import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Encode response and pass it onto the outbound transport.
 * Uses {@link CasHttpSoap11Encoder} to handle encoding.
 *
 * @param httpResponse the http response
 * @param httpRequest the http request
 * @param samlMessage the saml response
 * @throws Exception the exception in case encoding fails.
 */
public void encodeSamlResponse(final HttpServletResponse httpResponse,
                               final HttpServletRequest httpRequest,
                               final Response samlMessage) throws Exception {

    SamlUtils.logSamlObject(this.configBean, samlMessage);
    
    final HTTPSOAP11Encoder encoder = new CasHttpSoap11Encoder();
    final MessageContext<SAMLObject> context = new MessageContext();
    context.setMessage(samlMessage);
    encoder.setHttpServletResponse(httpResponse);
    encoder.setMessageContext(context);
    encoder.initialize();
    encoder.prepareContext();
    encoder.encode();
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Encrypt assertion.
 *
 * @param assertion the assertion
 * @param request   the request
 * @param response  the response
 * @param service   the service
 * @param adaptor   the adaptor
 * @return the saml object
 * @throws SamlException the saml exception
 */
protected SAMLObject encryptAssertion(final Assertion assertion,
                                      final HttpServletRequest request, final HttpServletResponse response,
                                      final SamlRegisteredService service,
                                      final SamlRegisteredServiceServiceProviderMetadataFacade adaptor) throws SamlException {
    try {
        if (service.isEncryptAssertions()) {
            LOGGER.info("SAML service [{}] requires assertions to be encrypted", adaptor.getEntityId());
            final EncryptedAssertion encryptedAssertion =
                    this.samlObjectEncrypter.encode(assertion, service, adaptor, response, request);
            return encryptedAssertion;
        }
        LOGGER.info("SAML registered service [{}] does not require assertions to be encrypted", adaptor.getEntityId());
        return assertion;
    } catch (final Exception e) {
        throw new SamlException("Unable to marshall assertion for encryption", e);
    }
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Encode a given saml object by invoking a number of outbound security handlers on the context.
 *
 * @param <T>        the type parameter
 * @param samlObject the saml object
 * @param service    the service
 * @param adaptor    the adaptor
 * @param response   the response
 * @param request    the request
 * @param binding    the binding
 * @return the t
 * @throws SamlException the saml exception
 */
public <T extends SAMLObject> T encode(final T samlObject,
                                       final SamlRegisteredService service,
                                       final SamlRegisteredServiceServiceProviderMetadataFacade adaptor,
                                       final HttpServletResponse response,
                                       final HttpServletRequest request,
                                       final String binding) throws SamlException {
    try {
        LOGGER.debug("Attempting to encode [{}] for [{}]", samlObject.getClass().getName(), adaptor.getEntityId());
        final MessageContext<T> outboundContext = new MessageContext<>();
        prepareOutboundContext(samlObject, adaptor, outboundContext, binding);
        prepareSecurityParametersContext(adaptor, outboundContext);
        prepareEndpointURLSchemeSecurityHandler(outboundContext);
        prepareSamlOutboundDestinationHandler(outboundContext);
        prepareSamlOutboundProtocolMessageSigningHandler(outboundContext);
        return samlObject;
    } catch (final Exception e) {
        throw new SamlException(e.getMessage(), e);
    }
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
@Override
protected void doEncode() throws MessageEncodingException {
    final MessageContext messageContext = this.getMessageContext();
    final SAMLObject outboundMessage = (SAMLObject)messageContext.getMessage();
    final String endpointURL = this.getEndpointURL(messageContext).toString();
    
    if (!this.forceSignRedirectBindingAuthnRequest) {
        this.removeSignature(outboundMessage);
    }
    
    final String encodedMessage = this.deflateAndBase64Encode(outboundMessage);
    final String redirectURL = this.buildRedirectURL(messageContext, endpointURL, encodedMessage);

    responseAdapter.init();
    responseAdapter.setRedirectUrl(redirectURL);
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * DEFLATE (RFC1951) compresses the given SAML message.
 *
 * @param message SAML message
 *
 * @return DEFLATE compressed message
 *
 * @throws MessageEncodingException thrown if there is a problem compressing the message
 */
protected String deflateAndBase64Encode(SAMLObject message) throws MessageEncodingException {
    log.debug("Deflating and Base64 encoding SAML message");
    try {
        String messageStr = SerializeSupport.nodeToString(marshallMessage(message));

