You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by bh...@apache.org on 2014/08/25 03:06:20 UTC
[1/2] git commit: updated refs/heads/saml2 to 2637186
Repository: cloudstack
Updated Branches:
refs/heads/saml2 67cfb568e -> 2637186f1
SAMLUtils: Create new NameID using passed nameId taking just id and session idx
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/dfd5be24
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/dfd5be24
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/dfd5be24
Branch: refs/heads/saml2
Commit: dfd5be24652a5c757bad9a029d68fcd7b71ff5bf
Parents: 67cfb56
Author: Rohit Yadav <ro...@shapeblue.com>
Authored: Mon Aug 25 02:39:50 2014 +0200
Committer: Rohit Yadav <ro...@shapeblue.com>
Committed: Mon Aug 25 02:39:50 2014 +0200
----------------------------------------------------------------------
utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/dfd5be24/utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java
----------------------------------------------------------------------
diff --git a/utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java b/utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java
index a238c82..51cf507 100644
--- a/utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java
+++ b/utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java
@@ -40,6 +40,7 @@ import org.opensaml.saml2.core.impl.AuthnContextClassRefBuilder;
import org.opensaml.saml2.core.impl.AuthnRequestBuilder;
import org.opensaml.saml2.core.impl.IssuerBuilder;
import org.opensaml.saml2.core.impl.LogoutRequestBuilder;
+import org.opensaml.saml2.core.impl.NameIDBuilder;
import org.opensaml.saml2.core.impl.NameIDPolicyBuilder;
import org.opensaml.saml2.core.impl.RequestedAuthnContextBuilder;
import org.opensaml.saml2.core.impl.SessionIndexBuilder;
@@ -138,7 +139,7 @@ public class SAMLUtils {
return authnRequest;
}
- public static LogoutRequest buildLogoutRequest(String logoutUrl, String spId, NameID nameId, String sessionIndex) {
+ public static LogoutRequest buildLogoutRequest(String logoutUrl, String spId, NameID sessionNameId, String sessionIndex) {
IssuerBuilder issuerBuilder = new IssuerBuilder();
Issuer issuer = issuerBuilder.buildObject();
issuer.setValue(spId);
@@ -146,6 +147,10 @@ public class SAMLUtils {
SessionIndex sessionIndexElement = new SessionIndexBuilder().buildObject();
sessionIndexElement.setSessionIndex(sessionIndex);
+ NameID nameID = new NameIDBuilder().buildObject();
+ nameID.setValue(sessionNameId.getValue());
+ nameID.setFormat(sessionNameId.getFormat());
+
LogoutRequest logoutRequest = new LogoutRequestBuilder().buildObject();
logoutRequest.setID(generateSecureRandomId());
logoutRequest.setDestination(logoutUrl);
@@ -153,7 +158,7 @@ public class SAMLUtils {
logoutRequest.setIssueInstant(new DateTime());
logoutRequest.setIssuer(issuer);
logoutRequest.getSessionIndexes().add(sessionIndexElement);
- logoutRequest.setNameID(nameId);
+ logoutRequest.setNameID(nameID);
return logoutRequest;
}
[2/2] git commit: updated refs/heads/saml2 to 2637186
Posted by bh...@apache.org.
