Package com.sun.identity.federation.common

Class FSUtils

  • public class FSUtils
extends Object
    This class contain constants used in the SDK.

    • Method Detail

      • setLocale

        public static void setLocale​(String localeName)
        Sets the locale of the resource bundle

      • generateID

        public static String generateID()
        Generates an ID String with length of IFSConstants.ID_LENGTH.
        Returns:
        string the ID String; or null if it fails.

      • generateSourceID

        public static String generateSourceID​(String entityID)
        Generates source ID String
        Parameters:
        entityID - the entity ID of the source site
        Returns:
        source ID

      • generateAssertionHandle

        public static String generateAssertionHandle()
        Generates assertion handle.
        Returns:
        20-byte random string to be used to form an artifact.

      • stringToBase64

        public static String stringToBase64​(String succinctID)
        Converts a string to Base64 encoded string.
        Parameters:
        succinctID - provider's succinctID string
        Returns:
        Base64 encoded string

      • checkHTTPRequestLength

        public static void checkHTTPRequestLength​(jakarta.servlet.http.HttpServletRequest request)
                                   throws jakarta.servlet.ServletException
        Checks content length of a http request to avoid dos attack. In case IDFF inter-op with other IDFF vendor who may not provide content length in HttpServletRequest. We decide to support no length restriction for Http communication. Here, we use a special value (e.g. 0) to indicate that no enforcement is required.
        Parameters:
        request - HttpServletRequest instance to be checked.
        Throws:
        jakarta.servlet.ServletException - if context length of the request exceeds maximum content length allowed.

      • isSameContainer

        public static boolean isSameContainer​(jakarta.servlet.http.HttpServletRequest request,
                                      String url)
        Test if url in argument is in the same web container as current opensso web apps serving the request.
        Parameters:
        request - HttpServletRequest
        url - the URL to test against the current web container
        Returns:
        true if request and url are in the same web container else false

      • forwardRequest

        public static void forwardRequest​(jakarta.servlet.http.HttpServletRequest request,
                                  jakarta.servlet.http.HttpServletResponse response,
                                  String url)
        Forwards or redirects to a new URL. This method will do forwarding if the target url is in the same web deployment URI as current web apps. Otherwise will do redirecting.
        Parameters:
        request - HttpServletRequest
        response - HttpServletResponse
        url - the target URL to be forwarded to redirected.

      • findPreferredIDP

        public static String findPreferredIDP​(String realm,
                                      jakarta.servlet.http.HttpServletRequest request)
        Finds the preferred IDP from the HttpServletRequest.
        Parameters:
        realm - The realm under which the entity resides.
        request - HttpServletRequest.
        Returns:
        String preferred IDP entity ID; or null for failure or unable to find in the request.

      • removeNewLineChars

        public static String removeNewLineChars​(String s)
        Removes new line characters (useful for Base64 decoding)
        Parameters:
        s - String
        Returns:
        result String

      • getIDFFMetaManager

        public static IDFFMetaManager getIDFFMetaManager()
        Returns an instance of the IDFF meta manager class.
        Returns:
        IDFFMetaManager instance; or null if it cannot retrieve the instance.

      • getAuthDomainURL

        public static String getAuthDomainURL​(String orgDN)

      • requireAddCookie

        public static boolean requireAddCookie​(jakarta.servlet.http.HttpServletRequest request)

      • requireRedirect

        public static boolean requireRedirect​(jakarta.servlet.http.HttpServletRequest request)

      • needSetLBCookieAndRedirect

        public static boolean needSetLBCookieAndRedirect​(jakarta.servlet.http.HttpServletRequest request,
                                                 jakarta.servlet.http.HttpServletResponse response,
                                                 boolean isIDP)
        Detects if a request simply needs loadbalancer cookies adding and to be redirected to be handled elsewhere.

        Gated on com.sun.identity.federation.cookieHashRedirectEnabled, which is off by default; see requireAddCookie(jakarta.servlet.http.HttpServletRequest) and requireRedirect(jakarta.servlet.http.HttpServletRequest) for the rest of the gate.

