+
+
+
+
+
+
\ No newline at end of file
diff --git a/examples/saml/post-basic/src/main/webapp/favicon.ico b/examples/saml/post-basic/src/main/webapp/favicon.ico
new file mode 100644
index 00000000000..c31d0fa862a
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/favicon.ico differ
diff --git a/examples/saml/post-basic/src/main/webapp/images/bkg.gif b/examples/saml/post-basic/src/main/webapp/images/bkg.gif
new file mode 100644
index 00000000000..523877c0874
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/images/bkg.gif differ
diff --git a/examples/saml/post-basic/src/main/webapp/images/picketlink-banner-1180px.png b/examples/saml/post-basic/src/main/webapp/images/picketlink-banner-1180px.png
new file mode 100644
index 00000000000..2509ff4480f
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/images/picketlink-banner-1180px.png differ
diff --git a/examples/saml/post-basic/src/main/webapp/images/rh_bg.png b/examples/saml/post-basic/src/main/webapp/images/rh_bg.png
new file mode 100644
index 00000000000..b0e6a006d01
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/images/rh_bg.png differ
diff --git a/examples/saml/post-basic/src/main/webapp/index.jsp b/examples/saml/post-basic/src/main/webapp/index.jsp
new file mode 100644
index 00000000000..199bdb0ee0c
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/index.jsp
@@ -0,0 +1,14 @@
++ The Service Provider could not process the request. +
+
+
+Welcome to the Sales Tool, <%=request.getUserPrincipal().getName()%> + +
+Here is your sales chart: +
+
+
+
+Click to LogOut + +
diff --git a/examples/saml/post-basic/src/main/webapp/logout.jsp b/examples/saml/post-basic/src/main/webapp/logout.jsp
new file mode 100644
index 00000000000..05ef7d35969
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/logout.jsp
@@ -0,0 +1,44 @@
+
+
+
+
+
+SalesTool
++Welcome to the Sales Tool, <%=request.getUserPrincipal().getName()%> + +
+Here is your sales chart: +
+
+
++Click to LogOut + +
+
+
+
+
+
+
\ No newline at end of file
diff --git a/examples/saml/post-basic/src/main/webapp/piechart.gif b/examples/saml/post-basic/src/main/webapp/piechart.gif
new file mode 100644
index 00000000000..57bfe377524
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/piechart.gif differ
diff --git a/examples/saml/post-with-encryption/README.md b/examples/saml/post-with-encryption/README.md
new file mode 100755
index 00000000000..08885157443
--- /dev/null
+++ b/examples/saml/post-with-encryption/README.md
@@ -0,0 +1,269 @@
+picketlink-federation-saml-sp-with-encryption: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding With Encryption Support
+===============================
+Author: Pedro Igor
+Level: Intermediate
+Technologies: PicketLink Federation, SAML v2.0
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support.
+Source: + Logout in progress. You will be redirected to the Login Page. +
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/examples/saml/redirect-basic/src/main/webapp/favicon.ico b/examples/saml/redirect-basic/src/main/webapp/favicon.ico
new file mode 100644
index 00000000000..c31d0fa862a
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/favicon.ico differ
diff --git a/examples/saml/redirect-basic/src/main/webapp/images/bkg.gif b/examples/saml/redirect-basic/src/main/webapp/images/bkg.gif
new file mode 100644
index 00000000000..523877c0874
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/images/bkg.gif differ
diff --git a/examples/saml/redirect-basic/src/main/webapp/images/picketlink-banner-1180px.png b/examples/saml/redirect-basic/src/main/webapp/images/picketlink-banner-1180px.png
new file mode 100644
index 00000000000..2509ff4480f
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/images/picketlink-banner-1180px.png differ
diff --git a/examples/saml/redirect-basic/src/main/webapp/images/rh_bg.png b/examples/saml/redirect-basic/src/main/webapp/images/rh_bg.png
new file mode 100644
index 00000000000..b0e6a006d01
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/images/rh_bg.png differ
diff --git a/examples/saml/redirect-basic/src/main/webapp/index.jsp b/examples/saml/redirect-basic/src/main/webapp/index.jsp
new file mode 100644
index 00000000000..5b3ecd4e279
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/index.jsp
@@ -0,0 +1,10 @@
++ The Service Provider could not process the request. +
+
+
+Welcome to the Employee Tool, <%=request.getUserPrincipal().getName()%>. +
+
+
+Click to LogOut + +
diff --git a/examples/saml/redirect-basic/src/main/webapp/logout.jsp b/examples/saml/redirect-basic/src/main/webapp/logout.jsp
new file mode 100644
index 00000000000..05ef7d35969
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/logout.jsp
@@ -0,0 +1,44 @@
+
+
+
+
+
+EmployeeDashboard
++Welcome to the Employee Tool, <%=request.getUserPrincipal().getName()%>. +
+
++Click to LogOut + +
+
+
+
+
+
+
\ No newline at end of file
diff --git a/examples/saml/redirect-with-signature/README.md b/examples/saml/redirect-with-signature/README.md
new file mode 100755
index 00000000000..329f554e802
--- /dev/null
+++ b/examples/saml/redirect-with-signature/README.md
@@ -0,0 +1,270 @@
+picketlink-federation-saml-sp-redirect-with-signature: PicketLink Service Provider With a Basic Configuration using SAML HTTP Redirect Binding With Signature Support
+===============================
+Author: Pedro Igor
+Level: Intermediate
+Technologies: PicketLink Federation, SAML v2.0
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP Redirect Binding With Signature Support.
