diff options
| -rw-r--r-- | .gitignore | 6 | ||||
| -rw-r--r-- | pom.xml | 31 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/ECPAuthState.java | 13 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationException.java | 22 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationInfo.java | 47 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticator.java | 167 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticatorBase.java | 150 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/ECPIdPAuth.java | 82 | ||||
| -rw-r--r-- | src/main/java/edu/kit/scc/dei/ecplean/NamespaceResolver.java | 39 |
9 files changed, 557 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..00e038e --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +/.settings +/.project +/.classpath +/target +*~ +*.swp @@ -0,0 +1,31 @@ +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+ <groupId>edu.kit.scc.dei</groupId>
+ <artifactId>ecp-client-lean</artifactId>
+ <version>0.0.2-SNAPSHOT</version>
+ <name>Lean ECP Client</name>
+ <description>ECP Client w/o OpenSAML Libs</description>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-compiler-plugin</artifactId>
+ <version>2.3.2</version>
+ <configuration>
+ <source>1.6</source>
+ <target>1.6</target>
+ <encoding>UTF-8</encoding>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.httpcomponents</groupId>
+ <artifactId>httpclient</artifactId>
+ <version>4.1</version>
+ </dependency>
+ </dependencies>
+</project>
\ No newline at end of file diff --git a/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthState.java b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthState.java new file mode 100644 index 0000000..486af84 --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthState.java @@ -0,0 +1,13 @@ +package edu.kit.scc.dei.ecplean;
+
+public enum ECPAuthState {
+
+ NOT_STARTED,
+ INITIAL_PAOS_SP,
+ AUTH_IDP,
+ RESPONSE_TO_SP,
+ AUTH_COMPLETED,
+ AUTH_DENIED,
+ AUTH_ERROR
+
+}
diff --git a/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationException.java b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationException.java new file mode 100644 index 0000000..2fbfe96 --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationException.java @@ -0,0 +1,22 @@ +package edu.kit.scc.dei.ecplean;
+
+public class ECPAuthenticationException extends Exception {
+
+ private static final long serialVersionUID = 1L;
+
+ public ECPAuthenticationException() {
+ }
+
+ public ECPAuthenticationException(String message) {
+ super(message);
+ }
+
+ public ECPAuthenticationException(Throwable cause) {
+ super(cause);
+ }
+
+ public ECPAuthenticationException(String message, Throwable cause) {
+ super(message, cause);
+ }
+
+}
diff --git a/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationInfo.java b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationInfo.java new file mode 100644 index 0000000..0fc8b90 --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticationInfo.java @@ -0,0 +1,47 @@ +package edu.kit.scc.dei.ecplean;
+
+import java.net.URI;
+
+public class ECPAuthenticationInfo {
+
+ private String username;
+ private String password;
+ private URI idpEcpEndpoint;
+ private URI spUrl;
+ private ECPAuthState authState;
+
+ public ECPAuthenticationInfo(String username, String password,
+ URI idpEcpEndpoint, URI spUrl) {
+ super();
+ this.username = username;
+ this.password = password;
+ this.idpEcpEndpoint = idpEcpEndpoint;
+ this.spUrl = spUrl;
+ }
+
+ public String getUsername() {
+ return username;
+ }
+
+ public String getPassword() {
+ return password;
+ }
+
+ public URI getIdpEcpEndpoint() {
+ return idpEcpEndpoint;
+ }
+
+ public URI getSpUrl() {
+ return spUrl;
+ }
+
+ public ECPAuthState getAuthState() {
+ return authState;
+ }
+
+ public void setAuthState(ECPAuthState authState) {
+ this.authState = authState;
+ }
+
+
+}
