import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
public SamlMessage generateAuthnRequestFromHub(SessionId sessionId, String principalIpAddress) {
    AuthnRequestFromHubContainerDto authnRequestFromHub = sessionProxy.getAuthnRequestFromHub(sessionId);

    AuthnRequest request = authnRequestTransformer.apply(authnRequestFromHub.getSamlRequest());

    SamlValidationResponse samlSignatureValidationResponse = samlMessageSignatureValidator.validate(request, SPSSODescriptor.DEFAULT_ELEMENT_NAME);
    protectiveMonitoringLogger.logAuthnRequest(request, Direction.OUTBOUND, samlSignatureValidationResponse.isOK());

    if (!samlSignatureValidationResponse.isOK()) {
        SamlValidationSpecificationFailure failure = samlSignatureValidationResponse.getSamlValidationSpecificationFailure();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), samlSignatureValidationResponse.getCause(), Level.ERROR);
    }
    SamlMessage samlMessage = new SamlMessage(authnRequestFromHub.getSamlRequest(), SamlMessageType.SAML_REQUEST, Optional.fromNullable(sessionId.toString()), authnRequestFromHub.getPostEndpoint().toString(), Optional.of(authnRequestFromHub.getRegistering()));

    externalCommunicationEventLogger.logIdpAuthnRequest(request.getID(), sessionId, authnRequestFromHub.getPostEndpoint(), principalIpAddress);
    return samlMessage;
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Timed
public Response handleRequestPost(SamlRequestDto samlRequestDto) {

    relayStateValidator.validate(samlRequestDto.getRelayState());

    AuthnRequest authnRequest = stringSamlAuthnRequestTransformer.apply(samlRequestDto.getSamlRequest());

    SamlValidationResponse signatureValidationResponse = authnRequestSignatureValidator.validate(authnRequest, SPSSODescriptor.DEFAULT_ELEMENT_NAME);

    protectiveMonitoringLogger.logAuthnRequest(authnRequest, Direction.INBOUND, signatureValidationResponse.isOK());

    if (!signatureValidationResponse.isOK()) {
        SamlValidationSpecificationFailure failure = signatureValidationResponse.getSamlValidationSpecificationFailure();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), signatureValidationResponse.getCause(), Level.ERROR);
    }

    SamlAuthnRequestContainerDto samlAuthnRequestContainerDto = new SamlAuthnRequestContainerDto(samlRequestDto.getSamlRequest(), Optional.ofNullable(samlRequestDto.getRelayState()), samlRequestDto.getPrincipalIpAsSeenByFrontend());

    SessionId sessionId = sessionProxy.createSession(samlAuthnRequestContainerDto);
    return Response.ok(sessionId).build();
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Override
protected Response handleException(SamlTransformationErrorException exception) {
    UUID errorId = UUID.randomUUID();
    Optional<SessionId> sessionId = getSessionId();
    if (sessionId.isPresent()) {
        eventSinkMessageSender.audit(exception, errorId, sessionId.get());
    } else {
        eventSinkMessageSender.audit(exception, errorId, SessionId.NO_SESSION_CONTEXT_IN_ERROR);
    }

    levelLogger.log(exception.getLogLevel(), exception, errorId);

    ErrorStatusDto auditedErrorStatus = ErrorStatusDto.createAuditedErrorStatus(errorId, getExceptionTypeForSamlException(exception));

    return Response.serverError().entity(auditedErrorStatus).build();
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
public void validate(ValidatedResponse validatedResponse, Assertion validatedIdentityAssertion) {

        assertionValidator.validate(validatedIdentityAssertion, validatedResponse.getInResponseTo(), expectedRecipientId);

        if (validatedResponse.isSuccess()) {

            if (validatedIdentityAssertion.getAuthnStatements().size() > 1) {
                SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.multipleAuthnStatements();
                throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
            }

            authnStatementAssertionValidator.validate(validatedIdentityAssertion);
            eidasAttributeStatementAssertionValidator.validate(validatedIdentityAssertion);
            authnResponseIssuerValidator.validate(validatedResponse, validatedIdentityAssertion);
        }
    }
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@POST
public Response translateResponse(@NotNull @Valid TranslateSamlResponseBody translateSamlResponseBody) throws IOException {
    String entityId = entityIdService.getEntityId(translateSamlResponseBody);
    try {
        TranslatedResponseBody translatedResponseBody = responseService.convertTranslatedResponseBody(
            translateSamlResponseBody.getSamlResponse(),
            translateSamlResponseBody.getRequestId(),
            translateSamlResponseBody.getLevelOfAssurance(),
            entityId
        );