+Source: + Logout in progress. You will be redirected to the Login Page. +
+
-
+
diff --git a/pom.xml b/pom.xml
index 623b0e0c0f8..5b3f1547cab 100755
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,8 @@
2.3.7.Final
3.0.9.Final
1.0.15.Final
- 2.7.0.CR1-20140924
+
+ 2.7.0.CR1
1.0.2.Final
2.11.3
3.1.4.GA
@@ -251,6 +252,16 @@
picketlink-config
${picketlink.version}
+
+ org.picketlink
+ picketlink-api
+ ${picketlink.version}
+
+
+ org.picketlink
+ picketlink-impl
+ ${picketlink.version}
+
org.picketbox
picketbox-ldap
diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java
index 6ed495d9896..3d53c66df7b 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java
@@ -53,7 +53,11 @@ public class SALM2LoginResponseBuilder extends SAML2BindingBuilder {
return (T)this;
}
- public class BindingBuilder {
+ public class PostBindingBuilder {
protected Document document;
- public BindingBuilder(Document document) {
+ public PostBindingBuilder(Document document) throws ProcessingException {
+ this.document = document;
+ if (signed) {
+ signDocument(document);
+ }
+ }
+
+ public String encoded() throws ProcessingException, ConfigurationException, IOException {
+ byte[] responseBytes = org.picketlink.identity.federation.core.saml.v2.util.DocumentUtil.getDocumentAsString(document).getBytes("UTF-8");
+ return PostBindingUtil.base64Encode(new String(responseBytes));
+ }
+ public Document getDocument() {
+ return document;
+ }
+
+ public String htmlResponse() throws ProcessingException, ConfigurationException, IOException {
+ return buildHtml(encoded());
+
+ }
+ public Response response() throws ConfigurationException, ProcessingException, IOException {
+ return buildResponse(document);
+ }
+ }
+
+
+ public class RedirectBindingBuilder {
+ protected Document document;
+
+ public RedirectBindingBuilder(Document document) {
this.document = document;
}
public Document getDocument() {
return document;
}
- public Response postResponse() throws ConfigurationException, ProcessingException, IOException {
- return buildResponse(document);
- }
-
- public URI redirectResponseUri() throws ConfigurationException, ProcessingException, IOException {
+ public URI responseUri() throws ConfigurationException, ProcessingException, IOException {
return generateRedirectUri("SAMLResponse", document);
}
-
- public Response redirectResponse() throws ProcessingException, ConfigurationException, IOException {
- URI uri = redirectResponseUri();
+ public Response response() throws ProcessingException, ConfigurationException, IOException {
+ URI uri = responseUri();
CacheControl cacheControl = new CacheControl();
cacheControl.setNoCache(true);
@@ -140,6 +163,7 @@ public class SAML2BindingBuilder {
}
+
private String getSAMLNSPrefix(Document samlResponseDocument) {
Node assertionElement = samlResponseDocument.getDocumentElement()
.getElementsByTagNameNS(JBossSAMLURIConstants.ASSERTION_NSURI.get(), JBossSAMLConstants.ASSERTION.get()).item(0);
@@ -171,18 +195,6 @@ public class SAML2BindingBuilder {
}
- protected void encryptAndSign(Document samlDocument) throws ProcessingException {
- if (encrypt) {
- encryptDocument(samlDocument);
- signDocument(samlDocument);
- return;
- }
- if (signed) {
- signDocument(samlDocument);
- return;
- }
- }
-
protected void signDocument(Document samlDocument) throws ProcessingException {
SamlProtocolUtils.signDocument(samlDocument, signingKeyPair, signatureAlgorithm.getXmlSignatureMethod(), signatureAlgorithm.getXmlSignatureDigestMethod(), signingCertificate);
}
@@ -201,6 +213,10 @@ public class SAML2BindingBuilder {
byte[] responseBytes = DocumentUtil.getDocumentAsString(responseDoc).getBytes("UTF-8");
String samlResponse = PostBindingUtil.base64Encode(new String(responseBytes));
