@Test public void fail_to_callback_when_using_wrong_certificate() { setSettings(true); settings.setProperty("sonar.auth.saml.certificate.secured", "-----BEGIN CERTIFICATE-----\n" + "MIIEIzCCAwugAwIBAgIUHUzPjy5E2TmnsmTRT2sIUBRXFF8wDQYJKoZIhvcNAQEF\n" + "BQAwXDELMAkGA1UEBhMCVVMxFDASBgNVBAoMC1NvbmFyU291cmNlMRUwEwYDVQQL\n" + "DAxPbmVMb2dpbiBJZFAxIDAeBgNVBAMMF09uZUxvZ2luIEFjY291bnQgMTMxMTkx\n" + "MB4XDTE4MDcxOTA4NDUwNVoXDTIzMDcxOTA4NDUwNVowXDELMAkGA1UEBhMCVVMx\n" + "FDASBgNVBAoMC1NvbmFyU291cmNlMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxIDAe\n" + "BgNVBAMMF09uZUxvZ2luIEFjY291bnQgMTMxMTkxMIIBIjANBgkqhkiG9w0BAQEF\n" + "AAOCAQ8AMIIBCgKCAQEArlpKHm4EkJiQyy+4GtZBixcy7fWnreB96T7cOoWLmWkK\n" + "05FM5M/boWHZsvaNAuHsoCAMzIY3/l+55WbORzAxsloH7rvDaDrdPYQN+sU9bzsD\n" + "ZkmDGDmA3QBSm/h/p5SiMkWU5Jg34toDdM0rmzUStIOMq6Gh/Ykx3fRRSjswy48x\n" + "wfZLy+0wU7lasHqdfk54dVbb7mCm9J3iHZizvOt2lbtzGbP6vrrjpzvZm43ZRgP8\n" + "FapYA8G3lczdIaG4IaLW6kYIRORd0UwI7IAwkao3uIo12rh1T6DLVyzjOs9PdIkb\n" + "HbICN2EehB/ut3wohuPwmwp2UmqopIMVVaBSsmSlYwIDAQABo4HcMIHZMAwGA1Ud\n" + "EwEB/wQCMAAwHQYDVR0OBBYEFAXGFMKYgtpzCpfpBUPQ1H/9AeDrMIGZBgNVHSME\n" + "gZEwgY6AFAXGFMKYgtpzCpfpBUPQ1H/9AeDroWCkXjBcMQswCQYDVQQGEwJVUzEU\n" + "MBIGA1UECgwLU29uYXJTb3VyY2UxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEgMB4G\n" + "A1UEAwwXT25lTG9naW4gQWNjb3VudCAxMzExOTGCFB1Mz48uRNk5p7Jk0U9rCFAU\n" + "VxRfMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEAPHgi9IdDaTxD\n" + "R5R8KHMdt385Uq8XC5pd0Li6y5RR2k6SKjThCt+eQU7D0Y2CyYU27vfCa2DQV4hJ\n" + "4v4UfQv3NR/fYfkVSsNpxjBXBI3YWouxt2yg7uwdZBdgGYd37Yv3g9PdIZenjOhr\n" + "Ck6WjdleMAWHRgJpocmB4IOESSyTfUul3jFupWnkbnn8c0ue6zwXd7LA1/yjVT2l\n" + "Yh45+lz25aIOlyyo7OUw2TD15LIl8OOIuWRS4+UWy5+VdhXMbmpSEQH+Byod90g6\n" + "A1bKpOFhRBzcxaZ6B2hB4SqjTBzS9zdmJyyFs/WNJxHri3aorcdqG9oUakjJJqqX\n" + "E13skIMV2g==\n" + "-----END CERTIFICATE-----\n"); DumbCallbackContext callbackContext = new DumbCallbackContext(request, response, "encoded_full_response.txt", SQ_CALLBACK_URL); expectedException.expect(UnauthorizedException.class); expectedException.expectMessage("Signature validation failed. SAML Response rejected"); underTest.callback(callbackContext); }
@Override public void callback(CallbackContext context) { HttpServletRequest processedRequest = useProxyHeadersInRequest(context.getRequest()); Auth auth = newAuth(initSettings(null), processedRequest, context.getResponse()); processResponse(auth); context.verifyCsrfState(STATE_REQUEST_PARAMETER); LOGGER.trace("Name ID : {}", auth.getNameId()); checkAuthentication(auth); LOGGER.trace("Attributes received : {}", auth.getAttributes()); String login = getNonNullFirstAttribute(auth, samlSettings.getUserLogin()); UserIdentity.Builder userIdentityBuilder = UserIdentity.builder() .setLogin(login) .setProviderLogin(login) .setName(getNonNullFirstAttribute(auth, samlSettings.getUserName())); samlSettings.getUserEmail().ifPresent( email -> userIdentityBuilder.setEmail(getFirstAttribute(auth, email))); samlSettings.getGroupName().ifPresent( group -> userIdentityBuilder.setGroups(getGroups(auth, group))); context.authenticate(userIdentityBuilder.build()); context.redirectToRequestedPage(); }
SamlIdentityProvider implements OAuth2IdentityProvider { @Override public void callback(CallbackContext context) { HttpServletRequest processedRequest = useProxyHeadersInRequest(context.getRequest()); Auth auth = newAuth(initSettings(null), processedRequest, context.getResponse()); processResponse(auth); context.verifyCsrfState(STATE_REQUEST_PARAMETER); LOGGER.trace("Name ID : {}", auth.getNameId()); checkAuthentication(auth); LOGGER.trace("Attributes received : {}", auth.getAttributes()); String login = getNonNullFirstAttribute(auth, samlSettings.getUserLogin()); UserIdentity.Builder userIdentityBuilder = UserIdentity.builder() .setLogin(login) .setProviderLogin(login) .setName(getNonNullFirstAttribute(auth, samlSettings.getUserName())); samlSettings.getUserEmail().ifPresent( email -> userIdentityBuilder.setEmail(getFirstAttribute(auth, email))); samlSettings.getGroupName().ifPresent( group -> userIdentityBuilder.setGroups(getGroups(auth, group))); context.authenticate(userIdentityBuilder.build()); context.redirectToRequestedPage(); } }
