CERTIFICATE"); - if (isCertificateLocation) { - try { - X509Certificate cert = CertsUtils.getX509Certificate(certificate); - if (cert == null) { - return null; - } - return new CertificateStore(new X509Certificate[]{cert}); - } catch (CertificateException ex) { - // Maybe it's a WSS4J properties file... - return CertsUtils.createCrypto(certificate); - } - } - - // Here the certificate is encoded in the configuration file - X509Certificate cert; - try { - cert = CertsUtils.parseCertificate(certificate); - } catch (Exception ex) { - LOG.error("Failed to parse trusted certificate", ex); - throw new ProcessingException("Failed to parse trusted certificate"); - } - return new CertificateStore(Collections.singletonList(cert).toArray(new X509Certificate[0])); - } - - private X509Certificate getCertificate(String certificate) - throws CertificateException, WSSecurityException, ProcessingException, Base64DecodingException, IOException { - if (certificate == null) { - return null; - } - - boolean isCertificateLocation = !certificate.startsWith("-----BEGIN CERTIFICATE"); - if (isCertificateLocation) { - try { - return CertsUtils.getX509Certificate(certificate); - } catch (CertificateException ex) { - // Maybe it's a WSS4J properties file... - Crypto crypto = CertsUtils.createCrypto(certificate); - if (crypto != null) { - return CertsUtils.getX509Certificate(crypto, null); - } - } - } - - // Here the certificate is encoded in the configuration file - try { - return CertsUtils.parseCertificate(certificate); - } catch (Exception ex) { - LOG.error("Failed to parse trusted certificate", ex); - throw new ProcessingException("Failed to parse trusted certificate"); - } - } - protected SamlAssertionWrapper createSamlAssertion(Idp idp, TrustedIdp trustedIdp, JwtToken token, Date created, Date expires) throws Exception { @@ -497,16 +428,6 @@ public class TrustedIdpOIDCProtocolHandler implements TrustedIdpProtocolHandler return assertion; } - private String getProperty(TrustedIdp trustedIdp, String property) { - Map<String, String> parameters = trustedIdp.getParameters(); - - if (parameters != null && parameters.containsKey(property)) { - return parameters.get(property); - } - - return null; - } - private static class SamlCallbackHandler implements CallbackHandler { private ConditionsBean conditionsBean; private SubjectBean subjectBean; http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/60154891/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpSAMLProtocolHandler.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpSAMLProtocolHandler.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpSAMLProtocolHandler.java index 1254eb4..00df355 100644 --- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpSAMLProtocolHandler.java +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpSAMLProtocolHandler.java @@ -29,10 +29,7 @@ import java.net.URL; import java.net.URLEncoder; import java.security.PrivateKey; import java.security.Signature; -import java.security.cert.CertificateException; import java.security.cert.X509Certificate; -import java.util.Collections; -import java.util.Map; import java.util.zip.DataFormatException; import javax.servlet.http.HttpServletRequest; @@ -46,13 +43,11 @@ import org.apache.cxf.common.util.Base64Exception; import org.apache.cxf.common.util.Base64Utility; import org.apache.cxf.common.util.StringUtils; import org.apache.cxf.fediz.core.FederationConstants; -import org.apache.cxf.fediz.core.exception.ProcessingException; import org.apache.cxf.fediz.core.util.CertsUtils; import org.apache.cxf.fediz.core.util.DOMUtils; import org.apache.cxf.fediz.service.idp.IdpConstants; import org.apache.cxf.fediz.service.idp.domain.Idp; import org.apache.cxf.fediz.service.idp.domain.TrustedIdp; -import org.apache.cxf.fediz.service.idp.spi.TrustedIdpProtocolHandler; import org.apache.cxf.fediz.service.idp.util.WebUtils; import