        LOG.info(String.format("Translated response for entityId: %s, requestId: %s, got Scenario: %s",
                entityId,
                translateSamlResponseBody.getRequestId(),
                translatedResponseBody.getScenario()));

        return Response.ok(translatedResponseBody).build();
    } catch (SamlResponseValidationException | SamlTransformationErrorException e) {
        LOG.warn(String.format("Error translating saml response for entityId: %s, requestId: %s, got Message: %s", entityId, translateSamlResponseBody.getRequestId(), e.getMessage()));
        return Response
            .status(BAD_REQUEST)
            .entity(new ErrorMessage(BAD_REQUEST.getStatusCode(), e.getMessage()))
            .build();
    }
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test
public void shouldReturn400WhenSamlTransformationErrorExceptionThrown() throws Exception {
    JSONObject translateResponseRequest = new JSONObject().put("samlResponse", "some-saml-response")
            .put("requestId", "some-request-id")
            .put("levelOfAssurance", LEVEL_2.name());

    when(responseService.convertTranslatedResponseBody(any(), eq("some-request-id"), eq(LEVEL_2), eq(defaultEntityId)))
            .thenThrow(new SamlTransformationErrorException("Some error.", Level.ERROR));

    Response response = resources.client()
        .target("/translate-response")
        .request()
        .post(json(translateResponseRequest.toString()));

    assertThat(response.getStatus()).isEqualTo(BAD_REQUEST.getStatusCode());

    ErrorMessage actualError = response.readEntity(ErrorMessage.class);
    assertThat(actualError.getCode()).isEqualTo(BAD_REQUEST.getStatusCode());
    assertThat(actualError.getMessage()).isEqualTo("Some error.");
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test
public void shouldFailValidationWhenMetadataDoesNotContainCorrectCertificate() throws Exception {
    expectedException.expect(SamlTransformationErrorException.class);
    expectedException.expectMessage("SAML Validation Specification: Signature was not valid.");

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(successStatus), testRpSigningCredential);
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_PUBLIC_CERT);

    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test
public void shouldFailValidationWhenResponseIsNotSigned() throws Exception {
    expectedException.expect(SamlTransformationErrorException.class);
    expectedException.expectMessage("SAML Validation Specification: Message signature is not signed");

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = createNoAttributeResponseBuilder(successStatus).withoutSigning().build();
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);

    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
private void validateAndLogSamlResponseSignature(Response samlResponse) {
    boolean isSigned = samlResponse.getIssuer() != null;
    if (isSigned) {
        SamlValidationResponse signatureValidationResponse = samlMessageSignatureValidator.validate(samlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME);
        protectiveMonitoringLogger.logAuthnResponse(samlResponse, Direction.OUTBOUND, signatureValidationResponse.isOK());

        if (!signatureValidationResponse.isOK()) {
            SamlValidationSpecificationFailure failure = signatureValidationResponse.getSamlValidationSpecificationFailure();
            throw new SamlTransformationErrorException(failure.getErrorMessage(), signatureValidationResponse.getCause(), Level.ERROR);
        }
    } else {
        protectiveMonitoringLogger.logAuthnResponse(samlResponse, Direction.OUTBOUND, null);
    }
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path(Urls.SamlProxyUrls.RESPONSE_POST_PATH)
@Timed
public Response handleResponsePost(SamlRequestDto samlRequestDto) {

    final SessionId sessionId = new SessionId(samlRequestDto.getRelayState());
    MDC.put("SessionId", sessionId);

    relayStateValidator.validate(samlRequestDto.getRelayState());

    org.opensaml.saml.saml2.core.Response samlResponse = stringSamlResponseTransformer.apply(samlRequestDto.getSamlRequest());

