import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyValidateServiceTicketReturnOnlyAllowedAttribute() throws Exception {
    final Service service = getService("eduPersonTestInvalid");
    final UsernamePasswordCredential cred = TestUtils.getCredentialsWithSameUsernameAndPassword();
    final AuthenticationContext ctx = TestUtils.getAuthenticationContext(getAuthenticationSystemSupport(), service);
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(ctx);
    final ServiceTicket serviceTicket = getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(),
        service, ctx);

    final Assertion assertion = getCentralAuthenticationService().validateServiceTicket(serviceTicket.getId(),
        service);
    final Authentication auth = assertion.getPrimaryAuthentication();
    final Map<String, Object> attributes = auth.getPrincipal().getAttributes();
    assertEquals(1, attributes.size());
    assertEquals("adopters", attributes.get("groupMembership"));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyValidateServiceTicketWithInvalidUsernameAttribute() throws Exception {
    final Service svc = getService("eduPersonTestInvalid");
    final UsernamePasswordCredential cred = TestUtils.getCredentialsWithSameUsernameAndPassword();
    final AuthenticationContext ctx = TestUtils.getAuthenticationContext(getAuthenticationSystemSupport(), svc);
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(ctx);


    final ServiceTicket serviceTicket = getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), svc, ctx);

    final Assertion assertion = getCentralAuthenticationService().validateServiceTicket(serviceTicket.getId(), svc);
    final Authentication auth = assertion.getPrimaryAuthentication();

    /*
     * The attribute specified for this service does not resolve.
     * Therefore, we expect the default to be returned.
     */
    assertEquals(auth.getPrincipal().getId(), cred.getUsername());
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyAllowsAccessToHighSecurityServiceWithPasswordAndOTPViaRenew() throws Exception {
    // Note the original credential used to start SSO session does not satisfy security policy

    final AuthenticationContext ctx = processAuthenticationAttempt(HIGH_SERVICE, newUserPassCredentials("alice", "alice"));
    final TicketGrantingTicket tgt = cas.createTicketGrantingTicket(ctx);
    assertNotNull(tgt);
    final AuthenticationContext ctx2 = processAuthenticationAttempt(HIGH_SERVICE, newUserPassCredentials("alice", "alice"),
            new OneTimePasswordCredential("alice", "31415"));

    final ServiceTicket st = cas.grantServiceTicket(
            tgt.getId(),
            HIGH_SERVICE,
            ctx2);

    assertNotNull(st);
    // Confirm the authentication in the assertion is the one that satisfies security policy
    final Assertion assertion = cas.validateServiceTicket(st.getId(), HIGH_SERVICE);
    assertEquals(2, assertion.getPrimaryAuthentication().getSuccesses().size());
    assertTrue(assertion.getPrimaryAuthentication().getSuccesses().containsKey("passwordHandler"));
    assertTrue(assertion.getPrimaryAuthentication().getSuccesses().containsKey("oneTimePasswordHandler"));
    assertTrue(assertion.getPrimaryAuthentication().getAttributes().containsKey(
            SuccessfulHandlerMetaDataPopulator.SUCCESSFUL_AUTHENTICATION_HANDLERS));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
/**
 * Generate the success view. The result will contain the assertion and the proxy iou.
 *
 * @param assertion the assertion
 * @param proxyIou the proxy iou
 * @param service the validated service
 * @param proxyGrantingTicket the proxy granting ticket
 * @return the model and view, pointed to the view name set by
 */
private ModelAndView generateSuccessView(final Assertion assertion, final String proxyIou,
                                         final WebApplicationService service,
                                         final TicketGrantingTicket proxyGrantingTicket) {

    final ModelAndView modelAndView = getModelAndView(true, service);

    modelAndView.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_ASSERTION, assertion);
    modelAndView.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_SERVICE, service);
    modelAndView.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET_IOU, proxyIou);
    if (proxyGrantingTicket != null) {
        modelAndView.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET, proxyGrantingTicket.getId());
    }
    final Map<String, ?> augmentedModelObjects = augmentSuccessViewModelObjects(assertion);
    if (augmentedModelObjects != null) {
        modelAndView.addAllObjects(augmentedModelObjects);
    }
    return modelAndView;
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyResolverAssertionReturnValue() throws Exception {
    final Credential c = TestUtils.getCredentialsWithSameUsernameAndPassword();
    final AuthenticationContext authnResult = TestUtils.getAuthenticationContext(getAuthenticationSystemSupport(), c);
    final Authentication authn = authnResult.getAuthentication();

