import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
protected void processChildElement(XMLObject parentObject, XMLObject childObject) throws UnmarshallingException {
    IDPSSODescriptor descriptor = (IDPSSODescriptor) parentObject;

    if (childObject instanceof SingleSignOnService) {
        descriptor.getSingleSignOnServices().add((SingleSignOnService) childObject);
    } else if (childObject instanceof NameIDMappingService) {
        descriptor.getNameIDMappingServices().add((NameIDMappingService) childObject);
    } else if (childObject instanceof AssertionIDRequestService) {
        descriptor.getAssertionIDRequestServices().add((AssertionIDRequestService) childObject);
    } else if (childObject instanceof AttributeProfile) {
        descriptor.getAttributeProfiles().add((AttributeProfile) childObject);
    } else if (childObject instanceof Attribute) {
        descriptor.getAttributes().add((Attribute) childObject);
    } else {
        super.processChildElement(parentObject, childObject);
    }
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/**
 * Constructor.
 * 
 * @param namespaceURI the namespace the element is in
 * @param elementLocalName the local name of the XML element this Object represents
 * @param namespacePrefix the prefix for the given namespace
 */
protected IDPSSODescriptorImpl(String namespaceURI, String elementLocalName, String namespacePrefix) {
    super(namespaceURI, elementLocalName, namespacePrefix);
    singleSignOnServices = new XMLObjectChildrenList<SingleSignOnService>(this);
    nameIDMappingServices = new XMLObjectChildrenList<NameIDMappingService>(this);
    assertionIDRequestServices = new XMLObjectChildrenList<AssertionIDRequestService>(this);
    attributeProfiles = new XMLObjectChildrenList<AttributeProfile>(this);
    attributes = new XMLObjectChildrenList<Attribute>(this);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public List<Endpoint> getEndpoints(QName type) {
    if(type.equals(SingleSignOnService.DEFAULT_ELEMENT_NAME)){
        return Collections.unmodifiableList(new ArrayList<Endpoint>(singleSignOnServices));
    }else if(type.equals(NameIDMappingService.DEFAULT_ELEMENT_NAME)){
        return Collections.unmodifiableList(new ArrayList<Endpoint>(nameIDMappingServices));
    }else if(type.equals(AssertionIDRequestService.DEFAULT_ELEMENT_NAME)){
        return Collections.unmodifiableList(new ArrayList<Endpoint>(assertionIDRequestServices));
    }else{
        return super.getEndpoints(type);
    }
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private SingleSignOnService getSingleSignOnService(final SAMLConfig configuration, final String binding) {
	SAMLObjectBuilder<SingleSignOnService> builder = (SAMLObjectBuilder<SingleSignOnService>) builderFactory.getBuilder(SingleSignOnService.DEFAULT_ELEMENT_NAME);
	SingleSignOnService service = builder.buildObject();
	service.setBinding(binding);
	service.setLocation(configuration.getLoginUrl());

	return service;
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
private static SingleSignOnService getPostBinding(IDPSSODescriptor idpSsoDescriptor)
    throws SamlException {
  return idpSsoDescriptor
      .getSingleSignOnServices()
      .stream()
      .filter(x -> x.getBinding().equals("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"))
      .findAny()
      .orElseThrow(() -> new SamlException("Cannot find HTTP-POST SSO binding in metadata"));
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/**
 * Get a signon service location for a specific binding.
 * @param binding SAML binding name,
 * @return The url for the location.
 * @throws IllegalArgumentException if the binding is not present in metadata.
 */
public String getSingleSignonServiceLocation(String binding) throws IllegalArgumentException {
	for (SingleSignOnService service : idpSSODescriptor.getSingleSignOnServices()) {
		if (service.getBinding().equals(binding)) {
			return service.getLocation();
		}
	}
	throw new IllegalArgumentException("Binding " + binding + " not found");
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/**
 * Find a supported login endpoint.
 * @throws IllegalArgumentException If no services match the selected bindings. 
 */
public Endpoint findLoginEndpoint(String[] bindings) {
	if (bindings == null) throw new IllegalArgumentException("bindings cannot be null");
	
