import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Resolve metadata from resource.
 *
 * @param service           the service
 * @param metadataResolvers the metadata resolvers
 * @throws Exception the io exception
 */
protected void resolveMetadataFromResource(final SamlRegisteredService service,
                                           final List<MetadataResolver> metadataResolvers) throws Exception {

    final String metadataLocation = service.getMetadataLocation();
    LOGGER.info("Loading SAML metadata from [{}]", metadataLocation);
    final AbstractResource metadataResource = ResourceUtils.getResourceFrom(metadataLocation);

    if (metadataResource instanceof FileSystemResource) {
        resolveFileSystemBasedMetadataResource(service, metadataResolvers, metadataResource);
    }

    if (metadataResource instanceof UrlResource) {
        resolveUrlBasedMetadataResource(service, metadataResolvers, metadataResource);
    }

    if (metadataResource instanceof ClassPathResource) {
        resolveClasspathBasedMetadataResource(service, metadataResolvers, metadataLocation, metadataResource);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
@Bean
public MetadataResolver casSamlIdPMetadataResolver() {
    try {
        final SamlIdPProperties idp = casProperties.getAuthn().getSamlIdp();
        final ResourceBackedMetadataResolver resolver = new ResourceBackedMetadataResolver(
                ResourceHelper.of(new FileSystemResource(idp.getMetadata().getMetadataFile())));
        resolver.setParserPool(this.openSamlConfigBean.getParserPool());
        resolver.setFailFastInitialization(idp.getMetadata().isFailFast());
        resolver.setRequireValidMetadata(idp.getMetadata().isRequireValidMetadata());
        resolver.setId(idp.getEntityId());
        resolver.initialize();
        return resolver;
    } catch (final Exception e) {
        throw new BeanCreationException(e.getMessage(), e);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
private void resolveUrlBasedMetadataResource(final SamlRegisteredService service,
                                             final List<MetadataResolver> metadataResolvers,
                                             final AbstractResource metadataResource) throws Exception {

    final SamlIdPProperties.Metadata md = casProperties.getAuthn().getSamlIdp().getMetadata();
    final File backupDirectory = new File(md.getLocation().getFile(), "metadata-backups");
    final File backupFile = new File(backupDirectory, metadataResource.getFilename());

    LOGGER.debug("Metadata backup directory is designated to be [{}]", backupDirectory.getCanonicalPath());
    FileUtils.forceMkdir(backupDirectory);

    LOGGER.debug("Metadata backup file will be at [{}]", backupFile.getCanonicalPath());
    FileUtils.forceMkdirParent(backupFile);

    final HttpClientMultithreadedDownloader downloader =
            new HttpClientMultithreadedDownloader(metadataResource, backupFile);

    final FileBackedHTTPMetadataResolver metadataProvider = new FileBackedHTTPMetadataResolver(
            this.httpClient.getWrappedHttpClient(), metadataResource.getURL().toExternalForm(),
            backupFile.getCanonicalPath());
    buildSingleMetadataResolver(metadataProvider, service);
    metadataResolvers.add(metadataProvider);
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Build single metadata resolver.
 *
 * @param metadataFilterChain the metadata filters chained together
 * @param resource the resource
 * @param document the xml document to parse
 * @return list of resolved metadata from resources.
 * @throws IOException the iO exception
 */
private List<MetadataResolver> buildSingleMetadataResolver(final MetadataFilter metadataFilterChain,
                                         final Resource resource, final Document document) throws IOException {
    final List<MetadataResolver> resolvers = new ArrayList<>();
    final Element metadataRoot = document.getDocumentElement();
    final DOMMetadataResolver metadataProvider = new DOMMetadataResolver(metadataRoot);

    metadataProvider.setParserPool(this.configBean.getParserPool());
    metadataProvider.setFailFastInitialization(true);
    metadataProvider.setRequireValidMetadata(this.requireValidMetadata);
    metadataProvider.setId(metadataProvider.getClass().getCanonicalName());
    if (metadataFilterChain != null) {
        metadataProvider.setMetadataFilter(metadataFilterChain);
    }
    logger.debug("Initializing metadata resolver for [{}]", resource.getURL());

    try {
        metadataProvider.initialize();
    } catch (final ComponentInitializationException ex) {
        logger.warn("Could not initialize metadata resolver. Resource will be ignored", ex);
    }
    resolvers.add(metadataProvider);
    return resolvers;
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Load metadata from resource.
 *
 * @param metadataFilter the metadata filter
 * @param resource the resource
 * @param entityId the entity id
 */
private void loadMetadataFromResource(final MetadataFilter metadataFilter,
                                      final Resource resource, final String entityId) {

