Skip to content

Commit 9d8888c

Browse files
jzheauxjzheaux
committed
Use AssertingPartyMetadata
Issue gh-15394
1 parent dfa67fd commit 9d8888c

29 files changed

+320
-79
lines changed

‎config/src/main/java/org/springframework/security/config/saml2/RelyingPartyRegistrationsBeanDefinitionParser.java

+7-6
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
import org.springframework.core.io.ResourceLoader;
4040
import org.springframework.security.converter.RsaKeyConverters;
4141
import org.springframework.security.saml2.core.Saml2X509Credential;
42+
import org.springframework.security.saml2.provider.service.registration.AssertingPartyMetadata;
4243
import org.springframework.security.saml2.provider.service.registration.InMemoryRelyingPartyRegistrationRepository;
4344
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
4445
import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrations;
@@ -153,7 +154,7 @@ private static Map<String, Map<String, Object>> getAssertingParties(Element elem
153154
}
154155

155156
private static void addVerificationCredentials(Map<String, Object> assertingParty,
156-
RelyingPartyRegistration.AssertingPartyDetails.Builder builder) {
157+
AssertingPartyMetadata.Builder<?> builder) {
157158
List<String> verificationCertificateLocations = (List<String>) assertingParty.get(ELT_VERIFICATION_CREDENTIAL);
158159
List<Saml2X509Credential> verificationCredentials = new ArrayList<>();
159160
for (String certificateLocation : verificationCertificateLocations) {
@@ -163,7 +164,7 @@ private static void addVerificationCredentials(Map<String, Object> assertingPart
163164
}
164165

165166
private static void addEncryptionCredentials(Map<String, Object> assertingParty,
166-
RelyingPartyRegistration.AssertingPartyDetails.Builder builder) {
167+
AssertingPartyMetadata.Builder<?> builder) {
167168
List<String> encryptionCertificateLocations = (List<String>) assertingParty.get(ELT_ENCRYPTION_CREDENTIAL);
168169
List<Saml2X509Credential> encryptionCredentials = new ArrayList<>();
169170
for (String certificateLocation : encryptionCertificateLocations) {
@@ -220,8 +221,8 @@ private static RelyingPartyRegistration.Builder getBuilderFromMetadataLocationIf
220221
}
221222
else {
222223
builder = RelyingPartyRegistration.withRegistrationId(registrationId)
223-
.assertingPartyDetails((apBuilder) -> buildAssertingParty(relyingPartyRegistrationElt, assertingParties,
224-
apBuilder, parserContext));
224+
.assertingPartyMetadata((apBuilder) -> buildAssertingParty(relyingPartyRegistrationElt,
225+
assertingParties, apBuilder, parserContext));
225226
}
226227
addRemainingProperties(relyingPartyRegistrationElt, builder);
227228
return builder;
@@ -260,7 +261,7 @@ private static void addRemainingProperties(Element relyingPartyRegistrationElt,
260261
}
261262

262263
private static void buildAssertingParty(Element relyingPartyElt, Map<String, Map<String, Object>> assertingParties,
263-
RelyingPartyRegistration.AssertingPartyDetails.Builder builder, ParserContext parserContext) {
264+
AssertingPartyMetadata.Builder<?> builder, ParserContext parserContext) {
264265
String assertingPartyId = relyingPartyElt.getAttribute(ATT_ASSERTING_PARTY_ID);
265266
if (!assertingParties.containsKey(assertingPartyId)) {
266267
Object source = parserContext.extractSource(relyingPartyElt);
@@ -293,7 +294,7 @@ private static void buildAssertingParty(Element relyingPartyElt, Map<String, Map
293294
}
294295

295296
private static void addSigningAlgorithms(Map<String, Object> assertingParty,
296-
RelyingPartyRegistration.AssertingPartyDetails.Builder builder) {
297+
AssertingPartyMetadata.Builder<?> builder) {
297298
String signingAlgorithmsAttr = getAsString(assertingParty, ATT_SIGNING_ALGORITHMS);
298299
if (StringUtils.hasText(signingAlgorithmsAttr)) {
299300
List<String> signingAlgorithms = Arrays.asList(signingAlgorithmsAttr.split(","));

