import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
private static void buildEntityRoleFilterIfNeeded(final SamlRegisteredService service, final List<MetadataFilter> metadataFilterList) {
    if (StringUtils.isNotBlank(service.getMetadataCriteriaRoles())) {
        final List<QName> roles = new ArrayList<>();
        final Set<String> rolesSet = org.springframework.util.StringUtils.commaDelimitedListToSet(service.getMetadataCriteriaRoles());
        rolesSet.stream().forEach(s -> {
            if (s.equalsIgnoreCase(SPSSODescriptor.DEFAULT_ELEMENT_NAME.getLocalPart())) {
                LOGGER.debug("Added entity role filter [{}]", SPSSODescriptor.DEFAULT_ELEMENT_NAME);
                roles.add(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
            }
            if (s.equalsIgnoreCase(IDPSSODescriptor.DEFAULT_ELEMENT_NAME.getLocalPart())) {
                LOGGER.debug("Added entity role filter [{}]", IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
                roles.add(IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
            }
        });
        final EntityRoleFilter filter = new EntityRoleFilter(roles);
        filter.setRemoveEmptyEntitiesDescriptors(service.isMetadataCriteriaRemoveEmptyEntitiesDescriptors());
        filter.setRemoveRolelessEntityDescriptors(service.isMetadataCriteriaRemoveRolelessEntityDescriptors());

        metadataFilterList.add(filter);
        LOGGER.debug("Added entity role filter with roles [{}]", roles);
    }
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
public SamlMessage generateAuthnRequestFromHub(SessionId sessionId, String principalIpAddress) {
    AuthnRequestFromHubContainerDto authnRequestFromHub = sessionProxy.getAuthnRequestFromHub(sessionId);

    AuthnRequest request = authnRequestTransformer.apply(authnRequestFromHub.getSamlRequest());

    SamlValidationResponse samlSignatureValidationResponse = samlMessageSignatureValidator.validate(request, SPSSODescriptor.DEFAULT_ELEMENT_NAME);
    protectiveMonitoringLogger.logAuthnRequest(request, Direction.OUTBOUND, samlSignatureValidationResponse.isOK());

    if (!samlSignatureValidationResponse.isOK()) {
        SamlValidationSpecificationFailure failure = samlSignatureValidationResponse.getSamlValidationSpecificationFailure();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), samlSignatureValidationResponse.getCause(), Level.ERROR);
    }
    SamlMessage samlMessage = new SamlMessage(authnRequestFromHub.getSamlRequest(), SamlMessageType.SAML_REQUEST, Optional.fromNullable(sessionId.toString()), authnRequestFromHub.getPostEndpoint().toString(), Optional.of(authnRequestFromHub.getRegistering()));

    externalCommunicationEventLogger.logIdpAuthnRequest(request.getID(), sessionId, authnRequestFromHub.getPostEndpoint(), principalIpAddress);
    return samlMessage;
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Timed
public Response handleRequestPost(SamlRequestDto samlRequestDto) {

    relayStateValidator.validate(samlRequestDto.getRelayState());

    AuthnRequest authnRequest = stringSamlAuthnRequestTransformer.apply(samlRequestDto.getSamlRequest());

    SamlValidationResponse signatureValidationResponse = authnRequestSignatureValidator.validate(authnRequest, SPSSODescriptor.DEFAULT_ELEMENT_NAME);

    protectiveMonitoringLogger.logAuthnRequest(authnRequest, Direction.INBOUND, signatureValidationResponse.isOK());

    if (!signatureValidationResponse.isOK()) {
        SamlValidationSpecificationFailure failure = signatureValidationResponse.getSamlValidationSpecificationFailure();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), signatureValidationResponse.getCause(), Level.ERROR);
    }

    SamlAuthnRequestContainerDto samlAuthnRequestContainerDto = new SamlAuthnRequestContainerDto(samlRequestDto.getSamlRequest(), Optional.ofNullable(samlRequestDto.getRelayState()), samlRequestDto.getPrincipalIpAsSeenByFrontend());

