import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
public String formatAuthnResponse(Response samlResponse, Direction direction, Boolean validSignature) {
    Issuer issuer = samlResponse.getIssuer();
    String issuerString = issuer != null ? issuer.getValue() : "";

    Status status = samlResponse.getStatus();
    StatusCode subStatusCode = status.getStatusCode().getStatusCode();
    String subStatus = subStatusCode != null ? subStatusCode.getValue() : "";

    return String.format(AUTHN_RESPONSE,
            samlResponse.getID(),
            samlResponse.getInResponseTo(),
            direction,
            samlResponse.getDestination(),
            issuerString,
            validSignature,
            status.getStatusCode().getValue(),
            subStatus,
            getStatusDetailValues(status));
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldReturnADtoWhenResponseIs_RequesterError() throws Exception {
    final String requestId = "requestId";
    final String msaStatusCode = StatusCode.NO_AUTHN_CONTEXT;
    final Status status = aStatus().withStatusCode(aStatusCode().withSubStatusCode(aStatusCode().withValue(msaStatusCode).build()).withValue(REQUESTER).build()).build();
    final SamlResponseDto samlResponseDto = new SamlResponseDto(Base64.encodeAsString(aValidNoMatchResponseFromMatchingService(requestId, status, TEST_RP_MS)));

    Response clientResponse = postToSamlEngine(samlResponseDto);

    assertThat(clientResponse.getStatus()).isEqualTo(Response.Status.OK.getStatusCode());
    InboundResponseFromMatchingServiceDto inboundResponseFromMatchingServiceDto = clientResponse.readEntity(InboundResponseFromMatchingServiceDto.class);
    assertThat(inboundResponseFromMatchingServiceDto.getIssuer()).isEqualTo(TEST_RP_MS);
    assertThat(inboundResponseFromMatchingServiceDto.getInResponseTo()).isEqualTo(requestId);
    assertThat(inboundResponseFromMatchingServiceDto.getStatus().name()).isEqualTo(MatchingServiceIdaStatus.RequesterError.name());
    assertThat(inboundResponseFromMatchingServiceDto.getLevelOfAssurance().isPresent()).isFalse();
    assertThat(inboundResponseFromMatchingServiceDto.getUnderlyingMatchingServiceAssertionBlob().isPresent()).isFalse();
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldGenerateRpAuthnResponseWithUnsignedMessage() throws Exception {
    // Given
    ResponseFromHubDto responseFromHubDto = aResponseFromHubDto().build();
    configStub.setUpStubForShouldHubSignResponseMessagesForSamlStandard(responseFromHubDto.getAuthnRequestIssuerEntityId());

    Response samlMessageResponse = postToTestSamlMessageResource(responseFromHubDto);
    assertThat(samlMessageResponse.getStatus()).isEqualTo(Response.Status.OK.getStatusCode());
    AuthnResponseFromHubContainerDto expectedResult = anAuthnResponseFromHubContainerDto()
            .withSamlResponse(samlMessageResponse.readEntity(String.class))
            .withPostEndPoint(responseFromHubDto.getAssertionConsumerServiceUri())
            .withResponseId(responseFromHubDto.getResponseId())
            .withRelayState(responseFromHubDto.getRelayState())
            .build();

    // When
    URI generateAuthnResponseEndpoint = samlEngineAppRule.getUri(Urls.SamlEngineUrls.GENERATE_RP_AUTHN_RESPONSE_RESOURCE);
    Response rpAuthnResponse = client.target(generateAuthnResponseEndpoint).request().post(Entity.entity(responseFromHubDto, MediaType.APPLICATION_JSON_TYPE));

    // Then
    assertThat(rpAuthnResponse.getStatus()).isEqualTo(Response.Status.OK.getStatusCode());
    AuthnResponseFromHubContainerDto actualResult = rpAuthnResponse.readEntity(AuthnResponseFromHubContainerDto.class);
    assertThat(actualResult).isEqualToComparingFieldByField(expectedResult);

    assertStatusCode(actualResult.getSamlResponse(), StatusCode.SUCCESS);
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
private TranslatedResponseBody translateNonSuccessResponse(StatusCode statusCode) {
    Optional.ofNullable(statusCode.getStatusCode())
        .orElseThrow(() -> new SamlResponseValidationException("Missing status code for non-Success response"));
    String subStatus = statusCode.getStatusCode().getValue();

