Skip to content

Commit 194993a

Browse files
jzheauxjzheaux
committed
Add Saml2ParameterNames
Closes gh-10270
1 parent 8cba9fb commit 194993a

File tree

34 files changed

+249
-142
lines changed

34 files changed

+249
-142
lines changed

‎etc/checkstyle/checkstyle-suppressions.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
<suppress files="OAuth2IntrospectionClaimNames\.java" checks="InterfaceIsType"/>
3030
<suppress files="OAuth2TokenIntrospectionClaimNames\.java" checks="InterfaceIsType"/>
3131
<suppress files="Saml2ErrorCodes\.java" checks="InterfaceIsType"/>
32+
<suppress files="Saml2ParameterNames\.java" checks="InterfaceIsType"/>
3233

3334
<!-- Method Visibility that we can't reduce -->
3435
<suppress files="AbstractAclVoterTests\.java" checks="SpringMethodVisibility"/>

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/core/Saml2ParameterNames.java

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/*
2+
* Copyright 2002-2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.saml2.core;
18+
19+
/**
20+
* Standard parameter names defined in the SAML 2.0 Specification and used by the
21+
* Authentication Request, Assertion Consumer Response, Logout Request, and Logout
22+
* Response endpoints.
23+
*
24+
* @author Josh Cummings
25+
* @since 5.6
26+
* @see <a target="_blank" href=
27+
* "https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf">SAML 2.0
28+
* Bindings</a>
29+
*/
30+
public interface Saml2ParameterNames {
31+
32+
/**
33+
* {@code SAMLRequest} - used to request authentication or request logout
34+
*/
35+
String SAML_REQUEST = "SAMLRequest";
36+
37+
/**
38+
* {@code SAMLResponse} - used to respond to an authentication or logout request
39+
*/
40+
String SAML_RESPONSE = "SAMLResponse";
41+
42+
/**
43+
* {@code RelayState} - used to communicate shared state between the relying and
44+
* asserting party
45+
* @see <a target="_blank" href=
46+
* "https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf#page=8">3.1.1
47+
* Use of RelayState</a>
48+
*/
49+
String RELAY_STATE = "RelayState";
50+
51+
/**
52+
* {@code SigAlg} - used to communicate which signature algorithm to use to verify
53+
* signature
54+
*/
55+
String SIG_ALG = "SigAlg";
56+
57+
/**
58+
* {@code Signature} - used to supply cryptographic signature on any SAML 2.0 payload
59+
*/
60+
String SIGNATURE = "Signature";
61+
62+
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlSigningUtils.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@
5151
import org.w3c.dom.Element;
5252

5353
import org.springframework.security.saml2.Saml2Exception;
54+
import org.springframework.security.saml2.core.Saml2ParameterNames;
5455
import org.springframework.security.saml2.core.Saml2X509Credential;
5556
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
5657
import org.springframework.util.Assert;
@@ -165,7 +166,7 @@ Map<String, String> parameters() {
165166
SignatureSigningParameters parameters = resolveSigningParameters(this.registration);
166167
Credential credential = parameters.getSigningCredential();
167168
String algorithmUri = parameters.getSignatureAlgorithm();
168-
this.components.put("SigAlg", algorithmUri);
169+
this.components.put(Saml2ParameterNames.SIG_ALG, algorithmUri);
169170
UriComponentsBuilder builder = UriComponentsBuilder.newInstance();
170171
for (Map.Entry<String, String> component : this.components.entrySet()) {
171172
builder.queryParam(component.getKey(),
@@ -176,7 +177,7 @@ Map<String, String> parameters() {
176177
byte[] rawSignature = XMLSigningUtil.signWithURI(credential, algorithmUri,
177178
queryString.getBytes(StandardCharsets.UTF_8));
178179
String b64Signature = Saml2Utils.samlEncode(rawSignature);
179-
this.components.put("Signature", b64Signature);
180+
this.components.put(Saml2ParameterNames.SIGNATURE, b64Signature);
180181
}
181182
catch (SecurityException ex) {
182183
throw new Saml2Exception(ex);

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlVerificationUtils.java

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@
4848

4949
import org.springframework.security.saml2.core.Saml2Error;
5050
import org.springframework.security.saml2.core.Saml2ErrorCodes;
51+
import org.springframework.security.saml2.core.Saml2ParameterNames;
5152
import org.springframework.security.saml2.core.Saml2ResponseValidatorResult;
5253
import org.springframework.security.saml2.core.Saml2X509Credential;
5354
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
@@ -176,34 +177,39 @@ private static class RedirectSignature {
176177
}
177178

