java.lang.Object

se.swedenconnect.opensaml.common.validation.AbstractObjectValidator<org.opensaml.saml.saml2.core.Assertion>

se.swedenconnect.opensaml.common.validation.AbstractSignableObjectValidator<org.opensaml.saml.saml2.core.Assertion>

se.swedenconnect.opensaml.saml2.assertion.validation.AssertionValidator

All Implemented Interfaces:: ObjectValidator<org.opensaml.saml.saml2.core.Assertion>

public class AssertionValidator extends AbstractSignableObjectValidator<org.opensaml.saml.saml2.core.Assertion>

A validator for Assertion objects.

Supports the following ValidationContext static parameters:

The static parameters defined for AbstractSignableObjectValidator.
CoreValidatorParameters.SP_METADATA: Required. The SP metadata.
CoreValidatorParameters.IDP_METADATA: Required. The IdP metadata.
CoreValidatorParameters.STRICT_VALIDATION: Optional. If not supplied, defaults to 'false'. Tells whether strict validation should be performed.
SAML2AssertionValidationParameters.CLOCK_SKEW: Optional. Gives the number of milliseconds that is the maximum allowed clock skew. If not given SAML20AssertionValidator.DEFAULT_CLOCK_SKEW is used.
CoreValidatorParameters.MAX_AGE_MESSAGE: Optional. Gives the maximum age (difference between issuance time and the validation time). If not given, the AbstractObjectValidator.DEFAULT_MAX_AGE_RECEIVED_MESSAGE is used.
CoreValidatorParameters.RECEIVE_INSTANT: Optional. Gives the timestamp (Instant) for when the response message was received. If not given the current time is used.
CoreValidatorParameters.AUTHN_REQUEST: Required. Will be used in a number of validations when information from the corresponding AuthnRequest is needed.
CoreValidatorParameters.AUTHN_REQUEST_ID: Required if the CoreValidatorParameters.AUTHN_REQUEST is not assigned. Is used when validating the InResponseTo attribute of the response.
CoreValidatorParameters.RECEIVE_URL: Required. A String holding the URL on which we received the response message. Is used when the Destination attribute is validated.
CoreValidatorParameters.EXPECTED_ISSUER: Optional. If set, is used when the issuer of the response is validated. If not set, the issuer from the CoreValidatorParameters.AUTHN_REQUEST is used (if available).
RESPONSE_ISSUE_INSTANT: Optional. If set, the IssueInstant of the Assertion being validated is compared with the corresponding response issue instant.

Supports the following ValidationContext dynamic parameters:

SAML2AssertionValidationParameters.CONFIRMED_SUBJECT_CONFIRMATION: Optional. Will be present after validation if subject confirmation was successfully performed.
HOK_PROFILE_ACTIVE: Is set to indicate whether the holder-of-key WebSSO profile is active.

Note: Also check the validation context parameters defined by the SubjectConfirmationValidator and ConditionValidator instances that are installed.

Author:: Martin Lindström (martin@idsec.se)

Field Summary

Fields

Modifier and Type

Field

Description

protected Map<QName,org.opensaml.saml.saml2.assertion.ConditionValidator>

conditionValidators

Registered Condition validators.

static final String

HOK_PROFILE_ACTIVE

Tells whether the AuthnRequest corresponding to this assertion was sent to the IdP's holder of key-endpoints, i.e., whether the Holder-of-key profile is in use.

static final String

RESPONSE_ISSUE_INSTANT

Carries a Instant holding the issue instant of the Response that contained the assertion being validated.

protected Map<String,org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator>

subjectConfirmationValidators

Registered SubjectConfirmation validators.

Fields inherited from class se.swedenconnect.opensaml.common.validation.AbstractSignableObjectValidator
signaturePrevalidator, trustEngine

Fields inherited from class se.swedenconnect.opensaml.common.validation.AbstractObjectValidator
DEFAULT_MAX_AGE_RECEIVED_MESSAGE
Constructor Summary

Constructors

Constructor

Description

AssertionValidator(org.opensaml.xmlsec.signature.support.SignatureTrustEngine trustEngine, org.opensaml.xmlsec.signature.support.SignaturePrevalidator signaturePrevalidator, Collection<org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator> confirmationValidators, Collection<org.opensaml.saml.saml2.assertion.ConditionValidator> conditionValidators, Collection<org.opensaml.saml.saml2.assertion.StatementValidator> statementValidators)

Constructor.
Method Summary

Modifier and Type

Method

Description

protected String

getID(org.opensaml.saml.saml2.core.Assertion signableObject)

Returns the Assertion ID.

protected String

getIssuer(org.opensaml.saml.saml2.core.Assertion signableObject)

Returns the Assertion issuer.

protected String

getObjectName()

Returns the name of the object being validated, e.g.

protected Instant

getResponseIssueInstant(org.opensaml.saml.common.assertion.ValidationContext context)

Gets the RESPONSE_ISSUE_INSTANT setting.

org.opensaml.saml.common.assertion.ValidationResult

validate(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates the assertion.

protected org.opensaml.saml.common.assertion.ValidationResult

validateConditions(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates the Conditions elements of the assertion.

