From 8ae1b1740d4b7c5516968cb80cdb58598edbfe8b Mon Sep 17 00:00:00 2001 From: Hynek Mlnarik Date: Thu, 3 Nov 2016 16:26:44 +0100 Subject: [PATCH] KEYCLOAK-1881 Client installers --- .../KeycloakSamlClientInstallation.java | 16 +--- .../KeycloakSamlSubsystemInstallation.java | 2 +- .../SamlIDPDescriptorClientInstallation.java | 89 +++++++++++-------- .../SamlSPDescriptorClientInstallation.java | 2 +- 4 files changed, 58 insertions(+), 51 deletions(-) diff --git a/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlClientInstallation.java b/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlClientInstallation.java index 2175b32cc6..14166cef3e 100755 --- a/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlClientInstallation.java +++ b/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlClientInstallation.java @@ -18,7 +18,6 @@ package org.keycloak.protocol.saml.installation; import org.keycloak.Config; -import org.keycloak.common.util.PemUtils; import org.keycloak.models.ClientModel; import org.keycloak.models.KeycloakSession; import org.keycloak.models.KeycloakSessionFactory; @@ -42,14 +41,14 @@ public class KeycloakSamlClientInstallation implements ClientInstallationProvide @Override public Response generateInstallation(KeycloakSession session, RealmModel realm, ClientModel client, URI baseUri) { SamlClient samlClient = new SamlClient(client); - StringBuffer buffer = new StringBuffer(); + StringBuilder buffer = new StringBuilder(); buffer.append("\n"); baseXml(session, realm, client, baseUri, samlClient, buffer); buffer.append("\n"); return Response.ok(buffer.toString(), MediaType.TEXT_PLAIN_TYPE).build(); } - public static void baseXml(KeycloakSession session, RealmModel realm, ClientModel client, URI baseUri, SamlClient samlClient, StringBuffer buffer) { + public static void baseXml(KeycloakSession session, RealmModel realm, ClientModel client, URI baseUri, SamlClient samlClient, StringBuilder buffer) { buffer.append(" \n"); @@ -113,15 +112,6 @@ public class KeycloakSamlClientInstallation implements ClientInstallationProvide buffer.append(" postBindingUrl=\"").append(bindingUrl).append("\"\n"); buffer.append(" redirectBindingUrl=\"").append(bindingUrl).append("\""); buffer.append("/>\n"); - if (samlClient.requiresRealmSignature()) { - buffer.append(" \n"); - buffer.append(" \n"); - buffer.append(" \n"); - buffer.append(" ").append(PemUtils.encodeCertificate(session.keys().getActiveKey(realm).getCertificate())).append("\n"); - buffer.append(" \n"); - buffer.append(" \n"); - buffer.append(" \n"); - } buffer.append(" \n"); buffer.append(" \n"); } @@ -138,7 +128,7 @@ public class KeycloakSamlClientInstallation implements ClientInstallationProvide @Override public String getHelpText() { - return "Keycloak SAML adapter configuration file. Put this in WEB-INF directory if your WAR."; + return "Keycloak SAML adapter configuration file. Put this in WEB-INF directory of your WAR."; } @Override diff --git a/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlSubsystemInstallation.java b/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlSubsystemInstallation.java index ea77d474b5..bde0ccd3d9 100755 --- a/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlSubsystemInstallation.java +++ b/services/src/main/java/org/keycloak/protocol/saml/installation/KeycloakSamlSubsystemInstallation.java @@ -39,7 +39,7 @@ public class KeycloakSamlSubsystemInstallation implements ClientInstallationProv @Override public Response generateInstallation(KeycloakSession session, RealmModel realm, ClientModel client, URI baseUri) { SamlClient samlClient = new SamlClient(client); - StringBuffer buffer = new StringBuffer(); + StringBuilder buffer = new StringBuilder(); buffer.append("\n"); KeycloakSamlClientInstallation.baseXml(session, realm, client, baseUri, samlClient, buffer); buffer.append("\n"); diff --git a/services/src/main/java/org/keycloak/protocol/saml/installation/SamlIDPDescriptorClientInstallation.java b/services/src/main/java/org/keycloak/protocol/saml/installation/SamlIDPDescriptorClientInstallation.java index 4b84363809..3c451b3857 100755 --- a/services/src/main/java/org/keycloak/protocol/saml/installation/SamlIDPDescriptorClientInstallation.java +++ b/services/src/main/java/org/keycloak/protocol/saml/installation/SamlIDPDescriptorClientInstallation.java @@ -32,6 +32,11 @@ import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import javax.ws.rs.core.UriBuilder; import java.net.URI; +import java.util.Set; +import java.util.TreeSet; +import org.keycloak.dom.saml.v2.metadata.KeyTypes; +import org.keycloak.keys.KeyMetadata; +import org.keycloak.saml.SPMetadataDescriptor; /** * @author Bill Burke @@ -41,49 +46,61 @@ public class SamlIDPDescriptorClientInstallation implements ClientInstallationPr public static String getIDPDescriptorForClient(KeycloakSession session, RealmModel realm, ClientModel client, URI serverBaseUri) { SamlClient samlClient = new SamlClient(client); String idpEntityId = RealmsResource.realmBaseUrl(UriBuilder.fromUri(serverBaseUri)).build(realm.getName()).toString(); - String idp = "\n" + - "\n" + - " \n"; + StringBuilder sb = new StringBuilder(); + sb.append("\n" + + "\n" + + " \n"); if (samlClient.forceNameIDFormat() && samlClient.getNameIDFormat() != null) { - idp += " " + samlClient.getNameIDFormat() + "\n"; + sb.append(" ").append(samlClient.getNameIDFormat()).append("\n"); } else { - idp += " urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\n" + - " urn:oasis:names:tc:SAML:2.0:nameid-format:transient\n" + - " urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n" + - " urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\n"; + sb.append(" urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\n" + + " urn:oasis:names:tc:SAML:2.0:nameid-format:transient\n" + + " urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n" + + " urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\n"); } String bindUrl = RealmsResource.protocolUrl(UriBuilder.fromUri(serverBaseUri)).build(realm.getName(), SamlProtocol.LOGIN_PROTOCOL).toString(); - idp += "\n" + - " \n"; - if (!samlClient.forcePostBinding()) { - idp += " \n"; + sb.append("\n" + + " \n"); + if (! samlClient.forcePostBinding()) { + sb.append(" \n"); } - idp += " \n"; - if (!samlClient.forcePostBinding()) { - idp += " \n"; + sb.append(" \n"); + if (! samlClient.forcePostBinding()) { + sb.append(" \n"); } - idp += " \n" + - " \n" + - " \n" + - " \n" + - " " + PemUtils.encodeCertificate(session.keys().getActiveKey(realm).getCertificate()) + "\n" + - " \n" + - " \n" + - " \n" + - " \n" + - " \n" + - "\n"; - return idp; + + Set keys = new TreeSet<>((o1, o2) -> o1.getStatus() == o2.getStatus() // Status can be only PASSIVE OR ACTIVE, push PASSIVE to end of list + ? (int) (o2.getProviderPriority() - o1.getProviderPriority()) + : (o1.getStatus() == KeyMetadata.Status.PASSIVE ? 1 : -1)); + keys.addAll(session.keys().getKeys(realm, false)); + for (KeyMetadata key : keys) { + addKeyInfo(sb, key, KeyTypes.SIGNING.value()); + } + + sb.append(" \n" + + "\n"); + return sb.toString(); + } + + private static void addKeyInfo(StringBuilder target, KeyMetadata key, String purpose) { + if (key == null) { + return; + } + + target.append(SPMetadataDescriptor.xmlKeyInfo(" ", key.getKid(), PemUtils.encodeCertificate(key.getCertificate()), purpose, false)); } @Override diff --git a/services/src/main/java/org/keycloak/protocol/saml/installation/SamlSPDescriptorClientInstallation.java b/services/src/main/java/org/keycloak/protocol/saml/installation/SamlSPDescriptorClientInstallation.java index ced0d7a3ca..6349953437 100755 --- a/services/src/main/java/org/keycloak/protocol/saml/installation/SamlSPDescriptorClientInstallation.java +++ b/services/src/main/java/org/keycloak/protocol/saml/installation/SamlSPDescriptorClientInstallation.java @@ -46,7 +46,7 @@ public class SamlSPDescriptorClientInstallation implements ClientInstallationPro if (logoutUrl == null) logoutUrl = client.getManagementUrl(); String nameIdFormat = samlClient.getNameIDFormat(); if (nameIdFormat == null) nameIdFormat = SamlProtocol.SAML_DEFAULT_NAMEID_FORMAT; - String spCertificate = SPMetadataDescriptor.xmlKeyInfo(null, samlClient.getClientSigningCertificate(), KeyTypes.SIGNING.value(), true); + String spCertificate = SPMetadataDescriptor.xmlKeyInfo(" ", null, samlClient.getClientSigningCertificate(), KeyTypes.SIGNING.value(), true); return SPMetadataDescriptor.getSPDescriptor(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get(), assertionUrl, logoutUrl, samlClient.requiresClientSignature(), client.getClientId(), nameIdFormat, spCertificate); }