[java-identity-provider] branch main updated: IDP-1958 - Remove ID-WSF SAML delegation support
Scott Cantor
cantor.2 at osu.edu
Tue Jun 7 12:34:18 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=86fbfb7603d63ed4cb4ce2c2bcf476403c545e05
The following commit(s) were added to refs/heads/main by this push:
new 86fbfb760 IDP-1958 - Remove ID-WSF SAML delegation support
86fbfb760 is described below
commit 86fbfb7603d63ed4cb4ce2c2bcf476403c545e05
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 7 08:34:14 2022 -0400
IDP-1958 - Remove ID-WSF SAML delegation support
https://shibboleth.atlassian.net/browse/IDP-1958
---
.../net/shibboleth/idp/conf/conditions.xml | 6 -
.../shibboleth/idp/conf/saml-binding-config.xml | 23 +-
.../net/shibboleth/idp/conf/webflow-config.xml | 3 -
.../idp/flows/saml/saml-abstract-beans.xml | 14 +-
.../idp/flows/saml/saml-abstract-flow.xml | 1 -
.../idp/flows/saml/saml2/common-beans.xml | 5 +-
.../idp/flows/saml/saml2/idwsf-ssos-beans.xml | 179 ------
.../idp/flows/saml/saml2/idwsf-ssos-flow.xml | 96 ----
.../flows/saml/saml2/idwsf-ssos-security-beans.xml | 107 ----
.../flows/saml/saml2/idwsf-ssos-security-flow.xml | 28 -
.../idp/flows/saml/saml2/sso-abstract-beans.xml | 50 +-
.../idp/flows/saml/saml2/sso-abstract-flow.xml | 4 -
idp-parent/pom.xml | 1 -
.../profile/config/SSOSProfileConfiguration.java | 12 +-
.../profile/delegation/DelegationContext.java | 114 ----
.../profile/delegation/DelegationRequest.java | 33 --
.../IssuingDelegatedAssertionPredicate.java | 68 ---
.../profile/delegation/LibertySSOSContext.java | 76 ---
.../saml2/profile/delegation/package-info.java | 19 -
.../idp/saml/xmlobject/DelegationPolicy.java | 51 --
.../idp/saml/xmlobject/ExtensionsConstants.java | 9 -
.../resources/schema/shibboleth-delegation-1.0.xsd | 21 -
idp-saml-impl/pom.xml | 6 -
...tementToAssertionFromInboundAssertionToken.java | 329 -----------
.../impl/AddDelegationPolicyToAssertion.java | 237 --------
.../impl/AddDelegationRestrictionToAssertions.java | 314 ----------
.../impl/DecorateDelegatedAssertion.java | 634 ---------------------
.../impl/DelegatedAssertionLookupStrategy.java | 74 ---
.../delegation/impl/EvaluateDelegationPolicy.java | 365 ------------
.../impl/FinalizeSAMLTokenProcessing.java | 84 ---
.../profile/delegation/impl/LibertyConstants.java | 97 ----
.../delegation/impl/PopulateDelegationContext.java | 567 ------------------
.../delegation/impl/PopulateLibertyContext.java | 169 ------
.../impl/PopulateOutboundMessageContext.java | 87 ---
.../delegation/impl/ProcessDelegatedAssertion.java | 217 -------
.../impl/XMLObjectProviderInitializer.java | 39 --
.../profile/delegation/impl/package-info.java | 19 -
.../messaging/impl/AddFrameworkHandler.java | 78 ---
.../messaging/impl/AddSenderHandler.java | 107 ----
.../messaging/impl/LibertyHTTPSOAP11Decoder.java | 194 -------
.../messaging/impl/LibertyHTTPSOAP11Encoder.java | 253 --------
.../messaging/impl/ProcessFrameworkHandler.java | 112 ----
.../messaging/impl/ProcessSenderHandler.java | 76 ---
.../messaging/impl/SAMLSOAPDecoderBodyHandler.java | 75 ---
.../delegation/messaging/impl/package-info.java | 21 -
.../xmlobject/impl/DelegationPolicyBuilder.java | 42 --
.../saml/xmlobject/impl/DelegationPolicyImpl.java | 66 ---
.../xmlobject/impl/DelegationPolicyMarshaller.java | 43 --
.../impl/DelegationPolicyUnmarshaller.java | 44 --
.../services/org.opensaml.core.config.Initializer | 1 -
.../main/resources/liberty-soap-binding-config.xml | 93 ---
.../main/resources/shibboleth-saml-ext-config.xml | 7 -
...ntToAssertionFromInboundAssertionTokenTest.java | 144 -----
.../impl/AddDelegationPolicyToAssertionTest.java | 216 -------
.../AddDelegationRestrictionToAssertionsTest.java | 243 --------
.../impl/DecorateDelegatedAssertionTest.java | 452 ---------------
.../impl/DelegatedAssertionLookupStrategyTest.java | 86 ---
.../impl/EvaluateDelegationPolicyTest.java | 256 ---------
.../impl/FinalizeSAMLTokenProcessingTest.java | 105 ----
.../impl/PopulateDelegationContextTest.java | 458 ---------------
.../impl/PopulateLibertyContextTest.java | 178 ------
.../impl/PopulateOutboundMessageContextTest.java | 117 ----
.../impl/ProcessDelegatedAssertionTest.java | 186 ------
.../messaging/impl/AddFrameworkHandlerTest.java | 65 ---
.../messaging/impl/AddSenderHandlerTest.java | 87 ---
.../impl/LibertyHTTPSOAP11DecoderTest.java | 78 ---
.../impl/LibertyHTTPSOAP11EncoderTest.java | 130 -----
.../impl/ProcessFrameworkHandlerTest.java | 90 ---
.../messaging/impl/ProcessSenderHandlerTest.java | 80 ---
.../saml/xmlobject/impl/DelegationPolicyTest.java | 80 ---
.../saml/impl/xmlobject/ShibDelegationPolicy.xml | 2 -
.../ShibDelegationPolicyOptionalAttributes.xml | 2 -
72 files changed, 16 insertions(+), 8409 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
index 2188aa290..41478716e 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/conditions.xml
@@ -83,10 +83,4 @@
</constructor-arg>
</bean>
-
- <bean id="shibboleth.Conditions.IssuingDelegatedAssertion"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.IssuingDelegatedAssertionPredicate" />
- <bean id="shibboleth.Conditions.AllowedSAMLPresenters" abstract="true"
- class="net.shibboleth.idp.saml.profile.config.logic.AllowedSAMLPresentersPredicate" />
-
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
index a9447dccd..d09a0f7ef 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-binding-config.xml
@@ -74,16 +74,7 @@
p:shortName="SOAP"
p:encoderBeanId="shibboleth.Encoders.SAML2SOAPEncoder"
p:synchronous="true" />
-
- <!-- Other Bindings -->
- <bean parent="shibboleth.BindingDescriptor" id="shibboleth.Binding.LibertySOAP"
- p:shortName="LibertySOAP"
- p:synchronous="true">
- <property name="id">
- <util:constant static-field="net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants.SOAP_BINDING_20_URI" />
- </property>
- </bean>
-
+
<util:list id="shibboleth.OutgoingSAML1SSOBindings">
<ref bean="shibboleth.Binding.SAML1POST" />
<ref bean="shibboleth.Binding.SAML1Artifact" />
@@ -130,14 +121,6 @@
p:encoderBeanId="shibboleth.Encoders.SAML2SOAPEncoder" />
</util:list>
- <util:list id="shibboleth.OutgoingIDWSFSSOSBindings">
- <!-- Special case, the binding is technically SOAP, but response endpoint checking based on PAOS. -->
- <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" p:shortName="LibertySOAP"
- p:encoderBeanId="shibboleth.Encoders.IDWSFSOAPEncoder" />
- <bean parent="shibboleth.BindingDescriptor" p:id="urn:ietf:params:xml:ns:samlec" p:shortName="LibertySOAP"
- p:encoderBeanId="shibboleth.Encoders.IDWSFSOAPEncoder" />
- </util:list>
-
<!-- Global bean used in all the SAML flows for endpoint resolution. -->
<bean id="shibboleth.EndpointResolver" class="org.opensaml.saml.common.binding.impl.DefaultEndpointResolver"
p:inMetadataOrder="%{idp.bindings.inMetadataOrder:true}" />
@@ -184,9 +167,5 @@
<bean id="shibboleth.Encoders.SAML2SOAPEncoder"
class="org.opensaml.saml.saml2.binding.encoding.impl.HTTPSOAP11Encoder" scope="prototype" init-method=""
p:httpServletResponse-ref="shibboleth.HttpServletResponse" />
-
- <bean id="shibboleth.Encoders.IDWSFSOAPEncoder"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl.LibertyHTTPSOAP11Encoder" scope="prototype" init-method=""
- p:httpServletResponse-ref="shibboleth.HttpServletResponse" />
</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
index 733e86f46..ee0bff489 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
@@ -66,9 +66,6 @@
<entry key="SAML2/SOAP/SLO" value="classpath:/net/shibboleth/idp/flows/saml/saml2/slo-back-flow.xml" />
<entry key="SAML2/SOAP/AttributeQuery" value="classpath:/net/shibboleth/idp/flows/saml/saml2/attribute-query-flow.xml" />
<entry key="SAML2/SOAP/ArtifactResolution" value="classpath:/net/shibboleth/idp/flows/saml/saml2/artifact-resolution-flow.xml" />
-
- <!-- Liberty IDWSF SSOS flow (for SAML 2 delegation) -->
- <entry key="IDWSF/SSOS" value="classpath:/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml" />
<!-- Main flow for authentication. -->
<entry key="authn.events" value="%{idp.home}/conf/authn/authn-events-flow.xml" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
index bf6156ad9..fcb1eba48 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-beans.xml
@@ -127,11 +127,6 @@
p:endpointType="#{getObject('shibboleth.EndpointType')}"
p:bindingDescriptorsLookupStrategy-ref="shibboleth.OutgoingBindingsLookupStrategy"
p:artifactImpliesSecureChannel="%{idp.artifact.secureChannel:true}" />
-
- <bean id="PopulateDelegationContext"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext" scope="prototype">
- <property name="credentialResolver" ref="shibboleth.MetadataCredentialResolver" />
- </bean>
<bean id="PopulateResponseSignatureSigningParameters"
class="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters" scope="prototype"
@@ -149,13 +144,8 @@
p:signatureSigningParametersResolver-ref="shibboleth.SignatureSigningParametersResolver"
p:noResultIsError="true">
<property name="activationCondition">
- <bean parent="shibboleth.Conditions.OR">
- <constructor-arg>
- <bean class="net.shibboleth.idp.saml.profile.config.logic.SignAssertionsPredicate"
- p:honorMetadata="%{idp.saml.honorWantAssertionsSigned:true}" />
- </constructor-arg>
- <constructor-arg ref="shibboleth.Conditions.IssuingDelegatedAssertion" />
- </bean>
+ <bean class="net.shibboleth.idp.saml.profile.config.logic.SignAssertionsPredicate"
+ p:honorMetadata="%{idp.saml.honorWantAssertionsSigned:true}" />
</property>
<property name="securityParametersContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
index 8092c6141..5456536e3 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml-abstract-flow.xml
@@ -57,7 +57,6 @@
<evaluate expression="InitializeOutboundMessageContext" />
<evaluate expression="InitializeMessageChannelSecurityContext" />
<evaluate expression="PopulateBindingAndEndpointContexts" />
- <evaluate expression="PopulateDelegationContext" />
<evaluate expression="PopulateResponseSignatureSigningParameters" />
<evaluate expression="PopulateAssertionSignatureSigningParameters" />
<evaluate expression="PopulateEncryptionParameters" />
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
index 62452ac7b..d7e89831b 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/common-beans.xml
@@ -115,10 +115,7 @@
<bean id="EncryptNameIDs"
class="org.opensaml.saml.saml2.profile.impl.EncryptNameIDs" scope="prototype"
p:excludedFormats="#{getObject('shibboleth.PlaintextNameIDFormats') ?: getObject('DefaultPlaintextNameIDFormats')}"
- p:recipientLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple"
- p:encryptToSelf-ref="shibboleth.Conditions.IssuingDelegatedAssertion"
- p:encryptToSelfParametersStrategy-ref="EncryptToSelfParametersStrategy"
- p:selfRecipientLookupStrategy-ref="shibboleth.ResponderIdLookup.Simple">
+ p:recipientLookupStrategy-ref="shibboleth.RelyingPartyIdLookup.Simple">
<property name="encryptionContextLookupStrategy">
<bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookup.EncryptionParameters"
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-beans.xml
deleted file mode 100644
index 3def23862..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-beans.xml
+++ /dev/null
@@ -1,179 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <bean id="InitializeProfileRequestContext"
- class="net.shibboleth.idp.profile.impl.InitializeProfileRequestContext" scope="prototype"
- p:profileId="#{T(net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration).PROFILE_ID}"
- p:loggingId="%{idp.service.logging.saml2sso:SSO}"
- p:browserProfile="false" />
-
- <bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
- <constructor-arg>
- <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl.LibertyHTTPSOAP11Decoder" scope="prototype"
- p:parserPool-ref="shibboleth.ParserPool"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:bindingDescriptor-ref="shibboleth.Binding.LibertySOAP" />
- </constructor-arg>
- </bean>
-
- <bean id="shibboleth.OutgoingBindingsLookupStrategy"
- class="net.shibboleth.utilities.java.support.logic.FunctionSupport" factory-method="constant"
- c:_0-ref="shibboleth.OutgoingIDWSFSSOSBindings" />
-
- <bean id="shibboleth.BindingSpecificMessageHandler"
- class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
- <property name="handlers">
- <util:list>
- <!-- Liberty SOAP binding-specific handlers. -->
- <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl.AddFrameworkHandler" scope="prototype" />
- <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl.AddSenderHandler" scope="prototype" />
-
- <!-- Standard WS-Addressing and WS-Security handlers. -->
- <bean class="org.opensaml.soap.wssecurity.messaging.impl.AddTimestampHandler" scope="prototype" />
- <bean class="org.opensaml.soap.wsaddressing.messaging.impl.AddMessageIDHandler" scope="prototype" />
- <bean class="org.opensaml.soap.wsaddressing.messaging.impl.AddRelatesToHandler" scope="prototype" />
- <bean class="org.opensaml.soap.wsaddressing.messaging.impl.AddActionHandler" scope="prototype">
- <property name="actionURI">
- <util:constant static-field="net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants.SSOS_RESPONSE_WSA_ACTION_URI" />
- </property>
- </bean>
-
- <!-- ECP-specific handlers. -->
- <bean class="org.opensaml.saml.saml2.binding.impl.AddECPResponseHeaderHandler" scope="prototype" />
- <!-- TODO Since this is really sub-profile of ECP, should we include the standard ECP stuff below?.
- Some of this is new since the original delegation work. -->
- <!--
- <bean class="org.opensaml.saml.saml2.binding.impl.AddRelayStateHeaderHandler" scope="prototype" />
- <bean class="org.opensaml.saml.saml2.binding.impl.AddRequestAuthenticatedHeaderHandler" scope="prototype" />
- <bean class="org.opensaml.saml.saml2.binding.impl.AddGeneratedKeyHeaderHandler" scope="prototype" />
- <bean class="org.opensaml.saml.common.binding.impl.AddChannelBindingsHeaderHandler" scope="prototype" />
- -->
- </util:list>
- </property>
- </bean>
-
- <util:constant id="shibboleth.Delegation.MetadataLookup.Protocol"
- static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20P_NS" />
-
- <util:constant id="shibboleth.Delegation.MetadataLookup.Role"
- static-field="org.opensaml.saml.saml2.metadata.SPSSODescriptor.DEFAULT_ELEMENT_NAME" />
-
- <bean id="PopulateInboundMessageContextWithSAMLSelf"
- class="net.shibboleth.idp.saml.profile.impl.PopulateInboundMessageContextWithSAMLSelf" scope="prototype" />
-
- <bean id="ProcessFrameworkHandler"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl.ProcessFrameworkHandler" />
- </constructor-arg>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT"
- c:predicate-ref="shibboleth.Conditions.BrowserProfile" />
- </property>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.INVALID_MESSAGE" />
- </property>
- </bean>
-
- <bean id="ProcessSenderHandler"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl.ProcessSenderHandler" />
- </constructor-arg>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT"
- c:predicate-ref="shibboleth.Conditions.BrowserProfile" />
- </property>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.INVALID_MESSAGE" />
- </property>
- </bean>
-
- <bean id="ExtractMessageIDHandler"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.soap.wsaddressing.messaging.impl.ExtractMessageIDHandler" />
- </constructor-arg>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT"
- c:predicate-ref="shibboleth.Conditions.BrowserProfile" />
- </property>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.INVALID_MESSAGE" />
- </property>
- </bean>
-
- <bean id="ValidateActionHandler"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.soap.wsaddressing.messaging.impl.ValidateActionHandler">
- <property name="expectedActionURI">
- <util:constant static-field="net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants.SSOS_AUTHN_REQUEST_WSA_ACTION_URI" />
- </property>
- </bean>
- </constructor-arg>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT"
- c:predicate-ref="shibboleth.Conditions.BrowserProfile" />
- </property>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.INVALID_MESSAGE" />
- </property>
- </bean>
-
- <bean id="SAMLProtocolAndRoleForPresenter"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
- p:entityContextClass="org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext"
- p:protocol-ref="shibboleth.Delegation.MetadataLookup.Protocol"
- p:role-ref="shibboleth.Delegation.MetadataLookup.Role" />
- </constructor-arg>
- </bean>
-
- <bean id="SAMLMetadataLookupForPresenter"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler" scope="prototype"
- p:entityContextClass="org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext">
- <property name="roleDescriptorResolver">
- <bean class="org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver"
- c:mdResolver-ref="shibboleth.MetadataResolver" />
- </property>
- </bean>
- </constructor-arg>
- </bean>
-
- <bean id="LibertyOutboundContexts" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateOutboundMessageContext" scope="prototype" />
-
- <bean id="PopulateLibertyContext" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateLibertyContext" scope="prototype" />
-
- <bean id="EvaluateDelegationPolicy" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.EvaluateDelegationPolicy" scope="prototype" />
-
- <bean id="DecryptDelegatedAssertionNameID" class="org.opensaml.saml.saml2.profile.impl.DecryptNameIDs" scope="prototype">
- <property name="messageLookupStrategy">
- <bean class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.DelegatedAssertionLookupStrategy" />
- </property>
- </bean>
-
- <bean id="ProcessDelegatedAssertion" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.ProcessDelegatedAssertion" scope="prototype" />
-
- <bean id="FinalizeSAMLTokenProcessing" class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.FinalizeSAMLTokenProcessing" scope="prototype" />
-
-</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml
deleted file mode 100644
index 19f93b20b..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-flow.xml
+++ /dev/null
@@ -1,96 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="saml2.sso.abstract">
-
- <!-- Bootstrap action has to be at the "top" of the flow after this flow prepends itself to parent. -->
-
- <action-state id="InitializeProfileRequestContext">
- <on-entry>
- <evaluate expression="T(net.shibboleth.utilities.java.support.primitive.DeprecationSupport).warnOnce(T(net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType).WEBFLOW, 'SAML delegation flow', null, null)" />
- <set name="flowScope.inboundSecuritySubflow" value="'intercept/security-policy/saml2-idwsf-ssos'" />
- </on-entry>
- <evaluate expression="InitializeProfileRequestContext" />
- <evaluate expression="FlowStartPopulateAuditContext" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="DecodeMessage" />
- </action-state>
-
- <action-state id="DecodeMessage">
- <!-- Here we override and "splice in" PostDecodeMessage to run after the this action defined in the parent flow -->
- <transition on="proceed" to="PostDecodeMessage" />
- </action-state>
-
- <action-state id="PostDecodeMessage">
- <evaluate expression="PopulateInboundMessageContextWithSAMLSelf" />
- <evaluate expression="ExtractMessageIDHandler" />
- <evaluate expression="ValidateActionHandler" />
- <evaluate expression="ProcessFrameworkHandler" />
- <evaluate expression="ProcessSenderHandler" />
-
- <!-- Note: SAMLPresenterContext entityID is populated by ProcessSenderHandler, so the ordering here is important. -->
- <evaluate expression="SAMLProtocolAndRoleForPresenter" />
- <evaluate expression="SAMLMetadataLookupForPresenter" />
-
- <evaluate expression="'proceed'" />
-
- <!-- If parent DecodeMessage's transition changes on 'proceed', this needs to also change. -->
- <transition on="proceed" to="CheckInboundInterceptContext" />
- </action-state>
-
- <action-state id="OutboundContextsAndSecurityParameters">
- <!-- Here we override and "splice in" LibertyOutboundContexts to run after the this action defined in the parent flow -->
- <transition on="proceed" to="LibertyOutboundContexts" />
- </action-state>
-
- <action-state id="LibertyOutboundContexts">
- <evaluate expression="LibertyOutboundContexts" />
-
- <evaluate expression="'proceed'" />
-
- <!-- If parent OutboundContextsAndSecurityParameters' transition changes on 'proceed', this needs to also change. -->
- <transition on="proceed" to="ExtractSubject" />
- </action-state>
-
-
-
- <action-state id="DoProfileWork">
- <!-- Here we override, "splice in" actions to run after the this action defined in the parent flow.
- We also "short-circuit" the entire authN and c14N process defined in the parent flow in favor of simpler inline approach here." -->
- <transition on="proceed" to="ProcessSAMLToken" />
- </action-state>
-
- <action-state id="ProcessSAMLToken">
- <evaluate expression="PopulateLibertyContext" />
- <evaluate expression="EvaluateDelegationPolicy" />
- <evaluate expression="DecryptDelegatedAssertionNameID" />
- <evaluate expression="ProcessDelegatedAssertion" />
- <evaluate expression="PopulateSubjectCanonicalizationContext" />
-
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="CallSAMLSubjectCanonicalization" />
- </action-state>
-
- <subflow-state id="CallSAMLSubjectCanonicalization" subflow="c14n">
- <input name="calledAsSubflow" value="true" />
- <transition on="proceed" to="FinalizeSAMLTokenProcessing" />
- </subflow-state>
-
- <action-state id="FinalizeSAMLTokenProcessing">
- <evaluate expression="FinalizeSAMLTokenProcessing" />
-
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="ResolveAttributes" />
- </action-state>
-
- <action-state id="EncryptAndSign">
- <!-- Here we override and "splice in" ReturnToParentFlow to run after the this action defined in the parent flow -->
- <transition on="proceed" to="ReturnToParentFlow" />
- </action-state>
-
- <bean-import resource="idwsf-ssos-beans.xml" />
-
-</flow>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-security-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-security-beans.xml
deleted file mode 100644
index d9fd28799..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-security-beans.xml
+++ /dev/null
@@ -1,107 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:context="http://www.springframework.org/schema/context"
- xmlns:util="http://www.springframework.org/schema/util"
- xmlns:p="http://www.springframework.org/schema/p"
- xmlns:c="http://www.springframework.org/schema/c"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
- http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
-
- default-init-method="initialize"
- default-destroy-method="destroy">
-
- <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"
- p:placeholderPrefix="%{" p:placeholderSuffix="}" />
-
- <bean id="SAMLMDClientCertAuthSecurityHandlerForPresenter"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.common.binding.security.impl.SAMLMDClientCertAuthSecurityHandler" scope="prototype"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:entityContextClass="org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext" />
- </constructor-arg>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT"
- c:predicate-ref="shibboleth.Conditions.BrowserProfile" />
- </property>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_AUTHN_ERROR" />
- </property>
- </bean>
-
- <bean id="CheckMandatoryAuthenticationForPresenter"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication" scope="prototype">
- <property name="authenticationLookupStrategy">
- <bean class="org.opensaml.saml.common.messaging.context.navigate.SAMLMessageContextAuthenticationFunction"
- p:entityContextClass="org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext" />
- </property>
- </bean>
- </constructor-arg>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_AUTHN_ERROR" />
- </property>
- </bean>
-
- <bean id="shibboleth.Delegation.AssertionSignatureTrustEngine" class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine">
- <constructor-arg>
- <bean class="net.shibboleth.idp.relyingparty.impl.SigningCredentialsResolver"
- c:_0-ref="shibboleth.RelyingPartyResolverService" />
- </constructor-arg>
- <constructor-arg ref="shibboleth.KeyInfoCredentialResolver" />
- </bean>
-
- <bean id="shibboleth.Delegation.SAML2AssertionTokenValidator" class="org.opensaml.saml.saml2.assertion.SAML20AssertionValidator">
- <!-- Condition validators. -->
- <constructor-arg index="0">
- <util:list>
- <bean class="org.opensaml.saml.saml2.assertion.impl.AudienceRestrictionConditionValidator" />
- <bean class="org.opensaml.saml.saml2.assertion.impl.DelegationRestrictionConditionValidator" />
- <bean class="org.opensaml.saml.saml2.assertion.impl.OneTimeUseConditionValidator">
- <constructor-arg ref="shibboleth.ReplayCache" />
- <constructor-arg value="#{null}" />
- </bean>
- </util:list>
- </constructor-arg>
- <!-- SubjectConfirmation validators. -->
- <constructor-arg index="1">
- <util:list>
- <bean class="org.opensaml.saml.saml2.assertion.impl.HolderOfKeySubjectConfirmationValidator" />
- </util:list>
- </constructor-arg>
- <!-- Statement validators. -->
- <constructor-arg index="2">
- <util:list>
- <!--Expected to be empty. -->
- </util:list>
- </constructor-arg>
- <constructor-arg index="3" ref="shibboleth.Delegation.AssertionSignatureTrustEngine" />
- <constructor-arg index="4">
- <bean class="org.opensaml.saml.security.impl.SAMLSignatureProfileValidator" />
- </constructor-arg>
- </bean>
-
- <bean id="WSSecuritySAML20AssertionTokenSecurityHandler"
- class="net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor" scope="prototype"
- c:executionDirection="INBOUND">
- <constructor-arg name="messageHandler">
- <bean class="org.opensaml.saml.saml2.wssecurity.messaging.impl.WSSecuritySAML20AssertionTokenSecurityHandler" scope="prototype"
- p:invalidFatal="true"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:assertionValidator-ref="shibboleth.Delegation.SAML2AssertionTokenValidator" />
- </constructor-arg>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.NOT"
- c:predicate-ref="shibboleth.Conditions.BrowserProfile" />
- </property>
- <property name="errorEvent">
- <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_AUTHN_ERROR" />
- </property>
- </bean>
-
-</beans>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-security-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-security-flow.xml
deleted file mode 100644
index 8cdb2ab1b..000000000
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/idwsf-ssos-security-flow.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<flow xmlns="http://www.springframework.org/schema/webflow"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/webflow http://www.springframework.org/schema/webflow/spring-webflow.xsd"
- parent="security-policy.abstract">
-
- <!-- Default inbound security processing for IDWSF SSOS SAML 2 delegation profile. -->
-
- <action-state id="IDWSFSSOSSecurityPolicy">
- <!-- First do everything related to client TLS, the SOAP binding and WS-Security processing. -->
- <evaluate expression="SAMLMDClientCertAuthSecurityHandlerForPresenter" />
- <evaluate expression="CheckMandatoryAuthenticationForPresenter" />
-
- <evaluate expression="WSSecuritySAML20AssertionTokenSecurityHandler" />
-
- <!-- Now continue with standard SAML protocol message processing. -->
- <evaluate expression="ReceivedEndpointSecurityHandler" />
- <evaluate expression="MessageReplaySecurityHandler" />
- <evaluate expression="MessageLifetimeSecurityHandler" />
- <evaluate expression="SAMLProtocolMessageXMLSignatureSecurityHandler" />
- <evaluate expression="CheckMandatoryIssuer" />
- <evaluate expression="'proceed'" />
-
- <transition on="proceed" to="proceed" />
- </action-state>
-
- <bean-import resource="idwsf-ssos-security-beans.xml" />
-
-</flow>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml
index eca780ad6..8709d7678 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-beans.xml
@@ -96,15 +96,6 @@
</property>
</bean>
- <bean id="DecorateDelegatedAssertion"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAssertion" scope="prototype"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest"
- p:libertySSOSEndpointURL="%{idp.delegation.saml2.libertySSOSEndpointURL:#{null}}">
- <property name="keyInfoGeneratorManager">
- <bean factory-method="buildBasicKeyInfoGeneratorManager" class="org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap" />
- </property>
- </bean>
-
<bean id="AddChannelBindingsToAssertions"
class="org.opensaml.saml.saml2.profile.impl.AddChannelBindingsToAssertions" scope="prototype" />
@@ -173,44 +164,5 @@
<bean id="InitializeOutboundMessageContextForSOAPFault"
class="net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContextForError" scope="prototype"
p:outboundBinding-ref="shibboleth.Binding.SAML2SOAP" />
-
- <bean id="AddAuthnStatementToAssertionFromInboundAssertionToken"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.AddAuthnStatementToAssertionFromInboundAssertionToken"
- scope="prototype"
- p:httpServletRequest-ref="shibboleth.HttpServletRequest">
- <property name="identifierGeneratorLookupStrategy">
- <bean class="net.shibboleth.idp.profile.config.navigate.IdentifierGenerationStrategyLookupFunction"
- p:defaultIdentifierGenerationStrategy-ref="shibboleth.DefaultIdentifierGenerationStrategy" />
- </property>
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.Expression">
- <constructor-arg>
- <value>
- #profileContext.getProfileId().equals('http://shibboleth.net/ns/profiles/liberty/ssos')
- </value>
- </constructor-arg>
- </bean>
- </property>
- </bean>
-
- <bean id="AddDelegationRestrictionToAssertions"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.AddDelegationRestrictionToAssertions"
- scope="prototype">
- <property name="activationCondition">
- <bean parent="shibboleth.Conditions.Expression">
- <constructor-arg>
- <value>
- #profileContext.getProfileId().equals('http://shibboleth.net/ns/profiles/liberty/ssos')
- </value>
- </constructor-arg>
- </bean>
- </property>
- </bean>
-
- <bean id="AddDelegationPolicyToAssertion"
- class="net.shibboleth.idp.saml.saml2.profile.delegation.impl.AddDelegationPolicyToAssertion"
- scope="prototype"
- p:activationCondition-ref="shibboleth.Conditions.IssuingDelegatedAssertion">
- </bean>
-
+
</beans>
\ No newline at end of file
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
index bdf6664fa..e949cb35c 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/saml/saml2/sso-abstract-flow.xml
@@ -101,7 +101,6 @@
<evaluate expression="AddInResponseToToResponse" />
<evaluate expression="AddAuthnStatementToAssertion" />
- <evaluate expression="AddAuthnStatementToAssertionFromInboundAssertionToken" />
<evaluate expression="AddAttributeStatementToAssertion" />
<evaluate expression="AddNameIDToSubjects" />
@@ -109,12 +108,9 @@
<evaluate expression="AddNotBeforeConditionToAssertions" />
<evaluate expression="AddNotOnOrAfterConditionToAssertions" />
<evaluate expression="AddAudienceRestrictionToAssertions" />
- <evaluate expression="AddDelegationRestrictionToAssertions" />
<evaluate expression="AddProxyRestrictionToAssertions" />
<evaluate expression="AddChannelBindingsToAssertions" />
<evaluate expression="AddGeneratedKeyToAssertions" />
- <evaluate expression="DecorateDelegatedAssertion" />
- <evaluate expression="AddDelegationPolicyToAssertion" />
<!-- Need access to unencrypted NameID and Assertion. -->
<evaluate expression="PostAssertionPopulateAuditContext" />
diff --git a/idp-parent/pom.xml b/idp-parent/pom.xml
index dc8ed0c64..aa646bd2a 100644
--- a/idp-parent/pom.xml
+++ b/idp-parent/pom.xml
@@ -67,7 +67,6 @@
</modules>
<properties>
- <idwsfconsumer.version>2.1.0</idwsfconsumer.version>
<java-support.version>9.0.0-SNAPSHOT</java-support.version>
<opensaml.groupId>org.opensaml</opensaml.groupId>
<opensaml.version>5.0.0-SNAPSHOT</opensaml.version>
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java
index 22d9b7dff..3a79d11d6 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/idwsf/profile/config/SSOSProfileConfiguration.java
@@ -25,12 +25,19 @@ import javax.annotation.Nullable;
import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import org.opensaml.profile.context.ProfileRequestContext;
import com.google.common.base.Predicates;
-/** Configuration support for the Liberty ID-WSF SSOS profile. */
+/**
+ * Configuration support for the Liberty ID-WSF SSOS profile.
