Skip to content

Commit 8adc79b

Browse files
pitbulkpitbulk
authored
Merge pull request #359 from mauromol/add-allowcreate
Allow to control NameIDPolicy.AllowCreate attribute on AuthnRequest
2 parents 257a415 + 89c2df0 commit 8adc79b

File tree

3 files changed

+143
-9
lines changed

3 files changed

+143
-9
lines changed

‎core/src/main/java/com/onelogin/saml2/authn/AuthnRequest.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,11 @@ private StrSubstitutor generateSubstitutor(AuthnRequestParams params, Saml2Setti
229229
if (settings.getWantNameIdEncrypted()) {
230230
nameIDPolicyFormat = Constants.NAMEID_ENCRYPTED;
231231
}
232-
nameIDPolicyStr = "<samlp:NameIDPolicy Format=\"" + Util.toXml(nameIDPolicyFormat) + "\" AllowCreate=\"true\" />";
232+
String allowCreateStr = "";
233+
if (params.isAllowCreate()) {
234+
allowCreateStr = " AllowCreate=\"true\"";
235+
}
236+
nameIDPolicyStr = "<samlp:NameIDPolicy Format=\"" + Util.toXml(nameIDPolicyFormat) + "\"" + allowCreateStr + " />";
233237
}
234238
valueMap.put("nameIDPolicyStr", nameIDPolicyStr);
235239

‎core/src/main/java/com/onelogin/saml2/authn/AuthnRequestParams.java‎

Lines changed: 69 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,14 @@ public class AuthnRequestParams {
1414
*/
1515
private final boolean isPassive;
1616
/**
17-
* When true the AuthNReuqest will set a nameIdPolicy
17+
* When true the AuthNRequest will set a nameIdPolicy
1818
*/
1919
private final boolean setNameIdPolicy;
20+
/**
21+
* When true and {@link #setNameIdPolicy} is also <code>true</code>, then the
22+
* AllowCreate='true' will be set on the NameIDPolicy element
23+
*/
24+
private final boolean allowCreate;
2025
/**
2126
* Indicates to the IdP the subject that should be authenticated
2227
*/
@@ -29,13 +34,34 @@ public class AuthnRequestParams {
2934
* whether the <code>ForceAuthn</code> attribute should be set to
3035
* <code>true</code>
3136
* @param isPassive
32-
* whether the <code>isPassive</code> attribute should be set to
37+
* whether the <code>IsPassive</code> attribute should be set to
3338
* <code>true</code>
3439
* @param setNameIdPolicy
3540
* whether a <code>NameIDPolicy</code> should be set
3641
*/
3742
public AuthnRequestParams(boolean forceAuthn, boolean isPassive, boolean setNameIdPolicy) {
38-
this(forceAuthn, isPassive, setNameIdPolicy, null);
43+
this(forceAuthn, isPassive, setNameIdPolicy, true);
44+
}
45+
46+
/**
47+
* Create a set of authentication request input parameters.
48+
*
49+
* @param forceAuthn
50+
* whether the <code>ForceAuthn</code> attribute should be set to
51+
* <code>true</code>
52+
* @param isPassive
53+
* whether the <code>IsPassive</code> attribute should be set to
54+
* <code>true</code>
55+
* @param setNameIdPolicy
56+
* whether a <code>NameIDPolicy</code> should be set
57+
* @param allowCreate
58+
* whether the <code>AllowCreate</code> attribute should be set to
59+
* <code>true</code> on the <code>NameIDPolicy</code> element; only
60+
* meaningful if <code>setNameIdPolicy</code> is also
61+
* <code>true</code>
62+
*/
63+
public AuthnRequestParams(boolean forceAuthn, boolean isPassive, boolean setNameIdPolicy, boolean allowCreate) {
64+
this(forceAuthn, isPassive, setNameIdPolicy, allowCreate, null);
3965
}
4066

