SecurityTokenServiceImpl

package org.kuali.student.security.trust.service;

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.io.StringWriter;
import java.io.UnsupportedEncodingException;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLEncoder;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import javax.jws.WebService;
import javax.xml.bind.JAXBElement;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;

import org.jasig.cas.client.util.CommonUtils;
import org.jasig.cas.client.util.XmlUtils;
import org.kuali.student.security.exceptions.KSSecurityException;
import org.kuali.student.security.trust.dto.RequestSecurityTokenResponseCollectionType;
import org.kuali.student.security.trust.dto.RequestSecurityTokenResponseType;
import org.kuali.student.security.trust.dto.RequestSecurityTokenType;
import org.kuali.student.security.util.SamlUtils;
import org.opensaml.SAMLAssertion;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;

/**
 * This class was generated by Apache CXF 2.2.8
 * Thu Jun 03 14:08:34 EDT 2010
 * Generated source version: 2.2.8
 *
 */

@WebService(endpointInterface = "org.kuali.student.security.trust.service.SecurityTokenService", serviceName = "SecurityTokenService",
            portName = "SecurityTokenService", targetNamespace = "http://schemas.xmlsoap.org/ws/2005/02/trust/wsdl")
public class SecurityTokenServiceImpl implements SecurityTokenService {

    public static final String WST_NS_05_02 = "http://schemas.xmlsoap.org/ws/2005/02/trust";
    public static final String SAML_11_NS = "urn:oasis:names:tc:SAML:1.0:assertion";


    private String casServerUrl;
    private String samlIssuerForUser;
    private String proxyCallBackUrl;

    public RequestSecurityTokenResponseCollectionType requestSecurityToken2(RequestSecurityTokenType request) throws KSSecurityException
    {
        return null;
    }

    public RequestSecurityTokenResponseType requestSecurityToken(RequestSecurityTokenType request) throws KSSecurityException
    {
        // Parse the request
        String context = request.getContext();
        List<Object> objects = request.getAny();

        String tokenTypeUri = null;
        String requestTypeUri = null;
        String proxyTicketId = null;
        String proxyTargetService = null;

        for(Object o : objects){
            // if its being accessed as a SOAP service with JAXB.
            if(o instanceof JAXBElement){
                JAXBElement<?> e = (JAXBElement<?>)o;
                if( e.getName().getLocalPart().equalsIgnoreCase("TokenType")){
                    tokenTypeUri = (String)e.getValue();
                }
                else if(e.getName().getLocalPart().equalsIgnoreCase("RequestType")) {
                    requestTypeUri = (String)e.getValue();
                }
                else if(e.getName().getLocalPart().equalsIgnoreCase("CasProxyTicket")) {
                    proxyTicketId = (String)e.getValue();
                }
                else if(e.getName().getLocalPart().equalsIgnoreCase("CasProxyTargetService")) {
                    proxyTargetService = (String)e.getValue();
                }

            // if its being accessed with a client impl, no SOAP.
            } else if(o instanceof Element){
                Element e = (Element)o;
                if( e.getLocalName().equalsIgnoreCase("TokenType")){
                    tokenTypeUri = e.getTextContent();
                }
                else if(e.getLocalName().equalsIgnoreCase("RequestType")) {
                    requestTypeUri = e.getTextContent();
                }
                else if(e.getLocalName().equalsIgnoreCase("CasProxyTicket")) {
                    proxyTicketId = e.getTextContent();
                }
                else if(e.getLocalName().equalsIgnoreCase("CasProxyTargetService")) {
                    proxyTargetService = e.getTextContent();
                }
            }
        }


        // Create the Response
        RequestSecurityTokenResponseType rstr = new RequestSecurityTokenResponseType();

        if(requestTypeUri == null){
            throw new KSSecurityException("The element RequestType is required");
        }
        if(proxyTicketId == null || proxyTargetService == null){
            throw new KSSecurityException("The elements CasProxyTicket and CasProxyTargetService are required");
        }

        //This optional URI specifies the identifier from the original request.
       // That is, if a context URI is specified on a RST, then it MUST be echoed on the corresponding RSTRs.
        if(context != null){
            rstr.setContext(context);
        }

        if(tokenTypeUri == null){
            //default to SAML
            tokenTypeUri = SAML_11_NS;
        }

        // We are just handling request for tokens of type SAML and for new token issuing, so this is just one BAD mother IF.
        if(tokenTypeUri.equals(SAML_11_NS) && requestTypeUri.endsWith("/Issue") ){
            // create the TokenType and RequestedSecurityToken Elements
            Element tokenType = null;
            Element requestedSecurityToken = null;
            Document signedSAMLDoc = null;
            try{

                DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

                //XML Signature needs to be namespace aware -- not sure if I need this here
                dbf.setNamespaceAware(true);

                DocumentBuilder db = dbf.newDocumentBuilder();
                Document doc = db.newDocument();

                tokenType = doc.createElementNS(WST_NS_05_02, "TokenType");
                tokenType.setTextContent(tokenTypeUri);

                requestedSecurityToken = doc.createElementNS(WST_NS_05_02, "RequestedSecurityToken");

