WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { protected void verifySubject(Subject subject, AuthnRequest request, SAMLMessageContext context) throws SAMLException, DecryptionException { for (SubjectConfirmation confirmation : subject.getSubjectConfirmations()) { if (SubjectConfirmation.METHOD_BEARER.equals(confirmation.getMethod())) { log.debug("Processing Bearer subject confirmation"); SubjectConfirmationData data = confirmation.getSubjectConfirmationData(); if (data == null) { log.debug("Bearer SubjectConfirmation invalidated by missing confirmation data"); continue; } if (data.getNotBefore() != null) { log.debug("Bearer SubjectConfirmation invalidated by not before which is forbidden"); continue; } if (data.getNotOnOrAfter() == null) { log.debug("Bearer SubjectConfirmation invalidated by missing notOnOrAfter"); continue; } if (data.getNotOnOrAfter().plusSeconds(getResponseSkew()).isBeforeNow()) { log.debug("Bearer SubjectConfirmation invalidated by notOnOrAfter"); continue; } if (request != null) { if (data.getInResponseTo() == null) { log.debug("Bearer SubjectConfirmation invalidated by missing inResponseTo field"); continue; } else { if (!data.getInResponseTo().equals(request.getID())) { log.debug("Bearer SubjectConfirmation invalidated by invalid in response to"); continue; } } } if (data.getRecipient() == null) { log.debug("Bearer SubjectConfirmation invalidated by missing recipient"); continue; } else { try { verifyEndpoint(context.getLocalEntityEndpoint(), data.getRecipient()); } catch (SAMLException e) { log.debug("Bearer SubjectConfirmation invalidated by recipient assertion consumer URL, found {}", data.getRecipient()); continue; } } NameID nameID; if (subject.getEncryptedID() != null) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt NameID, no decrypter is set in the context"); nameID = (NameID) context.getLocalDecrypter().decrypt(subject.getEncryptedID()); } else { nameID = subject.getNameID(); } context.setSubjectNameIdentifier(nameID); return; } } throw new SAMLException("Assertion invalidated by subject confirmation - can't be confirmed by the bearer method"); } WebSSOProfileConsumerImpl();  WebSSOProfileConsumerImpl(SAMLProcessor processor, MetadataManager manager); @Override String getProfileIdentifier(); SAMLCredential processAuthenticationResponse(SAMLMessageContext context); long getMaxAuthenticationAge(); void setMaxAuthenticationAge(long maxAuthenticationAge); boolean isIncludeAllAttributes(); void setIncludeAllAttributes(boolean includeAllAttributes); boolean isReleaseDOM(); void setReleaseDOM(boolean releaseDOM);  }
@Test public void verifySubject() throws Exception { SubjectConfirmationData subjectConfirmationData = ((SAMLObjectBuilder<SubjectConfirmationData>) builderFactory.getBuilder(SubjectConfirmationData.DEFAULT_ELEMENT_NAME)).buildObject(); subjectConfirmationData.setNotOnOrAfter(new DateTime().minusSeconds(10)); subjectConfirmationData.setRecipient("https: SAMLObjectBuilder<SubjectConfirmation> subjectConfirmationBuilder = (SAMLObjectBuilder<SubjectConfirmation>) builderFactory.getBuilder(SubjectConfirmation.DEFAULT_ELEMENT_NAME); SubjectConfirmation subjectConfirmation = subjectConfirmationBuilder.buildObject(); subjectConfirmation.setMethod(SubjectConfirmation.METHOD_BEARER); subjectConfirmation.setSubjectConfirmationData(subjectConfirmationData); SAMLObjectBuilder<Subject> subjectBuilder = (SAMLObjectBuilder<Subject>) builderFactory.getBuilder(Subject.DEFAULT_ELEMENT_NAME); Subject subject = subjectBuilder.buildObject(); subject.getSubjectConfirmations().add(subjectConfirmation); profile.verifySubject(subject, null, messageContext); }
@Test(expected = SAMLException.class) public void verifySubjectNotOnOrAfterExceeded() throws Exception { SubjectConfirmationData subjectConfirmationData = ((SAMLObjectBuilder<SubjectConfirmationData>) builderFactory.getBuilder(SubjectConfirmationData.DEFAULT_ELEMENT_NAME)).buildObject(); subjectConfirmationData.setNotOnOrAfter(new DateTime().minusSeconds(70)); subjectConfirmationData.setRecipient("https: SAMLObjectBuilder<SubjectConfirmation> subjectConfirmationBuilder = (SAMLObjectBuilder<SubjectConfirmation>) builderFactory.getBuilder(SubjectConfirmation.DEFAULT_ELEMENT_NAME); SubjectConfirmation subjectConfirmation = subjectConfirmationBuilder.buildObject(); subjectConfirmation.setMethod(SubjectConfirmation.METHOD_BEARER); subjectConfirmation.setSubjectConfirmationData(subjectConfirmationData); SAMLObjectBuilder<Subject> subjectBuilder = (SAMLObjectBuilder<Subject>) builderFactory.getBuilder(Subject.DEFAULT_ELEMENT_NAME); Subject subject = subjectBuilder.buildObject(); subject.getSubjectConfirmations().add(subjectConfirmation); profile.verifySubject(subject, null, messageContext); }
@Test(expected = SAMLException.class) public void verifySubjectMissingNotOnOrAfter() throws Exception { SubjectConfirmationData subjectConfirmationData = ((SAMLObjectBuilder<SubjectConfirmationData>) builderFactory.getBuilder(SubjectConfirmationData.DEFAULT_ELEMENT_NAME)).buildObject(); subjectConfirmationData.setRecipient("https: SAMLObjectBuilder<SubjectConfirmation> subjectConfirmationBuilder = (SAMLObjectBuilder<SubjectConfirmation>) builderFactory.getBuilder(SubjectConfirmation.DEFAULT_ELEMENT_NAME); SubjectConfirmation subjectConfirmation = subjectConfirmationBuilder.buildObject(); subjectConfirmation.setMethod(SubjectConfirmation.METHOD_BEARER); subjectConfirmation.setSubjectConfirmationData(subjectConfirmationData); SAMLObjectBuilder<Subject> subjectBuilder = (SAMLObjectBuilder<Subject>) builderFactory.getBuilder(Subject.DEFAULT_ELEMENT_NAME); Subject subject = subjectBuilder.buildObject(); subject.getSubjectConfirmations().add(subjectConfirmation); profile.verifySubject(subject, null, messageContext); }