    SessionId sessionId = sessionProxy.createSession(samlAuthnRequestContainerDto);
    return Response.ok(sessionId).build();
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
public InboundMatchingServiceRequest apply(final AttributeQuery attributeQuery) {
    samlAttributeQueryValidator.validate(attributeQuery);
    ValidatedAttributeQuery validatedAttributeQuery = attributeQuerySignatureValidator.validate(attributeQuery);

    List<Assertion> assertions = assertionDecrypter.decryptAssertions(validatedAttributeQuery);

    Map<Boolean, List<Assertion>> map = assertions.stream().collect(Collectors.groupingBy(this::isHubAssertion));
    List<Assertion> hubAssertions = map.getOrDefault(true, Collections.emptyList());
    List<Assertion> idpAssertions = map.getOrDefault(false, Collections.emptyList());

    samlAttributeQueryAssertionsValidator.validateHubAssertions(validatedAttributeQuery, hubAssertions);
    samlAttributeQueryAssertionsValidator.validateIdpAssertions(validatedAttributeQuery, idpAssertions);

    ValidatedAssertions validatedHubAssertions = samlAssertionsSignatureValidator.validate(hubAssertions, SPSSODescriptor.DEFAULT_ELEMENT_NAME);
    ValidatedAssertions validatedIdpAssertions = samlAssertionsSignatureValidator.validate(idpAssertions, IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
    return inboundMatchingServiceRequestUnmarshaller.fromSaml(validatedAttributeQuery, validatedHubAssertions, validatedIdpAssertions);
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
private EntityDescriptor badHubEntityDescriptor() {
    X509Certificate x509CertificateOne = X509CertificateBuilder.aX509Certificate().withCert(TestCertificateStrings.UNCHAINED_PUBLIC_CERT).build();
    X509Data x509DataOne = X509DataBuilder.aX509Data().withX509Certificate(x509CertificateOne).build();
    KeyInfo signingOne = KeyInfoBuilder.aKeyInfo().withKeyName("signing_one").withX509Data(x509DataOne).build();
    KeyDescriptor keyDescriptorOne = KeyDescriptorBuilder.aKeyDescriptor().withKeyInfo(signingOne).build();
    SPSSODescriptor spssoDescriptor = SPSSODescriptorBuilder.anSpServiceDescriptor()
            .addKeyDescriptor(keyDescriptorOne)
            .withoutDefaultSigningKey()
            .withoutDefaultEncryptionKey().build();
    try {
        return EntityDescriptorBuilder.anEntityDescriptor()
                .withEntityId(HUB_ENTITY_ID)
                .addSpServiceDescriptor(spssoDescriptor)
                .withIdpSsoDescriptor(null)
                .withValidUntil(DateTime.now().plusHours(1))
                .withSignature(null)
                .withoutSigning()
                .build();
    } catch (MarshallingException | SignatureException e) {
        throw propagate(e);
    }
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
/**
 * Gets SP SSO descriptor.
 *
 * @param entityDescriptor the entity descriptor
 * @return the SP SSO descriptor
 */
private SPSSODescriptor getSPSsoDescriptor(final EntityDescriptor entityDescriptor) {
    logger.debug("Locating SP SSO descriptor for SAML2 protocol...");
    SPSSODescriptor spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (spssoDescriptor == null) {
        logger.debug("Locating SP SSO descriptor for SAML11 protocol...");
        spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML11P_NS);
    }
    if (spssoDescriptor == null) {
        logger.debug("Locating SP SSO descriptor for SAML1 protocol...");
        spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML10P_NS);
    }
    logger.debug("SP SSO descriptor resolved to be [{}]", spssoDescriptor);
    return spssoDescriptor;
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
/**
 * Gets SP SSO descriptor.
 *
 * @param entityDescriptor the entity descriptor
 * @return the sPSSO descriptor
 */
private SPSSODescriptor getSPSSODescriptor(final EntityDescriptor entityDescriptor) {
    logger.debug("Locating SP SSO descriptor for SAML2 protocol...");
    SPSSODescriptor spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (spssoDescriptor == null) {
        logger.debug("Locating SP SSO descriptor for SAML11 protocol...");
        spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML11P_NS);
    }
    if (spssoDescriptor == null) {
        logger.debug("Locating SP SSO descriptor for SAML1 protocol...");
        spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML10P_NS);
    }
    logger.debug("SP SSO descriptor resolved to be [{}]", spssoDescriptor);
    return spssoDescriptor;
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
private SamlRegisteredServiceServiceProviderMetadataFacade(final SPSSODescriptor ssoDescriptor,
                                                           final EntityDescriptor entityDescriptor,
                                                           final MetadataResolver metadataResolver) {
    this.ssoDescriptor = ssoDescriptor;
    this.entityDescriptor = entityDescriptor;
    this.metadataResolver = metadataResolver;
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
private static Optional<SamlRegisteredServiceServiceProviderMetadataFacade> get(final SamlRegisteredServiceCachingMetadataResolver resolver,
                                                                                final SamlRegisteredService registeredService,
                                                                                final String entityID,
                                                                                final CriteriaSet criterions) {
    LOGGER.info("Adapting SAML metadata for CAS service [{}] issued by [{}]",
            registeredService.getName(), entityID);
    try {
        criterions.add(new BindingCriterion(Collections.singletonList(SAMLConstants.SAML2_POST_BINDING_URI)));
        criterions.add(new EntityIdCriterion(entityID));

