import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
/**
 * Validate audience by matching the SP entityId.
 *
 * @param audienceRestrictions the audience restrictions
 * @param spEntityId the sp entity id
 */
protected final void validateAudienceRestrictions(final List<AudienceRestriction> audienceRestrictions,
                                                  final String spEntityId) {

    if (audienceRestrictions == null || audienceRestrictions.isEmpty()) {
        throw new SAMLException("Audience restrictions cannot be null or empty");
    }

    final Set<String> audienceUris = new HashSet<String>();
    for (final AudienceRestriction audienceRestriction : audienceRestrictions) {
        if (audienceRestriction.getAudiences() != null) {
            for (final Audience audience : audienceRestriction.getAudiences()) {
                audienceUris.add(audience.getAudienceURI());
            }
        }
    }
    if (!audienceUris.contains(spEntityId)) {
        throw new SAMLException("Assertion audience " + audienceUris + " does not match SP configuration "
                + spEntityId);
    }
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
/**
 * New conditions element.
 *
 * @param notBefore the not before
 * @param notOnOrAfter the not on or after
 * @param audienceUri the service id
 * @return the conditions
 */
public Conditions newConditions(final DateTime notBefore, final DateTime notOnOrAfter, final String audienceUri) {
    final Conditions conditions = newSamlObject(Conditions.class);
    conditions.setNotBefore(notBefore);
    conditions.setNotOnOrAfter(notOnOrAfter);

    final AudienceRestriction audienceRestriction = newSamlObject(AudienceRestriction.class);
    final Audience audience = newSamlObject(Audience.class);
    audience.setAudienceURI(audienceUri);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
/**
 * New conditions element.
 *
 * @param notBefore    the not before
 * @param notOnOrAfter the not on or after
 * @param audienceUri  the service id
 * @return the conditions
 */
public Conditions newConditions(final ZonedDateTime notBefore, final ZonedDateTime notOnOrAfter, final String audienceUri) {
    LOGGER.debug("Building conditions for audience [{}] that enforce not-before [{}] and not-after [{}]", audienceUri, notBefore, notOnOrAfter);
    final Conditions conditions = newSamlObject(Conditions.class);
    conditions.setNotBefore(DateTimeUtils.dateTimeOf(notBefore));
    conditions.setNotOnOrAfter(DateTimeUtils.dateTimeOf(notOnOrAfter));

    final AudienceRestriction audienceRestriction = newSamlObject(AudienceRestriction.class);
    final Audience audience = newSamlObject(Audience.class);
    audience.setAudienceURI(audienceUri);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
public void validate(List<AudienceRestriction> audienceRestrictions, String entityId) {
    if (audienceRestrictions == null || audienceRestrictions.size() != 1) {
        throw new SamlResponseValidationException("Exactly one audience restriction is expected.");
    }

    List<Audience> audiences = audienceRestrictions.get(0).getAudiences();
    if (audiences == null || audiences.size() != 1) {
        throw new SamlResponseValidationException("Exactly one audience is expected.");
    }

    String audience = audiences.get(0).getAudienceURI();
    if (!entityId.equals(audience)) {
        throw new SamlResponseValidationException(String.format("Audience must match entity ID. Expected %s but was %s", entityId, audience));
    }
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldValidateConditionsAudienceRestrictions() {
    List<AudienceRestriction> audienceRestrictions = ImmutableList.of(anAudienceRestriction().build());
    when(conditions.getAudienceRestrictions()).thenReturn(audienceRestrictions);

    validator.validate(conditions, "some-entity-id");

    verify(audienceRestrictionValidator).validate(audienceRestrictions, "some-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldNotComplainWhenCorrectDataIsPassed() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI("some-entity-id");

    AudienceRestriction audienceRestriction = mock(AudienceRestriction.class, Answers.RETURNS_DEEP_STUBS);
    when(audienceRestriction.getAudiences()).thenReturn(ImmutableList.of(audience));

    validator.validate(ImmutableList.of(audienceRestriction), "some-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldThrowExceptionWhenAudienceRestrictionsIsNull() {
    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage("Exactly one audience restriction is expected.");

    List<AudienceRestriction> audienceRestrictions = null;
    validator.validate(audienceRestrictions, "any-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldThrowExceptionWhenAudienceRestrictionsHasMoreThanOneElements() {
    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage("Exactly one audience restriction is expected.");

    List<AudienceRestriction> audienceRestrictions = ImmutableList.of(
        anAudienceRestriction().build(),
        anAudienceRestriction().build()
    );

    validator.validate(audienceRestrictions, "any-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldThrowExceptionWhenAudiencesIsNull() {
    AudienceRestriction audienceRestriction = mock(AudienceRestriction.class, Answers.RETURNS_DEEP_STUBS);
    when(audienceRestriction.getAudiences()).thenReturn(null);

    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage("Exactly one audience is expected.");

    validator.validate(ImmutableList.of(audienceRestriction), "any-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldThrowExceptionWhenAudiencesIsMoreThanOne() {
    AudienceRestriction audienceRestriction = anAudienceRestriction().build();
    audienceRestriction.getAudiences().add(new AudienceBuilder().buildObject());
    audienceRestriction.getAudiences().add(new AudienceBuilder().buildObject());

    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage("Exactly one audience is expected.");

    validator.validate(ImmutableList.of(audienceRestriction), "any-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldThrowExceptionWhenAudienceUriDoesNotMatchTheEntityId() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI("some-entity-id");