    try (InputStream in = getResourceInputStream(resource, entityId)) {
        logger.debug("Parsing [{}]", resource.getFilename());
        final Document document = this.configBean.getParserPool().parse(in);

        final List<MetadataResolver> resolvers = buildSingleMetadataResolver(metadataFilter, resource, document);
        this.metadataResolver = new ChainingMetadataResolver();
        synchronized (this.lock) {
            this.metadataResolver.setId(ChainingMetadataResolver.class.getCanonicalName());
            this.metadataResolver.setResolvers(resolvers);
            logger.info("Collected metadata from [{}] resource(s). Initializing aggregate resolver...",
                    resolvers.size());
            this.metadataResolver.initialize();
            logger.info("Metadata aggregate initialized successfully.", resolvers.size());
        }
    } catch (final Exception e) {
        logger.warn("Could not retrieve input stream from resource. Moving on...", e);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Load metadata from resource.
 *
 * @param metadataFilter the metadata filter
 * @param resource the resource
 * @param entityId the entity id
 */
private void loadMetadataFromResource(final MetadataFilter metadataFilter,
                                      final Resource resource, final String entityId) {

    try (final InputStream in = getResourceInputStream(resource, entityId)) {
        logger.debug("Parsing [{}]", resource.getFilename());
        final Document document = this.configBean.getParserPool().parse(in);

        final List<MetadataResolver> resolvers = buildSingleMetadataResolver(metadataFilter, resource, document);
        this.metadataResolver = new ChainingMetadataResolver();
        synchronized (this.lock) {
            this.metadataResolver.setId(ChainingMetadataResolver.class.getCanonicalName());
            this.metadataResolver.setResolvers(resolvers);
            logger.info("Collected metadata from [{}] resource(s). Initializing aggregate resolver...",
                    resolvers.size());
            this.metadataResolver.initialize();
            logger.info("Metadata aggregate initialized successfully.", resolvers.size());
        }
    } catch (final Exception e) {
        logger.warn("Could not retrieve input stream from resource. Moving on...", e);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Handle profile request.
 *
 * @param response the response
 * @param request  the request
 * @param decoder  the decoder
 * @throws Exception the exception
 */
protected void handleSloProfileRequest(final HttpServletResponse response,
                                           final HttpServletRequest request,
                                           final BaseHttpServletRequestXMLMessageDecoder decoder) throws Exception {
    if (singleLogoutCallbacksDisabled) {
        LOGGER.info("Processing SAML IdP SLO requests is disabled");
        return;
    }

    final Pair<? extends SignableSAMLObject, MessageContext> pair = decodeSamlContextFromHttpRequest(request, decoder, LogoutRequest.class);
    final LogoutRequest logoutRequest = LogoutRequest.class.cast(pair.getKey());
    final MessageContext ctx = pair.getValue();

    if (this.forceSignedLogoutRequests && !SAMLBindingSupport.isMessageSigned(ctx)) {
        throw new SAMLException("Logout request is not signed but should be.");
    }

    if (SAMLBindingSupport.isMessageSigned(ctx)) {
        final MetadataResolver resolver = SamlIdPUtils.getMetadataResolverForAllSamlServices(this.servicesManager,
                SamlIdPUtils.getIssuerFromSamlRequest(logoutRequest),
                this.samlRegisteredServiceCachingMetadataResolver);
        this.samlObjectSignatureValidator.verifySamlProfileRequestIfNeeded(logoutRequest, resolver, request, ctx);
    }
    SamlUtils.logSamlObject(this.configBean, logoutRequest);
    response.sendRedirect(this.logoutUrl);
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Verify saml profile request if needed.
 *
 * @param profileRequest the profile request
 * @param resolver       the resolver
 * @param request        the request
 * @param context        the context
 * @throws Exception the exception
 */
public void verifySamlProfileRequestIfNeeded(final RequestAbstractType profileRequest,
                                             final MetadataResolver resolver,
                                             final HttpServletRequest request,
                                             final MessageContext context) throws Exception {

    final RoleDescriptorResolver roleDescriptorResolver = getRoleDescriptorResolver(resolver, context, profileRequest);