178179
String getAlgorithm() {
179-
return this.request.getParameter("SigAlg");
180+
return this.request.getParameter(Saml2ParameterNames.SIG_ALG);
180181
}
181182

182183
byte[] getContent() {
183-
if (this.request.getParameter("RelayState") != null) {
184-
return String.format("%s=%s&RelayState=%s&SigAlg=%s", this.objectParameterName,
185-
UriUtils.encode(this.request.getParameter(this.objectParameterName),
186-
StandardCharsets.ISO_8859_1),
187-
UriUtils.encode(this.request.getParameter("RelayState"), StandardCharsets.ISO_8859_1),
188-
UriUtils.encode(getAlgorithm(), StandardCharsets.ISO_8859_1))
184+
if (this.request.getParameter(Saml2ParameterNames.RELAY_STATE) != null) {
185+
return String
186+
.format("%s=%s&%s=%s&%s=%s", this.objectParameterName,
187+
UriUtils.encode(this.request.getParameter(this.objectParameterName),
188+
StandardCharsets.ISO_8859_1),
189+
Saml2ParameterNames.RELAY_STATE,
190+
UriUtils.encode(this.request.getParameter(Saml2ParameterNames.RELAY_STATE),
191+
StandardCharsets.ISO_8859_1),
192+
Saml2ParameterNames.SIG_ALG,
193+
UriUtils.encode(getAlgorithm(), StandardCharsets.ISO_8859_1))
189194
.getBytes(StandardCharsets.UTF_8);
190195
}
191196
else {
192197
return String
193-
.format("%s=%s&SigAlg=%s", this.objectParameterName,
198+
.format("%s=%s&%s=%s", this.objectParameterName,
194199
UriUtils.encode(this.request.getParameter(this.objectParameterName),
195200
StandardCharsets.ISO_8859_1),
201+
Saml2ParameterNames.SIG_ALG,
196202
UriUtils.encode(getAlgorithm(), StandardCharsets.ISO_8859_1))
197203
.getBytes(StandardCharsets.UTF_8);
198204
}
199205
}
200206

201207
byte[] getSignature() {
202-
return Saml2Utils.samlDecode(this.request.getParameter("Signature"));
208+
return Saml2Utils.samlDecode(this.request.getParameter(Saml2ParameterNames.SIGNATURE));
203209
}
204210

205211
boolean hasSignature() {
206-
return this.request.getParameter("Signature") != null;
212+
return this.request.getParameter(Saml2ParameterNames.SIGNATURE) != null;
207213
}
208214

209215
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSamlVerificationUtils.java

Lines changed: 18 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747

4848
import org.springframework.security.saml2.core.Saml2Error;
4949
import org.springframework.security.saml2.core.Saml2ErrorCodes;
50+
import org.springframework.security.saml2.core.Saml2ParameterNames;
5051
import org.springframework.security.saml2.core.Saml2X509Credential;
5152
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
5253
import org.springframework.web.util.UriUtils;
@@ -179,44 +180,40 @@ private static class RedirectSignature {
179180
private final byte[] content;
180181

181182
RedirectSignature(Saml2LogoutRequest request) {
182-
this.algorithm = request.getParameter("SigAlg");
183-
if (request.getParameter("Signature") != null) {
184-
this.signature = Saml2Utils.samlDecode(request.getParameter("Signature"));
183+
this.algorithm = request.getParameter(Saml2ParameterNames.SIG_ALG);
184+
if (request.getParameter(Saml2ParameterNames.SIGNATURE) != null) {
185+
this.signature = Saml2Utils.samlDecode(request.getParameter(Saml2ParameterNames.SIGNATURE));
185186
}
186187
else {
187188
this.signature = null;
188189
}
189-
this.content = content(request.getSamlRequest(), "SAMLRequest", request.getRelayState(),
190-
request.getParameter("SigAlg"));
190+
this.content = content(request.getSamlRequest(), Saml2ParameterNames.SAML_REQUEST,
191+
request.getRelayState(), request.getParameter(Saml2ParameterNames.SIG_ALG));
191192
}
192193

193194
RedirectSignature(Saml2LogoutResponse response) {
194-
this.algorithm = response.getParameter("SigAlg");
195-
if (response.getParameter("Signature") != null) {
196-
this.signature = Saml2Utils.samlDecode(response.getParameter("Signature"));
195+
this.algorithm = response.getParameter(Saml2ParameterNames.SIG_ALG);
196+
if (response.getParameter(Saml2ParameterNames.SIGNATURE) != null) {
197+
this.signature = Saml2Utils.samlDecode(response.getParameter(Saml2ParameterNames.SIGNATURE));
197198
}
198199
else {
199200
this.signature = null;
200201
}
201-
this.content = content(response.getSamlResponse(), "SAMLResponse", response.getRelayState(),
202-
response.getParameter("SigAlg"));
202+
this.content = content(response.getSamlResponse(), Saml2ParameterNames.SAML_RESPONSE,
203+
response.getRelayState(), response.getParameter(Saml2ParameterNames.SIG_ALG));
203204
}
204205