org.apache.cxf.jaxrs.utils.ExceptionUtils; import org.apache.cxf.rs.security.saml.DeflateEncoderDecoder; @@ -66,7 +61,6 @@ import org.apache.cxf.rs.security.saml.sso.SSOValidatorResponse; import org.apache.cxf.rs.security.saml.sso.TokenReplayCache; import org.apache.cxf.staxutils.StaxUtils; import org.apache.cxf.ws.security.tokenstore.SecurityToken; -import org.apache.wss4j.common.crypto.CertificateStore; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.saml.OpenSAMLUtil; @@ -81,7 +75,7 @@ import org.springframework.stereotype.Component; import org.springframework.webflow.execution.RequestContext; @Component -public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler { +public class TrustedIdpSAMLProtocolHandler extends AbstractTrustedIdpProtocolHandler { /** * Whether to sign the request or not. The default is "true". */ @@ -126,12 +120,6 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler } @Override - public boolean canHandleRequest(HttpServletRequest request) { - // TODO Auto-generated method stub - return false; - } - - @Override public String getProtocol() { return PROTOCOL; } @@ -148,7 +136,7 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler null, idp.getRealm(), idp.getIdpUrl().toString() ); - boolean signRequest = isPropertyConfigured(trustedIdp, SIGN_REQUEST, true); + boolean signRequest = isBooleanPropertyConfigured(trustedIdp, SIGN_REQUEST, true); if (signRequest) { authnRequest.setDestination(trustedIdp.getUrl()); } @@ -301,36 +289,6 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler ub.queryParam(SSOConstants.SIGNATURE, URLEncoder.encode(encodedSignature, "UTF-8")); } - private Crypto getCrypto(String certificate) throws ProcessingException { - if (certificate == null) { - return null; - } - - boolean isCertificateLocation = !certificate.startsWith("-----BEGIN CERTIFICATE"); - if (isCertificateLocation) { - try { - X509Certificate cert = CertsUtils.getX509Certificate(certificate); - if (cert == null) { - return null; - } - return new CertificateStore(new X509Certificate[]{cert}); - } catch (CertificateException ex) { - // Maybe it's a WSS4J properties file... - return CertsUtils.createCrypto(certificate); - } - } - - // Here the certificate is encoded in the configuration file - X509Certificate cert; - try { - cert = CertsUtils.parseCertificate(certificate); - } catch (Exception ex) { - LOG.error("Failed to parse trusted certificate", ex); - throw new ProcessingException("Failed to parse trusted certificate"); - } - return new CertificateStore(Collections.singletonList(cert).toArray(new X509Certificate[0])); - } - private org.opensaml.saml.saml2.core.Response readSAMLResponse(String samlResponse, TrustedIdp trustedIdp) { if (StringUtils.isEmpty(samlResponse)) { throw ExceptionUtils.toBadRequestException(null, null); @@ -339,10 +297,10 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler String samlResponseDecoded = samlResponse; InputStream tokenStream = null; - if (isPropertyConfigured(trustedIdp, SUPPORT_BASE64_ENCODING, true)) { + if (isBooleanPropertyConfigured(trustedIdp, SUPPORT_BASE64_ENCODING, true)) { try { byte[] deflatedToken = Base64Utility.decode(samlResponseDecoded); - tokenStream = isPropertyConfigured(trustedIdp, SUPPORT_DEFLATE_ENCODING, false) + tokenStream = isBooleanPropertyConfigured(trustedIdp, SUPPORT_DEFLATE_ENCODING, false) ? new DeflateEncoderDecoder().inflateToken(deflatedToken) : new ByteArrayInputStream(deflatedToken); } catch (Base64Exception ex) { @@ -389,7 +347,7 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler try { SAMLProtocolResponseValidator protocolValidator = new SAMLProtocolResponseValidator(); protocolValidator.setKeyInfoMustBeAvailable( - isPropertyConfigured(trustedIdp, REQUIRE_KEYINFO, true)); + isBooleanPropertyConfigured(trustedIdp, REQUIRE_KEYINFO, true)); protocolValidator.validateSamlResponse(samlResponse, crypto, null); } catch (WSSecurityException