import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
/**
 * Applies the XML Digital Signature to the SAML 2.0 based Request.
 *
 * @param request            the SAML 2.0 based Request
 * @param signatureAlgorithm the algorithm used to compute the signature
 * @param credential         the signature signing credential
 * @return the SAML 2.0 based Request with XML Digital Signature set
 * @throws SSOException if an error occurs while signing the SAML 2.0 based Request message
 */
public static RequestAbstractType setSignature(RequestAbstractType request, String signatureAlgorithm,
                                               X509Credential credential) throws SSOException {
    try {
        Signature signature = setSignatureRaw(signatureAlgorithm, credential);
        request.setSignature(signature);

        List<Signature> signatureList = new ArrayList<>();
        signatureList.add(signature);

        //  marshall and sign
        Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(request);
        if (marshaller != null) {
            marshaller.marshall(request);
        }

        //  initializes and configures the library
        Init.init();
        //  signer is responsible for creating the digital signatures for the given XML Objects,
        //  signs the XML Objects based on the given order of the Signature list
        Signer.signObjects(signatureList);
        return request;
    } catch (MarshallingException | SignatureException e) {
        throw new SSOException("Error while signing the SAML 2.0 Request message", e);
    }
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test
public void generateErrorResponseFromHub_shouldAddExternalCommunicationEvent() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String responseId = UUID.randomUUID().toString();

    when(sessionProxy.getErrorResponseFromHub(sessionId)).thenReturn(new AuthnResponseFromHubContainerDto(samlRequest, postEndPoint, relayState, responseId));
    Response samlResponse = setUpErrorResponseFromHub(sessionId, responseId);
    when(responseTransformer.apply(samlRequest)).thenReturn(samlResponse);

    SamlMessage samlMessage = samlMessageSenderHandler.generateErrorResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
    assertThat(samlMessage.getSamlMessage()).isEqualTo(samlRequest);
    assertThat(samlMessage.getPostEndpoint()).isEqualTo(postEndPoint.toString());
    assertThat(samlMessage.getRegistration().isPresent()).isFalse();
    assertThat(samlMessage.getSamlMessageType()).isEqualTo(SamlMessageType.SAML_RESPONSE);
    assertThat(samlMessage.getRelayState().isPresent()).isTrue();
    assertThat(samlMessage.getRelayState()).isEqualTo(relayState);

    verify(externalCommunicationEventLogger).logResponseFromHub(responseId, sessionId, postEndPoint, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test
public void shouldFormatAuthnSuccessResponse() throws IOException, URISyntaxException, MarshallingException, SignatureException {
    Response response = aResponse().build();

    String logString = new ProtectiveMonitoringLogFormatter().formatAuthnResponse(response, Direction.INBOUND, true);

    String expectedLogMessage = "Protective Monitoring – Authn Response Event – " +
            "{responseId: default-response-id, " +
            "inResponseTo: default-request-id, " +
            "direction: INBOUND, " +
            "destination: http://destination.com, " +
            "issuerId: a-test-entity, " +
            "validSignature: true, " +
            "status: urn:oasis:names:tc:SAML:2.0:status:Success, " +
            "subStatus: , " +
            "statusDetails: []}";
    assertThat(logString).isEqualTo(expectedLogMessage);
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private void verifyAssertionSignature(Assertion assertion) {

        if (!assertion.isSigned()) {
            throw new RuntimeException("The SAML Assertion was not signed");
        }

        try {
            SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();
            profileValidator.validate(assertion.getSignature());

            SignatureValidator.validate(assertion.getSignature(), IDPCredentials.getCredential());

            logger.info("SAML Assertion signature verified");
        } catch (SignatureException e) {
            e.printStackTrace();
        }

    }
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
public AuthnRequest build(LevelOfAssurance levelOfAssurance, String serviceEntityId) {
    AuthnRequest authnRequest = new AuthnRequestBuilder().buildObject();
    authnRequest.setID(String.format("_%s", UUID.randomUUID()));
    authnRequest.setIssueInstant(DateTime.now());
    authnRequest.setForceAuthn(false);
    authnRequest.setDestination(destination.toString());
    authnRequest.setExtensions(createExtensions());

