org.opensaml.saml.saml2.assertion

Class SAML20AssertionValidator

java.lang.Object

org.opensaml.saml.saml2.assertion.SAML20AssertionValidator

public class SAML20AssertionValidator
extends Object

A component capable of performing core validation of SAML version 2.0 Assertion instances.

Supports the following ValidationContext static parameters:

• SAML2AssertionValidationParameters.SIGNATURE_REQUIRED: Optional. If not supplied, defaults to 'true'. If an Assertion is signed, the signature is always evaluated and the result factored into the overall validation result, regardless of the value of this setting.
• SAML2AssertionValidationParameters.SIGNATURE_VALIDATION_CRITERIA_SET: Optional. If not supplied, a minimal criteria set will be constructed which contains an EntityIDCriteria containing the Assertion Issuer entityID, and a UsageCriteria of UsageType.SIGNING. If it is supplied, but either of those criteria are absent from the criteria set, they will be added with the above values.
• SAML2AssertionValidationParameters.CLOCK_SKEW: Optional. If not present the default clock skew of DEFAULT_CLOCK_SKEW milliseconds will be used.

Supports the following ValidationContext dynamic parameters:

• SAML2AssertionValidationParameters.CONFIRMED_SUBJECT_CONFIRMATION: Optional. Will be present after validation iff subject confirmation was successfully performed.

Field Summary

Fields

Modifier and Type	Field and Description
private net.shibboleth.utilities.java.support.collection.LazyMap<QName,ConditionValidator>	conditionValidators Registered Condition validators.
static long	DEFAULT_CLOCK_SKEW Default clock skew; 300000L milliseconds.
private Logger	log Class logger.
private SignaturePrevalidator	signaturePrevalidator SAML signature profile validator.
private net.shibboleth.utilities.java.support.collection.LazyMap<QName,StatementValidator>	statementValidators Registered Statement validators.
private net.shibboleth.utilities.java.support.collection.LazyMap<String,SubjectConfirmationValidator>	subjectConfirmationValidators Registered SubjectConfirmation validators.
private SignatureTrustEngine	trustEngine Trust engine for signature evaluation.

Constructor Summary

Constructors

Constructor and Description
SAML20AssertionValidator(Collection<ConditionValidator> newConditionValidators, Collection<SubjectConfirmationValidator> newConfirmationValidators, Collection<StatementValidator> newStatementValidators, SignatureTrustEngine newTrustEngine, SignaturePrevalidator newSignaturePrevalidator) Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
static long	getClockSkew(ValidationContext context) Gets the clock skew from the ValidationContext.getStaticParameters() parameters.
protected net.shibboleth.utilities.java.support.resolver.CriteriaSet	getSignatureValidationCriteriaSet(Assertion token, ValidationContext context) Get the criteria set that will be used in evaluating the Assertion signature via the supplied trust engine.
protected void	log(Assertion assertion, ValidationContext context) Log the Assertion which is being validated, along with the supplied validation context parameters.
protected ValidationResult	performSignatureValidation(Assertion token, ValidationContext context) Handle the actual signature validation.
ValidationResult	validate(Assertion assertion, ValidationContext context) Validate the supplied SAML 2 Assertion, using the parameters from the supplied ValidationContext.
protected ValidationResult	validateConditions(Assertion assertion, ValidationContext context) Validates the conditions on the assertion.
protected ValidationResult	validateConditionsTimeBounds(Assertion assertion, ValidationContext context) Validates the NotBefore and NotOnOrAfter Conditions constraints on the assertion.
protected ValidationResult	validateSignature(Assertion token, ValidationContext context) Validates the signature of the assertion, if it is signed.
protected ValidationResult	validateStatements(Assertion assertion, ValidationContext context) Validates the statements within the assertion.
protected ValidationResult	validateSubjectConfirmation(Assertion assertion, ValidationContext context) Validates the subject confirmations of the assertion.
protected ValidationResult	validateVersion(Assertion assertion, ValidationContext context) Validates that the assertion is a SAMLVersion.VERSION_20 assertion.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DEFAULT_CLOCK_SKEW

public static final long DEFAULT_CLOCK_SKEW

Default clock skew; 300000L milliseconds.

See Also:

Constant Field Values

log

private final Logger log

Class logger.

conditionValidators

private net.shibboleth.utilities.java.support.collection.LazyMap<QName,ConditionValidator> conditionValidators

Registered Condition validators.

subjectConfirmationValidators

private net.shibboleth.utilities.java.support.collection.LazyMap<String,SubjectConfirmationValidator> subjectConfirmationValidators

Registered SubjectConfirmation validators.

statementValidators

private net.shibboleth.utilities.java.support.collection.LazyMap<QName,StatementValidator> statementValidators

Registered Statement validators.

trustEngine

private SignatureTrustEngine trustEngine

Trust engine for signature evaluation.

signaturePrevalidator

private SignaturePrevalidator signaturePrevalidator

SAML signature profile validator.

Constructor Detail

SAML20AssertionValidator

public SAML20AssertionValidator(@Nullable
                        Collection<ConditionValidator> newConditionValidators,
                        @Nullable
                        Collection<SubjectConfirmationValidator> newConfirmationValidators,
                        @Nullable
                        Collection<StatementValidator> newStatementValidators,
                        @Nullable
                        SignatureTrustEngine newTrustEngine,
                        @Nullable
                        SignaturePrevalidator newSignaturePrevalidator)

Constructor.

