From facf7018979f8e0d5d641f9ce9a7a30ae38d4452 Mon Sep 17 00:00:00 2001 From: Dane Barentine Date: Mon, 22 Jun 2015 10:45:03 -0700 Subject: [PATCH 1/5] [KEYCLOAK-1491] SAML Spec compliance. NameIDFormat is optional, AttributeStatement must contain one or more attribute or encryptedattribute statements --- .../main/java/org/keycloak/broker/saml/SAMLEndpoint.java | 3 ++- .../main/java/org/keycloak/protocol/saml/SamlProtocol.java | 7 ++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/broker/saml/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java b/broker/saml/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java index a4fe1cf803e..21a0e58fc75 100755 --- a/broker/saml/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java +++ b/broker/saml/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java @@ -286,7 +286,8 @@ public class SAMLEndpoint { identity.setUsername(subjectNameID.getValue()); - if (subjectNameID.getFormat().toString().equals(JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.get())) { + //SAML Spec 2.2.2 Format is optional + if (subjectNameID.getFormat() != null && subjectNameID.getFormat().toString().equals(JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.get())) { identity.setEmail(subjectNameID.getValue()); } diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java index d5630bd54ac..d8d907592c1 100755 --- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java +++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java @@ -391,10 +391,15 @@ public class SamlProtocol implements LoginProtocol { UserSessionModel userSession, ClientSessionModel clientSession) { AssertionType assertion = response.getAssertions().get(0).getAssertion(); AttributeStatementType attributeStatement = new AttributeStatementType(); - assertion.addStatement(attributeStatement); + for (ProtocolMapperProcessor processor : attributeStatementMappers) { processor.mapper.transformAttributeStatement(attributeStatement, processor.model, session, userSession, clientSession); } + + //SAML Spec 2.7.3 AttributeStatement must contain one or more Attribute or EncryptedAttribute + if(attributeStatement.getAttributes().size() > 0) { + assertion.addStatement(attributeStatement); + } } public ResponseType transformLoginResponse(List> mappers, From 8da532da93692cce5efbd222a2adce9e00e48378 Mon Sep 17 00:00:00 2001 From: Dane Barentine Date: Mon, 22 Jun 2015 10:46:12 -0700 Subject: [PATCH 2/5] [KEYCLOAK-1492] Fix mapClaim when nested attribute already exists --- .../protocol/oidc/mappers/OIDCAttributeMapperHelper.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/services/src/main/java/org/keycloak/protocol/oidc/mappers/OIDCAttributeMapperHelper.java b/services/src/main/java/org/keycloak/protocol/oidc/mappers/OIDCAttributeMapperHelper.java index bae8c08abd2..9f29842b78c 100755 --- a/services/src/main/java/org/keycloak/protocol/oidc/mappers/OIDCAttributeMapperHelper.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/mappers/OIDCAttributeMapperHelper.java @@ -63,11 +63,13 @@ public class OIDCAttributeMapperHelper { jsonObject.put(split[i], attributeValue); } else { Map nested = (Map)jsonObject.get(split[i]); + if (nested == null) { nested = new HashMap(); jsonObject.put(split[i], nested); - jsonObject = nested; } + + jsonObject = nested; } } } From 14baef425e0c73d4406a17991a52b52c8b254984 Mon Sep 17 00:00:00 2001 From: Dane Barentine Date: Mon, 22 Jun 2015 10:47:58 -0700 Subject: [PATCH 3/5] [KEYCLOAK-1493] Added a couple of WSTrust constants --- .../org/keycloak/saml/common/constants/WSTrustConstants.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/saml/saml-core/src/main/java/org/keycloak/saml/common/constants/WSTrustConstants.java b/saml/saml-core/src/main/java/org/keycloak/saml/common/constants/WSTrustConstants.java index 000f041f087..33e86ca9893 100755 --- a/saml/saml-core/src/main/java/org/keycloak/saml/common/constants/WSTrustConstants.java +++ b/saml/saml-core/src/main/java/org/keycloak/saml/common/constants/WSTrustConstants.java @@ -224,6 +224,8 @@ public interface WSTrustConstants { String REFERENCE = "Reference"; + String PREFIX = "wsse"; + String PREFIX_11 = "wsse11"; // http://www.ws-i.org/Profiles/KerberosTokenProfile-1.0.html#Kerberos_Security_Token_URI @@ -238,5 +240,7 @@ public interface WSTrustConstants { String URI = "URI"; String VALUE_TYPE = "ValueType"; + + String ENCODING_TYPE = "EncodingType"; } } \ No newline at end of file From c403968fa8b5aee2077d74a8355f634c3a241850 Mon Sep 17 00:00:00 2001 From: Dane Barentine Date: Mon, 22 Jun 2015 10:49:15 -0700 Subject: [PATCH 4/5] [KEYCLOAK-1493] Added explicit dependency on keycloak-saml-core --- .../layers/base/org/keycloak/keycloak-services/main/module.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/base/org/keycloak/keycloak-services/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/base/org/keycloak/keycloak-services/main/module.xml index df80d95b07b..4917ab6a472 100644 --- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/base/org/keycloak/keycloak-services/main/module.xml +++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/base/org/keycloak/keycloak-services/main/module.xml @@ -49,6 +49,7 @@ + From b9f5946cf029f38a2715487fef961c58c8b58232 Mon Sep 17 00:00:00 2001 From: Dane Barentine Date: Mon, 22 Jun 2015 14:50:04 -0700 Subject: [PATCH 5/5] [KEYCLOAK-1493] Added explicit dependency on keycloak-saml-core --- .../modules/org/keycloak/keycloak-services/main/module.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/distribution/server-overlay/eap6/eap6-server-modules/src/main/resources/modules/org/keycloak/keycloak-services/main/module.xml b/distribution/server-overlay/eap6/eap6-server-modules/src/main/resources/modules/org/keycloak/keycloak-services/main/module.xml index 045e788b2fa..268a788a5a7 100755 --- a/distribution/server-overlay/eap6/eap6-server-modules/src/main/resources/modules/org/keycloak/keycloak-services/main/module.xml +++ b/distribution/server-overlay/eap6/eap6-server-modules/src/main/resources/modules/org/keycloak/keycloak-services/main/module.xml @@ -50,6 +50,7 @@ +