Package com.sun.identity.wsfederation.common

Class WReplyValidator

  • public final class WReplyValidator
extends Object
    Validates the wreply URLs that the WS-Federation endpoints receive as request parameters.

    This validator does not treat a missing wreplyList as permission to redirect anywhere: with no whitelist configured it accepts only URLs pointing back at this server. It also works for endpoints that are not deployed under a metaAlias, where the hosted entity cannot be resolved from the request URI and no whitelist is consulted at all - see pointsBackAtThisServer(HttpServletRequest, String).

    Deployments that need cross domain wreply URLs and cannot populate the list of every hosted entity can set Constants.FEDERATION_ALLOW_ANY_URL_WITHOUT_WHITELIST to restore the old behaviour. The property is read on every call, so it can be changed without a restart, and it only decides what an empty list means: a populated list rules either way, and so does a list that could not be read - a configuration store that cannot be reached, or a metaAlias whose entity could not be resolved, is never taken for an entity without a list.

    The static methods are the entry points the JSPs and the servlets use. They delegate to an instance holding the collaborators, which the tests build with stubs of their own.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static boolean isValidForEntity​(jakarta.servlet.http.HttpServletRequest request, String realm, String entityId, String wreply, String role)
      Tells whether it is safe to redirect to the given wreply URL, consulting only the whitelist of the given role.
      static boolean isValidForMetaAlias​(jakarta.servlet.http.HttpServletRequest request, String metaAlias, String wreply)
      Tells whether it is safe to redirect to the given wreply URL, taking the hosted entity from the provided metaAlias.
      static boolean isValidForRequest​(jakarta.servlet.http.HttpServletRequest request, String wreply)
      Tells whether it is safe to redirect to the given wreply URL, taking the hosted entity from the metaAlias in the request URI.
      static boolean pointsBackAtThisServer​(jakarta.servlet.http.HttpServletRequest request, String wreply)
      Tells whether the given wreply URL points back at this server, consulting no wreplyList at all.

    • Method Detail

      • pointsBackAtThisServer

        public static boolean pointsBackAtThisServer​(jakarta.servlet.http.HttpServletRequest request,
                                             String wreply)
        Tells whether the given wreply URL points back at this server, consulting no wreplyList at all.

        This is what an endpoint whose hosted entity is named by the caller has to use. multi.jsp carries no metaAlias - logout.jsp names the entity in its query string - and it answers an unauthenticated request, so the realm and the entity ID it receives are whatever the caller sent. Letting them select the whitelist would mean any hosted entity's wreplyList could authorise a redirect issued for another entity, in another realm; naming no role on top of that would merge that entity's IdP and RP lists. Untrusted input picks no whitelist here, so only this deployment's own URLs are accepted.

        Parameters:
        request - The request being processed, used to establish the origin of this server.
        wreply - The URL to validate.
        Returns:
        true if the wreply URL points back at this server.

      • isValidForEntity

        public static boolean isValidForEntity​(jakarta.servlet.http.HttpServletRequest request,
                                       String realm,
                                       String entityId,
                                       String wreply,
                                       String role)
        Tells whether it is safe to redirect to the given wreply URL, consulting only the whitelist of the given role.
        Parameters:
        request - The request being processed, consulted as a secondary view of this server's origin, may be null.
        realm - The realm of the hosted entity, may be null.
        entityId - The entity ID of the hosted entity, may be null.
        wreply - The URL to validate.
        role - The role serving this endpoint, SAML2Constants.UNKNOWN_ROLE or null when the caller can not tell, in which case both roles are consulted.
        Returns:
        true if the wreply URL may be used in a redirect.

      • isValidForRequest

        public static boolean isValidForRequest​(jakarta.servlet.http.HttpServletRequest request,
                                        String wreply)
        Tells whether it is safe to redirect to the given wreply URL, taking the hosted entity from the metaAlias in the request URI.

        There is deliberately no fallback to a metaAlias request parameter here: the WS-Federation endpoints reached through this overload carry their metaAlias in the URI, so letting the caller name the entity whose wreplyList is consulted would only add a choice it does not need.

        Parameters:
        request - The request being processed.
        wreply - The URL to validate.
        Returns:
        true if the wreply URL may be used in a redirect.

      • isValidForMetaAlias

        public static boolean isValidForMetaAlias​(jakarta.servlet.http.HttpServletRequest request,
                                          String metaAlias,
                                          String wreply)
        Tells whether it is safe to redirect to the given wreply URL, taking the hosted entity from the provided metaAlias.
        Parameters:
        request - The request being processed, may be null.
        metaAlias - The metaAlias of the hosted entity, may be null.
        wreply - The URL to validate.
        Returns:
        true if the wreply URL may be used in a redirect.