org.keycloak.saml.common.constants.JBossSAMLURIConstants Java Examples

The following examples show how to use org.keycloak.saml.common.constants.JBossSAMLURIConstants. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example #1

Source File: BaseSAML2BindingBuilder.java From keycloak with Apache License 2.0

6 votes

public void signAssertion(Document samlDocument) throws ProcessingException {
    Element originalAssertionElement = org.keycloak.saml.common.util.DocumentUtil.getChildElement(samlDocument.getDocumentElement(), new QName(JBossSAMLURIConstants.ASSERTION_NSURI.get(), JBossSAMLConstants.ASSERTION.get()));
    if (originalAssertionElement == null) return;
    Node clonedAssertionElement = originalAssertionElement.cloneNode(true);
    Document temporaryDocument;

    try {
        temporaryDocument = org.keycloak.saml.common.util.DocumentUtil.createDocument();
    } catch (ConfigurationException e) {
        throw new ProcessingException(e);
    }

    temporaryDocument.adoptNode(clonedAssertionElement);
    temporaryDocument.appendChild(clonedAssertionElement);

    signDocument(temporaryDocument);

    samlDocument.adoptNode(clonedAssertionElement);

    Element parentNode = (Element) originalAssertionElement.getParentNode();

    parentNode.replaceChild(clonedAssertionElement, originalAssertionElement);
}

Example #2

Source File: RoleMapperTest.java From keycloak with Apache License 2.0

6 votes

public void testExpectedRoles(String clientId, String... expectedRoles) {
    SAMLDocumentHolder document = new SamlClientBuilder()
      .authnRequest(getAuthServerSamlEndpoint(REALM_NAME), clientId, SAML_ASSERTION_CONSUMER_URL_EMPLOYEE_2, Binding.POST).build()
      .login().user(bburkeUser).build()
      .getSamlResponse(Binding.POST);

    assertThat(document.getSamlObject(), Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));

    Stream<AssertionType> assertions = assertionsUnencrypted(document.getSamlObject());
    Stream<AttributeType> attributes = attributesUnecrypted(attributeStatements(assertions));
    Set<String> roles = attributes
      .filter(a -> a.getName().equals(ROLE_ATTRIBUTE_NAME))
      .flatMap(a -> a.getAttributeValue().stream())
      .map(Object::toString)
      .collect(Collectors.toSet());

    assertThat(roles, containsInAnyOrder(expectedRoles));
}

Example #3

Source File: IdpInitiatedLoginTest.java From keycloak with Apache License 2.0

6 votes

@Test
public void testIdpInitiatedLoginPostAdminUrl() throws IOException {
    String url = adminClient.realm(REALM_NAME).clients().findByClientId(SAML_CLIENT_ID_SALES_POST).get(0)
            .getAttributes().get(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE);
    try (Closeable c = ClientAttributeUpdater.forClient(adminClient, REALM_NAME, SAML_CLIENT_ID_SALES_POST)
            .setAdminUrl(url)
            .setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, null)
            .setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, null)
            .update()) {
        new SamlClientBuilder()
                .idpInitiatedLogin(getAuthServerSamlEndpoint(REALM_NAME), "sales-post").build()
                .login().user(bburkeUser).build()
                .processSamlResponse(Binding.POST)
                .transformObject(ob -> {
                    assertThat(ob, Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
                    ResponseType resp = (ResponseType) ob;
                    assertThat(resp.getDestination(), is(SAML_ASSERTION_CONSUMER_URL_SALES_POST));
                    return null;
                })
                .build()
                .execute();
    }
}

Example #4

Source File: IdpInitiatedLoginTest.java From keycloak with Apache License 2.0

6 votes

@Test
public void testIdpInitiatedLoginPost() {
    new SamlClientBuilder()
      .idpInitiatedLogin(getAuthServerSamlEndpoint(REALM_NAME), "sales-post").build()
      .login().user(bburkeUser).build()
      .processSamlResponse(Binding.POST)
        .transformObject(ob -> {
          assertThat(ob, Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
          ResponseType resp = (ResponseType) ob;
          assertThat(resp.getDestination(), is(SAML_ASSERTION_CONSUMER_URL_SALES_POST));
          return null;
        })
        .build()
      .execute()
    ;
}

Example #5

Source File: IdpInitiatedLoginTest.java From keycloak with Apache License 2.0

6 votes

@Test
public void testIdpInitiatedLoginRedirect() throws IOException {
    String url = adminClient.realm(REALM_NAME).clients().findByClientId(SAML_CLIENT_ID_SALES_POST).get(0)
            .getAttributes().get(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE);
    try (Closeable c = ClientAttributeUpdater.forClient(adminClient, REALM_NAME, SAML_CLIENT_ID_SALES_POST)
            .setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_POST_ATTRIBUTE, null)
            .setAttribute(SamlProtocol.SAML_ASSERTION_CONSUMER_URL_REDIRECT_ATTRIBUTE, url)
            .update()) {
        new SamlClientBuilder()
                .idpInitiatedLogin(getAuthServerSamlEndpoint(REALM_NAME), "sales-post").build()
                .login().user(bburkeUser).build()
                .processSamlResponse(Binding.REDIRECT)
                .transformObject(ob -> {
                    assertThat(ob, Matchers.isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
                    ResponseType resp = (ResponseType) ob;
                    assertThat(resp.getDestination(), is(SAML_ASSERTION_CONSUMER_URL_SALES_POST));
                    return null;
                })
                .build()
                .execute();
    }
}

