From be1eea155a67bcbab0fd347a1b731effdc0774db Mon Sep 17 00:00:00 2001 From: Marcus Da Coregio Date: Thu, 30 Sep 2021 09:29:57 -0300 Subject: [PATCH] Add saml2.ValidIssuers parameter Adds the saml2.ValidIssuers parameter into SAML 2.0 Assertion Validators Closes gh-10335 --- .../OpenSaml4AuthenticationProvider.java | 12 ++++++++++-- .../OpenSaml4AuthenticationProviderTests.java | 14 ++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java b/saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java index b9e0c1070f8..cac0c2a3edd 100644 --- a/saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java +++ b/saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java @@ -672,11 +672,14 @@ private static Converter createAss private static ValidationContext createValidationContext(AssertionToken assertionToken, Consumer> paramsConsumer) { - String audience = assertionToken.token.getRelyingPartyRegistration().getEntityId(); - String recipient = assertionToken.token.getRelyingPartyRegistration().getAssertionConsumerServiceLocation(); + RelyingPartyRegistration relyingPartyRegistration = assertionToken.token.getRelyingPartyRegistration(); + String audience = relyingPartyRegistration.getEntityId(); + String recipient = relyingPartyRegistration.getAssertionConsumerServiceLocation(); + String assertingPartyEntityId = relyingPartyRegistration.getAssertingPartyDetails().getEntityId(); Map params = new HashMap<>(); params.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, Collections.singleton(audience)); params.put(SAML2AssertionValidationParameters.SC_VALID_RECIPIENTS, Collections.singleton(recipient)); + params.put(SAML2AssertionValidationParameters.VALID_ISSUERS, Collections.singleton(assertingPartyEntityId)); paramsConsumer.accept(params); return new ValidationContext(params); } @@ -754,6 +757,11 @@ protected ValidationResult validateSubjectConfirmation(Assertion assertion, Vali protected ValidationResult validateStatements(Assertion assertion, ValidationContext context) { return ValidationResult.VALID; } + + @Override + protected ValidationResult validateIssuer(Assertion assertion, ValidationContext context) { + return ValidationResult.VALID; + } }; } diff --git a/saml2/saml2-service-provider/src/opensaml4Test/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProviderTests.java b/saml2/saml2-service-provider/src/opensaml4Test/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProviderTests.java index c0131fa1d30..400d196b725 100644 --- a/saml2/saml2-service-provider/src/opensaml4Test/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProviderTests.java +++ b/saml2/saml2-service-provider/src/opensaml4Test/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProviderTests.java @@ -628,6 +628,20 @@ public void authenticateWhenCustomResponseValidatorThenUses() { verify(validator).convert(any(OpenSaml4AuthenticationProvider.ResponseToken.class)); } + @Test + public void authenticateWhenAssertionIssuerNotValidThenFailsWithInvalidIssuer() { + OpenSaml4AuthenticationProvider provider = new OpenSaml4AuthenticationProvider(); + Response response = response(); + Assertion assertion = assertion(); + assertion.setIssuer(TestOpenSamlObjects.issuer("https://invalid.idp.test/saml2/idp")); + response.getAssertions().add(assertion); + TestOpenSamlObjects.signed(response, TestSaml2X509Credentials.assertingPartySigningCredential(), + ASSERTING_PARTY_ENTITY_ID); + Saml2AuthenticationToken token = token(response, verifying(registration())); + assertThatExceptionOfType(Saml2AuthenticationException.class).isThrownBy(() -> provider.authenticate(token)) + .withMessageContaining("did not match any valid issuers"); + } + private T build(QName qName) { return (T) XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(qName).buildObject(qName); }