sirius.web.security

Class SAMLHelper

java.lang.Object

sirius.web.security.SAMLHelper

public class SAMLHelper
extends Object

Provides a helper to generate SAML 2 requests and to process responses.

The Security Assertion Markup Language is an XML beast to permit identity federation accross cloud services. This implementation provides all the tools required to become an identity consumer, which can call an identity provider to authenticate a user.

Field Summary

Fields

Modifier and Type	Field and Description
static sirius.kernel.health.Log	LOG Used to log all events related to SAML.
static int	MAX_TIMESTAMP_DELTA_IN_HOURS A response as a timestamp called IssueInstant.

Constructor Summary

Constructors

Constructor and Description
SAMLHelper()

Method Summary

Modifier and Type	Method and Description
String	generateAuthenticationRequest(String issuer, String issuerIndex) Generates a base64 encoded XML request which can be POSTed to a SAML 2 identity provider.
SAMLResponse	parseSAMLResponse(WebContext ctx) Parses a SAML 2 response from the given request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOG

public static final sirius.kernel.health.Log LOG

Used to log all events related to SAML.

Some FINE loggings are provided which might support troubleshooting.

MAX_TIMESTAMP_DELTA_IN_HOURS

public static final int MAX_TIMESTAMP_DELTA_IN_HOURS

A response as a timestamp called IssueInstant. We enforce that a received response isn't older than MAX_TIMESTAMP_DELTA_IN_HOURS hours. The value should be chosen to accept clock drift and differences in dailight saving time settings.

See Also:

Constant Field Values

Constructor Detail

SAMLHelper

public SAMLHelper()

Method Detail

generateAuthenticationRequest

public String generateAuthenticationRequest(String issuer,
                                            String issuerIndex)

Generates a base64 encoded XML request which can be POSTed to a SAML 2 identity provider.

Parameters:

issuer - the name of the issuer. This tells the identity provider "who" is asking to perform an authentication.

issuerIndex - the index of the issuer. As the identity provider might manage several endpoints for a single issuer configuration, different indices can be passed in. The default value would be "0"

Returns:

a base64 encoded SAML2 request which can be posted to an identity provider

parseSAMLResponse

public SAMLResponse parseSAMLResponse(WebContext ctx)

Parses a SAML 2 response from the given request.

Note that the fingerprint must be verified in some way or another, as this method only checks if the signature is valid, not who created it.

Parameters:

ctx - the http request to read the response from

Returns:

the parsed response which has been verified