diff --git a/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticator.java b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticator.java new file mode 100644 index 0000000..f6d1bb7 --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticator.java @@ -0,0 +1,167 @@ +package edu.kit.scc.dei.ecplean;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerException;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathException;
+
+import org.apache.http.HttpResponse;
+import org.apache.http.ParseException;
+import org.apache.http.client.ClientProtocolException;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.DefaultHttpClient;
+import org.apache.http.util.EntityUtils;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.xml.sax.SAXException;
+
+public class ECPAuthenticator extends ECPAuthenticatorBase {
+
+ public ECPAuthenticator(DefaultHttpClient client, String username, String password,
+ URI idpEcpEndpoint, URI spUrl) {
+ super(client);
+
+ authInfo = new ECPAuthenticationInfo(username, password, idpEcpEndpoint, spUrl);
+ authInfo.setAuthState(ECPAuthState.NOT_STARTED);
+ }
+
+ public ECPAuthenticator(String username, String password,
+ URI idpEcpEndpoint, URI spUrl) {
+ this(new DefaultHttpClient(), username, password, idpEcpEndpoint, spUrl);
+ }
+
+ public void authenticate() throws ECPAuthenticationException {
+ logger.info("Starting authentication");
+
+ logger.info("Contacting SP " + authInfo.getSpUrl());
+ authInfo.setAuthState(ECPAuthState.INITIAL_PAOS_SP);
+ setChanged();
+ notifyObservers(authInfo);
+
+ logger.info("Sending initial SP Request");
+
+ HttpGet httpGet = new HttpGet(authInfo.getSpUrl().toString());
+ httpGet.setHeader("Accept", "text/html; application/vnd.paos+xml");
+ httpGet.setHeader("PAOS", "ver='urn:liberty:paos:2003-08';'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'");
+
+ HttpResponse httpResponse;
+ String responseBody;
+ try {
+ httpResponse = client.execute(httpGet);
+ responseBody = EntityUtils.toString(httpResponse.getEntity());
+ } catch (ClientProtocolException e) {
+ logger.debug("Initial SP Request failed");
+ throw new ECPAuthenticationException(e);
+ } catch (ParseException e) {
+ logger.debug("Initial SP Request failed");
+ throw new ECPAuthenticationException(e);
+ } catch (IOException e) {
+ logger.debug("Initial SP Request failed");
+ throw new ECPAuthenticationException(e);
+ }
+
+ Document initResponse;
+ try {
+ initResponse = buildDocumentFromString(responseBody);
+ } catch (IOException e) {
+ logger.debug("Parsing SP Request failed");
+ throw new ECPAuthenticationException(e);
+ } catch (ParserConfigurationException e) {
+ logger.debug("Parsing SP Request failed");
+ throw new ECPAuthenticationException(e);
+ } catch (SAXException e) {
+ logger.debug("Parsing SP Request failed");
+ throw new ECPAuthenticationException(e);
+ }
+
+ String relayState;
+ try {
+ relayState = (String) queryDocument(initResponse, "//ecp:RelayState", XPathConstants.STRING);
+ } catch (XPathException e) {
+ logger.debug("Could not find relay state in PAOS answer from SP");
+ throw new ECPAuthenticationException(e);
+ }
+ logger.info("Got relayState: " + relayState);
+ String responseConsumerUrl;
+ try {
+ responseConsumerUrl = (String) queryDocument(initResponse, "/S:Envelope/S:Header/paos:Request/@responseConsumerURL", XPathConstants.STRING);
+ } catch (XPathException e) {
+ logger.debug("Could not find response consumer url in PAOS answer from SP");
+ throw new ECPAuthenticationException(e);
+ }
+ logger.info("Got responseConsumerUrl: " + responseConsumerUrl);
+
+ Node firstChild = initResponse.getDocumentElement().getFirstChild();
+ initResponse.getDocumentElement().removeChild(firstChild);
+
+ Document idpResponse = authenticateIdP(initResponse);
+
+ String assertionConsumerUrl;
+ try {
+ assertionConsumerUrl = (String) queryDocument(idpResponse, "/S:Envelope/S:Header/ecp:Response/@AssertionConsumerServiceURL", XPathConstants.STRING);
+ } catch (XPathException e) {