    switch (subStatus) {
        case SamlStatusCode.NO_MATCH:
            return new TranslatedResponseBody(Scenario.NO_MATCH, null, null, null);
        case StatusCode.REQUESTER:
            return new TranslatedResponseBody(Scenario.REQUEST_ERROR, null, null, null);
        case StatusCode.NO_AUTHN_CONTEXT:
            return new TranslatedResponseBody(Scenario.CANCELLATION, null, null, null);
        case StatusCode.AUTHN_FAILED:
            return new TranslatedResponseBody(Scenario.AUTHENTICATION_FAILED, null, null, null);
        default:
            throw new SamlResponseValidationException(String.format("Unknown SAML sub-status: %s", subStatus));
    }
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldHandleSuccessMatchSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(successStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result).isEqualTo(new TranslatedResponseBody(
        SUCCESS_MATCH,
        "some-pid",
        LevelOfAssurance.LEVEL_2,
        null
    ));
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldHandleAccountCreationSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = signResponse(createAttributeResponseBuilder(successStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(ACCOUNT_CREATION);
    assertThat(result.getAttributes()).isNotNull();
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldHandleNoMatchSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(SamlStatusCode.NO_MATCH).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(NO_MATCH);
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldHandleRequestErrorSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(StatusCode.REQUESTER).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(REQUEST_ERROR);
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldHandleNoAuthnContextSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(StatusCode.NO_AUTHN_CONTEXT).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(CANCELLATION);
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldHandleAuthenticationFailedSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(StatusCode.AUTHN_FAILED).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(AUTHENTICATION_FAILED);
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldFailWhenUnrecognizedSubStatus() throws Exception {
    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage("Unknown SAML sub-status: UNKNOWN");

    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue("UNKNOWN").build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldFailValidationWhenMetadataDoesNotContainCorrectCertificate() throws Exception {
    expectedException.expect(SamlTransformationErrorException.class);
    expectedException.expectMessage("SAML Validation Specification: Signature was not valid.");

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(successStatus), testRpSigningCredential);
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_PUBLIC_CERT);

    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldFailValidationWhenResponseIsNotSigned() throws Exception {
    expectedException.expect(SamlTransformationErrorException.class);
    expectedException.expectMessage("SAML Validation Specification: Message signature is not signed");

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = createNoAttributeResponseBuilder(successStatus).withoutSigning().build();
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);

    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void shouldFailWhenInResponseToDoesNotMatchRequestId() throws Exception {
    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage("Expected InResponseTo to be some-incorrect-request-id, but was default-request-id");

    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(successStatus), testRpSigningCredential);

    responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        "some-incorrect-request-id",
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Test
public void createResponse_shouldReturnValidSamlResponse() throws Exception {
    PublicKeyFactory publicKeyFactory = new PublicKeyFactory(new X509CertificateFactory());
    PrivateKey privateKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.PRIVATE_SIGNING_KEYS.get(TestEntityIds.STUB_IDP_ONE)));
    PublicKey publicKey = publicKeyFactory.createPublicKey(TestCertificateStrings.getPrimaryPublicEncryptionCert(TestEntityIds.HUB_ENTITY_ID));

    PrivateKey privateEncryptionKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.HUB_TEST_PRIVATE_ENCRYPTION_KEY));
    PublicKey publicEncryptionKey = publicKeyFactory.createPublicKey(TestCertificateStrings.HUB_TEST_PUBLIC_ENCRYPTION_CERT);

    KeyPair encryptionKeyPair = new KeyPair(publicEncryptionKey, privateEncryptionKey);

    KeyPair signingKeyPair = new KeyPair(publicKey, privateKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Arrays.asList(encryptionKeyPair));
    ExceptionResponseFactory exceptionResponseFactory = new ExceptionResponseFactory(new OpenSamlXmlObjectFactory(), new IdaKeyStoreCredentialRetriever(keyStore), new IdGenerator());

    String errorMessage = "some message";
    String requestId = UUID.randomUUID().toString();
    Element element = exceptionResponseFactory.createResponse(requestId, TEST_ENTITY_ID, errorMessage);

    Response attributeQueryResponse = (Response) XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(element).unmarshall(element);

    assertThat(attributeQueryResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.REQUESTER);
    assertThat(attributeQueryResponse.getStatus().getStatusMessage().getMessage()).isEqualTo(errorMessage);
    assertThat(attributeQueryResponse.getInResponseTo()).isEqualTo(requestId);
    assertThat(attributeQueryResponse.getIssuer().getValue()).isEqualTo(TEST_ENTITY_ID);
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
public static Status createStatus(final String statusCodeValue, final String statusMessage) {
    if (statusBuilder == null) {
        statusBuilder = new StatusBuilder();
    }
    if (statusCodeBuilder == null) {
        statusCodeBuilder = new StatusCodeBuilder();
    }
    if (statusMessageBuilder == null) {
        statusMessageBuilder = new StatusMessageBuilder();
    }