4167
/**
@@ -45,17 +71,42 @@ public AuthnRequestParams(boolean forceAuthn, boolean isPassive, boolean setName
4571
* whether the <code>ForceAuthn</code> attribute should be set to
4672
* <code>true</code>
4773
* @param isPassive
48-
* whether the <code>isPassive</code> attribute should be set to
74+
* whether the <code>IsPassive</code> attribute should be set to
4975
* <code>true</code>
5076
* @param setNameIdPolicy
5177
* whether a <code>NameIDPolicy</code> should be set
5278
* @param nameIdValueReq
5379
* the subject that should be authenticated
5480
*/
5581
public AuthnRequestParams(boolean forceAuthn, boolean isPassive, boolean setNameIdPolicy, String nameIdValueReq) {
82+
this(forceAuthn, isPassive, setNameIdPolicy, true, nameIdValueReq);
83+
}
84+
85+
/**
86+
* Create a set of authentication request input parameters.
87+
*
88+
* @param forceAuthn
89+
* whether the <code>ForceAuthn</code> attribute should be set to
90+
* <code>true</code>
91+
* @param isPassive
92+
* whether the <code>IsPassive</code> attribute should be set to
93+
* <code>true</code>
94+
* @param setNameIdPolicy
95+
* whether a <code>NameIDPolicy</code> should be set
96+
* @param allowCreate
97+
* the value to set for the <code>allowCreate</code> attribute of
98+
* <code>NameIDPolicy</code> element; <code>null</code> means it's
99+
* not set at all; only meaningful when
100+
* <code>setNameIdPolicy</code> is <code>true</code>
101+
* @param nameIdValueReq
102+
* the subject that should be authenticated
103+
*/
104+
public AuthnRequestParams(boolean forceAuthn, boolean isPassive, boolean setNameIdPolicy, boolean allowCreate,
105+
String nameIdValueReq) {
56106
this.forceAuthn = forceAuthn;
57107
this.isPassive = isPassive;
58108
this.setNameIdPolicy = setNameIdPolicy;
109+
this.allowCreate = allowCreate;
59110
this.nameIdValueReq = nameIdValueReq;
60111
}
61112

@@ -70,32 +121,42 @@ protected AuthnRequestParams(AuthnRequestParams source) {
70121
this.forceAuthn = source.isForceAuthn();
71122
this.isPassive = source.isPassive();
72123
this.setNameIdPolicy = source.isSetNameIdPolicy();
124+
this.allowCreate = source.isAllowCreate();
73125
this.nameIdValueReq = source.getNameIdValueReq();
74126
}
75127

76128
/**
77129
* @return whether the <code>ForceAuthn</code> attribute should be set to
78130
* <code>true</code>
79131
*/
80-
protected boolean isForceAuthn() {
132+
public boolean isForceAuthn() {
81133
return forceAuthn;
82134
}
83135

84136
/**
85-
* @return whether the <code>isPassive</code> attribute should be set to
137+
* @return whether the <code>IsPassive</code> attribute should be set to
86138
* <code>true</code>
87139
*/
88-
protected boolean isPassive() {
140+
public boolean isPassive() {
89141
return isPassive;
90142
}
91143

92144
/**
93145
* @return whether a <code>NameIDPolicy</code> should be set
94146
*/
95-
protected boolean isSetNameIdPolicy() {
147+
public boolean isSetNameIdPolicy() {
96148
return setNameIdPolicy;
97149
}
98150

151+
/**
152+
* @return whether the <code>AllowCreate</code> attribute should be set to
153+
* <code>true</code> on the <code>NameIDPolicy</code> element (only
154+
* meaningful if {@link #isSetNameIdPolicy()} is also <code>true</code>)
155+
*/
156+
public boolean isAllowCreate() {
157+
return allowCreate;
158+
}
159+
99160
/**
100161
* @return the subject that should be authenticated
101162
*/

