From 283581f920f33676a84362804d8aba8fab892b8d Mon Sep 17 00:00:00 2001 From: Josh Cain Date: Fri, 22 Jul 2016 14:49:48 -0500 Subject: [PATCH 1/2] SamlProtocol should only drop attributes into a single attributeStatement element --- .../keycloak/protocol/saml/SamlProtocol.java | 42 +++++++------------ 1 file changed, 16 insertions(+), 26 deletions(-) diff --git a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java index 85e316fb15..319f2de8a4 100755 --- a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java +++ b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java @@ -21,13 +21,7 @@ import java.io.IOException; import java.io.InputStream; import java.net.URI; import java.security.PublicKey; -import java.util.ArrayList; -import java.util.HashMap; -import java.util.LinkedList; -import java.util.List; -import java.util.Map; -import java.util.Set; -import java.util.UUID; +import java.util.*; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.Response; @@ -375,8 +369,15 @@ public class SamlProtocol implements LoginProtocol { Document samlDocument = null; try { ResponseType samlModel = builder.buildModel(); - transformAttributeStatement(attributeStatementMappers, samlModel, session, userSession, clientSession); - populateRoles(roleListMapper, samlModel, session, userSession, clientSession); + final AttributeStatementType attributeStatement = populateAttributeStatements(attributeStatementMappers, session, userSession, clientSession); + populateRoles(roleListMapper, session, userSession, clientSession, attributeStatement); + + // SAML Spec 2.7.3 AttributeStatement must contain one or more Attribute or EncryptedAttribute + if (attributeStatement.getAttributes().size() > 0) { + AssertionType assertion = samlModel.getAssertions().get(0).getAssertion(); + assertion.addStatement(attributeStatement); + } + samlModel = transformLoginResponse(loginResponseMappers, samlModel, session, userSession, clientSession); samlDocument = builder.buildDocument(samlModel); } catch (Exception e) { @@ -437,19 +438,14 @@ public class SamlProtocol implements LoginProtocol { } } - public void transformAttributeStatement(List> attributeStatementMappers, ResponseType response, KeycloakSession session, UserSessionModel userSession, - ClientSessionModel clientSession) { - AssertionType assertion = response.getAssertions().get(0).getAssertion(); + public AttributeStatementType populateAttributeStatements(List> attributeStatementMappers, KeycloakSession session, UserSessionModel userSession, + ClientSessionModel clientSession) { AttributeStatementType attributeStatement = new AttributeStatementType(); - for (ProtocolMapperProcessor processor : attributeStatementMappers) { processor.mapper.transformAttributeStatement(attributeStatement, processor.model, session, userSession, clientSession); } - // SAML Spec 2.7.3 AttributeStatement must contain one or more Attribute or EncryptedAttribute - if (attributeStatement.getAttributes().size() > 0) { - assertion.addStatement(attributeStatement); - } + return attributeStatement; } public ResponseType transformLoginResponse(List> mappers, ResponseType response, KeycloakSession session, UserSessionModel userSession, ClientSessionModel clientSession) { @@ -459,17 +455,11 @@ public class SamlProtocol implements LoginProtocol { return response; } - public void populateRoles(ProtocolMapperProcessor roleListMapper, ResponseType response, KeycloakSession session, UserSessionModel userSession, ClientSessionModel clientSession) { + public void populateRoles(ProtocolMapperProcessor roleListMapper, KeycloakSession session, UserSessionModel userSession, ClientSessionModel clientSession, + final AttributeStatementType existingAttributeStatement) { if (roleListMapper == null) return; - AssertionType assertion = response.getAssertions().get(0).getAssertion(); - AttributeStatementType attributeStatement = new AttributeStatementType(); - roleListMapper.mapper.mapRoles(attributeStatement, roleListMapper.model, session, userSession, clientSession); - - // SAML Spec 2.7.3 AttributeStatement must contain one or more Attribute or EncryptedAttribute - if (attributeStatement.getAttributes().size() > 0) { - assertion.addStatement(attributeStatement); - } + roleListMapper.mapper.mapRoles(existingAttributeStatement, roleListMapper.model, session, userSession, clientSession); } public static String getLogoutServiceUrl(UriInfo uriInfo, ClientModel client, String bindingType) { From 535a0763fceca9eb722f3e781eca2363b994b206 Mon Sep 17 00:00:00 2001 From: Josh Cain Date: Fri, 22 Jul 2016 14:57:07 -0500 Subject: [PATCH 2/2] put imports back, new IDE snuck a * in there. --- .../java/org/keycloak/protocol/saml/SamlProtocol.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java index 319f2de8a4..42fd549cb0 100755 --- a/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java +++ b/services/src/main/java/org/keycloak/protocol/saml/SamlProtocol.java @@ -21,7 +21,13 @@ import java.io.IOException; import java.io.InputStream; import java.net.URI; import java.security.PublicKey; -import java.util.*; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.LinkedList; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.UUID; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.Response;