/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.cxf.rs.security.oauth2.saml;
import java.util.List;
import javax.ws.rs.NotAuthorizedException;
import javax.ws.rs.core.Response;
import javax.ws.rs.core.UriBuilder;
import org.apache.cxf.jaxrs.impl.UriInfoImpl;
import org.apache.cxf.message.Message;
import org.apache.cxf.rs.security.oauth2.utils.OAuthConstants;
import org.apache.ws.security.saml.ext.AssertionWrapper;
import org.apache.ws.security.saml.ext.builder.SAML2Constants;
import org.opensaml.saml2.core.Audience;
import org.opensaml.saml2.core.AudienceRestriction;
import org.opensaml.saml2.core.Conditions;
import org.opensaml.saml2.core.Issuer;
import org.opensaml.saml2.core.SubjectConfirmation;
import org.opensaml.saml2.core.SubjectConfirmationData;
public class SamlOAuthValidator {
private String accessTokenServiceAddress;
private String issuer;
private String clientAddress;
private boolean subjectConfirmationDataRequired;
public SamlOAuthValidator() {
}
public void setSubjectConfirmationDataRequired(boolean required) {
subjectConfirmationDataRequired = required;
}
public void setAccessTokenServiceAddress(String address) {
accessTokenServiceAddress = address;
}
public void setIssuer(String value) {
issuer = value;
}
public void setClientAddress(String value) {
issuer = value;
}
public void validate(Message message, AssertionWrapper wrapper) {
Conditions cs = wrapper.getSaml2().getConditions();
validateAudience(message, cs);
if (issuer != null) {
String actualIssuer = getIssuer(wrapper);
String expectedIssuer = OAuthConstants.CLIENT_ID.equals(issuer)
? wrapper.getSaml2().getSubject().getNameID().getValue() : issuer;
if (actualIssuer == null || !actualIssuer.equals(expectedIssuer)) {
throw new NotAuthorizedException(errorResponse());
}
}
if (!validateAuthenticationSubject(message, cs, wrapper.getSaml2().getSubject())) {
throw new NotAuthorizedException(errorResponse());
}
}
private String getIssuer(AssertionWrapper assertionW) {
Issuer samlIssuer = assertionW.getSaml2().getIssuer();
return samlIssuer == null ? null : samlIssuer.getValue();
}
private void validateAudience(Message message, Conditions cs) {
String absoluteAddress = getAbsoluteTargetAddress(message);
List<AudienceRestriction> restrictions = cs.getAudienceRestrictions();
for (AudienceRestriction ar : restrictions) {
List<Audience> audiences = ar.getAudiences();
for (Audience a : audiences) {
if (absoluteAddress.equals(a.getAudienceURI())) {
return;
}
}
}
throw new NotAuthorizedException(errorResponse());
}
private String getAbsoluteTargetAddress(Message m) {
if (accessTokenServiceAddress == null) {
return new UriInfoImpl(m).getAbsolutePath().toString();
}
if (!accessTokenServiceAddress.startsWith("http")) {
String httpBasePath = (String)m.get("http.base.path");
return UriBuilder.fromUri(httpBasePath)
.path(accessTokenServiceAddress)
.build()
.toString();
} else {
return accessTokenServiceAddress;
}
}
private boolean validateAuthenticationSubject(Message m,
Conditions cs,
org.opensaml.saml2.core.Subject subject) {
if (subject.getSubjectConfirmations() == null) {
return false;
}
// We need to find a Bearer Subject Confirmation method
for (SubjectConfirmation subjectConf : subject.getSubjectConfirmations()) {
if (SAML2Constants.CONF_BEARER.equals(subjectConf.getMethod())) {
validateSubjectConfirmation(m, cs, subjectConf.getSubjectConfirmationData());
}
}
return true;
}
/**
* Validate a (Bearer) Subject Confirmation
*/
private void validateSubjectConfirmation(Message m,
Conditions cs,
SubjectConfirmationData subjectConfData) {
if (subjectConfData == null) {
if (!subjectConfirmationDataRequired
&& cs.getNotOnOrAfter() != null && !cs.getNotOnOrAfter().isBeforeNow()) {
return;
}
throw new NotAuthorizedException(errorResponse());
}
// Recipient must match assertion consumer URL
String recipient = subjectConfData.getRecipient();
if (recipient == null || !recipient.equals(getAbsoluteTargetAddress(m))) {
throw new NotAuthorizedException(errorResponse());
}
// We must have a NotOnOrAfter timestamp
if (subjectConfData.getNotOnOrAfter() == null
|| subjectConfData.getNotOnOrAfter().isBeforeNow()) {
throw new NotAuthorizedException(errorResponse());
}
//TODO: replay cache, same as with SAML SSO case
// Check address
if (subjectConfData.getAddress() != null
&& (clientAddress == null || !subjectConfData.getAddress().equals(clientAddress))) {
throw new NotAuthorizedException(errorResponse());
}
}
private static Response errorResponse() {
return Response.status(401).build();
}
}