‎core/src/test/java/com/onelogin/saml2/test/authn/AuthnRequestTest.java‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,75 @@ public void testNameIDPolicy() throws Exception {
242242
assertThat(authnRequestStr, containsString("Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\""));
243243
}
244244

245+
/**
246+
* Tests the AuthnRequest Constructor
247+
* The creation of a deflated SAML Request with NameIDPolicy with and without AllowCreate
248+
*
249+
* @throws Exception
250+
*
251+
* @see com.onelogin.saml2.authn.AuthnRequest
252+
*/
253+
@Test
254+
public void testAllowCreate() throws Exception {
255+
Saml2Settings settings = new SettingsBuilder().fromFile("config/config.min.properties").build();
256+
257+
// by default setNameIdPolicy=true, allowCreate=true
258+
AuthnRequest authnRequest = new AuthnRequest(settings);
259+
String authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
260+
String authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
261+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
262+
assertThat(authnRequestStr, containsString("<samlp:NameIDPolicy"));
263+
assertThat(authnRequestStr, containsString("AllowCreate=\"true\""));
264+
265+
// explicit setNameIdPolicy=true, by default allowCreate=true
266+
authnRequest = new AuthnRequest(settings, new AuthnRequestParams(false, false, true));
267+
authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
268+
authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
269+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
270+
assertThat(authnRequestStr, containsString("<samlp:NameIDPolicy"));
271+
assertThat(authnRequestStr, containsString("AllowCreate=\"true\""));
272+
273+
// explicit setNameIdPolicy=true, explicit allowCreate=true
274+
authnRequest = new AuthnRequest(settings, new AuthnRequestParams(false, false, true, true));
275+
authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
276+
authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
277+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
278+
assertThat(authnRequestStr, containsString("<samlp:NameIDPolicy"));
279+
assertThat(authnRequestStr, containsString("AllowCreate=\"true\""));
280+
281+
// explicit setNameIdPolicy=true, explicit allowCreate=false
282+
authnRequest = new AuthnRequest(settings, new AuthnRequestParams(false, false, true, false));
283+
authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
284+
authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
285+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
286+
assertThat(authnRequestStr, containsString("<samlp:NameIDPolicy"));
287+
assertThat(authnRequestStr, not(containsString("AllowCreate=\"true\"")));
288+
289+
// if setNameIdPolicy=false, by default AllowCreate missing
290+
authnRequest = new AuthnRequest(settings, new AuthnRequestParams(false, false, false));
291+
authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
292+
authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
293+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
294+
assertThat(authnRequestStr, not(containsString("<samlp:NameIDPolicy")));
295+
assertThat(authnRequestStr, not(containsString("AllowCreate=\"true\"")));
296+
297+
// if setNameIdPolicy=false explicitly, AllowCreate missing even if explicit allowCreate=true
298+
authnRequest = new AuthnRequest(settings, new AuthnRequestParams(false, false, false, true));
299+
authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
300+
authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
301+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
302+
assertThat(authnRequestStr, not(containsString("<samlp:NameIDPolicy")));
303+
assertThat(authnRequestStr, not(containsString("AllowCreate=\"true\"")));
304+
305+
// if both setNameIdPolicy=false and allowCreate=false explicitly, of course AllowCreate missing
306+
authnRequest = new AuthnRequest(settings, new AuthnRequestParams(false, false, false, false));
307+
authnRequestStringBase64 = authnRequest.getEncodedAuthnRequest();
308+
authnRequestStr = Util.base64decodedInflated(authnRequestStringBase64);
309+
assertThat(authnRequestStr, containsString("<samlp:AuthnRequest"));
310+
assertThat(authnRequestStr, not(containsString("<samlp:NameIDPolicy")));
311+
assertThat(authnRequestStr, not(containsString("AllowCreate=\"true\"")));
312+
}
313+
245314
/**
246315
* Tests the AuthnRequest Constructor
247316
* The creation of a deflated SAML Request with NameIDPolicy Encrypted

0 commit comments

Comments
 (0)