[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src: main/java/org/opensaml/saml/common/binding/security/impl/SAM...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Jun  2 21:20:54 2014
New Revision: 3911

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3911&view=rev
Log:
Add option to suppress signing of error responses.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandlerTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java?rev=3911&r1=3910&r2=3911&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java Mon Jun  2 21:20:54 2014
@@ -18,6 +18,9 @@
 package org.opensaml.saml.common.binding.security.impl;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
 
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.messaging.context.MessageContext;
@@ -25,6 +28,8 @@
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.messaging.SAMLMessageSecuritySupport;
+import org.opensaml.saml.saml1.core.Response;
+import org.opensaml.saml.saml2.core.StatusResponseType;
 import org.opensaml.security.SecurityException;
 import org.opensaml.xmlsec.SignatureSigningParameters;
 import org.opensaml.xmlsec.signature.support.SignatureException;
@@ -41,12 +46,31 @@
     /** Logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(SAMLOutboundProtocolMessageSigningHandler.class);
 
+    /** Whether to sign responses containing errors. */
+    private boolean signErrorResponses;
+    
+    /** Constructor. */
+    public SAMLOutboundProtocolMessageSigningHandler() {
+        signErrorResponses = true;
+    }
+    
+    /**
+     * Set whether to sign response messages that contain errors (defaults to true).
+     * 
+     * @param flag  flag to set
+     */
+    public void setSignErrorResponses(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        signErrorResponses = flag;
+    }
+    
     /** {@inheritDoc} */
     @Override
     protected void doInvoke(@Nonnull final MessageContext<SAMLObject> messageContext) throws MessageHandlerException {
         final SignatureSigningParameters signingParameters = 
                 SAMLMessageSecuritySupport.getContextSigningParameters(messageContext);
-        if (signingParameters != null) {
+        if (signingParameters != null && (signErrorResponses || !isErrorResponse(messageContext.getMessage()))) {
             try {
                 SAMLMessageSecuritySupport.signMessage(messageContext);
             } catch (SecurityException | MarshallingException | SignatureException e) {
@@ -58,4 +82,31 @@
         }
     }
 
+    /**
+     * Get whether the message is a SAML response containing an error status.
+     * 
+     * @param message   message to check
+     * 
+     * @return  true iff the message is a SAML response containing an error status
+     */
+    private boolean isErrorResponse(@Nullable final SAMLObject message) {
+        if (message != null) {
+            if (message instanceof Response) {
+                if (((Response) message).getStatus() != null) {
+                    final org.opensaml.saml.saml1.core.StatusCode s1 = ((Response) message).getStatus().getStatusCode();
+                    return s1 != null && s1.getValue() != null
+                            && !org.opensaml.saml.saml1.core.StatusCode.SUCCESS.equals(s1.getValue());
+                }
+            } else if (message instanceof StatusResponseType) {
+                if (((StatusResponseType) message).getStatus() != null) {
+                    final org.opensaml.saml.saml2.core.StatusCode s2 =
+                            ((StatusResponseType) message).getStatus().getStatusCode();
+                    return s2 != null && s2.getValue() != null
+                            && !org.opensaml.saml.saml2.core.StatusCode.SUCCESS_URI.equals(s2.getValue());
+                }
+            }
+        }
+        
+        return false;
+    }
 }

Modified: trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandlerTest.java

[... 61 lines stripped ...]