001 //$HeadURL: https://svn.wald.intevation.org/svn/deegree/base/branches/2.3_testing/src/org/deegree/ogcwebservices/wass/saml/SAMLDocument.java $
002 /*----------------------------------------------------------------------------
003 This file is part of deegree, http://deegree.org/
004 Copyright (C) 2001-2009 by:
005 Department of Geography, University of Bonn
006 and
007 lat/lon GmbH
008
009 This library is free software; you can redistribute it and/or modify it under
010 the terms of the GNU Lesser General Public License as published by the Free
011 Software Foundation; either version 2.1 of the License, or (at your option)
012 any later version.
013 This library is distributed in the hope that it will be useful, but WITHOUT
014 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
015 FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
016 details.
017 You should have received a copy of the GNU Lesser General Public License
018 along with this library; if not, write to the Free Software Foundation, Inc.,
019 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
020
021 Contact information:
022
023 lat/lon GmbH
024 Aennchenstr. 19, 53177 Bonn
025 Germany
026 http://lat-lon.de/
027
028 Department of Geography, University of Bonn
029 Prof. Dr. Klaus Greve
030 Postfach 1147, 53001 Bonn
031 Germany
032 http://www.geographie.uni-bonn.de/deegree/
033
034 e-mail: info@deegree.org
035 ----------------------------------------------------------------------------*/
036
037 package org.deegree.ogcwebservices.wass.saml;
038
039 import java.net.URI;
040 import java.util.ArrayList;
041 import java.util.Date;
042 import java.util.List;
043
044 import javax.xml.datatype.DatatypeConfigurationException;
045 import javax.xml.datatype.DatatypeFactory;
046
047 import org.deegree.datatypes.QualifiedName;
048 import org.deegree.framework.xml.XMLFragment;
049 import org.deegree.framework.xml.XMLParsingException;
050 import org.deegree.framework.xml.XMLTools;
051 import org.w3c.dom.Element;
052 import org.w3c.dom.Node;
053
054 /**
055 * Parser class for the SAML elements.
056 *
057 * Namespace: http://urn:oasis:names:tc.SAML:1.0:assertion
058 *
059 * The classes in this package are INCOMPLETE and UNTESTED.
060 *
061 * @author <a href="mailto:bezema@lat-lon.de">Rutger Bezema</a>
062 * @author last edited by: $Author: mschneider $
063 *
064 * @version 2.0, $Revision: 18195 $, $Date: 2009-06-18 17:55:39 +0200 (Do, 18. Jun 2009) $
065 *
066 * @since 2.0
067 */
068 public class SAMLDocument extends XMLFragment {
069
070 private DatatypeFactory datatypeFactory;
071
072 private static final long serialVersionUID = -1020160309145902779L;
073
074 private static final String PRE = "saml:";
075
076 /**
077 * @throws DatatypeConfigurationException
078 */
079 public SAMLDocument() throws DatatypeConfigurationException {
080
081 datatypeFactory = DatatypeFactory.newInstance();
082
083 }
084
085 /**
086 * @param val
087 * @return the decision
088 * @throws XMLParsingException
089 */
090 private String parseDecision( String val )
091 throws XMLParsingException {
092
093 if ( val.equals( "Permit" ) || val.equals( "Deny" ) || val.equals( "Indeterminate" ) ) {
094
095 return val;
096 }
097 throw new XMLParsingException( "The value '" + val + "' is not allowed here." );
098 }
099
100 private URI parseAudience( Element root )
101 throws XMLParsingException {
102 return XMLTools.getNodeAsURI( root, PRE + "Audience", nsContext, null );
103 }
104
105 private Conditions parseConditions( Element elem )
106 throws XMLParsingException {
107 Element root = (Element) XMLTools.getNode( elem, PRE + "Conditions", nsContext );
108
109 ArrayList<Condition> conditions = new ArrayList<Condition>();
110
111 List<Node> audiences = XMLTools.getNodes( root, PRE + "AudienceRestrictionCondition", nsContext );
112 for ( Object audience : audiences ) {
113 conditions.add( new Condition( parseAudience( (Element) audience ) ) );
114 }
115
116 // seems strange that there can be an unlimited number of these conditions, but anyway...