    Status status = statusBuilder.buildObject();

    StatusCode statusCode = statusCodeBuilder.buildObject();
    statusCode.setValue(statusCodeValue);
    status.setStatusCode(statusCode);

    if (statusMessage != null) {
        StatusMessage statusMessageObject = statusMessageBuilder.buildObject();
        statusMessageObject.setMessage(statusMessage);
        status.setStatusMessage(statusMessageObject);
    }

    return status;
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
/**
 * Create a new SAML status object.
 *
 * @param codeValue the code value
 * @param statusMessage the status message
 * @return the status
 */
public Status newStatus(final String codeValue, final String statusMessage) {
    final Status status = newSamlObject(Status.class);
    final StatusCode code = newSamlObject(StatusCode.class);
    code.setValue(codeValue);
    status.setStatusCode(code);
    if (StringUtils.isNotBlank(statusMessage)) {
        final StatusMessage message = newSamlObject(StatusMessage.class);
        message.setMessage(statusMessage);
        status.setStatusMessage(message);
    }
    return status;
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
@Override
public final QName getSamlObjectQName(final Class objectType) throws RuntimeException {
    try {
        final Field f = objectType.getField(DEFAULT_ELEMENT_LOCAL_NAME_FIELD);
        final String name = f.get(null).toString();

        if (objectType.equals(Response.class) || objectType.equals(Status.class)
                || objectType.equals(StatusCode.class)) {
            return new QName(SAMLConstants.SAML20P_NS, name, "samlp");
        }
        return new QName(SAMLConstants.SAML20_NS, name, XMLConstants.DEFAULT_NS_PREFIX);
    } catch (final Exception e){
        throw new IllegalStateException("Cannot access field " + objectType.getName() + '.' + DEFAULT_ELEMENT_LOCAL_NAME_FIELD);
    }
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
/**
 * Construct SAML response.
 * <a href="http://bit.ly/1uI8Ggu">See this reference for more info.</a>
 * @return the SAML response
 */
private String constructSamlResponse() {
    final DateTime currentDateTime = DateTime.parse(new ISOStandardDateFormat().getCurrentDateAndTime());
    final DateTime notBeforeIssueInstant = DateTime.parse("2003-04-17T00:46:02Z");

    final RegisteredService svc = this.servicesManager.findServiceBy(this);
    final String userId = svc.getUsernameAttributeProvider().resolveUsername(getPrincipal(), this);

    final org.opensaml.saml.saml2.core.Response response = BUILDER.newResponse(
            BUILDER.generateSecureRandomId(),
            currentDateTime,
            getId(), this);
    response.setStatus(BUILDER.newStatus(StatusCode.SUCCESS, null));

    final AuthnStatement authnStatement = BUILDER.newAuthnStatement(
            AuthnContext.PASSWORD_AUTHN_CTX, currentDateTime);
    final Assertion assertion = BUILDER.newAssertion(authnStatement,
            "https://www.opensaml.org/IDP",
            notBeforeIssueInstant, BUILDER.generateSecureRandomId());

    final Conditions conditions = BUILDER.newConditions(notBeforeIssueInstant,
            currentDateTime, getId());
    assertion.setConditions(conditions);

    final Subject subject = BUILDER.newSubject(NameID.EMAIL, userId,
            getId(), currentDateTime, this.requestId);
    assertion.setSubject(subject);

    response.getAssertions().add(assertion);

    final StringWriter writer = new StringWriter();
    BUILDER.marshalSamlXmlObject(response, writer);

    final String result = writer.toString();
    logger.debug("Generated Google SAML response: {}", result);
    return result;
}
 

import org.opensaml.saml.saml2.core.StatusCode; //导入依赖的package包/类
/**
 * Create a new SAML status object.
 *
 * @param codeValue     the code value
 * @param statusMessage the status message
 * @return the status
 */
public Status newStatus(final String codeValue, final String statusMessage) {
    final Status status = newSamlObject(Status.class);
    final StatusCode code = newSamlObject(StatusCode.class);
    code.setValue(codeValue);
    status.setStatusCode(code);
    if (StringUtils.isNotBlank(statusMessage)) {
        final StatusMessage message = newSamlObject(StatusMessage.class);
        message.setMessage(statusMessage);
        status.setStatusMessage(message);
    }
    return status;
}