Java SAMLCredential类代码示例

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Test
public void testAttributes() {
    SAMLCredential samlCredential = mock(SAMLCredential.class);
    NameID nameId = mock(NameID.class);
    when(samlCredential.getNameID()).thenReturn(nameId);
    Attribute attribute = mock(Attribute.class);
    when(attribute.getName()).thenReturn("attr");
    when(samlCredential.getAttributes()).thenReturn(Collections.singletonList(attribute));
    when(samlCredential.getAttribute("attr")).thenReturn(attribute);
    when(samlCredential.getAttributeAsString("attr")).thenReturn("value");
    when(samlCredential.getAttributeAsStringArray("attr")).thenReturn(new String[]{"value"});
    when(nameId.toString()).thenReturn(NameID.UNSPECIFIED);
    SAMLUserDetails details = (SAMLUserDetails) new SimpleSAMLUserDetailsService().loadUserBySAML(samlCredential);
    assertThat(details.getPassword()).isEmpty();
    assertThat(details.isAccountNonExpired()).isTrue();
    assertThat(details.isAccountNonLocked()).isTrue();
    assertThat(details.isCredentialsNonExpired()).isTrue();
    assertThat(details.isEnabled()).isTrue();
    assertThat(details.getAuthorities()).extracting(GrantedAuthority::getAuthority).containsExactly("ROLE_USER");
    assertThat(details.getAttribute("attr")).isEqualTo("value");
    assertThat(details.getAttributeArray("attr")).containsExactly("value");
    assertThat(details.getAttributes()).containsOnlyKeys("attr").containsValue("value");
    assertThat(details.getAttributesArrays()).containsOnlyKeys("attr");
    assertThat(details.getAttributesArrays().get("attr")).containsExactly("value");
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Test
public void testAttributes() {
    SAMLCredential samlCredential = mock(SAMLCredential.class);
    NameID nameId = mock(NameID.class);
    when(samlCredential.getNameID()).thenReturn(nameId);
    Attribute attribute = mock(Attribute.class);
    when(attribute.getName()).thenReturn("attr");
    when(samlCredential.getAttributes()).thenReturn(Collections.singletonList(attribute));
    when(samlCredential.getAttribute("attr")).thenReturn(attribute);
    when(samlCredential.getAttributeAsString("attr")).thenReturn("value");
    when(samlCredential.getAttributeAsStringArray("attr")).thenReturn(new String[]{"value"});
    when(nameId.toString()).thenReturn(NameID.UNSPECIFIED);
    SAMLUserDetails details = new SAMLUserDetails(samlCredential);
    assertThat(details.getPassword()).isEmpty();
    assertThat(details.isAccountNonExpired()).isTrue();
    assertThat(details.isAccountNonLocked()).isTrue();
    assertThat(details.isCredentialsNonExpired()).isTrue();
    assertThat(details.isEnabled()).isTrue();
    assertThat(details.getAuthorities()).extracting(GrantedAuthority::getAuthority).containsExactly("ROLE_USER");
    assertThat(details.getAttribute("attr")).isEqualTo("value");
    assertThat(details.getAttributeArray("attr")).containsExactly("value");
    assertThat(details.getAttributes()).containsOnlyKeys("attr").containsValue("value");
    assertThat(details.getAttributesArrays()).containsOnlyKeys("attr");
    assertThat(details.getAttributesArrays().get("attr")).containsExactly("value");
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Bean
public SAMLUserDetailsService userDetailsService() {
    return new SAMLUserDetailsService() {
        @Override
        public Object loadUserBySAML(SAMLCredential samlCredential) throws UsernameNotFoundException {
            return new SAMLUserDetails(samlCredential) {
                @Override
                public Map<String, String> getAttributes() {
                    return samlCredential.getAttributes().stream()
                            .collect(Collectors.toMap(Attribute::getName, this::getValue));
                }

