Skip to content

Commit 514224c

Browse files
pitbulkpitbulk
authored
Merge pull request #293 from rolandorh/configure_digest_algorithm_from_file
Read digest algorithm from configuration
2 parents 7b70cf3 + e9b78ad commit 514224c

15 files changed

+103
-9
lines changed

‎core/src/main/java/com/onelogin/saml2/settings/SettingsBuilder.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ public class SettingsBuilder {
9898
public final static String SECURITY_REQUESTED_AUTHNCONTEXTCOMPARISON = "onelogin.saml2.security.requested_authncontextcomparison";
9999
public final static String SECURITY_WANT_XML_VALIDATION = "onelogin.saml2.security.want_xml_validation";
100100
public final static String SECURITY_SIGNATURE_ALGORITHM = "onelogin.saml2.security.signature_algorithm";
101+
public final static String SECURITY_DIGEST_ALGORITHM = "onelogin.saml2.security.digest_algorithm";
101102
public final static String SECURITY_REJECT_UNSOLICITED_RESPONSES_WITH_INRESPONSETO = "onelogin.saml2.security.reject_unsolicited_responses_with_inresponseto";
102103
public final static String SECURITY_ALLOW_REPEAT_ATTRIBUTE_NAME_PROPERTY_KEY = "onelogin.saml2.security.allow_duplicated_attribute_name";
103104

@@ -216,7 +217,7 @@ public SettingsBuilder fromValues(Map<String, Object> samlData, KeyStoreSettings
216217
/**
217218
* Builds the Saml2Settings object. Read the Properties object and set all the
218219
* SAML settings
219-
*
220+
*
220221
* @return the Saml2Settings object with all the SAML settings loaded
221222
*
222223
*/
@@ -365,6 +366,10 @@ private void loadSecuritySetting() {
365366
if (signatureAlgorithm != null && !signatureAlgorithm.isEmpty())
366367
saml2Setting.setSignatureAlgorithm(signatureAlgorithm);
367368

369+
String digestAlgorithm = loadStringProperty(SECURITY_DIGEST_ALGORITHM);
370+
if (digestAlgorithm != null && !digestAlgorithm.isEmpty())
371+
saml2Setting.setDigestAlgorithm(digestAlgorithm);
372+
368373
Boolean rejectUnsolicitedResponsesWithInResponseTo = loadBooleanProperty(SECURITY_REJECT_UNSOLICITED_RESPONSES_WITH_INRESPONSETO);
369374
if (rejectUnsolicitedResponsesWithInResponseTo != null) {
370375
saml2Setting.setRejectUnsolicitedResponsesWithInResponseTo(rejectUnsolicitedResponsesWithInResponseTo);

‎core/src/test/java/com/onelogin/saml2/test/settings/Saml2SettingsTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ public void testGetSPMetadataSigned() throws Exception {
299299
assertEquals(Constants.C14NEXC, ds_signature_metadata.getFirstChild().getFirstChild().getAttributes().getNamedItem("Algorithm").getNodeValue());
300300

301301
assertEquals(Constants.RSA_SHA512, ds_signature_metadata.getFirstChild().getFirstChild().getNextSibling().getAttributes().getNamedItem("Algorithm").getNodeValue());
302-
assertEquals(Constants.SHA1, ds_signature_metadata.getFirstChild().getFirstChild().getNextSibling().getNextSibling().getFirstChild().getNextSibling().getAttributes().getNamedItem("Algorithm").getNodeValue());
302+
assertEquals(Constants.SHA512, ds_signature_metadata.getFirstChild().getFirstChild().getNextSibling().getNextSibling().getFirstChild().getNextSibling().getAttributes().getNamedItem("Algorithm").getNodeValue());
303303

304304
assertEquals("md:SPSSODescriptor", metadataDoc.getDocumentElement().getFirstChild().getNextSibling().getNodeName());
305305

‎core/src/test/java/com/onelogin/saml2/test/settings/SettingBuilderTest.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ public void testLoadFromFileEmpty() throws IOException, CertificateException, UR
158158
assertEquals("exact", setting.getRequestedAuthnContextComparison());
159159
assertTrue(setting.getWantXMLValidation());
160160
assertEquals(Constants.RSA_SHA1, setting.getSignatureAlgorithm());
161+
assertEquals(Constants.SHA1, setting.getDigestAlgorithm());
161162
assertFalse(setting.getSignMetadata());
162163