+ return buildHtml(samlResponse);
+ }
+
+ protected String buildHtml(String samlResponse) {
if (destination == null) {
throw SALM2LoginResponseBuilder.logger.nullValueError("Destination is null");
}
diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java
index 8d7a8158ca4..c4a2c2bad15 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java
@@ -18,7 +18,27 @@ import org.w3c.dom.Document;
*/
public class SAML2ErrorResponseBuilder extends SAML2BindingBuilder {
- public Document buildDocument(String status) throws ProcessingException {
+ protected String status;
+
+ public SAML2ErrorResponseBuilder status(String status) {
+ this.status = status;
+ return this;
+ }
+
+ public RedirectBindingBuilder redirectBinding() throws ConfigurationException, ProcessingException {
+ Document samlResponseDocument = buildDocument();
+ return new RedirectBindingBuilder(samlResponseDocument);
+
+ }
+
+ public PostBindingBuilder postBinding() throws ConfigurationException, ProcessingException {
+ Document samlResponseDocument = buildDocument();
+ return new PostBindingBuilder(samlResponseDocument);
+
+ }
+
+
+ public Document buildDocument() throws ProcessingException {
Document samlResponse = null;
ResponseType responseType = null;
@@ -41,15 +61,9 @@ public class SAML2ErrorResponseBuilder extends SAML2BindingBuilderBill Burke
* @version $Revision: 1 $
*/
-public class SalmProtocol implements LoginProtocol {
- protected static final Logger logger = Logger.getLogger(SalmProtocol.class);
+public class SamlProtocol implements LoginProtocol {
+ protected static final Logger logger = Logger.getLogger(SamlProtocol.class);
public static final String LOGIN_PROTOCOL = "saml";
public static final String SAML_BINDING = "saml_binding";
public static final String SAML_POST_BINDING = "post";
@@ -49,19 +49,19 @@ public class SalmProtocol implements LoginProtocol {
@Override
- public SalmProtocol setSession(KeycloakSession session) {
+ public SamlProtocol setSession(KeycloakSession session) {
this.session = session;
return this;
}
@Override
- public SalmProtocol setRealm(RealmModel realm) {
+ public SamlProtocol setRealm(RealmModel realm) {
this.realm = realm;
return this;
}
@Override
- public SalmProtocol setUriInfo(UriInfo uriInfo) {
+ public SamlProtocol setUriInfo(UriInfo uriInfo) {
this.uriInfo = uriInfo;
return this;
}
@@ -84,12 +84,13 @@ public class SalmProtocol implements LoginProtocol {
SAML2ErrorResponseBuilder builder = new SAML2ErrorResponseBuilder()
.relayState(clientSession.getNote(GeneralConstants.RELAY_STATE))
.destination(clientSession.getRedirectUri())
- .responseIssuer(getResponseIssuer(realm));
+ .responseIssuer(getResponseIssuer(realm))
+ .status(status);
try {
if (isPostBinding(clientSession)) {
- return builder.binding(status).postResponse();
+ return builder.postBinding().response();
} else {
- return builder.binding(status).redirectResponse();
+ return builder.redirectBinding().response();
}
} catch (Exception e) {
return Flows.forwardToSecurityFailurePage(session, realm, uriInfo, "Failed to process response");
@@ -97,7 +98,7 @@ public class SalmProtocol implements LoginProtocol {
}
protected boolean isPostBinding(ClientSessionModel clientSession) {
- return SalmProtocol.SAML_POST_BINDING.equals(clientSession.getNote(SalmProtocol.SAML_BINDING));
+ return SamlProtocol.SAML_POST_BINDING.equals(clientSession.getNote(SamlProtocol.SAML_BINDING));
}
@Override
@@ -142,9 +143,9 @@ public class SalmProtocol implements LoginProtocol {
}
try {
if (isPostBinding(clientSession)) {
- return builder.binding().postResponse();
+ return builder.postBinding().response();
} else {
- return builder.binding().redirectResponse();
+ return builder.redirectBinding().response();
}
} catch (Exception e) {
