cxf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cohei...@apache.org
Subject svn commit: r1432087 - in /cxf/branches/2.5.x-fixes/services/sts/sts-core/src: main/java/org/apache/cxf/sts/token/provider/SamlCallbackHandler.java test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
Date Fri, 11 Jan 2013 15:17:54 GMT
Author: coheigea
Date: Fri Jan 11 15:17:54 2013
New Revision: 1432087

URL: http://svn.apache.org/viewvc?rev=1432087&view=rev
Log:
Merged revisions 1432076 via  git cherry-pick from
https://svn.apache.org/repos/asf/cxf/branches/2.7.x-fixes

........
  r1432076 | coheigea | 2013-01-11 14:56:33 +0000 (Fri, 11 Jan 2013) | 10 lines

  Merged revisions 1432070 via  git cherry-pick from
  https://svn.apache.org/repos/asf/cxf/trunk

  ........
    r1432070 | coheigea | 2013-01-11 14:45:58 +0000 (Fri, 11 Jan 2013) | 2 lines

    [CXF-4746] - STS issues invalid SAML 1.1 Assertions under certain conditions

  ........

........


Conflicts:
	services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java

Modified:
    cxf/branches/2.5.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/SamlCallbackHandler.java
    cxf/branches/2.5.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java

Modified: cxf/branches/2.5.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/SamlCallbackHandler.java
URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/SamlCallbackHandler.java?rev=1432087&r1=1432086&r2=1432087&view=diff
==============================================================================
--- cxf/branches/2.5.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/SamlCallbackHandler.java
(original)
+++ cxf/branches/2.5.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/SamlCallbackHandler.java
Fri Jan 11 15:17:54 2013
@@ -19,6 +19,7 @@
 package org.apache.cxf.sts.token.provider;
 
 import java.io.IOException;
+import java.util.Collections;
 import java.util.List;
 
 import javax.security.auth.callback.Callback;
@@ -112,11 +113,13 @@ public class SamlCallbackHandler impleme
                 // Set the token Type.
                 TokenRequirements tokenRequirements = tokenParameters.getTokenRequirements();
                 String tokenType = tokenRequirements.getTokenType();
+                boolean saml1 = false;
                 if (WSConstants.WSS_SAML2_TOKEN_TYPE.equals(tokenType)
                     || WSConstants.SAML2_NS.equals(tokenType)) {
                     callback.setSamlVersion(SAMLVersion.VERSION_20);
                 } else {
                     callback.setSamlVersion(SAMLVersion.VERSION_11);
+                    saml1 = true;
                     setSubjectOnBeans();
                 }
                 
@@ -129,14 +132,26 @@ public class SamlCallbackHandler impleme
                 }
 
                 // Set the statements
+                boolean statementAdded = false;
                 if (attributeBeans != null && !attributeBeans.isEmpty()) {
                     callback.setAttributeStatementData(attributeBeans);
+                    statementAdded = true;
                 }
                 if (authBeans != null && !authBeans.isEmpty()) {
                     callback.setAuthenticationStatementData(authBeans);
+                    statementAdded = true;
                 }
                 if (authDecisionBeans != null && !authDecisionBeans.isEmpty()) {
                     callback.setAuthDecisionStatementData(authDecisionBeans);
+                    statementAdded = true;
+                }
+                
+                // If SAML 1.1 we *must* add a Statement
+                if (saml1 && !statementAdded) {
+                    AttributeStatementBean defaultStatement = 
+                        new DefaultAttributeStatementProvider().getStatement(tokenParameters);
+                    defaultStatement.setSubject(subjectBean);
+                    callback.setAttributeStatementData(Collections.singletonList(defaultStatement));
                 }
                 
