You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2014/03/26 16:00:57 UTC
git commit: Save roles from SAML SSO to allow authorization
Repository: cxf
Updated Branches:
refs/heads/2.7.x-fixes 9a0f2b28f -> 748b97767
Save roles from SAML SSO to allow authorization
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/748b9776
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/748b9776
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/748b9776
Branch: refs/heads/2.7.x-fixes
Commit: 748b9776711a54e2a44792e721bc228409176a0f
Parents: 9a0f2b2
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Wed Mar 26 15:00:33 2014 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Wed Mar 26 15:00:33 2014 +0000
----------------------------------------------------------------------
.../saml/sso/AbstractServiceProviderFilter.java | 40 ++++++++++++++------
1 file changed, 28 insertions(+), 12 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/748b9776/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java
index 1e9556f..5f7a19a 100644
--- a/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java
+++ b/rt/rs/security/sso/saml/src/main/java/org/apache/cxf/rs/security/saml/sso/AbstractServiceProviderFilter.java
@@ -23,8 +23,11 @@ import java.io.StringReader;
import java.net.URI;
import java.net.URLEncoder;
import java.security.Principal;
+import java.util.HashSet;
+import java.util.List;
import java.util.Map;
import java.util.ResourceBundle;
+import java.util.Set;
import java.util.UUID;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -36,11 +39,11 @@ import javax.ws.rs.core.UriBuilder;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
-
import org.apache.cxf.common.i18n.BundleUtils;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.security.SimplePrincipal;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.interceptor.security.SAMLSecurityContext;
import org.apache.cxf.jaxrs.ext.RequestHandler;
import org.apache.cxf.jaxrs.impl.HttpHeadersImpl;
import org.apache.cxf.jaxrs.impl.UriInfoImpl;
@@ -52,6 +55,7 @@ import org.apache.cxf.rs.security.saml.sso.state.RequestState;
import org.apache.cxf.rs.security.saml.sso.state.ResponseState;
import org.apache.cxf.security.SecurityContext;
import org.apache.cxf.staxutils.StaxUtils;
+import org.apache.cxf.ws.security.SecurityConstants;
import org.apache.ws.security.saml.ext.AssertionWrapper;
import org.apache.ws.security.saml.ext.OpenSAMLUtil;
import org.opensaml.saml2.core.AuthnRequest;
@@ -177,19 +181,31 @@ public abstract class AbstractServiceProviderFilter extends AbstractSSOSpHandler
// don't worry about roles/claims for now, just set a basic SecurityContext
Subject subject = SAMLUtils.getSubject(m, assertionWrapper);
final String name = subject.getName();
-
if (name != null) {
- final SecurityContext sc = new SecurityContext() {
-
- public Principal getUserPrincipal() {
- return new SimplePrincipal(name);
- }
-
- public boolean isUserInRole(String role) {
- return false;
+ String roleAttributeName = (String)m.getContextualProperty(
+ SecurityConstants.SAML_ROLE_ATTRIBUTENAME);
+ if (roleAttributeName == null || roleAttributeName.length() == 0) {
+ roleAttributeName = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ }
+ List<String> roles =
+ org.apache.cxf.ws.security.wss4j.SAMLUtils.parseRolesInAssertion(assertionWrapper, roleAttributeName);
+ final Set<Principal> userRoles;
+ if (roles != null) {
+ userRoles = new HashSet<Principal>();
+ for (String role : roles) {
+ userRoles.add(new SimplePrincipal(role));
}
- };
- m.put(SecurityContext.class, sc);
+ } else {
+ userRoles = null;
+ }
+
+ SAMLSecurityContext context =
+ new SAMLSecurityContext(new SimplePrincipal(name), userRoles);
+ context.setIssuer(org.apache.cxf.ws.security.wss4j.SAMLUtils.getIssuer(assertionWrapper));
+ context.setAssertionElement(
+ org.apache.cxf.ws.security.wss4j.SAMLUtils.getAssertionElement(assertionWrapper));
+
+ m.put(SecurityContext.class, context);
}
}