+ *
+ * @deprecated
+ */
+ at Deprecated(forRemoval=true, since="5.0.0")
public class SSOSProfileConfiguration extends BrowserSSOProfileConfiguration {
/** ID for this profile configuration. */
@@ -53,6 +60,9 @@ public class SSOSProfileConfiguration extends BrowserSSOProfileConfiguration {
super(profileId);
delegationPredicate = Predicates.alwaysFalse();
+
+ DeprecationSupport.warn(ObjectType.BEAN, "Liberty.SSOS or Liberty.SSOS.MDDriven", "relying-party.xml",
+ "(none)");
}
/**
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/DelegationContext.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/DelegationContext.java
deleted file mode 100644
index 39d25973a..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/DelegationContext.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.security.credential.Credential;
-
-/**
- * Context which holds data relevant to the issuance of a delegated {@link org.opensaml.saml.saml2.core.Assertion}.
- */
-public class DelegationContext extends BaseContext {
-
- /** Whether issuance of a delegated assertion is active. */
- private boolean issuingDelegatedAssertion;
-
- /** Status of whether the relying party has requested issuance of a delegated assertion token. */
- @Nonnull private DelegationRequest delegationRequested;
-
- /**
- * The relying party credentials which will be included in the assertion's
- * {@link org.opensaml.saml.saml2.core.KeyInfoConfirmationDataType}.
- */
- @Nullable @NonnullElements private List<Credential> subjectConfirmationCredentials;
-
-
- /** Constructor. */
- public DelegationContext() {
- delegationRequested = DelegationRequest.NOT_REQUESTED;
- }
-
- /**
- * Get whether issuance of a delegated assertion is active.
- *
- * @return true if issuing a delegated assertion, false otherwise
- */
- public boolean isIssuingDelegatedAssertion() {
- return issuingDelegatedAssertion;
- }
-
- /**
- * Set whether issuance of a delegated assertion is active.
- *
- * @param flag true is issuing a delegated assertion false otherwise
- */
- public void setIssuingDelegatedAssertion(final boolean flag) {
- issuingDelegatedAssertion = flag;
- }
-
- /**
- * Get the status of whether the relying party has requested issuance of a delegated assertion token.
- *
- * @return the delegation request status
- */
- @Nonnull public DelegationRequest getDelegationRequested() {
- return delegationRequested;
- }
-
- /**
- * Set the status of whether the relying party has requested issuance of a delegated assertion token.
- *
- * @param requested the delegation request status
- */
- public void setDelegationRequested(@Nonnull final DelegationRequest requested) {
- delegationRequested = Constraint.isNotNull(requested, "DelegationRequest was null");
- }
-
- /**
- * Get the relying party credentials which will be included in the assertion's
- * {@link org.opensaml.saml.saml2.core.KeyInfoConfirmationDataType}.
- *
- * @return the confirmation credentials, or null
- */
- @Nullable @NonnullElements public List<Credential> getSubjectConfirmationCredentials() {
- return subjectConfirmationCredentials;
- }
-
- /**
- * Set the relying party credentials which will be included in the assertion's
- * {@link org.opensaml.saml.saml2.core.KeyInfoConfirmationDataType}.
- *
- * @param credentials the confirmation credentials
- */
- public void setSubjectConfirmationCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
- if (credentials == null) {
- subjectConfirmationCredentials = null;
- } else {
- subjectConfirmationCredentials = List.copyOf(credentials);
- }
- }
-
-}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/DelegationRequest.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/DelegationRequest.java
deleted file mode 100644
index 71eabd672..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/DelegationRequest.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation;
-
-/** Enum which represents the state of the relying party's indication of whether
- * a delegated assertion token is requested. */
-public enum DelegationRequest {
-
- /** Delegation was not requested. */
- NOT_REQUESTED,
-
- /** Delegation was requested, as optional. */
- REQUESTED_OPTIONAL,
-
- /** Delegation was requested, as required. */
- REQUESTED_REQUIRED,
-
-}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/IssuingDelegatedAssertionPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/IssuingDelegatedAssertionPredicate.java
deleted file mode 100644
index be4a8193c..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/IssuingDelegatedAssertionPredicate.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.logic.Predicate;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * A predicate which determines whether issuance of a delegated
- * SAML 2 {@link org.opensaml.saml.saml2.core.Assertion} is active.
- */
-public class IssuingDelegatedAssertionPredicate implements Predicate<ProfileRequestContext> {
-
- /** Strategy used to lookup the {@link DelegationContext}. */
- @Nonnull private Function<ProfileRequestContext, DelegationContext> delegationContextLookupStrategy;
-
- /** Constructor. */
- public IssuingDelegatedAssertionPredicate() {
- delegationContextLookupStrategy = new ChildContextLookup<>(DelegationContext.class);
- }
-
- /**
- * Set the strategy used to locate the current {@link DelegationContext}.
- *
- * @param strategy strategy used to locate the current {@link DelegationContext}
- */
- public void setDelegationContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, DelegationContext> strategy) {
- delegationContextLookupStrategy = Constraint.isNotNull(strategy,
- "DelegationContext lookup strategy may not be null");
- }
-
- /** {@inheritDoc} */
- public boolean test(@Nullable final ProfileRequestContext input) {
- if (input == null) {
- return false;
- }
- final DelegationContext delegationContext = delegationContextLookupStrategy.apply(input);
- if (delegationContext == null) {
- return false;
- }
- return delegationContext.isIssuingDelegatedAssertion();
- }
-
-}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/LibertySSOSContext.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/LibertySSOSContext.java
deleted file mode 100644
index 2535ae512..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/LibertySSOSContext.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation;
-
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.saml.saml2.core.Assertion;
-
-/**
- * Context for storing information related to the Liberty SSOS profile and use of an inbound delegated
- * {@link Assertion} token.
- */
-public class LibertySSOSContext extends BaseContext {
-
- /** The SAML 2 Assertion which serves as the authentication token for the AuthnRequest and
- * has been successfully attested by the AuthnRequest presenter. */
- private Assertion attestedToken;
-
- /** Get the confirmation method that was successfully used by the attesting entity. */
- private String attestedSubjectConfirmationMethod;
-
- /**
- * Get the SAML 2 Assertion which serves as the authentication token for the AuthnRequest and
- * which has been successfully attested by the AuthnRequest presenter.
- *
- * @return Returns the attestedToken.
- */
- public Assertion getAttestedToken() {
- return attestedToken;
- }
-
- /**
- * Set the SAML 2 Assertion which serves as the authentication token for the AuthnRequest and
- * which has been successfully attested by the AuthnRequest presenter.
- *
- * @param newAttestedToken The attestedToken to set.
- */
- public void setAttestedToken(final Assertion newAttestedToken) {
- attestedToken = newAttestedToken;
- }
-
- /**
- * Get the SAML 2 SubjectConfirmation method which was used by the presenter in
- * the attestation of the authentication token.
- *
- * @return Returns the attestedSubjectConfirmationMethod.
- */
- public String getAttestedSubjectConfirmationMethod() {
- return attestedSubjectConfirmationMethod;
- }
-
- /**
- * Set the SAML 2 SubjectConfirmation method which was used by the presenter in
- * the attestation of the authentication token.
- *
- * @param newAttestedSubjectConfirmationMethod The attestedSubjectConfirmationMethod to set.
- */
- public void setAttestedSubjectConfirmationMethod(final String newAttestedSubjectConfirmationMethod) {
- attestedSubjectConfirmationMethod = newAttestedSubjectConfirmationMethod;
- }
-
-}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/package-info.java
deleted file mode 100644
index 09475891c..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/package-info.java
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/** Profile processing components related to SAML 2 delegation. */
-package net.shibboleth.idp.saml.saml2.profile.delegation;
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/DelegationPolicy.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/DelegationPolicy.java
deleted file mode 100644
index 2db2c7f4b..000000000
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/DelegationPolicy.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.xmlobject;
-
-import javax.xml.namespace.QName;
-
-import org.opensaml.saml.common.SAMLObject;
-
-/** SAMLObject for the Shibboleth DelegationPolicy extension supporting SAML delegation. */
-public interface DelegationPolicy extends SAMLObject {
-
- /** Element local name. */
- public static final String DEFAULT_ELEMENT_LOCAL_NAME = "DelegationPolicy";
-
- /** Default element name. */
- public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_DELEXT10_NS,
- DEFAULT_ELEMENT_LOCAL_NAME, ExtensionsConstants.SHIB_DELEXT10_PREFIX);
-
- /** VerifyDepth attribute name. */
- public static final String MAX_DELEGATION_CHAIN_LENGTH_ATTRIB_NAME = "MaximumTokenDelegationChainLength";
-
- /**
- * Get the MaximumTokenDelegationChainLength attribute value.
- *
- * @return the MaximumTokenDelegationChainLength attribute value
- */
- public Long getMaximumTokenDelegationChainLength();
-
- /**
- * Set the MaximumTokenDelegationChainLength attribute value.
- *
- * @param value the new MaximumTokenDelegationChainLength attribute value
- */
- public void setMaximumTokenDelegationChainLength(Long value);
-
-}
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java
index cd5910569..d89928f98 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/xmlobject/ExtensionsConstants.java
@@ -29,15 +29,6 @@ public final class ExtensionsConstants {
/** Namespace QName prefix for Shibboleth extensions to SAML metadata. */
public static final String SHIB_MDEXT10_PREFIX = "shibmd";
- /** Relative resource path for XML schema for Shibboleth extensions supporting SAML delegation. */
- public static final String SHIB_DELEXT10_SCHEMA_LOCATION = "/schema/shibboleth-delegation-1.0.xsd";
-
- /** URI for XML schema namespace for Shibboleth extensions supporting SAML delegation. */
- public static final String SHIB_DELEXT10_NS = "urn:mace:shibboleth:delegation:1.0";
-
- /** Namespace QName prefix for Shibboleth extensions supporting AML delegation. */
- public static final String SHIB_DELEXT10_PREFIX = "shibdel";
-
/** Constructor. */
private ExtensionsConstants() {
}
diff --git a/idp-saml-api/src/main/resources/schema/shibboleth-delegation-1.0.xsd b/idp-saml-api/src/main/resources/schema/shibboleth-delegation-1.0.xsd
deleted file mode 100644
index e82b19990..000000000
--- a/idp-saml-api/src/main/resources/schema/shibboleth-delegation-1.0.xsd
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<schema xmlns="http://www.w3.org/2001/XMLSchema" targetNamespace="urn:mace:shibboleth:delegation:1.0" elementFormDefault="unqualified" attributeFormDefault="unqualified" version="1.0">
-
- <element name="DelegationPolicy">
- <annotation>
- <documentation>
- Represents policy regarding issuance and/or use of delegated Assertion tokens.
- </documentation>
- </annotation>
- <complexType>
- <attribute name="MaximumTokenDelegationChainLength" type="nonNegativeInteger" use="optional">
- <annotation>
- <documentation>
- Specifies a limit on the total number of delegates that may be derived from the initial SAML token.
- </documentation>
- </annotation>
- </attribute>
- </complexType>
- </element>
-
-</schema>
diff --git a/idp-saml-impl/pom.xml b/idp-saml-impl/pom.xml
index 181816563..e2cb9a1cd 100644
--- a/idp-saml-impl/pom.xml
+++ b/idp-saml-impl/pom.xml
@@ -23,12 +23,6 @@
<dependencies>
<!-- Compile Dependencies -->
- <dependency>
- <groupId>net.shibboleth.liberty</groupId>
- <artifactId>idwsfconsumer</artifactId>
- <version>${idwsfconsumer.version}</version>
- </dependency>
-
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>idp-core</artifactId>
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddAuthnStatementToAssertionFromInboundAssertionToken.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddAuthnStatementToAssertionFromInboundAssertionToken.java
deleted file mode 100644
index bd45fbf2b..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddAuthnStatementToAssertionFromInboundAssertionToken.java
+++ /dev/null
@@ -1,329 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.config.navigate.IdentifierGenerationStrategyLookupFunction;
-import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
-import net.shibboleth.utilities.java.support.annotation.Prototype;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.security.IdentifierGenerationStrategy;
-
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.io.UnmarshallingException;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.AuthnStatement;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.profile.SAML2ActionSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Action that builds an {@link AuthnStatement} and adds it to an {@link Assertion} returned by a lookup
- * strategy, by default in the {@link ProfileRequestContext#getOutboundMessageContext()}.
- *
- * <p>This action is designed specifically to be used with SAML 2 delegation.
- * The {@link AuthnStatement} will be cloned directly from the inbound {@link Assertion} token obtained
- * from via the {@link #setAssertionTokenStrategy(Function)}.
- * </p>
- *
- * <p>If no {@link Response} exists, then an {@link Assertion} directly in the outbound message context will
- * be used or created</p>
- *
- * <p>A constructed {@link Assertion} will have its ID, IssueInstant, Issuer, and Version properties set.
- * The issuer is based on
- * {@link net.shibboleth.idp.relyingparty.RelyingPartyConfiguration#getResponderId(ProfileRequestContext)}.</p>
- *
- * @event {@link EventIds#INVALID_MSG_CTX}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#MESSAGE_PROC_ERROR}
- */
- at Prototype
-public class AddAuthnStatementToAssertionFromInboundAssertionToken extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log =
- LoggerFactory.getLogger(AddAuthnStatementToAssertionFromInboundAssertionToken.class);
-
- /**
- * Whether the generated authentication statement should be placed in its own assertion or added to one if it
- * exists.
- */
- private boolean statementInOwnAssertion;
-
- /** Strategy used to locate the {@link IdentifierGenerationStrategy} to use. */
- @Nonnull private Function<ProfileRequestContext,IdentifierGenerationStrategy> idGeneratorLookupStrategy;
-
- /** Strategy used to obtain the assertion issuer value. */
- @Nonnull private Function<ProfileRequestContext,String> issuerLookupStrategy;
-
- /** The generator to use. */
- @Nullable private IdentifierGenerationStrategy idGenerator;
-
- /** EntityID to populate as assertion issuer. */
- @Nullable private String issuerId;
-
- /** Strategy used to locate the {@link Assertion} to operate on. */
- @NonnullAfterInit private Function<ProfileRequestContext,Assertion> assertionLookupStrategy;
-
- /** Function used to resolve the inbound assertion token to process. */
- @Nonnull private Function<ProfileRequestContext, Assertion> assertionTokenStrategy;
-
- /** The authentication statement which is to be cloned into the new Assertion. */
- @Nullable private AuthnStatement sourceStatement;
-
- /** Constructor. */
- public AddAuthnStatementToAssertionFromInboundAssertionToken() {
- statementInOwnAssertion = false;
-
- idGeneratorLookupStrategy = new IdentifierGenerationStrategyLookupFunction();
- issuerLookupStrategy = new ResponderIdLookupFunction();
- assertionTokenStrategy = new DelegatedAssertionLookupStrategy();
- }
-
- /**
- * Set whether the generated statement should be placed in its own assertion or added to one if it exists.
- *
- * @return whether the generated statement should be placed in its own assertion or added to one if it exists
- */
- public boolean isStatementInOwnAssertion() {
- return statementInOwnAssertion;
- }
-
- /**
- * Set whether the generated authentication statement should be placed in its own assertion or added to one if it
- * exists.
- *
- * @param inOwnAssertion whether the generated authentication statement should be placed in its own assertion or
- * added to one if it exists
- */
- public void setStatementInOwnAssertion(final boolean inOwnAssertion) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- statementInOwnAssertion = inOwnAssertion;
- }
-
- /**
- * Set the strategy used to locate the inbound assertion token to process.
- *
- * @param strategy lookup strategy
- */
- public void setAssertionTokenStrategy(
- @Nonnull final Function<ProfileRequestContext,Assertion> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionTokenStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the {@link IdentifierGenerationStrategy} to use.
- *
- * @param strategy lookup strategy
- */
- public void setIdentifierGeneratorLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,IdentifierGenerationStrategy> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- idGeneratorLookupStrategy =
- Constraint.isNotNull(strategy, "IdentifierGenerationStrategy lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate the issuer value to use.
- *
- * @param strategy lookup strategy
- */
- public void setIssuerLookupStrategy(@Nonnull final Function<ProfileRequestContext,String> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- issuerLookupStrategy = Constraint.isNotNull(strategy, "Issuer lookup strategy cannot be null");
- }
-
- /**
- * Get the {@link IdentifierGenerationStrategy} to use if an assertion must be created.
- *
- * @return the ID generation strategy
- */
- @Nonnull public IdentifierGenerationStrategy getIdGenerator() {
- Constraint.isNotNull(idGenerator, "IdentifierGenerationStrategy has not been initialized yet");
- return idGenerator;
- }
-
- /**
- * Get the issuer name to use if an assertion must be created.
- *
- * @return the issuer name
- */
- @Nonnull public String getIssuerId() {
- Constraint.isNotNull(issuerId, "Issuer name has not been initialized yet");
- return issuerId;
- }
-
- /**
- * Set the strategy used to locate the {@link Assertion} to operate on.
- *
- * @param strategy strategy used to locate the {@link Assertion} to operate on
- */
- public void setAssertionLookupStrategy(@Nonnull final Function<ProfileRequestContext,Assertion> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionLookupStrategy = Constraint.isNotNull(strategy, "Assertion lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (assertionLookupStrategy == null) {
- assertionLookupStrategy = new AssertionStrategy();
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- log.debug("{} Attempting to add an AuthnStatement to outgoing Assertion based on inbound Assertion token",
- getLogPrefix());
-
- idGenerator = idGeneratorLookupStrategy.apply(profileRequestContext);
- if (idGenerator == null) {
- log.debug("{} No identifier generation strategy", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- issuerId = issuerLookupStrategy.apply(profileRequestContext);
- if (issuerId == null) {
- log.debug("{} No assertion issuer value", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- final Assertion attestedToken = assertionTokenStrategy.apply(profileRequestContext);
- if (attestedToken == null) {
- log.debug("{} No inbound assertion token", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- if (!attestedToken.getAuthnStatements().isEmpty()) {
- sourceStatement = attestedToken.getAuthnStatements().get(0);
- }
- if (sourceStatement == null) {
- log.debug("{} Inbound assertion token contains no AuthnStatement", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- return true;
- }
-
-//CheckStyle: ReturnCount OFF
- /** {@inheritDoc} */
- @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- final Assertion assertion = assertionLookupStrategy.apply(profileRequestContext);
- if (assertion == null) {
- log.error("Unable to obtain Assertion to modify");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return;
- }
-
- final AuthnStatement statement = getNewAuthnStatement();
- if (statement == null) {
- log.error("Unable to obtain AuthnStatement to add");
- ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
- return;
- }
- assertion.getAuthnStatements().add(statement);
-
- log.debug("{} Added AuthenticationStatement to Assertion {}", getLogPrefix(), assertion.getID());
- }
-//CheckStyle: ReturnCount OFF
-
- /**
- * Obtain the new {@link AuthnStatement} to add by cloning the inbound token's statement
- * which was previously stored.
- *
- * @return the cloned AuthnStatement, or null if an error is encountered
- */
- @Nullable protected AuthnStatement getNewAuthnStatement() {
- try {
- return XMLObjectSupport.cloneXMLObject(sourceStatement);
- } catch (final MarshallingException | UnmarshallingException e) {
- log.error("{} Error cloning Assertion AuthnStatement", getLogPrefix(), e);
- return null;
- }
- }
-
- /**
- * Default strategy for obtaining assertion to modify.
- *
- * <p>If the outbound context is empty, a new assertion is created and stored there. If the outbound
- * message is already an assertion, it's returned. If the outbound message is a response, then either
- * an existing or new assertion in the response is returned, depending on the action setting. If the
- * outbound message is anything else, null is returned.</p>
- */
- private class AssertionStrategy implements Function<ProfileRequestContext,Assertion> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Assertion apply(@Nullable final ProfileRequestContext input) {
- if (input != null && input.getOutboundMessageContext() != null) {
- final Object outboundMessage = input.getOutboundMessageContext().getMessage();
- if (outboundMessage == null) {
- final Assertion ret = SAML2ActionSupport.buildAssertion(
- AddAuthnStatementToAssertionFromInboundAssertionToken.this,
- getIdGenerator(), getIssuerId());
- input.getOutboundMessageContext().setMessage(ret);
- return ret;
- } else if (outboundMessage instanceof Assertion) {
- return (Assertion) outboundMessage;
- } else if (outboundMessage instanceof Response) {
- if (isStatementInOwnAssertion() || ((Response) outboundMessage).getAssertions().isEmpty()) {
- return SAML2ActionSupport.addAssertionToResponse(
- AddAuthnStatementToAssertionFromInboundAssertionToken.this,
- (Response) outboundMessage, getIdGenerator(), getIssuerId());
- }
- return ((Response) outboundMessage).getAssertions().get(0);
- }
- }
-
- return null;
- }
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertion.java
deleted file mode 100644
index 6c07c31d5..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertion.java
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-import net.shibboleth.utilities.java.support.annotation.Prototype;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Advice;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Response;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Action which adds a {@link DelegationPolicy} element to the {@link Advice} of an {@link Assertion}.
- *
- * <p>
- * The assertion to modify is determined by the strategy set by {@link #setAssertionLookupStrategy(Function)}.
- *</p>
- *
- * <p>
- * The maximum chain delegation length value for the added policy element is as follows:
- * </p>
- * <ol>
- * <li>If an inbound assertion token is present as determined by the strategy set by
- * {@link #setAssertionTokenStrategy(Function)}, the value is obtained from the policy contained
- * within the first {@link DelegationPolicy} element of that assertion's {@link Advice} element.</li>
- * <li>Otherwise the request is assumed to be the initial SSO request, so the value is determined by
- * the requesting SP's profile configuration value
- * {@link BrowserSSOProfileConfiguration#getMaximumTokenDelegationChainLength(ProfileRequestContext)}.</li>
- * <li>If neither of these approaches produces a value, a default value is used
- * {@link #DEFAULT_POLICY_MAX_CHAIN_LENGTH}</li>
- * </ol>
- */
- at Prototype
-public class AddDelegationPolicyToAssertion extends AbstractProfileAction {
-
- /** Default policy max chain length, when can't otherwise be derived. */
- @Nonnull public static final Long DEFAULT_POLICY_MAX_CHAIN_LENGTH = 1L;
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AddDelegationPolicyToAssertion.class);
-
- /** Strategy used to locate the {@link Assertion} to operate on. */
- @Nonnull private Function<ProfileRequestContext,Assertion> assertionLookupStrategy;
-
- /** Function used to resolve the inbound assertion token to process. */
- @Nonnull private Function<ProfileRequestContext, Assertion> assertionTokenStrategy;
-
- /** Strategy used to lookup the RelyingPartyContext. */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** The assertion to modify. */
- @Nullable private Assertion assertion;
-
- /** The inbound delegated Assertion that was attested. */
- @Nullable private Assertion attestedAssertion;
-
- /** The max token delegation chain length value to add. */
- @Nullable private Long maxChainLength;
-
- /** Constructor. */
- public AddDelegationPolicyToAssertion() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- assertionLookupStrategy = new AssertionStrategy();
- assertionTokenStrategy = new DelegatedAssertionLookupStrategy();
- }
-
- /**
- * Set the strategy used to locate the inbound assertion token to process.
- *
- * @param strategy lookup strategy
- */
- public void setAssertionTokenStrategy(
- @Nonnull final Function<ProfileRequestContext,Assertion> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionTokenStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the current {@link RelyingPartyContext}.
- *
- * @param strategy strategy used to locate the current {@link RelyingPartyContext}
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy,
- "RelyingPartyContext lookup strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the {@link Assertion} to operate on.
- *
- * @param strategy strategy used to locate the {@link Assertion} to operate on
- */
- public void setAssertionLookupStrategy(@Nonnull final Function<ProfileRequestContext,Assertion> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionLookupStrategy = Constraint.isNotNull(strategy, "Assertion lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- assertion = assertionLookupStrategy.apply(profileRequestContext);
- if (assertion == null) {
- log.debug("No assertion found, nothing to do");
- return false;
- }
-
- attestedAssertion = assertionTokenStrategy.apply(profileRequestContext);
-
- maxChainLength = resolveMaxChainLength(profileRequestContext);
- log.debug("Resolved token max delegation chain length: {}", maxChainLength);
-
- return true;
- }
-
- /** {@inheritDoc} */
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final DelegationPolicy delegationPolicy = (DelegationPolicy) XMLObjectSupport.buildXMLObject(
- DelegationPolicy.DEFAULT_ELEMENT_NAME);
- delegationPolicy.setMaximumTokenDelegationChainLength(maxChainLength);
-
- if (assertion.getAdvice() == null) {
- assertion.setAdvice((Advice) XMLObjectSupport.buildXMLObject(Advice.DEFAULT_ELEMENT_NAME));
- }
-
- assertion.getAdvice().getChildren().add(delegationPolicy);
- }
-
- /**
- * Resolve the max token delegation chain length value to add to the assertion.
- *
- * @param profileRequestContext the current profile request context
- * @return the max chain length value
- */
- @Nonnull protected Long resolveMaxChainLength(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (attestedAssertion != null) {
- // If have an inbound assertion token, then this is N-tier, so we copy the value from the inbound token.
- log.debug("Saw inbound assertion token, attempting to extract max delegation chain length "
- + "from token's DelegationPolicy");
- if (attestedAssertion.getAdvice() != null) {
- final List<XMLObject> inboundPolicies =
- attestedAssertion.getAdvice().getChildren(DelegationPolicy.DEFAULT_ELEMENT_NAME);
- if (inboundPolicies != null && !inboundPolicies.isEmpty()) {
- return ((DelegationPolicy)inboundPolicies.get(0)).getMaximumTokenDelegationChainLength();
- }
- }
- } else {
- // If no inbound assertion token, this must be initial SSO, so pull from RP's IdP config.
- log.debug("Attempting to resolve max delegation chain length from RP profile config");
- final RelyingPartyContext relyingPartyContext =
- relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (relyingPartyContext != null) {
- if (relyingPartyContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
- return ((BrowserSSOProfileConfiguration) relyingPartyContext.getProfileConfig())
- .getMaximumTokenDelegationChainLength(profileRequestContext);
- }
- log.debug("Profile config was not BrowserSSOProfileConfiguration, can't evaluate: {}",
- relyingPartyContext.getProfileConfig() != null ?
- relyingPartyContext.getProfileConfig().getClass().getName() : "null");
- }
- }
- log.debug("Unable to resolve max delegation chain length from inbound token or profile config, "
- + "returning default: {}", DEFAULT_POLICY_MAX_CHAIN_LENGTH);
- return DEFAULT_POLICY_MAX_CHAIN_LENGTH;
- }
-
- /**
- * Default strategy for obtaining assertion to modify.
- */
- private class AssertionStrategy implements Function<ProfileRequestContext,Assertion> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public Assertion apply(@Nullable final ProfileRequestContext input) {
- if (input != null && input.getOutboundMessageContext() != null) {
- final Object outboundMessage = input.getOutboundMessageContext().getMessage();
- if (outboundMessage instanceof Assertion) {
- return (Assertion) outboundMessage;
- } else if (outboundMessage instanceof Response) {
- final Response response = (Response) outboundMessage;
- if (response.getAssertions().isEmpty()) {
- return null;
- }
- for (final Assertion theAssertion : response.getAssertions()) {
- if (!theAssertion.getAuthnStatements().isEmpty()) {
- log.debug("Found Assertion with AuthnStatement to decorate in outbound Response");
- return theAssertion;
- }
- }
- log.debug("Found no Assertion with AuthnStatement in outbound Response, returning first");
- return response.getAssertions().get(0);
- }
- }
-
- return null;
- }
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationRestrictionToAssertions.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationRestrictionToAssertions.java
deleted file mode 100644
index c89a8ae36..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationRestrictionToAssertions.java
+++ /dev/null
@@ -1,314 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.time.Instant;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.io.UnmarshallingException;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.messaging.context.navigate.MessageLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.opensaml.profile.context.navigate.OutboundMessageContextLookup;
-import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
-import org.opensaml.saml.ext.saml2delrestrict.Delegate;
-import org.opensaml.saml.ext.saml2delrestrict.DelegationRestrictionType;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Condition;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.profile.SAML2ActionSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Action which adds a {@link DelegationRestrictionType} {@link Condition} to each {@link Assertion}
- * contained within the outbound {@link Response}.
- *
- * <p>If the inbound assertion token specified in {@link LibertySSOSContext} contains an existing
- * {@link DelegationRestrictionType} condition, it is cloned, and the current SAML presenter entityID
- * is added as a new {@link Delegate}. Otherwise a new instance of {@link DelegationRestrictionType}
- * is created and a single new {@link Delegate} added.
- * </p>
- *
- * <p>In both cases the new delegate entityID is obtained from the {@link SAMLPresenterEntityContext} located
- * using the corresponding lookup function. The new delegate is augmented with the SAML subject confirmation method
- * obtained from the current {@link LibertySSOSContext}.
- * </p>
- *
- * @event {@link EventIds#INVALID_MSG_CTX}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#MESSAGE_PROC_ERROR}
- */
-public class AddDelegationRestrictionToAssertions extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(AddDelegationRestrictionToAssertions.class);
-
- /** Strategy used to locate the Response to operate on. */
- @Nonnull private Function<ProfileRequestContext,Response> responseLookupStrategy;
-
- /** Strategy used to locate the SAMLPresenterEntityContext. */
- @Nonnull private Function<ProfileRequestContext,SAMLPresenterEntityContext> presenterContextLookupStrategy;
-
- /** Function used to resolve the Liberty context to populate. */
- @Nonnull private Function<ProfileRequestContext,LibertySSOSContext> libertyContextLookupStrategy;
-
- /** List of assertions to modify. */
- @Nullable private List<Assertion> assertions;
-
- /** The delegated Assertion that was attested. */
- @Nullable private Assertion attestedAssertion;
-
- /** The subject confirmation method successfully used to confirm the assertion by the presenter. */
- @Nullable private String attestedSubjectConfirmationMethod;
-
- /** The presenting entity which successfully attested the Assertion token. */
- @Nullable private String presenterEntityID;
-
- /** The instant of delegation. */
- @Nullable private Instant delegationInstant;
-
- /**
- * Constructor.
- */
- public AddDelegationRestrictionToAssertions() {
- responseLookupStrategy = new MessageLookup<>(Response.class).compose(new OutboundMessageContextLookup());
- presenterContextLookupStrategy =
- new ChildContextLookup<>(SAMLPresenterEntityContext.class).compose(
- new InboundMessageContextLookup());
-
- libertyContextLookupStrategy = new ChildContextLookup<>(LibertySSOSContext.class);
- }
-
- /**
- * Set the strategy used to locate the {@link LibertySSOSContext} to populate.
- *
- * @param strategy lookup strategy
- */
- public void setLibertyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,LibertySSOSContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- libertyContextLookupStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the Response to operate on.
- *
- * @param strategy lookup strategy
- */
- public void setResponseLookupStrategy(@Nonnull final Function<ProfileRequestContext,Response> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- responseLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
- }
-
- /**
- * Set the strategy used to locate the {@link SAMLPresenterEntityContext}.