        ByteArrayOutputStream bytesOut = new ByteArrayOutputStream();
        Deflater deflater = new Deflater(Deflater.DEFLATED, true);
        DeflaterOutputStream deflaterStream = new DeflaterOutputStream(bytesOut, deflater);
        deflaterStream.write(messageStr.getBytes("UTF-8"));
        deflaterStream.finish();

        return Base64Support.encode(bytesOut.toByteArray(), Base64Support.UNCHUNKED);
    } catch (IOException e) {
        throw new MessageEncodingException("Unable to DEFLATE and Base64 encode SAML message", e);
    }
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
protected void postEncode(final MessageContext<SAMLObject> messageContext, final String endpointURL) throws MessageEncodingException {
    log.debug("Invoking Velocity template to create POST body");

    try {
        final VelocityContext e = new VelocityContext();
        this.populateVelocityContext(e, messageContext, endpointURL);

        responseAdapter.setContentType("text/html");
        responseAdapter.init();

        final OutputStreamWriter out = responseAdapter.getOutputStreamWriter();
        this.getVelocityEngine().mergeTemplate(this.getVelocityTemplateId(), "UTF-8", e, out);
        out.flush();
    } catch (Exception var6) {
        throw new MessageEncodingException("Error creating output document", var6);
    }
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
@Override
protected void doDecode() throws MessageDecodingException {
    final MessageContext messageContext = new MessageContext();

    if(!"POST".equalsIgnoreCase(this.context.getRequestMethod())) {
        throw new MessageDecodingException("This message decoder only supports the HTTP POST method");
    } else {
        final String relayState = this.context.getRequestParameter("RelayState");
        logger.debug("Decoded SAML relay state of: {}", relayState);
        SAMLBindingSupport.setRelayState(messageContext, relayState);
        final InputStream base64DecodedMessage = this.getBase64DecodedMessage();
        final SAMLObject inboundMessage = (SAMLObject)this.unmarshallMessage(base64DecodedMessage);
        messageContext.setMessage(inboundMessage);
        logger.debug("Decoded SAML message");
        this.populateBindingContext(messageContext);
        this.setMessageContext(messageContext);
    }
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Validates the SAML protocol response and the SAML SSO response.
 * The method decrypt encrypted assertions if any.
 *
 * @param context the context
 */
@Override
public Credentials validate(final SAML2MessageContext context) {

    final SAMLObject message = context.getMessage();

    if (!(message instanceof Response)) {
        throw new SAMLException("Response instance is an unsupported type");
    }
    final Response response = (Response) message;
    final SignatureTrustEngine engine = this.signatureTrustEngineProvider.build();
    validateSamlProtocolResponse(response, context, engine);

    if (decrypter != null) {
        decryptEncryptedAssertions(response, decrypter);
    }

    validateSamlSSOResponse(response, context, engine, decrypter);
    return buildSAML2Credentials(context);
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
@Override
protected void doExecute(@Nonnull final ProfileRequestContext<SAMLObject, SAMLObject> profileRequestContext) {
   	logger.debug("Entering GenerateNewToken doExecute");
		
	try {
		LinotpConnection connection = new LinotpConnection(host, serviceUsername, servicePassword, checkCert);
		connection.requestAdminSession();
		List<LinotpTokenInfo> tokenList = connection.getTokenInfoList(username);
		
		if (createEmailToken && tokenList.size() == 0) {
			List<LinotpUser> userList = connection.getUserList("userid", username);
			if (userList.size() == 1) {
				connection.initEmailToken(username, userList.get(0).getEmail());
				tokenList = connection.getTokenInfoList(username);
			}
		}
		
		tokenCtx.setTokenList(tokenList);
		
		connection.generateToken(tokenCtx);
		
	} catch (Exception e) {
		logger.debug("Failed to create new token", e);
	}
	
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
@Nonnull
@Override
protected Event doExecute(
        final @Nonnull RequestContext springRequestContext,
        final @Nonnull ProfileRequestContext<SAMLObject, SAMLObject> profileRequestContext) {

    final MessageContext<SAMLObject> msgContext = new MessageContext<>();
    try {
        msgContext.setMessage(buildSamlResponse(springRequestContext, profileRequestContext));
    } catch (IllegalStateException e) {
        return ProtocolError.IllegalState.event(this);
    }
    final SAMLBindingContext bindingContext = new SAMLBindingContext();
    bindingContext.setBindingUri(SAMLConstants.SAML1_SOAP11_BINDING_URI);
    msgContext.addSubcontext(bindingContext);
    profileRequestContext.setOutboundMessageContext(msgContext);

