@Test(expected = SAMLException.class) public void testMissingResponse() throws Exception { messageContext.setInboundMessage(null); profile.processAuthenticationResponse(messageContext, storage); }
public SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache) throws SAMLException, org.opensaml.xml.security.SecurityException, ValidationException, DecryptionException { AuthnRequest request = null; SAMLObject message = context.getInboundSAMLMessage(); if (!(message instanceof Response)) { log.debug("Received response is not of a Response object type"); throw new SAMLException("Error validating SAML response"); } Response response = (Response) message; if (!StatusCode.SUCCESS_URI.equals(response.getStatus().getStatusCode().getValue())) { String[] logMessage = new String[2]; logMessage[0] = response.getStatus().getStatusCode().getValue(); StatusMessage message1 = response.getStatus().getStatusMessage(); if (message1 != null) { logMessage[1] = message1.getMessage(); } log.debug("Received response has invalid status code", logMessage); throw new SAMLException("SAML status is not success code"); } if (response.getSignature() != null) { verifySignature(response.getSignature(), context.getPeerEntityId(), context.getLocalTrustEngine()); context.setInboundSAMLMessageAuthenticated(true); } DateTime time = response.getIssueInstant(); if (!isDateTimeSkewValid(getResponseSkew(), time)) { log.debug("Response issue time is either too old or with date in the future, skew {}, time {}.", getResponseSkew(), time); throw new SAMLException("Error validating SAML response"); } if (response.getInResponseTo() != null) { XMLObject xmlObject = protocolCache.retrieveMessage(response.getInResponseTo()); if (xmlObject == null) { log.debug("InResponseToField doesn't correspond to sent message", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } else if (xmlObject instanceof AuthnRequest) { request = (AuthnRequest) xmlObject; } else { log.debug("Sent request was of different type then received response", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } } if (response.getDestination() != null) { SPSSODescriptor localDescriptor = (SPSSODescriptor) context.getLocalEntityRoleMetadata(); List<AssertionConsumerService> services = localDescriptor.getAssertionConsumerServices(); boolean found = false; for (AssertionConsumerService service : services) { if (response.getDestination().equals(service.getLocation()) && service.getBinding().equals(context.getCommunicationProfileId())) { found = true; break; } } if (!found) { log.debug("Destination of the response was not the expected value", response.getDestination()); throw new SAMLException("Error validating SAML response"); } } if (response.getIssuer() != null) { Issuer issuer = response.getIssuer(); verifyIssuer(issuer, context); } Assertion subjectAssertion = null; List<Attribute> attributes = new LinkedList<Attribute>(); List<Assertion> assertionList = response.getAssertions(); List<EncryptedAssertion> encryptedAssertionList = response.getEncryptedAssertions(); for (EncryptedAssertion ea : encryptedAssertionList) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Assertion, no decrypter is set in the context"); assertionList.add(context.getLocalDecrypter().decrypt(ea)); } for (Assertion a : assertionList) { verifyAssertion(a, request, context); if (a.getAuthnStatements().size() > 0) { if (a.getSubject() != null && a.getSubject().getSubjectConfirmations() != null) { for (SubjectConfirmation conf : a.getSubject().getSubjectConfirmations()) { if (SubjectConfirmation.METHOD_BEARER.equals(conf.getMethod())) { subjectAssertion = a; } } } } for (AttributeStatement attStatement : a.getAttributeStatements()) { for (Attribute att : attStatement.getAttributes()) { attributes.add(att); } for (EncryptedAttribute att : attStatement.getEncryptedAttributes()) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Attribute, no decrypter is set in the context"); attributes.add(context.getLocalDecrypter().decrypt(att)); } } } if (subjectAssertion == null) { log.debug("Response doesn't contain authentication statement"); throw new SAMLException("Error validating SAML response"); } NameID nameId = (NameID) context.getSubjectNameIdentifier(); if (nameId == null) { throw new SAMLException("NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration"); } return new SAMLCredential(nameId, subjectAssertion, context.getPeerEntityMetadata().getEntityID(), context.getRelayState(), attributes, context.getLocalEntityId()); }
WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { public SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache) throws SAMLException, org.opensaml.xml.security.SecurityException, ValidationException, DecryptionException { AuthnRequest request = null; SAMLObject message = context.getInboundSAMLMessage(); if (!(message instanceof Response)) { log.debug("Received response is not of a Response object type"); throw new SAMLException("Error validating SAML response"); } Response response = (Response) message; if (!StatusCode.SUCCESS_URI.equals(response.getStatus().getStatusCode().getValue())) { String[] logMessage = new String[2]; logMessage[0] = response.getStatus().getStatusCode().getValue(); StatusMessage message1 = response.getStatus().getStatusMessage(); if (message1 != null) { logMessage[1] = message1.getMessage(); } log.debug("Received response has invalid status code", logMessage); throw new SAMLException("SAML status is not success code"); } if (response.getSignature() != null) { verifySignature(response.getSignature(), context.getPeerEntityId(), context.getLocalTrustEngine()); context.setInboundSAMLMessageAuthenticated(true); } DateTime time = response.getIssueInstant(); if (!isDateTimeSkewValid(getResponseSkew(), time)) { log.debug("Response issue time is either too old or with date in the future, skew {}, time {}.", getResponseSkew(), time); throw new SAMLException("Error validating SAML response"); } if (response.getInResponseTo() != null) { XMLObject xmlObject = protocolCache.retrieveMessage(response.getInResponseTo()); if (xmlObject == null) { log.debug("InResponseToField doesn't correspond to sent message", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } else if (xmlObject instanceof AuthnRequest) { request = (AuthnRequest) xmlObject; } else { log.debug("Sent request was of different type then received response", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } } if (response.getDestination() != null) { SPSSODescriptor localDescriptor = (SPSSODescriptor) context.getLocalEntityRoleMetadata(); List<AssertionConsumerService> services = localDescriptor.getAssertionConsumerServices(); boolean found = false; for (AssertionConsumerService service : services) { if (response.getDestination().equals(service.getLocation()) && service.getBinding().equals(context.getCommunicationProfileId())) { found = true; break; } } if (!found) { log.debug("Destination of the response was not the expected value", response.getDestination()); throw new SAMLException("Error validating SAML response"); } } if (response.getIssuer() != null) { Issuer issuer = response.getIssuer(); verifyIssuer(issuer, context); } Assertion subjectAssertion = null; List<Attribute> attributes = new LinkedList<Attribute>(); List<Assertion> assertionList = response.getAssertions(); List<EncryptedAssertion> encryptedAssertionList = response.getEncryptedAssertions(); for (EncryptedAssertion ea : encryptedAssertionList) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Assertion, no decrypter is set in the context"); assertionList.add(context.getLocalDecrypter().decrypt(ea)); } for (Assertion a : assertionList) { verifyAssertion(a, request, context); if (a.getAuthnStatements().size() > 0) { if (a.getSubject() != null && a.getSubject().getSubjectConfirmations() != null) { for (SubjectConfirmation conf : a.getSubject().getSubjectConfirmations()) { if (SubjectConfirmation.METHOD_BEARER.equals(conf.getMethod())) { subjectAssertion = a; } } } } for (AttributeStatement attStatement : a.getAttributeStatements()) { for (Attribute att : attStatement.getAttributes()) { attributes.add(att); } for (EncryptedAttribute att : attStatement.getEncryptedAttributes()) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Attribute, no decrypter is set in the context"); attributes.add(context.getLocalDecrypter().decrypt(att)); } } } if (subjectAssertion == null) { log.debug("Response doesn't contain authentication statement"); throw new SAMLException("Error validating SAML response"); } NameID nameId = (NameID) context.getSubjectNameIdentifier(); if (nameId == null) { throw new SAMLException("NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration"); } return new SAMLCredential(nameId, subjectAssertion, context.getPeerEntityMetadata().getEntityID(), context.getRelayState(), attributes, context.getLocalEntityId()); } }
WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { public SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache) throws SAMLException, org.opensaml.xml.security.SecurityException, ValidationException, DecryptionException { AuthnRequest request = null; SAMLObject message = context.getInboundSAMLMessage(); if (!(message instanceof Response)) { log.debug("Received response is not of a Response object type"); throw new SAMLException("Error validating SAML response"); } Response response = (Response) message; if (!StatusCode.SUCCESS_URI.equals(response.getStatus().getStatusCode().getValue())) { String[] logMessage = new String[2]; logMessage[0] = response.getStatus().getStatusCode().getValue(); StatusMessage message1 = response.getStatus().getStatusMessage(); if (message1 != null) { logMessage[1] = message1.getMessage(); } log.debug("Received response has invalid status code", logMessage); throw new SAMLException("SAML status is not success code"); } if (response.getSignature() != null) { verifySignature(response.getSignature(), context.getPeerEntityId(), context.getLocalTrustEngine()); context.setInboundSAMLMessageAuthenticated(true); } DateTime time = response.getIssueInstant(); if (!isDateTimeSkewValid(getResponseSkew(), time)) { log.debug("Response issue time is either too old or with date in the future, skew {}, time {}.", getResponseSkew(), time); throw new SAMLException("Error validating SAML response"); } if (response.getInResponseTo() != null) { XMLObject xmlObject = protocolCache.retrieveMessage(response.getInResponseTo()); if (xmlObject == null) { log.debug("InResponseToField doesn't correspond to sent message", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } else if (xmlObject instanceof AuthnRequest) { request = (AuthnRequest) xmlObject; } else { log.debug("Sent request was of different type then received response", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } } if (response.getDestination() != null) { SPSSODescriptor localDescriptor = (SPSSODescriptor) context.getLocalEntityRoleMetadata(); List<AssertionConsumerService> services = localDescriptor.getAssertionConsumerServices(); boolean found = false; for (AssertionConsumerService service : services) { if (response.getDestination().equals(service.getLocation()) && service.getBinding().equals(context.getCommunicationProfileId())) { found = true; break; } } if (!found) { log.debug("Destination of the response was not the expected value", response.getDestination()); throw new SAMLException("Error validating SAML response"); } } if (response.getIssuer() != null) { Issuer issuer = response.getIssuer(); verifyIssuer(issuer, context); } Assertion subjectAssertion = null; List<Attribute> attributes = new LinkedList<Attribute>(); List<Assertion> assertionList = response.getAssertions(); List<EncryptedAssertion> encryptedAssertionList = response.getEncryptedAssertions(); for (EncryptedAssertion ea : encryptedAssertionList) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Assertion, no decrypter is set in the context"); assertionList.add(context.getLocalDecrypter().decrypt(ea)); } for (Assertion a : assertionList) { verifyAssertion(a, request, context); if (a.getAuthnStatements().size() > 0) { if (a.getSubject() != null && a.getSubject().getSubjectConfirmations() != null) { for (SubjectConfirmation conf : a.getSubject().getSubjectConfirmations()) { if (SubjectConfirmation.METHOD_BEARER.equals(conf.getMethod())) { subjectAssertion = a; } } } } for (AttributeStatement attStatement : a.getAttributeStatements()) { for (Attribute att : attStatement.getAttributes()) { attributes.add(att); } for (EncryptedAttribute att : attStatement.getEncryptedAttributes()) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Attribute, no decrypter is set in the context"); attributes.add(context.getLocalDecrypter().decrypt(att)); } } } if (subjectAssertion == null) { log.debug("Response doesn't contain authentication statement"); throw new SAMLException("Error validating SAML response"); } NameID nameId = (NameID) context.getSubjectNameIdentifier(); if (nameId == null) { throw new SAMLException("NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration"); } return new SAMLCredential(nameId, subjectAssertion, context.getPeerEntityMetadata().getEntityID(), context.getRelayState(), attributes, context.getLocalEntityId()); } WebSSOProfileConsumerImpl();  WebSSOProfileConsumerImpl(SAMLProcessor processor, MetadataManager manager); }
WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { public SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache) throws SAMLException, org.opensaml.xml.security.SecurityException, ValidationException, DecryptionException { AuthnRequest request = null; SAMLObject message = context.getInboundSAMLMessage(); if (!(message instanceof Response)) { log.debug("Received response is not of a Response object type"); throw new SAMLException("Error validating SAML response"); } Response response = (Response) message; if (!StatusCode.SUCCESS_URI.equals(response.getStatus().getStatusCode().getValue())) { String[] logMessage = new String[2]; logMessage[0] = response.getStatus().getStatusCode().getValue(); StatusMessage message1 = response.getStatus().getStatusMessage(); if (message1 != null) { logMessage[1] = message1.getMessage(); } log.debug("Received response has invalid status code", logMessage); throw new SAMLException("SAML status is not success code"); } if (response.getSignature() != null) { verifySignature(response.getSignature(), context.getPeerEntityId(), context.getLocalTrustEngine()); context.setInboundSAMLMessageAuthenticated(true); } DateTime time = response.getIssueInstant(); if (!isDateTimeSkewValid(getResponseSkew(), time)) { log.debug("Response issue time is either too old or with date in the future, skew {}, time {}.", getResponseSkew(), time); throw new SAMLException("Error validating SAML response"); } if (response.getInResponseTo() != null) { XMLObject xmlObject = protocolCache.retrieveMessage(response.getInResponseTo()); if (xmlObject == null) { log.debug("InResponseToField doesn't correspond to sent message", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } else if (xmlObject instanceof AuthnRequest) { request = (AuthnRequest) xmlObject; } else { log.debug("Sent request was of different type then received response", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } } if (response.getDestination() != null) { SPSSODescriptor localDescriptor = (SPSSODescriptor) context.getLocalEntityRoleMetadata(); List<AssertionConsumerService> services = localDescriptor.getAssertionConsumerServices(); boolean found = false; for (AssertionConsumerService service : services) { if (response.getDestination().equals(service.getLocation()) && service.getBinding().equals(context.getCommunicationProfileId())) { found = true; break; } } if (!found) { log.debug("Destination of the response was not the expected value", response.getDestination()); throw new SAMLException("Error validating SAML response"); } } if (response.getIssuer() != null) { Issuer issuer = response.getIssuer(); verifyIssuer(issuer, context); } Assertion subjectAssertion = null; List<Attribute> attributes = new LinkedList<Attribute>(); List<Assertion> assertionList = response.getAssertions(); List<EncryptedAssertion> encryptedAssertionList = response.getEncryptedAssertions(); for (EncryptedAssertion ea : encryptedAssertionList) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Assertion, no decrypter is set in the context"); assertionList.add(context.getLocalDecrypter().decrypt(ea)); } for (Assertion a : assertionList) { verifyAssertion(a, request, context); if (a.getAuthnStatements().size() > 0) { if (a.getSubject() != null && a.getSubject().getSubjectConfirmations() != null) { for (SubjectConfirmation conf : a.getSubject().getSubjectConfirmations()) { if (SubjectConfirmation.METHOD_BEARER.equals(conf.getMethod())) { subjectAssertion = a; } } } } for (AttributeStatement attStatement : a.getAttributeStatements()) { for (Attribute att : attStatement.getAttributes()) { attributes.add(att); } for (EncryptedAttribute att : attStatement.getEncryptedAttributes()) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Attribute, no decrypter is set in the context"); attributes.add(context.getLocalDecrypter().decrypt(att)); } } } if (subjectAssertion == null) { log.debug("Response doesn't contain authentication statement"); throw new SAMLException("Error validating SAML response"); } NameID nameId = (NameID) context.getSubjectNameIdentifier(); if (nameId == null) { throw new SAMLException("NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration"); } return new SAMLCredential(nameId, subjectAssertion, context.getPeerEntityMetadata().getEntityID(), context.getRelayState(), attributes, context.getLocalEntityId()); } WebSSOProfileConsumerImpl();  WebSSOProfileConsumerImpl(SAMLProcessor processor, MetadataManager manager); SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache); int getMaxAuthenticationAge(); void setMaxAuthenticationAge(int maxAuthenticationAge); }
WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { public SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache) throws SAMLException, org.opensaml.xml.security.SecurityException, ValidationException, DecryptionException { AuthnRequest request = null; SAMLObject message = context.getInboundSAMLMessage(); if (!(message instanceof Response)) { log.debug("Received response is not of a Response object type"); throw new SAMLException("Error validating SAML response"); } Response response = (Response) message; if (!StatusCode.SUCCESS_URI.equals(response.getStatus().getStatusCode().getValue())) { String[] logMessage = new String[2]; logMessage[0] = response.getStatus().getStatusCode().getValue(); StatusMessage message1 = response.getStatus().getStatusMessage(); if (message1 != null) { logMessage[1] = message1.getMessage(); } log.debug("Received response has invalid status code", logMessage); throw new SAMLException("SAML status is not success code"); } if (response.getSignature() != null) { verifySignature(response.getSignature(), context.getPeerEntityId(), context.getLocalTrustEngine()); context.setInboundSAMLMessageAuthenticated(true); } DateTime time = response.getIssueInstant(); if (!isDateTimeSkewValid(getResponseSkew(), time)) { log.debug("Response issue time is either too old or with date in the future, skew {}, time {}.", getResponseSkew(), time); throw new SAMLException("Error validating SAML response"); } if (response.getInResponseTo() != null) { XMLObject xmlObject = protocolCache.retrieveMessage(response.getInResponseTo()); if (xmlObject == null) { log.debug("InResponseToField doesn't correspond to sent message", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } else if (xmlObject instanceof AuthnRequest) { request = (AuthnRequest) xmlObject; } else { log.debug("Sent request was of different type then received response", response.getInResponseTo()); throw new SAMLException("Error validating SAML response"); } } if (response.getDestination() != null) { SPSSODescriptor localDescriptor = (SPSSODescriptor) context.getLocalEntityRoleMetadata(); List<AssertionConsumerService> services = localDescriptor.getAssertionConsumerServices(); boolean found = false; for (AssertionConsumerService service : services) { if (response.getDestination().equals(service.getLocation()) && service.getBinding().equals(context.getCommunicationProfileId())) { found = true; break; } } if (!found) { log.debug("Destination of the response was not the expected value", response.getDestination()); throw new SAMLException("Error validating SAML response"); } } if (response.getIssuer() != null) { Issuer issuer = response.getIssuer(); verifyIssuer(issuer, context); } Assertion subjectAssertion = null; List<Attribute> attributes = new LinkedList<Attribute>(); List<Assertion> assertionList = response.getAssertions(); List<EncryptedAssertion> encryptedAssertionList = response.getEncryptedAssertions(); for (EncryptedAssertion ea : encryptedAssertionList) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Assertion, no decrypter is set in the context"); assertionList.add(context.getLocalDecrypter().decrypt(ea)); } for (Assertion a : assertionList) { verifyAssertion(a, request, context); if (a.getAuthnStatements().size() > 0) { if (a.getSubject() != null && a.getSubject().getSubjectConfirmations() != null) { for (SubjectConfirmation conf : a.getSubject().getSubjectConfirmations()) { if (SubjectConfirmation.METHOD_BEARER.equals(conf.getMethod())) { subjectAssertion = a; } } } } for (AttributeStatement attStatement : a.getAttributeStatements()) { for (Attribute att : attStatement.getAttributes()) { attributes.add(att); } for (EncryptedAttribute att : attStatement.getEncryptedAttributes()) { Assert.notNull(context.getLocalDecrypter(), "Can't decrypt Attribute, no decrypter is set in the context"); attributes.add(context.getLocalDecrypter().decrypt(att)); } } } if (subjectAssertion == null) { log.debug("Response doesn't contain authentication statement"); throw new SAMLException("Error validating SAML response"); } NameID nameId = (NameID) context.getSubjectNameIdentifier(); if (nameId == null) { throw new SAMLException("NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration"); } return new SAMLCredential(nameId, subjectAssertion, context.getPeerEntityMetadata().getEntityID(), context.getRelayState(), attributes, context.getLocalEntityId()); } WebSSOProfileConsumerImpl();  WebSSOProfileConsumerImpl(SAMLProcessor processor, MetadataManager manager); SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache); int getMaxAuthenticationAge(); void setMaxAuthenticationAge(int maxAuthenticationAge);  }