|
| 1 | +/* |
| 2 | + * Copyright 2002-2023 the original author or authors. |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * https://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | + |
| 17 | +package org.springframework.security.saml2.provider.service.web.authentication.logout; |
| 18 | + |
| 19 | +import java.io.ByteArrayInputStream; |
| 20 | +import java.nio.charset.StandardCharsets; |
| 21 | + |
| 22 | +import jakarta.servlet.http.HttpServletRequest; |
| 23 | +import net.shibboleth.utilities.java.support.xml.ParserPool; |
| 24 | +import org.opensaml.core.config.ConfigurationService; |
| 25 | +import org.opensaml.core.xml.config.XMLObjectProviderRegistry; |
| 26 | +import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport; |
| 27 | +import org.opensaml.saml.saml2.core.LogoutRequest; |
| 28 | +import org.opensaml.saml.saml2.core.impl.LogoutRequestUnmarshaller; |
| 29 | +import org.w3c.dom.Document; |
| 30 | +import org.w3c.dom.Element; |
| 31 | + |
| 32 | +import org.springframework.http.HttpMethod; |
| 33 | +import org.springframework.security.core.Authentication; |
| 34 | +import org.springframework.security.saml2.Saml2Exception; |
| 35 | +import org.springframework.security.saml2.core.OpenSamlInitializationService; |
| 36 | +import org.springframework.security.saml2.core.Saml2Error; |
| 37 | +import org.springframework.security.saml2.core.Saml2ErrorCodes; |
| 38 | +import org.springframework.security.saml2.core.Saml2ParameterNames; |
| 39 | +import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal; |
| 40 | +import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException; |
| 41 | +import org.springframework.security.saml2.provider.service.authentication.logout.OpenSamlLogoutRequestValidator; |
| 42 | +import org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequest; |
| 43 | +import org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequestValidatorParameters; |
| 44 | +import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration; |
| 45 | +import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository; |
| 46 | +import org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding; |
| 47 | +import org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationPlaceholderResolvers; |
| 48 | +import org.springframework.security.web.util.matcher.AntPathRequestMatcher; |
| 49 | +import org.springframework.security.web.util.matcher.OrRequestMatcher; |
| 50 | +import org.springframework.security.web.util.matcher.RequestMatcher; |
| 51 | +import org.springframework.util.Assert; |
| 52 | + |
| 53 | +/** |
| 54 | + * An OpenSAML-based implementation of |
| 55 | + * {@link Saml2LogoutRequestValidatorParametersResolver} |
| 56 | + */ |
| 57 | +public final class OpenSamlLogoutRequestValidatorParametersResolver |
| 58 | + implements Saml2LogoutRequestValidatorParametersResolver { |
| 59 | + |
| 60 | + static { |
| 61 | + OpenSamlInitializationService.initialize(); |
| 62 | + } |
| 63 | + |
| 64 | + private RequestMatcher requestMatcher = new OrRequestMatcher( |
| 65 | + new AntPathRequestMatcher("/logout/saml2/slo/{registrationId}"), |
| 66 | + new AntPathRequestMatcher("/logout/saml2/slo")); |
| 67 | + |
| 68 | + private final RelyingPartyRegistrationRepository registrations; |
| 69 | + |
| 70 | + private final ParserPool parserPool; |
| 71 | + |
| 72 | + private final LogoutRequestUnmarshaller unmarshaller; |
| 73 | + |
| 74 | + /** |
| 75 | + * Constructs a {@link OpenSamlLogoutRequestValidator} |
| 76 | + */ |
| 77 | + public OpenSamlLogoutRequestValidatorParametersResolver(RelyingPartyRegistrationRepository registrations) { |
| 78 | + Assert.notNull(registrations, "relyingPartyRegistrationRepository cannot be null"); |
| 79 | + XMLObjectProviderRegistry registry = ConfigurationService.get(XMLObjectProviderRegistry.class); |
| 80 | + this.parserPool = registry.getParserPool(); |
| 81 | + this.unmarshaller = (LogoutRequestUnmarshaller) XMLObjectProviderRegistrySupport.getUnmarshallerFactory() |
