se.litsec.opensaml.saml2.common.response

Class ResponseValidator

java.lang.Object

se.litsec.opensaml.common.validation.AbstractObjectValidator<T>

se.litsec.opensaml.common.validation.AbstractSignableObjectValidator<Response>

se.litsec.opensaml.saml2.common.response.ResponseValidator

All Implemented Interfaces:

ObjectValidator<Response>

public class ResponseValidator
extends AbstractSignableObjectValidator<Response>

Response validator that ensures that a Response element is valid according to the 2.0 SAML Core specification and makes checks based on the supplied validation context parameters described below.

Supports the following ValidationContext static parameters:

• The static parameters defined for AbstractSignableObjectValidator.
• CoreValidatorParameters.STRICT_VALIDATION: Optional. If not supplied, defaults to 'false'. Tells whether strict validation should be performed.
• CoreValidatorParameters.ALLOWED_CLOCK_SKEW: Optional. Gives the number of milliseconds that is the maximum allowed clock skew. If not given AbstractObjectValidator.DEFAULT_ALLOWED_CLOCK_SKEW is used.
• CoreValidatorParameters.MAX_AGE_MESSAGE: Optional. Gives the maximum age (difference between issuance time and the validation time). If not given, the AbstractObjectValidator.DEFAULT_MAX_AGE_RECEIVED_MESSAGE is used.
• CoreValidatorParameters.RECEIVE_INSTANT: Optional. Gives the timestamp (milliseconds since epoch) for when the response message was received. If not given the current time is used.
• CoreValidatorParameters.AUTHN_REQUEST: Optional. If supplied will be used in a number of validations when information from the corresponding AuthnRequest is needed. If not supplied, other, more detailed parameters must be given.
• CoreValidatorParameters.AUTHN_REQUEST_ID: Required if the CoreValidatorParameters.AUTHN_REQUEST is not assigned. Is used when validating the InResponseTo attribute of the response.
• CoreValidatorParameters.RECEIVE_URL: Required. A String holding the URL on which we received the response message. Is used when the Destination attribute is validated.
• CoreValidatorParameters.EXPECTED_ISSUER: Optional. If set, is used when the issuer of the response is validated.

Author:

Martin Lindström (martin.lindstrom@litsec.se)

Field Summary

Fields inherited from class se.litsec.opensaml.common.validation.AbstractSignableObjectValidator

signaturePrevalidator, trustEngine

Fields inherited from class se.litsec.opensaml.common.validation.AbstractObjectValidator

DEFAULT_ALLOWED_CLOCK_SKEW, DEFAULT_MAX_AGE_RECEIVED_MESSAGE

Constructor Summary

Constructors

Constructor and Description
ResponseValidator(SignatureTrustEngine trustEngine, SignaturePrevalidator signaturePrevalidator) Constructor.

Method Summary

Modifier and Type	Method and Description
protected String	getID(Response signableObject) Returns the ID of the signable object.
protected String	getIssuer(Response signableObject) Returns the issuer of the signable object.
protected String	getObjectName() Returns the name of the object being validated, e.g.
ValidationResult	validate(Response response, ValidationContext context) Validates the given object.
protected ValidationResult	validateAssertions(Response response, ValidationContext context) Validates the Assertion and/or EncryptedAssertion element.
protected ValidationResult	validateConsent(Response response, ValidationContext context) Validates the Consent attribute.
protected ValidationResult	validateDestination(Response response, ValidationContext context) Ensures that the Destination attribute is present and matches the URL on which we received the message.
protected ValidationResult	validateExtensions(Response response, ValidationContext context) Validates the Extensions element.
protected ValidationResult	validateID(Response response, ValidationContext context) Validates that the Response object has an ID attribute.
protected ValidationResult	validateInResponseTo(Response response, ValidationContext context) Ensures that the InResponseTo attribute is present and that it matches the ID of the AuthnRequest.
protected ValidationResult	validateIssueInstant(Response response, ValidationContext context) Validates that the Response object has a IssueInstant attribute and that it is not too old given the CoreValidatorParameters.MAX_AGE_MESSAGE and CoreValidatorParameters.RECEIVE_INSTANT context parameters.
protected ValidationResult	validateIssuer(Response response, ValidationContext context) Ensures that the Issuer element is present and matches the expected issuer (if set in the context under the CoreValidatorParameters.EXPECTED_ISSUER key).
protected ValidationResult	validateStatus(Response response, ValidationContext context) Validates that the Response object has a Status attribute.
protected ValidationResult	validateVersion(Response response, ValidationContext context) Validates that the Response object has a valid Version attribute.