- *
- * @param strategy lookup strategy
- */
- public void setPresenterLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,SAMLPresenterEntityContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- presenterContextLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- final Response response = responseLookupStrategy.apply(profileRequestContext);
- if (response == null) {
- log.debug("{} No SAML Response located in current profile request context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
-
- assertions = response.getAssertions();
- if (assertions.isEmpty()) {
- log.debug("{} No assertions to modify", getLogPrefix());
- return false;
- }
-
- log.debug("{} Attempting to add a DelegationRestrictionType Condition to {} Assertion(s) in Response",
- getLogPrefix(), assertions.size());
-
- final SAMLPresenterEntityContext presenterContext = presenterContextLookupStrategy.apply(profileRequestContext);
- if (presenterContext == null || presenterContext.getEntityId() == null) {
- log.debug("{} No SAML presenter entityID", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
- presenterEntityID = presenterContext.getEntityId();
-
- final LibertySSOSContext libertyContext = libertyContextLookupStrategy.apply(profileRequestContext);
- if (libertyContext == null) {
- log.debug("{} No LibertySSOSContext", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- attestedAssertion = libertyContext.getAttestedToken();
- if (attestedAssertion == null) {
- log.debug("{} No attested SAML 2 Assertion", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- attestedSubjectConfirmationMethod = libertyContext.getAttestedSubjectConfirmationMethod();
- if (attestedSubjectConfirmationMethod == null) {
- log.debug("{} No attested SAML 2 SubjectConfirmation method", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- //TODO do we have a single harmonized "issue instant" for the outbound request data?
- delegationInstant = Instant.now();
-
- return super.doPreExecute(profileRequestContext);
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- for (final Assertion assertion : assertions) {
- addDelegationRestriction(profileRequestContext,
- SAML2ActionSupport.addConditionsToAssertion(this, assertion));
- log.debug("{} Added DelegationRestrictionType Condition to Assertion {}",
- getLogPrefix(), assertion.getID());
- }
- }
-
- /**
- * Add a delegation restriction condition to the specified conditions.
- *
- * @param profileRequestContext the current profile request context
- * @param conditions the conditions instance to modify
- */
- protected void addDelegationRestriction(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final Conditions conditions) {
- final DelegationRestrictionType drt = buildDelegationRestriction(profileRequestContext);
- if (drt != null) {
- conditions.getConditions().add(drt);
- } else {
- log.error("{} Unable to build DelegationRestriction Condition", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
- }
- }
-
- /**
- * Using the existing attested Assertion from the presenter as a context, build the
- * appropriate DelegationRestrictionType Condition.
- *
- * @param profileRequestContext the current profile request context
- *
- * @return new DelegationRestrictionType Condition, or null if the condition could not be build
- */
- @Nullable protected DelegationRestrictionType buildDelegationRestriction(
- @Nonnull final ProfileRequestContext profileRequestContext) {
- DelegationRestrictionType drt = null;
-
- final Delegate newDelegate = buildDelegate(profileRequestContext);
-
- drt = getDelegationRestrictionCondition(attestedAssertion.getConditions());
-
- if (drt != null) {
- try {
- drt = XMLObjectSupport.cloneXMLObject(drt);
- } catch (final MarshallingException | UnmarshallingException e) {
- log.error("{} Error cloning DelegationRestriction Condition", getLogPrefix(), e);
- return null;
- }
- } else {
- drt = (DelegationRestrictionType) XMLObjectSupport.getBuilder(DelegationRestrictionType.TYPE_NAME)
- .buildObject(Condition.DEFAULT_ELEMENT_NAME, DelegationRestrictionType.TYPE_NAME);
- }
-
- drt.getDelegates().add(newDelegate);
-
- return drt;
- }
-
- /**
- * Get the DelegationRestrictionType Condition from the supplied Conditions, if present.
- *
- * @param conditions the Assertion Conditions to process
- * @return the DelegationRestrictionType Condition object, or null if not present
- */
- @Nullable protected DelegationRestrictionType getDelegationRestrictionCondition(
- @Nullable final Conditions conditions) {
- if (conditions == null) {
- return null;
- }
-
- for (final Condition conditionChild : conditions.getConditions()) {
- if (DelegationRestrictionType.TYPE_NAME.equals(conditionChild.getSchemaType())) {
- if (conditionChild instanceof DelegationRestrictionType) {
- return (DelegationRestrictionType) conditionChild;
- }
- log.warn("Saw Condition of xsi:type DelegationRestrictionType, but incorrect class instance: {}",
- conditionChild.getClass().getName());
- }
- }
- return null;
- }
-
- /**
- * Build the Delegate child for the DelegationRestrictionType Condition,
- * based on the current request context.
- *
- * @param profileRequestContext the
- *
- * @return the new Delegate instance
- */
- @Nonnull protected Delegate buildDelegate(@Nonnull final ProfileRequestContext profileRequestContext) {
- final NameID delegateNameID = (NameID) XMLObjectSupport.buildXMLObject(NameID.DEFAULT_ELEMENT_NAME);
- delegateNameID.setValue(presenterEntityID);
- delegateNameID.setFormat(NameID.ENTITY);
-
- final Delegate newDelegate = (Delegate) XMLObjectSupport.buildXMLObject(Delegate.DEFAULT_ELEMENT_NAME);
- newDelegate.setNameID(delegateNameID);
- newDelegate.setConfirmationMethod(attestedSubjectConfirmationMethod);
- newDelegate.setDelegationInstant(delegationInstant);
-
- return newDelegate;
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DecorateDelegatedAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DecorateDelegatedAssertion.java
deleted file mode 100644
index 9a089b88f..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DecorateDelegatedAssertion.java
+++ /dev/null
@@ -1,634 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Objects;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import jakarta.servlet.http.HttpServletRequest;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationContext;
-import net.shibboleth.utilities.java.support.collection.Pair;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.openliberty.xmltooling.disco.MetadataAbstract;
-import org.openliberty.xmltooling.disco.ProviderID;
-import org.openliberty.xmltooling.disco.SecurityContext;
-import org.openliberty.xmltooling.disco.SecurityMechID;
-import org.openliberty.xmltooling.disco.ServiceType;
-import org.openliberty.xmltooling.security.Token;
-import org.openliberty.xmltooling.soapbinding.Framework;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.XMLObjectBuilder;
-import org.opensaml.core.xml.schema.XSAny;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventException;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Attribute;
-import org.opensaml.saml.saml2.core.AttributeStatement;
-import org.opensaml.saml.saml2.core.AttributeValue;
-import org.opensaml.saml.saml2.core.Audience;
-import org.opensaml.saml.saml2.core.AudienceRestriction;
-import org.opensaml.saml.saml2.core.KeyInfoConfirmationDataType;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.core.Subject;
-import org.opensaml.saml.saml2.core.SubjectConfirmation;
-import org.opensaml.saml.saml2.core.SubjectConfirmationData;
-import org.opensaml.saml.saml2.profile.SAML2ActionSupport;
-import org.opensaml.security.SecurityException;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.soap.wsaddressing.Address;
-import org.opensaml.soap.wsaddressing.EndpointReference;
-import org.opensaml.soap.wsaddressing.Metadata;
-import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
-import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorFactory;
-import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager;
-import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
-import org.opensaml.xmlsec.signature.KeyInfo;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * A profile action which decorates instances of {@link Assertion} appropriately for use as delegation tokens.
- *
- * <p>
- * An instance of {@link DelegationContext} is resolved via the strategy set via
- * {@link #setDelegationContextLookupStrategy(Function)}. If no delegation context is found
- * or if {@link DelegationContext#isIssuingDelegatedAssertion()} is false, then no decoration
- * occurs.
- * </p>
- *
- * <p>
- * The decoration consists of 3 primary parts:
- * </p>
- * <ol>
- * <li>
- * A holder-of-key {@link SubjectConfirmation} is added to the assertion's {@link Subject}. The credentials used
- * are taken from {@link DelegationContext#getSubjectConfirmationCredentials()}.
- * </li>
- * <li>
- * An additional {@link Audience} is added to the assertion condition {@link AudienceRestriction}, indicating
- * the IdP's own entityID as an acceptable audience. The IdP entityID is resolved from the active
- * {@link RelyingPartyContext}, which is resolved via the strategy set by
- * {@link #setRelyingPartyContextLookupStrategy(Function)}.
- * </li>
- * <li>
- * An additional {@link Attribute} is added to the assertion's {@link AttributeStatement} containing an
- * {@link EndpointReference}, indicating the location and other info necessary for the recipient to present
- * the delegated assertion at the IdP for delegated SSO. The attribute name is a URI type with name
- * {@link LibertyConstants#SERVICE_TYPE_SSOS}. The endpoint URL is either set directly on this action via
- * {@link #setLibertySSOSEndpointURL(String)}, or is resolved via the strategy
- * {@link #setLibertySSOSEndpointURLLookupStrategy(Function)}.
- * </li>
- * </ol>
- *
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- */
-public class DecorateDelegatedAssertion extends AbstractProfileAction {
-
- /** Class logger. */
- private final Logger log = LoggerFactory.getLogger(DecorateDelegatedAssertion.class);
-
- // Configured data
-
- /** The URL at which the IdP will accept Liberty ID-WSF SSOS requests. */
- private String libertySSOSEndpointURL;
-
- /** The strategy used to resolve the URL at which the IdP will accept Liberty ID-WSF SSOS requests. */
- @Nullable private Function<Pair<ProfileRequestContext, HttpServletRequest>,String>
- libertySSOSEndpointURLLookupStrategy;
-
- /** Strategy used to lookup the RelyingPartyContext. */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Strategy used to lookup the {@link DelegationContext}. */
- @Nonnull private Function<ProfileRequestContext, DelegationContext> delegationContextLookupStrategy;
-
- /** Strategy used to locate the {@link Assertion}s on which to operate. */
- @Nonnull private Function<ProfileRequestContext,List<Assertion>> assertionLookupStrategy;
-
- /** The manager used to generate KeyInfo instances from Credentials. */
- @Nonnull private NamedKeyInfoGeneratorManager keyInfoGeneratorManager;
-
-
- // Runtime data
-
- /** The delegation context instance to be populated. */
- private DelegationContext delegationContext;
-
- /** The list of assertions on which to operate. */
- private List<Assertion> assertions;
-
- /** The current RelyingPartyContext. */
- private RelyingPartyContext relyingPartyContext;
-
- /** The entityID of the local responder entity. */
- private String responderId;
-
- /** The entityID of the SAML relying party. */
- private String relyingPartyId;
-
- /** Constructor. */
- public DecorateDelegatedAssertion() {
- libertySSOSEndpointURLLookupStrategy = new LibertySSOSEndpointURLStrategy();
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- delegationContextLookupStrategy = new ChildContextLookup<>(DelegationContext.class);
- assertionLookupStrategy = new AssertionStrategy();
-
- }
-
- /**
- * Set the statically-configured URL at which the IdP will accept Liberty ID-WSF SSOS requests.
- *
- * @param url the Liberty ID-WSF SSOS endpoint URL, or null
- */
- public void setLibertySSOSEndpointURL(@Nullable final String url) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- libertySSOSEndpointURL = StringSupport.trimOrNull(url);
- }
-
- /**
- * Set strategy used to resolve the URL at which the IdP will accept Liberty ID-WSF SSOS requests.
- *
- * @param strategy the Liberty ID-WSF SSOS endpoint URL lookup strategy, or null
- */
- public void setLibertySSOSEndpointURLLookupStrategy(
- @Nullable final Function<Pair<ProfileRequestContext, HttpServletRequest>,String> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- libertySSOSEndpointURLLookupStrategy = strategy;
- }
-
- /**
- * Set the strategy used to locate the current {@link RelyingPartyContext}.
- *
- * @param strategy strategy used to locate the current {@link RelyingPartyContext}
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy,
- "RelyingPartyContext lookup strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the current {@link DelegationContext}.
- *
- * @param strategy strategy used to locate the current {@link DelegationContext}
- */
- public void setDelegationContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, DelegationContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- delegationContextLookupStrategy = Constraint.isNotNull(strategy,
- "DelegationContext lookup strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the {@link Assertion} to operate on.
- *
- * @param strategy strategy used to locate the {@link Assertion} to operate on
- */
- public void setAssertionLookupStrategy(@Nonnull final Function<ProfileRequestContext,List<Assertion>> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- assertionLookupStrategy = Constraint.isNotNull(strategy, "Assertion lookup strategy may not be null");
- }
-
- /**
- * Set the {@link KeyInfoGeneratorManager} instance used to generate {@link KeyInfo}
- * from {@link Credential}.
- *
- * @param manager the manager instance to use
- */
- public void setKeyInfoGeneratorManager(@Nonnull final NamedKeyInfoGeneratorManager manager) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- keyInfoGeneratorManager = Constraint.isNotNull(manager, "NamedKeyInfoGeneratorManager may not be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (keyInfoGeneratorManager == null) {
- throw new ComponentInitializationException("KeyInfoGeneratorManager may not be null");
- }
- if (libertySSOSEndpointURL == null && libertySSOSEndpointURLLookupStrategy == null) {
- throw new ComponentInitializationException("Either Liberty SSOS endpoint URL "
- + "or its lookup strategy must be non-null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
-
- // Eval the activation condition first. Don't bother with the rest if false, esp since
- // could terminate with a fatal error unnecessarily.
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- assertions = assertionLookupStrategy.apply(profileRequestContext);
- if (assertions == null || assertions.isEmpty()) {
- log.debug("No Assertions found to decorate, skipping further processing");
- return false;
- }
-
- if (!doPreExecuteDelegationInfo(profileRequestContext)) {
- return false;
- }
-
- if (!doPreExecuteRelyingParty(profileRequestContext)) {
- return false;
- }
-
- return true;
- }
-
- /**
- * Pre-execute actions on the delegation-specific info.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed
- */
- protected boolean doPreExecuteDelegationInfo(@Nonnull final ProfileRequestContext profileRequestContext) {
- delegationContext = delegationContextLookupStrategy.apply(profileRequestContext);
- if (delegationContext == null || !delegationContext.isIssuingDelegatedAssertion()) {
- log.debug("Issuance of delegated was not indicated, skipping assertion decoration");
- return false;
- }
-
- if (delegationContext.getSubjectConfirmationCredentials() == null
- || delegationContext.getSubjectConfirmationCredentials().isEmpty()) {
- log.warn("No subject confirmation credentials available in delegation context");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- resolveLibertySSOSEndpointURL(profileRequestContext);
- if (libertySSOSEndpointURL == null) {
- log.warn("No Liberty SSOS endpoint URL was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- return true;
- }
-
- /**
- * Pre-execute actions on the relying party context info.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed
- */
- protected boolean doPreExecuteRelyingParty(@Nonnull final ProfileRequestContext profileRequestContext) {
- relyingPartyContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (relyingPartyContext == null) {
- log.warn("No RelyingPartyContext was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- relyingPartyId = relyingPartyContext.getRelyingPartyId();
- if (relyingPartyId == null) {
- log.warn("No relying party ID was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- // This is @Nonnull
- responderId = relyingPartyContext.getConfiguration().getResponderId(profileRequestContext);
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
-
- try {
- log.debug("Decorating assertion for use as delegated token");
- decorateDelegatedAssertion(profileRequestContext);
- } catch (final EventException e) {
- if (Objects.equals(EventIds.PROCEED_EVENT_ID, e.getEventID())) {
- log.debug("Decoration of Assertion for delegation terminated with explicit proceed signal");
- } else {
- log.warn("Decoration of Assertion for delegation terminated with explicit non-proceed signal", e);
- ActionSupport.buildEvent(profileRequestContext, e.getEventID());
- }
- }
- }
-
- /**
- * Resolve and store the effective Liberty SSOS endpoint URL to use.
- *
- * @param profileRequestContext the current request context
- *
- */
-//CheckStyle: ReturnCount OFF
- private void resolveLibertySSOSEndpointURL(final ProfileRequestContext profileRequestContext) {
- if (libertySSOSEndpointURL != null) {
- log.debug("Using explicitly configured Liberty SSOS endpoint URL: {}", libertySSOSEndpointURL);
- return;
- }
- if (libertySSOSEndpointURLLookupStrategy != null) {
- libertySSOSEndpointURL = libertySSOSEndpointURLLookupStrategy.apply(
- new Pair<>(profileRequestContext, getHttpServletRequest()));
- if (libertySSOSEndpointURL != null) {
- log.debug("Using Liberty SSOS endpoint URL resolved via strategy: {}", libertySSOSEndpointURL);
- return;
- }
- log.debug("Liberty SSOS endpoint URL strategy was unable to resolve a value");
- }
- log.debug("No effective Liberty SSOS endpoint URL could be determined");
- }
-//CheckStyle: ReturnCount ON
-
- /**
- * Decorate the Assertion to allow use as a delegated security token by the SAML requester.
- *
- * @param requestContext the current request context
- *
- * @throws EventException to propagate events
- */
- private void decorateDelegatedAssertion(@Nonnull final ProfileRequestContext requestContext) throws EventException {
- for (final Assertion assertion : assertions) {
- addSAMLPeerSubjectConfirmation(requestContext, assertion);
- addIdPAudienceRestriction(requestContext, assertion);
- addLibertySSOSEPRAttribute(requestContext, assertion);
- }
- }
-
- /**
- * Add Liberty SSOS service Endpoint Reference (EPR) attribute to Assertion's AttributeStatement.
- *
- * @param requestContext the current request context
- * @param assertion the delegated assertion being issued
- */
- private void addLibertySSOSEPRAttribute(@Nonnull final ProfileRequestContext requestContext,
- @Nonnull final Assertion assertion) {
- final Attribute attribute = (Attribute) XMLObjectSupport.buildXMLObject(Attribute.DEFAULT_ELEMENT_NAME);
- attribute.setName(LibertyConstants.SERVICE_TYPE_SSOS);
- attribute.setNameFormat(Attribute.URI_REFERENCE);
- attribute.getAttributeValues().add(buildLibertSSOSEPRAttributeValue(requestContext, assertion));
-
- final List<AttributeStatement> attributeStatements = assertion.getAttributeStatements();
- AttributeStatement attributeStatement = null;
- if (attributeStatements.isEmpty()) {
- attributeStatement =
- (AttributeStatement) XMLObjectSupport.buildXMLObject(AttributeStatement.DEFAULT_ELEMENT_NAME);
- assertion.getAttributeStatements().add(attributeStatement);
- } else {
- attributeStatement = attributeStatements.get(0);
- }
- attributeStatement.getAttributes().add(attribute);
- }
-
- /**
- * Build the Liberty SSOS EPR AttributeValue object.
- *
- * @param requestContext the current request context
- * @param assertion the delegated assertion being issued
- *
- * @return the AttributeValue object containing the EPR
- */
- @SuppressWarnings("unchecked")
- @Nonnull private XMLObject buildLibertSSOSEPRAttributeValue(@Nonnull final ProfileRequestContext requestContext,
- @Nonnull final Assertion assertion) {
-
- final Address address = (Address) XMLObjectSupport.buildXMLObject(Address.ELEMENT_NAME);
- address.setURI(libertySSOSEndpointURL);
-
- final MetadataAbstract libertyAbstract = (MetadataAbstract) XMLObjectSupport.buildXMLObject(
- LibertyConstants.DISCO_ABSTRACT_ELEMENT_NAME);
- libertyAbstract.setValue(LibertyConstants.SSOS_EPR_METADATA_ABSTRACT);
-
- final ServiceType serviceType = (ServiceType) XMLObjectSupport.buildXMLObject(
- LibertyConstants.DISCO_SERVICE_TYPE_ELEMENT_NAME);
- serviceType.setValue(LibertyConstants.SERVICE_TYPE_SSOS);
-
- final ProviderID providerID = (ProviderID) XMLObjectSupport.buildXMLObject(
- LibertyConstants.DISCO_PROVIDERID_ELEMENT_NAME);
- providerID.setValue(responderId);
-
- final Framework framework = (Framework) XMLObjectSupport.buildXMLObject(Framework.DEFAULT_ELEMENT_NAME);
- framework.setVersion("2.0");
-
- final SecurityMechID securityMechID = (SecurityMechID) XMLObjectSupport.buildXMLObject(
- LibertyConstants.DISCO_SECURITY_MECH_ID_ELEMENT_NAME);
- securityMechID.setValue(LibertyConstants.SECURITY_MECH_ID_CLIENT_TLS_PEER_SAML_V2);
-
- final Token token = (Token) XMLObjectSupport.buildXMLObject(LibertyConstants.SECURITY_TOKEN_ELEMENT_NAME);
- token.setUsage(LibertyConstants.TOKEN_USAGE_SECURITY_TOKEN);
- token.setRef("#" + assertion.getID());
-
- final SecurityContext securityContext = (SecurityContext) XMLObjectSupport.buildXMLObject(
- LibertyConstants.DISCO_SECURITY_CONTEXT_ELEMENT_NAME);
- securityContext.getSecurityMechIDs().add(securityMechID);
- securityContext.getTokens().add(token);
-
- final Metadata metadata = (Metadata) XMLObjectSupport.buildXMLObject(Metadata.ELEMENT_NAME);
- metadata.getUnknownXMLObjects().add(libertyAbstract);
- metadata.getUnknownXMLObjects().add(serviceType);
- metadata.getUnknownXMLObjects().add(providerID);
- metadata.getUnknownXMLObjects().add(framework);
- metadata.getUnknownXMLObjects().add(securityContext);
-
- final EndpointReference epr =
- (EndpointReference) XMLObjectSupport.buildXMLObject(EndpointReference.ELEMENT_NAME);
- epr.setAddress(address);
- epr.setMetadata(metadata);
-
- final XMLObjectBuilder<XSAny> xsAnyBuilder =
- (XMLObjectBuilder<XSAny>) XMLObjectSupport.getBuilder(XSAny.TYPE_NAME);
- final XSAny attributeValue = xsAnyBuilder.buildObject(AttributeValue.DEFAULT_ELEMENT_NAME);
- attributeValue.getUnknownXMLObjects().add(epr);
-
- return attributeValue;
- }
-
- /**
- * An an AudienceRestriction condition indicating the IdP as an acceptable Audience.
- *
- * @param requestContext the current request context
- * @param assertion the assertion being isued
- */
- private void addIdPAudienceRestriction(@Nonnull final ProfileRequestContext requestContext,
- @Nonnull final Assertion assertion) {
-
- SAML2ActionSupport.addConditionsToAssertion(this, assertion);
-
- final List<AudienceRestriction> audienceRestrictions = assertion.getConditions().getAudienceRestrictions();
- AudienceRestriction audienceRestriction = null;
- if (audienceRestrictions.isEmpty()) {
- audienceRestriction = (AudienceRestriction) XMLObjectSupport.buildXMLObject(
- AudienceRestriction.DEFAULT_ELEMENT_NAME);
- assertion.getConditions().getAudienceRestrictions().add(audienceRestriction);
- } else {
- audienceRestriction = audienceRestrictions.get(0);
- }
-
- // Sanity check that IdP audience has not already been added by other code.
- for (final Audience audience : audienceRestriction.getAudiences()) {
- if (Objects.equals(responderId, StringSupport.trimOrNull(audience.getURI()))) {
- log.debug("Local entity ID '{}' already present in assertion AudienceRestriction set, skipping",
- responderId);
- return;
- }
- }
-
- final Audience idpAudience = (Audience) XMLObjectSupport.buildXMLObject(Audience.DEFAULT_ELEMENT_NAME);
- idpAudience.setURI(responderId);
- audienceRestriction.getAudiences().add(idpAudience);
- }
-
- /**
- * Add SubjectConfirmation to the Assertion Subject to allow confirmation when wielded by the SAML requester.
- *
- * @param requestContext the current request context
- * @param assertion the assertion being issued
- *
- * @throws EventException to propagate event signals
- */
- private void addSAMLPeerSubjectConfirmation(@Nonnull final ProfileRequestContext requestContext,
- @Nonnull final Assertion assertion) throws EventException {
-
- final KeyInfoConfirmationDataType scData =
- (KeyInfoConfirmationDataType) XMLObjectSupport.getBuilder(KeyInfoConfirmationDataType.TYPE_NAME)
- .buildObject(SubjectConfirmationData.DEFAULT_ELEMENT_NAME, KeyInfoConfirmationDataType.TYPE_NAME);
-
- //TODO could support some strategy for using different named managers, rather than always the default manager.
- final KeyInfoGeneratorManager kigm = keyInfoGeneratorManager.getDefaultManager();
-
- for (final Credential cred : delegationContext.getSubjectConfirmationCredentials()) {
- final KeyInfoGeneratorFactory kigf = kigm.getFactory(cred);
- final KeyInfoGenerator kig = kigf.newInstance();
- try {
- final KeyInfo keyInfo = kig.generate(cred);
- scData.getKeyInfos().add(keyInfo);
- } catch (final SecurityException e) {
- log.warn("Error generating KeyInfo from peer credential: {}", e.getMessage());
- throw new EventException(EventIds.MESSAGE_PROC_ERROR, "Error generating KeyInfo from credential", e);
- }
- }
-
- final NameID nameID = (NameID) XMLObjectSupport.buildXMLObject(NameID.DEFAULT_ELEMENT_NAME);
- nameID.setValue(relyingPartyId);
- nameID.setFormat(NameID.ENTITY);
-
- final SubjectConfirmation sc = (SubjectConfirmation) XMLObjectSupport.buildXMLObject(
- SubjectConfirmation.DEFAULT_ELEMENT_NAME);
- sc.setMethod(SubjectConfirmation.METHOD_HOLDER_OF_KEY);
- sc.setNameID(nameID);
- sc.setSubjectConfirmationData(scData);
-
- Subject subject = assertion.getSubject();
- if (subject==null) {
- subject = (Subject) XMLObjectSupport.buildXMLObject(Subject.DEFAULT_ELEMENT_NAME);
- assertion.setSubject(subject);
- }
- subject.getSubjectConfirmations().add(sc);
- }
-
- /**
- * Default strategy for obtaining assertion to modify.
- *
- * <p>If the outbound context is empty, a new assertion is created and stored there. If the outbound
- * message is already an assertion, it's returned. If the outbound message is a response, then either
- * an existing or new assertion in the response is returned, depending on the action setting. If the
- * outbound message is anything else, null is returned.</p>
- */
- private class AssertionStrategy implements Function<ProfileRequestContext,List<Assertion>> {
-
- /** {@inheritDoc} */
- @Override
- @Nullable public List<Assertion> apply(@Nullable final ProfileRequestContext input) {
- if (input != null && input.getOutboundMessageContext() != null) {
- final Object outboundMessage = input.getOutboundMessageContext().getMessage();
- if (outboundMessage == null) {
- log.debug("No outbound message found, nothing to decorate");
- return Collections.emptyList();
- } else if (outboundMessage instanceof Assertion) {
- log.debug("Found Assertion to decorate as outbound message");
- return Collections.singletonList((Assertion) outboundMessage);
- } else if (outboundMessage instanceof Response) {
- final Response response = (Response) outboundMessage;
- if (response.getAssertions().isEmpty()) {
- log.debug("Outbound Response contained no Assertions, nothing to decorate");
- return Collections.emptyList();
- }
- for (final Assertion assertion : response.getAssertions()) {
- if (!assertion.getAuthnStatements().isEmpty()) {
- log.debug("Found Assertion with AuthnStatement to decorate in outbound Response");
- return Collections.singletonList(assertion);
- }
- }
- log.debug("Found no Assertion with AuthnStatement in outbound Response, returning first");
- return Collections.singletonList(response.getAssertions().get(0));
- } else {
- log.debug("Found no Assertion to decorate");
- return null;
- }
- }
- log.debug("Input ProfileRequestContext or outbound MessageContext was null");
- return null;
- }
-
- }
-
- /** Strategy that builds the SSOS endpoint URL based on the current HTTP request
- * using default values for scheme, port and URI path suffix. */
- public static class LibertySSOSEndpointURLStrategy
- implements Function<Pair<ProfileRequestContext,HttpServletRequest>, String> {
-
- /** Logger. */
- private Logger log = LoggerFactory.getLogger(LibertySSOSEndpointURLStrategy.class);
-
- /** {@inheritDoc} */
- @Override
- @Nullable public String apply(@Nullable final Pair<ProfileRequestContext, HttpServletRequest> input) {
- if (input == null) {
- log.debug("Input Pair<ProfileRequestContext,HttpServletRequest> was null");
- return null;
- }
- if (input.getSecond() != null) {
- final HttpServletRequest request = input.getSecond();
- return String.format("https://%s:%s%s", request.getServerName(),
- LibertyConstants.DEFAULT_SSOS_ENDPOINT_URL_PORT,
- request.getServletContext().getContextPath()
- + LibertyConstants.DEFAULT_SSOS_ENDPOINT_URL_RELATIVE_PATH);
- }
- log.debug("Input HttpServletRequest was null");
- return null;
- }
- }
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategy.java
deleted file mode 100644
index 41dcc1598..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategy.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Lookup function to return the valid delegated assertion token in effect for the Liberty SSOS request.
- */
-public class DelegatedAssertionLookupStrategy implements Function<ProfileRequestContext, Assertion> {
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(DelegatedAssertionLookupStrategy.class);
-
- /** Function used to resolve the Liberty context to populate. */
- @Nonnull private Function<ProfileRequestContext, LibertySSOSContext> libertyContextLookupStrategy;
-
- /** Constructor. */
- public DelegatedAssertionLookupStrategy() {
- libertyContextLookupStrategy = new ChildContextLookup<>(LibertySSOSContext.class);
- }
-
- /**
- * Constructor.
- *
- * @param strategy the lookup strategy for {@link LibertySSOSContext}.
- */
- public DelegatedAssertionLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, LibertySSOSContext> strategy) {
- libertyContextLookupStrategy = Constraint.isNotNull(strategy, "Liberty context lookup strategy cannot be null");
- }
-
- /** {@inheritDoc} */
- @Nullable public Assertion apply(@Nullable final ProfileRequestContext input) {
- if (input == null) {
- return null;
- }
-
- final LibertySSOSContext libertyContext = libertyContextLookupStrategy.apply(input);
- if (libertyContext == null || libertyContext.getAttestedToken() == null) {
- log.debug("No attested token available from Liberty context");
- return null;
- }
- return libertyContext.getAttestedToken();
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java
deleted file mode 100644
index 7b01b33d9..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicy.java
+++ /dev/null
@@ -1,365 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.ext.saml2delrestrict.DelegationRestrictionType;
-import org.opensaml.saml.saml2.core.Advice;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Condition;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Action which implements policy controls to decide whether an SSO request based
- * on a delegated {@link Assertion} token is allowed to proceed.
- *
- * <p>
- * Two policy checks are performed:
- * </p>
- * <ol>
- * <li>
- * The active {@link SSOSProfileConfiguration} is resolved and its predicate
- * is applied. If the predicate evaluates to false,
- * the request is not allowed. An example predicate commonly used here is
- * {@link net.shibboleth.idp.saml.profile.config.logic.AllowedSAMLPresentersPredicate}.
- * </li>
- * <li>
- * The length of the delegation chain as indicated in the inbound assertion token's {@link DelegationRestrictionType}
- * condition is evaluated against a policy maximum resolved via the strategy set by
- * {@link #setPolicyMaxChainLengthStrategy(Function)}, or from
- * {@link BrowserSSOProfileConfiguration#DEFAULT_DELEGATION_CHAIN_LENGTH} if no value
- * can otherwise be resolved. If the chain of {@link org.opensaml.saml.ext.saml2delrestrict.Delegate}
- * child elements is greater than or equal to the resolved policy max chain length, the request is not allowed.
- * The default policy resolution strategy is to look at the first {@link DelegationPolicy} contained within the
- * inbound assertion token's {@link Advice}.
- * </li>
- * </ol>
- *
- * @event {@link AuthnEventIds#NO_CREDENTIALS}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#INVALID_SEC_CFG}
- */
-public class EvaluateDelegationPolicy extends AbstractProfileAction {
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(EvaluateDelegationPolicy.class);
-
- // Configured data
-
- /** Strategy used to lookup the RelyingPartyContext. */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Function used to resolve the assertion token to process. */
- @Nonnull private Function<ProfileRequestContext, Assertion> assertionTokenStrategy;
-
- /** Function used to resolve the policy maximum delegation chain length. */
- @Nonnull private Function<ProfileRequestContext, Long> policyMaxChainLengthStrategy;
-
- // Runtime data
-
- /** The inbound delegated assertion token being evaluated. */
- private Assertion assertionToken;
-
- /** The policy maximum token delegation chain length. */
- private Long policyMaxChainLength;
-
- /** The actual token delegation chain length. */
- private Long tokenChainLength;
-
- /** Whether the request is allowed to proceed. */
- private boolean delegationAllowed;
-
- /** Constructor. */
- public EvaluateDelegationPolicy() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- assertionTokenStrategy = new DelegatedAssertionLookupStrategy();
- policyMaxChainLengthStrategy = new PolicyMaxChainLengthStrategy();
- }
-
- /**
- * Set the strategy used to resolve the policy maximum delegation chain length.