        LOGGER.info("Locating metadata for entityID [{}] with binding [{}] by attempting to run through the metadata chain...",
                entityID, SAMLConstants.SAML2_POST_BINDING_URI);
        final ChainingMetadataResolver chainingMetadataResolver = resolver.resolve(registeredService);
        LOGGER.info("Resolved metadata chain for service [{}]. Filtering the chain by entity ID [{}] and binding [{}]",
                registeredService.getServiceId(), entityID, SAMLConstants.SAML2_POST_BINDING_URI);

        final EntityDescriptor entityDescriptor = chainingMetadataResolver.resolveSingle(criterions);
        if (entityDescriptor == null) {
            LOGGER.debug("Cannot find entity [{}] in metadata provider.", entityID);
            return Optional.empty();
        }
        LOGGER.debug("Located EntityDescriptor in metadata for [{}]", entityID);
        final SPSSODescriptor ssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
        if (ssoDescriptor != null) {
            LOGGER.debug("Located SPSSODescriptor in metadata for [{}]. Metadata is valid until [{}]",
                    entityID, ssoDescriptor.getValidUntil());
            return Optional.of(new SamlRegisteredServiceServiceProviderMetadataFacade(ssoDescriptor, entityDescriptor, chainingMetadataResolver));
        }
        LOGGER.warn("Could not locate SPSSODescriptor in the metadata for [{}]", entityID);
        return Optional.empty();
    } catch (final Exception e) {
        throw new RuntimeException(e.getMessage(), e);
    }
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
/**
 * Gets SP SSO descriptor.
 *
 * @param entityDescriptor the entity descriptor
 * @return the SP SSO descriptor
 */
public static SPSSODescriptor getSPSsoDescriptor(final EntityDescriptor entityDescriptor) {
    LOGGER.debug("Locating SP SSO descriptor for SAML2 protocol...");
    SPSSODescriptor spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML20P_NS);
    if (spssoDescriptor == null) {
        LOGGER.debug("Locating SP SSO descriptor for SAML11 protocol...");
        spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML11P_NS);
    }
    if (spssoDescriptor == null) {
        LOGGER.debug("Locating SP SSO descriptor for SAML1 protocol...");
        spssoDescriptor = entityDescriptor.getSPSSODescriptor(SAMLConstants.SAML10P_NS);
    }
    LOGGER.debug("SP SSO descriptor resolved to be [{}]", spssoDescriptor);
    return spssoDescriptor;
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
/**
 * Locate mdui for entity id simple metadata ui info.
 *
 * @param entityDescriptor  the entity descriptor
 * @param entityId          the entity id
 * @param registeredService the registered service
 * @return the simple metadata ui info
 */
public static SamlMetadataUIInfo locateMetadataUserInterfaceForEntityId(final EntityDescriptor entityDescriptor,
                                                                        final String entityId,
                                                                        final RegisteredService registeredService) {
    final SamlMetadataUIInfo mdui = new SamlMetadataUIInfo(registeredService);
    if (entityDescriptor == null) {
        LOGGER.debug("Entity descriptor not found for [{}]", entityId);
        return mdui;
    }