    // Return null to signal that other actions must follow this one before proceeding to next state
    return null;
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
@Nonnull
@Override
protected Response buildSamlResponse(
        final @Nonnull RequestContext springRequestContext,
        final @Nonnull ProfileRequestContext<SAMLObject, SAMLObject> profileRequestContext) {

    final String code = (String) springRequestContext.getFlashScope().get("code");
    final String detailCode = (String) springRequestContext.getFlashScope().get("detailCode");

    final Response response = newSAMLObject(Response.class, Response.DEFAULT_ELEMENT_NAME);
    final Status status = newSAMLObject(Status.class, Status.DEFAULT_ELEMENT_NAME);
    final StatusCode statusCode = newSAMLObject(StatusCode.class, StatusCode.DEFAULT_ELEMENT_NAME);
    statusCode.setValue(new QName(NAMESPACE, code));
    status.setStatusCode(statusCode);
    final StatusMessage message = newSAMLObject(StatusMessage.class, StatusMessage.DEFAULT_ELEMENT_NAME);
    message.setMessage(detailCode);
    status.setStatusMessage(message);
    response.setStatus(status);

    return response;
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Create a new SAML object.
 *
 * @param <T> the generic type
 * @param objectType the object type
 * @return the t
 */
public final <T extends SAMLObject> T newSamlObject(final Class<T> objectType) {
    final QName qName = getSamlObjectQName(objectType);
    final SAMLObjectBuilder<T> builder = (SAMLObjectBuilder<T>)
            XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(qName);
    if (builder == null) {
        throw new IllegalStateException("No SAMLObjectBuilder registered for class " + objectType.getName());
    }
    return objectType.cast(builder.buildObject(qName));
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Encode response and pass it onto the outbound transport.
 * Uses {@link CasHttpSoap11Encoder} to handle encoding.
 *
 * @param httpResponse the http response
 * @param httpRequest the http request
 * @param samlMessage the saml response
 * @throws Exception the exception in case encoding fails.
 */
public void encodeSamlResponse(final HttpServletResponse httpResponse,
                               final HttpServletRequest httpRequest,
                               final Response samlMessage) throws Exception {

    final HTTPSOAP11Encoder encoder = new CasHttpSoap11Encoder();
    final MessageContext<SAMLObject> context = new MessageContext();
    context.setMessage(samlMessage);
    encoder.setHttpServletResponse(httpResponse);
    encoder.setMessageContext(context);
    encoder.initialize();
    encoder.prepareContext();
    encoder.encode();
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Encode response and pass it onto the outbound transport.
 * Uses {@link CasHTTPSOAP11Encoder} to handle encoding.
 *
 * @param httpResponse the http response
 * @param httpRequest the http request
 * @param samlMessage the saml response
 * @throws Exception the exception in case encoding fails.
 */
public void encodeSamlResponse(final HttpServletResponse httpResponse,
                               final HttpServletRequest httpRequest,
                               final Response samlMessage) throws Exception {