+ logger.debug("Could not find assertion consumer url in answer from IdP");
+ throw new ECPAuthenticationException(e);
+ }
+ logger.info("Got assertionConsumerUrl: " + assertionConsumerUrl);
+
+ if (! assertionConsumerUrl.equals(responseConsumerUrl)) {
+ throw new ECPAuthenticationException("Assertion- and ResponseConsumerURL don't match");
+ }
+
+ idpResponse.getDocumentElement().getFirstChild().getFirstChild().setTextContent(relayState);
+
+ logger.info("Sending Assertion to SP");
+ HttpPost httpPost = new HttpPost(assertionConsumerUrl);
+ httpPost.setHeader("Content-Type", "application/vnd.paos+xml");
+ try {
+ httpPost.setEntity(new StringEntity(documentToString(idpResponse)));
+ httpResponse = client.execute(httpPost);
+ responseBody = EntityUtils.toString(httpResponse.getEntity());
+ } catch (UnsupportedEncodingException e) {
+ logger.debug("Could not post assertion back to SP");
+ throw new ECPAuthenticationException(e);
+ } catch (TransformerConfigurationException e) {
+ logger.debug("Could not post assertion back to SP");
+ throw new ECPAuthenticationException(e);
+ } catch (ClientProtocolException e) {
+ logger.debug("Could not post assertion back to SP");
+ throw new ECPAuthenticationException(e);
+ } catch (ParseException e) {
+ logger.debug("Could not post assertion back to SP");
+ throw new ECPAuthenticationException(e);
+ } catch (TransformerException e) {
+ logger.debug("Could not post assertion back to SP");
+ throw new ECPAuthenticationException(e);
+ } catch (IOException e) {
+ logger.debug("Could not post assertion back to SP");
+ throw new ECPAuthenticationException(e);
+ }
+
+ logger.info("Requesting original URL");
+ httpGet = new HttpGet(authInfo.getSpUrl().toString());
+ try {
+ httpResponse = client.execute(httpGet);
+ responseBody = EntityUtils.toString(httpResponse.getEntity());
+
+ logger.info(responseBody);
+ } catch (ClientProtocolException e) {
+ logger.debug("Could not request original URL");
+ throw new ECPAuthenticationException(e);
+ } catch (ParseException e) {
+ logger.debug("Could not request original URL");
+ throw new ECPAuthenticationException(e);
+ } catch (IOException e) {
+ logger.debug("Could not request original URL");
+ throw new ECPAuthenticationException(e);
+ }
+
+ }
+}
diff --git a/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticatorBase.java b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticatorBase.java new file mode 100644 index 0000000..7e080f6 --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/ECPAuthenticatorBase.java @@ -0,0 +1,150 @@ +package edu.kit.scc.dei.ecplean;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.io.UnsupportedEncodingException;
+import java.util.Observable;
+
+import javax.xml.namespace.QName;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathException;
+import javax.xml.xpath.XPathExpression;
+import javax.xml.xpath.XPathFactory;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.apache.http.HttpResponse;
+import org.apache.http.HttpStatus;
+import org.apache.http.ParseException;
+import org.apache.http.auth.AuthScope;
+import org.apache.http.auth.UsernamePasswordCredentials;
+import org.apache.http.client.ClientProtocolException;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.DefaultHttpClient;
+import org.apache.http.util.EntityUtils;
+import org.w3c.dom.Document;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+
+public abstract class ECPAuthenticatorBase extends Observable {
+
+ protected static Log logger = LogFactory.getLog(ECPAuthenticatorBase.class);
+ protected ECPAuthenticationInfo authInfo;
+ protected DefaultHttpClient client;
+ protected DocumentBuilderFactory documentBuilderFactory;
+ protected XPathFactory xpathFactory;
+ protected NamespaceResolver namespaceResolver;
+ protected TransformerFactory transformerFactory;
+
+ public ECPAuthenticatorBase(DefaultHttpClient client) {
+ this.client = client;
+