    final SPSSODescriptor spssoDescriptor = getSPSsoDescriptor(entityDescriptor);
    if (spssoDescriptor == null) {
        LOGGER.debug("SP SSO descriptor not found for [{}]", entityId);
        return mdui;
    }

    final Extensions extensions = spssoDescriptor.getExtensions();
    if (extensions == null) {
        LOGGER.debug("No extensions in the SP SSO descriptor are found for [{}]", UIInfo.DEFAULT_ELEMENT_NAME.getNamespaceURI());
        return mdui;
    }

    final List<XMLObject> spExtensions = extensions.getUnknownXMLObjects(UIInfo.DEFAULT_ELEMENT_NAME);
    if (spExtensions.isEmpty()) {
        LOGGER.debug("No extensions in the SP SSO descriptor are located for [{}]", UIInfo.DEFAULT_ELEMENT_NAME.getNamespaceURI());
        return mdui;
    }

    spExtensions.stream().filter(UIInfo.class::isInstance).forEach(obj -> {
        final UIInfo uiInfo = (UIInfo) obj;
        LOGGER.debug("Found MDUI info for [{}]", entityId);
        mdui.setUIInfo(uiInfo);
    });
    return mdui;
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
private void validateAndLogSamlResponseSignature(Response samlResponse) {
    boolean isSigned = samlResponse.getIssuer() != null;
    if (isSigned) {
        SamlValidationResponse signatureValidationResponse = samlMessageSignatureValidator.validate(samlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME);
        protectiveMonitoringLogger.logAuthnResponse(samlResponse, Direction.OUTBOUND, signatureValidationResponse.isOK());

        if (!signatureValidationResponse.isOK()) {
            SamlValidationSpecificationFailure failure = signatureValidationResponse.getSamlValidationSpecificationFailure();
            throw new SamlTransformationErrorException(failure.getErrorMessage(), signatureValidationResponse.getCause(), Level.ERROR);
        }
    } else {
        protectiveMonitoringLogger.logAuthnResponse(samlResponse, Direction.OUTBOUND, null);
    }
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateAuthRequestFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    when(sessionProxy.getAuthnRequestFromHub(sessionId)).thenReturn(new AuthnRequestFromHubContainerDto(samlRequest, postEndPoint, true));
    AuthnRequest authnRequest = anAuthnRequest().withId(expectedSamlMessageId).build();
    when(authnRequestTransformer.apply(samlRequest)).thenReturn(authnRequest);
    when(samlMessageSignatureValidator.validate(authnRequest, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateAuthnRequestFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateAuthResponseFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    Response openSamlResponse = setUpAuthnResponseFromHub(sessionId, expectedSamlMessageId);

    when(samlMessageSignatureValidator.validate(openSamlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateAuthnResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateErrorResponseFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    Response openSamlResponse = setUpErrorResponseFromHub(sessionId, expectedSamlMessageId);
    when(samlMessageSignatureValidator.validate(openSamlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateErrorResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
public TranslatedResponseBody convertTranslatedResponseBody(
    String decodedSamlResponse,
    String expectedInResponseTo,
    LevelOfAssurance expectedLevelOfAssurance,
    String entityId
) {
    Response response = stringToOpenSamlObjectTransformer.apply(decodedSamlResponse);

    ValidatedResponse validatedResponse = responseSignatureValidator.validate(response, SPSSODescriptor.DEFAULT_ELEMENT_NAME);

    if (!expectedInResponseTo.equals(validatedResponse.getInResponseTo())) {
        throw new SamlResponseValidationException(
            String.format("Expected InResponseTo to be %s, but was %s", expectedInResponseTo, response.getInResponseTo())
        );
    }

    instantValidator.validate(validatedResponse.getIssueInstant(), "Response IssueInstant");