Example #6

Source File: SamlRedirectBindingTest.java From keycloak with Apache License 2.0

6 votes

@Test
public void testQueryParametersInSamlProcessingUriRedirectWithSignature() throws Exception {
    SamlClient samlClient = new SamlClientBuilder()
            .authnRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_SALES_POST_SIG,
                    SAML_ASSERTION_CONSUMER_URL_SALES_POST_SIG + "?param1=value1&param2=value2",
                    Binding.REDIRECT)
            .signWith(SAML_CLIENT_SALES_POST_SIG_PRIVATE_KEY, SAML_CLIENT_SALES_POST_SIG_PUBLIC_KEY)
            .build()
            .login().user(bburkeUser).build().doNotFollowRedirects()
            .execute(hr -> {
                try {
                    // obtain the document validating the signature (it should be valid)
                    SAMLDocumentHolder doc = Binding.REDIRECT.extractResponse(hr, REALM_PUBLIC_KEY);
                    // assert doc is OK and the destination really has the extra parameters
                    assertThat(doc.getSamlObject(), isSamlStatusResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
                    assertThat(doc.getSamlObject(), instanceOf(ResponseType.class));
                    ResponseType res = (ResponseType) doc.getSamlObject();
                    assertThat(res.getDestination(), is(SAML_ASSERTION_CONSUMER_URL_SALES_POST_SIG + "?param1=value1&param2=value2"));
                } catch (IOException e) {
                    throw new IllegalStateException(e);
                }
            });
}

Example #7

Source File: SAML11ParserUtil.java From keycloak with Apache License 2.0

6 votes

/**
 * Parse Attribute value
 *
 * @param xmlEventReader
 *
 * @return
 *
 * @throws ParsingException
 */
public static Object parseAttributeValue(XMLEventReader xmlEventReader) throws ParsingException {
    StartElement startElement = StaxParserUtil.getNextStartElement(xmlEventReader);
    StaxParserUtil.validate(startElement, JBossSAMLConstants.ATTRIBUTE_VALUE.get());

    Attribute type = startElement.getAttributeByName(new QName(JBossSAMLURIConstants.XSI_NSURI.get(), "type", "xsi"));
    if (type == null) {
        return StaxParserUtil.getElementText(xmlEventReader);
    }

    String typeValue = StaxParserUtil.getAttributeValue(type);
    if (typeValue.contains(":string")) {
        return StaxParserUtil.getElementText(xmlEventReader);
    }

    throw logger.parserUnknownXSI(typeValue);
}

Example #8

Source File: SamlProtocol.java From keycloak with Apache License 2.0

6 votes

protected String getNameId(String nameIdFormat, CommonClientSessionModel clientSession, UserSessionModel userSession) {
    if (nameIdFormat.equals(JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.get())) {
        final String email = userSession.getUser().getEmail();
        if (email == null) {
            logger.debugf("E-mail of the user %s has to be set for %s NameIDFormat", userSession.getUser().getUsername(), JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.get());
        }
        return email;
    } else if (nameIdFormat.equals(JBossSAMLURIConstants.NAMEID_FORMAT_TRANSIENT.get())) {
        // "G-" stands for "generated" Add this for the slight possibility of collisions.
        return "G-" + UUID.randomUUID().toString();
    } else if (nameIdFormat.equals(JBossSAMLURIConstants.NAMEID_FORMAT_PERSISTENT.get())) {
        return getPersistentNameId(clientSession, userSession);
    } else if (nameIdFormat.equals(JBossSAMLURIConstants.NAMEID_FORMAT_UNSPECIFIED.get())) {
        // TODO: Support for persistent NameID (pseudo-random identifier persisted in user object)
        return userSession.getUser().getUsername();
    } else {
        return userSession.getUser().getUsername();
    }
}

Example #9

Source File: BaseSAML2BindingBuilder.java From keycloak with Apache License 2.0

6 votes

public void encryptDocument(Document samlDocument) throws ProcessingException {
    String samlNSPrefix = getSAMLNSPrefix(samlDocument);

    try {
        QName encryptedAssertionElementQName = new QName(JBossSAMLURIConstants.ASSERTION_NSURI.get(),
                JBossSAMLConstants.ENCRYPTED_ASSERTION.get(), samlNSPrefix);

        byte[] secret = RandomSecret.createRandomSecret(encryptionKeySize / 8);
        SecretKey secretKey = new SecretKeySpec(secret, encryptionAlgorithm);

        // encrypt the Assertion element and replace it with a EncryptedAssertion element.
        XMLEncryptionUtil.encryptElement(new QName(JBossSAMLURIConstants.ASSERTION_NSURI.get(),
                        JBossSAMLConstants.ASSERTION.get(), samlNSPrefix), samlDocument, encryptionPublicKey,
                secretKey, encryptionKeySize, encryptedAssertionElementQName, true);
    } catch (Exception e) {
        throw new ProcessingException("failed to encrypt", e);
    }

}

Example #10