Skip to content

Commit df95a76

Browse files
yadvryadvr
committed
SAML2: add saml sso and slo apicmds skeleton, add classes to AuthManager
Signed-off-by: Rohit Yadav <[email protected]>
1 parent d9531fb commit df95a76

4 files changed

Lines changed: 168 additions & 0 deletions

File tree

‎api/src/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,7 @@ public class ApiConstants {
514514
public static final String VMPROFILE_ID = "vmprofileid";
515515
public static final String VMGROUP_ID = "vmgroupid";
516516
public static final String CS_URL = "csurl";
517+
public static final String IDP_URL = "idpurl";
517518
public static final String SCALEUP_POLICY_IDS = "scaleuppolicyids";
518519
public static final String SCALEDOWN_POLICY_IDS = "scaledownpolicyids";
519520
public static final String SCALEUP_POLICIES = "scaleuppolicies";

‎server/src/com/cloud/api/auth/APIAuthenticationManagerImpl.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ public List<Class<?>> getCommands() {
5757
s_commandList = new ArrayList<Class<?>>();
5858
s_commandList.add(DefaultLoginAPIAuthenticatorCmd.class);
5959
s_commandList.add(DefaultLogoutAPIAuthenticatorCmd.class);
60+
s_commandList.add(SAML2LoginAPIAuthenticatorCmd.class);
61+
s_commandList.add(SAML2LogoutAPIAuthenticatorCmd.class);
6062
}
6163
return s_commandList;
6264
}

‎server/src/com/cloud/api/auth/SAML2LoginAPIAuthenticatorCmd.java‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
18+
package com.cloud.api.auth;
19+
20+
import com.cloud.user.Account;
21+
import org.apache.cloudstack.api.APICommand;
22+
import org.apache.cloudstack.api.ApiConstants;
23+
import org.apache.cloudstack.api.ApiErrorCode;
24+
import org.apache.cloudstack.api.BaseCmd;
25+
import org.apache.cloudstack.api.Parameter;
26+
import org.apache.cloudstack.api.ServerApiException;
27+
import org.apache.cloudstack.api.response.LoginCmdResponse;
28+
import org.apache.log4j.Logger;
29+
30+
import javax.servlet.http.HttpServletResponse;
31+
import javax.servlet.http.HttpSession;
32+
import java.io.IOException;
33+
import java.util.Map;
34+
35+
@APICommand(name = "samlsso", description = "SP initiated SAML Single Sign On", requestHasSensitiveInfo = true, responseObject = LoginCmdResponse.class, entityType = {})
36+
public class SAML2LoginAPIAuthenticatorCmd extends BaseCmd implements APIAuthenticator {
37+
public static final Logger s_logger = Logger.getLogger(SAML2LoginAPIAuthenticatorCmd.class.getName());
38+
private static final String s_name = "loginresponse";
39+
40+
/////////////////////////////////////////////////////
41+
//////////////// API parameters /////////////////////
42+
/////////////////////////////////////////////////////
43+
@Parameter(name = ApiConstants.IDP_URL, type = CommandType.STRING, description = "Identity Provider SSO HTTP-Redirect binding URL", required = true)
44+
private String idpUrl;
45+
46+
/////////////////////////////////////////////////////
47+
/////////////////// Accessors ///////////////////////
48+
/////////////////////////////////////////////////////
49+
50+
public String getIdpUrl() {
51+
return idpUrl;
52+
}
53+
54+
/////////////////////////////////////////////////////
55+
/////////////// API Implementation///////////////////
56+
/////////////////////////////////////////////////////
57+
58+
@Override
59+
public String getCommandName() {
60+
return s_name;
61+
}
62+
63+
@Override
64+
public long getEntityOwnerId() {
65+
return Account.ACCOUNT_TYPE_NORMAL;
66+
}
67+
68+
@Override
69+
public void execute() throws ServerApiException {
70+
// We should never reach here
71+
throw new ServerApiException(ApiErrorCode.METHOD_NOT_ALLOWED, "This is an authentication api, cannot be used directly");
72+
}
73+
74+
@Override
75+
public String authenticate(String command, Map<String, Object[]> params, HttpSession session, String remoteAddress, String responseType, StringBuilder auditTrailSb, final HttpServletResponse resp) throws ServerApiException {
76+
77+
String response = null;
78+
try {
79+
resp.sendRedirect(getIdpUrl());
80+
81+
// TODO: create and send assertion with the URL as GET params
82+
83+
} catch (IOException e) {
84+
auditTrailSb.append("SP initiated SAML authentication using HTTP redirection failed:");
85+
auditTrailSb.append(e.getMessage());
86+
}
87+
return response;
88+
}
89+
90+
@Override
91+
public APIAuthenticationType getAPIType() {
92+
return APIAuthenticationType.LOGIN_API;
93+
}
94+
}

‎server/src/com/cloud/api/auth/SAML2LogoutAPIAuthenticatorCmd.java‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package com.cloud.api.auth;
18+
19+
import com.cloud.api.response.ApiResponseSerializer;
20+
import com.cloud.user.Account;
21+
import org.apache.cloudstack.api.APICommand;
22+
import org.apache.cloudstack.api.ApiErrorCode;
23+
import org.apache.cloudstack.api.BaseCmd;
24+
import org.apache.cloudstack.api.ServerApiException;
25+
import org.apache.cloudstack.api.response.LogoutCmdResponse;
26+
import org.apache.log4j.Logger;
27+
28+
import javax.servlet.http.HttpServletResponse;
29+
import javax.servlet.http.HttpSession;
30+
import java.util.Map;
31+
32+
@APICommand(name = "samlslo", description = "SAML Single Log Out API", responseObject = LogoutCmdResponse.class, entityType = {})
33+
public class SAML2LogoutAPIAuthenticatorCmd extends BaseCmd implements APIAuthenticator {
34+
public static final Logger s_logger = Logger.getLogger(SAML2LogoutAPIAuthenticatorCmd.class.getName());
35+
private static final String s_name = "logoutresponse";
36+
37+
/////////////////////////////////////////////////////
38+
/////////////// API Implementation///////////////////
39+
/////////////////////////////////////////////////////
40+
41+
@Override
42+
public String getCommandName() {
43+
return s_name;
44+
}
45+
46+
@Override
47+
public long getEntityOwnerId() {
48+
return Account.ACCOUNT_TYPE_NORMAL;
49+
}
50+
51+
@Override
52+
public void execute() throws ServerApiException {
53+
// We should never reach here
54+
throw new ServerApiException(ApiErrorCode.METHOD_NOT_ALLOWED, "This is an authentication api, cannot be used directly");
55+
}
56+
57+
@Override
58+
public String authenticate(String command, Map<String, Object[]> params, HttpSession session, String remoteAddress, String responseType, StringBuilder auditTrailSb, final HttpServletResponse resp) throws ServerApiException {
59+
auditTrailSb.append("=== Logging out ===");
60+
// TODO: check global config and do either local or global log out
61+
LogoutCmdResponse response = new LogoutCmdResponse();
62+
response.setDescription("success");
63+
response.setResponseName(getCommandName());
64+
return ApiResponseSerializer.toSerializedString(response, responseType);
65+
}
66+
67+
@Override
68+
public APIAuthenticationType getAPIType() {
69+
return APIAuthenticationType.LOGOUT_API;
70+
}
71+
}

0 commit comments

Comments
 (0)