    AudienceRestriction audienceRestriction = mock(AudienceRestriction.class, Answers.RETURNS_DEEP_STUBS);
    when(audienceRestriction.getAudiences()).thenReturn(ImmutableList.of(audience));

    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage(String.format("Audience must match entity ID. Expected %s but was %s", "unknown-entity-id", "some-entity-id"));

    validator.validate(ImmutableList.of(audienceRestriction), "unknown-entity-id");
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
public Assertion apply(MatchingServiceAssertion originalAssertion) {

        Assertion transformedAssertion = openSamlXmlObjectFactory.createAssertion();
        transformedAssertion.setIssueInstant(originalAssertion.getIssueInstant());

        Issuer transformedIssuer = openSamlXmlObjectFactory.createIssuer(originalAssertion.getIssuerId());
        transformedAssertion.setIssuer(transformedIssuer);
        transformedAssertion.setID(originalAssertion.getId());

        Subject subject = outboundAssertionToSubjectTransformer.transform(originalAssertion);
        transformedAssertion.setSubject(subject);

        MatchingServiceAuthnStatement authnStatement = originalAssertion.getAuthnStatement();

        transformedAssertion.getAuthnStatements().add(matchingServiceAuthnStatementToAuthnStatementTransformer.transform(authnStatement));

        Conditions conditions = openSamlXmlObjectFactory.createConditions();
        AudienceRestriction audienceRestriction = openSamlXmlObjectFactory.createAudienceRestriction(originalAssertion.getAudience());
        conditions.getAudienceRestrictions().add(audienceRestriction);
        transformedAssertion.setConditions(conditions);

        List<Attribute> userAttributesForAccountCreation = originalAssertion.getUserAttributesForAccountCreation();
        if (!userAttributesForAccountCreation.isEmpty()) {
            addAttributes(transformedAssertion, userAttributesForAccountCreation);
        }


        return transformedAssertion;
    }
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
public AudienceRestrictionValidator(final Function<T, AudienceRestriction> valueProvider, final String audienceUri) {
    super(
        true,
        valueProvider,
        new RequiredValidator<>(DEFAULT_REQUIRED_MESSAGE),
        new FixedErrorValidator<>(audienceRestriction -> audienceRestriction.getAudiences().size() != 1, DEFAULT_AUDIENCES_MUST_CONTAIN_ONE_AUDIENCE_MESSAGE),
        new AudienceValidator<>(audienceRestriction -> audienceRestriction.getAudiences().get(0), audienceUri)
    );
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
private static Conditions aConditions() {
    Conditions conditions = new ConditionsBuilder().buildObject();
    conditions.setNotBefore(DateTime.now());
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(10));
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(HUB_SECONDARY_ENTITY_ID);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
private static Conditions aConditions() {
    Conditions conditions = new ConditionsBuilder().buildObject();
    conditions.setNotBefore(DateTime.now());
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(10));
    AudienceRestriction audienceRestriction = new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(HUB_SECONDARY_ENTITY_ID);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
private Conditions aConditions() {
    Conditions conditions = new ConditionsBuilder().buildObject();
    conditions.setNotBefore(DateTime.now());
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(10));
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(HUB_CONNECTOR_ENTITY_ID);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldReturnErrorIfAudiencesInAudienceRestrictionIsNotFound() {
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();

    Messages messages = validator.validate(audienceRestriction, messages());

    assertThat(messages.size()).isEqualTo(1);
    assertThat(messages.hasErrorLike(DEFAULT_AUDIENCES_MUST_CONTAIN_ONE_AUDIENCE_MESSAGE)).isTrue();
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
@Test
public void shouldValidateAudienceRestrictionSuccessfully() {
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(AUDIENCE_URI);
    audienceRestriction.getAudiences().add(audience);

    Messages messages = validator.validate(audienceRestriction, messages());

    assertThat(messages.size()).isEqualTo(0);
}
 

import org.opensaml.saml.saml2.core.AudienceRestriction; //导入依赖的package包/类
/**
 * Validates the SAML 2.0 Audience Restrictions set in the specified SAML 2.0 Assertion.
 *
 * @param assertion the SAML 2.0 Assertion in which Audience Restrictions' validity is checked for
 * @throws SSOException if the Audience Restriction validation fails
 */
private void validateAudienceRestriction(Assertion assertion) throws SSOException {
    if (assertion == null) {
        return;
    }

    Conditions conditions = assertion.getConditions();
    if (conditions == null) {
        throw new SSOException("SAML 2.0 Response doesn't contain Conditions");
    }

    List<AudienceRestriction> audienceRestrictions = conditions.getAudienceRestrictions();
    if ((audienceRestrictions == null) || (audienceRestrictions.isEmpty())) {
        throw new SSOException("SAML 2.0 Response doesn't contain AudienceRestrictions");
    }

    Stream<AudienceRestriction> audienceExistingStream = audienceRestrictions
            .stream()
            .filter(audienceRestriction ->
                    (((audienceRestriction.getAudiences() != null) && (!audienceRestriction.getAudiences().
                            isEmpty()))) && (audienceRestriction.getAudiences()
                            .stream()
                            .filter(audience -> contextConfiguration.getIssuerId().equals(audience.
                                    getAudienceURI())))
                            .count() > 0);

    if (audienceExistingStream.count() == 0) {
        throw new SSOException("SAML 2.0 Assertion Audience Restriction validation failed");
    }
}