@Nonnull final Assertion assertion, @Nonnull final ValidationContext context) throws AssertionValidationException { String address = StringSupport.trimOrNull(confirmation.getSubjectConfirmationData().getAddress()); if (address == null) { return ValidationResult.VALID;
/** {@inheritDoc} */ protected void marshallAttributes(XMLObject samlObject, Element domElement) throws MarshallingException { SubjectConfirmationData subjectCD = (SubjectConfirmationData) samlObject; if (subjectCD.getNotBefore() != null) { String notBeforeStr = SAMLConfigurationSupport.getSAMLDateFormatter().print(subjectCD.getNotBefore()); domElement.setAttributeNS(null, SubjectConfirmationData.NOT_BEFORE_ATTRIB_NAME, notBeforeStr); } if (subjectCD.getNotOnOrAfter() != null) { String notOnOrAfterStr = SAMLConfigurationSupport.getSAMLDateFormatter().print(subjectCD.getNotOnOrAfter()); domElement.setAttributeNS(null, SubjectConfirmationData.NOT_ON_OR_AFTER_ATTRIB_NAME, notOnOrAfterStr); } if (subjectCD.getRecipient() != null) { domElement.setAttributeNS(null, SubjectConfirmationData.RECIPIENT_ATTRIB_NAME, subjectCD.getRecipient()); } if (subjectCD.getInResponseTo() != null) { domElement.setAttributeNS(null, SubjectConfirmationData.IN_RESPONSE_TO_ATTRIB_NAME, subjectCD .getInResponseTo()); } if (subjectCD.getAddress() != null) { domElement.setAttributeNS(null, SubjectConfirmationData.ADDRESS_ATTRIB_NAME, subjectCD.getAddress()); } marshallUnknownAttributes(subjectCD, domElement); } }
if (subjectConfData.getAddress() != null && clientAddress != null && !subjectConfData.getAddress().equals(clientAddress)) { LOG.fine("Subject Conf Data address " + subjectConfData.getAddress() + " does not match" + " client address " + clientAddress); throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
/** * Validate a (Bearer) Subject Confirmation */ private void validateSubjectConfirmation(Message m, Conditions cs, SubjectConfirmationData subjectConfData) { if (subjectConfData == null) { if (!subjectConfirmationDataRequired && cs.getNotOnOrAfter() != null && !cs.getNotOnOrAfter().isBeforeNow()) { return; } throw ExceptionUtils.toNotAuthorizedException(null, null); } // Recipient must match assertion consumer URL String recipient = subjectConfData.getRecipient(); if (recipient == null || !recipient.equals(getAbsoluteTargetAddress(m))) { throw ExceptionUtils.toNotAuthorizedException(null, null); } // We must have a NotOnOrAfter timestamp if (subjectConfData.getNotOnOrAfter() == null || subjectConfData.getNotOnOrAfter().isBeforeNow()) { throw ExceptionUtils.toNotAuthorizedException(null, null); } //TODO: replay cache, same as with SAML SSO case // Check address if (subjectConfData.getAddress() != null && (clientAddress == null || !subjectConfData.getAddress().equals(clientAddress))) { throw ExceptionUtils.toNotAuthorizedException(null, null); } }
/** * Validate a (Bearer) Subject Confirmation */ private void validateSubjectConfirmation(Message m, Conditions cs, SubjectConfirmationData subjectConfData) { if (subjectConfData == null) { if (!subjectConfirmationDataRequired && cs.getNotOnOrAfter() != null && !cs.getNotOnOrAfter().isBeforeNow()) { return; } throw ExceptionUtils.toNotAuthorizedException(null, null); } // Recipient must match assertion consumer URL String recipient = subjectConfData.getRecipient(); if (recipient == null || !recipient.equals(getAbsoluteTargetAddress(m))) { throw ExceptionUtils.toNotAuthorizedException(null, null); } // We must have a NotOnOrAfter timestamp if (subjectConfData.getNotOnOrAfter() == null || subjectConfData.getNotOnOrAfter().isBeforeNow()) { throw ExceptionUtils.toNotAuthorizedException(null, null); } //TODO: replay cache, same as with SAML SSO case // Check address if (subjectConfData.getAddress() != null && (clientAddress == null || !subjectConfData.getAddress().equals(clientAddress))) { throw ExceptionUtils.toNotAuthorizedException(null, null); } }
/** * Create an efficient field-wise copy of a {@link SubjectConfirmation}. * * @param confirmation the object to clone * * @return the copy */ @Nonnull private SubjectConfirmation cloneConfirmation(@Nonnull final SubjectConfirmation confirmation) { final SubjectConfirmation clone = confirmationBuilder.buildObject(); clone.setMethod(confirmation.getMethod()); final SubjectConfirmationData data = confirmation.getSubjectConfirmationData(); if (data != null) { final SubjectConfirmationData cloneData = confirmationDataBuilder.buildObject(); cloneData.setAddress(data.getAddress()); cloneData.setInResponseTo(data.getInResponseTo()); cloneData.setRecipient(data.getRecipient()); cloneData.setNotBefore(data.getNotBefore()); cloneData.setNotOnOrAfter(data.getNotOnOrAfter()); clone.setSubjectConfirmationData(cloneData); } return clone; }