Repository: cxf-fediz Updated Branches: refs/heads/master a1fba8d71 -> 9da48791d
Create a SAML Response on an error Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/9da48791 Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/9da48791 Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/9da48791 Branch: refs/heads/master Commit: 9da48791d6d31366052518c9c6ccd25bdf82a4ca Parents: c564a8b Author: Colm O hEigeartaigh <[email protected]> Authored: Wed Mar 30 17:14:51 2016 +0100 Committer: Colm O hEigeartaigh <[email protected]> Committed: Wed Mar 30 17:43:11 2016 +0100 ---------------------------------------------------------------------- .../beans/samlsso/AuthnRequestValidator.java | 2 +- .../idp/beans/samlsso/SamlResponseCreator.java | 1 - .../beans/samlsso/SamlResponseErrorCreator.java | 97 ++++++++++ .../WEB-INF/flows/saml-signin-request.xml | 13 +- .../WEB-INF/flows/saml-validate-request.xml | 19 +- .../apache/cxf/fediz/systests/idp/IdpTest.java | 183 +++++++++---------- 6 files changed, 202 insertions(+), 113 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/9da48791/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestValidator.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestValidator.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestValidator.java index cb90ed0..80f4d0c 100644 --- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestValidator.java +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestValidator.java @@ -152,7 +152,7 @@ public class AuthnRequestValidator { LOG.debug("Validating destination: {}", destination); String localAddr = WebUtils.getHttpServletRequest(context).getRequestURL().toString(); - if (!localAddr.startsWith(destination)) { + if (destination == null || !localAddr.startsWith(destination)) { LOG.debug("The destination {} does not match the local address {}", destination, localAddr); throw new ProcessingException(TYPE.BAD_REQUEST); } http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/9da48791/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java index c0c0d22..a9aadf5 100644 --- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseCreator.java @@ -89,7 +89,6 @@ public class SamlResponseCreator { Element response = createResponse(idp, requestId, saml2Assertion); return encodeResponse(response); } catch (Exception ex) { - ex.printStackTrace(); LOG.warn("Error marshalling SAML Token: {}", ex.getMessage()); throw new ProcessingException(TYPE.BAD_REQUEST); } http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/9da48791/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseErrorCreator.java ---------------------------------------------------------------------- diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseErrorCreator.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseErrorCreator.java new file mode 100644 index 0000000..24b21f4 --- /dev/null +++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/SamlResponseErrorCreator.java @@ -0,0 +1,97 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.cxf.fediz.service.idp.beans.samlsso; + +import java.io.IOException; + +import org.w3c.dom.Document; +import org.w3c.dom.Element; + +import org.apache.cxf.common.util.Base64Utility; +import org.apache.cxf.fediz.core.exception.ProcessingException; +import org.apache.cxf.fediz.core.exception.ProcessingException.TYPE; +import org.apache.cxf.fediz.service.idp.domain.Idp; +import org.apache.cxf.fediz.service.idp.samlsso.SAML2PResponseComponentBuilder; +import org.apache.cxf.helpers.DOMUtils; +import org.apache.cxf.rs.security.saml.DeflateEncoderDecoder; +import org.apache.wss4j.common.saml.OpenSAMLUtil; +import org.apache.wss4j.common.util.DOM2Writer; +import org.opensaml.saml.saml2.core.Response; +import org.opensaml.saml.saml2.core.Status; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.stereotype.Component; +import org.springframework.webflow.execution.RequestContext; + +/** + * Create