	for (String binding : bindings) {
		for (SingleSignOnService service : idpSSODescriptor.getSingleSignOnServices()) {
			if (service.getBinding().equalsIgnoreCase(binding)) {
				return service;
			}
		}
	}
	throw new IllegalArgumentException("No SingleSignonService found for " + Arrays.toString(bindings));
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
protected void populateRequiredData() {
    super.populateRequiredData();
    IDPSSODescriptor idpssoDescriptor = (IDPSSODescriptor) target;
    SingleSignOnService singleSignOnService = (SingleSignOnService) buildXMLObject(new QName(
            SAMLConstants.SAML20MD_NS, SingleSignOnService.DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX));
    idpssoDescriptor.getSingleSignOnServices().add(singleSignOnService);
    NameIDMappingService nameIDMappingService = (NameIDMappingService) buildXMLObject(new QName(
            SAMLConstants.SAML20MD_NS, NameIDMappingService.DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX));
    idpssoDescriptor.getNameIDMappingServices().add(nameIDMappingService);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
protected void populateRequiredData() {
    super.populateRequiredData();
    IDPSSODescriptor idpssoDescriptor = (IDPSSODescriptor) target;
    SingleSignOnService singleSignOnService = (SingleSignOnService) buildXMLObject(new QName(SAMLConstants.SAML20MD_NS,
            SingleSignOnService.DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX));
    idpssoDescriptor.getSingleSignOnServices().add(singleSignOnService);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public void testSingleElementUnmarshall() {
    SingleSignOnService service = ( SingleSignOnService) unmarshallElement(singleElementFile);
    
    assertEquals("Binding URI was not expected value", expectedBinding, service.getBinding());
    assertEquals("Location was not expected value", expectedLocation, service.getLocation());
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public void testSingleElementOptionalAttributesUnmarshall() {
    SingleSignOnService service = ( SingleSignOnService) unmarshallElement(singleElementOptionalAttributesFile);
    
    assertEquals("Binding URI was not expected value", expectedBinding, service.getBinding());
    assertEquals("Location was not expected value", expectedLocation, service.getLocation());
    assertEquals("ResponseLocation was not expected value", expectedResponseLocation, service.getResponseLocation());;
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public void testSingleElementMarshall() {
    QName qname = new QName(SAMLConstants.SAML20MD_NS,  SingleSignOnService.DEFAULT_ELEMENT_LOCAL_NAME);
    SingleSignOnService service = ( SingleSignOnService) buildXMLObject(qname);
    
    service.setBinding(expectedBinding);
    service.setLocation(expectedLocation);

    assertEquals(expectedDOM, service);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public void testSingleElementOptionalAttributesMarshall() {
    QName qname = new QName(SAMLConstants.SAML20MD_NS,  SingleSignOnService.DEFAULT_ELEMENT_LOCAL_NAME);
    SingleSignOnService service = ( SingleSignOnService) buildXMLObject(qname);
    
    service.setBinding(expectedBinding);
    service.setLocation(expectedLocation);
    service.setResponseLocation(expectedResponseLocation);

    assertEquals(expectedOptionalAttributesDOM, service);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
@Bean
public WebSSOProfile webSSOprofile() {
    return new WebSSOProfileImpl() {

        @Override
        protected AuthnRequest getAuthnRequest(SAMLMessageContext context, WebSSOProfileOptions options, AssertionConsumerService assertionConsumer, SingleSignOnService bindingService) throws SAMLException, MetadataProviderException {
            AuthnRequest authnRequest = super.getAuthnRequest(context, options, assertionConsumer, bindingService);
            authnRequest.setExtensions(buildExtensions());
            return authnRequest;
        }

        /**
         * Language extension to AuthnRequest:
         *
         *  <samlp:Extensions>
                <vetuma xmlns="urn:vetuma:SAML:2.0:extensions">
                    <LG>[fi|sv]</LG>
                </vetuma>
            </samlp:Extensions>
         */
        private Extensions buildExtensions() {
            Extensions extensions = new ExtensionsBuilder()
                    .buildObject("urn:oasis:names:tc:SAML:2.0:protocol", "Extensions", "saml2p");
            XSAny vetuma = new XSAnyBuilder().buildObject(new QName("urn:vetuma:SAML:2.0:extensions", "vetuma"));
            XSAny language = new XSAnyBuilder().buildObject(new QName("urn:vetuma:SAML:2.0:extensions", "LG"));

            String idpLanguageFromTarget = TargetStoringFilter.getRequestParamTarget(((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest())
                    .map(t -> t.startsWith(Urls.FRONT_SV) ? "sv" : "fi")
                    .orElse("fi");

            language.setTextContent(idpLanguageFromTarget);
            extensions.getUnknownXMLObjects().add(vetuma);
            vetuma.getUnknownXMLObjects().add(language);
            return extensions;
        }
    };
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
private Endpoint getIPDEndpoint() {
    SingleSignOnService endpoint = OpenSAMLUtils.buildSAMLObject(SingleSignOnService.class);
    endpoint.setBinding(SAMLConstants.SAML2_REDIRECT_BINDING_URI);
    endpoint.setLocation(getIPDSSODestination());

    return endpoint;
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public List<SingleSignOnService> getSingleSignOnServices() {
    return singleSignOnServices;
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/** {@inheritDoc} */
public SingleSignOnService buildObject() {
    return buildObject(SAMLConstants.SAML20MD_NS, SingleSignOnService.DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
/**
 * Constructs an SAML client using XML metadata obtained from the identity provider. <p> When
 * using Okta as an identity provider, it is possible to pass null to relyingPartyIdentifier and
 * assertionConsumerServiceUrl; they will be inferred from the metadata provider XML.
 *
 * @param relyingPartyIdentifier      the identifier for the relying party.
 * @param assertionConsumerServiceUrl the url where the identity provider will post back the
 *                                    SAML response.
 * @param metadata                    the XML metadata obtained from the identity provider.
 * @return The created {@link SamlClient}.
 * @throws SamlException thrown if any error occur while loading the metadata information.
 */
public static SamlClient fromMetadata(
    String relyingPartyIdentifier, String assertionConsumerServiceUrl, Reader metadata)
    throws SamlException {

  ensureOpenSamlIsInitialized();

