1 files changed, 44 insertions, 27 deletions

diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
index 9758ff83..2257eba9 100644
--- a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/verification/SamlVerificationEngine.java
@@ -32,6 +32,8 @@ import javax.xml.validation.Validator;
 import org.apache.commons.lang3.StringUtils;
 import org.joda.time.DateTime;
 import org.opensaml.core.criterion.EntityIdCriterion;
+import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.common.xml.SAMLSchemaBuilder;
 import org.opensaml.saml.common.xml.SAMLSchemaBuilder.SAML1Version;
@@ -61,7 +63,6 @@ import org.opensaml.xmlsec.encryption.support.SimpleRetrievalMethodEncryptedKeyR
 import org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.w3c.dom.Element;
 import org.xml.sax.SAXException;
 
@@ -75,10 +76,12 @@ import at.gv.egiz.eaaf.modules.pvp2.exception.SchemaValidationException;
 import at.gv.egiz.eaaf.modules.pvp2.impl.message.InboundMessage;
 import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileRequest;
 import at.gv.egiz.eaaf.modules.pvp2.impl.message.PvpSProfileResponse;
+import at.gv.egiz.eaaf.modules.pvp2.impl.validation.SignatureTrustEngineDecorator;
 import lombok.extern.slf4j.Slf4j;
 import net.shibboleth.utilities.java.support.net.URIException;
 import net.shibboleth.utilities.java.support.net.impl.BasicURLComparator;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.xml.SerializeSupport;
 
 @Slf4j
 public class SamlVerificationEngine {
@@ -98,13 +101,7 @@ public class SamlVerificationEngine {
    */
   private static final int TIME_JITTER = 3;
 
-
-
-
-
-  @Autowired(required = true)
-  IPvp2MetadataProvider metadataProvider;
-
+  
   /**
    * Verify signature of a signed SAML2 object.
    *
@@ -141,27 +138,36 @@ public class SamlVerificationEngine {
       log.debug("PVP2X message validation FAILED. Relead metadata for entityID: {}",
           msg.getEntityID());
 
-      if (metadataProvider == null || !(metadataProvider instanceof IRefreshableMetadataProvider)
-          || !((IRefreshableMetadataProvider) metadataProvider)
-              .refreshMetadataProvider(msg.getEntityID())) {
-        throw e;
-
-      } else {
-        log.trace("PVP2X metadata reload finished. Check validate message again.");
-
-        if (msg instanceof PvpSProfileRequest
-            && ((PvpSProfileRequest) msg).getSamlRequest() instanceof RequestAbstractType) {
-          verifyRequest((RequestAbstractType) ((PvpSProfileRequest) msg).getSamlRequest(),
-              sigTrustEngine);
+      if (sigTrustEngine instanceof SignatureTrustEngineDecorator) {
+        IPvp2MetadataProvider metadataProvider = 
+            ((SignatureTrustEngineDecorator) sigTrustEngine).getMetadataProvider();
+        if (metadataProvider == null || !(metadataProvider instanceof IRefreshableMetadataProvider) 
+            || !((IRefreshableMetadataProvider) metadataProvider).refreshMetadataProvider(msg.getEntityID())) {
+          
+          throw e;
 
         } else {
-          verifyIdpResponse(((PvpSProfileResponse) msg).getResponse(), sigTrustEngine);
+          log.trace("PVP2X metadata reload finished. Check validate message again.");
 
-        }
+          if (msg instanceof PvpSProfileRequest
+              && ((PvpSProfileRequest) msg).getSamlRequest() instanceof RequestAbstractType) {
+            verifyRequest((RequestAbstractType) ((PvpSProfileRequest) msg).getSamlRequest(),
+                sigTrustEngine);
 
-      }
-      log.trace("Second PVP2X message validation finished");
+          } else {
+            verifyIdpResponse(((PvpSProfileResponse) msg).getResponse(), sigTrustEngine);
+
+          }
 
+        }
+        log.trace("Second PVP2X message validation finished");
+                                
+      } else {
+        log.debug("TrustEninge is not of type: {} Dynamic SAML2 metadata refresh not possibile.", 
+            SignatureTrustEngineDecorator.class);
+        throw e;
+        
+      }           
     }
   }
 
@@ -246,6 +252,7 @@ public class SamlVerificationEngine {
       // validate each assertion
       final List<Assertion> validatedassertions = new ArrayList<>();
       for (final Assertion saml2assertion : saml2assertions) {
+        traceLogFullAssertion(saml2assertion);        
         if (internalAssertionValidation(saml2assertion, spEntityID, validateDateTime)) {
           log.debug("Add valid Assertion:" + saml2assertion.getID());
           validatedassertions.add(saml2assertion);
@@ -271,9 +278,19 @@ public class SamlVerificationEngine {
       throw new SamlAssertionValidationExeption(ERROR_16,
           new Object[] { e.getMessage() }, e);
 
-//    } catch (final ConfigurationException e) {
-//      throw new AssertionValidationExeption("pvp.12",
-//          new Object[]{loggerName, e.getMessage()}, e);
+    }
+  }
+
+  private void traceLogFullAssertion(Assertion saml2assertion) {
+    if (log.isTraceEnabled()) {
+      try {
+        log.trace("Decrypted SAML2 Response:", SerializeSupport.nodeToString(
+            XMLObjectSupport.getMarshaller(saml2assertion).marshall(saml2assertion)));
+      
+      } catch (MarshallingException e) {
+        log.info("Can NOT trace decrypted SAML2 Assertion", e);
+      
+      }
     }
   }