a SAML Error Response + */ +@Component +public class SamlResponseErrorCreator { + + private static final Logger LOG = LoggerFactory.getLogger(SamlResponseErrorCreator.class); + private boolean supportDeflateEncoding = true; + + public String createSAMLResponse(RequestContext context, boolean requestor, + Idp idp, String requestID) throws ProcessingException { + Document doc = DOMUtils.newDocument(); + + String statusValue = "urn:oasis:names:tc:SAML:2.0:status:Responder"; + if (requestor) { + statusValue = "urn:oasis:names:tc:SAML:2.0:status:Requester"; + } + Status status = + SAML2PResponseComponentBuilder.createStatus(statusValue, null); + Response response = + SAML2PResponseComponentBuilder.createSAMLResponse(requestID, idp.getRealm(), status); + + try { + Element policyElement = OpenSAMLUtil.toDom(response, doc); + doc.appendChild(policyElement); + + Element responseElement = policyElement; + return encodeResponse(responseElement); + } catch (Exception e) { + LOG.warn("Error marshalling SAML Token: {}", e.getMessage()); + throw new ProcessingException(TYPE.BAD_REQUEST); + } + } + + protected String encodeResponse(Element response) throws IOException { + String responseMessage = DOM2Writer.nodeToString(response); + LOG.debug("Created Response: {}", responseMessage); + + if (supportDeflateEncoding) { + DeflateEncoderDecoder encoder = new DeflateEncoderDecoder(); + byte[] deflatedBytes = encoder.deflateToken(responseMessage.getBytes("UTF-8")); + + return Base64Utility.encode(deflatedBytes); + } + + return Base64Utility.encode(responseMessage.getBytes()); + } + + public boolean isSupportDeflateEncoding() { + return supportDeflateEncoding; + } + + public void setSupportDeflateEncoding(boolean supportDeflateEncoding) { + this.supportDeflateEncoding = supportDeflateEncoding; + } +} http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/9da48791/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml ---------------------------------------------------------------------- diff --git a/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml b/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml index a609ae1..70f7452 100644 --- a/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml +++ b/services/idp/src/main/webapp/WEB-INF/flows/saml-signin-request.xml @@ -34,7 +34,7 @@ <set name="flowScope.homerealm" value="flowScope.idpConfig.realm" /> </on-entry> <if test="flowScope.idpConfig.getAuthenticationURIs() == null" - then="viewBadRequest" /> + then="scInternalServerError" /> <!-- check presence of cached IDP token for THIS realm --> <if test="externalContext.sessionMap[flowScope.homerealm] == null" then="cacheSecurityToken" else="checkTokenExpiry" /> @@ -52,7 +52,7 @@ <transition on="no" to="parseAndValidateSAMLRequest"> <set name="flowScope.idpToken" value="externalContext.sessionMap[flowScope.homerealm]" /> </transition> - <transition on-exception="java.lang.Throwable" to="viewBadRequest" /> + <transition on-exception="java.lang.Throwable" to="scInternalServerError" /> </action-state> <end-state id="redirectToLocalIDP"> @@ -103,7 +103,12 @@ <output name="saml_authn_request" value="flowScope.saml_authn_request" /> </end-state> - <!-- abnormal exit point : Http 400 Bad Request --> - <end-state id="viewBadRequest" /> + <!-- abnormal exit point --> + <end-state id="viewBadRequest"> + <output name="saml_authn_request" value="flowScope.saml_authn_request" /> + </end-state> + + <!