New SAML 2024.05.30 - Not to merge but just for SAML feature branch testing

build.gradle

@@ -21,6 +21,7 @@ buildscript {
         classpath(libraries.testRetryPlugin)
         classpath(libraries.gradleJcocoPlugin)
         classpath(libraries.sonarqubePlugin)
+        //classpath(libraries.shadowPlugin)
     }
 }
 
@@ -64,6 +65,24 @@ subprojects {
         exclude(group: "org.apache.directory.server", module: "apacheds-protocol-ldap")
         exclude(group: "org.skyscreamer", module: "jsonassert")
         exclude(group: "com.vaadin.external.google", module: "android-json")
+        exclude(group: "com.unboundid.components", module: "json")
+
+        // Exclude opensaml-security-api and non-FIPS bouncycastle libs, and use Shadow library for FIPS compliance
+        exclude(group: "org.bouncycastle", module: "bcpkix-jdk15on")
+        exclude(group: "org.bouncycastle", module: "bcprov-jdk15on")
+        exclude(group: "org.bouncycastle", module: "bcutil-jdk15on")
+        exclude(group: "org.bouncycastle", module: "bcprov-jdk18on")
+        exclude(group: "org.bouncycastle", module: "bcpkix-jdk18on")
+        exclude(group: "org.bouncycastle", module: "bcutil-jdk18on")
+
+        resolutionStrategy {
+            resolutionStrategy.eachDependency { DependencyResolveDetails details ->
+                if (details.requested.group == 'org.opensaml' && details.requested.name.startsWith("opensaml-")) {
+                    details.useVersion "${versions.opensaml}"
+                    details.because 'Spring Security 5.8.x allows OpenSAML 3 or 4. OpenSAML 3 has reached its end-of-life. Spring Security 6 drops support for 3, using 4.'
+                }
+            }
+        }
     }
 
     dependencies {

dependencies.gradle

@@ -6,18 +6,20 @@ ext {
 // Versions shared between multiple dependencies
 versions.aspectJVersion = "1.9.4"
 versions.apacheDsVersion = "2.0.0.AM27"
-versions.bouncyCastleVersion = "1.0.2.5"
+versions.bouncyCastleFipsVersion = "1.0.2.5"
+versions.bouncyCastlePkixFipsVersion = "1.0.7"
+versions.bouncyCastleTlsFipsVersion = "1.0.19"
 versions.hamcrestVersion = "2.2"
 versions.springBootVersion = "2.7.18"
 versions.springFrameworkVersion = "5.3.37"
 versions.springSecurityVersion = "5.8.13"
-versions.springSecuritySamlVersion = "1.0.10.RELEASE"
 versions.tomcatCargoVersion = "9.0.91"
 versions.guavaVersion = "33.2.1-jre"
 versions.seleniumVersion = "4.18.1"
 versions.braveVersion = "6.0.3"
 versions.jacksonVersion = "2.17.2"
 versions.jsonPathVersion = "2.9.0"
+versions.opensaml = "4.0.1" // Spring Security 5.8.x allows OpenSAML 3 or 4. OpenSAML 3 has reached its end-of-life. Spring Security 6 drops support for 3, using 4.
 