‎docs/modules/ROOT/pages/servlet/saml2/login/authentication-requests.adoc

+6-6
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ Java::
114114
----
115115
RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.withRegistrationId("okta")
116116
// ...
117-
.assertingPartyDetails(party -> party
117+
.assertingPartyMetadata(party -> party
118118
// ...
119119
.wantAuthnRequestsSigned(false)
120120
)
@@ -128,7 +128,7 @@ Kotlin::
128128
var relyingPartyRegistration: RelyingPartyRegistration =
129129
RelyingPartyRegistration.withRegistrationId("okta")
130130
// ...
131-
.assertingPartyDetails { party: AssertingPartyDetails.Builder -> party
131+
.assertingPartyMetadata { party: AssertingPartyMetadata.Builder -> party
132132
// ...
133133
.wantAuthnRequestsSigned(false)
134134
}
@@ -154,7 +154,7 @@ Java::
154154
String metadataLocation = "classpath:asserting-party-metadata.xml";
155155
RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistrations.fromMetadataLocation(metadataLocation)
156156
// ...
157-
.assertingPartyDetails((party) -> party
157+
.assertingPartyMetadata((party) -> party
158158
// ...
159159
.signingAlgorithms((sign) -> sign.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512))
160160
)
@@ -169,7 +169,7 @@ var metadataLocation = "classpath:asserting-party-metadata.xml"
169169
var relyingPartyRegistration: RelyingPartyRegistration =
170170
RelyingPartyRegistrations.fromMetadataLocation(metadataLocation)
171171
// ...
172-
.assertingPartyDetails { party: AssertingPartyDetails.Builder -> party
172+
.assertingPartyMetadata { party: AssertingPartyMetadata.Builder -> party
173173
// ...
174174
.signingAlgorithms { sign: MutableList<String?> ->
175175
sign.add(
@@ -197,7 +197,7 @@ Java::
197197
----
198198
RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.withRegistrationId("okta")
199199
// ...
200-
.assertingPartyDetails(party -> party
200+
.assertingPartyMetadata(party -> party
201201
// ...
202202
.singleSignOnServiceBinding(Saml2MessageBinding.POST)
203203
)
@@ -211,7 +211,7 @@ Kotlin::
211211
var relyingPartyRegistration: RelyingPartyRegistration? =
212212
RelyingPartyRegistration.withRegistrationId("okta")
213213
// ...
214-
.assertingPartyDetails { party: AssertingPartyDetails.Builder -> party
214+
.assertingPartyMetadata { party: AssertingPartyMetadata.Builder -> party
215215
// ...
216216
.singleSignOnServiceBinding(Saml2MessageBinding.POST)
217217
}

‎docs/modules/ROOT/pages/servlet/saml2/login/overview.adoc

+5-5
Original file line numberDiff line numberDiff line change
@@ -484,7 +484,7 @@ public RelyingPartyRegistrationRepository relyingPartyRegistrations() throws Exc
484484
Saml2X509Credential credential = Saml2X509Credential.verification(certificate);
485485
RelyingPartyRegistration registration = RelyingPartyRegistration
486486
.withRegistrationId("example")
487-
.assertingPartyDetails(party -> party
487+
.assertingPartyMetadata(party -> party
488488
.entityId("https://idp.example.com/issuer")
489489
.singleSignOnServiceLocation("https://idp.example.com/SSO.saml2")
490490
.wantAuthnRequestsSigned(false)
@@ -508,7 +508,7 @@ open fun relyingPartyRegistrations(): RelyingPartyRegistrationRepository {
508508
val credential: Saml2X509Credential = Saml2X509Credential.verification(certificate)
509509
val registration = RelyingPartyRegistration
510510
.withRegistrationId("example")
511-
.assertingPartyDetails { party: AssertingPartyDetails.Builder ->
511+
.assertingPartyMetadata { party: AssertingPartyMetadata.Builder ->
512512
party
513513
.entityId("https://idp.example.com/issuer")
514514
.singleSignOnServiceLocation("https://idp.example.com/SSO.saml2")
@@ -699,7 +699,7 @@ RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.wit
699699
.entityId("{baseUrl}/{registrationId}")
700700
.decryptionX509Credentials(c -> c.add(relyingPartyDecryptingCredential()))
701701
.assertionConsumerServiceLocation("/my-login-endpoint/{registrationId}")
702-
.assertingPartyDetails(party -> party
702+
.assertingPartyMetadata(party -> party
703703
.entityId("https://ap.example.org")
704704
.verificationX509Credentials(c -> c.add(assertingPartyVerifyingCredential()))
705705
.singleSignOnServiceLocation("https://ap.example.org/SSO.saml2")
@@ -718,7 +718,7 @@ val relyingPartyRegistration =
718718
c.add(relyingPartyDecryptingCredential())
719719
}
720720
.assertionConsumerServiceLocation("/my-login-endpoint/{registrationId}")
721-
.assertingPartyDetails { party -> party
721+
.assertingPartyMetadata { party -> party
722722
.entityId("https://ap.example.org")
723723
.verificationX509Credentials { c -> c.add(assertingPartyVerifyingCredential()) }
724724
.singleSignOnServiceLocation("https://ap.example.org/SSO.saml2")
@@ -730,7 +730,7 @@ val relyingPartyRegistration =
730730
[TIP]
731731
====
732732
The top-level metadata methods are details about the relying party.
733-
The methods inside `assertingPartyDetails` are details about the asserting party.
733+
The methods inside `AssertingPartyMetadata` are details about the asserting party.
734734
====
735735