    SamlValidationResponse signatureValidationResponse = authnResponseSignatureValidator.validate(samlResponse, IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
    protectiveMonitoringLogger.logAuthnResponse(
            samlResponse,
            Direction.INBOUND,
            signatureValidationResponse.isOK());

    if (!signatureValidationResponse.isOK()) {
        SamlValidationSpecificationFailure failure = signatureValidationResponse.getSamlValidationSpecificationFailure();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), signatureValidationResponse.getCause(), Level.ERROR);
    }

    final SamlAuthnResponseContainerDto authnResponseDto = new SamlAuthnResponseContainerDto(
            samlRequestDto.getSamlRequest(),
            sessionId,
            samlRequestDto.getPrincipalIpAsSeenByFrontend()
    );

    return Response.ok(sessionProxy.receiveAuthnResponseFromIdp(authnResponseDto, sessionId)).build();
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@POST
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Path(Urls.SamlProxyUrls.EIDAS_RESPONSE_POST_PATH)
@Timed
public Response handleEidasResponsePost(SamlRequestDto samlRequestDto) {

    if (eidasAuthnResponseSignatureValidator.isPresent()) {
        final SessionId sessionId = new SessionId(samlRequestDto.getRelayState());
        MDC.put("SessionId", sessionId);

        relayStateValidator.validate(samlRequestDto.getRelayState());

        org.opensaml.saml.saml2.core.Response samlResponse = stringSamlResponseTransformer.apply(samlRequestDto.getSamlRequest());

        SamlValidationResponse signatureValidationResponse = eidasAuthnResponseSignatureValidator.get().validate(samlResponse, IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
        protectiveMonitoringLogger.logAuthnResponse(
            samlResponse,
            Direction.INBOUND,
            signatureValidationResponse.isOK());

        if (!signatureValidationResponse.isOK()) {
            SamlValidationSpecificationFailure failure = signatureValidationResponse.getSamlValidationSpecificationFailure();
            throw new SamlTransformationErrorException(failure.getErrorMessage(), signatureValidationResponse.getCause(), Level.ERROR);
        }

        final SamlAuthnResponseContainerDto authnResponseDto = new SamlAuthnResponseContainerDto(
            samlRequestDto.getSamlRequest(),
            sessionId,
            samlRequestDto.getPrincipalIpAsSeenByFrontend()
        );

        return Response.ok(sessionProxy.receiveAuthnResponseFromCountry(authnResponseDto, sessionId)).build();
    }
    return Response.status(Response.Status.NOT_FOUND).build();
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
private ExceptionType getExceptionTypeForSamlException(SamlTransformationErrorException exception) {
    if (exception instanceof SamlDuplicateRequestIdException) {
        return ExceptionType.INVALID_SAML_DUPLICATE_REQUEST_ID;
    } else if (exception instanceof SamlRequestTooOldException) {
        return ExceptionType.INVALID_SAML_REQUEST_TOO_OLD;
    } else {
        return ExceptionType.INVALID_SAML;
    }
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateAuthRequestFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    when(sessionProxy.getAuthnRequestFromHub(sessionId)).thenReturn(new AuthnRequestFromHubContainerDto(samlRequest, postEndPoint, true));
    AuthnRequest authnRequest = anAuthnRequest().withId(expectedSamlMessageId).build();
    when(authnRequestTransformer.apply(samlRequest)).thenReturn(authnRequest);
    when(samlMessageSignatureValidator.validate(authnRequest, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateAuthnRequestFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateAuthResponseFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    Response openSamlResponse = setUpAuthnResponseFromHub(sessionId, expectedSamlMessageId);

    when(samlMessageSignatureValidator.validate(openSamlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateAuthnResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test(expected = SamlTransformationErrorException.class)
public void generateErrorResponseFromHub_shouldThrowSamlTransformationException() throws MarshallingException, SignatureException {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();
    Response openSamlResponse = setUpErrorResponseFromHub(sessionId, expectedSamlMessageId);
    when(samlMessageSignatureValidator.validate(openSamlResponse, SPSSODescriptor.DEFAULT_ELEMENT_NAME)).thenReturn(SamlValidationResponse.anInvalidResponse(new SamlValidationSpecification("bad", true)));

    samlMessageSenderHandler.generateErrorResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Override
public Response toResponse(Exception exception) {
    final UUID errorId = UUID.randomUUID();
    Response.ResponseBuilder response = Response.status(Response.Status.BAD_REQUEST);

