Opensaml 2.6.0 : Validating signature of a Response
Yann Bourdeau
ybourdeau at mnubo.com
Fri Jan 24 09:17:04 EST 2014
Hi!
I have a hard time figuring out how to validate the signature of a response for SSO. From what i have found on the net and the documentation i need to use a TrustEngine and a File MetaData Provider that will contains the the x.509 certificate to validate agains it. Each time, that i try to initialize the Mete Data Provider, i got a Java.lang.NullPointerException (Later Unable to marshall metadata).
Anyway here is my code:
String responseMessage = getContext().getRequest().getParameter("SAMLResponse").toString();
DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
documentBuilderFactory.setNamespaceAware(true);
DocumentBuilder docBuilder = documentBuilderFactory.newDocumentBuilder();
byte[] encodedRequestMessage = Base64.decode( responseMessage );
ByteArrayInputStream is=new ByteArrayInputStream(new String(encodedRequestMessage, "UTF-8").getBytes());
Document document = docBuilder.parse(is);
Element element = document.getDocumentElement();
UnmarshallerFactory unmarshallerFactory = Configuration.getUnmarshallerFactory();
Unmarshaller unmarshaller = unmarshallerFactory.getUnmarshaller(element);
Response response = (Response) unmarshaller.unmarshall(element);
// INIT ONCE
FilesystemMetadataProvider idpMetaDataProvider = new FilesystemMetadataProvider(new File("/Volumes/Éléphant/apache/apache-tomcat-7.0.47/webapps/panelo/WEB-INF/classes/opensamlmetadata.xml"));
idpMetaDataProvider.initialize();
MetadataProvider mdProvider = idpMetaDataProvider;
MetadataCredentialResolver mdCredResolver = new MetadataCredentialResolver(mdProvider);
KeyInfoCredentialResolver keyInfoCredResolver =
Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver();
ExplicitKeySignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(mdCredResolver, keyInfoCredResolver);
//INIT ONCE
SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();;
profileValidator.validate(response.getSignature());
CriteriaSet criteriaSet = new CriteriaSet();
criteriaSet.add( new EntityIDCriteria(response.getIssuer().getValue()) );
criteriaSet.add( new MetadataCriteria(IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS) );
criteriaSet.add( new UsageCriteria(UsageType.SIGNING) );
if (!trustEngine.validate(response.getSignature(), criteriaSet))
{
throw new Exception("Signature was either invalid or signing key could not be established as trusted");
}
Here is my meta data file:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<EntityDescriptor xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://wso2identity:9443/samlsso">
<IDPSSODescriptor
WantAuthnRequestsSigned="false"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTousMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44iQlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJRO4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<!-- Supported Name Identifier Formats -->
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
<!-- AuthenticationRequest Consumer endpoint -->
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://wso2identity:9443/samlsso"
index="0"
isDefault="true"
/>
</IDPSSODescriptor>
</EntityDescriptor>
Here is the stack trace:
org.opensaml.saml2.metadata.provider.MetadataProviderException: Unable to unmarshall metadata
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.unmarshallMetadata(AbstractReloadingMetadataProvider.java:308)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:345)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:236)
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
com.mnubo.panelo.LoginActionBean.log(LoginActionBean.java:302)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
net.sourceforge.stripes.controller.DispatcherHelper$6.intercept(DispatcherHelper.java:456)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:158)
org.stripesstuff.plugin.security.SecurityInterceptor.interceptEventHandling(SecurityInterceptor.java:196)
org.stripesstuff.plugin.security.SecurityInterceptor.intercept(SecurityInterceptor.java:126)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
com.mnubo.panelo.interceptor.EventHandlerInterceptor.intercept(EventHandlerInterceptor.java:26)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.BeforeAfterMethodInterceptor.intercept(BeforeAfterMethodInterceptor.java:113)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.ExecutionContext.wrap(ExecutionContext.java:74)
net.sourceforge.stripes.controller.DispatcherHelper.invokeEventHandler(DispatcherHelper.java:454)
net.sourceforge.stripes.controller.DispatcherServlet.invokeEventHandler(DispatcherServlet.java:278)
net.sourceforge.stripes.controller.DispatcherServlet.service(DispatcherServlet.java:160)
javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
net.sourceforge.stripes.controller.StripesFilter.doFilter(StripesFilter.java:260)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
cause mère
org.opensaml.xml.io.UnmarshallingException: java.lang.NullPointerException
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.unmarshallMetadata(AbstractMetadataProvider.java:473)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.unmarshallMetadata(AbstractReloadingMetadataProvider.java:304)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:345)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:236)