-- abnormal exit point --> + <end-state id="scInternalServerError" /> </flow> http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/9da48791/services/idp/src/main/webapp/WEB-INF/flows/saml-validate-request.xml ---------------------------------------------------------------------- diff --git a/services/idp/src/main/webapp/WEB-INF/flows/saml-validate-request.xml b/services/idp/src/main/webapp/WEB-INF/flows/saml-validate-request.xml index 841a5d5..ef6d813 100644 --- a/services/idp/src/main/webapp/WEB-INF/flows/saml-validate-request.xml +++ b/services/idp/src/main/webapp/WEB-INF/flows/saml-validate-request.xml @@ -52,7 +52,9 @@ <set name="flowScope.idpToken" value="currentEvent.attributes.idpToken" /> <set name="flowScope.saml_authn_request" value="currentEvent.attributes.saml_authn_request" /> </transition> - <transition on="viewBadRequest" to="viewBadRequest" /> + <transition on="viewBadRequest" to="viewBadRequest"> + <set name="flowScope.saml_authn_request" value="currentEvent.attributes.saml_authn_request" /> + </transition> <transition on="scInternalServerError" to="scInternalServerError" /> <transition on="redirectToLocalIDP" to="redirectToLocalIDP" /> </subflow-state> @@ -96,12 +98,17 @@ </on-entry> </end-state> - <!-- abnormal exit point : Http 400 Bad Request --> - <end-state id="viewBadRequest" view="genericerror"> + <!-- abnormal exit point --> + <end-state id="viewBadRequest" view="samlsigninresponseform"> <on-entry> - <evaluate - expression="externalContext.nativeResponse.setStatus(400,flowRequestContext.currentTransition.toString())" /> - <!-- <set name="requestScope.reason" value="flowRequestContext.currentTransition" /> --> + <evaluate expression="authnRequestParser.retrieveConsumerURL(flowRequestContext)" + result="requestScope.samlAction"/> + <evaluate expression="authnRequestParser.retrieveRequestId(flowRequestContext)" + result="flowScope.requestId"/> + <evaluate expression="flowScope.RelayState" result="requestScope.relayState" /> + <evaluate expression="samlResponseErrorCreator.createSAMLResponse(flowRequestContext, true, flowScope.idpConfig, + flowScope.requestId)" + result="requestScope.samlResponse"/> </on-entry> </end-state> http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/9da48791/systests/samlsso/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java ---------------------------------------------------------------------- diff --git a/systests/samlsso/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java b/systests/samlsso/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java index aa974be..2af63be 100644 --- a/systests/samlsso/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java +++ b/systests/samlsso/src/test/java/org/apache/cxf/fediz/systests/idp/IdpTest.java @@ -32,7 +32,6 @@ import java.util.UUID; import org.w3c.dom.Document; import org.w3c.dom.Element; -import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException; import com.gargoylesoftware.htmlunit.WebClient; import com.gargoylesoftware.htmlunit.html.DomElement; import com.gargoylesoftware.htmlunit.html.DomNodeList; @@ -204,46 +203,13 @@ public class IdpTest { webClient.getOptions().setJavaScriptEnabled(true); Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - // Parse the form to get the token (SAMLResponse) - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - String samlResponse = null; - boolean foundRelayState = false; - for (DomElement result : results) { - if ("SAMLResponse".equals(result.getAttributeNS(null, "name"))) { - samlResponse = result.getAttributeNS(null, "value"); - } else if ("RelayState".equals(result.getAttributeNS(null, "name"))) { - foundRelayState = true; - Assert.assertEquals(result.getAttributeNS(null, "value"), relayState); - } - } - - Assert.assertNotNull(samlResponse); - Assert.assertTrue(foundRelayState); - - // Check the "action" - DomNodeList<DomElement> formResults = idpPage.getElementsByTagName("form"); - Assert.assertFalse(formResults.isEmpty()); - - DomElement formResult = formResults.get(0); - String action = formResult.getAttributeNS(null, "action"); - Assert.assertTrue(action.equals(consumerURL)); - - // Decode + verify response - byte[] deflatedToken = Base64Utility.decode(samlResponse); - InputStream inputStream = new DeflateEncoderDecoder().inflateToken(deflatedToken); - - Document responseDoc = StaxUtils.read(new InputStreamReader(inputStream, "UTF-8")); - - XMLObject responseObject = OpenSAMLUtil.fromDom(responseDoc.getDocumentElement()); - Assert.assertTrue(responseObject instanceof org.opensaml.saml.saml2.core.Response); - - org.opensaml.saml.saml2.core.Response samlResponseObject = - (org.opensaml.saml.saml2.core.Response)responseObject; - Assert.assertTrue(authnRequest.getID().equals(samlResponseObject.getInResponseTo())); + org.opensaml.saml.saml2.core.Response samlResponse = + parseSAMLResponse(idpPage, relayState, consumerURL, authnRequest.getID()); + String expected = "urn:oasis:names:tc:SAML:2.0:status:Success"; + Assert.assertEquals(expected, samlResponse.getStatus().getStatusCode().getValue()); // Check claims - String parsedResponse = DOM2Writer.nodeToString(responseDoc); + String parsedResponse = DOM2Writer.nodeToString(samlResponse.getDOM().getOwnerDocument()); String claim = ClaimTypes.FIRSTNAME.toString(); Assert.assertTrue(parsedResponse.contains(claim)); claim = ClaimTypes.LASTNAME.toString(); @@ -291,13 +257,13 @@ public class IdpTest { new UsernamePasswordCredentials(user, password)); webClient.getOptions().setJavaScriptEnabled(false); - try { - webClient.getPage(url); - Assert.fail("Failure expected on a bad issuer value"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 400); - } + final HtmlPage idpPage = webClient.getPage(url); + org.opensaml.saml.saml2.core.Response samlResponse = + parseSAMLResponse(idpPage, relayState, consumerURL, authnRequest.getID()); + String expected = "urn:oasis:names:tc:SAML:2.0:status:Requester"; + Assert.assertEquals(expected, samlResponse.getStatus().getStatusCode().getValue()); + webClient.close(); } @@ -337,12 +303,12 @@ public class IdpTest { new UsernamePasswordCredentials(user, password)); webClient.getOptions().setJavaScriptEnabled(false); - try { - webClient.getPage(url); - Assert.fail("Failure expected on no destination value"); - } catch (FailingHttpStatusCodeException ex) { - // expected - } + final HtmlPage idpPage = webClient.getPage(url); + + org.opensaml.saml.saml2.core.Response samlResponse = + parseSAMLResponse(idpPage, relayState, consumerURL, authnRequest.getID()); + String expected = "urn:oasis:names:tc:SAML:2.0:status:Requester"; + Assert.assertEquals(expected, samlResponse.getStatus().getStatusCode().getValue()); webClient.close(); } @@ -383,12 +349,12 @@ public class IdpTest { new UsernamePasswordCredentials(user, password)); webClient.getOptions().setJavaScriptEnabled(false); - try { - webClient.getPage(url); - Assert.fail("Failure expected on an unsigned request"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 400); - } + final HtmlPage idpPage = webClient.getPage(url); + + org.opensaml.saml.saml2.core.Response samlResponse = + parseSAMLResponse(idpPage, relayState, consumerURL, authnRequest.getID()); + String expected = "urn:oasis:names:tc:SAML:2.0:status:Requester"; + Assert.assertEquals(expected, samlResponse.getStatus().getStatusCode().getValue()); webClient.close(); } @@ -457,46 +423,13 @@ public class IdpTest { webClient.getOptions().setJavaScriptEnabled(true); Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); - // Parse the form to get the token (SAMLResponse) - DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); - - String samlResponse = null; - boolean foundRelayState = false; - for (DomElement result : results) { - if ("SAMLResponse".equals(result.getAttributeNS(null, "name"))) { - samlResponse = result.getAttributeNS(null, "value"); - } else if ("RelayState".equals(result.getAttributeNS(null, "name"))) { - foundRelayState = true; - Assert.assertEquals(result.getAttributeNS(null, "value"), relayState); - } - } - - Assert.assertNotNull(samlResponse); - Assert.assertTrue(foundRelayState); - - // Check the "action" - DomNodeList<DomElement> formResults = idpPage.getElementsByTagName("form"); - Assert.assertFalse(formResults.isEmpty()); - - DomElement formResult = formResults.get(0); - String action = formResult.getAttributeNS(null, "action"); - Assert.assertTrue(action.equals(consumerURL)); - - // Decode + verify response - byte[] deflatedToken = Base64Utility.decode(samlResponse); - InputStream inputStream = new DeflateEncoderDecoder().inflateToken(deflatedToken); - - Document responseDoc = StaxUtils.read(new InputStreamReader(inputStream, "UTF-8")); - - XMLObject responseObject = OpenSAMLUtil.fromDom(responseDoc.getDocumentElement()); - Assert.assertTrue(responseObject instanceof org.opensaml.saml.saml2.core.Response); - - org.opensaml.saml.saml2.core.Response samlResponseObject = - (org.opensaml.saml.saml2.core.Response)responseObject; - Assert.assertTrue(authnRequest.getID().equals(samlResponseObject.getInResponseTo())); + org.opensaml.saml.saml2.core.Response samlResponse = + parseSAMLResponse(idpPage, relayState, consumerURL, authnRequest.getID()); + String expected = "urn:oasis:names:tc:SAML:2.0:status:Success"; + Assert.assertEquals(expected, samlResponse.getStatus().getStatusCode().getValue()); // Check claims - String parsedResponse = DOM2Writer.nodeToString(responseDoc); + String parsedResponse = DOM2Writer.nodeToString(samlResponse.getDOM().getOwnerDocument()); String claim = ClaimTypes.FIRSTNAME.toString(); Assert.assertTrue(parsedResponse.contains(claim)); claim = ClaimTypes.LASTNAME.toString(); @@ -544,12 +477,12 @@ public class IdpTest { new UsernamePasswordCredentials(user, password)); webClient.getOptions().setJavaScriptEnabled(false); - try { - webClient.getPage(url); - Assert.fail("Failure expected on a bad RACS URL"); - } catch (FailingHttpStatusCodeException ex) { - Assert.assertEquals(ex.getStatusCode(), 400); - } + final HtmlPage idpPage = webClient.getPage(url); + + org.opensaml.saml.saml2.core.Response samlResponse = + parseSAMLResponse(idpPage, relayState, consumerURL, authnRequest.getID()); + String expected = "urn:oasis:names:tc:SAML:2.0:status:Requester"; + Assert.assertEquals(expected, samlResponse.getStatus().getStatusCode().getValue()); webClient.close(); } @@ -601,4 +534,52 @@ public class IdpTest { signableObject.releaseChildrenDOM(true); } + + private org.opensaml.saml.saml2.core.Response parseSAMLResponse(HtmlPage idpPage, + String relayState, + String consumerURL, + String authnRequestId + ) throws Exception { + Assert.assertEquals("IDP SignIn Response Form", idpPage.getTitleText()); + + // Parse the form to get the token (SAMLResponse) + DomNodeList<DomElement> results = idpPage.getElementsByTagName("input"); + + String samlResponse = null; + boolean foundRelayState = false; + for (DomElement result : results) { + if ("SAMLResponse".equals(result.getAttributeNS(null, "name"))) { + samlResponse = result.getAttributeNS(null, "value"); + } else if ("RelayState".equals(result.getAttributeNS(null, "name"))) { + foundRelayState = true; + Assert.assertEquals(result.getAttributeNS(null, "value"), relayState); + } + } + + Assert.assertNotNull(samlResponse); + Assert.assertTrue(foundRelayState); + + // Check the "action" + DomNodeList<DomElement> formResults = idpPage.getElementsByTagName("form"); + Assert.assertFalse(formResults.isEmpty()); + + DomElement formResult = formResults.get(0); + String action = formResult.getAttributeNS(null, "action"); + Assert.assertTrue(action.equals(consumerURL)); + + // Decode + verify response + byte[] deflatedToken = Base64Utility.decode(samlResponse); + InputStream inputStream = new DeflateEncoderDecoder().inflateToken(deflatedToken); + + Document responseDoc = StaxUtils.read(new InputStreamReader(inputStream, "UTF-8")); + + XMLObject responseObject = OpenSAMLUtil.fromDom(responseDoc.getDocumentElement()); + Assert.assertTrue(responseObject instanceof org.opensaml.saml.saml2.core.Response); + + org.opensaml.saml.saml2.core.Response samlResponseObject = + (org.opensaml.saml.saml2.core.Response)responseObject; + Assert.assertTrue(authnRequestId.equals(samlResponseObject.getInResponseTo())); + + return samlResponseObject; + } }
