/******************************************************************************* * Copyright 2017 Graz University of Technology * EAAF-Core Components has been developed in a cooperation between EGIZ, * A-SIT+, A-SIT, and Graz University of Technology. * * Licensed under the EUPL, Version 1.2 or - as soon they will be approved by * the European Commission - subsequent versions of the EUPL (the "Licence"); * You may not use this work except in compliance with the Licence. * You may obtain a copy of the Licence at: * https://joinup.ec.europa.eu/news/understanding-eupl-v12 * * Unless required by applicable law or agreed to in writing, software * distributed under the Licence is distributed on an "AS IS" basis, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the Licence for the specific language governing permissions and * limitations under the Licence. * * This product combines work with different licenses. See the "NOTICE" text * file for details on the various modules and licenses. * The "NOTICE" text file is part of the distribution. Any derivative works * that you distribute must include a readable copy of the "NOTICE" text file. *******************************************************************************/ /******************************************************************************* *******************************************************************************/ /******************************************************************************* *******************************************************************************/ package at.gv.egiz.eaaf.modules.pvp2.impl.utils; import java.io.IOException; import java.security.NoSuchAlgorithmException; import java.util.List; import javax.xml.namespace.QName; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; import javax.xml.transform.TransformerException; import javax.xml.transform.dom.DOMSource; import javax.xml.validation.Schema; import javax.xml.validation.Validator; import org.apache.commons.lang3.StringUtils; import org.opensaml.Configuration; import org.opensaml.common.impl.SecureRandomIdentifierGenerator; import org.opensaml.common.xml.SAMLSchemaBuilder; import org.opensaml.saml2.core.Attribute; import org.opensaml.saml2.core.Status; import org.opensaml.saml2.core.StatusCode; import org.opensaml.saml2.metadata.AssertionConsumerService; import org.opensaml.saml2.metadata.SPSSODescriptor; import org.opensaml.ws.soap.soap11.Body; import org.opensaml.ws.soap.soap11.Envelope; import org.opensaml.xml.XMLObject; import org.opensaml.xml.XMLObjectBuilderFactory; import org.opensaml.xml.io.Marshaller; import org.opensaml.xml.io.MarshallingException; import org.opensaml.xml.schema.XSString; import org.opensaml.xml.schema.impl.XSStringBuilder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.w3c.dom.Document; import at.gv.egiz.eaaf.core.impl.utils.Random; import at.gv.egiz.eaaf.modules.pvp2.PVPConstants; import at.gv.egiz.eaaf.modules.pvp2.api.reqattr.EAAFRequestedAttribute; public class SAML2Utils { private static final Logger log = LoggerFactory.getLogger(SAML2Utils.class); public static T createSAMLObject(final Class clazz) { try { XMLObjectBuilderFactory builderFactory = Configuration .getBuilderFactory(); QName defaultElementName = (QName) clazz.getDeclaredField( "DEFAULT_ELEMENT_NAME").get(null); @SuppressWarnings("unchecked") T object = (T) builderFactory.getBuilder(defaultElementName) .buildObject(defaultElementName); return object; } catch (Throwable e) { e.printStackTrace(); return null; } } public static String getSecureIdentifier() { return "_".concat(Random.nextHexRandom16()); /*Bug-Fix: There are open problems with RandomNumberGenerator via Java SPI and Java JDK 8.121 * Generation of a 16bit Random identifier FAILES with an Caused by: java.lang.ArrayIndexOutOfBoundsException * Caused by: java.lang.ArrayIndexOutOfBoundsException at iaik.security.random.o.engineNextBytes(Unknown Source) at iaik.security.random.SecRandomSpi.engineNextBytes(Unknown Source) at java.security.SecureRandom.nextBytes(SecureRandom.java:468) at org.opensaml.common.impl.SecureRandomIdentifierGenerator.generateIdentifier(SecureRandomIdentifierGenerator.java:62) at org.opensaml.common.impl.SecureRandomIdentifierGenerator.generateIdentifier(SecureRandomIdentifierGenerator.java:56) at at.gv.egovernment.moa.id.protocols.pvp2x.utils.SAML2Utils.getSecureIdentifier(SAML2Utils.java:69) */ //return idGenerator.generateIdentifier(); } private static SecureRandomIdentifierGenerator idGenerator; private static DocumentBuilder builder; static { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); try { builder = factory.newDocumentBuilder(); } catch (ParserConfigurationException e) { // TODO Auto-generated catch block e.printStackTrace(); } try { idGenerator = new SecureRandomIdentifierGenerator(); } catch(NoSuchAlgorithmException e) { e.printStackTrace(); } } public static Document asDOMDocument(XMLObject object) throws IOException, MarshallingException, TransformerException { Document document = builder.newDocument(); Marshaller out = Configuration.getMarshallerFactory().getMarshaller( object); out.marshall(object, document); return document; } public static Status getSuccessStatus() { Status status = SAML2Utils.createSAMLObject(Status.class); StatusCode statusCode = SAML2Utils.createSAMLObject(StatusCode.class); statusCode.setValue(StatusCode.SUCCESS_URI); status.setStatusCode(statusCode); return status; } public static int getDefaultAssertionConsumerServiceIndex(SPSSODescriptor spSSODescriptor) { List assertionConsumerList = spSSODescriptor.getAssertionConsumerServices(); for (AssertionConsumerService el : assertionConsumerList) { if (el.isDefault()) return el.getIndex(); } return 0; } public static Envelope buildSOAP11Envelope(XMLObject payload) { XMLObjectBuilderFactory bf = Configuration.getBuilderFactory(); Envelope envelope = (Envelope) bf.getBuilder(Envelope.DEFAULT_ELEMENT_NAME).buildObject(Envelope.DEFAULT_ELEMENT_NAME); Body body = (Body) bf.getBuilder(Body.DEFAULT_ELEMENT_NAME).buildObject(Body.DEFAULT_ELEMENT_NAME); body.getUnknownXMLObjects().add(payload); envelope.setBody(body); return envelope; } public static EAAFRequestedAttribute generateReqAuthnAttributeSimple(Attribute attr, boolean isRequired, String value) { EAAFRequestedAttribute requested = SAML2Utils.createSAMLObject(EAAFRequestedAttribute.class); requested.setName(attr.getName()); requested.setNameFormat(attr.getNameFormat()); requested.setFriendlyName(attr.getFriendlyName()); requested.setIsRequired(String.valueOf(isRequired)); List attributeValues = requested.getAttributeValues(); if (StringUtils.isNotEmpty(value)) { XMLObject attributeValueForRequest = createAttributeValue(PVPConstants.EIDAS_REQUESTED_ATTRIBUTE_VALUE_TYPE, value); attributeValues.add(attributeValueForRequest); } return requested; } public static void schemeValidation(XMLObject xmlObject) throws Exception { try { Schema test = SAMLSchemaBuilder.getSAML11Schema(); Validator val = test.newValidator(); DOMSource source = new DOMSource(xmlObject.getDOM()); val.validate(source); log.debug("SAML2 Scheme validation successful"); return; } catch (Exception e) { log.warn("SAML2 scheme validation FAILED.", e); throw e; } } private static XMLObject createAttributeValue(QName attributeValueType, String value) { XSStringBuilder stringBuilder = (XSStringBuilder) Configuration.getBuilderFactory().getBuilder(XSString.TYPE_NAME); XSString stringValue = stringBuilder.buildObject(attributeValueType, XSString.TYPE_NAME); stringValue.setValue(value); return stringValue; } }