SAMLAuthenticationProvider implements AuthenticationProvider, InitializingBean { public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (!supports(authentication.getClass())) { throw new IllegalArgumentException("Only SAMLAuthenticationToken is supported, " + authentication.getClass() + " was attempted"); } SAMLAuthenticationToken token = (SAMLAuthenticationToken) authentication; SAMLMessageContext context = token.getCredentials(); if (context == null) { throw new AuthenticationServiceException("SAML message context is not available in the authentication token"); } SAMLCredential credential; try { if (SAMLConstants.SAML2_WEBSSO_PROFILE_URI.equals(context.getCommunicationProfileId())) { credential = consumer.processAuthenticationResponse(context); } else if (SAMLConstants.SAML2_HOK_WEBSSO_PROFILE_URI.equals(context.getCommunicationProfileId())) { credential = hokConsumer.processAuthenticationResponse(context); } else { throw new SAMLException("Unsupported profile encountered in the context " + context.getCommunicationProfileId()); } } catch (SAMLRuntimeException e) { log.debug("Error validating SAML message", e); samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e); throw new AuthenticationServiceException("Error validating SAML message", e); } catch (SAMLException e) { log.debug("Error validating SAML message", e); samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e); throw new AuthenticationServiceException("Error validating SAML message", e); } catch (ValidationException e) { log.debug("Error validating signature", e); samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e); throw new AuthenticationServiceException("Error validating SAML message signature", e); } catch (org.opensaml.xml.security.SecurityException e) { log.debug("Error validating signature", e); samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e); throw new AuthenticationServiceException("Error validating SAML message signature", e); } catch (DecryptionException e) { log.debug("Error decrypting SAML message", e); samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.FAILURE, context, e); throw new AuthenticationServiceException("Error decrypting SAML message", e); } Object userDetails = getUserDetails(credential); Object principal = getPrincipal(credential, userDetails); Collection<? extends GrantedAuthority> entitlements = getEntitlements(credential, userDetails); Date expiration = getExpirationDate(credential); SAMLCredential authenticationCredential = excludeCredential ? null : credential; ExpiringUsernameAuthenticationToken result = new ExpiringUsernameAuthenticationToken(expiration, principal, authenticationCredential, entitlements); result.setDetails(userDetails); samlLogger.log(SAMLConstants.AUTH_N_RESPONSE, SAMLConstants.SUCCESS, context, result, null); return result; }  Authentication authenticate(Authentication authentication); SAMLUserDetailsService getUserDetails(); boolean supports(Class aClass); @Autowired(required = false) void setUserDetails(SAMLUserDetailsService userDetails); @Autowired void setSamlLogger(SAMLLogger samlLogger); @Autowired @Qualifier("webSSOprofileConsumer") void setConsumer(WebSSOProfileConsumer consumer); @Autowired @Qualifier("hokWebSSOprofileConsumer") void setHokConsumer(WebSSOProfileConsumer hokConsumer); boolean isForcePrincipalAsString(); void setForcePrincipalAsString(boolean forcePrincipalAsString); boolean isExcludeCredential(); void setExcludeCredential(boolean excludeCredential); void afterPropertiesSet();  }
@Test(expected = IllegalArgumentException.class) public void testInvalidAuthenticationObject() { Authentication auth = new UsernamePasswordAuthenticationToken("user", "pass"); provider.authenticate(auth); }
@Test public void testAuthenticate() throws Exception { SAMLMessageContext context = new SAMLMessageContext(); context.setCommunicationProfileId(SAMLConstants.SAML2_WEBSSO_PROFILE_URI); SAMLAuthenticationToken token = new SAMLAuthenticationToken(context); SAMLCredential result = new SAMLCredential(nameID, assertion, "IDP", "testSP"); expect(consumer.processAuthenticationResponse(context)).andReturn(result); expect(nameID.getValue()).andReturn("Name"); DateTime expiry = new DateTime().plusHours(4); AuthnStatement as = createMock(AuthnStatement.class); expect(assertion.getAuthnStatements()).andReturn(Arrays.asList(as)).anyTimes(); expect(as.getSessionNotOnOrAfter()).andReturn(expiry); replay(as); replayMock(); Authentication authentication = provider.authenticate(token); assertEquals("Name", authentication.getName()); assertTrue(authentication instanceof ExpiringUsernameAuthenticationToken); ExpiringUsernameAuthenticationToken t = (ExpiringUsernameAuthenticationToken) authentication; assertEquals(expiry.toDate(), t.getTokenExpiration()); verifyMock(); verify(as); }
@Test(expected = AuthenticationServiceException.class) public void testAuthenticateException() throws Exception { SAMLMessageContext context = new SAMLMessageContext(); SAMLAuthenticationToken token = new SAMLAuthenticationToken(context); SAMLCredential result = new SAMLCredential(nameID, assertion, "IDP", "localSP"); expect(consumer.processAuthenticationResponse(context)).andThrow(new SAMLException("Error")); expect(nameID.getValue()).andReturn("Name"); replayMock(); provider.authenticate(token); verifyMock(); }