import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
/**
 * Validate audience by matching the SP entityId.
 *
 * @param audienceRestrictions the audience restrictions
 * @param spEntityId the sp entity id
 */
protected final void validateAudienceRestrictions(final List<AudienceRestriction> audienceRestrictions,
                                                  final String spEntityId) {

    if (audienceRestrictions == null || audienceRestrictions.isEmpty()) {
        throw new SAMLException("Audience restrictions cannot be null or empty");
    }

    final Set<String> audienceUris = new HashSet<String>();
    for (final AudienceRestriction audienceRestriction : audienceRestrictions) {
        if (audienceRestriction.getAudiences() != null) {
            for (final Audience audience : audienceRestriction.getAudiences()) {
                audienceUris.add(audience.getAudienceURI());
            }
        }
    }
    if (!audienceUris.contains(spEntityId)) {
        throw new SAMLException("Assertion audience " + audienceUris + " does not match SP configuration "
                + spEntityId);
    }
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
/**
 * New conditions element.
 *
 * @param notBefore the not before
 * @param notOnOrAfter the not on or after
 * @param audienceUri the service id
 * @return the conditions
 */
public Conditions newConditions(final DateTime notBefore, final DateTime notOnOrAfter, final String audienceUri) {
    final Conditions conditions = newSamlObject(Conditions.class);
    conditions.setNotBefore(notBefore);
    conditions.setNotOnOrAfter(notOnOrAfter);

    final AudienceRestriction audienceRestriction = newSamlObject(AudienceRestriction.class);
    final Audience audience = newSamlObject(Audience.class);
    audience.setAudienceURI(audienceUri);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
/**
 * New conditions element.
 *
 * @param notBefore    the not before
 * @param notOnOrAfter the not on or after
 * @param audienceUri  the service id
 * @return the conditions
 */
public Conditions newConditions(final ZonedDateTime notBefore, final ZonedDateTime notOnOrAfter, final String audienceUri) {
    LOGGER.debug("Building conditions for audience [{}] that enforce not-before [{}] and not-after [{}]", audienceUri, notBefore, notOnOrAfter);
    final Conditions conditions = newSamlObject(Conditions.class);
    conditions.setNotBefore(DateTimeUtils.dateTimeOf(notBefore));
    conditions.setNotOnOrAfter(DateTimeUtils.dateTimeOf(notOnOrAfter));

    final AudienceRestriction audienceRestriction = newSamlObject(AudienceRestriction.class);
    final Audience audience = newSamlObject(Audience.class);
    audience.setAudienceURI(audienceUri);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
public void validate(List<AudienceRestriction> audienceRestrictions, String entityId) {
    if (audienceRestrictions == null || audienceRestrictions.size() != 1) {
        throw new SamlResponseValidationException("Exactly one audience restriction is expected.");
    }

    List<Audience> audiences = audienceRestrictions.get(0).getAudiences();
    if (audiences == null || audiences.size() != 1) {
        throw new SamlResponseValidationException("Exactly one audience is expected.");
    }

    String audience = audiences.get(0).getAudienceURI();
    if (!entityId.equals(audience)) {
        throw new SamlResponseValidationException(String.format("Audience must match entity ID. Expected %s but was %s", entityId, audience));
    }
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldNotComplainWhenCorrectDataIsPassed() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI("some-entity-id");

    AudienceRestriction audienceRestriction = mock(AudienceRestriction.class, Answers.RETURNS_DEEP_STUBS);
    when(audienceRestriction.getAudiences()).thenReturn(ImmutableList.of(audience));

    validator.validate(ImmutableList.of(audienceRestriction), "some-entity-id");
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldThrowExceptionWhenAudienceUriDoesNotMatchTheEntityId() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI("some-entity-id");