    final TicketOrCredentialPrincipalResolver delegate = new TicketOrCredentialPrincipalResolver(getCentralAuthenticationService());
    final AssertionAsReturnValuePrincipalResolver res = new AssertionAsReturnValuePrincipalResolver(delegate);
    final JoinPoint jp = mock(JoinPoint.class);
    final Assertion returnedAssertion =
            new ImmutableAssertion(authnResult.getAuthentication(), Arrays.asList(authn), authnResult.getService(), true);

    final String result = res.resolveFrom(jp, returnedAssertion);
    assertNotNull(result);
    assertEquals(result, c.getId());
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
/**
 * Gets chained authentications.
 *
 * @param model the model
 * @return the chained authentications
 */
protected final Collection<Authentication> getChainedAuthentications(final Map<String, Object> model) {
    final Collection<Authentication> chainedAuthenticationsToReturn = new ArrayList<>();

    final Assertion assertion = getAssertionFrom(model);
    final List<Authentication> chainedAuthentications = assertion.getChainedAuthentications();

    /**
     * Note that the last index in the list always describes the primary authentication
     * event. All others in the chain should denote proxies. Per the CAS protocol,
     * when authentication has proceeded through multiple proxies,
     * the order in which the proxies were traversed MUST be reflected in the response.
     * The most recently-visited proxy MUST be the first proxy listed, and all the
     * other proxies MUST be shifted down as new proxies are added. I
     */
    final int numberAuthenticationsExceptPrimary = chainedAuthentications.size() - 1;
    for (int i = 0; i < numberAuthenticationsExceptPrimary; i++) {
        chainedAuthenticationsToReturn.add(chainedAuthentications.get(i));
    }
    return chainedAuthenticationsToReturn;
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
/**
 * Gets chained authentications.
 *
 * @param model the model
 * @return the chained authentications
 */
protected final Collection<Authentication> getChainedAuthentications(final Map<String, Object> model) {
    final List<Authentication> chainedAuthenticationsToReturn = new ArrayList<>();

    final Assertion assertion = getAssertionFrom(model);
    final List<Authentication> chainedAuthentications = assertion.getChainedAuthentications();

    /**
     * Note that the last index in the list always describes the primary authentication
     * event. All others in the chain should denote proxies. Per the CAS protocol,
     * when authentication has proceeded through multiple proxies,
     * the order in which the proxies were traversed MUST be reflected in the response.
     * The most recently-visited proxy MUST be the first proxy listed, and all the
     * other proxies MUST be shifted down as new proxies are added. I
     */
    final int numberAuthenticationsExceptPrimary = chainedAuthentications.size() - 1;
    for (int i = 0; i < numberAuthenticationsExceptPrimary; i++) {
        chainedAuthenticationsToReturn.add(chainedAuthentications.get(i));
    }
    return chainedAuthenticationsToReturn;
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyChainedAuthenticationsOnValidation() throws TicketException {
    final Service svc = TestUtils.getService(SVC2_ID);
    final ServiceTicket st = this.cas.grantServiceTicket(TGT2_ID, svc);
    assertNotNull(st);
    
    final Assertion assertion = this.cas.validateServiceTicket(st.getId(), svc);
    assertNotNull(assertion);
    
    assertEquals(assertion.getService(), svc);
    assertEquals(assertion.getPrimaryAuthentication().getPrincipal().getId(), PRINCIPAL);
    assertTrue(assertion.getChainedAuthentications().size()  == 2);
    for (int i = 0; i < assertion.getChainedAuthentications().size(); i++) {
        final Authentication auth = assertion.getChainedAuthentications().get(i);
        assertEquals(auth, authentication);
    }
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyValidateServiceTicketWithInvalidUsernameAttribute() throws Exception {
    final UsernamePasswordCredential cred =  TestUtils.getCredentialsWithSameUsernameAndPassword();
    final TicketGrantingTicket ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(cred);

    final Service svc = TestUtils.getService("eduPersonTestInvalid");
    final ServiceTicket serviceTicket = getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket.getId(), svc);

    final Assertion assertion = getCentralAuthenticationService().validateServiceTicket(serviceTicket.getId(), svc);
    final Authentication auth = assertion.getPrimaryAuthentication();