                private String getValue(Attribute attribute) {
                    return Optional.ofNullable(getAttribute(attribute.getName())).orElse("");
                }
            };
        }
    };
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
private static String getUserId( SAMLCredential credential )
{
    String userId = null;
    for ( org.opensaml.saml2.core.Attribute attr : credential.getAttributes())
    {
        String fname = attr.getFriendlyName();
        if(StringUtils.isEmpty( fname ) )
        {
            break;
        }
        else if( fname.equals( "uid" ) )
        {
            String vals[] = credential.getAttributeAsStringArray( attr.getName() );
            userId = vals[0];
            break;
        }
    }
    return userId;
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
private static String getSurName( SAMLCredential credential )
{
    String userId = null;
    for ( org.opensaml.saml2.core.Attribute attr : credential.getAttributes())
    {
        String name = attr.getName();
        if(StringUtils.isEmpty( name ) )
        {
            break;
        }
        else if( name.equals( "LastName" ) )
        {
            String vals[] = credential.getAttributeAsStringArray( attr.getName() );
            userId = vals[0];
            break;
        }
    }
    return userId;
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
private List<GrantedAuthority> getGrantedAuthorities(SAMLCredential credential) {
    String rolesClaim = credential.getAttributeAsString("http://wso2.org/claims/role");
    List<GrantedAuthority> authorities = new ArrayList<>();
    if (StringUtils.isNotBlank(rolesClaim)) {
        String[] splitRolesClaim = StringUtils.split(rolesClaim, ",");
        for (String roleClaim : splitRolesClaim) {
            RoleId roleId = RoleId.valueById(roleClaim);
            if (roleId != null) {
                authorities.add(new SimpleGrantedAuthority(roleId.getId()));
            }
        }
    }

    // fallback in case the IdP did not provide any role claims
    if (authorities.isEmpty()) {
        authorities.add(new SimpleGrantedAuthority(RoleId.USER_ROLE_ID.getId()));
    }

    return Collections.unmodifiableList(authorities);
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
public Object loadUserBySAML(SAMLCredential credential)
		throws UsernameNotFoundException {
	
	// The method is supposed to identify local account of user referenced by
	// data in the SAML assertion and return UserDetails object describing the user.
	
	String userID = credential.getNameID().getValue();
	
	LOG.info(userID + " is logged in");
	List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
	GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_USER");
	authorities.add(authority);

	// In a real scenario, this implementation has to locate user in a arbitrary
	// dataStore based on information present in the SAMLCredential and
	// returns such a date in a form of application specific UserDetails object.
	return new User(userID, "<abc123>", true, true, true, true, authorities);
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
public Object loadUserBySAML(SAMLCredential credential)
        throws UsernameNotFoundException {
    XSAnyImpl uid =
            (XSAnyImpl) credential.getAttributes().stream()
                    .filter(a -> a.getFriendlyName().equals("uid"))
                    .findFirst().
                            orElseThrow(() -> new UsernameNotFoundException("uid not found from assertion"))
                    .getAttributeValues().get(0);

    List<GrantedAuthority> authorities = new ArrayList<>();
    return new User(uid.getTextContent(), "", true, true, true, true, authorities);
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Override
public Object loadUserBySAML(SAMLCredential credential) throws UsernameNotFoundException {
	logger.info("LOADING USER BASED ON SAML AUTHENTICATION OBJECT......{}", credential.toString());
	User u = new User();
	u.setUsername(credential.getAttributeAsString("EmailAddress"));
	u.setFirstName(credential.getAttributeAsString("FirstName"));
	u.setLastName(credential.getAttributeAsString("LastName"));
	
	//TODO You can do lookup in db based on some unique identified came from SAML Response and then prepare the user object with its
	//granted authorities so that later on it can be used either by spring security or you to grant certain access to part of your app
	logger.info(u.toString());
	return u;
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Override
public Object loadUserBySAML(SAMLCredential credential)
                throws UsernameNotFoundException {

    String userID = credential.getNameID().getValue();

    LOG.info(userID + " is logged in");
    List<GrantedAuthority> authorities = new ArrayList<>();
    GrantedAuthority authority = new SimpleGrantedAuthority("ROLE_USER");
    authorities.add(authority);

    return new User(userID, "<abc123>", true, true, true, true, authorities);
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
private SAMLCredential stubSAMLCredential() {
	return new SAMLCredential(
			mock(NameID.class),
			mock(Assertion.class),
			"entity",
			"local");
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Override
public Object loadUserBySAML(SAMLCredential credential) throws UsernameNotFoundException {
    com.sungardas.enhancedsnapshots.aws.dynamodb.model.User user = userService.getUser(credential.getNameID().getValue().toLowerCase());
    if (user == null) {
        String email = credential.getNameID().getValue().toLowerCase();
        UserDto userDto = new UserDto();
        userDto.setEmail(email);
        userDto.setRole(Roles.USER.getName());
        userService.createUser(userDto, "");
        user = userService.getUser(email);
    }
    return new User(credential.getNameID().getValue(), "",
            Arrays.asList(new SimpleGrantedAuthority(ROLE_PREFIX + user.getRole().toUpperCase())));
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    if (configurationMediator.isSungardasSSO()) {
        Authentication result = super.authenticate(authentication);