Methods inherited from class se.litsec.opensaml.common.validation.AbstractSignableObjectValidator

getSignatureValidationCriteriaSet, performSignatureValidation, validateSignature

Methods inherited from class se.litsec.opensaml.common.validation.AbstractObjectValidator

getAllowedClockSkew, getMaxAgeReceivedMessage, getReceiveInstant, isStrictValidation

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ResponseValidator

public ResponseValidator(SignatureTrustEngine trustEngine,
                         SignaturePrevalidator signaturePrevalidator)

Constructor.

Parameters:

trustEngine - the trust used to validate the object's signature

signaturePrevalidator - the signature pre-validator used to pre-validate the object's signature

Method Detail

validate

public ValidationResult validate(Response response,
                                 ValidationContext context)

Validates the given object.

Parameters:

response - object to be evaluated

context - current validation context

Returns:

the result of the evaluation

validateID

protected ValidationResult validateID(Response response,
                                      ValidationContext context)

Validates that the Response object has an ID attribute.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateVersion

protected ValidationResult validateVersion(Response response,
                                           ValidationContext context)

Validates that the Response object has a valid Version attribute.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateStatus

protected ValidationResult validateStatus(Response response,
                                          ValidationContext context)

Validates that the Response object has a Status attribute.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateIssueInstant

protected ValidationResult validateIssueInstant(Response response,
                                                ValidationContext context)

Validates that the Response object has a IssueInstant attribute and that it is not too old given the CoreValidatorParameters.MAX_AGE_MESSAGE and CoreValidatorParameters.RECEIVE_INSTANT context parameters.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateInResponseTo

protected ValidationResult validateInResponseTo(Response response,
                                                ValidationContext context)

Ensures that the InResponseTo attribute is present and that it matches the ID of the AuthnRequest. The ID is found in the context parameter under the key CoreValidatorParameters.AUTHN_REQUEST_ID or from the object stored under CoreValidatorParameters.AUTHN_REQUEST.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateDestination

protected ValidationResult validateDestination(Response response,
                                               ValidationContext context)

Ensures that the Destination attribute is present and matches the URL on which we received the message. This value is found in the context under the CoreValidatorParameters.RECEIVE_URL key.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateConsent

protected ValidationResult validateConsent(Response response,
                                           ValidationContext context)

Validates the Consent attribute. The default implementation returns ValidationResult.VALID since the attribute is optional according to the SAML 2.0 Core specifications.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateIssuer

protected ValidationResult validateIssuer(Response response,
                                          ValidationContext context)

Ensures that the Issuer element is present and matches the expected issuer (if set in the context under the CoreValidatorParameters.EXPECTED_ISSUER key).

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateAssertions

protected ValidationResult validateAssertions(Response response,
                                              ValidationContext context)

Validates the Assertion and/or EncryptedAssertion element. The default implementation checks:

• If status is success - At least of assertion (or encrypted assertion) is present.
• Else - No assertions are present.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

validateExtensions

protected ValidationResult validateExtensions(Response response,
                                              ValidationContext context)

Validates the Extensions element. The default implementation returns ValidationResult.VALID since the element is optional according to the SAML 2.0 Core specifications.

Parameters:

response - the response

context - the validation context

Returns:

a validation result

getIssuer

protected String getIssuer(Response signableObject)

Returns the issuer of the signable object.

Specified by:

getIssuer in class AbstractSignableObjectValidator<Response>

Parameters:

signableObject - the object being verified

Returns:

the issuer

getID

protected String getID(Response signableObject)

Returns the ID of the signable object.

Specified by:

getID in class AbstractSignableObjectValidator<Response>

Parameters:

signableObject - the object being verified

Returns:

the ID

getObjectName

protected String getObjectName()

Returns the name of the object being validated, e.g. "Assertion". Uses for logging.

Specified by:

getObjectName in class AbstractSignableObjectValidator<Response>

Returns:

the object name