    // when creating a new exception here we want to create an unaudited application exception - this is to ensure
    // that the exception is audited by the calling application, as saml-engine no longer talks directly to
    // event sink

    if(exception instanceof ApplicationException) {
        ApplicationException applicationException = (ApplicationException)exception;
        response.entity(logAndGetErrorStatusDto(applicationException.getExceptionType().getLevel(), applicationException.getExceptionType(), applicationException, applicationException.getErrorId(), applicationException.isAudited()));
    } else if(exception instanceof SamlContextException) {
        SamlContextException contextException = (SamlContextException) exception;
        response.entity(logAndGetErrorStatusDto(contextException.getLogLevel(), contextException.getExceptionType(), exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else if(exception instanceof SamlFailedToDecryptException) {
        response.entity(logAndGetErrorStatusDto(((SamlFailedToDecryptException) exception).getLogLevel(), ExceptionType.INVALID_SAML_FAILED_TO_DECRYPT, exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else if(exception instanceof SamlDuplicateRequestIdException) {
        response.entity(logAndGetErrorStatusDto(((SamlDuplicateRequestIdException) exception).getLogLevel(), ExceptionType.INVALID_SAML_DUPLICATE_REQUEST_ID, exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else if(exception instanceof SamlRequestTooOldException) {
        response.entity(logAndGetErrorStatusDto(((SamlTransformationErrorException) exception).getLogLevel(), ExceptionType.INVALID_SAML_REQUEST_TOO_OLD, exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else if(exception instanceof SamlTransformationErrorException) {
        response.entity(logAndGetErrorStatusDto(((SamlTransformationErrorException) exception).getLogLevel(), ExceptionType.INVALID_SAML, exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else if(exception instanceof UnableToGenerateSamlException) {
        response.entity(logAndGetErrorStatusDto(((UnableToGenerateSamlException) exception).getLogLevel(), ExceptionType.INVALID_INPUT, exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else if (exception instanceof NoKeyConfiguredForEntityException) {
        response.entity(logAndGetErrorStatusDto(ERROR, ExceptionType.NO_KEY_CONFIGURED_FOR_ENTITY, exception, errorId, HAS_NOT_BEEN_AUDITED_YET));
    } else {
        levelLogger.log(WARN, exception, errorId);
    }

    return response.build();
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test()
public void shouldThrowIfResponseHasUnencryptedAssertions() {
    exception.expect(SamlTransformationErrorException.class);
    exception.expectMessage("Response has unencrypted assertion.");
    when(response.getAssertions()).thenReturn(ImmutableList.of(assertion));

    validator.validateAssertionPresence(response);
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test()
public void shouldThrowIfResponseIsSuccessfulButHasNoEncryptedAssertions() {
    exception.expect(SamlTransformationErrorException.class);
    exception.expectMessage("Success response has no unencrypted assertions.");
    when(response.getEncryptedAssertions()).thenReturn(Collections.emptyList());

    validator.validateAssertionPresence(response);
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test
public void shouldThrowIfResponseNotSuccessfulButHasEncryptedAssertions() {
    exception.expect(SamlTransformationErrorException.class);
    exception.expectMessage("Non-success response has unencrypted assertions. Should contain no assertions.");
    when(statusCode.getValue()).thenReturn(StatusCode.AUTHN_FAILED);
    when(response.getEncryptedAssertions()).thenReturn(ImmutableList.of(encryptedAssertion));

    validator.validateAssertionPresence(response);
}
 

import uk.gov.ida.saml.core.validation.SamlTransformationErrorException; //导入依赖的package包/类
@Test()
public void shouldThrowIfResponseIsSuccessfulButHasMultipleEncryptedAssertions() {
    exception.expect(SamlTransformationErrorException.class);
    exception.expectMessage("Response expected to contain 1 assertions. 2 assertion(s) found.");
    when(response.getEncryptedAssertions()).thenReturn(ImmutableList.of(encryptedAssertion, encryptedAssertion));

    validator.validateAssertionPresence(response);
}