 // Versions we're overriding from the Spring Boot Bom (Dependabot does not issue PRs to bump these versions, so we need to manually bump them)
 ext["mariadb.version"] = "2.7.12" // Bumping to v3 breaks some pipeline jobs (and compatibility with Amazon Aurora MySQL), so pinning to v2 for now. v2 (current version) is stable and will be supported until about September 2025 (https://mariadb.com/kb/en/about-mariadb-connector-j/).
@@ -43,8 +45,9 @@ libraries.apacheDsProtocolLdap = "org.apache.directory.server:apacheds-protocol-
 libraries.apacheLdapApi = "org.apache.directory.api:api-ldap-model:2.1.6"
 libraries.aspectJRt = "org.aspectj:aspectjrt"
 libraries.aspectJWeaver = "org.aspectj:aspectjweaver"
-libraries.bouncyCastlePkix = "org.bouncycastle:bcpkix-fips:1.0.7"
-libraries.bouncyCastleProv = "org.bouncycastle:bc-fips:${versions.bouncyCastleVersion}"
+libraries.bouncyCastlePkixFips = "org.bouncycastle:bcpkix-fips:${versions.bouncyCastlePkixFipsVersion}"
+libraries.bouncyCastleFipsProv = "org.bouncycastle:bc-fips:${versions.bouncyCastleFipsVersion}"
+libraries.bouncyCastleTlsFips = "org.bouncycastle:bctls-fips:${versions.bouncyCastleTlsFipsVersion}"
 libraries.braveInstrumentationSpringWebmvc = "io.zipkin.brave:brave-instrumentation-spring-webmvc:${versions.braveVersion}"
 libraries.braveContextSlf4j = "io.zipkin.brave:brave-context-slf4j:${versions.braveVersion}"
 libraries.commonsCodec = "commons-codec:commons-codec:1.17.0"
@@ -78,6 +81,7 @@ libraries.lombok = "org.projectlombok:lombok"
 libraries.mariaJdbcDriver = "org.mariadb.jdbc:mariadb-java-client"
 libraries.mockito = "org.mockito:mockito-core"
 libraries.mockitoJunit5 = "org.mockito:mockito-junit-jupiter"
+libraries.openSamlApi = "org.opensaml:opensaml-saml-api:${versions.opensaml}"
 libraries.passay = "org.passay:passay:1.6.4"
 libraries.postgresql = "org.postgresql:postgresql:42.7.3"
 libraries.selenium = "org.seleniumhq.selenium:selenium-java:${versions.seleniumVersion}"
@@ -103,7 +107,7 @@ libraries.springRetry = "org.springframework.retry:spring-retry"
 libraries.springSecurityConfig = "org.springframework.security:spring-security-config:${versions.springSecurityVersion}"
 libraries.springSecurityCore = "org.springframework.security:spring-security-core:${versions.springSecurityVersion}"
 libraries.springSecurityLdap = "org.springframework.security:spring-security-ldap:${versions.springSecurityVersion}"
-libraries.springSecuritySaml = "org.springframework.security.extensions:spring-security-saml2-core:${versions.springSecuritySamlVersion}"
+libraries.springSecuritySamlServiceProvider = "org.springframework.security:spring-security-saml2-service-provider:${versions.springSecurityVersion}"
 libraries.springSecurityTaglibs = "org.springframework.security:spring-security-taglibs:${versions.springSecurityVersion}"
 libraries.springSecurityTest = "org.springframework.security:spring-security-test:${versions.springSecurityVersion}"
 libraries.springSecurityWeb = "org.springframework.security:spring-security-web:${versions.springSecurityVersion}"
@@ -127,6 +131,7 @@ libraries.velocity = "org.apache.velocity:velocity-engine-core:2.3"
 libraries.xerces = "xerces:xercesImpl:2.12.2"
 libraries.nimbusJwt = "com.nimbusds:nimbus-jose-jwt:9.40"
 libraries.xmlSecurity = "org.apache.santuario:xmlsec:4.0.2"
+libraries.xmlUnit = "org.xmlunit:xmlunit-assertj:2.10.0"
 libraries.orgJson = "org.json:json:20240303"
 libraries.owaspEsapi = "org.owasp.esapi:esapi:2.5.4.0"
 libraries.jodaTime = "joda-time:joda-time:2.12.7"
@@ -139,3 +144,4 @@ libraries.springBootGradlePlugin = "org.springframework.boot:spring-boot-gradle-
 libraries.springDependencyMangementGradlePlugin = "io.spring.gradle:dependency-management-plugin"
 libraries.gradleJcocoPlugin = "org.barfuin.gradle.jacocolog:gradle-jacoco-log:3.1.0"
 libraries.sonarqubePlugin = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:5.1.0.4882"
+//libraries.shadowPlugin = "com.github.johnrengelman:shadow:8.1.1"

lombok.config

@@ -0,0 +1 @@
+lombok.addLombokGeneratedAnnotation = true

model/src/main/java/org/cloudfoundry/identity/uaa/provider/IdentityProvider.java

@@ -23,7 +23,7 @@
 import com.fasterxml.jackson.databind.SerializerProvider;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
 import com.fasterxml.jackson.databind.annotation.JsonSerialize;
-
+import lombok.Getter;
 import org.cloudfoundry.identity.uaa.EntityWithAlias;
 import org.cloudfoundry.identity.uaa.util.JsonUtils;
 import org.springframework.util.StringUtils;
@@ -44,6 +44,7 @@
 import static org.cloudfoundry.identity.uaa.util.JsonUtils.getNodeAsInt;
 import static org.cloudfoundry.identity.uaa.util.JsonUtils.getNodeAsString;
 
+@Getter
 @JsonSerialize(using = IdentityProvider.IdentityProviderSerializer.class)
 @JsonDeserialize(using = IdentityProvider.IdentityProviderDeserializer.class)
 public class IdentityProvider<T extends AbstractIdentityProviderDefinition> implements EntityWithAlias {
@@ -78,99 +79,77 @@ public class IdentityProvider<T extends AbstractIdentityProviderDefinition> impl
     private String identityZoneId;
     private String aliasId;
     private String aliasZid;
-    public Date getCreated() {
-        return created;
-    }
+    @JsonIgnore
+    private boolean serializeConfigRaw;
 
-    public IdentityProvider setCreated(Date created) {
+    public IdentityProvider<T> setCreated(Date created) {
         this.created = created;
         return this;
     }
 
-    public Date getLastModified() {
-        return lastModified;
-    }
-
-    public IdentityProvider setLastModified(Date lastModified) {
+    public IdentityProvider<T> setLastModified(Date lastModified) {
         this.lastModified = lastModified;
         return this;
     }
 
-    public IdentityProvider setVersion(int version) {
+    public IdentityProvider<T> setVersion(int version) {
         this.version = version;
         return this;
     }
 
-    public int getVersion() {
-        return version;
-    }
-
-    public String getName() {
-        return name;
-    }
-
-    public IdentityProvider setName(String name) {
+    public IdentityProvider<T> setName(String name) {
         this.name = name;
         return this;
     }
 
