Skip to content
This repository has been archived by the owner on Jan 6, 2022. It is now read-only.

SAML Add Support For Encrypted Assertions #29

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

SAML Add Support For Encrypted Assertions #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a8d620
Set spKey in Saml2Settings
Aug 2, 2019
eee4561
Merge branch 'master' into decryptAssertion
Aug 2, 2019
78a093c
Update to last release
Jan 29, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 6 additions & 23 deletions src/main/java/com/amazon/dlic/auth/http/saml/HTTPSamlAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,6 @@ public class HTTPSamlAuthenticator implements HTTPAuthenticator, Destroyable {
private String idpMetadataFile;
private String spSignatureAlgorithm;
private Boolean useForceAuthn;
private PrivateKey spSignaturePrivateKey;
private Saml2SettingsProvider saml2SettingsProvider;
private MetadataResolver metadataResolver;
private AuthTokenProcessorHandler authTokenProcessorHandler;
Expand All @@ -86,7 +85,6 @@ public HTTPSamlAuthenticator(final Settings settings, final Path configPath) {
idpMetadataUrl = settings.get("idp.metadata_url");
idpMetadataFile = settings.get("idp.metadata_file");
spSignatureAlgorithm = settings.get("sp.signature_algorithm", Constants.RSA_SHA256);
spSignaturePrivateKey = getSpSignaturePrivateKey(settings, configPath);
useForceAuthn = settings.getAsBoolean("sp.forceAuthn", null);

if (rolesKey == null || rolesKey.length() == 0) {
Expand All @@ -110,7 +108,7 @@ public HTTPSamlAuthenticator(final Settings settings, final Path configPath) {

this.metadataResolver = createMetadataResolver(settings, configPath);

this.saml2SettingsProvider = new Saml2SettingsProvider(settings, this.metadataResolver);
this.saml2SettingsProvider = new Saml2SettingsProvider(settings, this.metadataResolver, configPath);

try {
this.saml2SettingsProvider.getCached();
Expand Down Expand Up @@ -199,22 +197,6 @@ private AuthnRequest buildAuthnRequest(Saml2Settings saml2Settings) {
return new AuthnRequest(saml2Settings, forceAuthn, false, true);
}

private PrivateKey getSpSignaturePrivateKey(Settings settings, Path configPath) throws Exception {
try {
PrivateKey result = PemKeyReader.loadKeyFromStream(settings.get("sp.signature_private_key_password"),
PemKeyReader.resolveStream("sp.signature_private_key", settings));

if (result == null) {
result = PemKeyReader.loadKeyFromFile(settings.get("sp.signature_private_key_password"),
PemKeyReader.resolve("sp.signature_private_key_filepath", settings, configPath, false));
}

return result;
} catch (Exception e) {
throw new Exception("Invalid value for sp.signature_private_key", e);
}
}

private URL getIdpUrl(IdpEndpointType endpointType, Saml2Settings saml2Settings) {
if (endpointType == IdpEndpointType.SSO) {
return saml2Settings.getIdpSingleSignOnServiceUrl();
Expand Down Expand Up @@ -377,24 +359,25 @@ private String getSamlRequestRedirectBindingLocation(IdpEndpointType idpEndpoint

private String getSamlRequestQueryString(String samlRequest) throws Exception {

if (this.spSignaturePrivateKey == null) {
Saml2Settings saml2Settings = this.saml2SettingsProvider.getCached();
if (saml2Settings.getSPkey() == null) {
return "SAMLRequest=" + Util.urlEncoder(samlRequest);
}

String queryString = "SAMLRequest=" + Util.urlEncoder(samlRequest) + "&SigAlg="
+ Util.urlEncoder(this.spSignatureAlgorithm);

String signature = getSamlRequestQueryStringSignature(queryString);
String signature = getSamlRequestQueryStringSignature(queryString,saml2Settings.getSPkey());

queryString += "&Signature=" + Util.urlEncoder(signature);

return queryString;
}

private String getSamlRequestQueryStringSignature(String samlRequestQueryString) throws Exception {
private String getSamlRequestQueryStringSignature(String samlRequestQueryString, PrivateKey spKey) throws Exception {
try {
return Util.base64encoder(
Util.sign(samlRequestQueryString, this.spSignaturePrivateKey, this.spSignatureAlgorithm));
Util.sign(samlRequestQueryString, spKey, this.spSignatureAlgorithm));
} catch (Exception e) {
throw new Exception("Error while signing SAML request", e);
}
Expand Down
25 changes: 24 additions & 1 deletion src/main/java/com/amazon/dlic/auth/http/saml/Saml2SettingsProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@

package com.amazon.dlic.auth.http.saml;

import java.nio.file.Path;
import java.security.PrivateKey;
import java.util.AbstractMap;
import java.util.Collection;
import java.util.HashMap;
Expand All @@ -23,6 +25,7 @@
import java.util.Set;
import java.util.stream.Collectors;

import com.amazon.opendistroforelasticsearch.security.support.PemKeyReader;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.elasticsearch.common.settings.Settings;
Expand Down Expand Up @@ -54,11 +57,13 @@ public class Saml2SettingsProvider {
private String idpEntityId;
private Saml2Settings cachedSaml2Settings;
private DateTime metadataUpdateTime;
private Path configPath;

Saml2SettingsProvider(Settings esSettings, MetadataResolver metadataResolver) {
Saml2SettingsProvider(Settings esSettings, MetadataResolver metadataResolver, Path configPath) {
this.esSettings = esSettings;
this.metadataResolver = metadataResolver;
this.idpEntityId = esSettings.get("idp.entity_id");
this.configPath = configPath;
}

Saml2Settings get() throws SamlConfigException {
Expand Down Expand Up @@ -86,6 +91,7 @@ Saml2Settings get() throws SamlConfigException {
initSpEndpoints(configProperties);

initMisc(configProperties);
initSpSignaturePrivateKey(esSettings,configProperties);

SettingsBuilder settingsBuilder = new SettingsBuilder();

Expand Down Expand Up @@ -143,6 +149,23 @@ private void initSpEndpoints(HashMap<String, Object> configProperties) {
configProperties.put(SettingsBuilder.SP_ENTITYID_PROPERTY_KEY, this.esSettings.get("sp.entity_id"));
}

private void initSpSignaturePrivateKey(Settings settings, HashMap<String, Object> configProperties) throws SamlConfigException {
try {
PrivateKey result = PemKeyReader.loadKeyFromStream(settings.get("sp.signature_private_key_password"),
PemKeyReader.resolveStream("sp.signature_private_key", settings));

if (result == null) {
result = PemKeyReader.loadKeyFromFile(settings.get("sp.signature_private_key_password"),
PemKeyReader.resolve("sp.signature_private_key_filepath", settings, configPath, false));
}

configProperties.put(SettingsBuilder.SP_PRIVATEKEY_PROPERTY_KEY,result);

} catch (Exception e) {
throw new SamlConfigException("Invalid value for sp.signature_private_key", e);
}
}

private void initIdpEndpoints(IDPSSODescriptor idpSsoDescriptor, HashMap<String, Object> configProperties)
throws SamlConfigException {
SingleSignOnService singleSignOnService = this.findSingleSignOnService(idpSsoDescriptor,
Expand Down