Package se.swedenconnect.opensaml.saml2.response.validation

Class ResponseValidator

java.lang.Object
se.swedenconnect.opensaml.common.validation.AbstractObjectValidator<Response>
se.swedenconnect.opensaml.common.validation.AbstractSignableObjectValidator<Response>
se.swedenconnect.opensaml.saml2.response.validation.ResponseValidator
All Implemented Interfaces:
ObjectValidator<Response>
public class ResponseValidator extends AbstractSignableObjectValidator<Response>
Response validator that ensures that a Response element is valid according to the 2.0 SAML Core specification and makes checks based on the supplied validation context parameters described below.

Supports the following ValidationContext static parameters:

Author:
Martin Lindström (martin.lindstrom@litsec.se)

  • Constructor Details

    • ResponseValidator

      public ResponseValidator(SignatureTrustEngine trustEngine, SignaturePrevalidator signaturePrevalidator)
      Constructor.
      Parameters:
      trustEngine - the trust used to validate the object's signature
      signaturePrevalidator - the signature pre-validator used to pre-validate the object's signature

  • Method Details

    • setUriComparator

      public void setUriComparator(URIComparator uriComparator)
      Assigns a custom URIComparator to be used when checking URL:s against eachother. The default is BasicURLComparator.
      Parameters:
      uriComparator - the customized URIComparator

    • validate

      public ValidationResult validate(Response response, ValidationContext context)
      Validates the given object.
      Parameters:
      response - object to be evaluated
      context - current validation context
      Returns:
      the result of the evaluation

    • validateID

      protected ValidationResult validateID(Response response, ValidationContext context)
      Validates that the Response object has an ID attribute.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateVersion

      protected ValidationResult validateVersion(Response response, ValidationContext context)
      Validates that the Response object has a valid Version attribute.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateStatus

      protected ValidationResult validateStatus(Response response, ValidationContext context)
      Validates that the Response object has a Status attribute.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateIssueInstant

      protected ValidationResult validateIssueInstant(Response response, ValidationContext context)
      Validates that the Response object has a IssueInstant attribute and that it is not too old given the CoreValidatorParameters.MAX_AGE_MESSAGE and CoreValidatorParameters.RECEIVE_INSTANT context parameters.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateInResponseTo

      protected ValidationResult validateInResponseTo(Response response, ValidationContext context)
      Ensures that the InResponseTo attribute is present and that it matches the ID of the AuthnRequest. The ID is found in the context parameter under the key CoreValidatorParameters.AUTHN_REQUEST_ID or from the object stored under CoreValidatorParameters.AUTHN_REQUEST.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateDestination

      protected ValidationResult validateDestination(Response response, ValidationContext context)
      Ensures that the Destination attribute is present and matches the URL on which we received the message. This value is found in the context under the CoreValidatorParameters.RECEIVE_URL key.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateConsent

      protected ValidationResult validateConsent(Response response, ValidationContext context)
      Validates the Consent attribute. The default implementation returns ValidationResult.VALID since the attribute is optional according to the SAML 2.0 Core specifications.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateIssuer

      protected ValidationResult validateIssuer(Response response, ValidationContext context)
      Ensures that the Issuer element is present and matches the expected issuer (if set in the context under the CoreValidatorParameters.EXPECTED_ISSUER key).
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateAssertions

      protected ValidationResult validateAssertions(Response response, ValidationContext context)
      Validates the Assertion and/or EncryptedAssertion element. The default implementation checks:
      • If status is success - At least of assertion (or encrypted assertion) is present.
      • Else - No assertions are present.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • validateExtensions

      protected ValidationResult validateExtensions(Response response, ValidationContext context)
      Validates the Extensions element. The default implementation returns ValidationResult.VALID since the element is optional according to the SAML 2.0 Core specifications.
      Parameters:
      response - the response
      context - the validation context
      Returns:
      a validation result

    • getIssuer

      protected String getIssuer(Response signableObject)
      Returns the issuer of the signable object.
      Specified by:
      getIssuer in class AbstractSignableObjectValidator<Response>
      Parameters:
      signableObject - the object being verified
      Returns:
      the issuer

    • getID

      protected String getID(Response signableObject)
      Returns the ID of the signable object.
      Specified by:
      getID in class AbstractSignableObjectValidator<Response>
      Parameters:
      signableObject - the object being verified
      Returns:
      the ID

    • getObjectName

      protected String getObjectName()
      Returns the name of the object being validated, e.g. "Assertion". Used for logging.
      Specified by:
      getObjectName in class AbstractSignableObjectValidator<Response>
      Returns:
      the object name