117 List<Node> caches = XMLTools.getNodes( root, PRE + "DoNotCacheCondition", nsContext );
118 if ( caches.size() != 0 )
119 conditions.add( new Condition( true ) );
120
121 String notBeforeString = XMLTools.getAttrValue( root, null, "NotBefore", null );
122 Date notBefore = null;
123 if ( notBeforeString != null ) {
124 notBefore = datatypeFactory.newXMLGregorianCalendar( notBeforeString ).toGregorianCalendar().getTime();
125 }
126 String notOnOrAfterString = XMLTools.getAttrValue( root, null, "NotOnOrAfter", null );
127 Date notOnOrAfter = null;
128 if ( notOnOrAfterString != null ) {
129 notOnOrAfter = datatypeFactory.newXMLGregorianCalendar( notOnOrAfterString ).toGregorianCalendar().getTime();
130 }
131
132 return new Conditions( conditions, notBefore, notOnOrAfter );
133 }
134
135 private Subject parseSubject( Element elem )
136 throws XMLParsingException {
137
138 Element root = (Element) XMLTools.getNode( elem, PRE + "Subject", nsContext );
139
140 // parse name identifier, if any
141 Element nameIdentifier = (Element) XMLTools.getNode( root, PRE + "NameIdentifier", nsContext );
142 String name = null;
143 String nameQualifier = null;
144 URI format = null;
145 if ( nameIdentifier != null ) {
146 name = nameIdentifier.getNodeValue();
147 nameQualifier = XMLTools.getAttrValue( nameIdentifier, null, PRE + "NameQualifier", null );
148 format = XMLTools.getNodeAsURI( nameIdentifier, "@Format", nsContext, null );
149 }
150
151 URI[] confirmationMethods = null;
152 String subjectConfirmationData = null;
153 // ds:KeyInfo must be parsed as well TODO FIXME LOOKATME
154
155 Element subjectConfirmation = (Element) XMLTools.getNode( root, PRE + "SubjectConfirmation", nsContext );
156
157 if ( subjectConfirmation != null ) {
158 confirmationMethods = XMLTools.getNodesAsURIs( subjectConfirmation, PRE + "ConfirmationMethod", nsContext );
159 subjectConfirmationData = XMLTools.getNodeAsString( subjectConfirmation, PRE + "SubjectConfirmation",
160 nsContext, null );
161 }
162
163 if ( name == null ) {
164 if ( ( confirmationMethods == null ) || ( confirmationMethods.length == 0 ) )
165 throw new XMLParsingException( "Invalid content of the saml:Subject element." );
166
167 return new Subject( confirmationMethods, subjectConfirmationData );
168 }
169
170 return new Subject( name, nameQualifier, format, confirmationMethods, subjectConfirmationData );
171 }
172
173 private Statement parseAuthenticationStatement( Element root )
174 throws XMLParsingException {
175
176 Subject subject = parseSubject( root );
177
178 Element locality = (Element) XMLTools.getNode( root, PRE + "SubjectLocality", nsContext );
179 String ip = null;
180 String dns = null;
181 if ( locality != null ) {
182 ip = XMLTools.getNodeAsString( locality, "@IPAddress", nsContext, null );
183 dns = XMLTools.getNodeAsString( locality, "@DNSAddress", nsContext, null );
184 }
185
186 Element authorityBinding = (Element) XMLTools.getNode( root, PRE + "AuthorityBinding", nsContext );
187 QualifiedName kind = null;
188 URI location = null;
189 URI binding = null;
190 if ( authorityBinding != null ) {
191 kind = XMLTools.getRequiredNodeAsQualifiedName( authorityBinding, "@AuthorityKind", nsContext );
192 location = XMLTools.getRequiredNodeAsURI( authorityBinding, "@Location", nsContext );
193 binding = XMLTools.getRequiredNodeAsURI( authorityBinding, "@Binding", nsContext );
194 }
195
196 URI authenticationMethod = XMLTools.getRequiredNodeAsURI( root, "@AuthenticationMethod", nsContext );
197 Date authenticationInstant = datatypeFactory.newXMLGregorianCalendar(
198 XMLTools.getRequiredNodeAsString(
199 root,
200 "@AuthenticationInstant",
201 nsContext ) ).toGregorianCalendar().getTime();
202
203 Statement statement = new Statement( subject, authenticationMethod, authenticationInstant );
204 if ( ip != null )
205 statement.setIP( ip );
206 if ( dns != null )
207 statement.setDNS( dns );
208
209 if ( ( kind != null ) && ( ( location == null ) || ( binding == null ) ) )
210 throw new XMLParsingException( "An saml:AuthorityBinding element requires all of its attributes." );
211 if ( kind != null )
212 statement.setAuthorityBinding( kind, location, binding );
213
214
215 return statement;
216 }
217
218 private Statement parseAuthorizationDecisionStatement( Element root )
219 throws XMLParsingException {
220
221 Subject subject = parseSubject( root );
222
223 List<Node> actionNodes = XMLTools.getRequiredNodes( root, PRE + "Action", nsContext );
224 ArrayList<String> actions = new ArrayList<String>();
