WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { protected void verifyAssertionConditions(Conditions conditions, SAMLMessageContext context, boolean audienceRequired) throws SAMLException { if (audienceRequired && (conditions == null || conditions.getAudienceRestrictions().size() == 0)) { throw new SAMLException("Assertion invalidated by missing Audience Restriction"); } if (conditions == null) { return; } if (conditions.getNotBefore() != null) { if (conditions.getNotBefore().minusSeconds(getResponseSkew()).isAfterNow()) { throw new SAMLException("Assertion is not yet valid, invalidated by condition notBefore " + conditions.getNotBefore()); } } if (conditions.getNotOnOrAfter() != null) { if (conditions.getNotOnOrAfter().plusSeconds(getResponseSkew()).isBeforeNow()) { throw new SAMLException("Assertion is no longer valid, invalidated by condition notOnOrAfter " + conditions.getNotOnOrAfter()); } } List<Condition> notUnderstoodConditions = new LinkedList<Condition>(); for (Condition condition : conditions.getConditions()) { QName conditionQName = condition.getElementQName(); if (conditionQName.equals(AudienceRestriction.DEFAULT_ELEMENT_NAME)) { verifyAudience(context, conditions.getAudienceRestrictions()); } else if (conditionQName.equals(OneTimeUse.DEFAULT_ELEMENT_NAME)) { throw new SAMLException("System cannot honor OneTimeUse condition of the Assertion for WebSSO"); } else if (conditionQName.equals(ProxyRestriction.DEFAULT_ELEMENT_NAME)) { ProxyRestriction restriction = (ProxyRestriction) condition; log.debug("Honoring ProxyRestriction with count {}, system does not issue assertions to 3rd parties", restriction.getProxyCount()); } else { log.debug("Condition {} is not understood", condition); notUnderstoodConditions.add(condition); } } verifyConditions(context, notUnderstoodConditions); } WebSSOProfileConsumerImpl();  WebSSOProfileConsumerImpl(SAMLProcessor processor, MetadataManager manager); @Override String getProfileIdentifier(); SAMLCredential processAuthenticationResponse(SAMLMessageContext context); long getMaxAuthenticationAge(); void setMaxAuthenticationAge(long maxAuthenticationAge); boolean isIncludeAllAttributes(); void setIncludeAllAttributes(boolean includeAllAttributes); boolean isReleaseDOM(); void setReleaseDOM(boolean releaseDOM);  }
@Test public void testCondition_empty() throws Exception { SAMLObjectBuilder<Conditions> builder = (SAMLObjectBuilder<Conditions>) builderFactory.getBuilder(Conditions.DEFAULT_ELEMENT_NAME); Conditions conditions = builder.buildObject(); profile.verifyAssertionConditions(conditions, messageContext, false); }
@Test(expected = SAMLException.class) public void testCondition_empty_audienceRequired() throws Exception { SAMLObjectBuilder<Conditions> builder = (SAMLObjectBuilder<Conditions>) builderFactory.getBuilder(Conditions.DEFAULT_ELEMENT_NAME); Conditions conditions = builder.buildObject(); profile.verifyAssertionConditions(conditions, messageContext, true); }
@Test public void testCondition_Audience_pass() throws Exception { SAMLObjectBuilder<Conditions> builder = (SAMLObjectBuilder<Conditions>) builderFactory.getBuilder(Conditions.DEFAULT_ELEMENT_NAME); Conditions conditions = builder.buildObject(); conditions.getConditions().add(helper.getAudienceRestriction("anotherURI", messageContext.getLocalEntityId(), "yetAnotherURI")); profile.verifyAssertionConditions(conditions, messageContext, true); }
@Test(expected = SAMLException.class) public void testCondition_Audience_two_restrictions_pass() throws Exception { SAMLObjectBuilder<Conditions> builder = (SAMLObjectBuilder<Conditions>) builderFactory.getBuilder(Conditions.DEFAULT_ELEMENT_NAME); Conditions conditions = builder.buildObject(); conditions.getConditions().add(helper.getAudienceRestriction("anotherAudience", "yetAnotherURI")); conditions.getConditions().add(helper.getAudienceRestriction(messageContext.getLocalEntityId())); profile.verifyAssertionConditions(conditions, messageContext, true); }
@Test(expected = SAMLException.class) public void testCondition_Audience_fail() throws Exception { SAMLObjectBuilder<Conditions> builder = (SAMLObjectBuilder<Conditions>) builderFactory.getBuilder(Conditions.DEFAULT_ELEMENT_NAME); Conditions conditions = builder.buildObject(); conditions.getConditions().add(helper.getAudienceRestriction("wrong")); profile.verifyAssertionConditions(conditions, messageContext, true); }
@Test(expected = SAMLException.class) public void testCondition_OneTimeUse() throws Exception { SAMLObjectBuilder<Conditions> builder = (SAMLObjectBuilder<Conditions>) builderFactory.getBuilder(Conditions.DEFAULT_ELEMENT_NAME); Conditions conditions = builder.buildObject(); conditions.getConditions().add(helper.getAudienceRestriction(messageContext.getLocalEntityId())); conditions.getConditions().add(((SAMLObjectBuilder<OneTimeUse>) builderFactory.getBuilder(OneTimeUse.DEFAULT_ELEMENT_NAME)).buildObject()); profile.verifyAssertionConditions(conditions, messageContext, true); }