    final HTTPSOAP11Encoder encoder = new CasHTTPSOAP11Encoder();
    final MessageContext<SAMLObject> context = new MessageContext();
    context.setMessage(samlMessage);
    encoder.setHttpServletResponse(httpResponse);
    encoder.setMessageContext(context);
    encoder.initialize();
    encoder.prepareContext();
    encoder.encode();
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Create a new SAML object.
 *
 * @param <T>        the generic type
 * @param objectType the object type
 * @return the t
 */
public <T extends SAMLObject> T newSamlObject(final Class<T> objectType) {
    final QName qName = getSamlObjectQName(objectType);
    final SAMLObjectBuilder<T> builder = (SAMLObjectBuilder<T>)
            XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(qName);
    if (builder == null) {
        throw new IllegalStateException("No SAML object builder is registered for class " + objectType.getName());
    }
    return objectType.cast(builder.buildObject(qName));
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Instantiates a new ecp saml profile handler controller.
 *
 * @param samlObjectSigner                             the saml object signer
 * @param parserPool                                   the parser pool
 * @param authenticationSystemSupport                  the authentication system support
 * @param servicesManager                              the services manager
 * @param webApplicationServiceFactory                 the web application service factory
 * @param samlRegisteredServiceCachingMetadataResolver the saml registered service caching metadata resolver
 * @param configBean                                   the config bean
 * @param responseBuilder                              the response builder
 * @param samlEcpFaultResponseBuilder                  the saml ecp fault response builder
 * @param authenticationContextClassMappings           the authentication context class mappings
 * @param serverPrefix                                 the server prefix
 * @param serverName                                   the server name
 * @param authenticationContextRequestParameter        the authentication context request parameter
 * @param loginUrl                                     the login url
 * @param logoutUrl                                    the logout url
 * @param forceSignedLogoutRequests                    the force signed logout requests
 * @param singleLogoutCallbacksDisabled                the single logout callbacks disabled
 * @param samlObjectSignatureValidator                 the saml object signature validator
 */
public ECPProfileHandlerController(final BaseSamlObjectSigner samlObjectSigner,
                                   final ParserPool parserPool,
                                   final AuthenticationSystemSupport authenticationSystemSupport,
                                   final ServicesManager servicesManager,
                                   final ServiceFactory<WebApplicationService> webApplicationServiceFactory,
                                   final SamlRegisteredServiceCachingMetadataResolver samlRegisteredServiceCachingMetadataResolver,
                                   final OpenSamlConfigBean configBean,
                                   final SamlProfileObjectBuilder<org.opensaml.saml.saml2.ecp.Response> responseBuilder,
                                   final SamlProfileObjectBuilder<? extends SAMLObject> samlEcpFaultResponseBuilder,
                                   final Set<String> authenticationContextClassMappings,
                                   final String serverPrefix,
                                   final String serverName,
                                   final String authenticationContextRequestParameter,
                                   final String loginUrl,
                                   final String logoutUrl,
                                   final boolean forceSignedLogoutRequests,
                                   final boolean singleLogoutCallbacksDisabled,
                                   final SamlObjectSignatureValidator samlObjectSignatureValidator) {
    super(samlObjectSigner, parserPool, authenticationSystemSupport,
            servicesManager, webApplicationServiceFactory,
            samlRegisteredServiceCachingMetadataResolver,
            configBean, responseBuilder,
            authenticationContextClassMappings,
            serverPrefix, serverName,
            authenticationContextRequestParameter, loginUrl, logoutUrl,
            forceSignedLogoutRequests, singleLogoutCallbacksDisabled,
            samlObjectSignatureValidator);
    this.samlEcpFaultResponseBuilder = samlEcpFaultResponseBuilder;
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
/**
 * Instantiates a new Abstract saml profile handler controller.
 *
 * @param samlObjectSigner                             the saml object signer
 * @param parserPool                                   the parser pool
 * @param authenticationSystemSupport                  the authentication system support
 * @param servicesManager                              the services manager
 * @param webApplicationServiceFactory                 the web application service factory
 * @param samlRegisteredServiceCachingMetadataResolver the saml registered service caching metadata resolver
 * @param configBean                                   the config bean
 * @param responseBuilder                              the response builder
 * @param authenticationContextClassMappings           the authentication context class mappings
 * @param serverPrefix                                 the server prefix
 * @param serverName                                   the server name
 * @param authenticationContextRequestParameter        the authentication context request parameter
 * @param loginUrl                                     the login url
 * @param logoutUrl                                    the logout url
 * @param forceSignedLogoutRequests                    the force signed logout requests
 * @param singleLogoutCallbacksDisabled                the single logout callbacks disabled
 * @param samlObjectSignatureValidator                 the saml object signature validator
 */
public AbstractSamlProfileHandlerController(final BaseSamlObjectSigner samlObjectSigner,
                                            final ParserPool parserPool,
                                            final AuthenticationSystemSupport authenticationSystemSupport,
                                            final ServicesManager servicesManager,
                                            final ServiceFactory<WebApplicationService> webApplicationServiceFactory,
                                            final SamlRegisteredServiceCachingMetadataResolver samlRegisteredServiceCachingMetadataResolver,
                                            final OpenSamlConfigBean configBean,
                                            final SamlProfileObjectBuilder<? extends SAMLObject> responseBuilder,
                                            final Set<String> authenticationContextClassMappings,
                                            final String serverPrefix,
                                            final String serverName,
                                            final String authenticationContextRequestParameter,
                                            final String loginUrl,
                                            final String logoutUrl,
                                            final boolean forceSignedLogoutRequests,
                                            final boolean singleLogoutCallbacksDisabled,
                                            final SamlObjectSignatureValidator samlObjectSignatureValidator) {
    this.samlObjectSigner = samlObjectSigner;
    this.parserPool = parserPool;
    this.servicesManager = servicesManager;
    this.webApplicationServiceFactory = webApplicationServiceFactory;
    this.samlRegisteredServiceCachingMetadataResolver = samlRegisteredServiceCachingMetadataResolver;
    this.configBean = configBean;
    this.responseBuilder = responseBuilder;
    this.authenticationContextClassMappings = authenticationContextClassMappings;
    this.serverPrefix = serverPrefix;
    this.serverName = serverName;
    this.authenticationContextRequestParameter = authenticationContextRequestParameter;
    this.loginUrl = loginUrl;
    this.logoutUrl = logoutUrl;
    this.forceSignedLogoutRequests = forceSignedLogoutRequests;
    this.singleLogoutCallbacksDisabled = singleLogoutCallbacksDisabled;
    this.authenticationSystemSupport = authenticationSystemSupport;
    this.samlObjectSignatureValidator = samlObjectSignatureValidator;
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
private static MessageContext<SAMLObject> bindRelayStateParameter(final HttpServletRequest request) {
    final MessageContext<SAMLObject> messageContext = new MessageContext<>();
    final String relayState = request.getParameter(SamlProtocolConstants.PARAMETER_SAML_RELAY_STATE);
    LOGGER.debug("RelayState is [{}]", relayState);
    SAMLBindingSupport.setRelayState(messageContext, relayState);
    return messageContext;
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
public SamlProfileSamlSoap11ResponseBuilder(
        final OpenSamlConfigBean openSamlConfigBean,
        final BaseSamlObjectSigner samlObjectSigner,
        final VelocityEngineFactory velocityEngineFactory,
        final SamlProfileObjectBuilder<Assertion> samlProfileSamlAssertionBuilder,
        final SamlProfileObjectBuilder<? extends SAMLObject> saml2ResponseBuilder,
        final SamlObjectEncrypter samlObjectEncrypter) {
    super(openSamlConfigBean, samlObjectSigner, velocityEngineFactory, samlProfileSamlAssertionBuilder, samlObjectEncrypter);
    this.saml2ResponseBuilder = saml2ResponseBuilder;
}
 