ex) { LOG.debug(ex.getMessage(), ex); @@ -428,9 +386,9 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler ssoResponseValidator.setRequestId(requestId); ssoResponseValidator.setSpIdentifier(idp.getRealm()); ssoResponseValidator.setEnforceAssertionsSigned( - isPropertyConfigured(trustedIdp, REQUIRE_SIGNED_ASSERTIONS, true)); + isBooleanPropertyConfigured(trustedIdp, REQUIRE_SIGNED_ASSERTIONS, true)); ssoResponseValidator.setEnforceKnownIssuer( - isPropertyConfigured(trustedIdp, REQUIRE_KNOWN_ISSUER, true)); + isBooleanPropertyConfigured(trustedIdp, REQUIRE_KNOWN_ISSUER, true)); HttpServletRequest httpServletRequest = WebUtils.getHttpServletRequest(requestContext); boolean post = "POST".equals(httpServletRequest.getMethod()); @@ -445,17 +403,6 @@ public class TrustedIdpSAMLProtocolHandler implements TrustedIdpProtocolHandler } } - // Is a property configured. Defaults to "true" if not - private boolean isPropertyConfigured(TrustedIdp trustedIdp, String property, boolean defaultValue) { - Map<String, String> parameters = trustedIdp.getParameters(); - - if (parameters != null && parameters.containsKey(property)) { - return Boolean.parseBoolean(parameters.get(property)); - } - - return defaultValue; - } - public void setReplayCache(TokenReplayCache<String> replayCache) { this.replayCache = replayCache; } http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/60154891/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java index 201d9bf..cf75cab 100644 --- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java @@ -26,8 +26,6 @@ import java.net.URLEncoder; import java.security.cert.X509Certificate; import java.util.Collections; -import javax.servlet.http.HttpServletRequest; - import org.w3c.dom.Element; import org.apache.cxf.fediz.core.FederationConstants; import org.apache.cxf.fediz.core.config.FedizContext; @@ -50,7 +48,6 @@ import org.apache.cxf.fediz.core.util.CertsUtils; import org.apache.cxf.fediz.service.idp.IdpConstants; import org.apache.cxf.fediz.service.idp.domain.Idp; import org.apache.cxf.fediz.service.idp.domain.TrustedIdp; -import org.apache.cxf.fediz.service.idp.spi.TrustedIdpProtocolHandler; import org.apache.cxf.fediz.service.idp.util.WebUtils; import org.apache.cxf.ws.security.tokenstore.SecurityToken; import org.apache.wss4j.common.crypto.CertificateStore; @@ -61,19 +58,18 @@ import org.springframework.stereotype.Component; import org.springframework.webflow.execution.RequestContext; @Component -public class TrustedIdpWSFedProtocolHandler implements TrustedIdpProtocolHandler { +public class TrustedIdpWSFedProtocolHandler extends AbstractTrustedIdpProtocolHandler { + + /** + * Whether to add the home realm parameter to the URL for redirection or not. The default is "true". + */ + public static final String ENABLE_HOME_REALM = "enable.home.realm"; public static final String PROTOCOL = "http://docs.oasis-open.org/wsfed/federation/200706";; private static final Logger LOG = LoggerFactory.getLogger(TrustedIdpWSFedProtocolHandler.class); @Override - public boolean canHandleRequest(HttpServletRequest request) { - // TODO Auto-generated method stub - return false; - } - - @Override public String getProtocol() { return PROTOCOL; } @@ -90,8 +86,11 @@ public class TrustedIdpWSFedProtocolHandler implements TrustedIdpProtocolHandler sb.append(URLEncoder.encode(idp.getRealm(), "UTF-8")); sb.append("&").append(FederationConstants.PARAM_REPLY).append('='); sb.append(URLEncoder.encode(idp.getIdpUrl().toString(), "UTF-8")); - sb.append("&").append(FederationConstants.PARAM_HOME_REALM).append('='); - sb.append(trustedIdp.getRealm()); + + if (isBooleanPropertyConfigured(trustedIdp, ENABLE_HOME_REALM, true)) { + sb.append("&").append(FederationConstants.PARAM_HOME_REALM).append('='); + sb.append(trustedIdp.getRealm()); + } String wfresh = context.getFlowScope().getString(FederationConstants.PARAM_FRESHNESS); if (wfresh != null) {
