Package swiss.trustbroker.wstrust.validator

Class WsTrustBaseValidator

java.lang.Object
swiss.trustbroker.wstrust.validator.WsTrustBaseValidator
All Implemented Interfaces:
WsTrustValidator
Direct Known Subclasses:
WsTrustIssueValidator, WsTrustRenewValidator
public abstract class WsTrustBaseValidator extends Object implements WsTrustValidator
Base class for WS-Trust request validators.

  • Constructor Summary

    Constructors
    Constructor
    Description
    WsTrustBaseValidator(swiss.trustbroker.config.TrustBrokerProperties trustBrokerProperties, swiss.trustbroker.homerealmdiscovery.service.RelyingPartySetupService relyingPartySetupService, Clock clock)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected boolean
    correctAssertionForSignatureValidation(List<org.opensaml.saml.saml2.core.Assertion> singletonListWithAssertion, org.opensaml.soap.wstrust.RequestSecurityToken request, swiss.trustbroker.federation.xmlconfig.ClaimsParty claimsParty, swiss.trustbroker.federation.xmlconfig.RelyingParty relyingParty)
    Transitional: Called if signature validation fails on the Assertion.
    protected boolean
    enabled()
     
    protected List<String>
    getAllowedSignatureAlgorithms(swiss.trustbroker.federation.xmlconfig.CounterParty cp)
     
    protected abstract swiss.trustbroker.federation.xmlconfig.WsTrustBinding
    getBinding()
     
    protected Clock
    getClock()
     
    protected swiss.trustbroker.federation.xmlconfig.ClaimsParty
    getIssuingClaimsParty(org.opensaml.saml.saml2.core.Assertion assertion)
     
    protected swiss.trustbroker.federation.xmlconfig.RelyingParty
    getRecipientRelyingParty(org.opensaml.saml.saml2.core.Assertion assertion)
     
    protected swiss.trustbroker.homerealmdiscovery.service.RelyingPartySetupService
    getRelyingPartySetupService()
     
    protected swiss.trustbroker.federation.xmlconfig.RelyingParty
    getRstRelyingParty(org.opensaml.soap.wstrust.RequestSecurityToken requestSecurityToken)
     
    protected swiss.trustbroker.config.TrustBrokerProperties
    getTrustBrokerProperties()
     
    protected swiss.trustbroker.saml.util.AssertionValidator.MessageValidationResult
    validateAssertion(org.opensaml.saml.saml2.core.Assertion assertion, swiss.trustbroker.saml.util.AssertionValidator.ExpectedAssertionValues expectedValues, Optional<List<org.opensaml.security.credential.Credential>> credentials, List<String> allowedSignatureAlgorithms, boolean requireSignedAssertion, org.opensaml.soap.wstrust.RequestSecurityToken request, swiss.trustbroker.federation.xmlconfig.ClaimsParty claimsParty, swiss.trustbroker.federation.xmlconfig.RelyingParty relyingParty)
     
    protected void
    validateProtocolRestrictions(swiss.trustbroker.federation.xmlconfig.CounterParty counterParty, swiss.trustbroker.federation.xmlconfig.CounterParty baseParty)
     
    protected void
    validateSignature(SoapMessageHeader soapMessageHeader, boolean requireSignature, List<org.opensaml.security.credential.Credential> trustCredentials)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface swiss.trustbroker.wstrust.validator.WsTrustValidator

    applies, validate

  • Constructor Details

    • WsTrustBaseValidator

      public WsTrustBaseValidator(swiss.trustbroker.config.TrustBrokerProperties trustBrokerProperties, swiss.trustbroker.homerealmdiscovery.service.RelyingPartySetupService relyingPartySetupService, Clock clock)

  • Method Details

    • validateAssertion

      protected swiss.trustbroker.saml.util.AssertionValidator.MessageValidationResult validateAssertion(org.opensaml.saml.saml2.core.Assertion assertion, swiss.trustbroker.saml.util.AssertionValidator.ExpectedAssertionValues expectedValues, Optional<List<org.opensaml.security.credential.Credential>> credentials, List<String> allowedSignatureAlgorithms, boolean requireSignedAssertion, org.opensaml.soap.wstrust.RequestSecurityToken request, swiss.trustbroker.federation.xmlconfig.ClaimsParty claimsParty, swiss.trustbroker.federation.xmlconfig.RelyingParty relyingParty)
      Returns:
      signatureValidated true if credentials present and the assertion has a signature that was successfully validated

    • correctAssertionForSignatureValidation

      protected boolean correctAssertionForSignatureValidation(List<org.opensaml.saml.saml2.core.Assertion> singletonListWithAssertion, org.opensaml.soap.wstrust.RequestSecurityToken request, swiss.trustbroker.federation.xmlconfig.ClaimsParty claimsParty, swiss.trustbroker.federation.xmlconfig.RelyingParty relyingParty)
      Transitional: Called if signature validation fails on the Assertion.
      Parameters:
      singletonListWithAssertion - Modifiable list with exactly one assertion that can be modified or replaced. If the list is empty at the end, the failing validation is accepted - unless a valid signature is required. Else the validation is retried with the assertion. May throw RequestDeniedException.
      request - passed down from validateAssertion
      claimsParty - passed down from validateAssertion
      relyingParty - passed down from validateAssertion
      Returns:
      false no correction performed (default), true correction performed, check singletonListWithAssertion again

    • getRecipientRelyingParty

      protected swiss.trustbroker.federation.xmlconfig.RelyingParty getRecipientRelyingParty(org.opensaml.saml.saml2.core.Assertion assertion)

    • getRstRelyingParty

      protected swiss.trustbroker.federation.xmlconfig.RelyingParty getRstRelyingParty(org.opensaml.soap.wstrust.RequestSecurityToken requestSecurityToken)

    • getIssuingClaimsParty

      protected swiss.trustbroker.federation.xmlconfig.ClaimsParty getIssuingClaimsParty(org.opensaml.saml.saml2.core.Assertion assertion)

    • validateSignature

      protected void validateSignature(SoapMessageHeader soapMessageHeader, boolean requireSignature, List<org.opensaml.security.credential.Credential> trustCredentials)

    • validateProtocolRestrictions

      protected void validateProtocolRestrictions(swiss.trustbroker.federation.xmlconfig.CounterParty counterParty, swiss.trustbroker.federation.xmlconfig.CounterParty baseParty)

    • getBinding

      protected abstract swiss.trustbroker.federation.xmlconfig.WsTrustBinding getBinding()
      Returns:
      binding supported by this validator.

    • enabled

      protected boolean enabled()
      Returns:
      true if this validator's binding is enabled.

    • getAllowedSignatureAlgorithms

      protected List<String> getAllowedSignatureAlgorithms(swiss.trustbroker.federation.xmlconfig.CounterParty cp)

    • getTrustBrokerProperties

      protected swiss.trustbroker.config.TrustBrokerProperties getTrustBrokerProperties()

    • getRelyingPartySetupService

      protected swiss.trustbroker.homerealmdiscovery.service.RelyingPartySetupService getRelyingPartySetupService()

    • getClock

      protected Clock getClock()