- *
- * @param strategy the strategy
- */
- public void setPolicyMaxChainLengthStrategy(@Nonnull final Function<ProfileRequestContext, Long> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- policyMaxChainLengthStrategy = Constraint.isNotNull(strategy,
- "Policy max chain length strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the inbound assertion token to process.
- *
- * @param strategy lookup strategy
- */
- public void setAssertionTokenStrategy(
- @Nonnull final Function<ProfileRequestContext,Assertion> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionTokenStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the current {@link RelyingPartyContext}.
- *
- * @param strategy strategy used to locate the current {@link RelyingPartyContext}
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy,
- "RelyingPartyContext lookup strategy may not be null");
- }
-
- /** {@inheritDoc} */
- protected boolean doPreExecute(final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- if (!doPreExecuteInbound(profileRequestContext)) {
- return false;
- }
-
- if (!doPreExecuteRelyingParty(profileRequestContext)) {
- return false;
- }
-
- return true;
- }
-
- /**
- * Pre-execute actions on the inbound message.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed
- */
- protected boolean doPreExecuteInbound(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- assertionToken = assertionTokenStrategy.apply(profileRequestContext);
- if (assertionToken == null) {
- log.warn("{} No valid SAML 2 Assertion available within the request context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
- return false;
- }
-
- tokenChainLength = getTokenDelegationChainLength(assertionToken);
-
- policyMaxChainLength = getPolicyMaxDelegationChainLength(profileRequestContext);
-
- return true;
- }
-
- /**
- * Pre-execute actions on the relying party context info.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed
- */
- protected boolean doPreExecuteRelyingParty(@Nonnull final ProfileRequestContext profileRequestContext) {
- final RelyingPartyContext relyingPartyContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (relyingPartyContext == null) {
- log.warn("No RelyingPartyContext was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- if (relyingPartyContext.getProfileConfig() instanceof SSOSProfileConfiguration) {
- delegationAllowed = ((SSOSProfileConfiguration)relyingPartyContext.getProfileConfig()).isDelegation(
- profileRequestContext);
- } else {
- log.warn("Relying party profile configuration was not SSOSProfileConfiguration");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!checkAllowedDelegate(profileRequestContext)) {
- return;
- }
- checkTokenDelegationChainLength(profileRequestContext);
- }
-
- /**
- * Apply policy control.
- *
- * @param profileRequestContext the current request context
- *
- * @return true if check passes, false if not
- */
- protected boolean checkAllowedDelegate(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (!delegationAllowed) {
- log.warn("Delegation predicate eval indicates delegated token use NOT allowed");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- return false;
- }
- log.debug("Delegation predicate eval indicates delegated token use is allowed");
- return true;
- }
-
- /**
- * Apply policy control which checks the actual token chain length against
- * the policy maximum chain length.
- *
- * @param profileRequestContext the current request context
- *
- * @return true if check passes, false if not
- */
- protected boolean checkTokenDelegationChainLength(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (tokenChainLength == null || tokenChainLength <= 0) {
- log.debug("Token did not have delegation chain, this must be initial delegation request, check passes");
- return true;
- }
-
- log.debug("Token delegation chain length was '{}', policy max was '{}'",
- tokenChainLength, policyMaxChainLength);
-
- if (tokenChainLength < policyMaxChainLength) {
- log.debug("Token delegation chain length is OK");
- return true;
- }
-
- if (tokenChainLength > policyMaxChainLength) {
- log.warn("Presented token delegation chain length exceeds policy max, and fails acceptance");
- //TODO right event ID?
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- return false;
- }
-
- if (tokenChainLength.equals(policyMaxChainLength)) {
- log.warn("Token delegation chain length is equal to policy max, can't issue a new token from this token");
- //TODO right event ID?
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- return false;
- }
-
- return true;
- }
-
- /**
- * Get the length of the delegation chain in the presented token.
- *
- * @param token the token to evaluate
- * @return the token delegation chain length
- */
- protected Long getTokenDelegationChainLength(@Nonnull final Assertion token) {
- final DelegationRestrictionType delRestrict = getDelegationRestrictionCondition(token.getConditions());
-
- if (delRestrict != null && delRestrict.getDelegates() != null) {
- return (long) delRestrict.getDelegates().size();
- }
- return null;
- }
-
- /**
- * Get the DelegationRestrictionType Condition from the supplied Conditions, if present.
- *
- * @param conditions the Assertion Conditions to process
- * @return the DelegationRestrictionType Condition object, or null if not present
- */
- protected DelegationRestrictionType getDelegationRestrictionCondition(@Nullable final Conditions conditions) {
- if (conditions == null) {
- return null;
- }
-
- for (final Condition conditionChild : conditions.getConditions()) {
- if (DelegationRestrictionType.TYPE_NAME.equals(conditionChild.getSchemaType())) {
- if (conditionChild instanceof DelegationRestrictionType) {
- return (DelegationRestrictionType) conditionChild;
- }
- log.warn("Saw Condition of xsi:type DelegationRestrictionType, but incorrect class instance: {}",
- conditionChild.getClass().getName());
- }
- }
- return null;
- }
-
- /**
- * Get the effective maximum delegation chain length allowed by policy.
- *
- * @param profileRequestContext the current request context
- * @return the policy max delegation chain policy length
- */
- @Nonnull protected Long getPolicyMaxDelegationChainLength(
- @Nonnull final ProfileRequestContext profileRequestContext) {
-
- final Long value = policyMaxChainLengthStrategy.apply(profileRequestContext);
- if (value != null) {
- log.debug("Strategy resolved policy max token delegation chain length: {}", value);
- return value;
- }
- log.debug("Returning default policy max token delegation chain length: {}",
- BrowserSSOProfileConfiguration.DEFAULT_DELEGATION_CHAIN_LENGTH);
- return BrowserSSOProfileConfiguration.DEFAULT_DELEGATION_CHAIN_LENGTH;
-
- }
-
- /**
- * Default strategy used to resolve the policy maximum token delegation chain length.
- *
- * <p>
- * This strategy evaluates the extension element value
- * {@link DelegationPolicy#getMaximumTokenDelegationChainLength()} present in the {@link Advice}
- * of the presented {@link Assertion} token.
- * </p>
- */
- public class PolicyMaxChainLengthStrategy implements Function<ProfileRequestContext,Long> {
-
- /** {@inheritDoc} */
- @Nullable
- public Long apply(@Nullable final ProfileRequestContext input) {
- if (assertionToken == null || assertionToken.getAdvice() == null) {
- return null;
- }
- final Advice inboundAdvice = assertionToken.getAdvice();
- final List<XMLObject> inboundPolicies = inboundAdvice.getChildren(DelegationPolicy.DEFAULT_ELEMENT_NAME);
- if (inboundPolicies != null && !inboundPolicies.isEmpty()) {
- return ((DelegationPolicy)inboundPolicies.get(0)).getMaximumTokenDelegationChainLength();
- }
- return null;
- }
-
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java
deleted file mode 100644
index 161aaccb2..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessing.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.authn.context.SubjectContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.utilities.java.support.annotation.Prototype;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Post-process the results of {@link org.opensaml.saml.saml2.core.Assertion} token subject canonicalization.
- *
- * @event {@link AuthnEventIds#INVALID_SUBJECT_C14N_CTX}
- * @pre <pre>profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class).getPrincipalName() != null</pre>
- * @post <pre>profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class) == null</pre>
- * @post <pre>profileRequestContext.getSubcontext(SubjectContext.class).getPrincipalName() != null</pre>
- */
- at Prototype
-public class FinalizeSAMLTokenProcessing extends AbstractProfileAction {
-
- /** Logger. */
- private Logger log = LoggerFactory.getLogger(FinalizeSAMLTokenProcessing.class);
-
- /** The canonicalized principal name. */
- private String principalName;
-
- /** {@inheritDoc} */
- protected boolean doPreExecute(final ProfileRequestContext profileRequestContext) {
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- final SubjectCanonicalizationContext c14nContext =
- profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class);
-
- if (c14nContext == null) {
- log.warn("{} SubjectCanonicalizationContext was missing", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
- return false;
- }
-
- principalName = c14nContext.getPrincipalName();
- if (principalName == null) {
- log.warn("{} SubjectCanonicalizationContext principal name was null", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
- return false;
- }
-
- log.debug("{} Subject c14n from inbound delegated Assertion token produced principal name: {}",
- getLogPrefix(), principalName);
-
- return true;
- }
-
- /** {@inheritDoc} */
- protected void doExecute(final ProfileRequestContext profileRequestContext) {
- profileRequestContext.removeSubcontext(SubjectCanonicalizationContext.class);
-
- final SubjectContext subjectContext = profileRequestContext.getSubcontext(SubjectContext.class, true);
- subjectContext.setPrincipalName(principalName);
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/LibertyConstants.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/LibertyConstants.java
deleted file mode 100644
index a548d70e0..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/LibertyConstants.java
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import javax.xml.namespace.QName;
-
-import org.openliberty.xmltooling.Konstantz;
-import org.openliberty.xmltooling.disco.MetadataAbstract;
-import org.openliberty.xmltooling.disco.ProviderID;
-import org.openliberty.xmltooling.disco.SecurityContext;
-import org.openliberty.xmltooling.disco.SecurityMechID;
-import org.openliberty.xmltooling.disco.ServiceType;
-import org.openliberty.xmltooling.security.Token;
-import org.openliberty.xmltooling.soapbinding.Sender;
-
-/** Liberty-related constants. */
-public final class LibertyConstants {
-
- // Various QNames that aren't defined currently in OpenLiberty.
-
- /** disco:Abstract element QName. */
- public static final QName DISCO_ABSTRACT_ELEMENT_NAME =
- new QName(Konstantz.DISCO_NS, MetadataAbstract.LOCAL_NAME, Konstantz.DISCO_PREFIX);
-
- /** disco:ServiceType element QName. */
- public static final QName DISCO_SERVICE_TYPE_ELEMENT_NAME =
- new QName(Konstantz.DISCO_NS, ServiceType.LOCAL_NAME, Konstantz.DISCO_PREFIX);
-
- /** disco:ProviderID element QName. */
- public static final QName DISCO_PROVIDERID_ELEMENT_NAME =
- new QName(Konstantz.DISCO_NS, ProviderID.LOCAL_NAME, Konstantz.DISCO_PREFIX);
-
- /** disco:SecurityContext element QName. */
- public static final QName DISCO_SECURITY_CONTEXT_ELEMENT_NAME =
- new QName(Konstantz.DISCO_NS, SecurityContext.LOCAL_NAME, Konstantz.DISCO_PREFIX);
-
- /** disco:SecurityMechID element QName. */
- public static final QName DISCO_SECURITY_MECH_ID_ELEMENT_NAME =
- new QName(Konstantz.DISCO_NS, SecurityMechID.LOCAL_NAME, Konstantz.DISCO_PREFIX);
-
- /** disco:ServiceType element QName. */
- public static final QName SECURITY_TOKEN_ELEMENT_NAME =
- new QName(Konstantz.SEC_NS, Token.LOCAL_NAME, Konstantz.SEC_PREFIX);
-
- /** sb:Sender element QName. */
- public static final QName SOAP_BINDING_SENDER_ELEMENT_NAME =
- new QName(Konstantz.SB_NS, Sender.LOCAL_NAME, Konstantz.SB_PREFIX);
-
- // Various constants relevant to the extension
-
- /** Liberty SOAP Binding 2.0 URI. */
- public static final String SOAP_BINDING_20_URI = Konstantz.SB_NS;
-
- /** SSOS ServiceType value. */
- public static final String SERVICE_TYPE_SSOS = "urn:liberty:ssos:2006-08";
-
- /** SecurityMechID 'urn:liberty:security:2005-02:ClientTLS:peerSAMLV2'. */
- public static final String SECURITY_MECH_ID_CLIENT_TLS_PEER_SAML_V2 =
- "urn:liberty:security:2005-02:ClientTLS:peerSAMLV2";
-
- /** sec:Token/@usage 'urn:liberty:security:tokenusage:2006-08:SecurityToken'. */
- public static final String TOKEN_USAGE_SECURITY_TOKEN = "urn:liberty:security:tokenusage:2006-08:SecurityToken";
-
- /** Data for SSOS EPR Metadata disco:Abstract. */
- public static final String SSOS_EPR_METADATA_ABSTRACT = "ID-WSF Single Sign-On Service";
-
- /** Liberty SSOS WS-Addressing inbound Action URI (AuthnRequest).*/
- public static final String SSOS_AUTHN_REQUEST_WSA_ACTION_URI = "urn:liberty:ssos:2006-08:AuthnRequest";
-
- /** Liberty SSOS WS-Addressing outbound Action URI (Response).*/
- public static final String SSOS_RESPONSE_WSA_ACTION_URI = "urn:liberty:ssos:2006-08:Response";
-
- /** The default path at the IdP for the SSOS endpoint, relative to the IdP context path. */
- public static final String DEFAULT_SSOS_ENDPOINT_URL_RELATIVE_PATH = "/profile/IDWSF/SSOS";
-
- /** The default port at the IdP for the SSOS endpoint. */
- public static final String DEFAULT_SSOS_ENDPOINT_URL_PORT = "8443";
-
- /** Constructor. Prevent instantiation. */
- private LibertyConstants() { }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateDelegationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateDelegationContext.java
deleted file mode 100644
index a71900f30..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateDelegationContext.java
+++ /dev/null
@@ -1,567 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationContext;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationRequest;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.core.criterion.EntityIdCriterion;
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.AttributeConsumingServiceContext;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.criterion.RoleDescriptorCriterion;
-import org.opensaml.saml.saml2.core.Audience;
-import org.opensaml.saml.saml2.core.AudienceRestriction;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
-import org.opensaml.saml.saml2.metadata.RequestedAttribute;
-import org.opensaml.saml.saml2.metadata.RoleDescriptor;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.CredentialResolver;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.criteria.UsageCriterion;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * A profile action which determines whether issuance of a delegated
- * {@link org.opensaml.saml.saml2.core.Assertion} token
- * is active, and populates a {@link DelegationContext} appropriately.
- *
- * <p>
- * The output of 3 different evaluations is combined to produce the final result:
- * </p>
- * <ol>
- *
- * <li>
- * Determination is made whether delegation is requested by the relying party, as a value of type
- * {@link DelegationRequest}. Delegation may be requested via:
- * <ul>
- * <li>The inclusion of the IdP entityID as an {@link Audience} in the {@link AudienceRestriction} condition
- * of the inbound {@link AuthnRequest}.</li>
- * <li>The presence of a {@link RequestedAttribute} with name {@link LibertyConstants#SERVICE_TYPE_SSOS} in
- * the relying party's metadata via {@link AttributeConsumingService}.
- * </ul>
- * </li>
- *
- * <li>
- * Determination is made whether issuance of a delegated token is allowed for the relying party,
- * based on the (predicate driven) {@link BrowserSSOProfileConfiguration#isAllowDelegation(ProfileRequestContext)}
- * method.
- * </li>
- *
- * <li>
- * Holder-of-key subject confirmation {@link Credential} instances are resolved for the relying party from
- * its resolved metadata {@link RoleDescriptor}.
- * </li>
- *
- * </ol>
- *
- * <p>
- * If 1) delegation is allowed, 2) subject confirmation credentials were resolved, and 3) request status was either
- * {@link DelegationRequest#REQUESTED_OPTIONAL} or {@link DelegationRequest#REQUESTED_REQUIRED},
- * a {@link DelegationContext} is populated indicating issuance of delegated token to be active, and containing the
- * resolved subject confirmation credentials.
- * </p>
- *
- * <p>
- * If request status was {@link DelegationRequest#REQUESTED_REQUIRED} but delegation was not allowed and/or no
- * subject confirmation credentials could be resolved, a fatal event is produced.
- * </p>
- *
- * <p>
- * Otherwise, issuance of a delegated token is not active and so no {@link DelegationContext} is populated.
- * </p>
- *
- * @event {@link EventIds#INVALID_MSG_CTX}
- * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#MESSAGE_PROC_ERROR}
- * @event {@link EventIds#INVALID_SEC_CFG}
- */
-public class PopulateDelegationContext extends AbstractProfileAction {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateDelegationContext.class);
-
- // Configured data
-
- /** Strategy used to lookup the RelyingPartyContext. */
- @Nonnull private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy;
-
- /** Strategy used to lookup the SAMLMetadataContext. */
- @Nonnull private Function<ProfileRequestContext, SAMLMetadataContext> samlMetadataContextLookupStrategy;
-
- /** Strategy used to lookup the {@link DelegationContext}. */
- @Nonnull private Function<ProfileRequestContext, DelegationContext> delegationContextLookupStrategy;
-
- /** Default delegation request value. */
- private DelegationRequest defaultDelegationRequested = DelegationRequest.NOT_REQUESTED;
-
- /** The credential resolver used to resolve HoK Credentials for the peer. */
- @Nonnull private CredentialResolver credentialResolver;
-
-
- // Runtime data
-
- /** The delegation requested state for the current request. */
- private DelegationRequest delegationRequested;
-
- /** The current RelyingPartyContext. */
- private RelyingPartyContext relyingPartyContext;
-
- /** Whether delegation is allowed for the current relying party. */
- private boolean delegationAllowed;
-
- /** The entityID of the local responder entity. */
- private String responderId;
-
- /** The entityID of the SAML relying party. */
- private String relyingPartyId;
-
- /** The RoleDescriptor for the SAML peer entity. */
- private RoleDescriptor roleDescriptor;
-
- /** The AttributeConsumingService for the SAML peer entity. */
- private AttributeConsumingService attributeConsumingService;
-
- /** The subject confirmation credentials. */
- private List<Credential> confirmationCredentials;
-
-
- /**
- * Constructor.
- */
- public PopulateDelegationContext() {
- relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
- samlMetadataContextLookupStrategy = new SAMLMetadataContextLookupFunction();
- delegationContextLookupStrategy = new ChildContextLookup<>(DelegationContext.class, true);
- }
-
- /**
- * Set the strategy used to locate the current {@link RelyingPartyContext}.
- *
- * @param strategy strategy used to locate the current {@link RelyingPartyContext}
- */
- public void setRelyingPartyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, RelyingPartyContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- relyingPartyContextLookupStrategy = Constraint.isNotNull(strategy,
- "RelyingPartyContext lookup strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the current {@link SAMLMetadataContext}.
- *
- * @param strategy strategy used to locate the current {@link SAMLMetadataContext}
- */
- public void setSAMLMetadataContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, SAMLMetadataContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- samlMetadataContextLookupStrategy = Constraint.isNotNull(strategy,
- "SAMLMetadataContext lookup strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the current {@link DelegationContext}.
- *
- * @param strategy strategy used to locate the current {@link DelegationContext}
- */
- public void setDelegationContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext, DelegationContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- delegationContextLookupStrategy = Constraint.isNotNull(strategy,
- "DelegationContext lookup strategy may not be null");
- }
-
- /**
- * Set the {@link CredentialResolver} instance to use to resolve HoK {@link Credential}.
- *
- * <p>
- * Typically this should be a metadata-based resolver which accepts input as the
- * peer's {@link RoleDescriptor}.
- * </p>
- *
- * @param resolver the resolver instance to use
- */
- public void setCredentialResolver(@Nonnull final CredentialResolver resolver) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- credentialResolver = Constraint.isNotNull(resolver, "CredentialResolver may not be null");
- }
-
- /**
- * Get the effective default value for whether request processing should proceed
- * with issuance of a delegation token.
- *
- * @return the default value
- */
- @Nonnull public DelegationRequest getDefaultDelegationRequested() {
- return defaultDelegationRequested;
- }
-
- /**
- * Set the effective default value for whether request processing should proceed
- * with issuance of a delegation token.
- *
- * @param delegationRequest the default delegation requested value
- */
- public void setDefaultDelegationRequested(@Nonnull final DelegationRequest delegationRequest) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- defaultDelegationRequested =
- Constraint.isNotNull(delegationRequest, "Default DelegationRequest may not be null");
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
- if (relyingPartyContextLookupStrategy == null) {
- throw new ComponentInitializationException("RelyingPartyContext lookup strategy may not be null");
- }
- if (samlMetadataContextLookupStrategy == null) {
- throw new ComponentInitializationException("SAMLMetadataContext lookup strategy may not be null");
- }
- if (credentialResolver == null) {
- throw new ComponentInitializationException("CredentialResolver may not be null");
- }
- }
-
- /** {@inheritDoc} */
- // Checkstyle: ReturnCount OFF -- already heavily refactored for return count and complexity
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
-
- // Eval the activation condition first. Don't bother with the rest if false, esp since
- // could terminate with a fatal error unnecessarily.
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- if (!doPreExecuteInbound(profileRequestContext)) {
- return false;
- }
-
- if (!doPreExecuteRelyingParty(profileRequestContext)) {
- return false;
- }
-
- if (!doPreExecuteMetadata(profileRequestContext)) {
- return false;
- }
-
- delegationRequested = getDelegationRequested(profileRequestContext);
- if (DelegationRequest.NOT_REQUESTED.equals(delegationRequested)) {
- log.debug("Issuance of a delegated Assertion is not in effect, skipping further processing");
- return false;
- }
-
- confirmationCredentials = resolveConfirmationCredentials(profileRequestContext);
-
- return true;
- }
- // Checkstyle: ReturnCount ON
-
- /**
- * Pre-execute actions on the inbound message.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed
- */
- protected boolean doPreExecuteInbound(@Nonnull final ProfileRequestContext profileRequestContext) {
- if (profileRequestContext.getInboundMessageContext() == null
- || profileRequestContext.getInboundMessageContext().getMessage() == null) {
- log.warn("No inbound message context or message found");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return false;
- }
-
- if (!(profileRequestContext.getInboundMessageContext().getMessage() instanceof AuthnRequest)) {
- log.debug("Request is not a SAML 2 AuthnRequest");
- return false;
- }
- return true;
- }
-
- /**
- * Pre-execute actions on the relying party context info.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed
- */
- protected boolean doPreExecuteRelyingParty(@Nonnull final ProfileRequestContext profileRequestContext) {
- relyingPartyContext = relyingPartyContextLookupStrategy.apply(profileRequestContext);
- if (relyingPartyContext == null) {
- log.warn("No RelyingPartyContext was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- relyingPartyId = relyingPartyContext.getRelyingPartyId();
- if (relyingPartyId == null) {
- log.warn("No relying party ID was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
-
- if (relyingPartyContext.getProfileConfig() instanceof BrowserSSOProfileConfiguration) {
- final BrowserSSOProfileConfiguration config =
- (BrowserSSOProfileConfiguration) relyingPartyContext.getProfileConfig();
- delegationAllowed = config.isAllowDelegation(profileRequestContext);
- } else {
- log.debug("ProfileConfiguration does not support delegation: {}",
- relyingPartyContext.getProfileConfig().getClass().getName());
- return false;
- }
-
- // This is @Nonnull
- responderId = relyingPartyContext.getConfiguration().getResponderId(profileRequestContext);
-
- return true;
- }
-
- /**
- * Pre-execute actions on the relying party metadata.
- *
- * @param profileRequestContext the current profile request context
- * @return true iff {@link #doExecute(ProfileRequestContext)} should proceed, false otherwise
- */
- protected boolean doPreExecuteMetadata(@Nonnull final ProfileRequestContext profileRequestContext) {
- final SAMLMetadataContext samlMetadataContext = samlMetadataContextLookupStrategy.apply(profileRequestContext);
- if (samlMetadataContext == null) {
- log.debug("No SAMLMetadataContext was available, skipping further delegation processing");
- return false;
- }
-
- roleDescriptor = samlMetadataContext.getRoleDescriptor();
- if (roleDescriptor == null) {
- log.debug("No RoleDescriptor was available, skipping further delegation processing");
- return false;
- }
-
- final AttributeConsumingServiceContext acsContext =
- samlMetadataContext.getSubcontext(AttributeConsumingServiceContext.class);
- if (acsContext != null) {
- attributeConsumingService = acsContext.getAttributeConsumingService();
- }
- if (attributeConsumingService == null) {
- log.debug("No AttributeConsumingService was resolved, won't be able to determine "
- + "delegation requested status via metadata");
- }
-
- return true;
- }
-
- /** {@inheritDoc} */
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
-
- switch (delegationRequested) {
- case NOT_REQUESTED:
- log.debug("Delegation was not requested");
- break;
-
- case REQUESTED_OPTIONAL:
- if (delegationAllowed) {
- log.debug("Delegation token issuance was requested (optional) and allowed");
- if (confirmationCredentials == null || confirmationCredentials.isEmpty()) {
- log.warn("Issuance of delegated token was indicated, "
- + "but no confirmation credentials were available, skipping issuance");
- } else {
- createAndPopulateDelegationContext(profileRequestContext);
- }
- } else {
- log.debug("Delegation token issuance was requested (optional), but not allowed, "
- + "skipping delegated assertion issuance");
- return;
- }
- break;
-
- case REQUESTED_REQUIRED:
- if (delegationAllowed) {
- log.debug("Delegation token issuance was requested (required) and allowed");
- if (confirmationCredentials == null || confirmationCredentials.isEmpty()) {
- log.warn("Issuance of delegated token was indicated, "
- + "but no confirmation credentials were available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.MESSAGE_PROC_ERROR);
- } else {
- createAndPopulateDelegationContext(profileRequestContext);
- }
- } else {
- log.warn("Delegation token issuance was requested (required), but disallowed by policy");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
- }
- break;
-
- default:
- log.error("Unknown value '{}' for delegation request state", delegationRequested);
- }
- }
-
- /**
- * Create and populate the {@link DelegationContext} using the available information.
- *
- * @param profileRequestContext the current request context
- */
- private void createAndPopulateDelegationContext(final ProfileRequestContext profileRequestContext) {
- final DelegationContext delegationContext =
- delegationContextLookupStrategy.apply(profileRequestContext);
- if (delegationContext == null) {
- log.warn("No DelegationContext was available");
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- }
- delegationContext.setIssuingDelegatedAssertion(true);
- delegationContext.setDelegationRequested(delegationRequested);
- delegationContext.setSubjectConfirmationCredentials(confirmationCredentials);
- }
-
- /**
- * Resolve the subject confirmation credentials.
- *
- * @param requestContext the current request context
- * @return the subject confirmation credentials, or null if not resolveable or there is an error
- */
- private List<Credential> resolveConfirmationCredentials(@Nonnull final ProfileRequestContext requestContext) {
- final CriteriaSet criteriaSet = new CriteriaSet();
- criteriaSet.add(new RoleDescriptorCriterion(roleDescriptor));
- criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
- // Add an entityID criterion just in case don't have a MetadataCredentialResolver,
- // and want to resolve via entityID + usage only, e.g. from a CollectionCredentialResolver
- // or other more general resolver type.
- criteriaSet.add(new EntityIdCriterion(relyingPartyId));
-
- final ArrayList<Credential> creds = new ArrayList<>();
- try {
- for (final Credential cred : credentialResolver.resolve(criteriaSet)) {
- if (cred != null) {
- creds.add(cred);
- }
- }
- return creds;
- } catch (final ResolverException e) {
- log.warn("Error resolving subject confirmation credentials for relying party: {}", relyingPartyId, e);
- return null;
- }
- }
-
- /**
- * Check whether issuance of a delegated token has been requested.
- *
- * @param requestContext the current request context
- * @return true if delegation is requested, false otherwise
- */
- private DelegationRequest getDelegationRequested(@Nonnull final ProfileRequestContext requestContext) {
- if (isDelegationRequestedByAudience(requestContext)) {
- log.debug("Delegation was requested via AuthnRequest Audience, treating as: {}",
- DelegationRequest.REQUESTED_REQUIRED);
- return DelegationRequest.REQUESTED_REQUIRED;
- }
-
- final DelegationRequest requestedByMetadata = getDelegationRequestedByMetadata(requestContext);
- if (requestedByMetadata != DelegationRequest.NOT_REQUESTED) {
- log.debug("Delegation was requested via metadata: {}", requestedByMetadata);
- return requestedByMetadata;
- }
-
- log.debug("Delegation request was not explicitly indicated, using default value: {}",
- getDefaultDelegationRequested());
- return getDefaultDelegationRequested();
- }
-
- /**
- * Determine whether a delegation token was requested via the SP's SPSSODescriptor AttributeConsumingService.
- *
- * @param requestContext the current request context
- * @return DelegationRequest enum value as appropriate
- */
- @Nonnull private DelegationRequest getDelegationRequestedByMetadata(
- @Nonnull final ProfileRequestContext requestContext) {
-
- if (attributeConsumingService == null) {
- log.debug("No AttributeConsumingService was available");
- return DelegationRequest.NOT_REQUESTED;
- }
-
- for (final RequestedAttribute requestedAttribute : attributeConsumingService.getRequestedAttributes()) {
- if (Objects.equals(LibertyConstants.SERVICE_TYPE_SSOS,
- StringSupport.trimOrNull(requestedAttribute.getName()))) {
- log.debug("Saw requested attribute '{}' in metadata AttributeConsumingService for SP: {}",
- LibertyConstants.SERVICE_TYPE_SSOS, relyingPartyId);
- if (requestedAttribute.isRequired()) {
- log.debug("Metadata delegation request attribute indicated it was required");
- return DelegationRequest.REQUESTED_REQUIRED;
- }
- log.debug("Metadata delegation request attribute indicated it was NOT required");
- return DelegationRequest.REQUESTED_OPTIONAL;
- }
- }
-
- return DelegationRequest.NOT_REQUESTED;
- }
-
- /**
- * Determine whether a delegation token was requested via the inbound AuthnRequest's
- * Conditions' AudienceRestriction.
- *
- * @param requestContext the current request context
- * @return true if the AudienceRestrictions condition contained the local entity Id, false otherwise
- */
- private boolean isDelegationRequestedByAudience(@Nonnull final ProfileRequestContext requestContext) {
- if (!(requestContext.getInboundMessageContext().getMessage() instanceof AuthnRequest)) {
- log.debug("Inbound SAML message was not an AuthnRequest: {}",
- requestContext.getInboundMessageContext().getMessage().getClass().getName());
- return false;
- }
-
- final AuthnRequest authnRequest = (AuthnRequest) requestContext.getInboundMessageContext().getMessage();
- if (authnRequest.getConditions() != null) {
- final Conditions conditions = authnRequest.getConditions();
- for (final AudienceRestriction ar : conditions.getAudienceRestrictions()) {
- for (final Audience audience : ar.getAudiences()) {
- final String audienceValue = StringSupport.trimOrNull(audience.getURI());
- if (Objects.equals(audienceValue, responderId)) {
- log.debug("Saw an AuthnRequest/Conditions/AudienceRestriction/Audience with value of '{}'",
- responderId);
- return true;
- }
- }
- }
- }
- return false;
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContext.java
deleted file mode 100644
index 321ca5212..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContext.java
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.messaging.context.navigate.ChildContextLookup;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.wssecurity.SAML20AssertionToken;
-import org.opensaml.soap.wssecurity.messaging.Token;
-import org.opensaml.soap.wssecurity.messaging.Token.ValidationStatus;
-import org.opensaml.soap.wssecurity.messaging.WSSecurityContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-
-/**
- * Locate a pre-validated {@link org.opensaml.saml.saml2.core.Assertion} WS-Security token,
- * and populate the {@link LibertySSOSContext}.
- *
- * <p>
- * The default token strategy is to resolve the first instance of {@link SAML20AssertionToken}
- * present in the inbound {@link WSSecurityContext} which has a validation status of
- * {@link ValidationStatus#VALID}
- * </p>
- *
- * @event {@link AuthnEventIds#NO_CREDENTIALS}
- * @pre <pre>assertionTokenStrategy.apply() != null</pre>
- * @post <pre>profileRequestContext.getSubcontext(LibertySSOSContext.class) != null</pre>
- * @post <pre>LibertySSOSContext.getAttestedToken() != null</pre>
- * @post <pre>LibertySSOSContext.getAttestedSubjectConfirmationMethod != null</pre>
- */
-public class PopulateLibertyContext extends AbstractProfileAction {
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(PopulateLibertyContext.class);
-
- /** Function used to resolve the assertion token to process. */
- @Nonnull private Function<ProfileRequestContext, SAML20AssertionToken> assertionTokenStrategy;
-
- /** Function used to resolve the Liberty context to populate. */
- @Nonnull private Function<ProfileRequestContext, LibertySSOSContext> libertyContextLookupStrategy;
-
- /** The SAML 2 Assertion token being processed. */
- private SAML20AssertionToken assertionToken;
-
- /** Liberty context to populate. */
- private LibertySSOSContext ssosContext;
-
- /**
- * Constructor.