Parameters:

newConditionValidators - validators used to validate the Conditions within the assertion

newConfirmationValidators - validators used to validate SubjectConfirmation methods within the assertion

newStatementValidators - validators used to validate Statements within the assertion

newTrustEngine - the trust used to validate the Assertion signature

newSignaturePrevalidator - the signature pre-validator used to pre-validate the Assertion signature

Method Detail

getClockSkew

public static long getClockSkew(@Nonnull
                ValidationContext context)

Gets the clock skew from the ValidationContext.getStaticParameters() parameters. If the parameter is not set or is not a positive Long then the DEFAULT_CLOCK_SKEW is used.

Parameters:

context - current validation context

Returns:

the clock skew

validate

@Nonnull
public ValidationResult validate(@Nonnull
                                Assertion assertion,
                                @Nonnull
                                ValidationContext context)
                          throws AssertionValidationException

Validate the supplied SAML 2 Assertion, using the parameters from the supplied ValidationContext.

Parameters:

assertion - the assertion being evaluated

context - the current validation context

Returns:

the validation result

Throws:

AssertionValidationException - if there is a fatal error evaluating the validity of the assertion

log

protected void log(@Nonnull
       Assertion assertion,
       @Nonnull
       ValidationContext context)

Log the Assertion which is being validated, along with the supplied validation context parameters.

Parameters:

assertion - the SAML 2 Assertion being validated

context -

validateVersion

@Nonnull
protected ValidationResult validateVersion(@Nonnull
                                       Assertion assertion,
                                       @Nonnull
                                       ValidationContext context)
                                    throws AssertionValidationException

Validates that the assertion is a SAMLVersion.VERSION_20 assertion.

Parameters:

assertion - the assertion to validate

context - current validation context

Returns:

result of the validation evaluation

Throws:

AssertionValidationException - thrown if there is a problem validating the version

validateSignature

@Nonnull
protected ValidationResult validateSignature(@Nonnull
                                         Assertion token,
                                         @Nonnull
                                         ValidationContext context)
                                      throws AssertionValidationException

Validates the signature of the assertion, if it is signed.

Parameters:

token - assertion whose signature will be validated

context - current validation context

Returns:

the result of the signature validation

Throws:

AssertionValidationException - thrown if there is a problem determining the validity of the signature

performSignatureValidation

@Nonnull
protected ValidationResult performSignatureValidation(@Nonnull
                                                  Assertion token,
                                                  @Nonnull
                                                  ValidationContext context)
                                               throws AssertionValidationException

Handle the actual signature validation.

Parameters:

token - assertion whose signature will be validated

context - current validation context

Returns:

the validation result

Throws:

AssertionValidationException - thrown if there is a problem determining the validity of the signature

getSignatureValidationCriteriaSet

@Nonnull
protected net.shibboleth.utilities.java.support.resolver.CriteriaSet getSignatureValidationCriteriaSet(@Nonnull
                                                                                                   Assertion token,
                                                                                                   @Nonnull
                                                                                                   ValidationContext context)

Get the criteria set that will be used in evaluating the Assertion signature via the supplied trust engine.

Parameters:

token - assertion whose signature will be validated

context - current validation context

Returns:

the criteria set to use

validateConditions

@Nonnull
protected ValidationResult validateConditions(@Nonnull
                                          Assertion assertion,
                                          @Nonnull
                                          ValidationContext context)
                                       throws AssertionValidationException

Validates the conditions on the assertion. Condition validators are looked up by the element QName and, if present, the schema type of the condition. If no validator can be found for the Condition the validation process fails.

Parameters:

assertion - the assertion whose conditions will be validated

context - current validation context

Returns:

the result of the validation evaluation

Throws:

AssertionValidationException - thrown if there is a problem determining the validity of the conditions

validateConditionsTimeBounds

@Nonnull
protected ValidationResult validateConditionsTimeBounds(@Nonnull
                                                    Assertion assertion,
                                                    @Nonnull
                                                    ValidationContext context)
                                                 throws AssertionValidationException

Validates the NotBefore and NotOnOrAfter Conditions constraints on the assertion.

Parameters:

assertion - the assertion whose conditions will be validated

context - current validation context

Returns:

the result of the validation evaluation

Throws:

AssertionValidationException - thrown if there is a problem determining the validity of the conditions

validateSubjectConfirmation

@Nonnull
protected ValidationResult validateSubjectConfirmation(@Nonnull
                                                   Assertion assertion,
                                                   @Nonnull
                                                   ValidationContext context)
                                                throws AssertionValidationException

Validates the subject confirmations of the assertion. Validators are looked up by the subject confirmation method. If any one subject confirmation is met the subject is considered confirmed per the SAML specification.

Parameters:

assertion - assertion whose subject is being confirmed

context - current validation context

Returns:

the result of the validation

Throws:

AssertionValidationException - thrown if there is a problem determining the validity the subject

validateStatements

@Nonnull
protected ValidationResult validateStatements(@Nonnull
                                          Assertion assertion,
                                          @Nonnull
                                          ValidationContext context)
                                       throws AssertionValidationException

Validates the statements within the assertion. Validators are looked up by the Statement's element QName or, if present, its schema type. Any statement for which a validator can not be found is simply ignored.

Parameters:

assertion - assertion whose statements are being validated

context - current validation context

Returns:

result of the validation

Throws:

AssertionValidationException - thrown if there is a problem determining the validity the statements