CONNECTSamlAssertionValidator extends SamlAssertionValidator { @Override public Credential validate(final Credential credential, final RequestData data) throws WSSecurityException { if (credential == null || credential.getSamlAssertion() == null) { throw new WSSecurityException(ErrorCode.FAILED_CHECK, "noCredential"); } final SamlAssertionWrapper assertion = credential.getSamlAssertion(); String confirmMethod = null; final List<String> methods = assertion.getConfirmationMethods(); if (CollectionUtils.isNotEmpty(methods)) { confirmMethod = methods.get(0); } checkAssertion(assertion, confirmMethod); checkConditions(assertion); validateAssertion(assertion); checkSignedAssertion(assertion, data); return credential; } CONNECTSamlAssertionValidator();  CONNECTSamlAssertionValidator(final PropertyAccessor propertyAccessor); @Override Credential validate(final Credential credential, final RequestData data); void checkAttributes(SamlAssertionWrapper assertion);  }
@Test public void testValidate() throws WSSecurityException { final List<Boolean> checkedSignedAssertion = new ArrayList<>(); final Credential credential = new Credential(); final String SECRET_KEY = "secret"; credential.setSecretKey(SECRET_KEY.getBytes()); final RequestData data = mock(RequestData.class); final SamlAssertionWrapper assertion = mock(SamlAssertionWrapper.class, RETURNS_DEEP_STUBS); final Issuer issuer = mock(Issuer.class); credential.setSamlAssertion(assertion); final List<String> methods = new ArrayList<>(); final String METHOD_NAME = "urn:oasis:names:tc:SAML:" + "TESTING" + ":cm:holder-of-key"; methods.add(METHOD_NAME); final SAMLKeyInfo keyInfo = mock(SAMLKeyInfo.class); final org.opensaml.saml.saml2.core.Assertion saml2Assertion = mock(org.opensaml.saml.saml2.core.Assertion.class); final org.opensaml.saml.saml2.core.Conditions conditions = mock(org.opensaml.saml.saml2.core.Conditions.class); final DateTime testDate = new DateTime(); when(assertion.getConfirmationMethods()).thenReturn(methods); when(assertion.getSubjectKeyInfo()).thenReturn(keyInfo); when(assertion.isSigned()).thenReturn(true); when(assertion.getSamlVersion()).thenReturn(SAMLVersion.VERSION_20); when(assertion.getSaml2()).thenReturn(saml2Assertion); when(saml2Assertion.getConditions()).thenReturn(conditions); when(conditions.getNotOnOrAfter()).thenReturn(testDate.plusDays(1)); when(conditions.getNotBefore()).thenReturn(testDate.minusSeconds(5)); when(saml2Assertion.getIssuer()).thenReturn(issuer); final CONNECTSamlAssertionValidator validator = new CONNECTSamlAssertionValidator() { @Override protected void checkSignedAssertion(final SamlAssertionWrapper assertion, final RequestData data) throws WSSecurityException { checkedSignedAssertion.add(true); } @Override protected boolean validateAttributes() { return false; } }; final Credential resultCredential = validator.validate(credential, data); assertFalse(checkedSignedAssertion.isEmpty()); assertTrue(checkedSignedAssertion.get(0)); final String resultSecretKey = new String(resultCredential.getSecretKey()); assertEquals(resultSecretKey, SECRET_KEY); }