                 // Set the conditions

Modified: cxf/branches/2.5.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java?rev=1432087&r1=1432086&r2=1432087&view=diff
==============================================================================
--- cxf/branches/2.5.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
(original)
+++ cxf/branches/2.5.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
Fri Jan 11 15:17:54 2013
@@ -21,6 +21,7 @@ package org.apache.cxf.sts.token.validat
 import java.io.IOException;
 import java.security.Principal;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 import java.util.Properties;
@@ -39,12 +40,14 @@ import org.apache.cxf.sts.STSConstants;
 import org.apache.cxf.sts.StaticSTSProperties;
 import org.apache.cxf.sts.cache.DefaultInMemoryTokenStore;
 import org.apache.cxf.sts.cache.STSTokenStore;
+import org.apache.cxf.sts.claims.CorrectedClaimsAttributeStatementProvider;
 import org.apache.cxf.sts.common.PasswordCallbackHandler;
 import org.apache.cxf.sts.request.KeyRequirements;
 import org.apache.cxf.sts.request.Lifetime;
 import org.apache.cxf.sts.request.ReceivedToken;
 import org.apache.cxf.sts.request.TokenRequirements;
 import org.apache.cxf.sts.service.EncryptionProperties;
+import org.apache.cxf.sts.token.provider.AttributeStatementProvider;
 import org.apache.cxf.sts.token.provider.DefaultConditionsProvider;
 import org.apache.cxf.sts.token.provider.SAMLTokenProvider;
 import org.apache.cxf.sts.token.provider.TokenProvider;
@@ -135,6 +138,39 @@ public class SAMLTokenValidatorTest exte
     }
     
     /**
+     * Test a SAML 1.1 Assertion that is configured with the ClaimsAttributeStatementProvider,
+     * but does not contain any claims. In older versions of the STS, this generated an invalid
+     * SAML Assertion.
+     */
+    @org.junit.Test
+    public void testSAML1AssertionWithClaims() throws Exception {
+        TokenValidator samlTokenValidator = new SAMLTokenValidator();
+        TokenValidatorParameters validatorParameters = createValidatorParameters();
+        validatorParameters.setTokenStore(null);
+        TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
+        
+        // Create a ValidateTarget consisting of a SAML Assertion
+        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
+        CallbackHandler callbackHandler = new PasswordCallbackHandler();
+        Element samlToken = 
+            createSAMLAssertionWithClaimsProvider(
+                WSConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler
+            );
+        Document doc = samlToken.getOwnerDocument();
+        samlToken = (Element)doc.appendChild(samlToken);
+        
+        ReceivedToken validateTarget = new ReceivedToken(samlToken);
+        tokenRequirements.setValidateTarget(validateTarget);
+        
+        assertTrue(samlTokenValidator.canHandleToken(validateTarget));
+        
+        TokenValidatorResponse validatorResponse = 
+            samlTokenValidator.validateToken(validatorParameters);
+        assertTrue(validatorResponse != null);
+        assertTrue(validatorResponse.isValid());
+    }
+    
+    /**
      * Test a SAML 1.1 Assertion with an invalid signature
      */
     @org.junit.Test
@@ -341,6 +377,23 @@ public class SAMLTokenValidatorTest exte
         return providerResponse.getToken();
     }
     
+    private Element createSAMLAssertionWithClaimsProvider(
+        String tokenType, Crypto crypto, String signatureUsername, CallbackHandler callbackHandler
+    ) throws WSSecurityException {
+        SAMLTokenProvider samlTokenProvider = new SAMLTokenProvider();
+        AttributeStatementProvider statementProvider = new CorrectedClaimsAttributeStatementProvider();
+        samlTokenProvider.setAttributeStatementProviders(Collections.singletonList(statementProvider));
+        TokenProviderParameters providerParameters = 
+            createProviderParameters(
+                tokenType, STSConstants.BEARER_KEY_KEYTYPE, crypto, signatureUsername, callbackHandler
+            );
+        TokenProviderResponse providerResponse = samlTokenProvider.createToken(providerParameters);
+        assertTrue(providerResponse != null);
+        assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId()
!= null);
+
+        return providerResponse.getToken();
+    }
+    
     private Element createSAMLAssertion(
             String tokenType, Crypto crypto, String signatureUsername,
             CallbackHandler callbackHandler, long ttlMs



Mime
View raw message