import org.opensaml.saml.common.SAMLObject; //导入依赖的package包/类
@Override
protected Response buildResponse(final Assertion assertion,
                                 final org.jasig.cas.client.validation.Assertion casAssertion,
                                 final AuthnRequest authnRequest,
                                 final SamlRegisteredService service,
                                 final SamlRegisteredServiceServiceProviderMetadataFacade adaptor,
                                 final HttpServletRequest request,
                                 final HttpServletResponse response,
                                 final String binding) throws SamlException {
    final String id = '_' + String.valueOf(Math.abs(new SecureRandom().nextLong()));
    Response samlResponse = newResponse(id, ZonedDateTime.now(ZoneOffset.UTC), authnRequest.getID(), null);
    samlResponse.setVersion(SAMLVersion.VERSION_20);
    samlResponse.setIssuer(buildEntityIssuer());
    samlResponse.setConsent(RequestAbstractType.UNSPECIFIED_CONSENT);

    final SAMLObject finalAssertion = encryptAssertion(assertion, request, response, service, adaptor);

    if (finalAssertion instanceof EncryptedAssertion) {
        LOGGER.debug("Built assertion is encrypted, so the response will add it to the encrypted assertions collection");
        samlResponse.getEncryptedAssertions().add(EncryptedAssertion.class.cast(finalAssertion));
    } else {
        LOGGER.debug("Built assertion is not encrypted, so the response will add it to the assertions collection");
        samlResponse.getAssertions().add(Assertion.class.cast(finalAssertion));
    }

    final Status status = newStatus(StatusCode.SUCCESS, StatusCode.SUCCESS);
    samlResponse.setStatus(status);

    SamlUtils.logSamlObject(this.configBean, samlResponse);

    if (service.isSignResponses()) {
        LOGGER.debug("SAML entity id [{}] indicates that SAML responses should be signed", adaptor.getEntityId());
        samlResponse = this.samlObjectSigner.encode(samlResponse, service, adaptor, 
                response, request, binding);
    }

    return samlResponse;
}