163164
assertNull(setting.getOrganization());
@@ -213,6 +214,7 @@ public void testLoadFromFileMinProp() throws IOException, CertificateException,
213214
assertEquals("exact", setting.getRequestedAuthnContextComparison());
214215
assertTrue(setting.getWantXMLValidation());
215216
assertEquals(Constants.RSA_SHA1, setting.getSignatureAlgorithm());
217+
assertEquals(Constants.SHA1, setting.getDigestAlgorithm());
216218
assertFalse(setting.getSignMetadata());
217219

218220
assertNull(setting.getOrganization());
@@ -273,6 +275,7 @@ public void testLoadFromFileAllProp() throws IOException, CertificateException,
273275
assertEquals("exact", setting.getRequestedAuthnContextComparison());
274276
assertTrue(setting.getWantXMLValidation());
275277
assertEquals(Constants.RSA_SHA512, setting.getSignatureAlgorithm());
278+
assertEquals(Constants.SHA512, setting.getDigestAlgorithm());
276279
assertTrue(setting.getSignMetadata());
277280

278281
Organization org = new Organization("SP Java", "SP Java Example", "http://sp.example.com");
@@ -338,6 +341,7 @@ public void testLoadFromFileCertString() throws IOException, CertificateExceptio
338341
assertEquals("exact", setting.getRequestedAuthnContextComparison());
339342
assertTrue(setting.getWantXMLValidation());
340343
assertEquals(Constants.RSA_SHA1, setting.getSignatureAlgorithm());
344+
assertEquals(Constants.SHA1, setting.getDigestAlgorithm());
341345
assertFalse(setting.getSignMetadata());
342346

343347
Organization org = new Organization("SP Java", "SP Java Example", "http://sp.example.com");
@@ -392,6 +396,7 @@ public void testLoadFromFileContactString() throws IOException, CertificateExcep
392396
assertEquals("exact", setting.getRequestedAuthnContextComparison());
393397
assertTrue(setting.getWantXMLValidation());
394398
assertEquals(Constants.RSA_SHA1, setting.getSignatureAlgorithm());
399+
assertEquals(Constants.SHA1, setting.getDigestAlgorithm());
395400
assertFalse(setting.getSignMetadata());
396401

397402
Organization org = new Organization("SP Java", "SP Java Example", "http://sp.example.com");
@@ -504,6 +509,7 @@ public void testLoadFromFileSomeEmptyProp() throws IOException, CertificateExcep
504509
assertEquals("exact", setting.getRequestedAuthnContextComparison());
505510
assertTrue(setting.getWantXMLValidation());
506511
assertEquals(Constants.RSA_SHA1, setting.getSignatureAlgorithm());
512+
assertEquals(Constants.SHA1, setting.getDigestAlgorithm());
507513
assertTrue(setting.getSignMetadata());
508514

509515
assertNull(setting.getOrganization());
@@ -560,6 +566,7 @@ public void testLoadFromFileDifferentProp() throws IOException, CertificateExcep
560566
assertEquals("minimum", setting.getRequestedAuthnContextComparison());
561567
assertTrue(setting.getWantXMLValidation());
562568
assertEquals(Constants.RSA_SHA512, setting.getSignatureAlgorithm());
569+
assertEquals(Constants.SHA512, setting.getDigestAlgorithm());
563570
assertTrue(setting.getSignMetadata());
564571

565572
Organization org = new Organization("SP Java", "", "");
@@ -652,6 +659,7 @@ public void testFromProperties() throws IOException, Error, CertificateException
652659
assertEquals("exact", setting2.getRequestedAuthnContextComparison());
653660
assertTrue(setting2.getWantXMLValidation());
654661
assertEquals(Constants.RSA_SHA1, setting2.getSignatureAlgorithm());
662+
assertEquals(Constants.SHA1, setting2.getDigestAlgorithm());
655663
assertFalse(setting2.getSignMetadata());
656664