    /*
     * The attribute specified for this service does not resolve.
     * Therefore, we expect the default to be returned.
     */
    assertEquals(auth.getPrincipal().getId(), cred.getUsername());
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyAllowsAccessToHighSecurityServiceWithPasswordAndOTPViaRenew() throws Exception {
    // Note the original credential used to start SSO session does not satisfy security policy
    final TicketGrantingTicket tgt = cas.createTicketGrantingTicket(newUserPassCredentials("alice", "alice"));
    assertNotNull(tgt);
    final Service service = newService("https://example.com/high/");
    final ServiceTicket st = cas.grantServiceTicket(
            tgt.getId(),
            service,
            newUserPassCredentials("alice", "alice"),
            new OneTimePasswordCredential("alice", "31415"));
    assertNotNull(st);
    // Confirm the authentication in the assertion is the one that satisfies security policy
    final Assertion assertion = cas.validateServiceTicket(st.getId(), service);
    assertEquals(2, assertion.getPrimaryAuthentication().getSuccesses().size());
    assertTrue(assertion.getPrimaryAuthentication().getSuccesses().containsKey("passwordHandler"));
    assertTrue(assertion.getPrimaryAuthentication().getSuccesses().containsKey("oneTimePasswordHandler"));
    assertTrue(assertion.getPrimaryAuthentication().getAttributes().containsKey(
            SuccessfulHandlerMetaDataPopulator.SUCCESSFUL_AUTHENTICATION_HANDLERS));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
/**
 * Generate the success view. The result will contain the assertion and the proxy iou.
 *
 * @param assertion the assertion
 * @param proxyIou the proxy iou
 * @param service the validated service
 * @param proxyGrantingTicket the proxy granting ticket
 * @return the model and view, pointed to the view name set by
 */
private ModelAndView generateSuccessView(final Assertion assertion, final String proxyIou,
                                         final WebApplicationService service,
                                         final TicketGrantingTicket proxyGrantingTicket) {

    final ModelAndView success = new ModelAndView(this.successView);
    success.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_ASSERTION, assertion);
    success.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_SERVICE, service);
    success.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET_IOU, proxyIou);
    if (proxyGrantingTicket != null) {
        success.addObject(CasViewConstants.MODEL_ATTRIBUTE_NAME_PROXY_GRANTING_TICKET, proxyGrantingTicket.getId());
    }
    final Map<String, ?> augmentedModelObjects = augmentSuccessViewModelObjects(assertion);
    if (augmentedModelObjects != null) {
        success.addAllObjects(augmentedModelObjects);
    }
    return success;
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void testResponseWithoutAuthMethod() throws Exception {
    final Map<String, Object> model = new HashMap<String, Object>();

    final Map<String, Object> attributes = new HashMap<String, Object>();
    attributes.put("testAttribute", "testValue");
    final SimplePrincipal principal = new SimplePrincipal("testPrincipal", attributes);

    final Authentication primary = TestUtils.getAuthentication(principal);

    final Assertion assertion = new ImmutableAssertion(
            primary, Collections.singletonList(primary), TestUtils.getService(), true);
    model.put("assertion", assertion);

    final MockHttpServletResponse servletResponse = new MockHttpServletResponse();

    this.response.renderMergedOutputModel(model, new MockHttpServletRequest(), servletResponse);
    final String written = servletResponse.getContentAsString();

    assertTrue(written.contains("testPrincipal"));
    assertTrue(written.contains("testAttribute"));
    assertTrue(written.contains("testValue"));
    assertTrue(written.contains("urn:oasis:names:tc:SAML:1.0:am:unspecified"));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void testChainedAuthenticationsOnValidation() throws TicketException {
    final Service svc = TestUtils.getService(SVC2_ID);
    final String st = this.cas.grantServiceTicket(TGT2_ID, svc);
    assertNotNull(st);
    
    final Assertion assertion = this.cas.validateServiceTicket(st, svc);
    assertNotNull(assertion);
    