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
com.mnubo.panelo.LoginActionBean.log(LoginActionBean.java:302)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
net.sourceforge.stripes.controller.DispatcherHelper$6.intercept(DispatcherHelper.java:456)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:158)
org.stripesstuff.plugin.security.SecurityInterceptor.interceptEventHandling(SecurityInterceptor.java:196)
org.stripesstuff.plugin.security.SecurityInterceptor.intercept(SecurityInterceptor.java:126)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
com.mnubo.panelo.interceptor.EventHandlerInterceptor.intercept(EventHandlerInterceptor.java:26)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.BeforeAfterMethodInterceptor.intercept(BeforeAfterMethodInterceptor.java:113)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.ExecutionContext.wrap(ExecutionContext.java:74)
net.sourceforge.stripes.controller.DispatcherHelper.invokeEventHandler(DispatcherHelper.java:454)
net.sourceforge.stripes.controller.DispatcherServlet.invokeEventHandler(DispatcherServlet.java:278)
net.sourceforge.stripes.controller.DispatcherServlet.service(DispatcherServlet.java:160)
javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
net.sourceforge.stripes.controller.StripesFilter.doFilter(StripesFilter.java:260)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
cause mère
java.lang.NullPointerException
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.unmarshallMetadata(AbstractMetadataProvider.java:460)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.unmarshallMetadata(AbstractReloadingMetadataProvider.java:304)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.processNewMetadata(AbstractReloadingMetadataProvider.java:345)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.refresh(AbstractReloadingMetadataProvider.java:261)
org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.doInitialization(AbstractReloadingMetadataProvider.java:236)
org.opensaml.saml2.metadata.provider.AbstractMetadataProvider.initialize(AbstractMetadataProvider.java:407)
com.mnubo.panelo.LoginActionBean.log(LoginActionBean.java:302)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
net.sourceforge.stripes.controller.DispatcherHelper$6.intercept(DispatcherHelper.java:456)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:158)
org.stripesstuff.plugin.security.SecurityInterceptor.interceptEventHandling(SecurityInterceptor.java:196)
org.stripesstuff.plugin.security.SecurityInterceptor.intercept(SecurityInterceptor.java:126)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
com.mnubo.panelo.interceptor.EventHandlerInterceptor.intercept(EventHandlerInterceptor.java:26)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.BeforeAfterMethodInterceptor.intercept(BeforeAfterMethodInterceptor.java:113)
net.sourceforge.stripes.controller.ExecutionContext.proceed(ExecutionContext.java:155)
net.sourceforge.stripes.controller.ExecutionContext.wrap(ExecutionContext.java:74)
net.sourceforge.stripes.controller.DispatcherHelper.invokeEventHandler(DispatcherHelper.java:454)
net.sourceforge.stripes.controller.DispatcherServlet.invokeEventHandler(DispatcherServlet.java:278)
net.sourceforge.stripes.controller.DispatcherServlet.service(DispatcherServlet.java:160)
javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
net.sourceforge.stripes.controller.StripesFilter.doFilter(StripesFilter.java:260)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
note La trace complète de la cause mère de cette erreur est disponible dans les fichiers journaux de Apache Tomcat/7.0.
If anyone could help, it would be appreciated. The archive of the mailing list is not working so i was not able to see if the same question has been raised before.
Thanks in advance.
Yann Bourdeau
--
CONFIDENTIALITY: This e-mail message (including attachments, if any) is
confidential and is intended only for the addressee. Any unauthorized use
or disclosure is strictly prohibited. Disclosure of this e-mail to anyone
other than the intended addressee does not constitute waiver of privilege.
If you have received this communication in error, please notify us
immediately and delete this. Thank you for your cooperation. This message
has not been encrypted. Special arrangements can be made for encryption
upon request.
CONFIDENTIALITÉ: Ce message courriel (y compris les pièces jointes, le cas
échéant) est confidentiel et destiné uniquement à la personne ou à
l'entité à qui il est adressé. Toute utilisation ou divulgation non permise
est strictement interdite. L'obligation de confidentialité et de secret
professionnel demeure malgré toute divulgation. Si vous avez reçu le
présent courriel et ses annexes par erreur, veuillez nous en informer
immédiatement et le détruire. Nous vous remercions de votre
collaboration. Le présent message n'a pas été crypté. Le cryptage est
possible sur demande spéciale.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140124/db9dd837/attachment-0001.html
More information about the dev
mailing list