SAML2LogoutAPIAuthenticatorCmd: check logout response and redirect to UI
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/2637186f
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/2637186f
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/2637186f
Branch: refs/heads/saml2
Commit: 2637186f143cb1423d287d0ba99752d300c1a776
Parents: dfd5be2
Author: Rohit Yadav <ro...@shapeblue.com>
Authored: Mon Aug 25 02:41:26 2014 +0200
Committer: Rohit Yadav <ro...@shapeblue.com>
Committed: Mon Aug 25 03:02:06 2014 +0200
----------------------------------------------------------------------
.../command/SAML2LogoutAPIAuthenticatorCmd.java | 40 +++++++++++++++++++-
1 file changed, 38 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2637186f/plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LogoutAPIAuthenticatorCmd.java
----------------------------------------------------------------------
diff --git a/plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LogoutAPIAuthenticatorCmd.java b/plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LogoutAPIAuthenticatorCmd.java
index 9910074..1c96f0b 100644
--- a/plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LogoutAPIAuthenticatorCmd.java
+++ b/plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LogoutAPIAuthenticatorCmd.java
@@ -17,6 +17,7 @@
package org.apache.cloudstack.api.command;
import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.configuration.Config;
import com.cloud.user.Account;
import org.apache.cloudstack.api.APICommand;
import org.apache.cloudstack.api.ApiErrorCode;
@@ -27,18 +28,24 @@ import org.apache.cloudstack.api.auth.APIAuthenticationType;
import org.apache.cloudstack.api.auth.APIAuthenticator;
import org.apache.cloudstack.api.auth.PluggableAPIAuthenticator;
import org.apache.cloudstack.api.response.LogoutCmdResponse;
+import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
import org.apache.cloudstack.saml.SAML2AuthManager;
import org.apache.cloudstack.utils.auth.SAMLUtils;
import org.apache.log4j.Logger;
import org.opensaml.DefaultBootstrap;
import org.opensaml.saml2.core.LogoutRequest;
import org.opensaml.saml2.core.NameID;
+import org.opensaml.saml2.core.Response;
+import org.opensaml.saml2.core.StatusCode;
import org.opensaml.xml.ConfigurationException;
import org.opensaml.xml.io.MarshallingException;
+import org.opensaml.xml.io.UnmarshallingException;
+import org.xml.sax.SAXException;
import javax.inject.Inject;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
+import javax.xml.parsers.ParserConfigurationException;
import javax.xml.stream.FactoryConfigurationError;
import java.io.IOException;
import java.util.List;
@@ -51,6 +58,8 @@ public class SAML2LogoutAPIAuthenticatorCmd extends BaseCmd implements APIAuthen
@Inject
ApiServerService _apiServer;
+ @Inject
+ ConfigurationDao _configDao;
SAML2AuthManager _samlAuthManager;
/////////////////////////////////////////////////////
@@ -79,6 +88,7 @@ public class SAML2LogoutAPIAuthenticatorCmd extends BaseCmd implements APIAuthen
LogoutCmdResponse response = new LogoutCmdResponse();
response.setDescription("success");
response.setResponseName(getCommandName());
+ String responseString = ApiResponseSerializer.toSerializedString(response, responseType);
try {
DefaultBootstrap.bootstrap();
@@ -89,8 +99,35 @@ public class SAML2LogoutAPIAuthenticatorCmd extends BaseCmd implements APIAuthen
params, responseType));
}
+ if (params.containsKey("SAMLResponse")) {
+ try {
+ final String samlResponse = ((String[])params.get(SAMLUtils.SAML_RESPONSE))[0];
+ Response processedSAMLResponse = SAMLUtils.decodeSAMLResponse(samlResponse);
+ String statusCode = processedSAMLResponse.getStatus().getStatusCode().getValue();
+ if (!statusCode.equals(StatusCode.SUCCESS_URI)) {
+ throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, _apiServer.getSerializedApiError(ApiErrorCode.INTERNAL_ERROR.getHttpCode(),
+ "SAML SLO LogoutResponse status is not Success",
+ params, responseType));
+ }
+ } catch (ConfigurationException | FactoryConfigurationError | ParserConfigurationException | SAXException | IOException | UnmarshallingException e) {
+ s_logger.error("SAMLResponse processing error: " + e.getMessage());
+ }
+ try {
+ resp.sendRedirect(_configDao.getValue(Config.SAMLCloudStackRedirectionUrl.key()));
+ } catch (IOException ignored) {
+ }
+ return responseString;
+ }
+
NameID nameId = (NameID) session.getAttribute(SAMLUtils.SAML_NAMEID);
String sessionIndex = (String) session.getAttribute(SAMLUtils.SAML_SESSION);
+ if (nameId == null || sessionIndex == null) {
+ try {
+ resp.sendRedirect(_configDao.getValue(Config.SAMLCloudStackRedirectionUrl.key()));
+ } catch (IOException ignored) {
+ }
+ return responseString;
+ }
LogoutRequest logoutRequest = SAMLUtils.buildLogoutRequest(_samlAuthManager.getIdpSingleLogOutUrl(), _samlAuthManager.getServiceProviderId(), nameId, sessionIndex);
try {
@@ -102,8 +139,7 @@ public class SAML2LogoutAPIAuthenticatorCmd extends BaseCmd implements APIAuthen
"SAML Single Logout Error",
params, responseType));
}
-
- return ApiResponseSerializer.toSerializedString(response, responseType);
+ return responseString;
}
@Override