    assertEquals(assertion.getService(), svc);
    assertEquals(assertion.getPrimaryAuthentication().getPrincipal().getId(), PRINCIPAL);
    assertTrue(assertion.getChainedAuthentications().size()  == 2);
    for (int i = 0; i < assertion.getChainedAuthentications().size(); i++) {
        final Authentication auth = assertion.getChainedAuthentications().get(i);
        assertEquals(auth, authentication);
    }
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void testValidateServiceTicketWithInvalidUsernameAttribute() throws Exception {
    final UsernamePasswordCredential cred =  TestUtils.getCredentialsWithSameUsernameAndPassword();
    final String ticketGrantingTicket = getCentralAuthenticationService().createTicketGrantingTicket(cred);

    final Service svc = TestUtils.getService("eduPersonTestInvalid");
    final String serviceTicket = getCentralAuthenticationService().grantServiceTicket(ticketGrantingTicket, svc);

    final Assertion assertion = getCentralAuthenticationService().validateServiceTicket(serviceTicket, svc);
    final Authentication auth = assertion.getPrimaryAuthentication();

    /*
     * The attribute specified for this service does not resolve.
     * Therefore, we expect the default to be returned.
     */
    assertEquals(auth.getPrincipal().getId(), cred.getUsername());
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void testAllowsAccessToHighSecurityServiceWithPasswordAndOTPViaRenew() throws Exception {
    // Note the original credential used to start SSO session does not satisfy security policy
    final String tgt = cas.createTicketGrantingTicket(newUserPassCredentials("alice", "alice"));
    assertNotNull(tgt);
    final Service service = newService("https://example.com/high/");
    final String st = cas.grantServiceTicket(
            tgt,
            service,
            newUserPassCredentials("alice", "alice"),
            new OneTimePasswordCredential("alice", "31415"));
    assertNotNull(st);
    // Confirm the authentication in the assertion is the one that satisfies security policy
    final Assertion assertion = cas.validateServiceTicket(st, service);
    assertEquals(2, assertion.getPrimaryAuthentication().getSuccesses().size());
    assertTrue(assertion.getPrimaryAuthentication().getSuccesses().containsKey("passwordHandler"));
    assertTrue(assertion.getPrimaryAuthentication().getSuccesses().containsKey("oneTimePasswordHandler"));
    assertTrue(assertion.getPrimaryAuthentication().getAttributes().containsKey(
            SuccessfulHandlerMetaDataPopulator.SUCCESSFUL_AUTHENTICATION_HANDLERS));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyChainedAuthenticationsOnValidation() throws Exception {
    final Service svc = org.jasig.cas.services.TestUtils.getService(SVC2_ID);
    final ServiceTicket st = this.cas.grantServiceTicket(TGT2_ID, svc, getAuthenticationContext());
    assertNotNull(st);
    
    final Assertion assertion = this.cas.validateServiceTicket(st.getId(), svc);
    assertNotNull(assertion);
    
    assertEquals(assertion.getService(), svc);
    assertEquals(assertion.getPrimaryAuthentication().getPrincipal().getId(), PRINCIPAL);
    assertTrue(assertion.getChainedAuthentications().size()  == 2);
    for (int i = 0; i < assertion.getChainedAuthentications().size(); i++) {
        final Authentication auth = assertion.getChainedAuthentications().get(i);
        assertEquals(auth, authentication);
    }
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyResponse() throws Exception {
    final Map<String, Object> model = new HashMap<>();

    final Map<String, Object> attributes = new HashMap<>();
    attributes.put("testAttribute", "testValue");
    attributes.put("testEmptyCollection", Collections.emptyList());
    attributes.put("testAttributeCollection", Arrays.asList("tac1", "tac2"));
    final Principal principal = new DefaultPrincipalFactory().createPrincipal("testPrincipal", attributes);

    final Map<String, Object> authAttributes = new HashMap<>();
    authAttributes.put(
            SamlAuthenticationMetaDataPopulator.ATTRIBUTE_AUTHENTICATION_METHOD,
            SamlAuthenticationMetaDataPopulator.AUTHN_METHOD_SSL_TLS_CLIENT);
    authAttributes.put("testSamlAttribute", "value");

    final Authentication primary =
            org.jasig.cas.authentication.TestUtils.getAuthentication(principal, authAttributes);
    final Assertion assertion = new ImmutableAssertion(
            primary, Collections.singletonList(primary),
            org.jasig.cas.authentication.TestUtils.getService(), true);
    model.put("assertion", assertion);

    final MockHttpServletResponse servletResponse = new MockHttpServletResponse();

