CODEWITHSUNDEEP
saml-2.0
Swaraj Shekhar
Swaraj Shekhar

Reputation: 229

Validate SAML Response

I have a SAML response and few other data. Based on this, I need to validate if the response has been tampered or not. How can I do that?

What all I have?

  1. SAML Response with Signed Message & Assertion

  2. IdP EntityId

  3. SP EntityId

  4. SP ACS Endpoint

  5. Target URL

  6. Certificate of the IdP in X509 format.

Language needed: JAVA

Upvotes: 0

Views: 993

Answers (1)

Swaraj Shekhar
Swaraj Shekhar

Reputation: 229

Got a solution. If anyone is loking for it.

try {
            InputStream is = new FileInputStream("<CERTIFICATE FILE>");
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            Certificate cert = cf.generateCertificate(is);
            X509Certificate x509Certificate = (X509Certificate) cert;
            PublicKey pk = x509Certificate.getPublicKey();
            BasicX509Credential publicCredential = new BasicX509Credential();
            publicCredential.setPublicKey(pk);
            SignatureValidator signatureValidator = new SignatureValidator(publicCredential);
            SignableSAMLObject signableSAMLObject = (SignableSAMLObject) <XML OBJECT>;
            Signature signature = signableSAMLObject.getSignature();
            signatureValidator.validate(signature);
        }catch(Exception ex){
            // fail this.
        }

XML Object can be obtained from SAML Message using marshaller in following way:

String encodedMessage = request.getParameter(PARAM_SAML);
String decodedMessage = new String(Base64.decodeBase64(encodedMessage.getBytes()));
DefaultBootstrap.bootstrap();
BasicParserPool ppMgr = new BasicParserPool();
ppMgr.setNamespaceAware(true);
Document responseRoot = ppMgr.parse(new StringReader(decodedMessage));
UnmarshallerFactory unmarshallFactory = Configuration.getUnmarshallerFactory();
Unmarshaller unmarshaller = unmarshallFactory.getUnmarshaller(responseRoot.getDocumentElement());
XMLObject obj = unmarshaller.unmarshall(responseRoot.getDocumentElement());

Upvotes: 1

Related Questions