                String testProperty = System.getProperty("ks.test.securityTokenService.useCas", "true");

                if(Boolean.valueOf(testProperty)){
                    signedSAMLDoc = validateCasProxyTicket(proxyTicketId, proxyTargetService);
                } else {
                    // Create TEST SAML
                    signedSAMLDoc = getSamlPrincipal("WS Trust Service is in test mode");
                }
                Node signedSAMLAssertion = signedSAMLDoc.getDocumentElement();
                requestedSecurityToken.appendChild(doc.importNode(signedSAMLAssertion, true));

            } catch(Exception e){
                throw new KSSecurityException(e);
            }
            rstr.getAny().add(tokenType);
            rstr.getAny().add(requestedSecurityToken);
        }

        return rstr;
    }

    private Document validateCasProxyTicket(String proxyTicketId, String proxyTargetService) throws KSSecurityException{

        String url = constructUrl(proxyTicketId, proxyTargetService);
        HttpURLConnection conn = null;

        try {
            URL constructedUrl = new URL(url);
            conn = (HttpURLConnection) constructedUrl.openConnection();

            BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()));

            //JIRA FIX : KSENROLL-8731 - Replaced StringBuffer with StringBuilder
            String line;
            StringBuilder stringBuilder = new StringBuilder(255);
            String response;

            while ((line = in.readLine()) != null) {
                stringBuilder.append(line);
            }

            response = stringBuilder.toString();
            String error = XmlUtils.getTextForElement(response, "authenticationFailure");

            if (CommonUtils.isNotEmpty(error)) {
                //return error;
                throw new KSSecurityException(error);
            }

            String user = XmlUtils.getTextForElement(response, "user");
            String pgt  = XmlUtils.getTextForElement(response, "proxyGrantingTicket");
            String proxies = XmlUtils.getTextForElement(response, "proxies");

            Map<String,String> samlProperties = new HashMap<String,String>();
            samlProperties.put("user", user.trim());
            samlProperties.put("proxyGrantingTicket", pgt.trim());
            samlProperties.put("proxies", proxies.trim());
            samlProperties.put("samlIssuerForUser", samlIssuerForUser.trim());

            SamlUtils.setSamlProperties(samlProperties);
            SAMLAssertion samlAssertion = SamlUtils.createAssertion();

            Document signedSAML = SamlUtils.signAssertion(samlAssertion);
            return signedSAML;

            // transform the saml DOM into a writer, and return as a string response
            /*DOMSource domSource = new DOMSource(signedSAML);
            StringWriter writer = new StringWriter();
            StreamResult result = new StreamResult(writer);

            TransformerFactory tf = TransformerFactory.newInstance();
            Transformer transformer;

            transformer = tf.newTransformer();
            transformer.transform(domSource, result);

            writer.flush();

            return writer.toString();*/

        } catch (final Exception e) {
            throw new KSSecurityException(e);
        } finally {
            if (conn != null) {
                conn.disconnect();
            }
        }
    }

    private String constructUrl(String proxyTicketId, String proxyTargetService) throws KSSecurityException{
        try {
            return this.casServerUrl + (this.casServerUrl.endsWith("/") ? "" : "/") + "proxyValidate" + "?ticket="
            + proxyTicketId + "&service=" + URLEncoder.encode(proxyTargetService, "UTF-8")
            + "&pgtUrl=" + URLEncoder.encode(proxyCallBackUrl, "UTF-8");
        } catch (UnsupportedEncodingException e) {
            throw new KSSecurityException(e);
        }
    }

    private Document getSamlPrincipal(String principal) throws KSSecurityException{
        try {
            Map<String,String> samlProperties = new HashMap<String,String>();
            samlProperties.put("user", principal);
            samlProperties.put("proxyGrantingTicket", "");
            samlProperties.put("proxies", "");
            if(samlIssuerForUser == null){
                samlProperties.put("samlIssuerForUser", "org.kuali.student.trust.sts");
            }else{
                samlProperties.put("samlIssuerForUser", samlIssuerForUser.trim());
            }

            SamlUtils.setSamlProperties(samlProperties);
            SAMLAssertion samlAssertion = SamlUtils.createAssertion();

            Document signedSAML = SamlUtils.signAssertion(samlAssertion);

            return signedSAML;

        } catch (final Exception e) {
            throw new KSSecurityException(e);
        }

    }

    public String getCasServerUrl() {
        return casServerUrl;
    }

    public void setCasServerUrl(String casServerUrl) {
        this.casServerUrl = casServerUrl;
    }

    public String getSamlIssuerForUser() {
        return samlIssuerForUser;
    }

    public void setSamlIssuerForUser(String samlIssuerForUser) {
        this.samlIssuerForUser = samlIssuerForUser;
    }

    public String getProxyCallBackUrl() {
        return proxyCallBackUrl;
    }

    public void setProxyCallBackUrl(String proxyCallBackUrl) {
        this.proxyCallBackUrl = proxyCallBackUrl;
    }
}