- */
- public PopulateLibertyContext() {
- assertionTokenStrategy = new TokenStrategy();
- libertyContextLookupStrategy = new ChildContextLookup<>(LibertySSOSContext.class, true);
- }
-
- /**
- * Set the strategy used to locate the {@link LibertySSOSContext} to populate.
- *
- * @param strategy lookup strategy
- */
- public void setLibertyContextLookupStrategy(
- @Nonnull final Function<ProfileRequestContext,LibertySSOSContext> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- libertyContextLookupStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the requester ID for canonicalization.
- *
- * @param strategy lookup strategy
- */
- public void setAssertionTokenStrategy(
- @Nonnull final Function<ProfileRequestContext,SAML20AssertionToken> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionTokenStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- assertionToken = assertionTokenStrategy.apply(profileRequestContext);
-
- if (assertionToken == null) {
- log.info("{} No valid SAML20AssertionToken available within inbound WSSecurityContext", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
- return false;
- }
-
- ssosContext = libertyContextLookupStrategy.apply(profileRequestContext);
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- // Populate Liberty context for use later.
- ssosContext = profileRequestContext.getSubcontext(LibertySSOSContext.class, true);
- ssosContext.setAttestedToken(assertionToken.getWrappedToken());
- ssosContext.setAttestedSubjectConfirmationMethod(assertionToken.getSubjectConfirmation().getMethod());
- }
-
- /**
- * Default strategy for resolving the assertion token to process.
- *
- * <p>This impl just returns the first valid {@link SAML20AssertionToken} found
- * in the inbound {@link WSSecurityContext}.</p>
- */
- public class TokenStrategy implements Function<ProfileRequestContext, SAML20AssertionToken> {
-
- /** {@inheritDoc} */
- @Nullable
- public SAML20AssertionToken apply(@Nullable final ProfileRequestContext input) {
- if (input == null) {
- return null;
- }
- final WSSecurityContext wssContext =
- input.getInboundMessageContext().getSubcontext(WSSecurityContext.class);
- if (wssContext == null) {
- log.info("{} No WSSecurityContext available within inbound message context", getLogPrefix());
- return null;
- }
-
- for (final Token<?> token : wssContext.getTokens()) {
- if (token.getValidationStatus().equals(ValidationStatus.VALID)
- && token instanceof SAML20AssertionToken) {
- return (SAML20AssertionToken) token;
- }
- }
- return null;
- }
-
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateOutboundMessageContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateOutboundMessageContext.java
deleted file mode 100644
index 0df21e857..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateOutboundMessageContext.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import net.shibboleth.idp.profile.AbstractProfileAction;
-
-import java.time.Instant;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
-import org.opensaml.soap.wsaddressing.messaging.WSAddressingContext;
-import org.opensaml.soap.wssecurity.messaging.WSSecurityContext;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Populate the outbound message context with data that is specific to the delegation flow.
- *
- * @event {@link EventIds#INVALID_MSG_CTX}
- */
-public class PopulateOutboundMessageContext extends AbstractProfileAction {
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(PopulateOutboundMessageContext.class);
-
-//CheckStyle: ReturnCount OFF
- /** {@inheritDoc} */
- @Override
- protected void doExecute(final ProfileRequestContext profileRequestContext) {
- final MessageContext inboundMessageContext = profileRequestContext.getInboundMessageContext();
- if (inboundMessageContext == null) {
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return;
- }
- final MessageContext outboundMessageContext = profileRequestContext.getOutboundMessageContext();
- if (outboundMessageContext == null) {
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
- return;
- }
-
- // Set outbound wsa:RelatesTo based on inbound wsa:MessageID
- final WSAddressingContext addressingInbound = inboundMessageContext.getSubcontext(WSAddressingContext.class);
- if (addressingInbound != null) {
- outboundMessageContext.getSubcontext(WSAddressingContext.class, true).setRelatesToURI(
- addressingInbound.getMessageIDURI());
- log.debug("Set outbound WS-Addressing RelatesTo URL: {}",
- outboundMessageContext.getSubcontext(WSAddressingContext.class).getRelatesToURI());
- }
-
- // Set outbound WS-S wsu:Timestamp/wsu:Created based on either outbound SAML message issue instant (if present)
- // or current time.
- final SAMLMessageInfoContext samlMsgInfoCtx =
- outboundMessageContext.getSubcontext(SAMLMessageInfoContext.class);
- if (samlMsgInfoCtx != null) {
- log.debug("Saw outbound SAMLMessageInfoContext with message issue instant: {}",
- samlMsgInfoCtx.getMessageIssueInstant());
- outboundMessageContext.getSubcontext(WSSecurityContext.class, true).setTimestampCreated(
- samlMsgInfoCtx.getMessageIssueInstant());
- } else {
- outboundMessageContext.getSubcontext(WSSecurityContext.class, true).setTimestampCreated(Instant.now());
- }
- log.debug("Set outbound WS-Security Timestamp Created: {}",
- outboundMessageContext.getSubcontext(WSSecurityContext.class).getTimestampCreated());
-
- }
-//CheckStyle: ReturnCount ON
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java
deleted file mode 100644
index 17cb311c3..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertion.java
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.security.auth.Subject;
-
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.NameID;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.profile.context.navigate.ResponderIdLookupFunction;
-import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.xml.SerializeSupport;
-
-
-/**
- * Process the pre-validated inbound {@link Assertion} WS-Security token, and set up the resulting
- * {@link NameID} for subject canonicalization as the effective subject of the request.
- *
- * <p>
- * A {@link SubjectCanonicalizationContext} is added containing a {@link NameIDPrincipal} with the
- * token's {@link NameID}.
- * </p>
- *
- * @event {@link AuthnEventIds#NO_CREDENTIALS}
- * @event {@link AuthnEventIds#INVALID_SUBJECT}
- * @pre <pre>assertionTokenStrategy.apply(profileRequestContext).getSubject().getNameID() != null</pre>
- * @post <pre>profileRequestContext.getSubcontext(SubjectCanonicalizationContext.class) != null</pre>
- */
-public class ProcessDelegatedAssertion extends AbstractProfileAction {
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(ProcessDelegatedAssertion.class);
-
- /** Function used to obtain the requester ID, for purposes of Subject c14n. */
- @Nullable private Function<ProfileRequestContext,String> requesterLookupStrategy;
-
- /** Function used to obtain the responder ID, for purposes of Subject c14n. */
- @Nullable private Function<ProfileRequestContext,String> responderLookupStrategy;
-
- /** Function used to resolve the assertion token to process. */
- @Nonnull private Function<ProfileRequestContext, Assertion> assertionTokenStrategy;
-
- /** The SAML 2 Assertion token being processed. */
- private Assertion assertion;
-
- /** The SAML 2 NameID representing the authenticated user. */
- private NameID nameID;
-
- /**
- * Constructor.
- */
- public ProcessDelegatedAssertion() {
- requesterLookupStrategy = new DefaultC14NRequesterLookupFunction();
- responderLookupStrategy = new ResponderIdLookupFunction();
- assertionTokenStrategy = new DelegatedAssertionLookupStrategy();
- }
-
- /**
- * Set the strategy used to locate the inbound assertion token to process.
- *
- * @param strategy lookup strategy
- */
- public void setAssertionTokenStrategy(@Nonnull final Function<ProfileRequestContext,Assertion> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- assertionTokenStrategy = Constraint.isNotNull(strategy, "Assertion token strategy may not be null");
- }
-
- /**
- * Set the strategy used to locate the requester ID for subject canonicalization.
- *
- * @param strategy lookup strategy
- */
- public void setRequesterLookupStrategy(@Nullable final Function<ProfileRequestContext,String> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- requesterLookupStrategy = strategy;
- }
-
- /**
- * Set the strategy used to locate the responder ID for subject canonicalization.
- *
- * @param strategy lookup strategy
- */
- public void setResponderLookupStrategy(@Nullable final Function<ProfileRequestContext,String> strategy) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
-
- responderLookupStrategy = strategy;
- }
-
- /** {@inheritDoc} */
- @Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (!super.doPreExecute(profileRequestContext)) {
- return false;
- }
-
- assertion = assertionTokenStrategy.apply(profileRequestContext);
-
- if (assertion == null) {
- log.warn("{} No valid SAML 2 Assertion available within the request context", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.NO_CREDENTIALS);
- return false;
- }
-
- final org.opensaml.saml.saml2.core.Subject samlSubject = assertion.getSubject();
- if (samlSubject == null || samlSubject.getNameID() == null) {
- log.warn("{} SAML 2 Assertion does not contain either a Subject or a NameID", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT);
- return false;
- }
-
- nameID = samlSubject.getNameID();
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-
- if (log.isDebugEnabled()) {
- try {
- log.debug("{} Authenticated user based on inbound SAML 2 Assertion token with NameID: {}",
- getLogPrefix(), SerializeSupport.nodeToString(XMLObjectSupport.marshall(nameID)));
- } catch (final MarshallingException e) {
- log.debug("{} Could not marshall SAML 2 NameID for logging purposes", getLogPrefix(), e);
- }
- }
-
- // Set up Subject c14n context for call to c14n subflow.
- final Subject subject = new Subject();
- subject.getPrincipals().add(new NameIDPrincipal(nameID));
-
- final SubjectCanonicalizationContext c14n = new SubjectCanonicalizationContext();
- c14n.setSubject(subject);
-
- String requesterEntityID = null;
- if (requesterLookupStrategy != null) {
- requesterEntityID = requesterLookupStrategy.apply(profileRequestContext);
- }
- if (requesterEntityID != null) {
- log.debug("Resolved effective SAML requester entityID for Subject c14n: {}", requesterEntityID);
- c14n.setRequesterId(requesterEntityID);
- } else {
- log.warn("Unable to determine effective SAML requester for c14n, Subject c14n may fail, "
- + "depending on NameID type");
- }
-
- if (responderLookupStrategy != null) {
- c14n.setResponderId(responderLookupStrategy.apply(profileRequestContext));
- }
- profileRequestContext.addSubcontext(c14n, true);
- }
-
- /**
- * Default strategy for resolving the requester entityID for SAML subject c14n.
- */
- public class DefaultC14NRequesterLookupFunction implements Function<ProfileRequestContext, String> {
-
- /** {@inheritDoc} */
- public String apply(final ProfileRequestContext input) {
- // First attempt to resolve SPNameQualifier from delegated Assertion's Subject NameID, if present
- if (nameID.getSPNameQualifier() != null) {
- log.debug("Saw delegated Assertion Subject NameID SPNameQualifier: {}", nameID.getSPNameQualifier());
- return nameID.getSPNameQualifier();
- }
-
- // Second attempt to resolve entityID of entity in SAML presenter role
- if (input != null && input.getInboundMessageContext() != null) {
- final SAMLPresenterEntityContext presenterContext =
- input.getInboundMessageContext().getSubcontext(SAMLPresenterEntityContext.class);
- if (presenterContext != null) {
- log.debug("Saw SAML presenter entityID: {}", presenterContext.getEntityId());
- return presenterContext.getEntityId();
- }
- return null;
- }
-
- return null;
- }
-
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/XMLObjectProviderInitializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/XMLObjectProviderInitializer.java
deleted file mode 100644
index 8dda3eb19..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/XMLObjectProviderInitializer.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import org.opensaml.core.xml.config.AbstractXMLObjectProviderInitializer;
-
-/**
- * XMLObject provider initializer for providers from OpenLiberty used in delegation.
- */
-public class XMLObjectProviderInitializer extends AbstractXMLObjectProviderInitializer {
-
- /** Config resources. */
- private static String[] configs = {
- "/liberty-soap-binding-config.xml",
- "/disco-config.xml",
- "/sec-config.xml",
- };
-
- /** {@inheritDoc} */
- protected String[] getConfigResources() {
- return configs;
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/package-info.java
deleted file mode 100644
index 0c22bda50..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/package-info.java
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/** Profile processing components related to SAML 2 delegation. */
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddFrameworkHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddFrameworkHandler.java
deleted file mode 100644
index a0cca3ee6..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddFrameworkHandler.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.openliberty.xmltooling.soapbinding.Framework;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.soap.messaging.AbstractHeaderGeneratingMessageHandler;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Handler implementation that adds a Liberty sbf:Framework header to the outbound SOAP envelope.
- */
-public class AddFrameworkHandler extends AbstractHeaderGeneratingMessageHandler {
-
- /** Default Framework version. */
- public static final String DEFAULT_VERSION = "2.0";
-
- /** Logger. */
- private Logger log = LoggerFactory.getLogger(AddFrameworkHandler.class);
-
- /** The Version value. */
- private String version = DEFAULT_VERSION;
-
- /**
- * Get the version value.
- *
- * @return the version, or null
- */
- @Nullable public String getVersion() {
- return version;
- }
-
- /**
- * Set the version value.
- *
- * @param newVersion the new version value
- */
- public void setVersion(@Nullable final String newVersion) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- version = StringSupport.trimOrNull(newVersion);
- }
-
- /** {@inheritDoc} */
- protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
- log.debug("Issuing Liberty ID-WSF Framework header with version value: {}", getVersion());
- final Framework framework = (Framework) XMLObjectSupport.buildXMLObject(Framework.DEFAULT_ELEMENT_NAME);
- framework.setVersion(getVersion());
- decorateGeneratedHeader(messageContext, framework);
- SOAPMessagingSupport.addHeaderBlock(messageContext, framework);
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddSenderHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddSenderHandler.java
deleted file mode 100644
index f5ab1bd72..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddSenderHandler.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import java.util.function.Function;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.openliberty.xmltooling.soapbinding.Sender;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.messaging.context.SAMLSelfEntityContext;
-import org.opensaml.soap.messaging.AbstractHeaderGeneratingMessageHandler;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Handler implementation that adds a Liberty sb:Sender header to the outbound SOAP envelope.
- */
-public class AddSenderHandler extends AbstractHeaderGeneratingMessageHandler {
-
- /** Logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(AddSenderHandler.class);
-
- /** The providerId lookup function. */
- @Nonnull private Function<MessageContext, String> providerIdLookupFunction;
-
- /** The providerId value to send. */
- private String providerId;
-
- /** Constructor. *
- */
- public AddSenderHandler() {
- providerIdLookupFunction = new SAMLSelfEntityIDLookupFunction();
- }
-
- /**
- * Set the providerId lookup function.
- *
- * @param function the lookup function
- */
- public void setProviderIdLookupFunction(final Function<MessageContext, String> function) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- providerIdLookupFunction = Constraint.isNotNull(function,
- "ProviderId lookup function may not be null");
- }
-
- /** {@inheritDoc} */
- protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
- providerId = providerIdLookupFunction.apply(messageContext);
- if (providerId != null) {
- log.debug("Resolved Liberty ID-WSF Sender providerId value: {}", providerId);
- return true;
- }
- log.debug("Unable to resolve Liberty ID-WSF Sender providerId value, skipping further processing");
- return false;
- }
-
- /** {@inheritDoc} */
- protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
- log.debug("Issuing Liberty ID-WSF Sender with providerId value: {}", providerId);
- final Sender sender =
- (Sender) XMLObjectSupport.buildXMLObject(LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME);
- sender.setProviderID(providerId);
- decorateGeneratedHeader(messageContext, sender);
- SOAPMessagingSupport.addHeaderBlock(messageContext, sender);
- }
-
- /** Function to return the SAML self entityID from the MessageContext. */
- public static class SAMLSelfEntityIDLookupFunction implements Function<MessageContext, String> {
-
- /** {@inheritDoc} */
- @Nullable public String apply(@Nullable final MessageContext input) {
- if (input != null) {
- final SAMLSelfEntityContext selfContext = input.getSubcontext(SAMLSelfEntityContext.class);
- if (selfContext != null) {
- return selfContext.getEntityId();
- }
- }
- return null;
- }
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11Decoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11Decoder.java
deleted file mode 100644
index 79db439d1..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11Decoder.java
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import java.io.IOException;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import jakarta.servlet.http.HttpServletRequest;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.decoder.MessageDecodingException;
-import org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDecoder;
-import org.opensaml.messaging.handler.MessageHandler;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.saml.common.binding.BindingDescriptor;
-import org.opensaml.saml.common.binding.decoding.SAMLMessageDecoder;
-import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
-import org.opensaml.soap.messaging.context.SOAP11Context;
-import org.opensaml.soap.soap11.Envelope;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Decoder for Liberty ID-WSF 2.0 SOAP 1.1 HTTP binding carrying SAML protocol messages
- * used in SAML delegation.
- *
- * <p>
- * This decoder takes a mandatory {@link MessageHandler} instance which is used to determine
- * and populate the message that is returned as the {@link MessageContext#getMessage()}.
- * </p>
- *
- * <p>
- * A SOAP message-oriented message exchange style might just populate the Envelope as the message.
- * An application-specific payload-oriented message exchange would handle a specific type
- * of payload structure.
- * </p>
- *
- */
-public class LibertyHTTPSOAP11Decoder extends BaseHttpServletRequestXMLMessageDecoder implements SAMLMessageDecoder {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(LibertyHTTPSOAP11Decoder.class);
-
- /** Optional {@link BindingDescriptor} to inject into {@link SAMLBindingContext} created. */
- @Nullable private BindingDescriptor bindingDescriptor;
-
- /** Message handler to use in processing the message body. */
- private MessageHandler bodyHandler;
-
- /**
- * Constructor.
- */
- public LibertyHTTPSOAP11Decoder() {
- setBodyHandler(new SAMLSOAPDecoderBodyHandler());
- }
-
- /** {@inheritDoc} */
- @Nonnull @NotEmpty public String getBindingURI() {
- return LibertyConstants.SOAP_BINDING_20_URI;
- }
-
- /**
- * Get an optional {@link BindingDescriptor} to inject into {@link SAMLBindingContext} created.
- *
- * @return binding descriptor
- */
- @Nullable public BindingDescriptor getBindingDescriptor() {
- return bindingDescriptor;
- }
-
- /**
- * Set an optional {@link BindingDescriptor} to inject into {@link SAMLBindingContext} created.
- *
- * @param descriptor a binding descriptor
- */
- public void setBindingDescriptor(@Nullable final BindingDescriptor descriptor) {
- bindingDescriptor = descriptor;
- }
-
- /**
- * Get the configured body handler MessageHandler.
- *
- * @return Returns the bodyHandler.
- */
- public MessageHandler getBodyHandler() {
- return bodyHandler;
- }
-
- /**
- * Set the configured body handler MessageHandler.
- *
- * @param newBodyHandler The bodyHandler to set.
- */
- public void setBodyHandler(final MessageHandler newBodyHandler) {
- bodyHandler = newBodyHandler;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (getBodyHandler() == null) {
- throw new ComponentInitializationException("Body handler MessageHandler cannot be null");
- }
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doDecode() throws MessageDecodingException {
- final MessageContext messageContext = new MessageContext();
- final HttpServletRequest request = getHttpServletRequest();
-
- if (!"POST".equalsIgnoreCase(request.getMethod())) {
- throw new MessageDecodingException("This message decoder only supports the HTTP POST method");
- }
-
- log.debug("Unmarshalling SOAP message");
- final Envelope soapMessage;
- try {
- soapMessage = (Envelope) unmarshallMessage(request.getInputStream());
- messageContext.getSubcontext(SOAP11Context.class, true).setEnvelope(soapMessage);
- } catch (final IOException e) {
- log.error("Unable to obtain input stream from HttpServletRequest: {}", e.getMessage());
- throw new MessageDecodingException("Unable to obtain input stream from HttpServletRequest", e);
- }
-
- try {
- getBodyHandler().invoke(messageContext);
- } catch (final MessageHandlerException e) {
- log.error("Error processing SOAP Envelope body: {}", e.getMessage());
- throw new MessageDecodingException("Error processing SOAP Envelope body", e);
- }
-
- if (messageContext.getMessage() == null) {
- log.warn("Body handler did not properly populate the message in message context");
- throw new MessageDecodingException("Body handler did not properly populate the message in message context");
- }
-
- setMessageContext(messageContext);
-
- populateBindingContext(getMessageContext());
-
- final Object samlMessage = getMessageContext().getMessage();
- if (samlMessage instanceof SAMLObject) {
- log.debug("Decoded SOAP message which included SAML message of type {}",
- ((SAMLObject) samlMessage).getElementQName());
- } else {
- throw new MessageDecodingException("Decoded SOAP message did not include SAML message");
- }
- }
-
- /**
- * Populate the context which carries information specific to this binding.
- *
- * @param messageContext the current message context
- */
- protected void populateBindingContext(final MessageContext messageContext) {
- final SAMLBindingContext bindingContext = messageContext.getSubcontext(SAMLBindingContext.class, true);
- bindingContext.setBindingUri(getBindingURI());
- bindingContext.setBindingDescriptor(bindingDescriptor);
- bindingContext.setHasBindingSignature(false);
- bindingContext.setIntendedDestinationEndpointURIRequired(false);
- }
-
- /** {@inheritDoc} */
- @Override
- protected XMLObject getMessageToLog() {
- return getMessageContext().getSubcontext(SOAP11Context.class, true).getEnvelope();
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11Encoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11Encoder.java
deleted file mode 100644
index 488046d02..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11Encoder.java
+++ /dev/null
@@ -1,253 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import java.io.IOException;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import jakarta.servlet.http.HttpServletResponse;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-import net.shibboleth.utilities.java.support.net.HttpServletSupport;
-import net.shibboleth.utilities.java.support.xml.SerializeSupport;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.XMLObjectBuilderFactory;
-import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.encoder.MessageEncodingException;
-import org.opensaml.messaging.encoder.servlet.BaseHttpServletResponseXMLMessageEncoder;
-import org.opensaml.saml.common.binding.encoding.SAMLMessageEncoder;
-import org.opensaml.soap.common.SOAPObjectBuilder;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.opensaml.soap.messaging.context.SOAP11Context;
-import org.opensaml.soap.soap11.Body;
-import org.opensaml.soap.soap11.Envelope;
-import org.opensaml.soap.soap11.Fault;
-import org.opensaml.soap.soap11.Header;
-import org.opensaml.soap.wsaddressing.Action;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.w3c.dom.Element;
-
-/**
- * Encoder for Liberty ID-WSF 2.0 SOAP 1.1 HTTP binding carrying SAML protocol messages
- * used in SAML delegation.
- */
-public class LibertyHTTPSOAP11Encoder extends BaseHttpServletResponseXMLMessageEncoder implements SAMLMessageEncoder {
-
- /** Class logger. */
- private final Logger log = LoggerFactory.getLogger(LibertyHTTPSOAP11Encoder.class);
-
- /** SOAP Envelope builder. */
- private SOAPObjectBuilder<Envelope> envBuilder;
-
- /** SOAP Body builder. */
- private SOAPObjectBuilder<Body> bodyBuilder;
-
- /** Constructor. */
- public LibertyHTTPSOAP11Encoder() {
- super();
- final XMLObjectBuilderFactory builderFactory = XMLObjectProviderRegistrySupport.getBuilderFactory();
- envBuilder = (SOAPObjectBuilder<Envelope>) builderFactory.<Envelope>getBuilderOrThrow(
- Envelope.DEFAULT_ELEMENT_NAME);
- bodyBuilder = (SOAPObjectBuilder<Body>) builderFactory.<Body>getBuilderOrThrow(
- Body.DEFAULT_ELEMENT_NAME);
- }
-
- /** {@inheritDoc} */
- @Override
- public String getBindingURI() {
- return LibertyConstants.SOAP_BINDING_20_URI;
- }
-
- /** {@inheritDoc} */
- public void prepareContext() throws MessageEncodingException {
- final MessageContext messageContext = getMessageContext();
- Object payload = null;
-
- final Fault fault = SOAPMessagingSupport.getSOAP11Fault(messageContext);
- if (fault != null) {
- log.debug("Saw SOAP 1.1 Fault payload with fault code, replacing any existing context message: {}",
- fault.getCode() != null ? fault.getCode().getValue() : null);
- payload = fault;
- messageContext.setMessage(null);
- } else {
- payload = messageContext.getMessage();
- }
-
- if (payload == null || !(payload instanceof XMLObject)) {
- throw new MessageEncodingException("No outbound XML message or Fault contained in message context");
- }
-
- if (payload instanceof Envelope) {
- storeSOAPEnvelope((Envelope) payload);
- } else {
- buildAndStoreSOAPMessage((XMLObject) payload);
- }
-
- }
-
- /** {@inheritDoc} */
- protected void doEncode() throws MessageEncodingException {
- final Envelope envelope = getSOAPEnvelope();
- final Element envelopeElem = marshallMessage(envelope);
-
- prepareHttpServletResponse();
-
- try {
- SerializeSupport.writeNode(envelopeElem, getHttpServletResponse().getOutputStream());
- } catch (final IOException e) {
- throw new MessageEncodingException("Problem writing SOAP envelope to servlet output stream", e);
- }
- }
-
- /**
- * Store the constructed SOAP envelope in the message context for later encoding.
- *
- * @param envelope the SOAP envelope
- */
- protected void storeSOAPEnvelope(final Envelope envelope) {
- getMessageContext().getSubcontext(SOAP11Context.class, true).setEnvelope(envelope);
- }
-
- /**
- * Retrieve the previously stored SOAP envelope from the message context.
- *
- * @return the previously stored SOAP envelope
- */
- protected Envelope getSOAPEnvelope() {
- return getMessageContext().getSubcontext(SOAP11Context.class, true).getEnvelope();
- }
-
- /**
- * Builds the SOAP message to be encoded.
- *
- * @param payload body of the SOAP message
- */
- protected void buildAndStoreSOAPMessage(@Nonnull final XMLObject payload) {
- Envelope envelope = getSOAPEnvelope();
- if (envelope == null) {
- envelope = envBuilder.buildObject();
- storeSOAPEnvelope(envelope);
- }
-
- Body body = envelope.getBody();
- if (body == null) {
- body = bodyBuilder.buildObject();
- envelope.setBody(body);
- }
-
- if (!body.getUnknownXMLObjects().isEmpty()) {
- log.warn("Existing SOAP Envelope Body already contained children");
- }
-
- body.getUnknownXMLObjects().add(payload);
- }
-
-
- /**
- * <p>
- * This implementation performs the following actions on the context's {@link HttpServletResponse}:
- * </p>
- * <ol>
- * <li>Adds the HTTP header: "Cache-control: no-cache, no-store"</li>
- * <li>Adds the HTTP header: "Pragma: no-cache"</li>
- * <li>Sets the character encoding to: "UTF-8"</li>
- * <li>Sets the content type to: "text/xml"</li>
- * <li>Sets the SOAPAction HTTP header the value returned by {@link #getSOAPAction()}, if
- * that returns non-null.</li>
- * </ol>
- *
- * <p>
- * Subclasses should NOT set the SOAPAction HTTP header in this method. Instead, they should override
- * the method {@link #getSOAPAction()}.
- * </p>
- *
- * @throws MessageEncodingException thrown if there is a problem preprocessing the transport
- */
- protected void prepareHttpServletResponse() throws MessageEncodingException {
- final HttpServletResponse response = getHttpServletResponse();
- HttpServletSupport.addNoCacheHeaders(response);
- HttpServletSupport.setUTF8Encoding(response);
- HttpServletSupport.setContentType(response, "text/xml");
-
- final String soapAction = getSOAPAction();
- if (soapAction != null) {
- response.setHeader("SOAPAction", soapAction);
- } else {
- response.setHeader("SOAPAction", "");
- }
-
- response.setStatus(getHTTPResponseStatusCode());
- }
-
- /**
- * Determine the value of the SOAPAction HTTP header to send.
- *
- * <p>
- * The default behavior is to return the value of the SOAP Envelope's WS-Addressing Action header,
- * if present.
- * </p>
- *
- * @return a SOAPAction HTTP header URI value
- */
- protected String getSOAPAction() {
- final Envelope env = getSOAPEnvelope();
- final Header header = env.getHeader();
- if (header == null) {
- return null;
- }
- final List<XMLObject> objList = header.getUnknownXMLObjects(Action.ELEMENT_NAME);
- if (objList == null || objList.isEmpty()) {
- return null;
- }
- return ((Action)objList.get(0)).getURI();
- }
-
- /**
- * Get the HTTP response status code to return.
- *
- * @return the HTTP response status code
- */
- protected int getHTTPResponseStatusCode() {
- final Integer contextStatus =
- getMessageContext().getSubcontext(SOAP11Context.class, true).getHTTPResponseStatus();
- if (contextStatus != null) {
- return contextStatus;
- }
-
- final Envelope envelope = getSOAPEnvelope();
- if (envelope != null && envelope.getBody() != null) {
- final Body body = envelope.getBody();
- final List<XMLObject> faults = body.getUnknownXMLObjects(Fault.DEFAULT_ELEMENT_NAME);
- if (!faults.isEmpty()) {
- return HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
- }
- }
-
- return HttpServletResponse.SC_OK;
- }
-
- /** {@inheritDoc} */
- protected XMLObject getMessageToLog() {
- return getMessageContext().getSubcontext(SOAP11Context.class, true).getEnvelope();
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessFrameworkHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessFrameworkHandler.java
deleted file mode 100644
index c02fed2a1..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessFrameworkHandler.java
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import java.util.List;
-import java.util.Objects;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.xml.namespace.QName;
-
-import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.openliberty.xmltooling.Konstantz;
-import org.openliberty.xmltooling.soapbinding.Framework;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.handler.AbstractMessageHandler;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Handler implementation that handles sbf:Framework header on the inbound SOAP envelope.
- */
-public class ProcessFrameworkHandler extends AbstractMessageHandler {
-
- /** Default Framework version. */
- public static final String DEFAULT_VERSION = "2.0";
-
- /** Logger. */
- private Logger log = LoggerFactory.getLogger(ProcessFrameworkHandler.class);
-
- /** The expected version value. */
- private String expectedVersion = DEFAULT_VERSION;
-
- /**
- * Get the expected version value.
- *
- * <p>Defaults to: {@link #DEFAULT_VERSION}</p>
- *
- * @return the expected version, or null
- */
- @Nullable public String getExpectedVersion() {
- return expectedVersion;
- }
-
- /**
- * Set the expected version value.
- *
- * <p>Defaults to: {@link #DEFAULT_VERSION}</p>
- *
- * @param version the new version value
- */
- public void setExpectedVersion(@Nullable final String version) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- expectedVersion = StringSupport.trimOrNull(version);
- }
-
- /** {@inheritDoc} */
- protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
- final Framework header = getFramework(messageContext);
- final String headerVersion = header != null ? StringSupport.trimOrNull(header.getVersion()) : null;
- log.debug("Checking inbound message Liberty ID-WSF Framework version value: {}", headerVersion);
- if (Objects.equals(getExpectedVersion(), headerVersion)) {
- log.debug("Inbound Liberty ID-WSF Framework version matched expected value");
- SOAPMessagingSupport.registerUnderstoodHeader(messageContext, header);
- } else {
- log.warn("Inbound Liberty ID-WSF Framework version '{}' did not match the expected value '{}'",
- headerVersion, getExpectedVersion());
- SOAPMessagingSupport.registerSOAP11Fault(messageContext,
- new QName(Konstantz.SBF_NS, Konstantz.Status.FRAMEWORK_VERSION_MISMATCH.getCode()),
- "Framework version not supported: " + headerVersion, null, null, null);
- throw new MessageHandlerException("Inbound Liberty ID-WSF Framework version "
- + "did not match the expected value");
- }
- }
-
- /**
- * Get message Action header.