-    @Override
-    public String getId() {
-        return id;
+    public IdentityProvider<T> setId(String id) {
+        this.id = id;
+        return this;
     }
 
     @Override
     public String getZoneId() {
         return getIdentityZoneId();
     }
 
-    public IdentityProvider setId(String id) {
-        this.id = id;
-        return this;
-    }
-
-    public T getConfig() {
-        return config;
-    }
-
-    public IdentityProvider setConfig(T config) {
-        if (config == null) {
-            this.type = UNKNOWN;
-        } else {
-            Class clazz = config.getClass();
-            if (SamlIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = SAML;
+    public IdentityProvider<T> setConfig(T config) {
+        this.type = UNKNOWN;
+        if (config != null) {
+            this.type = determineType(config.getClass());
+            if (SAML.equals(this.type)) {
                 if (StringUtils.hasText(getOriginKey())) {
                     ((SamlIdentityProviderDefinition) config).setIdpEntityAlias(getOriginKey());
                 }
                 if (StringUtils.hasText(getIdentityZoneId())) {
                     ((SamlIdentityProviderDefinition) config).setZoneId(getIdentityZoneId());
                 }
-            } else if (UaaIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = UAA;
-            } else if (RawExternalOAuthIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = OAUTH20;
-            } else if (OIDCIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = OIDC10;
-            } else if (LdapIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = LDAP;
-            } else if (KeystoneIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = KEYSTONE;
-            } else if (AbstractIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
-                this.type = UNKNOWN;
-            } else {
-                throw new IllegalArgumentException("Unknown identity provider configuration type:" + clazz.getName());
             }
         }
         this.config = config;
         return this;
     }
 
-    public String getOriginKey() {
-        return originKey;
+    private static String determineType(Class clazz) {
+        if (SamlIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return SAML;
+        } else if (UaaIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return UAA;
+        } else if (RawExternalOAuthIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return OAUTH20;
+        } else if (OIDCIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return OIDC10;
+        } else if (LdapIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return LDAP;
+        } else if (KeystoneIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return KEYSTONE;
+        } else if (AbstractIdentityProviderDefinition.class.isAssignableFrom(clazz)) {
+            return UNKNOWN;
+        } else {
+            throw new IllegalArgumentException("Unknown identity provider configuration type:" + clazz.getName());
+        }
     }
 
-    public IdentityProvider setOriginKey(String originKey) {
+    public IdentityProvider<T> setOriginKey(String originKey) {
         this.originKey = originKey;
         if (config != null && config instanceof SamlIdentityProviderDefinition) {
             ((SamlIdentityProviderDefinition) config).setIdpEntityAlias(originKey);
@@ -179,51 +158,29 @@ public IdentityProvider setOriginKey(String originKey) {
         return this;
     }
 
-    public String getType() {
-        return type;
-    }
-
-    public IdentityProvider setType(String type) {
+    public IdentityProvider<T> setType(String type) {
         this.type = type;
         return this;
     }
 
-    public boolean isActive() {
-        return active;
-    }
-
-    public IdentityProvider setActive(boolean active) {
+    public IdentityProvider<T> setActive(boolean active) {
         this.active = active;
         return this;
     }
 
-    public String getIdentityZoneId() {
-        return identityZoneId;
-    }
-
-    public IdentityProvider setIdentityZoneId(String identityZoneId) {
+    public IdentityProvider<T> setIdentityZoneId(String identityZoneId) {
         this.identityZoneId = identityZoneId;
         if (config != null && config instanceof SamlIdentityProviderDefinition) {
             ((SamlIdentityProviderDefinition) config).setZoneId(identityZoneId);
         }
         return this;
     }
 
-    @Override
-    public String getAliasId() {
-        return aliasId;
-    }
-
     @Override
     public void setAliasId(String aliasId) {
         this.aliasId = aliasId;
     }
 
-    @Override
-    public String getAliasZid() {
-        return aliasZid;
-    }
-
     @Override
     public void setAliasZid(String aliasZid) {
         this.aliasZid = aliasZid;
@@ -304,9 +261,7 @@ public boolean equals(Object obj) {
         } else if (!aliasZid.equals(other.aliasZid)) {
             return false;
         }
-        if (version != other.version)
-            return false;
-        return true;
+        return version == other.version;
     }
 
     @Override
@@ -344,13 +299,6 @@ public String toString() {
         return sb.toString();
     }
 
-    private boolean serializeConfigRaw;
-
-    @JsonIgnore
-    public boolean isSerializeConfigRaw() {
-        return serializeConfigRaw;
-    }
-
     @JsonIgnore
     public void setSerializeConfigRaw(boolean serializeConfigRaw) {
         this.serializeConfigRaw = serializeConfigRaw;
@@ -446,8 +394,5 @@ public IdentityProvider deserialize(JsonParser jp, DeserializationContext ctxt)
             result.setAliasZid(getNodeAsString(node, FIELD_ALIAS_ZID, null));
             return result;
         }
-
-
     }
-
 }