Java AuthnStatement.getSessionNotOnOrAfter方法代码示例

import org.opensaml.saml2.core.AuthnStatement; //导入方法依赖的package包/类
/** {@inheritDoc} */
protected void marshallAttributes(XMLObject samlObject, Element domElement) throws MarshallingException {
    AuthnStatement authnStatement = (AuthnStatement) samlObject;

    if (authnStatement.getAuthnInstant() != null) {
        String authnInstantStr = Configuration.getSAMLDateFormatter().print(authnStatement.getAuthnInstant());
        domElement.setAttributeNS(null, AuthnStatement.AUTHN_INSTANT_ATTRIB_NAME, authnInstantStr);
    }

    if (authnStatement.getSessionIndex() != null) {
        domElement.setAttributeNS(null, AuthnStatement.SESSION_INDEX_ATTRIB_NAME, authnStatement.getSessionIndex());
    }

    if (authnStatement.getSessionNotOnOrAfter() != null) {
        String sessionNotOnOrAfterStr = Configuration.getSAMLDateFormatter().print(
                authnStatement.getSessionNotOnOrAfter());
        domElement.setAttributeNS(null, AuthnStatement.SESSION_NOT_ON_OR_AFTER_ATTRIB_NAME, sessionNotOnOrAfterStr);
    }
}
 

import org.opensaml.saml2.core.AuthnStatement; //导入方法依赖的package包/类
/**
 * Check whether an assertion contains an expired sessionIndex within a
 * AuthnStatement (i.e. [email protected] >= now)
 * 
 * @return <code>true</code>, if the assertion has expired. <code>false</code>
 *         otherwise.
 */
public boolean hasSessionExpired() {
	boolean retVal = false;
   	if (assertion != null && assertion.getAuthnStatements() != null) {
		if (assertion.getAuthnStatements().size() > 0) {
			// We only look into the first AuthnStatement
			AuthnStatement authnStatement = (AuthnStatement) assertion.getAuthnStatements().get(0);
			if (authnStatement.getSessionNotOnOrAfter() != null) {
				retVal = authnStatement.getSessionNotOnOrAfter().isBeforeNow();
			} else {
				retVal = false;
			}
		}
	}
	return retVal;
}
 

import org.opensaml.saml2.core.AuthnStatement; //导入方法依赖的package包/类
/** {@inheritDoc} */
public void testSingleElementOptionalAttributesUnmarshall() {
    AuthnStatement authnStatement = (AuthnStatement) unmarshallElement(singleElementOptionalAttributesFile);

    DateTime authnInstant = authnStatement.getAuthnInstant();
    assertEquals("AuthnInstant was " + authnInstant + ", expected " + expectedAuthnInstant, expectedAuthnInstant,
            authnInstant);

    String sessionIndex = authnStatement.getSessionIndex();
    assertEquals("SessionIndex was " + sessionIndex + ", expected " + expectedSessionIndex, expectedSessionIndex,
            sessionIndex);

    DateTime sessionNotOnOrAfter = authnStatement.getSessionNotOnOrAfter();
    assertEquals("SessionNotOnOrAfter was " + sessionNotOnOrAfter + ", expected " + expectedSessionNotOnOrAfter,
            expectedSessionNotOnOrAfter, sessionNotOnOrAfter);
}
 

import org.opensaml.saml2.core.AuthnStatement; //导入方法依赖的package包/类
public void validate(OIOAssertion assertion, String spEntityId, String spAssertionConsumerURL) throws ValidationException {
	super.validate(assertion, spEntityId, spAssertionConsumerURL);
	
	Assertion a = assertion.getAssertion();
	
	DateTime confirmationTime = assertion.getConfirmationTime();
	if (confirmationTime == null || !confirmationTime.isAfterNow()) {
		throw new ValidationException("Subject Confirmation Data is expired: " + confirmationTime + " before " + new DateTime());
	}

   	// There must be only be one AuthnStatement within the assertion
   	if (a.getAuthnStatements().size() != 1) {  
   		throw new ValidationException("The assertion must contain exactly one AuthnStatement. Was " + a.getAuthnStatements().size());
   	}
   	// AssuranceLevel and AuthnStatement/AuthnContext/AuthnContextClassRef must be consistent
   	int assuranceLevel = assertion.getAssuranceLevel();
   	String authnContextClassRefValue = null;
   	AuthnStatement authnStatement = (AuthnStatement) a.getAuthnStatements().get(0);
   	AuthnContext authnContext = authnStatement.getAuthnContext();
   	if (authnContext != null) {
   		AuthnContextClassRef authnContextClassRef = authnContext.getAuthnContextClassRef();
   		if (authnContextClassRef != null) {
   			authnContextClassRefValue = authnContextClassRef.getAuthnContextClassRef();
   		}
   	}
   	if (assuranceLevel == AssuranceLevel.PASSWORD_ASSURANCE_LEVEL && 
   		!OIOSAMLConstants.PASSWORD_AUTHN_CONTEXT_CLASS_REF.equals(authnContextClassRefValue)) {
   		log.warn("The assuranceLevel attribute " + assuranceLevel + "  in the assertion does not correspond with the value of AuthnStatement/AuthnContext/AuthnContextClassRef: " + authnContextClassRefValue);
   	} else if (assuranceLevel == AssuranceLevel.CERTIFICATE_ASSURANCE_LEVEL && 
   		!OIOSAMLConstants.X509_AUTHN_CONTEXT_CLASS_REF.equals(authnContextClassRefValue)) {
   		log.warn("The assuranceLevel attribute " + assuranceLevel + "  in the assertion does not correspond with the value of AuthnStatement/AuthnContext/AuthnContextClassRef: " + authnContextClassRefValue);
      	}
   	
   	// There must be a SessionIndex
   	if (assertion.getSessionIndex() == null) {  
   		throw new ValidationException("The assertion must contain a [email protected]");
   	}
   	// There must be exactly one AttributeStatement within the assertion
   	if (a.getAttributeStatements().size() != 1) {  
   		throw new ValidationException("The assertion must contain exactly one AttributeStatement. Contains " + a.getAttributeStatements().size());
   	}
   	// There must not be a AttributeStatement within the assertion
   	if (a.getAuthzDecisionStatements().size() != 0) {  
   		throw new ValidationException("The assertion must not contain a AuthzDecisionStatement. Contains " + a.getAuthzDecisionStatements().size());
   	}

   	// There must be a valid recipient
   	if (!assertion.checkRecipient(spAssertionConsumerURL)) {
   		throw new ValidationException("The assertion must contain the recipient "+ spAssertionConsumerURL);
   	}
   	
   	// Session must not have expired
   	if (authnStatement.getSessionNotOnOrAfter() != null &&
   		!authnStatement.getSessionNotOnOrAfter().isAfterNow()) {  
   		throw new ValidationException("The assertion must have a [email protected] and it must not have expired. SessionNotOnOrAfter: " + authnStatement.getSessionNotOnOrAfter());
   	}
}