657665
assertNull(setting2.getOrganization());
@@ -713,6 +721,7 @@ public void testLoadFromValues() throws Exception {
713721
samlData.put(SECURITY_REQUESTED_AUTHNCONTEXTCOMPARISON, "exact");
714722
samlData.put(SECURITY_WANT_XML_VALIDATION, "true");
715723
samlData.put(SECURITY_SIGNATURE_ALGORITHM, "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512");
724+
samlData.put(SECURITY_DIGEST_ALGORITHM, "http://www.w3.org/2001/04/xmlenc#sha512");
716725

717726
// Compress
718727
samlData.put(COMPRESS_REQUEST, "false");
@@ -777,6 +786,7 @@ public void testLoadFromValues() throws Exception {
777786
assertEquals("exact", setting.getRequestedAuthnContextComparison());
778787
assertTrue(setting.getWantXMLValidation());
779788
assertEquals(Constants.RSA_SHA512, setting.getSignatureAlgorithm());
789+
assertEquals(Constants.SHA512, setting.getDigestAlgorithm());
780790
assertTrue(setting.getSignMetadata());
781791
assertFalse(setting.getWantNameId());
782792

@@ -868,6 +878,7 @@ public void testLoadFromValuesWithObjects() throws Exception {
868878
samlData.put(SECURITY_REQUESTED_AUTHNCONTEXTCOMPARISON, "exact");
869879
samlData.put(SECURITY_WANT_XML_VALIDATION, true);
870880
samlData.put(SECURITY_SIGNATURE_ALGORITHM, "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512");
881+
samlData.put(SECURITY_DIGEST_ALGORITHM, "http://www.w3.org/2001/04/xmlenc#sha512");
871882

872883
// Compress
873884
samlData.put(COMPRESS_REQUEST, "false");
@@ -924,6 +935,7 @@ public void testLoadFromValuesWithObjects() throws Exception {
924935
assertEquals("exact", setting.getRequestedAuthnContextComparison());
925936
assertTrue(setting.getWantXMLValidation());
926937
assertEquals(Constants.RSA_SHA512, setting.getSignatureAlgorithm());
938+
assertEquals(Constants.SHA512, setting.getDigestAlgorithm());
927939
assertTrue(setting.getSignMetadata());
928940
assertFalse(setting.getWantNameId());
929941

‎core/src/test/resources/config/config.adfs.properties‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ onelogin.saml2.sp.nameidformat = urn:oasis:names:tc:SAML:1.1:nameid-format:unspe
3636
onelogin.saml2.sp.x509cert = -----BEGIN CERTIFICATE-----MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo-----END CERTIFICATE-----
3737

3838

39-
# Requires Format PKCS#8 BEGIN PRIVATE KEY
39+
# Requires Format PKCS#8 BEGIN PRIVATE KEY
4040
# If you have PKCS#1 BEGIN RSA PRIVATE KEY convert it by openssl pkcs8 -topk8 -inform pem -nocrypt -in sp.rsa_key -outform pem -out sp.pem
4141
onelogin.saml2.sp.privatekey = -----BEGIN PRIVATE KEY-----MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOK9uFHs/nXrH9LcGorG6lB7Qs42iWK6mIE56wI7dIdsOuXf6r0ht+d+YTTis24xw+wjEHXrVN0Okh6wsKftzxo8chIo60+UB5NlKdvxAC7tpGNmrf49us/m5bdNx8IY+0pPK0c6B786UlujTvx1WFdDXh3UQPBclbWtFe5S3gLxAgMBAAECgYAPj9ngtZVZXoPWowinUbOvRmZ1ZMTVI91nsSPyCUacLM92C4I+7NuEZeYiDRUnkP7TbCyrCzXN3jwlIxdczzORhlXBBgg9Sw2fkV61CnDEMgw+aEeD5A0GDA6eTwkrawiOMs8vupjsi2/stPsa+bmpI6RnfdEKBdyDP6iQQhAxiQJBAPNtM7IMvRzlZBXoDaTTpP9rN2FR0ZcX0LT5aRZJ81qi+ZOBFeHUb6MyWvzZKfPinj9JO3s/9e3JbMXemRWBmvcCQQDuc+NfAeW200QyjoC3Ed3jueLMrY1Q3zTcSUhRPw/0pIKgRGZJerro8N6QY2JziV2mxK855gKTwwBigMHL2S9XAkEAwuBfjGDqXOG/uFHn6laNNvWshjqsIdus99Tbrj5RlfP2/YFP9VTOcsXzVYy9K0P3EA8ekVLpHQ4uCFJmF3OEjQJBAMvwO69/HOufhv1CWZ25XzAsRGhPqsRXEouw9XPfXpMavEm8FkuT9xXRJFkTVxl/i6RdJYx8Rwn/Rm34t0bUKqMCQQCrAtKCUn0PLcemAzPi8ADJlbMDG/IDXNbSej0Y4tw9Cdho1Q38XLZJi0RNdNvQJD1fWu3x9+QU/vJr7lMLzdoy-----END PRIVATE KEY-----
4242

