[WSS-286] Evidence element not present in SAML AuthzDecisionStatement

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6
• Fix Version/s: 1.6.1
• Component/s: WSS4J Core, WSS4J Handlers
• Environment: CXF 2.4.0, WS4J 1.6.0, Windows XP, Apache Tomcat 7.0.5
• Assignee: Colm O hEigeartaigh
• Reporter: David Morris
• Created: 19/May/11 12:30
• Updated: 03/Jun/11 16:40
• Resolved: 20/May/11 13:29

Description

Running SOAPUI test, the SAML AuthzDecisionStatement evidence element is not present. The code worked with openSAML2.0 and CXF 2.3.x (via interceptors) before SAMLCallBackHandler in CXF 2.4.0. Resolved issue below example.

Example:

<saml2:AuthzDecisionStatement>
<saml2:Action.../>
<saml2:Evidence...> <!-this is missing – >
<saml2:Assertion...>
</saml2:Evidence>
</saml2:AuthzDecisionStatement>

//Build Evidence
EvidenceBuilder evidenceBuilder = new EvidenceBuilder(); Evidence
evidence = evidenceBuilder.buildObject();

//Build assertion for Evidence
AssertionBuilder assertionBuilder = new AssertionBuilder(); Assertion
assertion = assertionBuilder.buildObject();
assertion.setVersion(SAMLVersion.VERSION_20);
...
authDecisionStatementBean.setEvidence(evidence);

Resolution updated the createAuthorizationDecisionStatement method in org.apache.ws.security.saml.ext.builder.SAML2ComponentBuilder:

/**

• Create SAML2 AuthorizationDecisionStatement(s)
  *
• @param decisionData A list of AuthDecisionStatementBean instances
• @return SAML2 AuthorizationDecisionStatement(s)
  */
  @SuppressWarnings("unchecked")
  public static List<AuthzDecisionStatement> createAuthorizationDecisionStatement(
  List<AuthDecisionStatementBean> decisionData
  ) {

List<AuthzDecisionStatement> authDecisionStatements = new ArrayList();
if (authorizationDecisionStatementBuilder == null)

{ authorizationDecisionStatementBuilder = (SAMLObjectBuilder<AuthzDecisionStatement>) builderFactory.getBuilder(AuthzDecisionStatement.DEFAULT_ELEMENT_NAME); }

if (decisionData != null && decisionData.size() > 0) {
for (AuthDecisionStatementBean decisionStatementBean : decisionData) {
AuthzDecisionStatement authDecision =
authorizationDecisionStatementBuilder.buildObject();
authDecision.setResource(decisionStatementBean.getResource());
authDecision.setDecision(
transformDecisionType(decisionStatementBean.getDecision())
);

for (ActionBean actionBean : decisionStatementBean.getActions())

{ Action actionElement = createSamlAction(actionBean); authDecision.getActions().add(actionElement); }

//Check for Evidence
if (decisionStatementBean.getEvidence()!=null && decisionStatementBean.getEvidence() instanceof Evidence)

{ authDecision.setEvidence((Evidence)decisionStatementBean.getEvidence()); }

authDecisionStatements.add(authDecision);
}
}

return authDecisionStatements;
}