736736
[NOTE]

‎docs/modules/ROOT/pages/servlet/saml2/logout.adoc

+2-2
Original file line numberDiff line numberDiff line change
@@ -339,7 +339,7 @@ It's common to need to set other values in the `<saml2:LogoutRequest>` than the
339339

340340
By default, Spring Security will issue a `<saml2:LogoutRequest>` and supply:
341341

342-
* The `Destination` attribute - from `RelyingPartyRegistration#getAssertingPartyDetails#getSingleLogoutServiceLocation`
342+
* The `Destination` attribute - from `RelyingPartyRegistration#getAssertingPartyMetadata#getSingleLogoutServiceLocation`
343343
* The `ID` attribute - a GUID
344344
* The `<Issuer>` element - from `RelyingPartyRegistration#getEntityId`
345345
* The `<NameID>` element - from `Authentication#getName`
@@ -424,7 +424,7 @@ It's common to need to set other values in the `<saml2:LogoutResponse>` than the
424424

425425
By default, Spring Security will issue a `<saml2:LogoutResponse>` and supply:
426426

427-
* The `Destination` attribute - from `RelyingPartyRegistration#getAssertingPartyDetails#getSingleLogoutServiceResponseLocation`
427+
* The `Destination` attribute - from `RelyingPartyRegistration#getAssertingPartyMetadata#getSingleLogoutServiceResponseLocation`
428428
* The `ID` attribute - a GUID
429429
* The `<Issuer>` element - from `RelyingPartyRegistration#getEntityId`
430430
* The `<Status>` element - `SUCCESS`

‎docs/modules/ROOT/pages/servlet/saml2/metadata.adoc

+7-8
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
[[servlet-saml2login-metadata]]
22
= Saml 2.0 Metadata
33

4-
Spring Security can <<parsing-asserting-party-metadata,parse asserting party metadata>> to produce an `AssertingPartyDetails` instance as well as <<publishing-relying-party-metadata,publish relying party metadata>> from a `RelyingPartyRegistration` instance.
4+
Spring Security can <<parsing-asserting-party-metadata,parse asserting party metadata>> to produce an `AssertingPartyMetadata` instance as well as <<publishing-relying-party-metadata,publish relying party metadata>> from a `RelyingPartyRegistration` instance.
55

66
[[parsing-asserting-party-metadata]]
77
== Parsing `<saml2:IDPSSODescriptor>` metadata
88

99
You can parse an asserting party's metadata xref:servlet/saml2/login/overview.adoc#servlet-saml2login-relyingpartyregistrationrepository[using `RelyingPartyRegistrations`].
1010

11-
When using the OpenSAML vendor support, the resulting `AssertingPartyDetails` will be of type `OpenSamlAssertingPartyDetails`.
11+
When using the OpenSAML vendor support, the resulting `AssertingPartyMetadata` will be of type `OpenSamlAssertingPartyDetails`.
1212
This means you'll be able to do get the underlying OpenSAML XMLObject by doing the following:
1313

