From fe98c30077d49822624c728e9fe668f8fb0ff074 Mon Sep 17 00:00:00 2001 From: Patric Vormstein Date: Wed, 21 Mar 2018 14:41:47 +0100 Subject: [PATCH] [KEYCLOAK-6412] - Handle Proxy Restriction Tag incl. Test --- .../saml/assertion/SAMLAssertionQNames.java | 1 + .../saml/assertion/SAMLConditionsParser.java | 6 ++ .../assertion/SAMLProxyRestrictionParser.java | 55 +++++++++++++ .../core/parsers/saml/SAMLParserTest.java | 5 ++ ...K-6412-response-with-proxy-restriction.xml | 78 +++++++++++++++++++ 5 files changed, 145 insertions(+) create mode 100644 saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLProxyRestrictionParser.java create mode 100644 saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLAssertionQNames.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLAssertionQNames.java index 9e18f670a8..85d46af1df 100644 --- a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLAssertionQNames.java +++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLAssertionQNames.java @@ -64,6 +64,7 @@ public enum SAMLAssertionQNames implements HasQName { // Attribute names ATTR_ADDRESS(null, "Address"), ATTR_AUTHN_INSTANT(null, "AuthnInstant"), + ATTR_COUNT(null, "Count"), ATTR_DNS_NAME(null, "DNSName"), ATTR_FORMAT(null, "Format"), ATTR_FRIENDLY_NAME(null, "FriendlyName"), diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLConditionsParser.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLConditionsParser.java index 3024bc2cc4..db0fda1fe2 100755 --- a/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLConditionsParser.java +++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/assertion/SAMLConditionsParser.java @@ -19,6 +19,7 @@ package org.keycloak.saml.processing.core.parsers.saml.assertion; import org.keycloak.dom.saml.v2.assertion.AudienceRestrictionType; import org.keycloak.dom.saml.v2.assertion.ConditionsType; import org.keycloak.dom.saml.v2.assertion.OneTimeUseType; +import org.keycloak.dom.saml.v2.assertion.ProxyRestrictionType; import org.keycloak.saml.common.exceptions.ParsingException; import org.keycloak.saml.common.util.StaxParserUtil; import javax.xml.stream.XMLEventReader; @@ -64,6 +65,11 @@ public class SAMLConditionsParser extends AbstractStaxSamlAssertionParser tag + * + * @author Patric Vormstein + * @since 21.03.2018 + */ +public class SAMLProxyRestrictionParser extends AbstractStaxSamlAssertionParser { + + private static final SAMLProxyRestrictionParser INSTANCE = new SAMLProxyRestrictionParser(); + + public SAMLProxyRestrictionParser() { + super(SAMLAssertionQNames.PROXY_RESTRICTION); + } + + public static SAMLProxyRestrictionParser getInstance() { + return INSTANCE; + } + + @Override + protected ProxyRestrictionType instantiateElement(XMLEventReader xmlEventReader, StartElement element) throws ParsingException { + ProxyRestrictionType proxyRestriction = new ProxyRestrictionType(); + Integer count = StaxParserUtil.getIntegerAttributeValue(element, SAMLAssertionQNames.ATTR_COUNT); + + if (count != null) { + proxyRestriction.setCount(BigInteger.valueOf(count)); + } + + return proxyRestriction; + } + + @Override + protected void processSubElement(XMLEventReader xmlEventReader, ProxyRestrictionType target, SAMLAssertionQNames element, StartElement elementDetail) throws ParsingException { + switch (element) { + case AUDIENCE: + StaxParserUtil.advance(xmlEventReader); + String audienceValue = StaxParserUtil.getElementText(xmlEventReader); + target.addAudience(URI.create(audienceValue)); + break; + + default: + throw LOGGER.parserUnknownTag(StaxParserUtil.getElementName(elementDetail), elementDetail.getLocation()); + } + } +} diff --git a/saml-core/src/test/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParserTest.java b/saml-core/src/test/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParserTest.java index c395f86850..e475643e58 100644 --- a/saml-core/src/test/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParserTest.java +++ b/saml-core/src/test/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParserTest.java @@ -279,6 +279,11 @@ public class SAMLParserTest { assertParsed("KEYCLOAK-4040-sharefile-metadata.xml", EntityDescriptorType.class); } + @Test + public void testProxyRestrictionTagHandling() throws Exception { + assertParsed("KEYCLOAK-6412-response-with-proxy-restriction.xml", ResponseType.class); + } + @Test public void testSaml20MetadataEntityDescriptorIdP() throws Exception { EntityDescriptorType entityDescriptor = assertParsed("saml20-entity-descriptor-idp.xml", EntityDescriptorType.class); diff --git a/saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml b/saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml new file mode 100644 index 0000000000..a6d15de5f7 --- /dev/null +++ b/saml-core/src/test/resources/org/keycloak/saml/processing/core/parsers/saml/KEYCLOAK-6412-response-with-proxy-restriction.xml @@ -0,0 +1,78 @@ + + https://joe-docker:7002/cas/login + + + + + + + + + + + + + [omitted] + + + [ommitted] + + + [ommitted] + [ommitted] + [ommitted] + + + + + + Successful ECAS authentication + + + https://joe-docker:7002/cas/login + + chucknorris + + + + + + + http://localhost:8080/auth/realms/ECAS + + + + + + + urn:oasis:names:tc:SAML:2.0:ac:classes:Password + + + + + eu.europa.ec + + + chucknorris + + + texasranger@chuck_norris.com.eu + + + Chuck + + + INTERNET + DG_DIGIT + LIVENEWS + TEXAS_RANGER + + + NORRIS + + + chucknorris + + + +