| 82 | + .getUnmarshaller(LogoutRequest.DEFAULT_ELEMENT_NAME); |
| 83 | + this.registrations = registrations; |
| 84 | + } |
| 85 | + |
| 86 | + /** |
| 87 | + * Construct the parameters necessary for validating an asserting party's |
| 88 | + * {@code <saml2:LogoutRequest>} based on the given {@link HttpServletRequest} |
| 89 | + * |
| 90 | + * <p> |
| 91 | + * Uses the configured {@link RequestMatcher} to identify the processing request, |
| 92 | + * including looking for any indicated {@code registrationId}. |
| 93 | + * |
| 94 | + * <p> |
| 95 | + * If a {@code registrationId} is found in the request, it will attempt to use that, |
| 96 | + * erroring if no {@link RelyingPartyRegistration} is found. |
| 97 | + * |
| 98 | + * <p> |
| 99 | + * If no {@code registrationId} is found in the request, it will look for a currently |
| 100 | + * logged-in user and use the associated {@code registrationId}. |
| 101 | + * |
| 102 | + * <p> |
| 103 | + * In the event that neither the URL nor any logged in user could determine a |
| 104 | + * {@code registrationId}, this code then will try and derive a |
| 105 | + * {@link RelyingPartyRegistration} given the {@code <saml2:LogoutRequest>}'s |
| 106 | + * {@code Issuer} value. |
| 107 | + * @param request the HTTP request |
| 108 | + * @return a {@link Saml2LogoutRequestValidatorParameters} instance, or {@code null} |
| 109 | + * if one could not be resolved |
| 110 | + * @throws Saml2AuthenticationException if the {@link RequestMatcher} specifies a |
| 111 | + * non-existent {@code registrationId} |
| 112 | + */ |
| 113 | + @Override |
| 114 | + public Saml2LogoutRequestValidatorParameters resolve(HttpServletRequest request, Authentication authentication) { |
| 115 | + if (request.getParameter(Saml2ParameterNames.SAML_REQUEST) == null) { |
| 116 | + return null; |
| 117 | + } |
| 118 | + RequestMatcher.MatchResult result = this.requestMatcher.matcher(request); |
| 119 | + if (!result.isMatch()) { |
| 120 | + return null; |
| 121 | + } |
| 122 | + String registrationId = getRegistrationId(result, authentication); |
| 123 | + if (registrationId == null) { |
| 124 | + return logoutRequestByEntityId(request, authentication); |
| 125 | + } |
| 126 | + return logoutRequestById(request, authentication, registrationId); |
| 127 | + } |
| 128 | + |
| 129 | + /** |
| 130 | + * The request matcher to use to identify a request to process a |
| 131 | + * {@code <saml2:LogoutRequest>}. By default, checks for {@code /logout/saml2/slo} and |
| 132 | + * {@code /logout/saml2/slo/{registrationId}}. |
| 133 | + * |
| 134 | + * <p> |
| 135 | + * Generally speaking, the URL does not need to have a {@code registrationId} in it |
| 136 | + * since either it can be looked up from the active logged in user or it can be |
| 137 | + * derived through the {@code Issuer} in the {@code <saml2:LogoutRequest>}. |
| 138 | + * @param requestMatcher the {@link RequestMatcher} to use |
| 139 | + */ |
| 140 | + public void setRequestMatcher(RequestMatcher requestMatcher) { |
| 141 | + Assert.notNull(requestMatcher, "requestMatcher cannot be null"); |
| 142 | + this.requestMatcher = requestMatcher; |
| 143 | + } |
| 144 | + |
| 145 | + private String getRegistrationId(RequestMatcher.MatchResult result, Authentication authentication) { |
| 146 | + String registrationId = result.getVariables().get("registrationId"); |
| 147 | + if (registrationId != null) { |
| 148 | + return registrationId; |
| 149 | + } |
| 150 | + if (authentication == null) { |
| 151 | + return null; |
| 152 | + } |
| 153 | + if (authentication.getPrincipal() instanceof Saml2AuthenticatedPrincipal principal) { |
| 154 | + return principal.getRelyingPartyRegistrationId(); |
| 155 | + } |
| 156 | + return null; |
| 157 | + } |
| 158 | + |
| 159 | + private Saml2LogoutRequestValidatorParameters logoutRequestById(HttpServletRequest request, |
| 160 | + Authentication authentication, String registrationId) { |
| 161 | + RelyingPartyRegistration registration = this.registrations.findByRegistrationId(registrationId); |