+ documentBuilderFactory = DocumentBuilderFactory.newInstance();
+ documentBuilderFactory.setNamespaceAware(true);
+
+ xpathFactory = XPathFactory.newInstance();
+ namespaceResolver = new NamespaceResolver();
+ namespaceResolver.addNamespace("ecp", "urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp");
+ namespaceResolver.addNamespace("S", "http://schemas.xmlsoap.org/soap/envelope/");
+ namespaceResolver.addNamespace("paos", "urn:liberty:paos:2003-08");
+
+ transformerFactory = TransformerFactory.newInstance();
+ }
+
+ public ECPAuthenticatorBase() {
+ this(new DefaultHttpClient());
+ }
+
+ protected Document authenticateIdP(Document idpRequest)
+ throws ECPAuthenticationException {
+ logger.info("Sending initial IdP Request");
+ client.getCredentialsProvider().setCredentials(
+ new AuthScope(authInfo.getIdpEcpEndpoint().getHost(), authInfo.getIdpEcpEndpoint().getPort()),
+ new UsernamePasswordCredentials(authInfo.getUsername(), authInfo.getPassword()));
+ HttpPost httpPost = new HttpPost(authInfo.getIdpEcpEndpoint().toString());
+ HttpResponse httpResponse;
+
+ try {
+ httpPost.setEntity(new StringEntity(documentToString(idpRequest)));
+ httpResponse = client.execute(httpPost);
+
+ if (httpResponse.getStatusLine().getStatusCode() == HttpStatus.SC_UNAUTHORIZED) {
+ throw new ECPAuthenticationException("User not authorized");
+ }
+ } catch (UnsupportedEncodingException e) {
+ logger.debug("Could not submit PAOS request to IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (TransformerConfigurationException e) {
+ logger.debug("Could not submit PAOS request to IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (ClientProtocolException e) {
+ logger.debug("Could not submit PAOS request to IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (TransformerException e) {
+ logger.debug("Could not submit PAOS request to IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (IOException e) {
+ logger.debug("Could not submit PAOS request to IdP");
+ throw new ECPAuthenticationException(e);
+ }
+
+ String responseBody;
+ try {
+ responseBody = EntityUtils.toString(httpResponse.getEntity());
+ return buildDocumentFromString(responseBody);
+ } catch (ParseException e) {
+ logger.debug("Could not read response from IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (IOException e) {
+ logger.debug("Could not read response from IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (SAXException e) {
+ logger.debug("Could not read response from IdP");
+ throw new ECPAuthenticationException(e);
+ } catch (ParserConfigurationException e) {
+ logger.debug("Could not read response from IdP");
+ throw new ECPAuthenticationException(e);
+ }
+ }
+
+ protected Document buildDocumentFromString(String input)
+ throws IOException, ParserConfigurationException, SAXException {
+ DocumentBuilder builder = documentBuilderFactory.newDocumentBuilder();
+ return builder.parse(new InputSource(new StringReader(input)));
+ }
+
+ protected Object queryDocument(Document xmlDocument, String expression,
+ QName returnType) throws XPathException {
+ XPath xpath = xpathFactory.newXPath();
+ xpath.setNamespaceContext(namespaceResolver);
+ XPathExpression xPathExpression = xpath.compile(expression);
+ return xPathExpression.evaluate(xmlDocument, returnType);
+ }
+
+ protected String documentToString(Document xmlDocument)
+ throws TransformerConfigurationException, TransformerException {
+ Transformer transformer = transformerFactory.newTransformer();
+
+ StreamResult result = new StreamResult(new StringWriter());
+ DOMSource source = new DOMSource(xmlDocument);
+ transformer.transform(source, result);
+
+ return result.getWriter().toString();
+ }
+
+ public DefaultHttpClient getHttpClient() {
+ return client;
+ }
+
+}
\ No newline at end of file diff --git a/src/main/java/edu/kit/scc/dei/ecplean/ECPIdPAuth.java b/src/main/java/edu/kit/scc/dei/ecplean/ECPIdPAuth.java new file mode 100644 index 0000000..0eb035b --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/ECPIdPAuth.java @@ -0,0 +1,82 @@ +package edu.kit.scc.dei.ecplean;