    Issuer issuer = new IssuerBuilder().buildObject();
    issuer.setValue(serviceEntityId);
    authnRequest.setIssuer(issuer);

    authnRequest.setSignature(createSignature());

    try {
        XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(authnRequest).marshall(authnRequest);
        Signer.signObject(authnRequest.getSignature());
    } catch (SignatureException | MarshallingException e) {
        throw new SAMLRuntimeException("Unknown problem while signing SAML object", e);
    }

    return authnRequest;
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private EntityDescriptor badHubEntityDescriptor() {
    X509Certificate x509CertificateOne = X509CertificateBuilder.aX509Certificate().withCert(TestCertificateStrings.UNCHAINED_PUBLIC_CERT).build();
    X509Data x509DataOne = X509DataBuilder.aX509Data().withX509Certificate(x509CertificateOne).build();
    KeyInfo signingOne = KeyInfoBuilder.aKeyInfo().withKeyName("signing_one").withX509Data(x509DataOne).build();
    KeyDescriptor keyDescriptorOne = KeyDescriptorBuilder.aKeyDescriptor().withKeyInfo(signingOne).build();
    SPSSODescriptor spssoDescriptor = SPSSODescriptorBuilder.anSpServiceDescriptor()
            .addKeyDescriptor(keyDescriptorOne)
            .withoutDefaultSigningKey()
            .withoutDefaultEncryptionKey().build();
    try {
        return EntityDescriptorBuilder.anEntityDescriptor()
                .withEntityId(HUB_ENTITY_ID)
                .addSpServiceDescriptor(spssoDescriptor)
                .withIdpSsoDescriptor(null)
                .withValidUntil(DateTime.now().plusHours(1))
                .withSignature(null)
                .withoutSigning()
                .build();
    } catch (MarshallingException | SignatureException e) {
        throw propagate(e);
    }
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
/**
 * Applies the XML Digital Signature to the HTTP query string specified.
 *
 * @param httpQueryString the primary HTTP query string which is to be digitally signed
 * @param credential      an entity credential associated with X.509 Public Key Infrastructure
 * @throws SSOException if an error occurs while applying the SAML 2.0 Redirect binding signature
 */
public static void addDeflateSignatureToHTTPQueryString(StringBuilder httpQueryString, X509Credential credential)
        throws SSOException {
    try {
        httpQueryString.append("&SigAlg=").
                append(URLEncoder.encode(XMLSignature.ALGO_ID_SIGNATURE_RSA, StandardCharsets.UTF_8.name()).trim());

        java.security.Signature signature = java.security.Signature.getInstance("SHA1withRSA");
        signature.initSign(credential.getPrivateKey());
        signature.update(httpQueryString.toString().getBytes(StandardCharsets.UTF_8));
        byte[] signatureByteArray = signature.sign();

        String signatureBase64EncodedString = Base64Support.encode(signatureByteArray, false);
        httpQueryString.append("&Signature=").
                append(URLEncoder.encode(signatureBase64EncodedString, StandardCharsets.UTF_8.name()).trim());
    } catch (NoSuchAlgorithmException | InvalidKeyException |
            java.security.SignatureException | UnsupportedEncodingException e) {
        throw new SSOException("Error applying SAML 2.0 Redirect Binding signature", e);
    }
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
public static EntityDescriptor createCountryEntityDescriptor(String entityID) {
    Signature entityDescriptorSignature = createSignature();
    KeyDescriptor keyDescriptor = KeyDescriptorBuilder.aKeyDescriptor().withX509ForSigning(TEST_PUBLIC_CERT).build();
    IDPSSODescriptor idpssoDescriptor = IdpSsoDescriptorBuilder
            .anIdpSsoDescriptor()
            .addKeyDescriptor(keyDescriptor)
            .build();
    try {
        return getEntityDescriptor(entityID, idpssoDescriptor, entityDescriptorSignature);
    } catch (MarshallingException | SignatureException e) {
        throw Throwables.propagate(e);
    }
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private static EntityDescriptor getEntityDescriptor(String entityID, IDPSSODescriptor idpssoDescriptor, Signature entityDescriptorSignature) throws MarshallingException, SignatureException {
    return EntityDescriptorBuilder
            .anEntityDescriptor()
            .withEntityId(entityID)
            .withIdpSsoDescriptor(idpssoDescriptor)
            .withSignature(entityDescriptorSignature)
            .build();
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateAuthRequestFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    when(sessionProxy.getAuthnRequestFromHub(sessionId)).thenReturn(new AuthnRequestFromHubContainerDto(samlRequest, postEndPoint, true));
    AuthnRequest authnRequest = anAuthnRequest().withId(expectedSamlMessageId).build();
    when(authnRequestTransformer.apply(samlRequest)).thenReturn(authnRequest);
    when(samlMessageSignatureValidator.validate(authnRequest, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateAuthnRequestFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateAuthResponseFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    Response openSamlResponse = setUpAuthnResponseFromHub(sessionId, expectedSamlMessageId);

