net.shibboleth.idp.test.flows.saml1

Class SAML1TestResponseValidator

java.lang.Object

net.shibboleth.idp.test.flows.saml1.SAML1TestResponseValidator

public class SAML1TestResponseValidator
extends Object

Validate a test SAML 1 Response.

Field Summary

Fields

Modifier and Type	Field and Description
String	authenticationMethod Expected authentication method.
String	confirmationMethod Expected confirmation method.
String	idpEntityID Expected IdP entity ID.
org.opensaml.saml.saml1.core.NameIdentifier	nameIdentifier Expected name identifier.
String	spEntityID Expected SP entity ID.
QName	statusCode Expected status code.
String	statusMessage Expected status message when an error occurs.
boolean	usedAttributeDesignators Whether attributes were limited by designators.
boolean	validateAuthenticationStatements Whether authentication statements should be validated.

Constructor Summary

Constructors

Constructor and Description
SAML1TestResponseValidator() Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
void	assertAssertion(org.opensaml.saml.saml1.core.Assertion assertion) Assert that : the assertion ID is not null nor empty the assertion issue instant is not null the assertion version is SAMLVersion.VERSION_11 the assertion issuer is the expected IdP entity ID
void	assertAssertions(List<org.opensaml.saml.saml1.core.Assertion> assertions) Assert that a single assertion is present.
void	assertAttribute(org.opensaml.saml.saml1.core.Attribute attribute, String attributeName, String attributeValue) Assert that the attribute namespace is SAMLConstants.SAML1_ATTR_NAMESPACE_URI, the attribute name is the supplied name, and the attribute value is the single supplied String value.
void	assertAttributes(List<org.opensaml.saml.saml1.core.Attribute> attributes) Assert that two attributes are present.
void	assertAttributeStatement(org.opensaml.saml.saml1.core.AttributeStatement attributeStatement) Assert that the attribute statement has a subject and attributes.
void	assertAttributeStatements(List<org.opensaml.saml.saml1.core.AttributeStatement> attributeStatements) Assert that a single attribute statement is present.
void	assertAudienceRestrictionConditions(List<org.opensaml.saml.saml1.core.AudienceRestrictionCondition> audienceRestrictionConditions) Assert that a single audience restriction condition is present.
void	assertAudiences(List<org.opensaml.saml.saml1.core.Audience> audiences) Assert that a single audience is present whose URI is the expected SP entity ID.
void	assertAuthenticationMethod(String method) Assert that the authentication method is the expected authentication method.
void	assertAuthenticationStatement(org.opensaml.saml.saml1.core.AuthenticationStatement authenticationStatement) Assert that : the authentication statement has a subject the authentication instant is not null the authentication method is not null nor empty
void	assertAuthenticationStatements(List<org.opensaml.saml.saml1.core.AuthenticationStatement> authenticationStatements) Assert that a single authentication statement is present.
void	assertConditions(org.opensaml.saml.saml1.core.Conditions conditions) Assert that the conditions has a NotBefore and NotOnOrAfter attribute, and that a single audience restriction conditions is present.
void	assertConfirmationMethod(org.opensaml.saml.saml1.core.ConfirmationMethod method) Assert the confirmation method.
void	assertConfirmationMethods(List<org.opensaml.saml.saml1.core.ConfirmationMethod> confirmationMethods) Assert that a single confirmation method is present.
void	assertNameIdentifier(org.opensaml.saml.saml1.core.NameIdentifier identifier) Assert that : the name identifier is not null the name identifier value is not null the name identifier value is the expected value if the format is not transient the name format is the expected name format/li> the name qualifier is the expected name qualifier
void	assertResponse(org.opensaml.saml.saml1.core.Response response) Assert that : the response ID is not null nor empty the response IssueInstant is not null the response version is SAMLVersion.VERSION_11
void	assertStatus(org.opensaml.saml.saml1.core.Status status) Assert that : the status is not null the status code is not null the status code is the expected status code the status message is the expected status message if the status code is not success
void	assertSubject(org.opensaml.saml.saml1.core.Subject subject) Assert that the subject has a name identifier and subject confirmation.
void	assertSubjectConfirmation(org.opensaml.saml.saml1.core.SubjectConfirmation subjectConfirmation) Assert that the subject confirmation has a single confirmation method.
void	validateAttributeStatements(org.opensaml.saml.saml1.core.Assertion assertion) Validate the assertion attribute statements.
void	validateAuthenticationStatements(org.opensaml.saml.saml1.core.Assertion assertion) Validate the assertion authentication statements.
void	validateConditions(org.opensaml.saml.saml1.core.Assertion assertion) Validate the assertion conditions.
void	validateResponse(org.opensaml.saml.saml1.core.Response response) Validate the response.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

idpEntityID

@Nonnull
public String idpEntityID

Expected IdP entity ID.

