-
-
-
-
- Home Page!
-
- Logout
-
- You are now redirected back to " + ssoAgentConfig.getSAML2().getIdPURL() + " \n" + - "If the redirection fails, please click the post button.
\n" + - "\n" + - "\n" + - "\n" + - ""; - } else { - htmlPayload = htmlPayload.replace("", - htmlParams.toString()); - } - return htmlPayload; - - } - - public String buildPostResponse(SignableSAMLObject requestMessage) throws SSOAgentException { - - return encodeRequestMessage(requestMessage, SAMLConstants.SAML2_POST_BINDING_URI); - } - - public void processResponse(HttpServletRequest request, HttpServletResponse response) - throws SSOAgentException { - - String saml2SSOResponse = request.getParameter(SSOAgentConstants.SAML2SSO.HTTP_POST_PARAM_SAML2_RESP); - - if (saml2SSOResponse != null) { - String decodedResponse = new String(Base64Support.decode(saml2SSOResponse), Charset.forName("UTF-8")); - XMLObject samlObject = SSOAgentUtils.unmarshall(decodedResponse); - if (samlObject instanceof LogoutResponse) { - //This is a SAML response for a single logout request from the SP - doSLO(request); - request.setAttribute(org.wso2.carbon.identity.sso.agent.util.SSOAgentConstants.SHOULD_GO_TO_WELCOME_PAGE, "true"); - } else { - processSSOResponse(request); - } - String relayState = request.getParameter(RelayState.DEFAULT_ELEMENT_LOCAL_NAME); - - if (relayState != null && !relayState.isEmpty() && !"null".equalsIgnoreCase(relayState)) { //additional - // checks for incompetent IdPs - ssoAgentConfig.getSAML2().setRelayState(relayState); - } - - } else { - throw new SSOAgentException("Invalid SAML2 Response. SAML2 Response can not be null."); - } - } - - /** - * Process authentication response with SAML2 artifact. - * - * @param request Http Servlet Request object. - * @throws SSOAgentException - */ - public void processArtifactResponse(HttpServletRequest request) throws SSOAgentException { - - SAMLSSOArtifactResolutionService artifactResolutionService = - new SAMLSSOArtifactResolutionService(ssoAgentConfig); - try { - ArtifactResponse artifactResponse = artifactResolutionService.getSAMLArtifactResponse( - request.getParameter(SSOAgentConstants.SAML2SSO.SAML2_ARTIFACT_RESP)); - - if (!StringUtils.equals(artifactResponse.getStatus().getStatusCode().getValue(), StatusCode.SUCCESS)) { - throw new SSOAgentException("Received an invalid SAML response with status code: " + - artifactResponse.getStatus().getStatusCode().getValue()); - } - if (artifactResponse.getMessage() == null) { - throw new SSOAgentException("Received SAML2 Artifact response message was null."); - } - XMLObject xmlObject = artifactResponse.getMessage(); - if (xmlObject instanceof Response || xmlObject instanceof LogoutResponse) { - validateSAMLResponseInArtifactResponse(xmlObject); - executeSAMLResponse(request, xmlObject); - } else { - throw new SSOAgentException("Received incorrect Artifact Response message with type: " + - xmlObject.getClass()); - } - } catch (ArtifactResolutionException e) { - throw new SSOAgentException("Error when getting the Artifact Response.", e); - } - } - - /** - * Validate Artifact Response message content. - * - * @param response Message of the received Artifact Response. - * @throws SSOAgentException - */ - private void validateSAMLResponseInArtifactResponse(XMLObject response) throws SSOAgentException { - - // Checking for duplicate samlp:Response. This is done to thwart possible XSW attacks - NodeList responseList = response.getDOM().getElementsByTagNameNS(SAMLConstants.SAML20P_NS, "Response"); - if (responseList != null && responseList.getLength() > 0) { - throw new SSOAgentException("Error occurred while processing SAML2 response. " + - "Invalid schema for the SAML2 response. Multiple Response elements found."); - } - - // Checking for multiple Assertions. This is done to thwart possible XSW attacks. - NodeList assertionList = response.getDOM().getElementsByTagNameNS(SAMLConstants.SAML20_NS, "Assertion"); - if (assertionList != null && assertionList.getLength() > 1) { - throw new SSOAgentException("Error occurred while processing SAML2 response. " + - "Invalid schema for the SAML2 response. Multiple Assertion elements found."); - } - } - - /** - * Redirect SAML response received via artifact resolution. - * - * @param request Initial authentication request. - * @param samlObject Response received via artifact resolution. - * @throws SSOAgentException - */ - private void executeSAMLResponse(HttpServletRequest request, XMLObject samlObject) throws SSOAgentException { - if (samlObject instanceof LogoutResponse) { - // This is a SAML response for a single logout request from the SP. - doSLO(request); - } else if (samlObject instanceof Response) { - processSSOResponse(request, (Response) samlObject); - } else { - throw new SSOAgentException("Unable to process unknown SAML object of type: " + samlObject.getClass()); - } - } - - /** - * This method handles the logout requests from the IdP - * Any request for the defined logout URL is handled here - * - * @param request - * @throws javax.servlet.ServletException - * @throws IOException - */ - public LogoutResponse doSLO(HttpServletRequest request) throws SSOAgentException { - - XMLObject saml2Object = null; - if (request.getParameter(SSOAgentConstants.SAML2SSO.HTTP_POST_PARAM_SAML2_AUTH_REQ) != null) { - saml2Object = SSOAgentUtils.unmarshall(new String(Base64Support.decode(request.getParameter( - SSOAgentConstants.SAML2SSO.HTTP_POST_PARAM_SAML2_AUTH_REQ)), Charset.forName("UTF-8"))); - } - if (saml2Object == null) { - saml2Object = SSOAgentUtils.unmarshall(new String(Base64Support.decode(request.getParameter( - SSOAgentConstants.SAML2SSO.HTTP_POST_PARAM_SAML2_RESP)), Charset.forName("UTF-8"))); - } - if (saml2Object instanceof LogoutRequest) { - LogoutRequest logoutRequest = (LogoutRequest) saml2Object; - String sessionIndex = logoutRequest.getSessionIndexes().get(0).getSessionIndex(); - SetYou are logged in as <%=subjectId%> -
- <% - } - %> -| <%=entry.getKey()%> - | -<%=entry.getValue()%> - | -