    this.response.renderMergedOutputModel(model, new MockHttpServletRequest(), servletResponse);
    final String written = servletResponse.getContentAsString();

    assertTrue(written.contains("testPrincipal"));
    assertTrue(written.contains("testAttribute"));
    assertTrue(written.contains("testValue"));
    assertFalse(written.contains("testEmptyCollection"));
    assertTrue(written.contains("testAttributeCollection"));
    assertTrue(written.contains("tac1"));
    assertTrue(written.contains("tac2"));
    assertTrue(written.contains(SamlAuthenticationMetaDataPopulator.AUTHN_METHOD_SSL_TLS_CLIENT));
    assertTrue(written.contains("AuthenticationMethod"));
    assertTrue(written.contains("AssertionID"));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyResponseWithNoAttributes() throws Exception {
    final Map<String, Object> model = new HashMap<>();

    final Principal principal = new DefaultPrincipalFactory().createPrincipal("testPrincipal");

    final Map<String, Object> authAttributes = new HashMap<>();
    authAttributes.put(
            SamlAuthenticationMetaDataPopulator.ATTRIBUTE_AUTHENTICATION_METHOD,
            SamlAuthenticationMetaDataPopulator.AUTHN_METHOD_SSL_TLS_CLIENT);
    authAttributes.put("testSamlAttribute", "value");

    final Authentication primary = org.jasig.cas.authentication.TestUtils.getAuthentication(principal, authAttributes);

    final Assertion assertion = new ImmutableAssertion(
            primary, Collections.singletonList(primary),
            org.jasig.cas.authentication.TestUtils.getService(), true);
    model.put("assertion", assertion);

    final MockHttpServletResponse servletResponse = new MockHttpServletResponse();

    this.response.renderMergedOutputModel(model, new MockHttpServletRequest(), servletResponse);
    final String written = servletResponse.getContentAsString();

    assertTrue(written.contains("testPrincipal"));
    assertTrue(written.contains(SamlAuthenticationMetaDataPopulator.AUTHN_METHOD_SSL_TLS_CLIENT));
    assertTrue(written.contains("AuthenticationMethod="));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
@Test
public void verifyResponseWithoutAuthMethod() throws Exception {
    final Map<String, Object> model = new HashMap<>();

    final Map<String, Object> attributes = new HashMap<>();
    attributes.put("testAttribute", "testValue");
    final Principal principal = new DefaultPrincipalFactory().createPrincipal("testPrincipal", attributes);

    final Map<String, Object> authnAttributes = new HashMap<>();
    authnAttributes.put("authnAttribute1", "authnAttrbuteV1");
    authnAttributes.put("authnAttribute2", "authnAttrbuteV2");
    authnAttributes.put(RememberMeCredential.AUTHENTICATION_ATTRIBUTE_REMEMBER_ME, Boolean.TRUE);

    final Authentication primary =
            org.jasig.cas.authentication.TestUtils.getAuthentication(principal, authnAttributes);

    final Assertion assertion = new ImmutableAssertion(
            primary, Collections.singletonList(primary),
            org.jasig.cas.authentication.TestUtils.getService(), true);
    model.put("assertion", assertion);

    final MockHttpServletResponse servletResponse = new MockHttpServletResponse();

    this.response.renderMergedOutputModel(model, new MockHttpServletRequest(), servletResponse);
    final String written = servletResponse.getContentAsString();

    assertTrue(written.contains("testPrincipal"));
    assertTrue(written.contains("testAttribute"));
    assertTrue(written.contains("testValue"));
    assertTrue(written.contains("authnAttribute1"));
    assertTrue(written.contains("authnAttribute2"));
    assertTrue(written.contains(CasProtocolConstants.VALIDATION_REMEMBER_ME_ATTRIBUTE_NAME));
    assertTrue(written.contains("urn:oasis:names:tc:SAML:1.0:am:unspecified"));
}
 

import org.jasig.cas.validation.Assertion; //导入依赖的package包/类
/**
 * Instantiates a new Cas service ticket validated event.
 *
 * @param source        the source
 * @param serviceTicket the service ticket
 * @param assertion     the assertion
 */
public CasServiceTicketValidatedEvent(final Object source,
                                      final ServiceTicket serviceTicket,
                                      final Assertion assertion) {
    super(source);
    this.assertion = assertion;
    this.serviceTicket = serviceTicket;
}