1414
[tabs]
@@ -18,7 +18,7 @@ Java::
1818
[source,java,role="primary"]
1919
----
2020
OpenSamlAssertingPartyDetails details = (OpenSamlAssertingPartyDetails)
21-
registration.getAssertingPartyDetails();
21+
registration.getAssertingPartyMetadata();
2222
EntityDescriptor openSamlEntityDescriptor = details.getEntityDescriptor();
2323
----
2424
@@ -27,7 +27,7 @@ Kotlin::
2727
[source,kotlin,role="secondary"]
2828
----
2929
val details: OpenSamlAssertingPartyDetails =
30-
registration.getAssertingPartyDetails() as OpenSamlAssertingPartyDetails
30+
registration.getAssertingPartyMetadata() as OpenSamlAssertingPartyDetails
3131
val openSamlEntityDescriptor: EntityDescriptor = details.getEntityDescriptor()
3232
----
3333
======
@@ -76,8 +76,7 @@ public class RefreshableRelyingPartyRegistrationRepository
7676
}
7777
7878
private RelyingPartyRegistration applyRelyingParty(AssertingPartyMetadata metadata) {
79-
AssertingPartyDetails details = (AssertingPartyDetails) metadata;
80-
return RelyingPartyRegistration.withAssertingPartyDetails(details)
79+
return RelyingPartyRegistration.withAssertingPartyMetadata(metadata)
8180
// apply any relying party configuration
8281
.build();
8382
}
@@ -110,8 +109,8 @@ class RefreshableRelyingPartyRegistrationRepository : IterableRelyingPartyRegist
110109
}
111110
112111
private fun applyRelyingParty(metadata: AssertingPartyMetadata): RelyingPartyRegistration {
113-
val details: AssertingPartyDetails = metadata as AssertingPartyDetails
114-
return RelyingPartyRegistration.withAssertingPartyDetails(details)
112+
val details: AssertingPartyMetadata = metadata as AssertingPartyMetadata
113+
return RelyingPartyRegistration.withAssertingPartyMetadata(details)
115114
// apply any relying party configuration
116115
.build()
117116
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -400,7 +400,7 @@ public static Converter<ResponseToken, Saml2ResponseValidatorResult> createDefau
400400
result = result.concat(new Saml2Error(Saml2ErrorCodes.INVALID_DESTINATION, message));
401401
}
402402
String assertingPartyEntityId = token.getRelyingPartyRegistration()
403-
.getAssertingPartyDetails()
403+
.getAssertingPartyMetadata()
404404
.getEntityId();
405405
if (!StringUtils.hasText(issuer) || !issuer.equals(assertingPartyEntityId)) {
406406
String message = String.format("Invalid issuer [%s] for SAML response [%s]", issuer, response.getID());
@@ -775,7 +775,7 @@ private static ValidationContext createValidationContext(AssertionToken assertio
775775
RelyingPartyRegistration relyingPartyRegistration = token.getRelyingPartyRegistration();
776776
String audience = relyingPartyRegistration.getEntityId();
777777
String recipient = relyingPartyRegistration.getAssertionConsumerServiceLocation();
778-
String assertingPartyEntityId = relyingPartyRegistration.getAssertingPartyDetails().getEntityId();
778+
String assertingPartyEntityId = relyingPartyRegistration.getAssertingPartyMetadata().getEntityId();
779779
Map<String, Object> params = new HashMap<>();
780780
Assertion assertion = assertionToken.getAssertion();
781781
if (assertionContainsInResponseTo(assertion)) {

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlSigningUtils.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ static QueryParametersPartial sign(RelyingPartyRegistration registration) {
9696
private static SignatureSigningParameters resolveSigningParameters(
9797
RelyingPartyRegistration relyingPartyRegistration) {
9898
List<Credential> credentials = resolveSigningCredentials(relyingPartyRegistration);
99-
List<String> algorithms = relyingPartyRegistration.getAssertingPartyDetails().getSigningAlgorithms();
99+
List<String> algorithms = relyingPartyRegistration.getAssertingPartyMetadata().getSigningAlgorithms();
100100
List<String> digests = Collections.singletonList(SignatureConstants.ALGO_ID_DIGEST_SHA256);
101101
String canonicalization = SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS;
102102
SignatureSigningParametersResolver resolver = new SAMLMetadataSignatureSigningParametersResolver();

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlVerificationUtils.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,12 @@ static VerifierPartial verifySignature(RequestAbstractType object, RelyingPartyR
7373

7474
static SignatureTrustEngine trustEngine(RelyingPartyRegistration registration) {
7575
Set<Credential> credentials = new HashSet<>();
76-
Collection<Saml2X509Credential> keys = registration.getAssertingPartyDetails().getVerificationX509Credentials();
76+
Collection<Saml2X509Credential> keys = registration.getAssertingPartyMetadata()
77+
.getVerificationX509Credentials();
7778
for (Saml2X509Credential key : keys) {
7879
BasicX509Credential cred = new BasicX509Credential(key.getCertificate());
7980
cred.setUsageType(UsageType.SIGNING);
80-
cred.setEntityId(registration.getAssertingPartyDetails().getEntityId());
81+
cred.setEntityId(registration.getAssertingPartyMetadata().getEntityId());
8182
credentials.add(cred);
8283
}
8384
CredentialResolver credentialsResolver = new CollectionCredentialResolver(credentials);