SamlIdentityProvider implements OAuth2IdentityProvider { @Override public void callback(CallbackContext context) { HttpServletRequest processedRequest = useProxyHeadersInRequest(context.getRequest()); Auth auth = newAuth(initSettings(null), processedRequest, context.getResponse()); processResponse(auth); context.verifyCsrfState(STATE_REQUEST_PARAMETER); LOGGER.trace("Name ID : {}", auth.getNameId()); checkAuthentication(auth); LOGGER.trace("Attributes received : {}", auth.getAttributes()); String login = getNonNullFirstAttribute(auth, samlSettings.getUserLogin()); UserIdentity.Builder userIdentityBuilder = UserIdentity.builder() .setLogin(login) .setProviderLogin(login) .setName(getNonNullFirstAttribute(auth, samlSettings.getUserName())); samlSettings.getUserEmail().ifPresent( email -> userIdentityBuilder.setEmail(getFirstAttribute(auth, email))); samlSettings.getGroupName().ifPresent( group -> userIdentityBuilder.setGroups(getGroups(auth, group))); context.authenticate(userIdentityBuilder.build()); context.redirectToRequestedPage(); } SamlIdentityProvider(SamlSettings samlSettings); }
SamlIdentityProvider implements OAuth2IdentityProvider { @Override public void callback(CallbackContext context) { HttpServletRequest processedRequest = useProxyHeadersInRequest(context.getRequest()); Auth auth = newAuth(initSettings(null), processedRequest, context.getResponse()); processResponse(auth); context.verifyCsrfState(STATE_REQUEST_PARAMETER); LOGGER.trace("Name ID : {}", auth.getNameId()); checkAuthentication(auth); LOGGER.trace("Attributes received : {}", auth.getAttributes()); String login = getNonNullFirstAttribute(auth, samlSettings.getUserLogin()); UserIdentity.Builder userIdentityBuilder = UserIdentity.builder() .setLogin(login) .setProviderLogin(login) .setName(getNonNullFirstAttribute(auth, samlSettings.getUserName())); samlSettings.getUserEmail().ifPresent( email -> userIdentityBuilder.setEmail(getFirstAttribute(auth, email))); samlSettings.getGroupName().ifPresent( group -> userIdentityBuilder.setGroups(getGroups(auth, group))); context.authenticate(userIdentityBuilder.build()); context.redirectToRequestedPage(); } SamlIdentityProvider(SamlSettings samlSettings); @Override String getKey(); @Override String getName(); @Override Display getDisplay(); @Override boolean isEnabled(); @Override boolean allowsUsersToSignUp(); @Override void init(InitContext context); @Override void callback(CallbackContext context); }
SamlIdentityProvider implements OAuth2IdentityProvider { @Override public void callback(CallbackContext context) { HttpServletRequest processedRequest = useProxyHeadersInRequest(context.getRequest()); Auth auth = newAuth(initSettings(null), processedRequest, context.getResponse()); processResponse(auth); context.verifyCsrfState(STATE_REQUEST_PARAMETER); LOGGER.trace("Name ID : {}", auth.getNameId()); checkAuthentication(auth); LOGGER.trace("Attributes received : {}", auth.getAttributes()); String login = getNonNullFirstAttribute(auth, samlSettings.getUserLogin()); UserIdentity.Builder userIdentityBuilder = UserIdentity.builder() .setLogin(login) .setProviderLogin(login) .setName(getNonNullFirstAttribute(auth, samlSettings.getUserName())); samlSettings.getUserEmail().ifPresent( email -> userIdentityBuilder.setEmail(getFirstAttribute(auth, email))); samlSettings.getGroupName().ifPresent( group -> userIdentityBuilder.setGroups(getGroups(auth, group))); context.authenticate(userIdentityBuilder.build()); context.redirectToRequestedPage(); } SamlIdentityProvider(SamlSettings samlSettings); @Override String getKey(); @Override String getName(); @Override Display getDisplay(); @Override boolean isEnabled(); @Override boolean allowsUsersToSignUp(); @Override void init(InitContext context); @Override void callback(CallbackContext context);  }