| 162 | + if (registration == null) { |
| 163 | + throw new Saml2AuthenticationException( |
| 164 | + new Saml2Error(Saml2ErrorCodes.RELYING_PARTY_REGISTRATION_NOT_FOUND, "registration not found"), |
| 165 | + "registration not found"); |
| 166 | + } |
| 167 | + return logoutRequestByRegistration(request, registration, authentication); |
| 168 | + } |
| 169 | + |
| 170 | + private Saml2LogoutRequestValidatorParameters logoutRequestByEntityId(HttpServletRequest request, |
| 171 | + Authentication authentication) { |
| 172 | + String serialized = request.getParameter(Saml2ParameterNames.SAML_REQUEST); |
| 173 | + byte[] b = Saml2Utils.samlDecode(serialized); |
| 174 | + LogoutRequest logoutRequest = parse(inflateIfRequired(request, b)); |
| 175 | + String issuer = logoutRequest.getIssuer().getValue(); |
| 176 | + RelyingPartyRegistration registration = this.registrations.findUniqueByAssertingPartyEntityId(issuer); |
| 177 | + return logoutRequestByRegistration(request, registration, authentication); |
| 178 | + } |
| 179 | + |
| 180 | + private Saml2LogoutRequestValidatorParameters logoutRequestByRegistration(HttpServletRequest request, |
| 181 | + RelyingPartyRegistration registration, Authentication authentication) { |
| 182 | + if (registration == null) { |
| 183 | + return null; |
| 184 | + } |
| 185 | + Saml2MessageBinding saml2MessageBinding = Saml2MessageBindingUtils.resolveBinding(request); |
| 186 | + registration = fromRequest(request, registration); |
| 187 | + String serialized = request.getParameter(Saml2ParameterNames.SAML_REQUEST); |
| 188 | + Saml2LogoutRequest logoutRequest = Saml2LogoutRequest.withRelyingPartyRegistration(registration) |
| 189 | + .samlRequest(serialized).relayState(request.getParameter(Saml2ParameterNames.RELAY_STATE)) |
| 190 | + .binding(saml2MessageBinding).location(registration.getSingleLogoutServiceLocation()) |
| 191 | + .parameters((params) -> params.put(Saml2ParameterNames.SIG_ALG, |
| 192 | + request.getParameter(Saml2ParameterNames.SIG_ALG))) |
| 193 | + .parameters((params) -> params.put(Saml2ParameterNames.SIGNATURE, |
| 194 | + request.getParameter(Saml2ParameterNames.SIGNATURE))) |
| 195 | + .parametersQuery((params) -> request.getQueryString()).build(); |
| 196 | + return new Saml2LogoutRequestValidatorParameters(logoutRequest, registration, authentication); |
| 197 | + } |
| 198 | + |
| 199 | + private String inflateIfRequired(HttpServletRequest request, byte[] b) { |
| 200 | + if (HttpMethod.GET.equals(request.getMethod())) { |
| 201 | + return Saml2Utils.samlInflate(b); |
| 202 | + } |
| 203 | + return new String(b, StandardCharsets.UTF_8); |
| 204 | + } |
| 205 | + |
| 206 | + private LogoutRequest parse(String request) throws Saml2Exception { |
| 207 | + try { |
| 208 | + Document document = this.parserPool |
| 209 | + .parse(new ByteArrayInputStream(request.getBytes(StandardCharsets.UTF_8))); |
| 210 | + Element element = document.getDocumentElement(); |
| 211 | + return (LogoutRequest) this.unmarshaller.unmarshall(element); |
| 212 | + } |
| 213 | + catch (Exception ex) { |
| 214 | + throw new Saml2Exception("Failed to deserialize LogoutRequest", ex); |
| 215 | + } |
| 216 | + } |
| 217 | + |
| 218 | + private RelyingPartyRegistration fromRequest(HttpServletRequest request, RelyingPartyRegistration registration) { |
| 219 | + RelyingPartyRegistrationPlaceholderResolvers.UriResolver uriResolver = RelyingPartyRegistrationPlaceholderResolvers |
| 220 | + .uriResolver(request, registration); |
| 221 | + String entityId = uriResolver.resolve(registration.getEntityId()); |
| 222 | + String logoutLocation = uriResolver.resolve(registration.getSingleLogoutServiceLocation()); |
| 223 | + String logoutResponseLocation = uriResolver.resolve(registration.getSingleLogoutServiceResponseLocation()); |
| 224 | + return registration.mutate().entityId(entityId).singleLogoutServiceLocation(logoutLocation) |
| 225 | + .singleLogoutServiceResponseLocation(logoutResponseLocation).build(); |
| 226 | + } |
| 227 | + |
| 228 | +} |
0 commit comments