    when(samlMessageSignatureValidator.validate(openSamlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateAuthnResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateErrorResponseFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    Response openSamlResponse = setUpErrorResponseFromHub(sessionId, expectedSamlMessageId);
    when(samlMessageSignatureValidator.validate(openSamlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateErrorResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private Response setUpAuthnResponseFromHub(SessionId sessionId, String expectedSamlMessageId) throws MarshallingException, SignatureException {
    AuthnResponseFromHubContainerDto hubContainerDto = new AuthnResponseFromHubContainerDto(samlRequest, postEndPoint, relayState, expectedSamlMessageId);
    when(sessionProxy.getAuthnResponseFromHub(sessionId)).thenReturn(hubContainerDto);
    Response openSamlResponse = aResponse().withId(expectedSamlMessageId).build();
    when(responseTransformer.apply(anyString())).thenReturn(openSamlResponse);
    return openSamlResponse;
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private Response setUpErrorResponseFromHub(SessionId sessionId, String expectedSamlMessageId) throws MarshallingException, SignatureException {
    AuthnResponseFromHubContainerDto hubContainerDto = new AuthnResponseFromHubContainerDto(samlRequest, postEndPoint, relayState, expectedSamlMessageId);
    when(sessionProxy.getErrorResponseFromHub(sessionId)).thenReturn(hubContainerDto);
    Response openSamlResponse = aResponse().withId(expectedSamlMessageId).build();
    when(responseTransformer.apply(anyString())).thenReturn(openSamlResponse);
    return openSamlResponse;
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Before
public void setUp() throws MarshallingException, SignatureException {
    samlMessageReceiverApi = new SamlMessageReceiverApi(
            relayStateValidator,
            stringSamlAuthnRequestTransformer,
            stringSamlResponseTransformer,
            samlMessageSignatureValidator,
            samlMessageSignatureValidator,
            Optional.of(samlMessageSignatureValidator),
            protectiveMonitoringLogger,
            sessionProxy);
    validSamlResponse = aValidIdpResponse().build();
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test
public void handleResponsePost_shouldReturnActionDtoOnSuccessfulRegistration() throws MarshallingException, SignatureException {
    ResponseActionDto responseActionDto = ResponseActionDto.success(SESSION_ID, true, LevelOfAssurance.LEVEL_2);
    when(stringSamlResponseTransformer.apply(SAML_REQUEST)).thenReturn(validSamlResponse);
    when(samlMessageSignatureValidator.validate(any(org.opensaml.saml.saml2.core.Response.class), any(QName.class))).thenReturn(SamlValidationResponse.aValidResponse());
    when(sessionProxy.receiveAuthnResponseFromIdp(any(SamlAuthnResponseContainerDto.class), eq(SESSION_ID))).thenReturn(responseActionDto);

    Response response = samlMessageReceiverApi.handleResponsePost(SAML_REQUEST_DTO);

    assertThat(response.getStatus()).isEqualTo(Status.OK.getStatusCode());
    assertThat(response.getEntity()).isEqualTo(responseActionDto);
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
@Test
public void shouldFormatResponseWithNoIssuer() throws IOException, URISyntaxException, MarshallingException, SignatureException {
    Response response = aResponse().withIssuer(null).build();