spEntityID

@Nonnull
public String spEntityID

Expected SP entity ID.

authenticationMethod

@Nonnull
public String authenticationMethod

Expected authentication method.

confirmationMethod

@Nonnull
public String confirmationMethod

Expected confirmation method.

nameIdentifier

@Nonnull
public org.opensaml.saml.saml1.core.NameIdentifier nameIdentifier

Expected name identifier.

statusCode

@Nonnull
public QName statusCode

Expected status code.

statusMessage

@Nonnull
public String statusMessage

Expected status message when an error occurs.

validateAuthenticationStatements

public boolean validateAuthenticationStatements

Whether authentication statements should be validated.

usedAttributeDesignators

public boolean usedAttributeDesignators

Whether attributes were limited by designators.

Constructor Detail

SAML1TestResponseValidator

public SAML1TestResponseValidator()

Constructor.

Method Detail

validateResponse

public void validateResponse(@Nullable
                    org.opensaml.saml.saml1.core.Response response)

Validate the response. Calls validate methods :

• validateConditions(Assertion)
• validateAuthenticationStatements(Assertion)
• validateAttributeStatements(Assertion)

Calls assert methods :

• assertResponse(Response)
• assertStatus(Status)
• assertAssertions(List)
• assertAssertion(Assertion)

Parameters:

response - the SAML response

validateConditions

public void validateConditions(@Nullable
                      org.opensaml.saml.saml1.core.Assertion assertion)

Validate the assertion conditions.

Calls assert methods :

• assertConditions(Conditions)
• assertAudienceRestrictionConditions(List)
• assertAudiences(List)

Parameters:

assertion - the assertion

validateAuthenticationStatements

public void validateAuthenticationStatements(@Nullable
                                    org.opensaml.saml.saml1.core.Assertion assertion)

Validate the assertion authentication statements.

Calls assert methods :

• assertAuthenticationStatement(AuthenticationStatement)
• assertAttributeStatement(AttributeStatement)
• assertSubject(Subject)
• assertAuthenticationMethod(String)

Parameters:

assertion - the assertion

validateAttributeStatements

public void validateAttributeStatements(@Nullable
                               org.opensaml.saml.saml1.core.Assertion assertion)

Validate the assertion attribute statements.

Calls assert methods :

• assertAuthenticationStatements(List)
• assertAttributeStatement(AttributeStatement)
• assertSubject(Subject)
• assertNameIdentifier(NameIdentifier)
• assertSubjectConfirmation(SubjectConfirmation)
• assertConfirmationMethods(List)
• assertAttributes(List)

Parameters:

assertion - the assertion

assertResponse

public void assertResponse(@Nullable
                  org.opensaml.saml.saml1.core.Response response)

Assert that :

• the response ID is not null nor empty
• the response IssueInstant is not null
• the response version is SAMLVersion.VERSION_11

Parameters:

response - the SAML 1 response

assertStatus

public void assertStatus(@Nullable
                org.opensaml.saml.saml1.core.Status status)

Assert that :

• the status is not null
• the status code is not null
• the status code is the expected status code
• the status message is the expected status message if the status code is not success

Parameters:

status - the status

assertAssertions

public void assertAssertions(@Nullable
                    List<org.opensaml.saml.saml1.core.Assertion> assertions)

Assert that a single assertion is present.

Parameters:

assertions - the assertions

assertAssertion

public void assertAssertion(@Nullable
                   org.opensaml.saml.saml1.core.Assertion assertion)

Assert that :

• the assertion ID is not null nor empty
• the assertion issue instant is not null
• the assertion version is SAMLVersion.VERSION_11
• the assertion issuer is the expected IdP entity ID

Parameters:

assertion - the assertion

assertAuthenticationStatements

public void assertAuthenticationStatements(@Nullable
                                  List<org.opensaml.saml.saml1.core.AuthenticationStatement> authenticationStatements)

Assert that a single authentication statement is present.