protected org.opensaml.saml.common.assertion.ValidationResult

validateConditionsTimeBounds(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates the NotBefore and NotOnOrAfter Conditions constraints on the assertion.

protected org.opensaml.saml.common.assertion.ValidationResult

validateHolderOfKeyRequirement(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Performs initial validation concerning the Holder-of-key WebSSO Profile.

protected org.opensaml.saml.common.assertion.ValidationResult

validateID(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates that the Assertion object has an ID attribute.

protected org.opensaml.saml.common.assertion.ValidationResult

validateIssueInstant(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates that the Assertion object has a IssueInstant attribute and checks that its value is OK.

protected org.opensaml.saml.common.assertion.ValidationResult

validateIssuer(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Ensures that the Issuer element is present and matches the expected issuer (if set in the context under the CoreValidatorParameters.EXPECTED_ISSUER key).

protected org.opensaml.saml.common.assertion.ValidationResult

validateStatements(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates the statements of the assertion using the registered StatementValidator instance.

protected org.opensaml.saml.common.assertion.ValidationResult

validateSubject(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates the Subject element of the assertion.

protected org.opensaml.saml.common.assertion.ValidationResult

validateSubjectConfirmations(org.opensaml.saml.saml2.core.Assertion assertion, List<org.opensaml.saml.saml2.core.SubjectConfirmation> subjectConfirmations, org.opensaml.saml.common.assertion.ValidationContext context)

Validates the subject confirmations and for the one that is confirmed, it is saved in the validation context under the SAML2AssertionValidationParameters.CONFIRMED_SUBJECT_CONFIRMATION key.

protected org.opensaml.saml.common.assertion.ValidationResult

validateVersion(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)

Validates that the Response object has a valid Version attribute.

Methods inherited from class se.swedenconnect.opensaml.common.validation.AbstractSignableObjectValidator
getSignatureValidationCriteriaSet, performSignatureValidation, validateSignature

Methods inherited from class se.swedenconnect.opensaml.common.validation.AbstractObjectValidator
getAllowedClockSkew, getMaxAgeReceivedMessage, getReceiveInstant, isStrictValidation

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details
- RESPONSE_ISSUE_INSTANT
  
  public static final String RESPONSE_ISSUE_INSTANT
  
  Carries a Instant holding the issue instant of the Response that contained the assertion being validated.
  See Also:
  
  Constant Field Values
- HOK_PROFILE_ACTIVE
  
  public static final String HOK_PROFILE_ACTIVE
  
  Tells whether the AuthnRequest corresponding to this assertion was sent to the IdP's holder of key-endpoints, i.e., whether the Holder-of-key profile is in use. Carries a Boolean.
  See Also:
  
  Constant Field Values
- subjectConfirmationValidators
  
  protected Map<String,org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator> subjectConfirmationValidators
  
  Registered SubjectConfirmation validators.
- conditionValidators
  
  protected Map<QName,org.opensaml.saml.saml2.assertion.ConditionValidator> conditionValidators
  
  Registered Condition validators.
Constructor Details
- AssertionValidator
  
  public AssertionValidator(org.opensaml.xmlsec.signature.support.SignatureTrustEngine trustEngine, org.opensaml.xmlsec.signature.support.SignaturePrevalidator signaturePrevalidator, Collection<org.opensaml.saml.saml2.assertion.SubjectConfirmationValidator> confirmationValidators, Collection<org.opensaml.saml.saml2.assertion.ConditionValidator> conditionValidators, Collection<org.opensaml.saml.saml2.assertion.StatementValidator> statementValidators)
  
  Constructor.
  
  Parameters:
  
  trustEngine - the trust used to validate the object's signature
  
  signaturePrevalidator - the signature pre-validator used to pre-validate the object's signature
  
  confirmationValidators - validators used to validate SubjectConfirmation methods within the assertion
  
  conditionValidators - validators used to validate the Condition elements within the assertion
  
  statementValidators - validators used to validate Statements within the assertion
Method Details
- validate
  
  public org.opensaml.saml.common.assertion.ValidationResult validate(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates the assertion.
  
  Parameters:
  
  assertion - object to be evaluated
  
  context - current validation context
  
  Returns:
  
  the result of the evaluation
- validateID
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateID(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates that the Assertion object has an ID attribute.
  
  Parameters:
  
  assertion - the assertion
  
  context - the validation context
  
  Returns:
  
  a validation result
- validateVersion
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateVersion(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates that the Response object has a valid Version attribute.
  
  Parameters:
  
  assertion - the assertion
  
  context - the validation context
  
  Returns:
  
  a validation result
- validateIssueInstant
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateIssueInstant(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates that the Assertion object has a IssueInstant attribute and checks that its value is OK. If the response that contained the assertion was previously validated the static context parameter RESPONSE_ISSUE_INSTANT should be passed. If so, the method checks that the assertion issue instant is not after the response issue instant. Otherwise the method checks that the IssueInstant is not too old given the CoreValidatorParameters.MAX_AGE_MESSAGE and CoreValidatorParameters.RECEIVE_INSTANT context parameters.
  