- *
- * @param messageContext the current message context
- * @return the message Action header
- */
- protected Framework getFramework(@Nonnull final MessageContext messageContext) {
- final List<XMLObject> frameworks = SOAPMessagingSupport.getInboundHeaderBlock(messageContext,
- Framework.DEFAULT_ELEMENT_NAME);
- if (frameworks != null && !frameworks.isEmpty()) {
- return (Framework) frameworks.get(0);
- }
- return null;
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessSenderHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessSenderHandler.java
deleted file mode 100644
index af1755cea..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessSenderHandler.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.openliberty.xmltooling.soapbinding.Sender;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.handler.AbstractMessageHandler;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Handler implementation that handles the sb:Sender header on the inbound SOAP envelope.
- *
- * <p>
- * If the header is present, the providerId value is stored in the message context via
- * {@link SAMLPresenterEntityContext#setEntityId(String)}.
- * </p>
- */
-public class ProcessSenderHandler extends AbstractMessageHandler {
-
- /** Logger. */
- private Logger log = LoggerFactory.getLogger(ProcessSenderHandler.class);
-
- /** {@inheritDoc} */
- protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
- final Sender header = getSender(messageContext);
- final String headerValue = header != null ? StringSupport.trimOrNull(header.getProviderID()) : null;
- log.debug("Extracted inbound Liberty ID-WSF Sender providerId value: {}", headerValue);
- if (header != null && headerValue != null) {
- messageContext.getSubcontext(SAMLPresenterEntityContext.class, true).setEntityId(headerValue);
- SOAPMessagingSupport.registerUnderstoodHeader(messageContext, header);
- }
- }
-
- /**
- * Get Sender value.
- *
- * @param messageContext the current message context
- * @return the Sender header
- */
- protected Sender getSender(@Nonnull final MessageContext messageContext) {
- final List<XMLObject> senders = SOAPMessagingSupport.getInboundHeaderBlock(messageContext,
- LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME);
- if (senders != null && !senders.isEmpty()) {
- return (Sender) senders.get(0);
- }
- return null;
- }
-
-}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/SAMLSOAPDecoderBodyHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/SAMLSOAPDecoderBodyHandler.java
deleted file mode 100644
index 47d228561..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/SAMLSOAPDecoderBodyHandler.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.messaging.handler.AbstractMessageHandler;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.SAMLObject;
-import org.opensaml.soap.messaging.context.SOAP11Context;
-import org.opensaml.soap.soap11.Envelope;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Body handler impl for use with SAML SOAP message decoders.
- */
-public class SAMLSOAPDecoderBodyHandler extends AbstractMessageHandler {
-
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(SAMLSOAPDecoderBodyHandler.class);
-
- /** {@inheritDoc} */
- @Override
- protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
-
- final SOAP11Context soap11Context = messageContext.getSubcontext(SOAP11Context.class);
- if (soap11Context == null) {
- throw new MessageHandlerException("SOAP 1.1 context was not present in message context");
- }
- final Envelope soapMessage = soap11Context.getEnvelope();
- if (soapMessage == null) {
- throw new MessageHandlerException("SOAP 1.1 envelope was not present in SOAP context");
- }
-
- final List<XMLObject> soapBodyChildren = soapMessage.getBody().getUnknownXMLObjects();
- if (soapBodyChildren.size() < 1 || soapBodyChildren.size() > 1) {
- log.error("Unexpected number of children in the SOAP body, " + soapBodyChildren.size()
- + ". Unable to extract SAML message");
- throw new MessageHandlerException(
- "Unexpected number of children in the SOAP body, unable to extract SAML message");
- }
-
- final XMLObject incommingMessage = soapBodyChildren.get(0);
- if (!(incommingMessage instanceof SAMLObject)) {
- log.error("Unexpected SOAP body content. Expected a SAML request but recieved {}", incommingMessage
- .getElementQName());
- throw new MessageHandlerException("Unexpected SOAP body content. Expected a SAML request but recieved "
- + incommingMessage.getElementQName());
- }
-
- messageContext.setMessage(incommingMessage);
-
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/package-info.java
deleted file mode 100644
index bdddb8df3..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/package-info.java
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Profile processing components related to SAML 2 delegation messaging.
- */
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyBuilder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyBuilder.java
deleted file mode 100644
index d2f800e5e..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyBuilder.java
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.xmlobject.impl;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-import net.shibboleth.idp.saml.xmlobject.ExtensionsConstants;
-
-import org.opensaml.saml.common.AbstractSAMLObjectBuilder;
-
-/** Builder of {@link DelegationPolicy} objects. */
- at ThreadSafe
-public class DelegationPolicyBuilder extends AbstractSAMLObjectBuilder<DelegationPolicy> {
-
- /** {@inheritDoc} */
- public DelegationPolicy buildObject(final String namespaceURI, final String localName,
- final String namespacePrefix) {
- return new DelegationPolicyImpl(namespaceURI, localName, namespacePrefix);
- }
-
- /** {@inheritDoc} */
- public DelegationPolicy buildObject() {
- return buildObject(ExtensionsConstants.SHIB_DELEXT10_NS, DelegationPolicy.DEFAULT_ELEMENT_LOCAL_NAME,
- ExtensionsConstants.SHIB_DELEXT10_PREFIX);
- }
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyImpl.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyImpl.java
deleted file mode 100644
index 42ac542b4..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyImpl.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.xmlobject.impl;
-
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.concurrent.NotThreadSafe;
-
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-
-import org.opensaml.core.xml.AbstractXMLObject;
-import org.opensaml.core.xml.XMLObject;
-
-/** Implementation of {@link DelegationPolicy}. */
- at NotThreadSafe
-public class DelegationPolicyImpl extends AbstractXMLObject implements DelegationPolicy {
-
- /** The VerifyDepth attribute. */
- private Long maximumTokenDelegationChainLength;
-
- /**
- * Constructor.
- *
- * @param namespaceURI the namespace the element is in
- * @param elementLocalName the local name of the XML element this Object represents
- * @param namespacePrefix the prefix for the given namespace
- */
- protected DelegationPolicyImpl(final String namespaceURI, final String elementLocalName,
- final String namespacePrefix) {
- super(namespaceURI, elementLocalName, namespacePrefix);
- }
-
- /** {@inheritDoc} */
- @Override
- public Long getMaximumTokenDelegationChainLength() {
- return maximumTokenDelegationChainLength;
- }
-
- /** {@inheritDoc} */
- @Override
- public void setMaximumTokenDelegationChainLength(final Long value) {
- maximumTokenDelegationChainLength = prepareForAssignment(maximumTokenDelegationChainLength, value);
- }
-
- /** {@inheritDoc} */
- @Override
- public List<XMLObject> getOrderedChildren() {
- return Collections.emptyList();
- }
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyMarshaller.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyMarshaller.java
deleted file mode 100644
index 3eef9f8e0..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyMarshaller.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.xmlobject.impl;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.saml.common.AbstractSAMLObjectMarshaller;
-import org.w3c.dom.Element;
-
-/** Marshaller for {@link DelegationPolicy}. */
- at ThreadSafe
-public class DelegationPolicyMarshaller extends AbstractSAMLObjectMarshaller {
-
- /** {@inheritDoc} */
- protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
- final DelegationPolicy delegationPolicy = (DelegationPolicy) xmlObject;
-
- if (delegationPolicy.getMaximumTokenDelegationChainLength() != null) {
- domElement.setAttributeNS(null, DelegationPolicy.MAX_DELEGATION_CHAIN_LENGTH_ATTRIB_NAME,
- delegationPolicy.getMaximumTokenDelegationChainLength().toString());
- }
-
- }
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyUnmarshaller.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyUnmarshaller.java
deleted file mode 100644
index 6044b5586..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyUnmarshaller.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.xmlobject.impl;
-
-import javax.annotation.concurrent.ThreadSafe;
-
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.io.UnmarshallingException;
-import org.opensaml.saml.common.AbstractSAMLObjectUnmarshaller;
-import org.w3c.dom.Attr;
-
-/** Unmarshaller for {@link DelegationPolicy}. */
- at ThreadSafe
-public class DelegationPolicyUnmarshaller extends AbstractSAMLObjectUnmarshaller {
-
- /** {@inheritDoc} */
- protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
- final DelegationPolicy delegationPolicy = (DelegationPolicy) xmlObject;
-
- if (attribute.getLocalName().equals(DelegationPolicy.MAX_DELEGATION_CHAIN_LENGTH_ATTRIB_NAME)) {
- delegationPolicy.setMaximumTokenDelegationChainLength(Long.valueOf(attribute.getValue()));
- } else {
- super.processAttribute(xmlObject, attribute);
- }
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer b/idp-saml-impl/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
index 55da98caf..246b28c9b 100644
--- a/idp-saml-impl/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
+++ b/idp-saml-impl/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
@@ -1,2 +1 @@
net.shibboleth.idp.saml.xmlobject.impl.XMLObjectProviderInitializer
-net.shibboleth.idp.saml.saml2.profile.delegation.impl.XMLObjectProviderInitializer
diff --git a/idp-saml-impl/src/main/resources/liberty-soap-binding-config.xml b/idp-saml-impl/src/main/resources/liberty-soap-binding-config.xml
deleted file mode 100644
index de5df900d..000000000
--- a/idp-saml-impl/src/main/resources/liberty-soap-binding-config.xml
+++ /dev/null
@@ -1,93 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<XMLTooling xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.opensaml.org/xmltooling-config ../../src/schema/xmltooling-config.xsd"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/"
- xmlns:wsa="http://www.w3.org/2005/08/addressing"
- xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
- xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
- xmlns:sec="urn:liberty:security:2006-08"
- xmlns:sa="urn:liberty:sa:2006-08"
- xmlns:sb="urn:liberty:sb:2006-08"
- xmlns:sbf="urn:liberty:sb"
- xmlns="http://www.opensaml.org/xmltooling-config">
-
- <!-- This is a copy of OpenLiberty idwsfconsumer's soap-binding-xmltooling-config.xml, with some non-Liberty
- provider configs removed, which clash with impls supplied now in OpenWS. -->
- <ObjectProviders>
-
- <ObjectProvider qualifiedName="sbf:Framework">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.Framework$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.Framework$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.Framework$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:Consent">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.Consent$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.Consent$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.Consent$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:EndpointUpdate">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.EndpointUpdate$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.EndpointUpdate$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.EndpointUpdate$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:InteractionService">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.InteractionService$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.InteractionService$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.InteractionService$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:ProcessingContext">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.ProcessingContext$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.ProcessingContext$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.ProcessingContext$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:RedirectRequest">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.RedirectRequest$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.RedirectRequest$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.RedirectRequest$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:SecurityMechID">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.SecurityMechID$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.SecurityMechID$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.SecurityMechID$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:Sender">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.Sender$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.Sender$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.Sender$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:TargetIdentity">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.TargetIdentity$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.TargetIdentity$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.TargetIdentity$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:Timeout">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.Timeout$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.Timeout$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.Timeout$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:UsageDirective">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.UsageDirective$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.UsageDirective$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.UsageDirective$Unmarshaller" />
- </ObjectProvider>
-
- <ObjectProvider qualifiedName="sb:UserInteraction">
- <BuilderClass className="org.openliberty.xmltooling.soapbinding.UserInteraction$Builder" />
- <MarshallingClass className="org.openliberty.xmltooling.soapbinding.UserInteraction$Marshaller" />
- <UnmarshallingClass className="org.openliberty.xmltooling.soapbinding.UserInteraction$Unmarshaller" />
- </ObjectProvider>
-
- </ObjectProviders>
-
-</XMLTooling>
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/resources/shibboleth-saml-ext-config.xml b/idp-saml-impl/src/main/resources/shibboleth-saml-ext-config.xml
index db909c2e6..93a420c93 100644
--- a/idp-saml-impl/src/main/resources/shibboleth-saml-ext-config.xml
+++ b/idp-saml-impl/src/main/resources/shibboleth-saml-ext-config.xml
@@ -4,13 +4,6 @@
<!-- Shibboleth Extensions Object providers -->
<ObjectProviders>
- <!-- DelegationPolicy provider -->
- <ObjectProvider qualifiedName="shibdel:DelegationPolicy">
- <BuilderClass className="net.shibboleth.idp.saml.xmlobject.impl.DelegationPolicyBuilder"/>
- <MarshallingClass className="net.shibboleth.idp.saml.xmlobject.impl.DelegationPolicyMarshaller"/>
- <UnmarshallingClass className="net.shibboleth.idp.saml.xmlobject.impl.DelegationPolicyUnmarshaller"/>
- </ObjectProvider>
-
<!-- Scope provider -->
<ObjectProvider qualifiedName="shibmd:Scope">
<BuilderClass className="net.shibboleth.idp.saml.xmlobject.impl.ScopeBuilder"/>
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddAuthnStatementToAssertionFromInboundAssertionTokenTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddAuthnStatementToAssertionFromInboundAssertionTokenTest.java
deleted file mode 100644
index 5c0c426eb..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddAuthnStatementToAssertionFromInboundAssertionTokenTest.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.AuthnStatement;
-import org.opensaml.saml.saml2.core.Response;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-import org.xmlunit.builder.DiffBuilder;
-import org.xmlunit.diff.Diff;
-
-import com.google.common.base.Predicates;
-
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-
-/**
- * Unit test for {@link AddAuthnStatementToAssertionFromInboundAssertionToken} action.
- */
-public class AddAuthnStatementToAssertionFromInboundAssertionTokenTest extends OpenSAMLInitBaseTestCase {
-
- private AddAuthnStatementToAssertionFromInboundAssertionToken action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private Assertion delegatedAssertion;
-
- private AuthnStatement delegatedAuthnStatement;
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
- response.getAssertions().add(SAML2ActionTestingSupport.buildAssertion());
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
-
- delegatedAuthnStatement = SAML2ActionTestingSupport.buildAuthnStatement();
- delegatedAssertion.getAuthnStatements().add(delegatedAuthnStatement);
-
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedToken(delegatedAssertion);
-
- action = new AddAuthnStatementToAssertionFromInboundAssertionToken();
- }
-
- @Test
- public void testSuccess() throws ComponentInitializationException, MarshallingException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- final Assertion newAssertion = ((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().get(0);
- Assert.assertFalse(newAssertion.getAuthnStatements().isEmpty());
-
- final Diff diff = DiffBuilder.compare(
- XMLObjectSupport.marshall(delegatedAuthnStatement)).withTest(
- XMLObjectSupport.marshall(newAssertion.getAuthnStatements().get(0)))
- .checkForIdentical()
- .build();
- Assert.assertFalse(diff.hasDifferences(), diff.toString());
- }
-
- @Test
- public void testActivationCondition() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class); // This would otherwise cause failure
- action.setActivationCondition(Predicates.alwaysFalse());
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
- }
-
- @Test
- public void testNoLibertyContext() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoDelegatedAssertion() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).setAttestedToken(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoDelegatedAuthnStatement() throws ComponentInitializationException {
- delegatedAssertion.getAuthnStatements().clear();
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoAssertionToModify() throws ComponentInitializationException {
- action.setAssertionLookupStrategy(FunctionSupport.constant(null));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_MSG_CTX);
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertionTest.java
deleted file mode 100644
index ef9c2230b..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationPolicyToAssertionTest.java
+++ /dev/null
@@ -1,216 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Advice;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Response;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-/**
- *
- */
-public class AddDelegationPolicyToAssertionTest extends OpenSAMLInitBaseTestCase {
-
- private AddDelegationPolicyToAssertion action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private BrowserSSOProfileConfiguration browserSSOProfileConfig;
-
- private List<ProfileConfiguration> profileConfigs;
-
- private Assertion delegatedAssertion, assertionToModify;
-
- private Long expectedProfileChainLength = 3L;
- private Long expectedInboundChainLength = 5L;
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
- response.getAssertions().add(SAML2ActionTestingSupport.buildAssertion());
-
- assertionToModify = SAML2ActionTestingSupport.buildAssertion();
- assertionToModify.getAuthnStatements().add(SAML2ActionTestingSupport.buildAuthnStatement());
- response.getAssertions().add(assertionToModify);
-
- browserSSOProfileConfig = new BrowserSSOProfileConfiguration();
- browserSSOProfileConfig.setMaximumTokenDelegationChainLength(expectedProfileChainLength);
-
- profileConfigs = new ArrayList<>();
- profileConfigs.add(browserSSOProfileConfig);
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .setRelyingPartyProfileConfigurations(profileConfigs)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
- delegatedAssertion.setAdvice((Advice) XMLObjectSupport.buildXMLObject(Advice.DEFAULT_ELEMENT_NAME));
- DelegationPolicy delPolicy = (DelegationPolicy) XMLObjectSupport.buildXMLObject(DelegationPolicy.DEFAULT_ELEMENT_NAME);
- delPolicy.setMaximumTokenDelegationChainLength(expectedInboundChainLength);
- delegatedAssertion.getAdvice().getChildren().add(delPolicy);
-
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedToken(delegatedAssertion);
-
- action = new AddDelegationPolicyToAssertion();
- }
-
- @Test
- public void testChainLengthFromProfileConfig() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), expectedProfileChainLength);
- }
-
- @Test
- public void testNoRelyingPartyContext() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
- prc.removeSubcontext(RelyingPartyContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), AddDelegationPolicyToAssertion.DEFAULT_POLICY_MAX_CHAIN_LENGTH);
- }
-
- @Test
- public void testNoProfileConfig() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
- prc.getSubcontext(RelyingPartyContext.class).setProfileConfig(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), AddDelegationPolicyToAssertion.DEFAULT_POLICY_MAX_CHAIN_LENGTH);
- }
-
- @Test
- public void testChainLengthFromDelegatedAssertion() throws ComponentInitializationException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), expectedInboundChainLength);
- }
-
- @Test
- public void testNoDelegatedAssertion() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), expectedProfileChainLength);
- }
-
- @Test
- public void testNoDelegatedAssertionAdvice() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).getAttestedToken().setAdvice(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), AddDelegationPolicyToAssertion.DEFAULT_POLICY_MAX_CHAIN_LENGTH);
- }
-
- @Test
- public void testNoDelegatedAssertionPolicy() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).getAttestedToken().getAdvice().getChildren().clear();
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(getOutboundChainLength(), AddDelegationPolicyToAssertion.DEFAULT_POLICY_MAX_CHAIN_LENGTH);
- }
-
- @Test
- public void testActivationCondition() throws ComponentInitializationException {
- action.setActivationCondition(Predicates.alwaysFalse());
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertNull(getOutboundChainLength());
- }
-
- @Test
- public void testNoAssertionsToModify() throws ComponentInitializationException {
- ((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().clear();
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertNull(getOutboundChainLength());
- }
-
-
-
- // Helpers
-
- private Long getOutboundChainLength() {
- Advice advice = assertionToModify.getAdvice();
- if (advice != null) {
- List<XMLObject> policies = advice.getChildren(DelegationPolicy.DEFAULT_ELEMENT_NAME);
- if (policies != null && !policies.isEmpty()) {
- Assert.assertEquals(policies.size(), 1);
- return ((DelegationPolicy)policies.get(0)).getMaximumTokenDelegationChainLength();
- }
- }
- return null;
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationRestrictionToAssertionsTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationRestrictionToAssertionsTest.java
deleted file mode 100644
index 43c47a66e..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/AddDelegationRestrictionToAssertionsTest.java
+++ /dev/null
@@ -1,243 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
-import org.opensaml.saml.ext.saml2delrestrict.Delegate;
-import org.opensaml.saml.ext.saml2delrestrict.DelegationRestrictionType;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Condition;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.core.SubjectConfirmation;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-/**
- *
- */
-public class AddDelegationRestrictionToAssertionsTest extends OpenSAMLInitBaseTestCase {
-
- private AddDelegationRestrictionToAssertions action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private Assertion delegatedAssertion;
- private String delegatedConfirmationMethod;
-
- private DelegationRestrictionType delegatedRestrictionsCondition;
-
- private String[] initialDelegates =
- new String []{"http:/foo.example.org", "http://bar.example.org", "http://baz.exqmple.org"};
-
- private String presenterEntityID = "http://portal.example.org";
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
- response.getAssertions().add(SAML2ActionTestingSupport.buildAssertion());
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
-
- delegatedRestrictionsCondition =
- (DelegationRestrictionType) XMLObjectSupport.getBuilder(DelegationRestrictionType.TYPE_NAME)
- .buildObject(Condition.DEFAULT_ELEMENT_NAME, DelegationRestrictionType.TYPE_NAME);
-
- for (String entityID : initialDelegates) {
- Delegate delegate = (Delegate) XMLObjectSupport.buildXMLObject(Delegate.DEFAULT_ELEMENT_NAME);
- delegate.setNameID(SAML2ActionTestingSupport.buildNameID(entityID));
- delegatedRestrictionsCondition.getDelegates().add(delegate);
- }
-
- delegatedAssertion.setConditions((Conditions) XMLObjectSupport.buildXMLObject(Conditions.DEFAULT_ELEMENT_NAME));
- delegatedAssertion.getConditions().getConditions().add(delegatedRestrictionsCondition);
-
- delegatedConfirmationMethod = SubjectConfirmation.METHOD_HOLDER_OF_KEY;
-
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedToken(delegatedAssertion);
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedSubjectConfirmationMethod(delegatedConfirmationMethod);
-
- prc.getInboundMessageContext().getSubcontext(SAMLPresenterEntityContext.class, true).setEntityId(presenterEntityID);
-
- action = new AddDelegationRestrictionToAssertions();
- }
-
- @Test
- public void testSuccessCloneExistingDelegates() throws ComponentInitializationException, MarshallingException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().size(), 1);
- Assertion newAssertion = ((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().get(0);
- Assert.assertNotNull(newAssertion.getConditions());
-
- List<DelegationRestrictionType> drts = getDelegationRestrictionConditions(newAssertion.getConditions());
- Assert.assertEquals(drts.size(), 1);
- DelegationRestrictionType drt = drts.get(0);
- Assert.assertEquals(drt.getDelegates().size(), initialDelegates.length+1);
-
- Delegate newDelegate = drt.getDelegates().get(initialDelegates.length);
- Assert.assertNotNull(newDelegate.getNameID());
- Assert.assertEquals(newDelegate.getNameID().getValue(), presenterEntityID);
- Assert.assertNotNull(newDelegate.getConfirmationMethod());
- Assert.assertEquals(newDelegate.getConfirmationMethod(), delegatedConfirmationMethod);
- Assert.assertNotNull(newDelegate.getDelegationInstant());
- }
-
- @Test
- public void testSuccessNoExistingDelegates() throws ComponentInitializationException, MarshallingException {
- delegatedAssertion.setConditions(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertEquals(((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().size(), 1);
- Assertion newAssertion = ((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().get(0);
- Assert.assertNotNull(newAssertion.getConditions());
-
- List<DelegationRestrictionType> drts = getDelegationRestrictionConditions(newAssertion.getConditions());
- Assert.assertEquals(drts.size(), 1);
- DelegationRestrictionType drt = drts.get(0);
- Assert.assertEquals(drt.getDelegates().size(), 1);
-
- Delegate newDelegate = drt.getDelegates().get(0);
- Assert.assertNotNull(newDelegate.getNameID());
- Assert.assertEquals(newDelegate.getNameID().getValue(), presenterEntityID);
- Assert.assertNotNull(newDelegate.getConfirmationMethod());
- Assert.assertEquals(newDelegate.getConfirmationMethod(), delegatedConfirmationMethod);
- Assert.assertNotNull(newDelegate.getDelegationInstant());
- }
-
- @Test
- public void testActivationCondition() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class); // This would otherwise cause failure
- action.setActivationCondition(Predicates.alwaysFalse());
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
- }
-
- @Test
- public void testNoAssertionsToModify() throws ComponentInitializationException {
- ((Response)prc.getOutboundMessageContext().getMessage()).getAssertions().clear();
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
- }
-
- @Test
- public void testNoResponse() throws ComponentInitializationException {
- prc.getOutboundMessageContext().setMessage(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_MSG_CTX);
- }
-
- @Test
- public void testNoLibertyContext() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoDelegatedAssertion() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).setAttestedToken(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoDelegatedConfirmationMethod() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).setAttestedSubjectConfirmationMethod(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoPresenter() throws ComponentInitializationException {
- prc.getInboundMessageContext().removeSubcontext(SAMLPresenterEntityContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoPresenterEntityID() throws ComponentInitializationException {
- prc.getInboundMessageContext().getSubcontext(SAMLPresenterEntityContext.class).setEntityId(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
-
- // Helpers
-
- private List<DelegationRestrictionType> getDelegationRestrictionConditions(Conditions conditions) {
- ArrayList<DelegationRestrictionType> drts = new ArrayList<>();
- for (Condition conditionChild : conditions.getConditions()) {
- if (DelegationRestrictionType.TYPE_NAME.equals(conditionChild.getSchemaType())) {
- if (conditionChild instanceof DelegationRestrictionType) {
- drts.add((DelegationRestrictionType) conditionChild);
- }
- }
- }
- return drts;
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DecorateDelegatedAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DecorateDelegatedAssertionTest.java
deleted file mode 100644
index b244c9074..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DecorateDelegatedAssertionTest.java
+++ /dev/null
@@ -1,452 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.PublicKey;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Objects;
-
-import jakarta.servlet.http.HttpServletRequest;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationContext;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationRequest;
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAssertion.LibertySSOSEndpointURLStrategy;
-import net.shibboleth.utilities.java.support.collection.Pair;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.UninitializedComponentException;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-import net.shibboleth.utilities.java.support.xml.SerializeSupport;
-
-import org.openliberty.xmltooling.disco.MetadataAbstract;
-import org.openliberty.xmltooling.disco.ProviderID;
-import org.openliberty.xmltooling.disco.SecurityContext;
-import org.openliberty.xmltooling.disco.ServiceType;
-import org.openliberty.xmltooling.soapbinding.Framework;
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.core.xml.schema.XSAny;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Attribute;
-import org.opensaml.saml.saml2.core.Audience;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.KeyInfoConfirmationDataType;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.core.SubjectConfirmation;
-import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.CredentialSupport;
-import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.soap.wsaddressing.EndpointReference;
-import org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap;
-import org.opensaml.xmlsec.signature.KeyInfo;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockServletContext;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.AfterMethod;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-import org.w3c.dom.Element;
-import org.xmlunit.builder.DiffBuilder;
-import org.xmlunit.diff.Diff;
-
-import com.google.common.base.Predicates;
-
-/**
- *
- */
-public class DecorateDelegatedAssertionTest extends OpenSAMLInitBaseTestCase {
-
- private boolean print = false;
-
- private String ssosURL = "https://idp.example.org:8443/idp/profile/IDWSF/SSOS";
-
- private AuthnRequest authnRequest;
-
- private Response response;
-
- private Assertion assertion;
-
- private Element origAssertionDOM;
-
- private BrowserSSOProfileConfiguration browserSSOProfileConfig;
-
- private List<ProfileConfiguration> profileConfigs;
-
- private List<PublicKey> publicKeys;
-
- private int numKeys = 3;
-
- private List<Credential> credentials;
-
- private DecorateDelegatedAssertion action;
-
- private MockServletContext servletContext;
-
- private MockHttpServletRequest servletRequest;
-
- private RequestContext rc;
-
- private ProfileRequestContext prc;
-
- private DelegationContext delegationContext;
-
- public DecorateDelegatedAssertionTest() throws NoSuchAlgorithmException, NoSuchProviderException {
- publicKeys = new ArrayList<>();
- for (int i=0; i<numKeys; i++) {
- publicKeys.add(KeySupport.generateKeyPair("RSA", 2048, null).getPublic());
- }
- credentials = new ArrayList<>();
- for (PublicKey publicKey : publicKeys) {
- credentials.add(CredentialSupport.getSimpleCredential(publicKey, null));
- }
- }
-
- @BeforeMethod
- protected void setUp() throws ComponentInitializationException, MarshallingException {
- servletContext = new MockServletContext();
- servletContext.setContextPath("/idp");
- servletRequest = new MockHttpServletRequest(servletContext);
- servletRequest.setScheme("https");
- servletRequest.setServerName("idp.example.org");
- servletRequest.setServerPort(443);
- servletRequest.setRequestURI("/idp/profile/SAML2/Redirect/SSO");
- servletRequest.setContextPath("/idp");
-
- authnRequest = SAML2ActionTestingSupport.buildAuthnRequest();
- authnRequest.setIssuer(SAML2ActionTestingSupport.buildIssuer(ActionTestingSupport.INBOUND_MSG_ISSUER));
-
- response = SAML2ActionTestingSupport.buildResponse();
- response.setIssuer(SAML2ActionTestingSupport.buildIssuer(ActionTestingSupport.OUTBOUND_MSG_ISSUER));
-
- assertion = SAML2ActionTestingSupport.buildAssertion();
- assertion.setID(SAML2ActionTestingSupport.ASSERTION_ID);
- assertion.setIssuer(SAML2ActionTestingSupport.buildIssuer(ActionTestingSupport.OUTBOUND_MSG_ISSUER));
- assertion.setSubject(SAML2ActionTestingSupport.buildSubject("morpheus"));
- assertion.getAuthnStatements().add(SAML2ActionTestingSupport.buildAuthnStatement());
- assertion.getAttributeStatements().add(SAML2ActionTestingSupport.buildAttributeStatement());
- response.getAssertions().add(assertion);
-
- browserSSOProfileConfig = new BrowserSSOProfileConfiguration();
-
- profileConfigs = new ArrayList<>();
- profileConfigs.add(browserSSOProfileConfig);
-
- rc = new RequestContextBuilder()
- .setServletContext(servletContext)
- .setHttpRequest(servletRequest)
- .setInboundMessage(authnRequest)
- .setOutboundMessage(response)
- .setRelyingPartyProfileConfigurations(profileConfigs)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- RelyingPartyContext rpcContext = prc.getSubcontext(RelyingPartyContext.class);
- SAMLPeerEntityContext peerContext = rpcContext.getSubcontext(SAMLPeerEntityContext.class, true);
- peerContext.setEntityId(ActionTestingSupport.INBOUND_MSG_ISSUER);
- peerContext.setRole(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
- rpcContext.setRelyingPartyIdContextTree(peerContext);
-
- action = new DecorateDelegatedAssertion();
- action.setHttpServletRequest(servletRequest);
- action.setLibertySSOSEndpointURL(ssosURL);
- action.setKeyInfoGeneratorManager(DefaultSecurityConfigurationBootstrap.buildBasicKeyInfoGeneratorManager());
-
- delegationContext = prc.getSubcontext(DelegationContext.class, true);
- delegationContext.setIssuingDelegatedAssertion(true);
- delegationContext.setDelegationRequested(DelegationRequest.REQUESTED_REQUIRED);
- delegationContext.setSubjectConfirmationCredentials(credentials);
-
- origAssertionDOM = XMLObjectSupport.marshall(assertion);
- assertion.releaseDOM();
- assertion.releaseChildrenDOM(true);
- }
-
- @BeforeMethod(dependsOnMethods="setUp")
- protected void printBefore() {
- if (print) {
- System.out.println(prettyPrint(authnRequest));
- System.out.println(prettyPrint(response));
- }
- }
-
- @AfterMethod
- protected void printAfter() {
- if (print) {
- System.out.println(prettyPrint(response));
- }
- }
-
- @Test(expectedExceptions=UninitializedComponentException.class)
- public void testNotInitialized() throws Exception {
- action.execute(rc);
- }
-
- @Test(expectedExceptions=ComponentInitializationException.class)
- public void testNoConfiguredEndpointNoStrategy() throws Exception {
- action = new DecorateDelegatedAssertion();
- action.setLibertySSOSEndpointURL(null);
- action.setLibertySSOSEndpointURLLookupStrategy(null);
- action.setKeyInfoGeneratorManager(DefaultSecurityConfigurationBootstrap.buildBasicKeyInfoGeneratorManager());
- action.initialize();
- }
-
- @Test(expectedExceptions=ComponentInitializationException.class)
- public void testNoKeyInfoManager() throws Exception {
- action = new DecorateDelegatedAssertion();
- action.setLibertySSOSEndpointURL(ssosURL);
- action.initialize();
- }
-
- @Test
- public void testNoRelyingPartyContext() throws Exception {
- prc.removeSubcontext(RelyingPartyContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
-
- testUndecoratedAssertion();
- }
-
- @Test
- public void testNoAssertions() throws Exception {
- response.getAssertions().clear();
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- testUndecoratedAssertion();
- }
-
- @Test
- public void testActivationCondition() throws Exception {
- // Ensure that activation condition is evaled first.
