Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change ArtifactResponse extracting method #70

Merged
merged 1 commit into from
Aug 1, 2018
Merged

Change ArtifactResponse extracting method #70

merged 1 commit into from
Aug 1, 2018

Conversation

vihanga-liyanage
Copy link
Contributor

@vihanga-liyanage vihanga-liyanage commented Jul 23, 2018 •
edited
Loading

Proposed changes in this pull request

  • Earlier a regex pattern was used to extract the ArtifactResponse object. Hardcoded regex string can cause problems when specification versions or lib versions are upgraded. Therefore we have used library constants to validate and extract the object.

Refers wso2/product-is#3401
Resolves wso2/product-is#3580

When should this PR be merged

ASAP

Follow up actions

  • Update the pom version.

Checklist (for reviewing)

General

  • Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
  • Is the PR labeled correctly?

Functionality

  • Are all requirements met? Compare implemented functionality with the requirements specification.
  • Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

  • Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
  • Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
  • Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

  • Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
  • If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
  • If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

  • Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
  • Are all UI and API inputs run through forms or serializers?
  • Are all external inputs validated and sanitized appropriately?
  • Does all branching logic have a default case?
  • Does this solution handle outliers and edge cases gracefully?
  • Are all external communications secured and restricted to SSL?

Documentation

  • Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
  • Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
  • Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

IndunilRathnayake
IndunilRathnayake reviewed Jul 24, 2018
View reviewed changes
.../src/test/java/org/wso2/carbon/identity/application/authenticator/samlsso/TestConstants.java Outdated
@@ -353,6 +353,77 @@ private TestConstants() {

public static final String SAML_ART = "AAQAAM1OZiCJt3Va5A1W4dyuSepX9Q6clxUTA4vGKbi/bFCqu6Vm+NTZMDE=";

public static final String SAML_ART_RESPONSE = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like this is not used in the testcases. If so, shall we remove this?

IndunilRathnayake
IndunilRathnayake reviewed Jul 24, 2018
View reviewed changes
...dentity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionServiceTest.java Outdated

public class SAMLSSOArtifactResolutionServiceTest {

private static ArtifactResolve artifactResolve;
private static ArtifactResponse artifactResponse;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need of these changes in this class.

IndunilRathnayake
IndunilRathnayake reviewed Jul 24, 2018
View reviewed changes
...on/identity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionService.java Outdated
return artifactResponse;
ArtifactResponse artifactResponse = extractArtifactResponse(artifactResponseString);

if (artifactResponse != null && isArtifactResponseValid(artifactResolve, artifactResponse)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Null check is already added inside isArtifactResponseValid() [1], no need to add it in here.

[1] https://github.com/vihanga-liyanage/identity-outbound-auth-samlsso/blob/2cf2a4fe6423a3c1aa3348a8401f9100c3bfb2ca/components/org.wso2.carbon.identity.application.authenticator.samlsso/src/main/java/org/wso2/carbon/identity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionService.java#L189

IndunilRathnayake
IndunilRathnayake reviewed Jul 24, 2018
View reviewed changes
...on/identity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionService.java
throws ArtifactResolutionException {

ArtifactResponse artifactResponse = null;
InputStream stream = new ByteArrayInputStream(artifactResponseString.getBytes(StandardCharsets.UTF_8));
Copy link
Contributor

@IndunilRathnayake IndunilRathnayake Jul 24, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initially validate whether artifactResponseString is null.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Validation added before calling the method.

IndunilRathnayake
IndunilRathnayake reviewed Jul 24, 2018
View reviewed changes
...on/identity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionService.java Outdated
artifactResolve.getArtifact().getArtifact() + " Issuer: " + artifactResolve.getIssuer().getValue());
}
ArtifactResponse artifactResponse = extractArtifactResponse(artifactResponseString);

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the unnecessary line.

malithie
malithie reviewed Jul 29, 2018
View reviewed changes
...on/identity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionService.java Outdated
ArtifactResponse artifactResponse = (ArtifactResponse) SSOUtils.unmarshall(artifactResponseReceived);
if (isArtifactResponseValid(artifactResolve, artifactResponse)) {
return artifactResponse;
if (artifactResponseString == null) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any probability for this string to be empty

malithie
malithie reviewed Jul 29, 2018
View reviewed changes
...on/identity/application/authenticator/samlsso/artifact/SAMLSSOArtifactResolutionService.java Outdated
} else {
throw new ArtifactResolutionException("Artifact Response is not valid.");
throw new ArtifactResolutionException("Didn't receive valid artifact response.");
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So based on this if else block if the very first element is not an artifact response an error will be thown.
Is this the expectation. Can artifact response be nested ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the spec, the SOAP message should wrap the Artifact Response object. Following is an example given in the spec.

<SOAP-ENV:Envelope
    xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
    <SOAP-ENV:Body>
        <samlp:ArtifactResponse
            xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
            xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
            ID="_FQvGknDfws2Z" Version="2.0"
            InResponseTo="_6c3a4f8b9c2d"
            IssueInstant="2004-01-21T19:00:49Z">
            <Issuer>https://wso2is.com</Issuer>
            <samlp:Status>
                <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
            </samlp:Status>
            <samlp:Response ID="d2b7c388cec36fa7c39c28fd298644a8"
                IssueInstant="2004-01-21T19:00:49Z"
                Version="2.0">
                ...
            </samlp:Response>
        </samlp:ArtifactResponse>
    </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

@IndunilRathnayake IndunilRathnayake merged commit 81ea9d0 into wso2-extensions:5.1.x Aug 1, 2018
@vihanga-liyanage vihanga-liyanage mentioned this pull request Aug 7, 2018
Closed
19 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@IndunilRathnayake IndunilRathnayake IndunilRathnayake left review comments

@malithie malithie malithie approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@vihanga-liyanage @malithie @IndunilRathnayake