+
+import java.io.IOException;
+import java.net.URI;
+
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerException;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathException;
+
+import org.apache.http.impl.client.DefaultHttpClient;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.xml.sax.SAXException;
+
+public class ECPIdPAuth extends ECPAuthenticatorBase {
+
+ public ECPIdPAuth(String username, String password,
+ URI idpEcpEndpoint) {
+ this(new DefaultHttpClient(), username, password, idpEcpEndpoint);
+ }
+
+ public ECPIdPAuth(DefaultHttpClient client, String username, String password,
+ URI idpEcpEndpoint) {
+ super(client);
+
+ authInfo = new ECPAuthenticationInfo(username, password, idpEcpEndpoint, null);
+ authInfo.setAuthState(ECPAuthState.NOT_STARTED);
+ }
+
+ public String authenticate(String paosMessage) throws ECPAuthenticationException {
+
+ Document initResponse;
+ try {
+ initResponse = buildDocumentFromString(paosMessage);
+ } catch (IOException e) {
+ logger.debug("Parsing SP Request failed");
+ throw new ECPAuthenticationException(e);
+ } catch (ParserConfigurationException e) {
+ logger.debug("Parsing SP Request failed");
+ throw new ECPAuthenticationException(e);
+ } catch (SAXException e) {
+ logger.debug("Parsing SP Request failed");
+ throw new ECPAuthenticationException(e);
+ }
+
+ String relayState;
+ try {
+ relayState = (String) queryDocument(initResponse, "//ecp:RelayState", XPathConstants.STRING);
+ } catch (XPathException e) {
+ logger.debug("Could not find relay state in PAOS answer from SP");
+ throw new ECPAuthenticationException(e);
+ }
+ logger.info("Got relayState: " + relayState);
+ String responseConsumerUrl;
+ try {
+ responseConsumerUrl = (String) queryDocument(initResponse, "/S:Envelope/S:Header/paos:Request/@responseConsumerURL", XPathConstants.STRING);
+ } catch (XPathException e) {
+ logger.debug("Could not find response consumer url in PAOS answer from SP");
+ throw new ECPAuthenticationException(e);
+ }
+ logger.info("Got responseConsumerUrl: " + responseConsumerUrl);
+
+ Node firstChild = initResponse.getDocumentElement().getFirstChild();
+ initResponse.getDocumentElement().removeChild(firstChild);
+
+ Document idpResponse = authenticateIdP(initResponse);
+ idpResponse.getDocumentElement().getFirstChild().getFirstChild().setTextContent(relayState);
+
+ try {
+ return documentToString(idpResponse);
+ } catch (TransformerConfigurationException e) {
+ logger.debug("documentToString failed");
+ throw new ECPAuthenticationException(e);
+ } catch (TransformerException e) {
+ logger.debug("documentToString failed");
+ throw new ECPAuthenticationException(e);
+ }
+ }
+
+}
diff --git a/src/main/java/edu/kit/scc/dei/ecplean/NamespaceResolver.java b/src/main/java/edu/kit/scc/dei/ecplean/NamespaceResolver.java new file mode 100644 index 0000000..455923e --- /dev/null +++ b/src/main/java/edu/kit/scc/dei/ecplean/NamespaceResolver.java @@ -0,0 +1,39 @@ +package edu.kit.scc.dei.ecplean;
+
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.Map;
+
+import javax.xml.namespace.NamespaceContext;
+
+public class NamespaceResolver implements NamespaceContext {
+
+ private Map<String, String> prefixMap;
+ private Map<String, String> uriMap;
+
+ public NamespaceResolver() {
+ prefixMap = new HashMap<String, String>();
+ uriMap = new HashMap<String, String>();
+ }
+
+ public void addNamespace(String prefix, String uri) {
+ prefixMap.put(prefix, uri);
+ uriMap.put(uri, prefix);
+ }
+
+ @Override
+ public String getNamespaceURI(String prefix) {
+ return prefixMap.get(prefix);
+ }
+
+ @Override
+ public String getPrefix(String namespaceURI) {
+ return uriMap.get(namespaceURI);
+ }
+
+ @Override
+ public Iterator<String> getPrefixes(String namespaceURI) {
+ return prefixMap.keySet().iterator();
+ }
+
+}
|