    LOGGER.debug("Validating signature for [{}]", profileRequest.getClass().getName());

    final Signature signature = profileRequest.getSignature();
    if (signature != null) {
        validateSignatureOnProfileRequest(profileRequest, signature, roleDescriptorResolver);
    } else {
        validateSignatureOnAuthenticationRequest(profileRequest, request, context, roleDescriptorResolver);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
private void resolveClasspathBasedMetadataResource(final SamlRegisteredService service,
                                                   final List<MetadataResolver> metadataResolvers,
                                                   final String metadataLocation,
                                                   final AbstractResource metadataResource) {
    try (InputStream in = metadataResource.getInputStream()) {
        LOGGER.debug("Parsing metadata from [{}]", metadataLocation);
        final Document document = this.configBean.getParserPool().parse(in);

        final Element metadataRoot = document.getDocumentElement();
        final DOMMetadataResolver metadataProvider = new DOMMetadataResolver(metadataRoot);
        buildSingleMetadataResolver(metadataProvider, service);
        metadataResolvers.add(metadataProvider);
    } catch (final Exception e) {
        throw Throwables.propagate(e);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Load metadata from resource.
 *
 * @param metadataFilter the metadata filter
 * @param resource       the resource
 * @param entityId       the entity id
 * @return the list
 */
private List<MetadataResolver> loadMetadataFromResource(final MetadataFilter metadataFilter,
                                                        final Resource resource, final String entityId) {
    LOGGER.debug("Evaluating metadata resource [{}]", resource.getFilename());
    try (InputStream in = getResourceInputStream(resource, entityId)) {
        if (in.available() > 0) {
            LOGGER.debug("Parsing [{}]", resource.getFilename());
            final Document document = this.configBean.getParserPool().parse(in);
            return buildSingleMetadataResolver(metadataFilter, resource, document);
        }
        LOGGER.warn("Input stream from resource [{}] appears empty. Moving on...", resource.getFilename());
    } catch (final Exception e) {
        LOGGER.warn("Could not retrieve input stream from resource. Moving on...", e);
    }
    return new ArrayList<>();
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
/**
 * Build single metadata resolver.
 *
 * @param metadataFilterChain the metadata filters chained together
 * @param resource            the resource
 * @param document            the xml document to parse
 * @return list of resolved metadata from resources.
 * @throws IOException the iO exception
 */
private List<MetadataResolver> buildSingleMetadataResolver(final MetadataFilter metadataFilterChain,
                                                           final Resource resource, final Document document) throws IOException {
    try {
        final Element metadataRoot = document.getDocumentElement();
        final DOMMetadataResolver metadataProvider = new DOMMetadataResolver(metadataRoot);

        metadataProvider.setParserPool(this.configBean.getParserPool());
        metadataProvider.setFailFastInitialization(true);
        metadataProvider.setRequireValidMetadata(this.requireValidMetadata);
        metadataProvider.setId(metadataProvider.getClass().getCanonicalName());
        if (metadataFilterChain != null) {
            metadataProvider.setMetadataFilter(metadataFilterChain);
        }
        LOGGER.debug("Initializing metadata resolver for [{}]", resource);
        metadataProvider.initialize();

        final List<MetadataResolver> resolvers = new ArrayList<>();
        resolvers.add(metadataProvider);
        return resolvers;
    } catch (final Exception ex) {
        LOGGER.warn("Could not initialize metadata resolver. Resource will be ignored", ex);
    }
    return new ArrayList<>();
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
private MetadataResolver initializeMetadata() {
    try {
        InitializationService.initialize();
        String content = new MetadataFactory().defaultMetadata();
        StringBackedMetadataResolver metadataResolver = new StringBackedMetadataResolver(content);
        BasicParserPool pool = new BasicParserPool();
        pool.initialize();
        metadataResolver.setParserPool(pool);
        metadataResolver.setId("testResolver");
        metadataResolver.setResolveViaPredicatesOnly(true);
        metadataResolver.setRequireValidMetadata(true);
        EntityDescriptorCriterionPredicateRegistry registry = new EntityDescriptorCriterionPredicateRegistry();
        registry.register(EntitiesDescriptorNameCriterion.class, EntitiesDescriptorNamePredicate.class);
        metadataResolver.setCriterionPredicateRegistry(registry);
        metadataResolver.initialize();
        return metadataResolver;
    } catch (ComponentInitializationException | InitializationException e) {
        throw propagate(e);
    }
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
public ResponseService createResponseService(
    MetadataResolver hubMetadataResolver,
    AssertionTranslator assertionTranslator,
    DateTimeComparator dateTimeComparator
) throws ComponentInitializationException {
    AssertionDecrypter assertionDecrypter = createAssertionDecrypter();
    MetadataBackedSignatureValidator metadataBackedSignatureValidator = getMetadataBackedSignatureValidator(hubMetadataResolver);

