Skip to content

Commit 550762a

Browse files
yadvryadvr
committed
SAMLUtils: fix signature, refactor generateRandomX509Certificate
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1 parent 12ad5ba commit 550762a

4 files changed

Lines changed: 23 additions & 9 deletions

File tree

‎plugins/user-authenticators/saml2/test/org/apache/cloudstack/api/command/GetServiceProviderMetaDataCmdTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public void testAuthenticate() throws NoSuchFieldException, SecurityException, I
7171

7272
String spId = "someSPID";
7373
String url = "someUrl";
74-
X509Certificate cert = SAMLUtils.generateRandomX509Certificate();
74+
X509Certificate cert = SAMLUtils.generateRandomX509Certificate(SAMLUtils.generateRandomKeyPair());
7575
Mockito.when(samlAuthManager.getServiceProviderId()).thenReturn(spId);
7676
Mockito.when(samlAuthManager.getIdpSigningKey()).thenReturn(cert);
7777
Mockito.when(samlAuthManager.getIdpSingleLogOutUrl()).thenReturn(url);

‎plugins/user-authenticators/saml2/test/org/apache/cloudstack/api/command/SAML2LoginAPIAuthenticatorCmdTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ public void testAuthenticate() throws Exception {
152152

153153
String spId = "someSPID";
154154
String url = "someUrl";
155-
X509Certificate cert = SAMLUtils.generateRandomX509Certificate();
155+
X509Certificate cert = SAMLUtils.generateRandomX509Certificate(SAMLUtils.generateRandomKeyPair());
156156
Mockito.when(samlAuthManager.getServiceProviderId()).thenReturn(spId);
157157
Mockito.when(samlAuthManager.getIdpSigningKey()).thenReturn(null);
158158
Mockito.when(samlAuthManager.getIdpSingleSignOnUrl()).thenReturn(url);

‎plugins/user-authenticators/saml2/test/org/apache/cloudstack/api/command/SAML2LogoutAPIAuthenticatorCmdTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ public void testAuthenticate() throws Exception {
7373

7474
String spId = "someSPID";
7575
String url = "someUrl";
76-
X509Certificate cert = SAMLUtils.generateRandomX509Certificate();
76+
X509Certificate cert = SAMLUtils.generateRandomX509Certificate(SAMLUtils.generateRandomKeyPair());
7777
Mockito.when(samlAuthManager.getServiceProviderId()).thenReturn(spId);
7878
Mockito.when(samlAuthManager.getIdpSigningKey()).thenReturn(cert);
7979
Mockito.when(samlAuthManager.getIdpSingleLogOutUrl()).thenReturn(url);

‎utils/src/org/apache/cloudstack/utils/auth/SAMLUtils.java‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import org.opensaml.xml.io.Unmarshaller;
5454
import org.opensaml.xml.io.UnmarshallerFactory;
5555
import org.opensaml.xml.io.UnmarshallingException;
56+
import org.opensaml.xml.signature.SignatureConstants;
5657
import org.opensaml.xml.util.Base64;
5758
import org.opensaml.xml.util.XMLHelper;
5859
import org.w3c.dom.Document;
@@ -67,15 +68,18 @@
6768
import java.io.ByteArrayOutputStream;
6869
import java.io.IOException;
6970
import java.io.StringWriter;
71+
import java.io.UnsupportedEncodingException;
7072
import java.math.BigInteger;
7173
import java.net.URLEncoder;
7274
import java.security.InvalidKeyException;
7375
import java.security.KeyPair;
7476
import java.security.KeyPairGenerator;
7577
import java.security.NoSuchAlgorithmException;
7678
import java.security.NoSuchProviderException;
79+
import java.security.PrivateKey;
7780
import java.security.SecureRandom;
7881
import java.security.Security;
82+
import java.security.Signature;
7983
import java.security.SignatureException;
8084
import java.security.cert.CertificateEncodingException;
8185
import java.security.cert.X509Certificate;
@@ -90,7 +94,7 @@ public class SAMLUtils {
9094
public static final String SAML_NS = "saml://";
9195
public static final String SAML_NAMEID = "SAML_NAMEID";
9296
public static final String SAML_SESSION = "SAML_SESSION";
93-
public static final String CERTIFICATE_NAME = "SAMLSP_X509CERTIFICATE";
97+
public static final String CERTIFICATE_NAME = "SAMLSP_CERTIFICATE";
9498

9599
public static String createSAMLId(String uid) {
96100
return SAML_NS + uid;
@@ -207,15 +211,25 @@ public static Response decodeSAMLResponse(String responseMessage)
207211
return (Response) unmarshaller.unmarshall(element);
208212
}
209213

210-
public static X509Certificate generateRandomX509Certificate() throws NoSuchAlgorithmException, NoSuchProviderException, CertificateEncodingException, SignatureException, InvalidKeyException {
211-
Date validityBeginDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
212-
Date validityEndDate = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);
214+
public static String generateSAMLRequestSignature(String urlEncodedString, PrivateKey signingKey)
215+
throws NoSuchAlgorithmException, SignatureException, InvalidKeyException, UnsupportedEncodingException {
216+
String url = urlEncodedString + "&SigAlg=" + URLEncoder.encode(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, HttpUtils.UTF_8);
217+
Signature signature = Signature.getInstance("SHA1withRSA");
218+
signature.initSign(signingKey);
219+
signature.update(url.getBytes());
220+
return URLEncoder.encode(Base64.encodeBytes(signature.sign(), Base64.DONT_BREAK_LINES), HttpUtils.UTF_8);
221+
}
213222

223+
public static KeyPair generateRandomKeyPair() throws NoSuchProviderException, NoSuchAlgorithmException {
214224
Security.addProvider(new BouncyCastleProvider());
215225
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
216-
keyPairGenerator.initialize(1024, new SecureRandom());
217-
KeyPair keyPair = keyPairGenerator.generateKeyPair();
226+
keyPairGenerator.initialize(2048, new SecureRandom());
227+
return keyPairGenerator.generateKeyPair();
228+
}
218229

230+
public static X509Certificate generateRandomX509Certificate(KeyPair keyPair) throws NoSuchAlgorithmException, NoSuchProviderException, CertificateEncodingException, SignatureException, InvalidKeyException {
231+
Date validityBeginDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
232+
Date validityEndDate = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);
219233
X500Principal dnName = new X500Principal("CN=Apache CloudStack");
220234
X509V1CertificateGenerator certGen = new X509V1CertificateGenerator();
221235
certGen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));

0 commit comments

Comments
 (0)