205206
static byte[] content(String samlObject, String objectParameterName, String relayState, String algorithm) {
206207
if (relayState != null) {
207-
return String
208-
.format("%s=%s&RelayState=%s&SigAlg=%s", objectParameterName,
209-
UriUtils.encode(samlObject, StandardCharsets.ISO_8859_1),
210-
UriUtils.encode(relayState, StandardCharsets.ISO_8859_1),
211-
UriUtils.encode(algorithm, StandardCharsets.ISO_8859_1))
212-
.getBytes(StandardCharsets.UTF_8);
208+
return String.format("%s=%s&%s=%s&%s=%s", objectParameterName,
209+
UriUtils.encode(samlObject, StandardCharsets.ISO_8859_1), Saml2ParameterNames.RELAY_STATE,
210+
UriUtils.encode(relayState, StandardCharsets.ISO_8859_1), Saml2ParameterNames.SIG_ALG,
211+
UriUtils.encode(algorithm, StandardCharsets.ISO_8859_1)).getBytes(StandardCharsets.UTF_8);
213212
}
214213
else {
215-
return String
216-
.format("%s=%s&SigAlg=%s", objectParameterName,
217-
UriUtils.encode(samlObject, StandardCharsets.ISO_8859_1),
218-
UriUtils.encode(algorithm, StandardCharsets.ISO_8859_1))
219-
.getBytes(StandardCharsets.UTF_8);
214+
return String.format("%s=%s&%s=%s", objectParameterName,
215+
UriUtils.encode(samlObject, StandardCharsets.ISO_8859_1), Saml2ParameterNames.SIG_ALG,
216+
UriUtils.encode(algorithm, StandardCharsets.ISO_8859_1)).getBytes(StandardCharsets.UTF_8);
220217
}
221218
}
222219

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2LogoutRequest.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import java.util.Map;
2323
import java.util.function.Consumer;
2424

25+
import org.springframework.security.saml2.core.Saml2ParameterNames;
2526
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
2627
import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
2728
import org.springframework.security.saml2.provider.service.web.authentication.logout.Saml2LogoutRequestResolver;
@@ -84,15 +85,15 @@ public Saml2MessageBinding getBinding() {
8485
* @return the signed and serialized &lt;saml2:LogoutRequest&gt; payload
8586
*/
8687
public String getSamlRequest() {
87-
return this.parameters.get("SAMLRequest");
88+
return this.parameters.get(Saml2ParameterNames.SAML_REQUEST);
8889
}
8990

9091
/**
9192
* The relay state associated with this Logout Request
9293
* @return the relay state
9394
*/
9495
public String getRelayState() {
95-
return this.parameters.get("RelayState");
96+
return this.parameters.get(Saml2ParameterNames.RELAY_STATE);
9697
}
9798

9899
/**
@@ -170,7 +171,7 @@ private Builder(RelyingPartyRegistration registration) {
170171
* @see Saml2LogoutRequestResolver
171172
*/
172173
public Builder samlRequest(String samlRequest) {
173-
this.parameters.put("SAMLRequest", samlRequest);
174+
this.parameters.put(Saml2ParameterNames.SAML_REQUEST, samlRequest);
174175
return this;
175176
}
176177

@@ -207,7 +208,7 @@ public Builder location(String location) {
207208
* @return the {@link Builder} for further configurations
208209
*/
209210
public Builder relayState(String relayState) {
210-
this.parameters.put("RelayState", relayState);
211+
this.parameters.put(Saml2ParameterNames.RELAY_STATE, relayState);
211212
return this;
212213
}
213214

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2LogoutResponse.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import java.util.Map;
2222
import java.util.function.Consumer;
2323

24+
import org.springframework.security.saml2.core.Saml2ParameterNames;
2425
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
2526
import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding;
2627
import org.springframework.security.saml2.provider.service.web.authentication.logout.Saml2LogoutResponseResolver;
@@ -68,15 +69,15 @@ public Saml2MessageBinding getBinding() {
6869
* @return the signed and serialized &lt;saml2:LogoutResponse&gt; payload
6970
*/
7071
public String getSamlResponse() {
71-
return this.parameters.get("SAMLResponse");
72+
return this.parameters.get(Saml2ParameterNames.SAML_RESPONSE);
7273
}
7374