Parameters:

authenticationStatements - the authentication statements

assertAuthenticationStatement

public void assertAuthenticationStatement(@Nullable
                                 org.opensaml.saml.saml1.core.AuthenticationStatement authenticationStatement)

Assert that :

• the authentication statement has a subject
• the authentication instant is not null
• the authentication method is not null nor empty

Parameters:

authenticationStatement - the authentication statement

assertAuthenticationMethod

public void assertAuthenticationMethod(@Nullable
                              String method)

Assert that the authentication method is the expected authentication method.

Parameters:

method - the authentication method

assertAudienceRestrictionConditions

public void assertAudienceRestrictionConditions(@Nullable
                                       List<org.opensaml.saml.saml1.core.AudienceRestrictionCondition> audienceRestrictionConditions)

Assert that a single audience restriction condition is present.

Parameters:

audienceRestrictionConditions - the audience restriction conditions

assertAudiences

public void assertAudiences(@Nullable
                   List<org.opensaml.saml.saml1.core.Audience> audiences)

Assert that a single audience is present whose URI is the expected SP entity ID.

Parameters:

audiences - the audiences

assertConditions

public void assertConditions(@Nullable
                    org.opensaml.saml.saml1.core.Conditions conditions)

Assert that the conditions has a NotBefore and NotOnOrAfter attribute, and that a single audience restriction conditions is present.

Parameters:

conditions - the conditions

assertAttributeStatements

public void assertAttributeStatements(@Nullable
                             List<org.opensaml.saml.saml1.core.AttributeStatement> attributeStatements)

Assert that a single attribute statement is present.

Parameters:

attributeStatements - the attribute statements

assertAttributeStatement

public void assertAttributeStatement(@Nullable
                            org.opensaml.saml.saml1.core.AttributeStatement attributeStatement)

Assert that the attribute statement has a subject and attributes.

Parameters:

attributeStatement - the attribute statement

assertSubject

public void assertSubject(@Nullable
                 org.opensaml.saml.saml1.core.Subject subject)

Assert that the subject has a name identifier and subject confirmation.

Parameters:

subject - the subject

assertNameIdentifier

public void assertNameIdentifier(@Nullable
                        org.opensaml.saml.saml1.core.NameIdentifier identifier)

Assert that :

• the name identifier is not null
• the name identifier value is not null
• the name identifier value is the expected value if the format is not transient
• the name format is the expected name format/li>
• the name qualifier is the expected name qualifier

Parameters:

identifier - the name identifier

assertSubjectConfirmation

public void assertSubjectConfirmation(@Nullable
                             org.opensaml.saml.saml1.core.SubjectConfirmation subjectConfirmation)

Assert that the subject confirmation has a single confirmation method.

Parameters:

subjectConfirmation - the subject confirmation

assertConfirmationMethods

public void assertConfirmationMethods(@Nullable
                             List<org.opensaml.saml.saml1.core.ConfirmationMethod> confirmationMethods)

Assert that a single confirmation method is present. Calls assertConfirmationMethod(ConfirmationMethod).

Parameters:

confirmationMethods - the confirmation methods

assertConfirmationMethod

public void assertConfirmationMethod(@Nullable
                            org.opensaml.saml.saml1.core.ConfirmationMethod method)

Assert the confirmation method.

Parameters:

method - the confirmation method

assertAttributes

public void assertAttributes(@Nullable
                    List<org.opensaml.saml.saml1.core.Attribute> attributes)

Assert that two attributes are present.

The first attribute is

• name : urn:mace:dir:attribute-def:eduPersonAffiliation
• namespace : SAMLConstants.SAML1_ATTR_NAMESPACE_URI
• value : member

The second attribute is

• name : urn:oid:0.9.2342.19200300.100.1.3
• namespace : SAMLConstants.SAML1_ATTR_NAMESPACE_URI
• value : jdoe@shibboleth.net

Calls assert methods :

• assertAttribute(Attribute, String, String)

Parameters:

attributes - the attributes

assertAttribute

public void assertAttribute(@Nullable
                   org.opensaml.saml.saml1.core.Attribute attribute,
                   @Nonnull
                   String attributeName,
                   @Nonnull
                   String attributeValue)

Assert that the attribute namespace is SAMLConstants.SAML1_ATTR_NAMESPACE_URI, the attribute name is the supplied name, and the attribute value is the single supplied String value.

Parameters:

attribute - the attribute

attributeName - the attribute name

attributeValue - the attribute value