- action.setActivationCondition(Predicates.alwaysFalse());
-
- // This would otherwise generate preExecute error, but shouldn't even get there.
- delegationContext.setSubjectConfirmationCredentials(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- testUndecoratedAssertion();
- }
-
- @Test
- public void testNoDelegationContext() throws Exception {
- prc.removeSubcontext(DelegationContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- testUndecoratedAssertion();
- }
-
-
- @Test
- public void testDelegationNotActive() throws Exception {
- delegationContext.setIssuingDelegatedAssertion(false);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- testUndecoratedAssertion();
- }
-
- @Test
- public void testDelegationActive() throws Exception {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- testDecoratedAssertion();
- }
-
- @Test
- public void testDelegationActiveNoCredentials() throws Exception {
- delegationContext.setSubjectConfirmationCredentials(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
-
- testUndecoratedAssertion();
- }
-
- @Test
- public void testEndpointViaDefaultStrategy() throws Exception {
- action.setLibertySSOSEndpointURL(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- testDecoratedAssertion();
- }
-
- @Test
- public void testEndpointStrategyProducesNull() throws Exception {
- action.setLibertySSOSEndpointURL(null);
- action.setLibertySSOSEndpointURLLookupStrategy(FunctionSupport.constant(null));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
-
- testUndecoratedAssertion();
- }
-
- @Test
- public void testDefaultEndpointStrategy() {
- // Sanity check
- Assert.assertEquals(servletRequest.getRequestURL().toString(), "https://idp.example.org/idp/profile/SAML2/Redirect/SSO");
-
- Pair<ProfileRequestContext, HttpServletRequest> input = new Pair<>(prc, servletRequest);
-
- LibertySSOSEndpointURLStrategy strategy = new DecorateDelegatedAssertion.LibertySSOSEndpointURLStrategy();
- Assert.assertEquals(strategy.apply(input), ssosURL);
- }
-
-
-
-
- // Helper methods
-
- private String prettyPrint(XMLObject xmlObject) {
- try {
- Element element = XMLObjectSupport.marshall(xmlObject);
- return SerializeSupport.prettyPrintXML(element);
- } catch (MarshallingException e) {
- throw new RuntimeException(e);
- }
- }
-
- private void testUndecoratedAssertion() throws MarshallingException {
- Element currentAssertionDOM = XMLObjectSupport.marshall(assertion);
- assertion.releaseDOM();
- assertion.releaseChildrenDOM(true);
- Assert.assertNotSame(origAssertionDOM.getOwnerDocument(), currentAssertionDOM.getOwnerDocument());
-
- final Diff diff = DiffBuilder.compare(origAssertionDOM).withTest(currentAssertionDOM)
- .checkForIdentical()
- .build();
- Assert.assertFalse(diff.hasDifferences(), diff.toString());
- }
-
- private void testDecoratedAssertion() throws MarshallingException {
- Element currentAssertionDOM = XMLObjectSupport.marshall(assertion);
- assertion.releaseDOM();
- assertion.releaseChildrenDOM(true);
- Assert.assertNotSame(origAssertionDOM.getOwnerDocument(), currentAssertionDOM.getOwnerDocument());
-
- final Diff diff = DiffBuilder.compare(origAssertionDOM).withTest(currentAssertionDOM)
- .checkForIdentical()
- .build();
- Assert.assertTrue(diff.hasDifferences(), diff.toString());
-
- // SubjectConfirmation
- Assert.assertNotNull(assertion.getSubject().getSubjectConfirmations());
- Assert.assertEquals(assertion.getSubject().getSubjectConfirmations().size(), 1);
- SubjectConfirmation sc = assertion.getSubject().getSubjectConfirmations().get(0);
- Assert.assertEquals(sc.getMethod(), SubjectConfirmation.METHOD_HOLDER_OF_KEY);
- Assert.assertNotNull(sc.getNameID());
- Assert.assertEquals(sc.getNameID().getValue(), ActionTestingSupport.INBOUND_MSG_ISSUER);
- Assert.assertTrue(sc.getSubjectConfirmationData() instanceof KeyInfoConfirmationDataType);
- KeyInfoConfirmationDataType confData = (KeyInfoConfirmationDataType) sc.getSubjectConfirmationData();
- Assert.assertEquals(confData.getKeyInfos().size(), numKeys);
- Assert.assertEquals(((KeyInfo)confData.getKeyInfos().get(0)).getKeyValues().size(), 1);
-
- // Audience
- Assert.assertNotNull(assertion.getConditions());
- Assert.assertEquals(assertion.getConditions().getAudienceRestrictions().size(), 1);
- Assert.assertTrue(assertion.getConditions().getAudienceRestrictions().get(0).getAudiences().size() > 0);
- boolean sawAudience = false;
- for (Audience audience : assertion.getConditions().getAudienceRestrictions().get(0).getAudiences()) {
- if (Objects.equals(audience.getURI(), ActionTestingSupport.OUTBOUND_MSG_ISSUER)) {
- sawAudience = true;
- }
- }
- Assert.assertTrue(sawAudience);
-
- // Endpoint Attribute
- Assert.assertEquals(assertion.getAttributeStatements().size(), 1);
- Attribute ssosAttrib = null;
- for (Attribute attrib : assertion.getAttributeStatements().get(0).getAttributes()) {
- if (Objects.equals(attrib.getName(), LibertyConstants.SERVICE_TYPE_SSOS)) {
- ssosAttrib = attrib;
- break;
- }
- }
- Assert.assertNotNull(ssosAttrib);
- Assert.assertEquals(ssosAttrib.getAttributeValues().size(), 1);
- Assert.assertTrue(ssosAttrib.getAttributeValues().get(0) instanceof XSAny);
- XSAny attribValue = (XSAny) ssosAttrib.getAttributeValues().get(0);
- Assert.assertEquals(attribValue.getUnknownXMLObjects(EndpointReference.ELEMENT_NAME).size(), 1);
- EndpointReference epr = (EndpointReference) attribValue.getUnknownXMLObjects(EndpointReference.ELEMENT_NAME).get(0);
- Assert.assertNotNull(epr.getAddress());
- Assert.assertEquals(epr.getAddress().getURI(), ssosURL);
-
- Assert.assertNotNull(epr.getMetadata());
-
- Assert.assertEquals(epr.getMetadata().getUnknownXMLObjects(LibertyConstants.DISCO_ABSTRACT_ELEMENT_NAME).size(), 1);
- Assert.assertEquals(((MetadataAbstract)epr.getMetadata().getUnknownXMLObjects(
- LibertyConstants.DISCO_ABSTRACT_ELEMENT_NAME).get(0)).getValue(), LibertyConstants.SSOS_EPR_METADATA_ABSTRACT);
-
- Assert.assertEquals(epr.getMetadata().getUnknownXMLObjects(LibertyConstants.DISCO_SERVICE_TYPE_ELEMENT_NAME).size(), 1);
- Assert.assertEquals(((ServiceType)epr.getMetadata().getUnknownXMLObjects(
- LibertyConstants.DISCO_SERVICE_TYPE_ELEMENT_NAME).get(0)).getValue(), LibertyConstants.SERVICE_TYPE_SSOS);
-
- Assert.assertEquals(epr.getMetadata().getUnknownXMLObjects(LibertyConstants.DISCO_PROVIDERID_ELEMENT_NAME).size(), 1);
- Assert.assertEquals(((ProviderID)epr.getMetadata().getUnknownXMLObjects(
- LibertyConstants.DISCO_PROVIDERID_ELEMENT_NAME).get(0)).getValue(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
-
- Assert.assertEquals(epr.getMetadata().getUnknownXMLObjects(Framework.DEFAULT_ELEMENT_NAME).size(), 1);
- Assert.assertEquals(((Framework)epr.getMetadata().getUnknownXMLObjects(
- Framework.DEFAULT_ELEMENT_NAME).get(0)).getVersion(), "2.0");
-
- Assert.assertEquals(epr.getMetadata().getUnknownXMLObjects(LibertyConstants.DISCO_SECURITY_CONTEXT_ELEMENT_NAME).size(), 1);
- SecurityContext secContext = (SecurityContext) epr.getMetadata().getUnknownXMLObjects(LibertyConstants.DISCO_SECURITY_CONTEXT_ELEMENT_NAME).get(0);
- Assert.assertEquals(secContext.getSecurityMechIDs().size(), 1);
- Assert.assertEquals(secContext.getSecurityMechIDs().get(0).getValue(), LibertyConstants.SECURITY_MECH_ID_CLIENT_TLS_PEER_SAML_V2);
- Assert.assertEquals(secContext.getTokens().size(), 1);
- Assert.assertEquals(secContext.getTokens().get(0).getRef(), "#" + SAML2ActionTestingSupport.ASSERTION_ID);
- Assert.assertEquals(secContext.getTokens().get(0).getUsage(), LibertyConstants.TOKEN_USAGE_SECURITY_TOKEN);
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategyTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategyTest.java
deleted file mode 100644
index 0b7cc3add..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/DelegatedAssertionLookupStrategyTest.java
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class DelegatedAssertionLookupStrategyTest extends OpenSAMLInitBaseTestCase {
-
- private DelegatedAssertionLookupStrategy strategy;
-
- private ProfileRequestContext prc;
-
- private Assertion delegatedAssertion;
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- RequestContext rc = new RequestContextBuilder().buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
-
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedToken(delegatedAssertion);
-
- strategy = new DelegatedAssertionLookupStrategy();
- }
-
- @Test
- public void testSuccess() {
- Assertion assertion = strategy.apply(prc);
- Assert.assertNotNull(assertion);
- Assert.assertSame(assertion, delegatedAssertion);
- }
-
- @Test
- void testNoPRC() {
- Assertion assertion = strategy.apply(null);
- Assert.assertNull(assertion);
- }
-
- @Test
- public void testNoLibertyContext() {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- Assertion assertion = strategy.apply(prc);
- Assert.assertNull(assertion);
- }
-
- @Test
- public void testNoAssertion() {
- prc.getSubcontext(LibertySSOSContext.class).setAttestedToken(null);
-
- Assertion assertion = strategy.apply(prc);
- Assert.assertNull(assertion);
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicyTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicyTest.java
deleted file mode 100644
index 553ac7f7e..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/EvaluateDelegationPolicyTest.java
+++ /dev/null
@@ -1,256 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.function.Function;
-
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.EvaluateDelegationPolicy.PolicyMaxChainLengthStrategy;
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.ext.saml2delrestrict.Delegate;
-import org.opensaml.saml.ext.saml2delrestrict.DelegationRestrictionType;
-import org.opensaml.saml.saml2.core.Advice;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Condition;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.core.Response;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-/**
- *
- */
-public class EvaluateDelegationPolicyTest extends OpenSAMLInitBaseTestCase {
-
- private EvaluateDelegationPolicy action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private SSOSProfileConfiguration ssosProfileConfig;
-
- private List<ProfileConfiguration> profileConfigs;
-
- private Assertion delegatedAssertion;
-
- private DelegationRestrictionType delegatedRestrictionsCondition;
- private DelegationPolicy delegationPolicy;
-
- private String[] delegates =
- new String []{"http:/foo.example.org", "http://bar.example.org", "http://baz.exqmple.org"};
-
- private Long policyMaxChainLength = delegates.length+1L;
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
- response.getAssertions().add(SAML2ActionTestingSupport.buildAssertion());
-
- ssosProfileConfig = new SSOSProfileConfiguration();
- ssosProfileConfig.setDelegationPredicate(Predicates.<ProfileRequestContext>alwaysTrue());
-
-
- profileConfigs = new ArrayList<>();
- profileConfigs.add(ssosProfileConfig);
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .setRelyingPartyProfileConfigurations(profileConfigs)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
-
- delegatedRestrictionsCondition =
- (DelegationRestrictionType) XMLObjectSupport.getBuilder(DelegationRestrictionType.TYPE_NAME)
- .buildObject(Condition.DEFAULT_ELEMENT_NAME, DelegationRestrictionType.TYPE_NAME);
-
- for (String entityID : delegates) {
- Delegate delegate = (Delegate) XMLObjectSupport.buildXMLObject(Delegate.DEFAULT_ELEMENT_NAME);
- delegate.setNameID(SAML2ActionTestingSupport.buildNameID(entityID));
- delegatedRestrictionsCondition.getDelegates().add(delegate);
- }
-
- delegatedAssertion.setConditions((Conditions) XMLObjectSupport.buildXMLObject(Conditions.DEFAULT_ELEMENT_NAME));
- delegatedAssertion.getConditions().getConditions().add(delegatedRestrictionsCondition);
-
- delegationPolicy = (DelegationPolicy) XMLObjectSupport.buildXMLObject(DelegationPolicy.DEFAULT_ELEMENT_NAME);
- delegationPolicy.setMaximumTokenDelegationChainLength(policyMaxChainLength);
-
- delegatedAssertion.setAdvice((Advice) XMLObjectSupport.buildXMLObject(Advice.DEFAULT_ELEMENT_NAME));
- delegatedAssertion.getAdvice().getChildren().add(delegationPolicy);
-
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedToken(delegatedAssertion);
-
- action = new EvaluateDelegationPolicy();
- }
-
- @Test
- public void testDefaultChainLengthStrategy() throws ComponentInitializationException {
- action.initialize();
- //The non-static strategy reads instance vars populated during execute();
- action.execute(rc);
-
- PolicyMaxChainLengthStrategy strategy = action.new PolicyMaxChainLengthStrategy();
- Assert.assertEquals(strategy.apply(prc), policyMaxChainLength);
- }
-
- @Test
- public void testDefaultChainLengthStrategyNoAssertion() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- action.initialize();
- //The non-static strategy reads instance vars populated during execute();
- action.execute(rc);
-
- PolicyMaxChainLengthStrategy strategy = action.new PolicyMaxChainLengthStrategy();
- Assert.assertNull(strategy.apply(prc));
- }
-
- @Test
- public void testDefaultChainLengthStrategyNoPolicy() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).getAttestedToken().setAdvice(null);
-
- action.initialize();
- //The non-static strategy reads instance vars populated during execute();
- action.execute(rc);
-
- PolicyMaxChainLengthStrategy strategy = action.new PolicyMaxChainLengthStrategy();
- Assert.assertNull(strategy.apply(prc));
- }
-
- @Test
- public void testSuccessNoInboundChain() throws ComponentInitializationException {
- delegatedAssertion.setConditions(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
- }
-
- @Test
- public void testSuccessChainShorterThanPolicy() throws ComponentInitializationException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
- }
-
- @Test
- public void testSuccessNoChainDefaultChainPolicy() throws ComponentInitializationException {
- delegatedAssertion.setConditions(null);
- action.setPolicyMaxChainLengthStrategy(new MockChainLengthStrategy(null));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
- }
-
- @Test
- public void testChainLongerThanPolicy() throws ComponentInitializationException {
- action.setPolicyMaxChainLengthStrategy(new MockChainLengthStrategy(delegates.length-1L));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_SEC_CFG);
- }
-
- @Test
- public void testChainEqualToPolicy() throws ComponentInitializationException {
- action.setPolicyMaxChainLengthStrategy(new MockChainLengthStrategy((long)delegates.length));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_SEC_CFG);
- }
-
- @Test
- public void testPredicateDisallows() throws ComponentInitializationException {
- ssosProfileConfig.setDelegationPredicate(Predicates.<ProfileRequestContext>alwaysFalse());
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_SEC_CFG);
- }
-
- @Test
- public void testNoDelegatedAssertion() throws ComponentInitializationException {
- action.setAssertionTokenStrategy(FunctionSupport.constant(null));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.NO_CREDENTIALS);
- }
-
- @Test
- public void testNoRelyingPartyContext() throws ComponentInitializationException {
- prc.removeSubcontext(RelyingPartyContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
- @Test
- public void testNoProfileConfig() throws ComponentInitializationException {
- prc.getSubcontext(RelyingPartyContext.class).setProfileConfig(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
- }
-
-
-
- // Helpers
-
- private static class MockChainLengthStrategy implements Function<ProfileRequestContext, Long> {
- private Long length;
- public MockChainLengthStrategy(Long value) {
- length = value;
- }
- @Nullable public Long apply(@Nullable ProfileRequestContext input) {
- return length;
- }
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessingTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessingTest.java
deleted file mode 100644
index b27448d1e..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/FinalizeSAMLTokenProcessingTest.java
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.authn.context.SubjectContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Response;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class FinalizeSAMLTokenProcessingTest extends OpenSAMLInitBaseTestCase {
-
- private FinalizeSAMLTokenProcessing action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private SubjectCanonicalizationContext c14NContext;
-
- private String expectedPrincipalName = "morpheus";
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
-
- c14NContext = prc.getSubcontext(SubjectCanonicalizationContext.class, true);
- c14NContext.setPrincipalName(expectedPrincipalName);
-
- action = new FinalizeSAMLTokenProcessing();
- }
-
- @Test
- public void testSuccess() throws ComponentInitializationException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- Assert.assertNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
-
- SubjectContext subjectContext = prc.getSubcontext(SubjectContext.class);
- Assert.assertNotNull(subjectContext);
- Assert.assertEquals(subjectContext.getPrincipalName(), expectedPrincipalName);
- }
-
- @Test
- public void testNoC14NContext() throws ComponentInitializationException {
- prc.removeSubcontext(SubjectCanonicalizationContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
-
- Assert.assertNull(prc.getSubcontext(SubjectContext.class));
- }
-
- @Test
- public void testNoPrincipalName() throws ComponentInitializationException {
- prc.getSubcontext(SubjectCanonicalizationContext.class).setPrincipalName(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
-
- Assert.assertNotNull(prc.getSubcontext(SubjectCanonicalizationContext.class));
-
- Assert.assertNull(prc.getSubcontext(SubjectContext.class));
- }
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateDelegationContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateDelegationContextTest.java
deleted file mode 100644
index fc196b718..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateDelegationContextTest.java
+++ /dev/null
@@ -1,458 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.PublicKey;
-import java.util.ArrayList;
-import java.util.List;
-
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.RelyingPartyContext;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationContext;
-import net.shibboleth.idp.saml.saml2.profile.delegation.DelegationRequest;
-import net.shibboleth.utilities.java.support.codec.EncodingException;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.component.UninitializedComponentException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.AttributeConsumingServiceContext;
-import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.AttributeQuery;
-import org.opensaml.saml.saml2.core.Audience;
-import org.opensaml.saml.saml2.core.AudienceRestriction;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
-import org.opensaml.saml.saml2.metadata.EntityDescriptor;
-import org.opensaml.saml.saml2.metadata.KeyDescriptor;
-import org.opensaml.saml.saml2.metadata.RequestedAttribute;
-import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
-import org.opensaml.saml.security.impl.MetadataCredentialResolver;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap;
-import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
-import org.opensaml.xmlsec.signature.KeyInfo;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.mock.web.MockServletContext;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-/**
- *
- */
-public class PopulateDelegationContextTest extends OpenSAMLInitBaseTestCase {
-
- private AuthnRequest authnRequest;
-
- private Response response;
-
- private Assertion assertion;
-
- private BrowserSSOProfileConfiguration browserSSOProfileConfig;
-
- private List<ProfileConfiguration> profileConfigs;
-
- private List<PublicKey> publicKeys;
-
- private int numKeys = 3;
-
- private SAMLPeerEntityContext samlPeerContext;
-
- private SAMLMetadataContext samlMetadataContext;
-
- private PopulateDelegationContext action;
-
- private MockServletContext servletContext;
-
- private MockHttpServletRequest servletRequest;
-
- private RequestContext rc;
-
- private ProfileRequestContext prc;
-
- public PopulateDelegationContextTest() throws NoSuchAlgorithmException, NoSuchProviderException {
- publicKeys = new ArrayList<>();
- for (int i=0; i<numKeys; i++) {
- publicKeys.add(KeySupport.generateKeyPair("RSA", 2048, null).getPublic());
- }
- }
-
- @BeforeMethod
- protected void setUp() throws ComponentInitializationException, EncodingException {
- servletContext = new MockServletContext();
- servletContext.setContextPath("/idp");
- servletRequest = new MockHttpServletRequest(servletContext);
- servletRequest.setScheme("https");
- servletRequest.setServerName("idp.example.org");
- servletRequest.setServerPort(443);
- servletRequest.setRequestURI("/idp/profile/SAML2/Redirect/SSO");
- servletRequest.setContextPath("/idp");
-
- authnRequest = SAML2ActionTestingSupport.buildAuthnRequest();
- authnRequest.setIssuer(SAML2ActionTestingSupport.buildIssuer(ActionTestingSupport.INBOUND_MSG_ISSUER));
-
- response = SAML2ActionTestingSupport.buildResponse();
- response.setIssuer(SAML2ActionTestingSupport.buildIssuer(ActionTestingSupport.OUTBOUND_MSG_ISSUER));
-
- assertion = SAML2ActionTestingSupport.buildAssertion();
- assertion.setID(SAML2ActionTestingSupport.ASSERTION_ID);
- assertion.setIssuer(SAML2ActionTestingSupport.buildIssuer(ActionTestingSupport.OUTBOUND_MSG_ISSUER));
- assertion.setSubject(SAML2ActionTestingSupport.buildSubject("morpheus"));
- assertion.getAuthnStatements().add(SAML2ActionTestingSupport.buildAuthnStatement());
- assertion.getAttributeStatements().add(SAML2ActionTestingSupport.buildAttributeStatement());
- response.getAssertions().add(assertion);
-
- browserSSOProfileConfig = new BrowserSSOProfileConfiguration();
-
- profileConfigs = new ArrayList<>();
- profileConfigs.add(browserSSOProfileConfig);
-
- rc = new RequestContextBuilder()
- .setServletContext(servletContext)
- .setHttpRequest(servletRequest)
- .setInboundMessage(authnRequest)
- .setOutboundMessage(response)
- .setRelyingPartyProfileConfigurations(profileConfigs)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- RelyingPartyContext rpcContext = prc.getSubcontext(RelyingPartyContext.class);
- samlPeerContext = rpcContext.getSubcontext(SAMLPeerEntityContext.class, true);
- samlPeerContext.setEntityId(ActionTestingSupport.INBOUND_MSG_ISSUER);
- samlPeerContext.setRole(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
- rpcContext.setRelyingPartyIdContextTree(samlPeerContext);
- samlMetadataContext = samlPeerContext.getSubcontext(SAMLMetadataContext.class, true);
- samlMetadataContext.setRoleDescriptor(buildSPSSODescriptor());
-
- MetadataCredentialResolver mcr = new MetadataCredentialResolver();
- mcr.setKeyInfoCredentialResolver(DefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());
- mcr.initialize();
-
- action = new PopulateDelegationContext();
- action.setCredentialResolver(mcr);
- }
-
- @Test(expectedExceptions=UninitializedComponentException.class)
- public void testNotInitialized() throws Exception {
- action.execute(rc);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testNoInboundMessageContext() throws Exception {
- prc.setInboundMessageContext(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_MSG_CTX);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testNoInboundMessage() throws Exception {
- prc.getInboundMessageContext().setMessage(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_MSG_CTX);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testInboundMessageNotSAML2AuthnRequest() throws Exception {
- prc.getInboundMessageContext().setMessage(XMLObjectSupport.buildXMLObject(AttributeQuery.DEFAULT_ELEMENT_NAME));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test(expectedExceptions=ComponentInitializationException.class)
- public void testNoCredentialResolver() throws Exception {
- action = new PopulateDelegationContext();
- action.initialize();
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testNoRelyingPartyContext() throws Exception {
- prc.removeSubcontext(RelyingPartyContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_PROFILE_CTX);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testActivationCondition() throws Exception {
- // Ensure that activation condition is evaled first.
- action.setActivationCondition(Predicates.alwaysFalse());
-
- // An empty PRC would otherwise generate lots of preExecute errors, but shouldn't even get there.