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2PostAuthenticationRequest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public Saml2MessageBinding getBinding() {
5050
* @since 5.7
5151
*/
5252
public static Builder withRelyingPartyRegistration(RelyingPartyRegistration registration) {
53-
String location = registration.getAssertingPartyDetails().getSingleSignOnServiceLocation();
53+
String location = registration.getAssertingPartyMetadata().getSingleSignOnServiceLocation();
5454
return new Builder(registration).authenticationRequestUri(location);
5555
}
5656

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2RedirectAuthenticationRequest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ public Saml2MessageBinding getBinding() {
7373
* @since 5.7
7474
*/
7575
public static Builder withRelyingPartyRegistration(RelyingPartyRegistration registration) {
76-
String location = registration.getAssertingPartyDetails().getSingleSignOnServiceLocation();
76+
String location = registration.getAssertingPartyMetadata().getSingleSignOnServiceLocation();
7777
return new Builder(registration).authenticationRequestUri(location);
7878
}
7979

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSamlLogoutRequestValidator.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ private Consumer<Collection<Saml2Error>> validateIssuer(LogoutRequest request,
134134
return;
135135
}
136136
String issuer = request.getIssuer().getValue();
137-
if (!issuer.equals(registration.getAssertingPartyDetails().getEntityId())) {
137+
if (!issuer.equals(registration.getAssertingPartyMetadata().getEntityId())) {
138138
errors
139139
.add(new Saml2Error(Saml2ErrorCodes.INVALID_ISSUER, "Failed to match issuer to configured issuer"));
140140
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSamlLogoutResponseValidator.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ private Consumer<Collection<Saml2Error>> validateIssuer(LogoutResponse response,
132132
return;
133133
}
134134
String issuer = response.getIssuer().getValue();
135-
if (!issuer.equals(registration.getAssertingPartyDetails().getEntityId())) {
135+
if (!issuer.equals(registration.getAssertingPartyMetadata().getEntityId())) {
136136
errors
137137
.add(new Saml2Error(Saml2ErrorCodes.INVALID_ISSUER, "Failed to match issuer to configured issuer"));
138138
}

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSamlVerificationUtils.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -164,12 +164,12 @@ private CriteriaSet verificationCriteria(Issuer issuer) {
164164

165165
private SignatureTrustEngine trustEngine(RelyingPartyRegistration registration) {
166166
Set<Credential> credentials = new HashSet<>();
167-
Collection<Saml2X509Credential> keys = registration.getAssertingPartyDetails()
167+
Collection<Saml2X509Credential> keys = registration.getAssertingPartyMetadata()
168168
.getVerificationX509Credentials();
169169
for (Saml2X509Credential key : keys) {
170170
BasicX509Credential cred = new BasicX509Credential(key.getCertificate());
171171
cred.setUsageType(UsageType.SIGNING);
172-
cred.setEntityId(registration.getAssertingPartyDetails().getEntityId());
172+
cred.setEntityId(registration.getAssertingPartyMetadata().getEntityId());
173173
credentials.add(cred);
174174
}
175175
CredentialResolver credentialsResolver = new CollectionCredentialResolver(credentials);

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2LogoutRequest.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,8 @@ public static final class Builder {
190190

191191
private Builder(RelyingPartyRegistration registration) {
192192
this.registration = registration;
193-
this.location = registration.getAssertingPartyDetails().getSingleLogoutServiceLocation();
194-
this.binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
193+
this.location = registration.getAssertingPartyMetadata().getSingleLogoutServiceLocation();
194+
this.binding = registration.getAssertingPartyMetadata().getSingleLogoutServiceBinding();
195195
}
196196

197197
/**

‎saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2LogoutResponse.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,8 @@ public static final class Builder {
156156
private Function<Map<String, String>, String> encoder = DEFAULT_ENCODER;
157157

158158
private Builder(RelyingPartyRegistration registration) {
159-
this.location = registration.getAssertingPartyDetails().getSingleLogoutServiceResponseLocation();
160-
this.binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
159+
this.location = registration.getAssertingPartyMetadata().getSingleLogoutServiceResponseLocation();
160+
this.binding = registration.getAssertingPartyMetadata().getSingleLogoutServiceBinding();
161161
}
162162

163163
/**

0 commit comments

Comments
 (0)