Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for unable to decrypt SAML assertion #96

Merged
merged 7 commits into from
Jan 13, 2020
Merged

Fix for unable to decrypt SAML assertion #96

Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9370fe2
Fix Unable to decrypt SAML Assertion
wijith7 Dec 6, 2019
8244960
fix comment
wijith7 Dec 12, 2019
5a89b10
fix comment
wijith7 Dec 12, 2019
c4c2f58
fix comments
wijith7 Dec 12, 2019
b381a8a
fix comment
wijith7 Dec 13, 2019
c5b6bd1
Fix comments
wijith7 Jan 3, 2020
ec37830
Update DefaultSAML2SSOManager.java
madurangasiriwardena Jan 13, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions ...so2/carbon/identity/application/authenticator/samlsso/manager/DefaultSAML2SSOManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,8 @@
import javax.crypto.SecretKey;
import javax.servlet.http.HttpServletRequest;

import static org.apache.commons.collections.CollectionUtils.*;
wijith7 marked this conversation as resolved.
Show resolved Hide resolved
import static org.apache.commons.collections.CollectionUtils.isNotEmpty;
import static org.opensaml.saml.saml2.core.StatusCode.SUCCESS;
import static org.wso2.carbon.CarbonConstants.AUDIT_LOG;

Expand Down Expand Up @@ -513,7 +515,7 @@ private void processSSOResponse(HttpServletRequest request, Response samlRespons
if (SSOUtils.isAssertionEncryptionEnabled(properties)) {
List<EncryptedAssertion> encryptedAssertions = samlResponse.getEncryptedAssertions();
EncryptedAssertion encryptedAssertion = null;
if (CollectionUtils.isNotEmpty(encryptedAssertions)) {
if (isNotEmpty(encryptedAssertions)) {
encryptedAssertion = encryptedAssertions.get(0);
try {
assertion = getDecryptedAssertion(encryptedAssertion);
Expand All @@ -523,7 +525,7 @@ private void processSSOResponse(HttpServletRequest request, Response samlRespons
}
} else {
List<Assertion> assertions = samlResponse.getAssertions();
if (CollectionUtils.isNotEmpty(assertions)) {
if (isNotEmpty(assertions)) {
assertion = assertions.get(0);
}
}
Expand Down Expand Up @@ -1004,7 +1006,7 @@ private void validateAudienceRestriction(Assertion assertion, String issuer) thr
List<AudienceRestriction> audienceRestrictions = conditions.getAudienceRestrictions();
if (audienceRestrictions != null && !audienceRestrictions.isEmpty()) {
for (AudienceRestriction audienceRestriction : audienceRestrictions) {
if (CollectionUtils.isNotEmpty(audienceRestriction.getAudiences())) {
if (isNotEmpty(audienceRestriction.getAudiences())) {
boolean audienceFound = false;
for (Audience audience : audienceRestriction.getAudiences()) {
if (issuer != null && issuer.equals(audience.getAudienceURI())) {
Expand Down Expand Up @@ -1175,7 +1177,7 @@ private Assertion getDecryptedAssertion(EncryptedAssertion encryptedAssertion) t

X509Credential credential = new X509CredentialImpl(tenantDomain, null);
KeyInfoCredentialResolver keyResolver = new StaticKeyInfoCredentialResolver(credential);
EncryptedKey key = encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().get(0);
EncryptedKey key = getEncryptedKey(encryptedAssertion);
Decrypter decrypter = new Decrypter(null, keyResolver, null);
SecretKey dkey = (SecretKey) decrypter.decryptKey(key, encryptedAssertion.getEncryptedData().
getEncryptionMethod().getAlgorithm());
Expand Down Expand Up @@ -1228,4 +1230,14 @@ protected String getIssuer(AuthenticationContext context) {
return properties.get(IdentityApplicationConstants.Authenticator.SAML2SSO.SP_ENTITY_ID);
}

private EncryptedKey getEncryptedKey(EncryptedAssertion encryptedAssertion) throws Exception {

if (isNotEmpty(encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys())) {
return encryptedAssertion.getEncryptedData().getKeyInfo().getEncryptedKeys().get(0);
wijith7 marked this conversation as resolved.
Show resolved Hide resolved
}
if (isNotEmpty(encryptedAssertion.getEncryptedKeys())) {
return encryptedAssertion.getEncryptedKeys().get(0);
}
throw new Exception("Can not get the encrypted key");
wijith7 marked this conversation as resolved.
Show resolved Hide resolved
}
}