- prc.clearSubcontexts();
- prc.setInboundMessageContext(null);
- prc.setOutboundMessageContext(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testNoMetadataContext() throws Exception {
- samlPeerContext.removeSubcontext(SAMLMetadataContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testNoRoleDescriptor() throws Exception {
- samlMetadataContext.setRoleDescriptor(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testDelegationNotRequested() throws Exception {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testRequestedViaMetadataNotRequiredNotAllowed() throws Exception {
- samlMetadataContext.getSubcontext(AttributeConsumingServiceContext.class, true).setAttributeConsumingService(
- buildDelegationRequestAttributeConsumingService(false));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testRequestedViaMetadataRequiredNotAllowed() throws Exception {
- samlMetadataContext.getSubcontext(AttributeConsumingServiceContext.class, true).setAttributeConsumingService(
- buildDelegationRequestAttributeConsumingService(true));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_SEC_CFG);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testRequestedViaMetadataNotRequiredAllowed() throws Exception {
- samlMetadataContext.getSubcontext(AttributeConsumingServiceContext.class, true).setAttributeConsumingService(
- buildDelegationRequestAttributeConsumingService(false));
-
- browserSSOProfileConfig.setAllowDelegation(true);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNotNull(delegationContext);
- Assert.assertEquals(delegationContext.isIssuingDelegatedAssertion(), true);
- Assert.assertEquals(delegationContext.getDelegationRequested(), DelegationRequest.REQUESTED_OPTIONAL);
- Assert.assertNotNull(delegationContext.getSubjectConfirmationCredentials());
- Assert.assertFalse(delegationContext.getSubjectConfirmationCredentials().isEmpty());
- }
-
- @Test
- public void testRequestedViaMetadataRequiredAllowed() throws Exception {
- samlMetadataContext.getSubcontext(AttributeConsumingServiceContext.class, true).setAttributeConsumingService(
- buildDelegationRequestAttributeConsumingService(true));
-
- browserSSOProfileConfig.setAllowDelegation(true);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNotNull(delegationContext);
- Assert.assertEquals(delegationContext.isIssuingDelegatedAssertion(), true);
- Assert.assertEquals(delegationContext.getDelegationRequested(), DelegationRequest.REQUESTED_REQUIRED);
- Assert.assertNotNull(delegationContext.getSubjectConfirmationCredentials());
- Assert.assertFalse(delegationContext.getSubjectConfirmationCredentials().isEmpty());
- }
-
- @Test
- public void testRequestedViaConditionsNotAllowed() throws Exception {
- authnRequest.setConditions(buildDelegationRequestConditions());
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.INVALID_SEC_CFG);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testRequestedViaConditionsAllowed() throws Exception {
- authnRequest.setConditions(buildDelegationRequestConditions());
-
- browserSSOProfileConfig.setAllowDelegation(true);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNotNull(delegationContext);
- Assert.assertEquals(delegationContext.isIssuingDelegatedAssertion(), true);
- Assert.assertEquals(delegationContext.getDelegationRequested(), DelegationRequest.REQUESTED_REQUIRED);
- Assert.assertNotNull(delegationContext.getSubjectConfirmationCredentials());
- Assert.assertFalse(delegationContext.getSubjectConfirmationCredentials().isEmpty());
- }
-
- @Test
- public void testRequiredNoKeyDescriptors() throws Exception {
- samlMetadataContext.getRoleDescriptor().getKeyDescriptors().clear();
-
- authnRequest.setConditions(buildDelegationRequestConditions());
-
- browserSSOProfileConfig.setAllowDelegation(true);
-
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, EventIds.MESSAGE_PROC_ERROR);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
- @Test
- public void testNotRequiredNoKeyDescriptors() throws Exception {
- samlMetadataContext.getRoleDescriptor().getKeyDescriptors().clear();
-
- samlMetadataContext.getSubcontext(AttributeConsumingServiceContext.class, true).setAttributeConsumingService(
- buildDelegationRequestAttributeConsumingService(false));
-
- browserSSOProfileConfig.setAllowDelegation(true);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- DelegationContext delegationContext = prc.getSubcontext(DelegationContext.class);
- Assert.assertNull(delegationContext);
- }
-
-
- // Helper methods
-
- private Conditions buildDelegationRequestConditions() {
- Audience audience = (Audience) XMLObjectSupport.buildXMLObject(Audience.DEFAULT_ELEMENT_NAME);
- audience.setURI(prc.getSubcontext(RelyingPartyContext.class).getConfiguration().getResponderId(prc));
- AudienceRestriction ar = (AudienceRestriction) XMLObjectSupport.buildXMLObject(AudienceRestriction.DEFAULT_ELEMENT_NAME);
- ar.getAudiences().add(audience);
- Conditions conditions = (Conditions) XMLObjectSupport.buildXMLObject(Conditions.DEFAULT_ELEMENT_NAME);
- conditions.getAudienceRestrictions().add(ar);
- return conditions;
- }
-
- private AttributeConsumingService buildDelegationRequestAttributeConsumingService(boolean required) {
- RequestedAttribute ra = (RequestedAttribute) XMLObjectSupport.buildXMLObject(RequestedAttribute.DEFAULT_ELEMENT_NAME);
- ra.setName(LibertyConstants.SERVICE_TYPE_SSOS);
- ra.setIsRequired(required);
- AttributeConsumingService acs = (AttributeConsumingService) XMLObjectSupport.buildXMLObject(AttributeConsumingService.DEFAULT_ELEMENT_NAME);
- acs.getRequestedAttributes().add(ra);
- return acs;
- }
-
- private SPSSODescriptor buildSPSSODescriptor() throws EncodingException {
- SPSSODescriptor spSSODescriptor = (SPSSODescriptor) XMLObjectSupport.buildXMLObject(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
-
- for (PublicKey publicKey : publicKeys) {
- KeyInfo keyInfo = (KeyInfo) XMLObjectSupport.buildXMLObject(KeyInfo.DEFAULT_ELEMENT_NAME);
- KeyInfoSupport.addPublicKey(keyInfo, publicKey);
-
- KeyDescriptor keyDescriptor = (KeyDescriptor) XMLObjectSupport.buildXMLObject(KeyDescriptor.DEFAULT_ELEMENT_NAME);
- keyDescriptor.setUse(UsageType.SIGNING);
- keyDescriptor.setKeyInfo(keyInfo);
-
- spSSODescriptor.getKeyDescriptors().add(keyDescriptor);
- }
-
- EntityDescriptor ed = (EntityDescriptor) XMLObjectSupport.buildXMLObject(EntityDescriptor.DEFAULT_ELEMENT_NAME);
- ed.setEntityID(ActionTestingSupport.INBOUND_MSG_ISSUER);
- ed.getRoleDescriptors().add(spSSODescriptor);
-
- return spSSODescriptor;
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContextTest.java
deleted file mode 100644
index c4b178b81..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateLibertyContextTest.java
+++ /dev/null
@@ -1,178 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.core.SubjectConfirmation;
-import org.opensaml.saml.saml2.wssecurity.SAML20AssertionToken;
-import org.opensaml.soap.wssecurity.messaging.Token.ValidationStatus;
-import org.opensaml.soap.wssecurity.messaging.WSSecurityContext;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateLibertyContext.TokenStrategy;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import net.shibboleth.utilities.java.support.logic.FunctionSupport;
-
-/**
- *
- */
-public class PopulateLibertyContextTest extends OpenSAMLInitBaseTestCase {
-
- private PopulateLibertyContext action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private SAML20AssertionToken delegatedToken;
- private Assertion delegatedAssertion;
- private String delegatedConfirmationMethod;
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
- response.getAssertions().add(SAML2ActionTestingSupport.buildAssertion());
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- Assertion dummyAssertion = SAML2ActionTestingSupport.buildAssertion();
- dummyAssertion.setSubject(SAML2ActionTestingSupport.buildSubject("neo"));
- SubjectConfirmation dummyConfirmation = (SubjectConfirmation) XMLObjectSupport.buildXMLObject(SubjectConfirmation.DEFAULT_ELEMENT_NAME);
- dummyConfirmation.setMethod(SubjectConfirmation.METHOD_BEARER);
- dummyAssertion.getSubject().getSubjectConfirmations().add(dummyConfirmation);
-
- delegatedConfirmationMethod = SubjectConfirmation.METHOD_HOLDER_OF_KEY;
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
- delegatedAssertion.setSubject(SAML2ActionTestingSupport.buildSubject("morpheus"));
- SubjectConfirmation delegatedConfirmation = (SubjectConfirmation) XMLObjectSupport.buildXMLObject(SubjectConfirmation.DEFAULT_ELEMENT_NAME);
- delegatedConfirmation.setMethod(delegatedConfirmationMethod);
- delegatedAssertion.getSubject().getSubjectConfirmations().add(delegatedConfirmation);
-
- WSSecurityContext wssContext = prc.getInboundMessageContext().getSubcontext(WSSecurityContext.class, true);
-
- SAML20AssertionToken dummyToken = new SAML20AssertionToken(dummyAssertion);
- dummyToken.setSubjectConfirmation(dummyConfirmation);
- dummyToken.setValidationStatus(ValidationStatus.INVALID);
- wssContext.getTokens().add(dummyToken);
-
- delegatedToken = new SAML20AssertionToken(delegatedAssertion);
- delegatedToken.setSubjectConfirmation(delegatedConfirmation);
- delegatedToken.setValidationStatus(ValidationStatus.VALID);
- wssContext.getTokens().add(delegatedToken);
-
- action = new PopulateLibertyContext();
- }
-
- @Test
- public void testDefaultTokenStrategySuccess() throws ComponentInitializationException {
- action.initialize();
-
- TokenStrategy strategy = action.new TokenStrategy();
- Assert.assertSame(strategy.apply(prc), delegatedToken);
- }
-
- @Test
- public void testDefaultTokenStrategyNullInput() throws ComponentInitializationException {
- action.initialize();
-
- TokenStrategy strategy = action.new TokenStrategy();
- Assert.assertNull(strategy.apply(null));
- }
-
- @Test
- public void testDefaultTokenStrategyNoWSSContext() throws ComponentInitializationException {
- action.initialize();
-
- prc.getInboundMessageContext().removeSubcontext(WSSecurityContext.class);
-
- TokenStrategy strategy = action.new TokenStrategy();
- Assert.assertNull(strategy.apply(prc));
- }
-
- @Test
- public void testDefaultTokenStrategyNoTokens() throws ComponentInitializationException {
- action.initialize();
-
- prc.getInboundMessageContext().getSubcontext(WSSecurityContext.class).getTokens().clear();
-
- TokenStrategy strategy = action.new TokenStrategy();
- Assert.assertNull(strategy.apply(prc));
- }
-
- @Test
- public void testSuccess() throws ComponentInitializationException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- LibertySSOSContext libertyContext = prc.getSubcontext(LibertySSOSContext.class);
- Assert.assertNotNull(libertyContext);
- Assert.assertNotNull(libertyContext.getAttestedToken());
- Assert.assertSame(libertyContext.getAttestedToken(), delegatedAssertion);
- Assert.assertNotNull(libertyContext.getAttestedSubjectConfirmationMethod());
- Assert.assertEquals(libertyContext.getAttestedSubjectConfirmationMethod(), delegatedConfirmationMethod);
- }
-
- @Test
- public void testNoResolvedAssertionToken() throws ComponentInitializationException {
- action.setAssertionTokenStrategy(FunctionSupport.constant(null));
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.NO_CREDENTIALS);
-
- LibertySSOSContext libertyContext = prc.getSubcontext(LibertySSOSContext.class);
- Assert.assertNull(libertyContext);
- }
-
- @Test
- public void testActivationCondition() throws ComponentInitializationException {
- //This would otherwise cause to fail
- action.setAssertionTokenStrategy(FunctionSupport.constant(null));
-
- action.setActivationCondition(Predicates.alwaysFalse());
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- LibertySSOSContext libertyContext = prc.getSubcontext(LibertySSOSContext.class);
- Assert.assertNull(libertyContext);
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateOutboundMessageContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateOutboundMessageContextTest.java
deleted file mode 100644
index e7967dc1d..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/PopulateOutboundMessageContextTest.java
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import java.time.Instant;
-
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.action.EventIds;
-import org.opensaml.profile.context.EventContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
-import org.opensaml.soap.wsaddressing.messaging.WSAddressingContext;
-import org.opensaml.soap.wssecurity.messaging.WSSecurityContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class PopulateOutboundMessageContextTest {
-
- private PopulateOutboundMessageContext action;
-
- private ProfileRequestContext prc;
-
- @BeforeMethod
- public void setUp() {
- prc = new ProfileRequestContext();
- prc.setInboundMessageContext(new MessageContext());
- prc.setOutboundMessageContext(new MessageContext());
-
- action = new PopulateOutboundMessageContext();
- }
-
- @Test
- public void testBasic() throws ComponentInitializationException {
- Instant now = Instant.now();
- prc.getInboundMessageContext().getSubcontext(WSAddressingContext.class, true).setMessageIDURI("urn:test:abc123");
- prc.getOutboundMessageContext().getSubcontext(SAMLMessageInfoContext.class, true).setMessageIssueInstant(now);
-
- action.initialize();
-
- action.execute(prc);
-
- Assert.assertEquals(prc.getOutboundMessageContext().getSubcontext(WSAddressingContext.class, true).getRelatesToURI(),
- "urn:test:abc123");
- Assert.assertSame(prc.getOutboundMessageContext().getSubcontext(WSSecurityContext.class, true).getTimestampCreated(),
- now);
- }
-
- @Test
- public void testNoInboundMessageID() throws ComponentInitializationException {
- Instant now = Instant.now();
- prc.getOutboundMessageContext().getSubcontext(SAMLMessageInfoContext.class, true).setMessageIssueInstant(now);
-
- action.initialize();
-
- action.execute(prc);
-
- Assert.assertNull(prc.getOutboundMessageContext().getSubcontext(WSAddressingContext.class, true).getRelatesToURI());
- Assert.assertSame(prc.getOutboundMessageContext().getSubcontext(WSSecurityContext.class, true).getTimestampCreated(),
- now);
- }
-
- @Test
- public void testNoSAMLMessageInfoContext() throws ComponentInitializationException {
- prc.getInboundMessageContext().getSubcontext(WSAddressingContext.class, true).setMessageIDURI("urn:test:abc123");
-
- action.initialize();
-
- action.execute(prc);
-
- Assert.assertEquals(prc.getOutboundMessageContext().getSubcontext(WSAddressingContext.class, true).getRelatesToURI(),
- "urn:test:abc123");
- Assert.assertNotNull(prc.getOutboundMessageContext().getSubcontext(WSSecurityContext.class, true).getTimestampCreated());
- }
-
- @Test
- public void testNoInboundContext() throws ComponentInitializationException {
- prc.setInboundMessageContext(null);
-
- action.initialize();
-
- action.execute(prc);
-
- Assert.assertEquals(prc.getSubcontext(EventContext.class).getEvent(), EventIds.INVALID_MSG_CTX);
- }
-
- @Test
- public void testNoOutboundContext() throws ComponentInitializationException {
- prc.setOutboundMessageContext(null);
-
- action.initialize();
-
- action.execute(prc);
-
- Assert.assertEquals(prc.getSubcontext(EventContext.class).getEvent(), EventIds.INVALID_MSG_CTX);
- }
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertionTest.java
deleted file mode 100644
index 8fab1d987..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/impl/ProcessDelegatedAssertionTest.java
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.profile.config.ProfileConfiguration;
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
-import net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration;
-import net.shibboleth.idp.saml.saml2.profile.SAML2ActionTestingSupport;
-import net.shibboleth.idp.saml.saml2.profile.delegation.LibertySSOSContext;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Response;
-import org.springframework.webflow.execution.Event;
-import org.springframework.webflow.execution.RequestContext;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-import com.google.common.base.Predicates;
-
-/**
- *
- */
-public class ProcessDelegatedAssertionTest extends OpenSAMLInitBaseTestCase {
-
- private ProcessDelegatedAssertion action;
-
- private RequestContext rc;
- private ProfileRequestContext prc;
-
- private SSOSProfileConfiguration ssosProfileConfig;
-
- private List<ProfileConfiguration> profileConfigs;
-
- private Assertion delegatedAssertion;
-
- @BeforeMethod
- public void setUp() throws ComponentInitializationException {
- Response response = SAML2ActionTestingSupport.buildResponse();
- response.getAssertions().add(SAML2ActionTestingSupport.buildAssertion());
-
- ssosProfileConfig = new SSOSProfileConfiguration();
- ssosProfileConfig.setDelegationPredicate(Predicates.<ProfileRequestContext>alwaysTrue());
-
-
- profileConfigs = new ArrayList<>();
- profileConfigs.add(ssosProfileConfig);
-
- rc = new RequestContextBuilder()
- .setInboundMessage(SAML2ActionTestingSupport.buildAuthnRequest())
- .setOutboundMessage(response)
- .setRelyingPartyProfileConfigurations(profileConfigs)
- .buildRequestContext();
- prc = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
-
- delegatedAssertion = SAML2ActionTestingSupport.buildAssertion();
- delegatedAssertion.setSubject(SAML2ActionTestingSupport.buildSubject("morpheus"));
-
- prc.getSubcontext(LibertySSOSContext.class, true).setAttestedToken(delegatedAssertion);
-
- action = new ProcessDelegatedAssertion();
- }
-
- @Test
- public void testSuccessWithSPNameQualifer() throws ComponentInitializationException {
- delegatedAssertion.getSubject().getNameID().setSPNameQualifier("https://portal.example.edu/saml");
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- SubjectCanonicalizationContext c14nContext = prc.getSubcontext(SubjectCanonicalizationContext.class);
- Assert.assertNotNull(c14nContext);
- Assert.assertNotNull(c14nContext.getSubject());
- Set<NameIDPrincipal> nameIdPrincipals = c14nContext.getSubject().getPrincipals(NameIDPrincipal.class);
- Assert.assertNotNull(nameIdPrincipals);
- Assert.assertEquals(nameIdPrincipals.size(), 1);
- Assert.assertSame(nameIdPrincipals.iterator().next().getNameID(), delegatedAssertion.getSubject().getNameID());
-
- Assert.assertEquals(c14nContext.getRequesterId(), "https://portal.example.edu/saml");
- Assert.assertEquals(c14nContext.getResponderId(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
- }
-
- @Test
- public void testSuccessWithSAMLPresenter() throws ComponentInitializationException {
- prc.getInboundMessageContext().getSubcontext(SAMLPresenterEntityContext.class, true).setEntityId("https://portal.example.edu/saml");
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- SubjectCanonicalizationContext c14nContext = prc.getSubcontext(SubjectCanonicalizationContext.class);
- Assert.assertNotNull(c14nContext);
- Assert.assertNotNull(c14nContext.getSubject());
- Set<NameIDPrincipal> nameIdPrincipals = c14nContext.getSubject().getPrincipals(NameIDPrincipal.class);
- Assert.assertNotNull(nameIdPrincipals);
- Assert.assertEquals(nameIdPrincipals.size(), 1);
- Assert.assertSame(nameIdPrincipals.iterator().next().getNameID(), delegatedAssertion.getSubject().getNameID());
-
- Assert.assertEquals(c14nContext.getRequesterId(), "https://portal.example.edu/saml");
- Assert.assertEquals(c14nContext.getResponderId(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
- }
-
- @Test
- public void testSuccessNoC14NRequester() throws ComponentInitializationException {
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertProceedEvent(result);
-
- SubjectCanonicalizationContext c14nContext = prc.getSubcontext(SubjectCanonicalizationContext.class);
- Assert.assertNotNull(c14nContext);
- Assert.assertNotNull(c14nContext.getSubject());
- Set<NameIDPrincipal> nameIdPrincipals = c14nContext.getSubject().getPrincipals(NameIDPrincipal.class);
- Assert.assertNotNull(nameIdPrincipals);
- Assert.assertEquals(nameIdPrincipals.size(), 1);
- Assert.assertSame(nameIdPrincipals.iterator().next().getNameID(), delegatedAssertion.getSubject().getNameID());
-
- Assert.assertNull(c14nContext.getRequesterId());
- Assert.assertEquals(c14nContext.getResponderId(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
- }
-
- @Test
- public void testNoAssertion() throws ComponentInitializationException {
- prc.removeSubcontext(LibertySSOSContext.class);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.NO_CREDENTIALS);
-
- SubjectCanonicalizationContext c14nContext = prc.getSubcontext(SubjectCanonicalizationContext.class);
- Assert.assertNull(c14nContext);
- }
-
- @Test
- public void testNoSubject() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).getAttestedToken().setSubject(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.INVALID_SUBJECT);
-
- SubjectCanonicalizationContext c14nContext = prc.getSubcontext(SubjectCanonicalizationContext.class);
- Assert.assertNull(c14nContext);
- }
-
- @Test
- public void testNoNameID() throws ComponentInitializationException {
- prc.getSubcontext(LibertySSOSContext.class).getAttestedToken().getSubject().setNameID(null);
-
- action.initialize();
- final Event result = action.execute(rc);
- ActionTestingSupport.assertEvent(result, AuthnEventIds.INVALID_SUBJECT);
-
- SubjectCanonicalizationContext c14nContext = prc.getSubcontext(SubjectCanonicalizationContext.class);
- Assert.assertNull(c14nContext);
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddFrameworkHandlerTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddFrameworkHandlerTest.java
deleted file mode 100644
index 60034a191..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddFrameworkHandlerTest.java
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.openliberty.xmltooling.soapbinding.Framework;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.opensaml.soap.testing.SOAPMessagingBaseTestCase;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class AddFrameworkHandlerTest extends SOAPMessagingBaseTestCase {
-
- private AddFrameworkHandler handler;
-
- @BeforeMethod
- protected void setUp() throws ComponentInitializationException {
- handler = new AddFrameworkHandler();
- }
-
- @Test
- public void testDefault() throws ComponentInitializationException, MessageHandlerException {
- handler.initialize();
- handler.invoke(getMessageContext());
-
-
- Assert.assertFalse(SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), Framework.DEFAULT_ELEMENT_NAME).isEmpty());
- Framework framework = (Framework) SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), Framework.DEFAULT_ELEMENT_NAME).get(0);
- Assert.assertEquals(framework.getVersion(), "2.0");
- }
-
- @Test
- public void testNonDefault() throws ComponentInitializationException, MessageHandlerException {
- handler.setVersion("2.5");
-
- handler.initialize();
- handler.invoke(getMessageContext());
-
-
- Assert.assertFalse(SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), Framework.DEFAULT_ELEMENT_NAME).isEmpty());
- Framework framework = (Framework) SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), Framework.DEFAULT_ELEMENT_NAME).get(0);
- Assert.assertEquals(framework.getVersion(), "2.5");
- }
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddSenderHandlerTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddSenderHandlerTest.java
deleted file mode 100644
index 42f1ec8b9..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/AddSenderHandlerTest.java
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.openliberty.xmltooling.soapbinding.Sender;
-import org.opensaml.messaging.context.BaseContext;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.messaging.context.SAMLSelfEntityContext;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.opensaml.soap.testing.SOAPMessagingBaseTestCase;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class AddSenderHandlerTest extends SOAPMessagingBaseTestCase {
-
- private AddSenderHandler handler;
-
- @BeforeMethod
- protected void setUp() throws ComponentInitializationException {
- handler = new AddSenderHandler();
- }
-
- @Test
- public void testInputPresentDefaultStrategy() throws ComponentInitializationException, MessageHandlerException {
- getMessageContext().getSubcontext(SAMLSelfEntityContext.class, true).setEntityId("urn:test:foo");
-
- handler.initialize();
- handler.invoke(getMessageContext());
-
-
- Assert.assertFalse(SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME).isEmpty());
- Sender sender = (Sender) SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME).get(0);
- Assert.assertEquals(sender.getProviderID(), "urn:test:foo");
- }
-
- @Test
- public void testNoInputDefaultStrategy() throws ComponentInitializationException, MessageHandlerException {
- handler.initialize();
- handler.invoke(getMessageContext());
-
-
- Assert.assertTrue(SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME).isEmpty());
- }
-
- @Test
- public void testInputPresentNonDefaultStrategy() throws ComponentInitializationException, MessageHandlerException {
- getMessageContext().getSubcontext(TestContext.class, true).value="urn:test:abc123";
-
- handler.setProviderIdLookupFunction(mc -> mc.getSubcontext(TestContext.class).value);
- handler.initialize();
- handler.invoke(getMessageContext());
-
-
- Assert.assertFalse(SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME).isEmpty());
- Sender sender = (Sender) SOAPMessagingSupport.getOutboundHeaderBlock(getMessageContext(), LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME).get(0);
- Assert.assertEquals(sender.getProviderID(), "urn:test:abc123");
- }
-
-
-
- public static class TestContext extends BaseContext {
- public String value;
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11DecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11DecoderTest.java
deleted file mode 100644
index 9a4a7e349..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11DecoderTest.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import net.shibboleth.utilities.java.support.xml.SerializeSupport;
-
-import org.opensaml.core.testing.XMLObjectBaseTestCase;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.io.MarshallingException;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.soap.messaging.context.SOAP11Context;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- * Test case for Liberty HTTP SOAP 1.1 decoder.
- */
-public class LibertyHTTPSOAP11DecoderTest extends XMLObjectBaseTestCase {
-
- private LibertyHTTPSOAP11Decoder decoder;
-
- private MockHttpServletRequest httpRequest;
-
- @BeforeMethod
- protected void setUp() throws Exception {
- httpRequest = new MockHttpServletRequest();
- httpRequest.setMethod("POST");
-
- decoder = new LibertyHTTPSOAP11Decoder();
- decoder.setParserPool(parserPool);
- decoder.setHttpServletRequest(httpRequest);
- decoder.initialize();
- }
-
- /**
- * Tests decoding a SOAP 1.1 message.
- *
- * @throws Exception if something goes wrong
- */
- @Test
- public void testDecoding() throws Exception {
- String requestContent = "<soap11:Envelope xmlns:soap11=\"http://schemas.xmlsoap.org/soap/envelope/\">"
- + "<soap11:Body><samlp:Response ID=\"foo\" IssueInstant=\"1970-01-01T00:00:00.000Z\" Version=\"2.0\" "
- + "xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\"><samlp:Status><samlp:StatusCode "
- + "Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status></samlp:Response>"
- + "</soap11:Body></soap11:Envelope>";
- httpRequest.setContent(requestContent.getBytes());
-
- decoder.decode();
- final MessageContext messageContext = decoder.getMessageContext();
-
- Assert.assertNotNull(messageContext.getSubcontext(SOAP11Context.class).getEnvelope());
- Assert.assertTrue(messageContext.getMessage() instanceof Response);
- }
-
- protected String encodeMessage(XMLObject message) throws MarshallingException {
- marshallerFactory.getMarshaller(message).marshall(message);
- return SerializeSupport.nodeToString(message.getDOM());
- }
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11EncoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11EncoderTest.java
deleted file mode 100644
index ac05d4754..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/LibertyHTTPSOAP11EncoderTest.java
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-
-import java.io.ByteArrayInputStream;
-import java.time.Instant;
-
-import org.opensaml.core.testing.XMLObjectBaseTestCase;
-import org.opensaml.core.xml.XMLObject;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.common.SAMLObjectBuilder;
-import org.opensaml.saml.common.SAMLVersion;
-import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.common.messaging.context.SAMLEndpointContext;
-import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.core.Status;
-import org.opensaml.saml.saml2.core.StatusCode;
-import org.opensaml.saml.saml2.metadata.AssertionConsumerService;
-import org.opensaml.saml.saml2.metadata.Endpoint;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.opensaml.soap.soap11.Envelope;
-import org.opensaml.soap.wsaddressing.Action;
-import org.springframework.mock.web.MockHttpServletResponse;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * Test for Liberty SAML 2 SOAP 1.1 message encoder.
- */
-public class LibertyHTTPSOAP11EncoderTest extends XMLObjectBaseTestCase {
-
- /**
- * Tests encoding a SAML message to an servlet response.
- *
- * @throws Exception if something goes wrong
- */
- @Test
- public void testResponseEncoding() throws Exception {
- SAMLObjectBuilder<StatusCode> statusCodeBuilder =
- (SAMLObjectBuilder<StatusCode>) builderFactory.<StatusCode>getBuilderOrThrow(
- StatusCode.DEFAULT_ELEMENT_NAME);
- StatusCode statusCode = statusCodeBuilder.buildObject();
- statusCode.setValue(StatusCode.SUCCESS);
-
- SAMLObjectBuilder<Status> statusBuilder =
- (SAMLObjectBuilder<Status>) builderFactory.<Status>getBuilderOrThrow(
- Status.DEFAULT_ELEMENT_NAME);
- Status responseStatus = statusBuilder.buildObject();
- responseStatus.setStatusCode(statusCode);
-
- SAMLObjectBuilder<Response> responseBuilder =
- (SAMLObjectBuilder<Response>) builderFactory.<Response>getBuilderOrThrow(
- Response.DEFAULT_ELEMENT_NAME);
- Response samlMessage = responseBuilder.buildObject();
- samlMessage.setID("foo");
- samlMessage.setVersion(SAMLVersion.VERSION_20);
- samlMessage.setIssueInstant(Instant.ofEpochMilli(0));
- samlMessage.setStatus(responseStatus);
-
- SAMLObjectBuilder<AssertionConsumerService> endpointBuilder =
- (SAMLObjectBuilder<AssertionConsumerService>) builderFactory.<AssertionConsumerService>getBuilderOrThrow(
- AssertionConsumerService.DEFAULT_ELEMENT_NAME);
- Endpoint samlEndpoint = endpointBuilder.buildObject();
- samlEndpoint.setLocation("http://example.org");
- samlEndpoint.setResponseLocation("http://example.org/response");
-
- final MessageContext messageContext = new MessageContext();
- messageContext.setMessage(samlMessage);
- SAMLBindingSupport.setRelayState(messageContext, "relay");
- messageContext.getSubcontext(SAMLPeerEntityContext.class, true)
- .getSubcontext(SAMLEndpointContext.class, true).setEndpoint(samlEndpoint);
-
- MockHttpServletResponse response = new MockHttpServletResponse();
-
- LibertyHTTPSOAP11Encoder encoder = new LibertyHTTPSOAP11Encoder();
- encoder.setMessageContext(messageContext);
- encoder.setHttpServletResponse(response);
-
- encoder.initialize();
- encoder.prepareContext();
-
- Action action = buildXMLObject(Action.ELEMENT_NAME);
- action.setURI(LibertyConstants.SSOS_RESPONSE_WSA_ACTION_URI);
- SOAPMessagingSupport.addHeaderBlock(messageContext, action);
-
- encoder.encode();
-
- Assert.assertEquals(response.getContentType(), "text/xml;charset=UTF-8", "Unexpected content type");
- Assert.assertEquals("UTF-8", response.getCharacterEncoding(), "Unexpected character encoding");
- Assert.assertEquals(response.getHeader("Cache-control"), "no-cache, no-store", "Unexpected cache controls");
- Assert.assertEquals(response.getHeader("SOAPAction"), LibertyConstants.SSOS_RESPONSE_WSA_ACTION_URI);
-
- try (ByteArrayInputStream inputStream = new ByteArrayInputStream(response.getContentAsByteArray())) {
- XMLObject xmlObject = XMLObjectSupport.unmarshallFromInputStream(parserPool, inputStream);
- Assert.assertNotNull(xmlObject);
- Assert.assertTrue(xmlObject instanceof Envelope);
- Envelope envelope = (Envelope) xmlObject;
- Assert.assertNotNull(envelope.getHeader());
- Assert.assertEquals(envelope.getHeader().getUnknownXMLObjects().size(), 1);
- Action outboundAction = (Action) envelope.getHeader().getUnknownXMLObjects().get(0);
- Assert.assertNotNull(outboundAction);
- Assert.assertNotNull(envelope.getBody());
- Assert.assertEquals(envelope.getBody().getUnknownXMLObjects().size(), 1);
- Response outboundResponse = (Response) envelope.getBody().getUnknownXMLObjects().get(0);
- outboundResponse.releaseDOM();
- outboundResponse.releaseChildrenDOM(true);
- outboundResponse.setParent(null);
- assertXMLEquals(XMLObjectSupport.marshall(outboundResponse).getOwnerDocument(), samlMessage);
- }
- }
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessFrameworkHandlerTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessFrameworkHandlerTest.java
deleted file mode 100644
index 3ad9f3090..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessFrameworkHandlerTest.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.openliberty.xmltooling.soapbinding.Framework;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.opensaml.soap.testing.SOAPMessagingBaseTestCase;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class ProcessFrameworkHandlerTest extends SOAPMessagingBaseTestCase {
-
- private ProcessFrameworkHandler handler;
-
- @BeforeMethod
- protected void setUp() throws ComponentInitializationException {
- handler = new ProcessFrameworkHandler();
- }
-
- @Test
- public void testDefaultExpected() throws ComponentInitializationException, MessageHandlerException {
- Framework framework = buildXMLObject(Framework.DEFAULT_ELEMENT_NAME);
- framework.setVersion("2.0");
- SOAPMessagingSupport.addHeaderBlock(getMessageContext(), framework);
-
- handler.initialize();
- handler.invoke(getMessageContext());
-
- Assert.assertTrue(SOAPMessagingSupport.checkUnderstoodHeader(getMessageContext(), framework));
- }
-
- @Test(expectedExceptions=MessageHandlerException.class)
- public void testDefaultUnexpected() throws ComponentInitializationException, MessageHandlerException {
- Framework framework = buildXMLObject(Framework.DEFAULT_ELEMENT_NAME);
- framework.setVersion("3.0");
- SOAPMessagingSupport.addHeaderBlock(getMessageContext(), framework);
-
- handler.initialize();
- handler.invoke(getMessageContext());
- }
-
- @Test
- public void testNonDefaultExpected() throws ComponentInitializationException, MessageHandlerException {
- Framework framework = buildXMLObject(Framework.DEFAULT_ELEMENT_NAME);
- framework.setVersion("3.0");
- SOAPMessagingSupport.addHeaderBlock(getMessageContext(), framework);
-
- handler.setExpectedVersion("3.0");
-
- handler.initialize();
- handler.invoke(getMessageContext());
-
- Assert.assertTrue(SOAPMessagingSupport.checkUnderstoodHeader(getMessageContext(), framework));
- }
-
- @Test(expectedExceptions=MessageHandlerException.class)
- public void testNonDefaultUnexpected() throws ComponentInitializationException, MessageHandlerException {
- Framework framework = buildXMLObject(Framework.DEFAULT_ELEMENT_NAME);
- framework.setVersion("3.0");
- SOAPMessagingSupport.addHeaderBlock(getMessageContext(), framework);
-
- handler.setExpectedVersion("2.5");
-
- handler.initialize();
- handler.invoke(getMessageContext());
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessSenderHandlerTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessSenderHandlerTest.java
deleted file mode 100644
index 44bbee77c..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/delegation/messaging/impl/ProcessSenderHandlerTest.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.saml2.profile.delegation.messaging.impl;
-
-import net.shibboleth.idp.saml.saml2.profile.delegation.impl.LibertyConstants;
-import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-
-import org.openliberty.xmltooling.soapbinding.Sender;
-import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext;
-import org.opensaml.soap.messaging.SOAPMessagingSupport;
-import org.opensaml.soap.testing.SOAPMessagingBaseTestCase;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- *
- */
-public class ProcessSenderHandlerTest extends SOAPMessagingBaseTestCase {
-
- private ProcessSenderHandler handler;
-
- @BeforeMethod
- protected void setUp() throws ComponentInitializationException {
- handler = new ProcessSenderHandler();
- }
-
- @Test
- public void testHeaderPresent() throws ComponentInitializationException, MessageHandlerException {
- Sender sender = buildXMLObject(LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME);
- sender.setProviderID("urn:test:foo");
- SOAPMessagingSupport.addHeaderBlock(getMessageContext(), sender);
-
- handler.initialize();
- handler.invoke(getMessageContext());
-
- Assert.assertEquals(getMessageContext().getSubcontext(SAMLPresenterEntityContext.class, true).getEntityId(), "urn:test:foo");
-
- Assert.assertTrue(SOAPMessagingSupport.checkUnderstoodHeader(getMessageContext(), sender));
- }
-
- @Test
- public void testHeaderNotPresent() throws ComponentInitializationException, MessageHandlerException {
- handler.initialize();
- handler.invoke(getMessageContext());
-
- Assert.assertNull(getMessageContext().getSubcontext(SAMLPresenterEntityContext.class, true).getEntityId());
- }
-
- @Test
- public void testHeaderEmptyValue() throws ComponentInitializationException, MessageHandlerException {
- Sender sender = buildXMLObject(LibertyConstants.SOAP_BINDING_SENDER_ELEMENT_NAME);
- sender.setProviderID(" ");
- SOAPMessagingSupport.addHeaderBlock(getMessageContext(), sender);
-
- handler.initialize();
- handler.invoke(getMessageContext());
-
- Assert.assertNull(getMessageContext().getSubcontext(SAMLPresenterEntityContext.class, true).getEntityId());
-
- Assert.assertFalse(SOAPMessagingSupport.checkUnderstoodHeader(getMessageContext(), sender));
- }
-
-}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyTest.java
deleted file mode 100644
index cfc54252b..000000000
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/DelegationPolicyTest.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.xmlobject.impl;
-
-import net.shibboleth.idp.saml.xmlobject.DelegationPolicy;
-
-import org.opensaml.core.testing.XMLObjectProviderBaseTestCase;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
-/**
- * Testing shibdel:DelegationPolicy extension.
- */
-public class DelegationPolicyTest extends XMLObjectProviderBaseTestCase {
-
- private Long expectedMaxChainLength;
-
- /** Constructor. */
- public DelegationPolicyTest() {
- singleElementFile = "/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicy.xml";
- singleElementOptionalAttributesFile = "/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicyOptionalAttributes.xml";
- }
-
- @BeforeMethod
- protected void setUp() throws Exception {
- expectedMaxChainLength = 5L;
- }
-
- /** {@inheritDoc} */
- @Test
- public void testSingleElementMarshall() {
- DelegationPolicy delegationPolicy = (DelegationPolicy) buildXMLObject(DelegationPolicy.DEFAULT_ELEMENT_NAME);
-
- assertXMLEquals(expectedDOM, delegationPolicy);
- }
-
- @Test
- public void testSingleElementUnmarshall() {
- DelegationPolicy delegationPolicy = (DelegationPolicy) unmarshallElement(singleElementFile);
-
- Assert.assertNotNull(delegationPolicy, "Unmarshalled object was null");
- Assert.assertNull(delegationPolicy.getMaximumTokenDelegationChainLength(), "MaximumTokenDelegationChainLength attribute value");
- }
-
- /** {@inheritDoc} */
- @Test
- public void testSingleElementOptionalAttributesMarshall() {
- DelegationPolicy delegationPolicy = (DelegationPolicy) buildXMLObject(DelegationPolicy.DEFAULT_ELEMENT_NAME);
-
- delegationPolicy.setMaximumTokenDelegationChainLength(expectedMaxChainLength);
-
- assertXMLEquals(expectedOptionalAttributesDOM, delegationPolicy);
- }
-
- @Test
- public void testSingleElementOptionalAttributesUnmarshall() {
- DelegationPolicy delegationPolicy = (DelegationPolicy) unmarshallElement(singleElementOptionalAttributesFile);
-
- Assert.assertNotNull(delegationPolicy, "Unmarshalled object was null");
- Assert.assertEquals(delegationPolicy.getMaximumTokenDelegationChainLength(), expectedMaxChainLength,
- "VerifyDepth attribute value");
- }
-
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicy.xml b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicy.xml
deleted file mode 100644
index dcec67741..000000000
--- a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicy.xml
+++ /dev/null
@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<shibdel:DelegationPolicy xmlns:shibdel="urn:mace:shibboleth:delegation:1.0"/>
diff --git a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicyOptionalAttributes.xml b/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicyOptionalAttributes.xml
deleted file mode 100644
index 81afd0057..000000000
--- a/idp-saml-impl/src/test/resources/net/shibboleth/idp/saml/impl/xmlobject/ShibDelegationPolicyOptionalAttributes.xml
+++ /dev/null
@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<shibdel:DelegationPolicy xmlns:shibdel="urn:mace:shibboleth:delegation:1.0" MaximumTokenDelegationChainLength="5" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list