@@ -124,6 +124,13 @@ onelogin.saml2.security.want_xml_validation = true
124124
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
125125
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
126126

127+
# Algorithm that the toolkit will use on digest process. Options:
128+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
129+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
130+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
131+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
132+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
133+
127134
# Organization
128135
onelogin.saml2.organization.name = SP Java
129136
onelogin.saml2.organization.displayname = SP Java Example

‎core/src/test/resources/config/config.all.properties‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,12 +130,12 @@ onelogin.saml2.security.want_xml_validation = true
130130
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
131131
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
132132

133-
# Algorithm that the toolkit will use on signing process. Options:
134-
# 'http://www.w3.org/2000/09/xmldsig#sha1'
135-
# 'http://www.w3.org/2001/04/xmlenc#sha256'
136-
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
137-
# 'http://www.w3.org/2001/04/xmlenc#sha512'
138-
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2000/09/xmldsig#sha1
133+
# Algorithm that the toolkit will use on digest process. Options:
134+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
135+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
136+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
137+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
138+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
139139

140140
# Organization
141141
onelogin.saml2.organization.name = SP Java

‎core/src/test/resources/config/config.allowduplicatednames.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,13 @@ onelogin.saml2.security.want_xml_validation = true
127127
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
128128
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
129129

130+
# Algorithm that the toolkit will use on digest process. Options:
131+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
132+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
133+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
134+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
135+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
136+
130137
# Organization
131138
onelogin.saml2.organization.name = SP Java
132139
onelogin.saml2.organization.displayname = SP Java Example

‎core/src/test/resources/config/config.different.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,13 @@ onelogin.saml2.security.want_xml_validation = true
127127
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
128128
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
129129

130+
# Algorithm that the toolkit will use on digest process. Options:
131+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
132+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
133+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
134+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
135+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
136+
130137
# Organization
131138
onelogin.saml2.organization.name = SP Java
132139

‎core/src/test/resources/config/config.knownIdpPrivateKey.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,13 @@ onelogin.saml2.security.want_xml_validation = true
131131
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
132132
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
133133

134+
# Algorithm that the toolkit will use on digest process. Options:
135+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
136+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
137+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
138+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
139+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
140+
134141
# Organization
135142
onelogin.saml2.organization.name = SP Java
136143
onelogin.saml2.organization.displayname = SP Java Example

‎core/src/test/resources/config/config.my.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,13 @@ onelogin.saml2.security.want_xml_validation = true
124124
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
125125
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
126126

127+
# Algorithm that the toolkit will use on digest process. Options:
128+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
129+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
130+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
131+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
132+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
133+
127134
# Organization
128135
onelogin.saml2.organization.name = SP Java
129136
onelogin.saml2.organization.displayname = SP Java Example

‎core/src/test/resources/config/config.mywithmulticert.properties‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,13 @@ onelogin.saml2.security.want_xml_validation = true
126126
# 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
127127
onelogin.saml2.security.signature_algorithm = http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
128128

129+
# Algorithm that the toolkit will use on digest process. Options:
130+
# 'http://www.w3.org/2000/09/xmldsig#sha1'
131+
# 'http://www.w3.org/2001/04/xmlenc#sha256'
132+
# 'http://www.w3.org/2001/04/xmldsig-more#sha384'
133+
# 'http://www.w3.org/2001/04/xmlenc#sha512'
134+
onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha512
135+
129136
# Organization
130137
onelogin.saml2.organization.name = SP Java
131138
onelogin.saml2.organization.displayname = SP Java Example

0 commit comments

Comments
 (0)