logger.error("failed", e);
@@ -156,7 +157,7 @@ public class SalmProtocol implements LoginProtocol {
return "true".equals(client.getAttribute("saml.server.signature"));
}
- private SignatureAlgorithm getSignatureAlgorithm(ClientModel client) {
+ public static SignatureAlgorithm getSignatureAlgorithm(ClientModel client) {
String alg = client.getAttribute("saml.signature.algorithm");
if (alg != null) {
SignatureAlgorithm algorithm = SignatureAlgorithm.valueOf(alg);
@@ -214,7 +215,7 @@ public class SalmProtocol implements LoginProtocol {
String logoutRequestString = null;
try {
- logoutRequestString = logoutBuilder.buildRequestString();
+ logoutRequestString = logoutBuilder.postBinding().encoded();
} catch (Exception e) {
logger.warn("failed to send saml logout", e);
return;
diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
index 5021d0cbb75..e2c0fd5bc7a 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
@@ -22,7 +22,7 @@ public class SamlProtocolFactory implements LoginProtocolFactory {
@Override
public LoginProtocol create(KeycloakSession session) {
- return new SalmProtocol().setSession(session);
+ return new SamlProtocol().setSession(session);
}
@Override
diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
index 1ccfba196e1..2b428289ec0 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
@@ -42,11 +42,9 @@ import javax.ws.rs.core.SecurityContext;
import javax.ws.rs.core.UriBuilder;
import javax.ws.rs.core.UriInfo;
import javax.ws.rs.ext.Providers;
-import java.io.IOException;
import java.net.URI;
import java.security.PublicKey;
import java.security.Signature;
-import java.security.SignatureException;
/**
* Resource class for the oauth/openid connect token service
@@ -195,10 +193,10 @@ public class SamlService {
ClientSessionModel clientSession = session.sessions().createClientSession(realm, client);
- clientSession.setAuthMethod(SalmProtocol.LOGIN_PROTOCOL);
+ clientSession.setAuthMethod(SamlProtocol.LOGIN_PROTOCOL);
clientSession.setRedirectUri(redirect);
clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE);
- clientSession.setNote(SalmProtocol.SAML_BINDING, getBindingType());
+ clientSession.setNote(SamlProtocol.SAML_BINDING, getBindingType());
clientSession.setNote(GeneralConstants.RELAY_STATE, relayState);
clientSession.setNote("REQUEST_ID", requestAbstractType.getID());
@@ -278,7 +276,7 @@ public class SamlService {
@Override
protected String getBindingType() {
- return SalmProtocol.SAML_POST_BINDING;
+ return SamlProtocol.SAML_POST_BINDING;
}
@@ -307,7 +305,9 @@ public class SamlService {
if (algorithm == null) throw new VerificationException("SigAlg as null");
if (signature == null) throw new VerificationException("Signature as null");
- SamlProtocolUtils.verifyDocumentSignature(client, documentHolder.getSamlDocument());
+ // Shibboleth doesn't sign the document for redirect binding.
+ // todo maybe a flag?
+ // SamlProtocolUtils.verifyDocumentSignature(client, documentHolder.getSamlDocument());
PublicKey publicKey = SamlProtocolUtils.getPublicKey(client);
@@ -323,7 +323,8 @@ public class SamlService {
try {
byte[] decodedSignature = RedirectBindingUtil.urlBase64Decode(signature);
- Signature validator = SignatureAlgorithm.RSA_SHA1.createSignature(); // todo plugin signature alg
+ SignatureAlgorithm signatureAlgorithm = SamlProtocol.getSignatureAlgorithm(client);
+ Signature validator = signatureAlgorithm.createSignature(); // todo plugin signature alg
validator.initVerify(publicKey);
validator.update(rawQuery.getBytes("UTF-8"));
if (!validator.verify(decodedSignature)) {
@@ -343,7 +344,7 @@ public class SamlService {
@Override
protected String getBindingType() {
- return SalmProtocol.SAML_GET_BINDING;
+ return SamlProtocol.SAML_GET_BINDING;
}