    StatusCode statusCode = validatedResponse.getStatus().getStatusCode();

    switch (statusCode.getValue()) {
        case StatusCode.RESPONDER:
            return translateNonSuccessResponse(statusCode);
        case StatusCode.SUCCESS:
            List<Assertion> assertions = assertionDecrypter.decryptAssertions(validatedResponse);
            return assertionTranslator.translate(assertions, expectedInResponseTo, expectedLevelOfAssurance, entityId);
        default:
            throw new SamlResponseValidationException(String.format("Unknown SAML status: %s", statusCode.getValue()));
    }
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
public final AssertionConsumerService getSPAssertionConsumerService(final String acsIndex) {
    final SPSSODescriptor spssoDescriptor = getSPSSODescriptor();
    final List<AssertionConsumerService> services = spssoDescriptor.getAssertionConsumerServices();

    // Get by index
    if (acsIndex != null) {
        for (final AssertionConsumerService service : services) {
            if (Integer.valueOf(acsIndex).equals(service.getIndex())) {
                return service;
            }
        }
        throw new SAMLException("Assertion consumer service with index " + acsIndex
                + " could not be found for spDescriptor " + spssoDescriptor);
    }

    // Get default
    if (spssoDescriptor.getDefaultAssertionConsumerService() != null) {
        return spssoDescriptor.getDefaultAssertionConsumerService();
    }

    // Get first
    if (!services.isEmpty()) {
        return services.iterator().next();
    }

    throw new SAMLException("No assertion consumer services could be found for " + spssoDescriptor);
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
protected final void invokeOutboundMessageHandlers(final SPSSODescriptor spDescriptor,
                                                   final IDPSSODescriptor idpssoDescriptor,
                                                   final SAML2MessageContext outboundContext) {

    try {
        final EndpointURLSchemeSecurityHandler handlerEnd =
                new EndpointURLSchemeSecurityHandler();
        handlerEnd.initialize();
        handlerEnd.invoke(outboundContext);

        final SAMLOutboundDestinationHandler handlerDest =
                new SAMLOutboundDestinationHandler();
        handlerDest.initialize();
        handlerDest.invoke(outboundContext);

        if (spDescriptor.isAuthnRequestsSigned()) {
            final SAMLOutboundProtocolMessageSigningHandler handler = new
                    SAMLOutboundProtocolMessageSigningHandler();
            handler.invoke(outboundContext);

        } else if (idpssoDescriptor.getWantAuthnRequestsSigned()) {
            logger.warn("IdP wants authn requests signed, it will perhaps reject your authn requests unless you provide a keystore");
        }
    } catch (final Exception e) {
        throw new SAMLException(e);
    }

}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
@VisibleForTesting
Boolean wantsAssertionsSigned(SAML2MessageContext context) {
    if (context == null) return wantsAssertionsSigned;
    SPSSODescriptor spDescriptor = context.getSPSSODescriptor();
    if (spDescriptor == null) return wantsAssertionsSigned;
    return spDescriptor.getWantAssertionsSigned();
}
 

import org.opensaml.saml.saml2.metadata.SPSSODescriptor; //导入依赖的package包/类
@Test
public void testDoesNotWantAssertionsSignedWithValidSPSSODescriptor() throws Exception {
    SAML2DefaultResponseValidator validator = createResponseValidatorWithSigningValidationOf(false);
    SAML2MessageContext context = new SAML2MessageContext();

    SAMLMetadataContext samlSelfMetadataContext = context.getSAMLSelfMetadataContext();
    SPSSODescriptor roleDescriptor = mock(SPSSODescriptor.class);
    when(roleDescriptor.getWantAssertionsSigned()).thenReturn(false);
    samlSelfMetadataContext.setRoleDescriptor(roleDescriptor);

    assertNotNull("Expected SPSSODescriptor to not be null", context.getSPSSODescriptor());
    assertFalse("Expected wantAssertionsSigned == false", validator.wantsAssertionsSigned(context));
}