    return new ResponseService(
        createStringToResponseTransformer(),
        assertionDecrypter,
        assertionTranslator,
        new SamlResponseSignatureValidator(new SamlMessageSignatureValidator(metadataBackedSignatureValidator)),
        new InstantValidator(dateTimeComparator)
    );
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
public AssertionTranslator createAssertionTranslator(
    MetadataResolver msaMetadataResolver,
    DateTimeComparator dateTimeComparator
) throws ComponentInitializationException {
    MetadataBackedSignatureValidator metadataBackedSignatureValidator = getMetadataBackedSignatureValidator(msaMetadataResolver);
    SamlMessageSignatureValidator samlMessageSignatureValidator = new SamlMessageSignatureValidator(metadataBackedSignatureValidator);
    TimeRestrictionValidator timeRestrictionValidator = new TimeRestrictionValidator(dateTimeComparator);

    SamlAssertionsSignatureValidator assertionsSignatureValidator = new SamlAssertionsSignatureValidator(samlMessageSignatureValidator);
    AssertionValidator assertionValidator = new AssertionValidator(
        new InstantValidator(dateTimeComparator),
        new SubjectValidator(timeRestrictionValidator),
        new ConditionsValidator(timeRestrictionValidator, new AudienceRestrictionValidator())
    );

    return new AssertionTranslator(
        assertionsSignatureValidator,
        assertionValidator
    );
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
@Before
public void setUp() throws Exception {
    PrivateKey privateKey = new PrivateKeyStoreFactory().create(TestEntityIds.TEST_RP).getEncryptionPrivateKeys().get(0);
    ResponseFactory responseFactory = new ResponseFactory(privateKey, privateKey);

    EntityDescriptor entityDescriptor = anEntityDescriptor()
        .withIdpSsoDescriptor(anIdpSsoDescriptor()
            .addKeyDescriptor(aKeyDescriptor()
                .withX509ForSigning(TEST_RP_MS_PUBLIC_SIGNING_CERT)
                .build())
            .build())
        .build();

    MetadataResolver msaMetadataResolver = mock(MetadataResolver.class);
    DateTimeComparator dateTimeComparator = new DateTimeComparator(Duration.standardSeconds(5));
    when(msaMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    translator = responseFactory.createAssertionTranslator(msaMetadataResolver, dateTimeComparator);
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
@Before
public void setUp() throws ComponentInitializationException {
    // Note: the private key and the encrypting credential need to be from the same keypair
    PrivateKey privateKey = new PrivateKeyStoreFactory().create(TestEntityIds.TEST_RP).getEncryptionPrivateKeys().get(0);
    encryptionCredentialFactory = new TestCredentialFactory(TEST_RP_PUBLIC_ENCRYPTION_CERT, TEST_RP_PRIVATE_ENCRYPTION_KEY);
    testRpSigningCredential = new TestCredentialFactory(TEST_RP_PUBLIC_SIGNING_CERT, TEST_RP_PRIVATE_SIGNING_KEY).getSigningCredential();

    hubMetadataResolver = mock(MetadataResolver.class);

    ResponseFactory responseFactory = new ResponseFactory(privateKey, privateKey);
    DateTimeComparator dateTimeComparator = new DateTimeComparator(Duration.standardSeconds(5));
    TimeRestrictionValidator timeRestrictionValidator = new TimeRestrictionValidator(dateTimeComparator);

    SamlAssertionsSignatureValidator samlAssertionsSignatureValidator = mock(SamlAssertionsSignatureValidator.class);
    InstantValidator instantValidator = new InstantValidator(dateTimeComparator);
    SubjectValidator subjectValidator = new SubjectValidator(timeRestrictionValidator);
    ConditionsValidator conditionsValidator = new ConditionsValidator(timeRestrictionValidator, new AudienceRestrictionValidator());
    AssertionValidator assertionValidator = new AssertionValidator(instantValidator, subjectValidator, conditionsValidator);
    AssertionTranslator assertionTranslator = new AssertionTranslator(samlAssertionsSignatureValidator, assertionValidator);

    responseService = responseFactory.createResponseService(
        hubMetadataResolver,
        assertionTranslator,
        dateTimeComparator
    );
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
@Override
protected void internalInit(final WebContext context) {
    CommonHelper.assertNotBlank("callbackUrl", this.callbackUrl);
    CommonHelper.assertNotNull("configuration", this.configuration); 
    