225 ArrayList<URI> actionNamespaces = new ArrayList<URI>();
226
227 for ( Object node : actionNodes ) {
228 actions.add( ( (Element) node ).getNodeValue() );
229 actionNamespaces.add( XMLTools.getNodeAsURI( (Element) node, "@Namespace", nsContext, null ) );
230 }
231
232 Element evidence = (Element) XMLTools.getNode( root, PRE + "Evidence", nsContext );
233 List<Node> assertionNodes = XMLTools.getNodes( evidence, PRE + "Assertion", nsContext );
234 ArrayList<Assertion> assertions = new ArrayList<Assertion>();
235 for ( Object node : assertionNodes ) {
236 assertions.add( parseAssertion( (Element) node ) );
237 }
238 String[] assertionIDs = XMLTools.getNodesAsStrings( evidence, PRE + "AssertionIDReference", nsContext );
239
240 URI resource = XMLTools.getRequiredNodeAsURI( root, "@Resource", nsContext );
241 String decision = parseDecision( XMLTools.getRequiredNodeAsString( root, "@Decision", nsContext ) );
242
243
244 return new Statement( subject, actions, actionNamespaces, assertions, assertionIDs, resource, decision );
245 }
246
247 private Statement parseAttributeStatement( Element root )
248 throws XMLParsingException {
249
250 Subject subject = parseSubject( root );
251
252 List<Element> attributes = XMLTools.getRequiredElements( root, PRE + "Attribute", nsContext );
253
254 ArrayList<String> attributeNames = new ArrayList<String>();
255 ArrayList<URI> attributeNamespaces = new ArrayList<URI>();
256 ArrayList<String[]> attributeValues = new ArrayList<String[]>();
257
258 for ( Element node : attributes ) {
259 attributeNames.add( XMLTools.getRequiredNodeAsString( node, "@AttributeName", nsContext ) );
260 attributeNamespaces.add( XMLTools.getRequiredNodeAsURI( node, "@AttributeNamespace", nsContext ) );
261 attributeValues.add( XMLTools.getRequiredNodesAsStrings( node, PRE + "AttributeValue", nsContext ) );
262 }
263
264
265 return new Statement( subject, attributeNames, attributeNamespaces, attributeValues );
266 }
267
268 private Assertion parseAssertion( Element root )
269 throws XMLParsingException {
270
271 Element node = (Element) XMLTools.getNode( root, PRE + "Conditions", nsContext );
272 Conditions conditions = null;
273 if ( node != null )
274 conditions = parseConditions( node );
275
276 node = (Element) XMLTools.getNode( root, PRE + "Advice", nsContext );
277
278 ArrayList<Assertion> advices = new ArrayList<Assertion>();
279 List<Node> assertionNodes = XMLTools.getNodes( node, PRE + "Assertion", nsContext );
280 for ( Object elem : assertionNodes ) {
281 advices.add( parseAssertion( (Element) elem ) );
282 }
283 String[] adviceIDs = XMLTools.getNodesAsStrings( node, PRE + "AssertionIDReference", nsContext );
284
285 // other stuff is not processed
286
287 ArrayList<Statement> statements = new ArrayList<Statement>();
288
289 List<Node> authenticationStatements = XMLTools.getNodes( root, PRE + "AuthenticationStatement", nsContext );
290 for ( Object elem : authenticationStatements ) {
291 statements.add( parseAuthenticationStatement( (Element) elem ) );
292 }
293
294 List<Node> authorizationDecisionStatements = XMLTools.getNodes( root, PRE + "AuthorizationDecisionStatement",
295 nsContext );
296 for ( Object elem : authorizationDecisionStatements ) {
297 statements.add( parseAuthorizationDecisionStatement( (Element) elem ) );
298 }
299
300 List<Node> attributeStatements = XMLTools.getNodes( root, PRE + "AttributeStatement", nsContext );
301 for ( Object elem : attributeStatements ) {
302 statements.add( parseAttributeStatement( (Element) elem ) );
303 }
304
305 if ( statements.size() == 0 )
306 throw new XMLParsingException( "You must choose at least one Statement element." );
307
308 // parse signature from ds namespace
309 int majorVersion = Integer.parseInt( XMLTools.getRequiredNodeAsString( root, "@MajorVersion", nsContext ) );
310 int minorVersion = Integer.parseInt( XMLTools.getRequiredNodeAsString( root, "@MinorVersion", nsContext ) );
311 String assertionID = XMLTools.getRequiredNodeAsString( root, "@AssertionID", nsContext );
312 String issuer = XMLTools.getRequiredNodeAsString( root, "@Issuer", nsContext );
313 String issueInstantString = XMLTools.getRequiredNodeAsString( root, "@IssueInstant", nsContext );
314 Date issueInstant = datatypeFactory.newXMLGregorianCalendar( issueInstantString ).toGregorianCalendar().getTime();
315
316
317 return new Assertion( conditions, advices, adviceIDs, statements, majorVersion, minorVersion, assertionID,
318 issuer, issueInstant );
319 }
320
321 }