  Parameters:
  
  assertion - the response
  
  context - the validation context
  
  Returns:
  
  a validation result
- getResponseIssueInstant
  
  protected Instant getResponseIssueInstant(org.opensaml.saml.common.assertion.ValidationContext context)
  
  Gets the RESPONSE_ISSUE_INSTANT setting.
  
  Parameters:
  
  context - the context
  
  Returns:
  
  the response issue instant, or null if it is not set
- validateIssuer
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateIssuer(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Ensures that the Issuer element is present and matches the expected issuer (if set in the context under the CoreValidatorParameters.EXPECTED_ISSUER key).
  
  Parameters:
  
  assertion - the assertion
  
  context - the validation context
  
  Returns:
  
  a validation result
- validateHolderOfKeyRequirement
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateHolderOfKeyRequirement(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Performs initial validation concerning the Holder-of-key WebSSO Profile. The method checks that if the request was sent to an IdP HoK-endpoint, we verify that the SP received the response on an endpoint dedicated for HoK.
  The method also sets the dynamic validation parameter HOK_PROFILE_ACTIVE.
  
  Parameters:
  
  assertion - the assertion
  
  context - the validation context
  
  Returns:
  
  a validation result
- validateSubject
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateSubject(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates the Subject element of the assertion. The default implementation returns ValidationResult.VALID if there is no Subject element since it is optional according to the SAML 2.0 Core specifications.
  
  Parameters:
  
  assertion - the assertion
  
  context - the validation context
  
  Returns:
  
  a validation result
- validateSubjectConfirmations
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateSubjectConfirmations(org.opensaml.saml.saml2.core.Assertion assertion, List<org.opensaml.saml.saml2.core.SubjectConfirmation> subjectConfirmations, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates the subject confirmations and for the one that is confirmed, it is saved in the validation context under the SAML2AssertionValidationParameters.CONFIRMED_SUBJECT_CONFIRMATION key.
  
  Parameters:
  
  assertion - the assertion
  
  subjectConfirmations - the subject confirmations
  
  context - the validation context
  
  Returns:
  
  a validation result
- validateConditions
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateConditions(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates the Conditions elements of the assertion.
  
  Parameters:
  
  assertion - the assertion
  
  context - the validation context
  
  Returns:
  
  the validation result
- validateConditionsTimeBounds
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateConditionsTimeBounds(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates the NotBefore and NotOnOrAfter Conditions constraints on the assertion.
  
  Parameters:
  
  assertion - the assertion whose conditions will be validated
  
  context - current validation context
  
  Returns:
  
  the result of the validation evaluation
- validateStatements
  
  protected org.opensaml.saml.common.assertion.ValidationResult validateStatements(org.opensaml.saml.saml2.core.Assertion assertion, org.opensaml.saml.common.assertion.ValidationContext context)
  
  Validates the statements of the assertion using the registered StatementValidator instance.
  
  Parameters:
  
  assertion - the assertion to validate
  
  context - the validation context
  
  Returns:
  
  validation result
- getIssuer
  
  protected String getIssuer(org.opensaml.saml.saml2.core.Assertion signableObject)
  
  Returns the Assertion issuer.
  
  Specified by:
  
  getIssuer in class AbstractSignableObjectValidator<org.opensaml.saml.saml2.core.Assertion>
  
  Parameters:
  
  signableObject - the object being verified
  
  Returns:
  
  the issuer
- getID
  
  protected String getID(org.opensaml.saml.saml2.core.Assertion signableObject)
  
  Returns the Assertion ID.
  
  Specified by:
  
  getID in class AbstractSignableObjectValidator<org.opensaml.saml.saml2.core.Assertion>
  
  Parameters:
  
  signableObject - the object being verified
  
  Returns:
  
  the ID
- getObjectName
  
  protected String getObjectName()
  
  Returns the name of the object being validated, e.g. "Assertion". Used for logging.
  
  Specified by:
  
  getObjectName in class AbstractSignableObjectValidator<org.opensaml.saml.saml2.core.Assertion>
  
  Returns:
  
  the object name

Class AssertionValidator

Field Summary

Fields inherited from class se.swedenconnect.opensaml.common.validation.AbstractSignableObjectValidator

Fields inherited from class se.swedenconnect.opensaml.common.validation.AbstractObjectValidator

Constructor Summary

Method Summary

Methods inherited from class se.swedenconnect.opensaml.common.validation.AbstractSignableObjectValidator

Methods inherited from class se.swedenconnect.opensaml.common.validation.AbstractObjectValidator

Methods inherited from class java.lang.Object

Field Details

RESPONSE_ISSUE_INSTANT

HOK_PROFILE_ACTIVE

subjectConfirmationValidators

conditionValidators

Constructor Details

AssertionValidator

Method Details

validate

validateID

validateVersion

validateIssueInstant

getResponseIssueInstant

validateIssuer

validateHolderOfKeyRequirement

validateSubject

validateSubjectConfirmations

validateConditions

validateConditionsTimeBounds

validateStatements

getIssuer

getID

getObjectName