Author: coheigea
Date: Mon Dec 16 15:20:35 2013
New Revision: 1551229
URL: http://svn.apache.org/r1551229
Log:
Merged revisions 1551228 via git cherry-pick from
https://svn.apache.org/repos/asf/cxf/trunk
........
r1551228 | coheigea | 2013-12-16 15:18:58 +0000 (Mon, 16 Dec 2013) | 2 lines
Validation fix in the STS
........
Modified:
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
Modified:
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
URL:
http://svn.apache.org/viewvc/cxf/branches/2.7.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java?rev=1551229&r1=1551228&r2=1551229&view=diff
==============================================================================
---
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
(original)
+++
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
Mon Dec 16 15:20:35 2013
@@ -148,6 +148,29 @@ public class SAMLTokenValidator implemen
SAMLTokenPrincipal samlPrincipal = new
SAMLTokenPrincipal(assertion);
response.setPrincipal(samlPrincipal);
+ if (!assertion.isSigned()) {
+ LOG.log(Level.WARNING, "The received assertion is not signed,
and therefore not trusted");
+ return response;
+ }
+
+ RequestData requestData = new RequestData();
+ requestData.setSigVerCrypto(sigCrypto);
+ WSSConfig wssConfig = WSSConfig.getNewInstance();
+ requestData.setWssConfig(wssConfig);
+ requestData.setCallbackHandler(callbackHandler);
+
requestData.setMsgContext(tokenParameters.getWebServiceContext().getMessageContext());
+
+ WSDocInfo docInfo = new
WSDocInfo(validateTargetElement.getOwnerDocument());
+
+ // Verify the signature
+ Signature sig = assertion.getSignature();
+ KeyInfo keyInfo = sig.getKeyInfo();
+ SAMLKeyInfo samlKeyInfo =
+ SAMLUtil.getCredentialFromKeyInfo(
+ keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData,
docInfo), sigCrypto
+ );
+ assertion.verifySignature(samlKeyInfo);
+
SecurityToken secToken = null;
byte[] signatureValue = assertion.getSignatureValue();
if (tokenParameters.getTokenStore() != null && signatureValue !=
null
@@ -164,6 +187,7 @@ public class SAMLTokenValidator implemen
}
if (secToken == null) {
+<<<<<<< HEAD
if (!assertion.isSigned()) {
LOG.log(Level.WARNING, "The received assertion is not
signed, and therefore not trusted");
return response;
@@ -181,6 +205,8 @@ public class SAMLTokenValidator implemen
requestData, new
WSDocInfo(validateTargetElement.getOwnerDocument())
);
+=======
+>>>>>>> 4b3dbb3... Validation fix in the STS
// Validate the assertion against schemas/profiles
validateAssertion(assertion);
@@ -201,7 +227,6 @@ public class SAMLTokenValidator implemen
if (!certConstraints.matches(cert)) {
return response;
}
-
}
// Parse roles from the validated token
Modified:
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
URL:
http://svn.apache.org/viewvc/cxf/branches/2.7.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java?rev=1551229&r1=1551228&r2=1551229&view=diff
==============================================================================
---
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
(original)
+++
cxf/branches/2.7.x-fixes/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/validator/SAMLTokenValidatorTest.java
Mon Dec 16 15:20:35 2013
@@ -34,6 +34,7 @@ import javax.security.auth.callback.Unsu
import org.w3c.dom.Document;
import org.w3c.dom.Element;
+
import org.apache.cxf.jaxws.context.WebServiceContextImpl;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
@@ -425,6 +426,53 @@ public class SAMLTokenValidatorTest exte
assertTrue(roles.iterator().next().getName().equals("employee"));
}
+ /**
+ * Test an invalid SAML 2 Assertion
+ */
+ @org.junit.Test
+ public void testInvalidSAML2Assertion() throws Exception {
+ TokenValidator samlTokenValidator = new SAMLTokenValidator();
+ TokenValidatorParameters validatorParameters =
createValidatorParameters();
+ TokenRequirements tokenRequirements =
validatorParameters.getTokenRequirements();
+
+ // Create a ValidateTarget consisting of a SAML Assertion
+ Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
+ CallbackHandler callbackHandler = new PasswordCallbackHandler();
+ Element samlToken =
+ createSAMLAssertion(WSConstants.WSS_SAML2_TOKEN_TYPE, crypto,
"mystskey", callbackHandler);
+ Document doc = samlToken.getOwnerDocument();
+ samlToken = (Element)doc.appendChild(samlToken);
+
+ ReceivedToken validateTarget = new ReceivedToken(samlToken);
+ tokenRequirements.setValidateTarget(validateTarget);
+ validatorParameters.setToken(validateTarget);
+
+ assertTrue(samlTokenValidator.canHandleToken(validateTarget));
+
+ TokenValidatorResponse validatorResponse =
+ samlTokenValidator.validateToken(validatorParameters);
+ assertTrue(validatorResponse != null);
+ assertTrue(validatorResponse.getToken() != null);
+ assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
+
+ // Replace "alice" with "bob".
+ Element nameID =
+ (Element)samlToken.getElementsByTagNameNS(WSConstants.SAML2_NS,
"NameID").item(0);
+ nameID.setTextContent("bob");
+
+ // Now validate again
+ validateTarget = new ReceivedToken(samlToken);
+ tokenRequirements.setValidateTarget(validateTarget);
+ validatorParameters.setToken(validateTarget);
+
+ assertTrue(samlTokenValidator.canHandleToken(validateTarget));
+
+ validatorResponse =
samlTokenValidator.validateToken(validatorParameters);
+ assertTrue(validatorResponse != null);
+ assertTrue(validatorResponse.getToken() != null);
+ assertTrue(validatorResponse.getToken().getState() != STATE.VALID);
+ }
+
private TokenValidatorParameters createValidatorParameters() throws
WSSecurityException {
TokenValidatorParameters parameters = new TokenValidatorParameters();
@@ -627,5 +675,5 @@ public class SAMLTokenValidatorTest exte
}
}
-
+
}