    String logString = new ProtectiveMonitoringLogFormatter().formatAuthnResponse(response, Direction.INBOUND, true);

    assertThat(logString).contains("issuerId: ,");
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private String aValidMatchResponseFromMatchingService(final String requestId, final Status status, DateTime notOnOrAfter) throws MarshallingException, SignatureException {
    Credential signingCredential = new TestCredentialFactory(TEST_RP_MS_PUBLIC_SIGNING_CERT, TEST_RP_MS_PRIVATE_SIGNING_KEY).getSigningCredential();
    return XmlUtils.writeToString(aResponse()
            .withStatus(status)
            .withInResponseTo(requestId)
            .withIssuer(anIssuer().withIssuerId(TEST_RP_MS).build())
            .withSigningCredential(signingCredential)
            .addEncryptedAssertion(
                    anAssertion()
                            .withSubject(
                                    aSubject()
                                            .withSubjectConfirmation(
                                                    aSubjectConfirmation()
                                                            .withSubjectConfirmationData(
                                                                    aSubjectConfirmationData()
                                                                            .withInResponseTo(requestId)
                                                                            .withNotOnOrAfter(
                                                                                    notOnOrAfter
                                                                            )
                                                                            .build()
                                                            )
                                                            .build()
                                            )
                                            .build()
                            )
                            .withIssuer(anIssuer().withIssuerId(TEST_RP_MS).build())
                            .withSignature(aSignature().withSigningCredential(signingCredential).build())
                            .addAuthnStatement(anAuthnStatement().build())
                            .buildWithEncrypterCredential(new EncryptionCredentialFactory(entityId -> {
                                PublicKeyFactory keyFactory = new PublicKeyFactory(new X509CertificateFactory());
                                return keyFactory.createPublicKey(HUB_TEST_PUBLIC_ENCRYPTION_CERT);
                            }).getEncryptingCredential(HUB_ENTITY_ID))
            ).build().getDOM());
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private static EntityDescriptor getEntityDescriptor(String entityID, IDPSSODescriptor idpssoDescriptor, Signature entityDescriptorSignature) throws MarshallingException, SignatureException {
    return EntityDescriptorBuilder
        .anEntityDescriptor()
        .withEntityId(entityID)
        .withIdpSsoDescriptor(idpssoDescriptor)
        .withSignature(entityDescriptorSignature)
        .build();
}
 

import org.opensaml.xmlsec.signature.support.SignatureException; //导入依赖的package包/类
private String aValidMatchResponseFromMatchingService(final String requestId, final Status status, DateTime notOnOrAfter) throws MarshallingException, SignatureException {
    return XmlUtils.writeToString(aResponse()
            .withStatus(status)
            .withInResponseTo(requestId)
            .withIssuer(anIssuer().withIssuerId(TEST_RP_MS).build())
            .withSigningCredential(msaSigningCredential)
            .addEncryptedAssertion(
                    anAssertion()
                            .withSubject(
                                    aSubject()
                                            .withSubjectConfirmation(
                                                    aSubjectConfirmation()
                                                            .withSubjectConfirmationData(
                                                                    aSubjectConfirmationData()
                                                                            .withInResponseTo(requestId)
                                                                            .withNotOnOrAfter(
                                                                                    notOnOrAfter
                                                                            )
                                                                            .build()
                                                            )
                                                            .build()
                                            )
                                            .build()
                            )
                            .withIssuer(anIssuer().withIssuerId(TEST_RP_MS).build())
                            .withSignature(
                                    aSignature().withSigningCredential(msaSigningCredential).build()
                            )
                            .addAuthnStatement(anAuthnStatement().build())
                            .buildWithEncrypterCredential(new EncryptionCredentialFactory(entityId -> {
                                PublicKeyFactory keyFactory = new PublicKeyFactory(new X509CertificateFactory());
                                return keyFactory.createPublicKey(HUB_TEST_PUBLIC_ENCRYPTION_CERT);
                            }).getEncryptingCredential(HUB_ENTITY_ID))
            ).build().getDOM());
}