7475
/**
7576
* The relay state associated with this Logout Request
7677
* @return the relay state
7778
*/
7879
public String getRelayState() {
79-
return this.parameters.get("RelayState");
80+
return this.parameters.get(Saml2ParameterNames.RELAY_STATE);
8081
}
8182

8283
/**
@@ -140,7 +141,7 @@ private Builder(RelyingPartyRegistration registration) {
140141
* @see Saml2LogoutResponseResolver
141142
*/
142143
public Builder samlResponse(String samlResponse) {
143-
this.parameters.put("SAMLResponse", samlResponse);
144+
this.parameters.put(Saml2ParameterNames.SAML_RESPONSE, samlResponse);
144145
return this;
145146
}
146147

@@ -177,7 +178,7 @@ public Builder location(String location) {
177178
* @return the {@link Builder} for further configurations
178179
*/
179180
public Builder relayState(String relayState) {
180-
this.parameters.put("RelayState", relayState);
181+
this.parameters.put(Saml2ParameterNames.RELAY_STATE, relayState);
181182
return this;
182183
}
183184

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationFilter.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.springframework.security.core.AuthenticationException;
2424
import org.springframework.security.saml2.core.Saml2Error;
2525
import org.springframework.security.saml2.core.Saml2ErrorCodes;
26+
import org.springframework.security.saml2.core.Saml2ParameterNames;
2627
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
2728
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
2829
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository;
@@ -96,7 +97,7 @@ public Saml2WebSsoAuthenticationFilter(AuthenticationConverter authenticationCon
9697
@Override
9798
protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
9899
return (super.requiresAuthentication(request, response)
99-
&& StringUtils.hasText(request.getParameter("SAMLResponse")));
100+
&& StringUtils.hasText(request.getParameter(Saml2ParameterNames.SAML_RESPONSE)));
100101
}
101102

102103
@Override

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/servlet/filter/Saml2WebSsoAuthenticationRequestFilter.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import org.opensaml.core.Version;
2828

2929
import org.springframework.http.MediaType;
30+
import org.springframework.security.saml2.core.Saml2ParameterNames;
3031
import org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest;
3132
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestContext;
3233
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestFactory;
@@ -200,10 +201,10 @@ private void sendRedirect(HttpServletRequest request, HttpServletResponse respon
200201
this.authenticationRequestRepository.saveAuthenticationRequest(authenticationRequest, request, response);
201202
UriComponentsBuilder uriBuilder = UriComponentsBuilder
202203
.fromUriString(authenticationRequest.getAuthenticationRequestUri());
203-
addParameter("SAMLRequest", authenticationRequest.getSamlRequest(), uriBuilder);
204-
addParameter("RelayState", authenticationRequest.getRelayState(), uriBuilder);
205-
addParameter("SigAlg", authenticationRequest.getSigAlg(), uriBuilder);
206-
addParameter("Signature", authenticationRequest.getSignature(), uriBuilder);
204+
addParameter(Saml2ParameterNames.SAML_REQUEST, authenticationRequest.getSamlRequest(), uriBuilder);
205+
addParameter(Saml2ParameterNames.RELAY_STATE, authenticationRequest.getRelayState(), uriBuilder);
206+
addParameter(Saml2ParameterNames.SIG_ALG, authenticationRequest.getSigAlg(), uriBuilder);
207+
addParameter(Saml2ParameterNames.SIGNATURE, authenticationRequest.getSignature(), uriBuilder);
207208
String redirectUrl = uriBuilder.build(true).toUriString();
208209
response.sendRedirect(redirectUrl);
209210
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/DefaultSaml2AuthenticationRequestContextResolver.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import org.apache.commons.logging.LogFactory;
2323

2424
import org.springframework.core.convert.converter.Converter;
25+
import org.springframework.security.saml2.core.Saml2ParameterNames;
2526
import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestContext;
2627
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
2728
import org.springframework.util.Assert;
@@ -80,7 +81,7 @@ private Saml2AuthenticationRequestContext createRedirectAuthenticationRequestCon
8081
return Saml2AuthenticationRequestContext.builder().issuer(relyingParty.getEntityId())
8182
.relyingPartyRegistration(relyingParty)
8283
.assertionConsumerServiceUrl(relyingParty.getAssertionConsumerServiceLocation())
83-
.relayState(request.getParameter("RelayState")).build();
84+
.relayState(request.getParameter(Saml2ParameterNames.RELAY_STATE)).build();
8485
}
8586

8687
}

0 commit comments

Comments
 (0)