        Parameters:
        request - The HTTP request in question.
        response - The response associated with the request.
        isIDP - Whether this entity is acting as an IDP.
        Returns:
        false if the caller still owns the response and has to carry on, true if the request has been bounced and the caller must return without writing anything further. A bounce that failed after committing the response also returns true, see requireStopAfterFailedBounce(jakarta.servlet.http.HttpServletResponse, java.lang.Exception).

      • requireStopAfterFailedBounce

        public static boolean requireStopAfterFailedBounce​(jakarta.servlet.http.HttpServletResponse response,
                                                   Exception cause)
        Reports whether a failed load balancer cookie bounce has to stop the caller.

        Every caller reads a false from needSetLBCookieAndRedirect(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse, boolean) as "no bounce was needed, carry on", which is only safe while the response is still untouched. The forward to the auto submit JSP can fail after the JSP has already written the SAML message and the container has flushed it - a signed assertion larger than the response buffer plus a client that aborts is enough. Carrying on from there would consume the one-time-use assertion, mint a session, and then call sendError or sendRedirect on a committed response. So once the response is committed the caller is told the request was handled.

        A forward that failed while its output was still buffered leaves the caller in charge, but the half rendered auto submit form has to go: appending the caller's own page to it would produce one document carrying both, and the leftover <body onload="document.forms[0].submit()"> would submit the stale SAML message. So the buffer is dropped before handing the response back.

        Only the buffer: reset() would also clear the headers, and by this point setlbCookie(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse) has already put the load balancer cookie on the response. Dropping that would send the client away without the cookie the whole bounce exists to deliver, so the no-cache headers the sink set are left in place as the lesser cost.

        The same limit applies to the GET branch, where the failure came out of sendRedirect: the status line and Location it had already set stay on the response, and the servlet API offers no way to remove a header. A caller that carries on there would have its page discarded by a client following the redirect. Reaching that needs sendRedirect to throw without committing, which Tomcat does not do unless the context is configured to send a redirect body.

        Parameters:
        response - The response associated with the request.
        cause - The failure that came out of the forward.
        Returns:
        true if the response is already committed and the caller must stop.

      • getRemoteServiceURLs

        public static List getRemoteServiceURLs​(jakarta.servlet.http.HttpServletRequest request)
        Gets remote service URLs
        Parameters:
        request - http request
        Returns:
        remote service URLs

      • setlbCookie

        public static void setlbCookie​(jakarta.servlet.http.HttpServletRequest request,
                               jakarta.servlet.http.HttpServletResponse response)
        Sets load balancer cookie.
        Parameters:
        response - HttpServletResponse object

      • getlbCookieName

        public static String getlbCookieName()

      • getlbCookieValue

        public static String getlbCookieValue()

      • postToTarget

        public static void postToTarget​(jakarta.servlet.http.HttpServletRequest request,
                                jakarta.servlet.http.HttpServletResponse response,
                                String SAMLmessageName,
                                String SAMLmessageValue,
                                String relayStateName,
                                String relayStateValue,
                                String targetURL)
                         throws SAML2Exception
        Forwards to the auto submitting JSP so that the SAML message is re-posted to targetURL.

        IDFF and SAML2 re-post through the very same autosubmitaccessrights.jsp, so this is a thin delegation to SAML2Utils.postToTarget(jakarta.servlet.http.HttpServletRequest, jakarta.servlet.http.HttpServletResponse, java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.String) rather than a second implementation: that JSP renders the values with bare JSP EL, and one sink is what keeps the encoding it needs from drifting away on one of the two paths.

        Parameters:
        request - The HTTP request in question.
        response - The response associated with the request.
        SAMLmessageName - Name of the SAML message parameter.
        SAMLmessageValue - Value of the SAML message parameter.
        relayStateName - Name of the relay state parameter.
        relayStateValue - Value of the relay state parameter, may be null.
        targetURL - The URL the message is re-posted to.
        Throws:
        SAML2Exception - if the forward fails.