Package swiss.trustbroker.saml.util

Class AssertionValidator

java.lang.Object

swiss.trustbroker.saml.util.AssertionValidator

public class AssertionValidator
extends Object

Validate (parts of) SAML messages applying our XTB specific business rules to increase security. The XTB security properties allow to control policy checks on a more fine-grained level in case we are too restrictive. The class is used as follows:

• - SAML POST AuthnRequest incoming from RPs - SAML POST Response incoming from CP
• - SAML Assertions incoming via WS-Trust 1.3 interface (this one is pre-checked by wss4j with a bad error handling)

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	AssertionValidator.ExpectedAssertionValues
static class	AssertionValidator.MessageValidationResult

Method Summary

Modifier and Type	Method	Description
static AssertionValidator.MessageValidationResult	validateArtifactResolve(org.opensaml.saml.saml2.core.ArtifactResolve artifactResolve, TrustBrokerProperties properties, List<org.opensaml.security.credential.Credential> trustCredentials, List<String> allowedSignatureAlgorithms)
static AssertionValidator.MessageValidationResult	validateAssertion(org.opensaml.saml.saml2.core.Assertion assertion, Instant now, List<org.opensaml.security.credential.Credential> credentials, List<String> allowedSignatureAlgorithms, TrustBrokerProperties properties, ClaimsParty claimsParty, Qoa qoa, AssertionValidator.ExpectedAssertionValues expectedValues)
static void	validateAssertionId(org.opensaml.saml.saml2.core.Assertion assertion)
static void	validateAssertionIssuer(org.opensaml.saml.saml2.core.Assertion assertion, String expectedIssuer, TrustBrokerProperties properties)
static AssertionValidator.MessageValidationResult	validateAuthnRequest(org.opensaml.saml.saml2.core.AuthnRequest authnRequest, List<org.opensaml.security.credential.Credential> credentials, List<String> allowedSignatureAlgorithms, AcWhitelist acWhiteList, TrustBrokerProperties properties, SecurityPolicies securityPolicies, swiss.trustbroker.common.saml.dto.SignatureContext signatureContext, Qoa rpQoa)	the check 'require signed AuthnRequest' is based on signatureContext (not SecurityPolicies)
static void	validateQoaRequirement(String contextClass, QoaConfig qoaConfig, QoaComparison comparison, List<String> expectedContextClasses, Map<String,Integer> globalMapping, String issuer)
static AssertionValidator.MessageValidationResult	validateRequestSignature(org.opensaml.saml.saml2.core.RequestAbstractType request, List<org.opensaml.security.credential.Credential> credentials, List<String> allowedSignatureAlgorithms, TrustBrokerProperties properties, swiss.trustbroker.common.saml.dto.SignatureContext signatureContext)
static AssertionValidator.MessageValidationResult	validateResponse(ResponseData<org.opensaml.saml.saml2.core.Response> responseData, List<org.opensaml.saml.saml2.core.Assertion> assertions, List<org.opensaml.security.credential.Credential> credentials, List<String> allowedSignatureAlgorithms, TrustBrokerProperties properties, ClaimsParty claimsParty, Qoa qoa, AssertionValidator.ExpectedAssertionValues expectedValues)
static AssertionValidator.MessageValidationResult	validateRstAssertion(org.opensaml.saml.saml2.core.Assertion assertion, TrustBrokerProperties properties, ClaimsParty claimsParty, SecurityPolicies securityPolicies, Instant now, AssertionValidator.ExpectedAssertionValues expectedValues, Optional<List<org.opensaml.security.credential.Credential>> signatureValidationCredentials, List<String> allowedSignatureAlgorithms)	RST case of WSTrust service: The header assertion is already checked by wss4j.
static AssertionValidator.MessageValidationResult	validateTokenAssertion(ClaimsParty claimsParty, org.opensaml.saml.saml2.core.Assertion assertion, TrustBrokerProperties trustBrokerProperties)
static void	validCpSession(StateData state)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