    AudienceRestriction audienceRestriction = mock(AudienceRestriction.class, Answers.RETURNS_DEEP_STUBS);
    when(audienceRestriction.getAudiences()).thenReturn(ImmutableList.of(audience));

    expectedException.expect(SamlResponseValidationException.class);
    expectedException.expectMessage(String.format("Audience must match entity ID. Expected %s but was %s", "unknown-entity-id", "some-entity-id"));

    validator.validate(ImmutableList.of(audienceRestriction), "unknown-entity-id");
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
public AudienceValidator(final Function<T, Audience> valueProvider, final String audienceUri) {
    super(
        true,
        valueProvider,
        new RequiredValidator<>(DEFAULT_REQUIRED_MESSAGE),
        new RequiredValidator<>(DEFAULT_REQUIRED_URI_MESSAGE, Audience::getAudienceURI),
        new FixedErrorValidator<>(a -> !a.getAudienceURI().equals(audienceUri), generateMismatchedAudienceUriMessage(audienceUri))
    );
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
private static Conditions aConditions() {
    Conditions conditions = new ConditionsBuilder().buildObject();
    conditions.setNotBefore(DateTime.now());
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(10));
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(HUB_SECONDARY_ENTITY_ID);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
private static Conditions aConditions() {
    Conditions conditions = new ConditionsBuilder().buildObject();
    conditions.setNotBefore(DateTime.now());
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(10));
    AudienceRestriction audienceRestriction = new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(HUB_SECONDARY_ENTITY_ID);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldReturnErrorIfAudienceUriIsNotFound() {
    Audience audience = new AudienceBuilder().buildObject();
    Messages messages = validator.validate(audience, messages());

    assertThat(messages.size()).isEqualTo(1);
    assertThat(messages.hasErrorLike(DEFAULT_REQUIRED_URI_MESSAGE)).isTrue();
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldReturnErrorIfAudienceUriIsEmpty() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI("");
    Messages messages = validator.validate(audience, messages());

    assertThat(messages.size()).isEqualTo(1);
    assertThat(messages.hasErrorLike(DEFAULT_REQUIRED_URI_MESSAGE)).isTrue();
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldReturnErrorIfAudienceUriDoesNotMatchExpectedEntityId() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI("invalidEntityId");
    Messages messages = validator.validate(audience, messages());

    assertThat(messages.size()).isEqualTo(1);
    assertThat(messages.hasErrorLike(generateMismatchedAudienceUriMessage(AUDIENCE_URI))).isTrue();
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldValidateAudienceUriSuccessfully() {
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(AUDIENCE_URI);
    Messages messages = validator.validate(audience, messages());

    assertThat(messages.size()).isEqualTo(0);
    assertThat(messages.hasErrors()).isFalse();
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Before
public void setUp() throws Exception {
    DateTimeUtils.setCurrentMillisFixed(NOW.getMillis());
    validator = new ConditionsValidator<>(conditions -> conditions, AUDIENCE_URI);

    audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(AUDIENCE_URI);
    audienceRestriction.getAudiences().add(audience);
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
private Conditions aConditions() {
    Conditions conditions = new ConditionsBuilder().buildObject();
    conditions.setNotBefore(DateTime.now());
    conditions.setNotOnOrAfter(DateTime.now().plusMinutes(10));
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(HUB_CONNECTOR_ENTITY_ID);
    audienceRestriction.getAudiences().add(audience);
    conditions.getAudienceRestrictions().add(audienceRestriction);
    return conditions;
}
 

import org.opensaml.saml.saml2.core.Audience; //导入依赖的package包/类
@Test
public void shouldValidateAudienceRestrictionSuccessfully() {
    AudienceRestriction audienceRestriction= new AudienceRestrictionBuilder().buildObject();
    Audience audience = new AudienceBuilder().buildObject();
    audience.setAudienceURI(AUDIENCE_URI);
    audienceRestriction.getAudiences().add(audience);

    Messages messages = validator.validate(audienceRestriction, messages());

    assertThat(messages.size()).isEqualTo(0);
}