        SAMLCredential credential = (SAMLCredential) result.getCredentials();
        Attribute attribute = credential.getAttribute(ALLOWED_LIST_ATTRIBUTE_NAME);
        if (attribute != null) {
            for (XMLObject object : attribute.getAttributeValues()) {
                String value = ((XSStringImpl) object).getValue();
                if (ADMIN_WILDCARD_EXP.equals(value)) {
                    LOG.warn("User ({}) has admin access, instance UUID: {}", credential.getNameID().getValue(), configurationMediator.getUUID());
                    return result;
                }
                if (configurationMediator.getUUID().equals(value)) {
                    return result;
                }
            }
        }

        LOG.error("User ({}) has not allowed to use this instance with UUID: {}", credential.getNameID().getValue(), configurationMediator.getUUID());

        userService.removeUser(result.getName());

        throw new AuthenticationServiceException("Access denied");
    } else {
        return super.authenticate(authentication);
    }
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Override
public Object loadUserBySAML( SAMLCredential credential ) throws UsernameNotFoundException {

  if ( getUserDetailsService() instanceof SAMLUserDetailsService ) {
    // inner UserDetailsService is also an implementation of SAMLUserDetailsService ? Great!
    // In that case we can also delegate any incoming loadUserBySAML() calls
    Object userDetails = ( (SAMLUserDetailsService) getUserDetailsService() ).loadUserBySAML( credential );
    if ( userDetails == null ) {
      logger.warn(
          "Got a null from calling the method loadUserBySAML( SAMLCredential credential ) of UserDetailsService: "
              + getUserDetailsService()
              + ". This is an interface violation beacuse it is specified that loadUserByUsername method should never return null. Throwing a UsernameNotFoundException." );
      throw new UsernameNotFoundException( credential.getRemoteEntityID() );
    }

    return ( (SAMLUserDetailsService) getUserDetailsService() ).loadUserBySAML( credential );
  }

  // default UserDetail build, using as reference the passed SAMLCredential

  if ( credential == null || credential.getNameID() == null || credential.getNameID().getValue() == null ) {
    throw new UsernameNotFoundException( "invalid/null SAMLCredential" );
  }

  String username = credential.getNameID().getValue();

  return loadUserByUsername( username );
}
 

import org.springframework.security.saml.SAMLCredential; //导入依赖的package包/类
@Override
public Object loadUserBySAML(SAMLCredential credential)
		throws UsernameNotFoundException {
	String usersId = credential.getAttributeAsString("USERS_ID");
	String displayName = credential.getAttributeAsString("DISPLAY_NAME");
	String loginName = credential.getAttributeAsString("LOGIN_NAME");
	String[] groupIds = credential.getAttributeAsStringArray("GROUP_IDS");
	String[] groupNames = credential.getAttributeAsStringArray("GROUPS");
	//String activeFlag = credential.getAttributeAsString("ACTIVE_FLAG");
	String primaryIpAddress =  credential.getAttributeAsString("PRIMARY_IP_ADDRESS");
	String primaryMemberGroupId =  credential.getAttributeAsString("PRIMARY_MEMBER_GROUP_ID");

       Users user = new Users();
       IpAddress ip = new IpAddress();
       ip.setIpAddress(primaryIpAddress);
       
       user.setUsersId(Integer.parseInt(usersId));
       user.setDisplayName(displayName);
       user.setLoginName(displayName);
       user.setFromDb(false);
       //user.setActiveFlag(activeFlag != null && activeFlag.equals("1") ? true : false);
       user.setPrimaryIpAddress(ip);
       user.setPrimaryMemberGroupId(Integer.parseInt(primaryMemberGroupId));
       
       Map<Integer, String> groups = new HashMap<Integer, String>();
       
       for(int i = 0; i < groupIds.length; i++){
       	groups.put(Integer.parseInt(groupIds[i]), groupNames[i]);
       }
       
       user.setMemberGroups(groups);
       
       return user;
}