  MetadataProvider metadataProvider = createMetadataProvider(metadata);
  EntityDescriptor entityDescriptor = getEntityDescriptor(metadataProvider);

  IDPSSODescriptor idpSsoDescriptor = getIDPSSODescriptor(entityDescriptor);
  SingleSignOnService postBinding = getPostBinding(idpSsoDescriptor);
  List<X509Certificate> x509Certificates = getCertificates(idpSsoDescriptor);
  boolean isOkta = entityDescriptor.getEntityID().contains(".okta.com");

  if (relyingPartyIdentifier == null) {
    // Okta's own toolkit uses the entity ID as a relying party identifier, so if we
    // detect that the IDP is Okta let's tolerate a null value for this parameter.
    if (isOkta) {
      relyingPartyIdentifier = entityDescriptor.getEntityID();
    } else {
      throw new IllegalArgumentException("relyingPartyIdentifier");
    }
  }

  if (assertionConsumerServiceUrl == null && isOkta) {
    // Again, Okta's own toolkit uses this value for the assertion consumer url, which
    // kinda makes no sense since this is supposed to be a url pointing to a server
    // outside Okta, but it probably just straight ignores this and use the one from
    // it's own config anyway.
    assertionConsumerServiceUrl = postBinding.getLocation();
  }

  String identityProviderUrl = postBinding.getLocation();
  String responseIssuer = entityDescriptor.getEntityID();

  return new SamlClient(
      relyingPartyIdentifier,
      assertionConsumerServiceUrl,
      identityProviderUrl,
      responseIssuer,
      x509Certificates);
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
private EntityDescriptor generateIdPDescriptor(String stsEntityId, String stsLocation, String stsLogoutLocation, byte[] stsKeystore) {
	EntityDescriptor descriptor = SAMLUtil.buildXMLObject(EntityDescriptor.class);
	descriptor.setEntityID(stsEntityId);

	IDPSSODescriptor desc = SAMLUtil.buildXMLObject(IDPSSODescriptor.class);
	desc.addSupportedProtocol("http://schemas.xmlsoap.org/ws/2006/12/federation");
	
	KeyDescriptor signingDescriptor = SAMLUtil.buildXMLObject(KeyDescriptor.class);
	signingDescriptor.setUse(UsageType.SIGNING);
	KeyDescriptor encryptionDescriptor = SAMLUtil.buildXMLObject(KeyDescriptor.class);
	encryptionDescriptor.setUse(UsageType.ENCRYPTION);

	try {
		CertificateFactory cf = CertificateFactory.getInstance("X.509");
		X509Certificate cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(stsKeystore));
		BasicX509Credential credential = new BasicX509Credential();
		credential.setEntityCertificate(cert);
		
		KeyInfoGenerator gen = SecurityHelper.getKeyInfoGenerator(credential, org.opensaml.xml.Configuration.getGlobalSecurityConfiguration(), null);
		signingDescriptor.setKeyInfo(gen.generate(credential));
		encryptionDescriptor.setKeyInfo(gen.generate(credential));
	} catch (SecurityException e1) {
		throw new WrappedException(Layer.BUSINESS, e1);
	} catch (CertificateException e) {
		throw new WrappedException(Layer.BUSINESS, e);
	}
	desc.getKeyDescriptors().add(signingDescriptor);
	desc.getKeyDescriptors().add(encryptionDescriptor);
	
	SingleSignOnService sso = SAMLUtil.buildXMLObject(SingleSignOnService.class);
	sso.setBinding("http://schemas.xmlsoap.org/ws/2006/12/federation");
	sso.setLocation(stsLocation);
	desc.getSingleSignOnServices().add(sso);

	//TODO: Check that the location should be the same
	SingleLogoutService slo = SAMLUtil.buildXMLObject(SingleLogoutService.class);
	slo.setBinding("http://schemas.xmlsoap.org/ws/2006/12/federation");
	slo.setLocation(stsLogoutLocation);
	desc.getSingleLogoutServices().add(slo);
	
	descriptor.getRoleDescriptors().add(desc);
	return descriptor;
}
 

import org.opensaml.saml2.metadata.SingleSignOnService; //导入依赖的package包/类
public List<SingleSignOnService> getSingleSignonServices() {
	return idpSSODescriptor.getSingleSignOnServices();
}