    // First of all, initialize the configuration. It may dynamically load some properties, if it is not a static one.
    this.configuration.init(getName(), context); 
    
    initCredentialProvider();
    initDecrypter();
    initSignatureSigningParametersProvider();
    final MetadataResolver metadataManager = initChainingMetadataResolver(
            initIdentityProviderMetadataResolver(),
            initServiceProviderMetadataResolver(context));
    initSAMLContextProvider(metadataManager);
    initSAMLObjectBuilder();
    initSignatureTrustEngineProvider(metadataManager);
    initSAMLResponseValidator();
    initSAMLProfileHandler();
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
@Inject
public MatchingServiceAdapterMetadataRepository(
        MatchingServiceAdapterConfiguration msaConfiguration,
        KeyDescriptorsUnmarshaller keyDescriptorsUnmarshaller,
        Function<EntitiesDescriptor, Element> entitiesDescriptorElementTransformer,
        CertificateStore certificateStore,
        @Named("VerifyMetadataResolver") MetadataResolver metadataResolver,
        MatchingServiceAdapterConfiguration matchingServiceAdapterConfiguration,
        @Named("HubEntityId") String hubEntityId) {

    this.msaConfiguration = msaConfiguration;
    this.keyDescriptorsUnmarshaller = keyDescriptorsUnmarshaller;
    this.entitiesDescriptorElementTransformer = entitiesDescriptorElementTransformer;
    this.certificateStore = certificateStore;
    this.metadataResolver = metadataResolver;
    this.matchingServiceAdapterConfiguration = matchingServiceAdapterConfiguration;
    this.hubEntityId = hubEntityId;
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
public VerifyAttributeQueryToInboundMatchingServiceRequestTransformer getVerifyAttributeQueryToInboundMatchingServiceRequestTransformer(
    final MetadataResolver metaDataResolver,
    final IdaKeyStore keyStore,
    final MatchingServiceAdapterConfiguration matchingServiceAdapterConfiguration,
    final String hubEntityId,
    CertificateChainEvaluableCriterion certificateChainEvaluableCriterion) throws ComponentInitializationException {
    HubAssertionUnmarshaller hubAssertionTransformer = coreTransformersFactory.getAssertionToHubAssertionTransformer(hubEntityId);
    IdentityProviderAssertionUnmarshaller identityProviderAssertionTransformer = new IdentityProviderAssertionUnmarshaller(
            new MatchingDatasetUnmarshaller(new AddressFactory()),
            new IdentityProviderAuthnStatementUnmarshaller(new AuthnContextFactory()),
            hubEntityId
    );
    SignatureValidator signatureValidator = getMetadataBackedSignatureValidator(metaDataResolver, certificateChainEvaluableCriterion);
    return new VerifyAttributeQueryToInboundMatchingServiceRequestTransformer(
            new SamlAttributeQueryValidator(),
            new AttributeQuerySignatureValidator(new SamlMessageSignatureValidator(signatureValidator)),
            new SamlAssertionsSignatureValidator(new SamlMessageSignatureValidator(signatureValidator)),
            new InboundMatchingServiceRequestUnmarshaller(hubAssertionTransformer, identityProviderAssertionTransformer),
            new SamlAttributeQueryAssertionsValidator(getAssertionValidator(), getIdentityProviderAssertionValidator(), matchingServiceAdapterConfiguration, hubEntityId),
            new AssertionDecrypter(new IdaKeyStoreCredentialRetriever(keyStore), new EncryptionAlgorithmValidator(), new DecrypterFactory()),
            hubEntityId);
}
 

import org.opensaml.saml.metadata.resolver.MetadataResolver; //导入依赖的package包/类
@Provides
@Singleton
public ServiceLocator<MatchingServiceRequestContext, MatchingService> getServiceLocator(
    HealthCheckMatchingService healthCheckMatchingService,
    VerifyMatchingService verifyMatchingService,
    Optional<EidasMatchingService> eidasMatchingService,
    @Named(COUNTRY_METADATA_RESOLVER) Optional<MetadataResolver> countryMetadataResolver
) {
    Map<Predicate<MatchingServiceRequestContext>, MatchingService> servicesMap = new LinkedHashMap<>();
    servicesMap.put((MatchingServiceRequestContext ctx) -> ctx.getAssertions().isEmpty(), healthCheckMatchingService);
    countryMetadataResolver.ifPresent(countryResolver -> servicesMap.put(new EidasAttributesBasedAttributeQueryDiscriminator(new ResolverBackedMetadataRepository(countryMetadataResolver.get())), eidasMatchingService.get()));
    servicesMap.put(ctx -> true, verifyMatchingService);

    return new MatchingServiceLocator(
        ImmutableMap.copyOf(servicesMap)
    );
}