validateAuthnRequest

public static AssertionValidator.MessageValidationResult validateAuthnRequest(org.opensaml.saml.saml2.core.AuthnRequest authnRequest,
 List<org.opensaml.security.credential.Credential> credentials,
 List<String> allowedSignatureAlgorithms,
 AcWhitelist acWhiteList,
 TrustBrokerProperties properties,
 SecurityPolicies securityPolicies,
 swiss.trustbroker.common.saml.dto.SignatureContext signatureContext,
 Qoa rpQoa)

the check 'require signed AuthnRequest' is based on signatureContext (not SecurityPolicies)

validateResponse

public static AssertionValidator.MessageValidationResult validateResponse(ResponseData<org.opensaml.saml.saml2.core.Response> responseData,
 List<org.opensaml.saml.saml2.core.Assertion> assertions,
 List<org.opensaml.security.credential.Credential> credentials,
 List<String> allowedSignatureAlgorithms,
 TrustBrokerProperties properties,
 ClaimsParty claimsParty,
 Qoa qoa,
 AssertionValidator.ExpectedAssertionValues expectedValues)

Returns:

signatureValidated true if for the response and all assertions, a signature is present and has been successfully validated

validateRstAssertion

public static AssertionValidator.MessageValidationResult validateRstAssertion(org.opensaml.saml.saml2.core.Assertion assertion,
 TrustBrokerProperties properties,
 ClaimsParty claimsParty,
 SecurityPolicies securityPolicies,
 Instant now,
 AssertionValidator.ExpectedAssertionValues expectedValues,
 Optional<List<org.opensaml.security.credential.Credential>> signatureValidationCredentials,
 List<String> allowedSignatureAlgorithms)

RST case of WSTrust service: The header assertion is already checked by wss4j.

Parameters:

assertion -

properties -

claimsParty -

securityPolicies -

now - current time if null

expectedValues - default ExpectedAssertionValues if null

signatureValidationCredentials - signature checked if present

Returns:

validation result

validateAssertion

public static AssertionValidator.MessageValidationResult validateAssertion(org.opensaml.saml.saml2.core.Assertion assertion,
 Instant now,
 List<org.opensaml.security.credential.Credential> credentials,
 List<String> allowedSignatureAlgorithms,
 TrustBrokerProperties properties,
 ClaimsParty claimsParty,
 Qoa qoa,
 AssertionValidator.ExpectedAssertionValues expectedValues)

validCpSession

public static void validCpSession(StateData state)

validateAssertionId

public static void validateAssertionId(org.opensaml.saml.saml2.core.Assertion assertion)

validateAssertionIssuer

public static void validateAssertionIssuer(org.opensaml.saml.saml2.core.Assertion assertion,
 String expectedIssuer,
 TrustBrokerProperties properties)

validateRequestSignature

public static AssertionValidator.MessageValidationResult validateRequestSignature(org.opensaml.saml.saml2.core.RequestAbstractType request,
 List<org.opensaml.security.credential.Credential> credentials,
 List<String> allowedSignatureAlgorithms,
 TrustBrokerProperties properties,
 swiss.trustbroker.common.saml.dto.SignatureContext signatureContext)

validateQoaRequirement

public static void validateQoaRequirement(String contextClass,
 QoaConfig qoaConfig,
 QoaComparison comparison,
 List<String> expectedContextClasses,
 Map<String,Integer> globalMapping,
 String issuer)

validateArtifactResolve

public static AssertionValidator.MessageValidationResult validateArtifactResolve(org.opensaml.saml.saml2.core.ArtifactResolve artifactResolve,
 TrustBrokerProperties properties,
 List<org.opensaml.security.credential.Credential> trustCredentials,
 List<String> allowedSignatureAlgorithms)

validateTokenAssertion

public static AssertionValidator.MessageValidationResult validateTokenAssertion(ClaimsParty claimsParty,
 org.opensaml.saml.saml2.core.Assertion assertion,
 TrustBrokerProperties trustBrokerProperties)