Package org.opensaml.saml.common.binding

Class SAMLBindingSupport

java.lang.Object
org.opensaml.saml.common.binding.SAMLBindingSupport
public final class SAMLBindingSupport extends Object
A support class for SAML binding operations.

  • Field Details

    • LOG

      @Nonnull private static final org.slf4j.Logger LOG
      Logger.

  • Constructor Details

    • SAMLBindingSupport

      private SAMLBindingSupport()
      Constructor.

  • Method Details

    • getRelayState

      @Nullable @NotEmpty public static String getRelayState(@Nonnull MessageContext messageContext)
      Get the SAML protocol relay state from a message context.
      Parameters:
      messageContext - the message context on which to operate
      Returns:
      the relay state or null

    • setRelayState

      public static void setRelayState(@Nonnull MessageContext messageContext, @Nullable String relayState)
      Set the SAML protocol relay state on a message context.
      Parameters:
      messageContext - the message context on which to operate
      relayState - the relay state to set

    • checkRelayState

      public static boolean checkRelayState(@Nullable String relayState)
      Checks that the relay state is 80 bytes or less if it is not null.
      Parameters:
      relayState - relay state to check
      Returns:
      true if the relay state is not empty and is less than 80 bytes

    • getEndpointURLOrNull

      @Nullable public static URI getEndpointURLOrNull(@Nonnull MessageContext messageContext)
      Get the response URL from the relying party endpoint. If the SAML message is a response and the relying party endpoint contains a response location then that location is returned otherwise the normal endpoint location is returned.

      Instead of raising an exception, this variant returns null in the event of an inability to identify a URL to return.

      Parameters:
      messageContext - current message context
      Returns:
      response URL from the relying party endpoint or null
      Since:
      5.2.0

    • getEndpointURL

      @Nonnull public static URI getEndpointURL(@Nonnull MessageContext messageContext) throws BindingException
      Get the response URL from the relying party endpoint. If the SAML message is a response and the relying party endpoint contains a response location then that location is returned otherwise the normal endpoint location is returned.
      Parameters:
      messageContext - current message context
      Returns:
      response URL from the relying party endpoint
      Throws:
      BindingException - throw if no relying party endpoint is available

    • setSAML1ResponseRecipient

      public static void setSAML1ResponseRecipient(@Nonnull SAMLObject outboundMessage, @Nonnull @NotEmpty String endpointURL)
      Sets the destination attribute on the outbound message if it is a ResponseAbstractType message.
      Parameters:
      outboundMessage - outbound SAML message
      endpointURL - destination endpoint

    • setSAML2Destination

      public static void setSAML2Destination(@Nonnull SAMLObject outboundMessage, @Nonnull @NotEmpty String endpointURL)
      Sets the destination attribute on an outbound message if it is either a RequestAbstractType or a StatusResponseType message.
      Parameters:
      outboundMessage - outbound SAML message
      endpointURL - destination endpoint

    • isMessageSigned

      public static boolean isMessageSigned(@Nonnull MessageContext messageContext)
      Determine whether the SAML message represented by the message context is digitally signed.

      First the SAML protocol message is examined as to whether an XML signature is present at the DOM level; if yes return true. Finally, the presence of a binding signature is evaluated by looking at SAMLBindingContext.hasBindingSignature().

      Parameters:
      messageContext - current message context
      Returns:
      true if the message is considered to be digitally signed, false otherwise

    • isMessageSigned

      public static boolean isMessageSigned(@Nonnull MessageContext messageContext, boolean presenceSatisfies)
      Determine whether the SAML message represented by the message context is digitally signed.

      First the SAML protocol message is examined as to whether an XML signature is present at the DOM level; if yes return true. Next if presenceSatisfies is true, then SignableXMLObject.getSignature() is evaluated for a non-null value; if yes return true. Finally, the presence of a binding signature is evaluated by looking at SAMLBindingContext.hasBindingSignature().

      Parameters:
      messageContext - current message context
      presenceSatisfies - whether the presence of a non-null Signature member satisfies the evaluation
      Returns:
      true if the message is considered to be digitally signed, false otherwise

    • isSigningCapableBinding

      public static boolean isSigningCapableBinding(@Nonnull MessageContext messageContext)
      Determine whether the SAML binding to be used by the message context supports signatures at the binding layer.

      The capability of the binding is determined by extracting a BindingDescriptor from a SAMLBindingContext.

      Parameters:
      messageContext - current message context
      Returns:
      true if the message is considered to be digitally signed, false otherwise

    • isIntendedDestinationEndpointURIRequired

      public static boolean isIntendedDestinationEndpointURIRequired(@Nonnull MessageContext messageContext)
      Determine whether the binding in use requires the presence within the message of information indicating the intended message destination endpoint URI.
      Parameters:
      messageContext - current SAML message context
      Returns:
      true if the intended message destination endpoint is required, false if not

    • getIntendedDestinationEndpointURI

      @Nullable public static String getIntendedDestinationEndpointURI(@Nonnull MessageContext messageContext) throws MessageException
      Extract the message information which indicates to what receiver endpoint URI the SAML message was intended to be delivered.
      Parameters:
      messageContext - the SAML message context being processed
      Returns:
      the value of the intended destination endpoint URI, or null if not present or empty
      Throws:
      MessageException - thrown if the message is not an instance of SAML message that could be processed by the decoder

    • getActualReceiverEndpointURI

      @Nonnull public static String getActualReceiverEndpointURI(@Nonnull MessageContext messageContext, @Nonnull HttpServletRequest request) throws MessageException
      Extract the transport endpoint URI at which this message was received.
      Parameters:
      messageContext - current message context
      request - the HttpServletRequest being evaluated
      Returns:
      string representing the transport endpoint URI at which the current message was received
      Throws:
      MessageException - thrown if the endpoint can not be looked up from the message context and converted to a string representation

