Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Always require signature on either response or assertion 

Fixes gh-7490
https://github.com/spring-projects/spring-security/issues/7490
This commit is contained in:
Filip Hanik 2019-09-28 11:52:53 -07:00
parent d83aa34dde
commit 7adb4da3ef
3 changed files with 40 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlAuthenticationProvider.java
View File

@ -254,7 +254,7 @@ public final class OpenSamlAuthenticationProvider implements AuthenticationProvi
} }
try { try {
Assertion a = decrypt(token, ea); Assertion a = decrypt(token, ea);
validateAssertion(recipient, a, token, false); validateAssertion(recipient, a, token, !responseSigned);
return a; return a;
} catch (Saml2AuthenticationException e) { } catch (Saml2AuthenticationException e) {
lastValidationError = e; lastValidationError = e;

37
saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlAuthenticationProviderTests.java
View File

@ -216,12 +216,47 @@ public class OpenSamlAuthenticationProviderTests {
} }
@Test @Test
public void authenticateWhenEncryptedAssertionWithoutSignatureThenItSucceeds() throws Exception { public void authenticateWhenEncryptedAssertionWithoutSignatureThenItFails() throws Exception {
Response response = response(recipientUri, idpEntityId); Response response = response(recipientUri, idpEntityId);
Assertion assertion = defaultAssertion(); Assertion assertion = defaultAssertion();
EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials()); EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials());
response.getEncryptedAssertions().add(encryptedAssertion); response.getEncryptedAssertions().add(encryptedAssertion);
token = responseXml(response, idpEntityId); token = responseXml(response, idpEntityId);
exception.expect(
authenticationMatcher(
Saml2ErrorCodes.INVALID_SIGNATURE
)
);
provider.authenticate(token);
}
@Test
public void authenticateWhenEncryptedAssertionWithSignatureThenItSucceeds() throws Exception {
Response response = response(recipientUri, idpEntityId);
Assertion assertion = defaultAssertion();
signXmlObject(
assertion,
assertingPartyCredentials(),
recipientEntityId
);
EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials());
response.getEncryptedAssertions().add(encryptedAssertion);
token = responseXml(response, idpEntityId);
provider.authenticate(token);
}
@Test
public void authenticateWhenEncryptedAssertionWithResponseSignatureThenItSucceeds() throws Exception {
Response response = response(recipientUri, idpEntityId);
Assertion assertion = defaultAssertion();
EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials());
response.getEncryptedAssertions().add(encryptedAssertion);
signXmlObject(
response,
assertingPartyCredentials(),
recipientEntityId
);
token = responseXml(response, idpEntityId);
provider.authenticate(token); provider.authenticate(token);
} }

5
samples/boot/saml2login/src/integration-test/java/org/springframework/security/samples/Saml2LoginIntegrationTests.java
View File

@ -163,14 +163,15 @@ public class Saml2LoginIntegrationTests {
EncryptedAssertion encryptedAssertion = EncryptedAssertion encryptedAssertion =
OpenSamlActionTestingSupport.encryptAssertion(assertion, decodeCertificate(spCertificate)); OpenSamlActionTestingSupport.encryptAssertion(assertion, decodeCertificate(spCertificate));
Response response = buildResponse(encryptedAssertion); Response response = buildResponse(encryptedAssertion);
signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING)); signXmlObject(response, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
sendResponse(response, "/") sendResponse(response, "/")
.andExpect(authenticated().withUsername(USERNAME)); .andExpect(authenticated().withUsername(USERNAME));
} }
@Test @Test
public void authenticateWhenResponseIsNotSignedAndAssertionIsEncryptedThenItSucceeds() throws Exception { public void authenticateWhenResponseIsNotSignedAndAssertionIsEncryptedAndSignedThenItSucceeds() throws Exception {
Assertion assertion = buildAssertion(USERNAME); Assertion assertion = buildAssertion(USERNAME);
signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
EncryptedAssertion encryptedAssertion = EncryptedAssertion encryptedAssertion =
OpenSamlActionTestingSupport.encryptAssertion(assertion, decodeCertificate(spCertificate)); OpenSamlActionTestingSupport.encryptAssertion(assertion, decodeCertificate(spCertificate));
Response response = buildResponse(encryptedAssertion); Response response = buildResponse(encryptedAssertion);