WebSSOProfileImpl extends AbstractProfileBase implements WebSSOProfile { public void sendAuthenticationRequest(SAMLMessageContext context, WebSSOProfileOptions options) throws SAMLException, MetadataProviderException, MessageEncodingException { if (!SPSSODescriptor.DEFAULT_ELEMENT_NAME.equals(context.getLocalEntityRole())) { throw new SAMLException("WebSSO can only be initialized for local SP, but localEntityRole is: " + context.getLocalEntityRole()); } SPSSODescriptor spDescriptor = (SPSSODescriptor) context.getLocalEntityRoleMetadata(); IDPSSODescriptor idpssoDescriptor = (IDPSSODescriptor) context.getPeerEntityRoleMetadata(); ExtendedMetadata idpExtendedMetadata = context.getPeerExtendedMetadata(); if (spDescriptor == null || idpssoDescriptor == null || idpExtendedMetadata == null) { throw new SAMLException("SPSSODescriptor, IDPSSODescriptor or IDPExtendedMetadata are not present in the SAMLContext"); } SingleSignOnService ssoService = getSingleSignOnService(options, idpssoDescriptor, spDescriptor); AssertionConsumerService consumerService = getAssertionConsumerService(options, idpssoDescriptor, spDescriptor); AuthnRequest authRequest = getAuthnRequest(context, options, consumerService, ssoService); context.setCommunicationProfileId(getProfileIdentifier()); context.setOutboundMessage(authRequest); context.setOutboundSAMLMessage(authRequest); context.setPeerEntityEndpoint(ssoService); context.setPeerEntityRoleMetadata(idpssoDescriptor); context.setPeerExtendedMetadata(idpExtendedMetadata); if (options.getRelayState() != null) { context.setRelayState(options.getRelayState()); } boolean sign = spDescriptor.isAuthnRequestsSigned() || idpssoDescriptor.getWantAuthnRequestsSigned(); sendMessage(context, sign); SAMLMessageStorage messageStorage = context.getMessageStorage(); if (messageStorage != null) { messageStorage.storeMessage(authRequest.getID(), authRequest); } } WebSSOProfileImpl();  WebSSOProfileImpl(SAMLProcessor processor, MetadataManager manager); @Override String getProfileIdentifier(); void sendAuthenticationRequest(SAMLMessageContext context, WebSSOProfileOptions options);  }
@Test(expected = SAMLException.class) public void testNoSPNameSet() throws Exception { samlContext.setLocalEntityId(null); samlContext.setLocalEntityMetadata(null); samlContext.setLocalEntityRole(null); samlContext.setLocalEntityRoleMetadata(null); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test(expected = MetadataProviderException.class) public void testMissingSP() throws Exception { MetadataManager manager = context.getBean("metadata", MetadataManager.class); while (manager.getProviders().size() > 0) { manager.removeMetadataProvider(manager.getProviders().iterator().next()); manager.refreshMetadata(); } expect(request.isSecure()).andReturn(false); expect(request.getAttribute(org.springframework.security.saml.SAMLConstants.LOCAL_ENTITY_ID)).andReturn(null); replyMock(); samlContext = contextProvider.getLocalAndPeerEntity(request, response); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test public void testDefaultIDP() throws Exception { storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test public void testPOSTSigned() throws Exception { options.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); verifyMock(); assertTrue(authnRequest.isSigned()); assertNotNull(authnRequest.getSignature()); }
@Test public void testSentCorrectly() throws Exception { options.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); assertNotNull(authnRequest.getID()); assertNotNull(authnRequest.getIssueInstant()); assertEquals(false, authnRequest.isForceAuthn()); assertEquals(false, authnRequest.isPassive()); assertEquals("http: assertEquals("http: assertEquals("http: assertEquals(org.opensaml.common.xml.SAMLConstants.SAML2_POST_BINDING_URI, authnRequest.getProtocolBinding()); assertEquals(org.opensaml.common.xml.SAMLConstants.SAML2_REDIRECT_BINDING_URI, samlContext.getPeerEntityEndpoint().getBinding()); verifyMock(); }
@Test(expected = MetadataProviderException.class) public void testInvalidBinding() throws Exception { options.setBinding("invalid"); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test(expected = MetadataProviderException.class) public void testUnsupportedConsumerIndex() throws Exception { options.setAssertionConsumerIndex(2); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test(expected = MetadataProviderException.class) public void testInvalidConsumerIndex() throws Exception { options.setAssertionConsumerIndex(20); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test(expected = MetadataProviderException.class) public void testBindingUnsupportedByIDP() throws Exception { String idpId = "http: samlContext.setPeerEntityId(idpId); samlContext.setPeerExtendedMetadata(metadata.getExtendedMetadata(idpId)); samlContext.setPeerEntityMetadata(metadata.getEntityDescriptor(idpId)); samlContext.setPeerEntityRoleMetadata(metadata.getRole(idpId, IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS)); options.setBinding("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test public void testNoSigningRequired() throws Exception { String idpId = "http: samlContext.setPeerEntityId(idpId); samlContext.setPeerExtendedMetadata(metadata.getExtendedMetadata(idpId)); samlContext.setPeerEntityMetadata(metadata.getEntityDescriptor(idpId)); samlContext.setPeerEntityRoleMetadata(metadata.getRole(idpId, IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS)); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); verifyMock(); assertTrue(!authnRequest.isSigned()); }
@Test(expected = MetadataProviderException.class) public void testNoAvailableBinding() throws Exception { String idpId = "http: samlContext.setPeerEntityId(idpId); samlContext.setPeerExtendedMetadata(metadata.getExtendedMetadata(idpId)); samlContext.setPeerEntityMetadata(metadata.getEntityDescriptor(idpId)); samlContext.setPeerEntityRoleMetadata(metadata.getRole(idpId, IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS)); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); }
@Test public void testPassive() throws Exception { options.setPassive(true); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); verifyMock(); assertEquals(false, authnRequest.isForceAuthn()); assertEquals(true, authnRequest.isPassive()); assertTrue(authnRequest.getScoping().getProxyCount() > 0); }
@Test public void testForce() throws Exception { options.setForceAuthN(true); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); verifyMock(); assertEquals(true, authnRequest.isForceAuthn()); assertEquals(false, authnRequest.isPassive()); assertTrue(authnRequest.getScoping().getProxyCount() > 0); }
@Test public void testSendRelayState() throws Exception { options.setRelayState("myRelayState"); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); verifyMock(); assertEquals("myRelayState", samlContext.getRelayState()); }
@Test public void testDisallowProxy() throws Exception { options.setProxyCount(null); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); verifyMock(); assertEquals(false, authnRequest.isForceAuthn()); assertEquals(false, authnRequest.isPassive()); assertNull(authnRequest.getScoping().getProxyCount()); }
@Test public void testRequesterIds() throws Exception { options.setIncludeScoping(true); List<String> ids = Arrays.asList("requesterId1", "requesterId2"); options.setRequesterIds(new HashSet<String>(ids)); storage.storeMessage((String) notNull(), (XMLObject) notNull()); replyMock(); profile.sendAuthenticationRequest(samlContext, options); AuthnRequest authnRequest = (AuthnRequest) samlContext.getOutboundSAMLMessage(); verifyMock(); List<RequesterID> requesterIDs = authnRequest.getScoping().getRequesterIDs(); assertEquals(2, requesterIDs.size()); assertTrue(ids.contains(requesterIDs.get(0).getRequesterID())); assertTrue(ids.contains(requesterIDs.get(1).getRequesterID())); }