    • getActualReceiverEndpointURI

      @Nullable public static String getActualReceiverEndpointURI(@Nonnull MessageContext messageContext) throws MessageException
      Extract the transport endpoint URI at which this message was received.
      Parameters:
      messageContext - current message context
      Returns:
      string representing the transport endpoint URI at which the current message was received
      Throws:
      MessageException - thrown if the endpoint can not be looked up from the message context and converted to a string representation
      Since:
      5.2.0

    • convertSAML2ArtifactEndpointIndex

      public static int convertSAML2ArtifactEndpointIndex(@Nonnull byte[] artifactEndpointIndex)
      Convert a 2-byte artifact endpoint index byte[] as typically used by SAML 2 artifact types to an integer, appropriate for use with IndexedEndpoint impls.

      The max input value supported is 0x7FFF (32767), which is the largest possible unsigned 16 bit value. This should be more than sufficient for typical SAML cases.

      Parameters:
      artifactEndpointIndex - the endpoint index byte array, must have length == 2, and big endian byte order.
      Returns:
      the convert integer value

    • checkSAML1MessageType

      public static void checkSAML1MessageType(boolean expectRequest, @Nonnull SAMLObject message) throws MessageDecodingException
      Evaluate a SAML 1 message SAMLObject as to whether it is the expected message type (request vs response).
      Parameters:
      expectRequest - true if a SAML 1 request is expected (an instance of RequestAbstractType, false if a SAML 1 response is expected (an instance of ResponseAbstractType
      message - the message to evaluate
      Throws:
      MessageDecodingException - if the message being evaluated is not the expected type

    • checkSAML2MessageType

      public static void checkSAML2MessageType(boolean expectRequest, @Nonnull SAMLObject message) throws MessageDecodingException
      Evaluate a SAML 2 message SAMLObject as to whether it is the expected message type (request vs response).
      Parameters:
      expectRequest - true if a SAML 2 request is expected (an instance of RequestAbstractType, false if a SAML 2 response is expected (an instance of ResponseAbstractType
      message - the message to evaluate
      Throws:
      MessageDecodingException - if the message being evaluated is not the expected type

    • getMessageType

      @Nullable public static MessageType getMessageType(@Nonnull HttpServletRequest httpRequest)
      Get the type of message being processed.
      Parameters:
      httpRequest - the HTTP request
      Returns:
      the message type, or null if the HTTP request is malformed with respect to SAML message parameters

    • validateMessageTypeValues

      public static void validateMessageTypeValues(@Nonnull HttpServletRequest httpRequest, @Nonnull MessageType messageType) throws MessageDecodingException
      Validate that an HTTP request has a valid number of values for the specified message type.
      Parameters:
      httpRequest - the HTTP request
      messageType - the message type
      Throws:
      MessageDecodingException - if the HTTP request has an invalid number of values for the specified message type

    • evaluateMessageSizeLimit

      public static void evaluateMessageSizeLimit(boolean enforcementEnabled, @Nullable Integer messageSizeLimit, @Nullable Integer messageSize) throws MessageDecodingException
      Evaluate message size limit using the supplied parameters.
      Parameters:
      enforcementEnabled - whether enforcement of message size limit is enabled
      messageSizeLimit - the message size limit
      messageSize - the received message size
      Throws:
      MessageDecodingException - if evaluation is enabled and either 1) message size exceeds the limit or 2) the message size or limit is null

    • evaluateMessageSizeLimit

      public static void evaluateMessageSizeLimit(boolean enforcementEnabled, @Nullable Integer messageSizeLimit, @Nullable Integer messageSize, @Nullable String description) throws MessageDecodingException
      Evaluate message size limit using the supplied parameters.
      Parameters:
      enforcementEnabled - whether enforcement of message size limit is enabled
      messageSizeLimit - the message size limit
      messageSize - the received message size
      description - description of what is being evaluated
      Throws:
      MessageDecodingException - if evaluation is enabled and either 1) message size exceeds the limit or 2) the message size or limit is null

    • getBase64Size

      @Nonnull public static Integer getBase64Size(@Nullable String encoded)
      Efficiently get the size of Base64-encoded data if it were decoded.
      Parameters:
      encoded - the Base64-encoded data
      Returns:
      the size of the data when decoded, in bytes

    • getDeflatedSize

      @Nonnull public static Integer getDeflatedSize(@Nullable String deflatedAndEncoded, boolean estimated, @Nullable Float inflationFactor) throws MessageDecodingException
      Get the size of deflated and Base64-encoded data if it were decoded then inflated.

      If estimated is true, then the size is estimated efficiently by simply applying the specified inflationFactor against the result of getBase64Size(String). This is very fast but the accuracy will depend entirely on the inflationFactor that is used, so it must be chosen based on knowledge of the compressibility of the data.

      If estimated is false, then the encoded data is actually Base64-decoded and then inflated and the size is the length of the resulting byte[]. This is computationally more expensive, but will give an exact size.

      Parameters:
      deflatedAndEncoded - the deflated and Base64-encoded data
      estimated - flag indicating whether an exact or an estimated value should be determined
      inflationFactor - for estimated mode the multiplier applied against the Base64-decoded size. Should be greater than 1.0
      Returns:
      the size of the data when Base64-decoded and inflated, in bytes
      Throws:
      MessageDecodingException - if estimated was true and inflationFactor is null, or if there was a fatal error during Base64-decoding or inflation