Package org.opensaml.saml.common.binding

# Class SAMLBindingSupport

java.lang.Object
org.opensaml.saml.common.binding.SAMLBindingSupport

public final class SAMLBindingSupport extends Object
A support class for SAML binding operations.

## Field Summary

Fields
Modifier and Type
Field
Description
`private static final org.slf4j.Logger`
`LOG`
Logger.

## Constructor Summary

Constructors
Modifier
Constructor
Description
`private`
`SAMLBindingSupport()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`static boolean`
`checkRelayState(String relayState)`
Checks that the relay state is 80 bytes or less if it is not null.
`static void`
`checkSAML1MessageType(boolean expectRequest, SAMLObject message)`
Evaluate a SAML 1 message `SAMLObject` as to whether it is the expected message type (request vs response).
`static void`
`checkSAML2MessageType(boolean expectRequest, SAMLObject message)`
Evaluate a SAML 2 message `SAMLObject` as to whether it is the expected message type (request vs response).
`static int`
`convertSAML2ArtifactEndpointIndex(byte[] artifactEndpointIndex)`
Convert a 2-byte artifact endpoint index byte[] as typically used by SAML 2 artifact types to an integer, appropriate for use with `IndexedEndpoint` impls.
`static void`
`evaluateMessageSizeLimit(boolean enforcementEnabled, Integer messageSizeLimit, Integer messageSize)`
Evaluate message size limit using the supplied parameters.
`static void`
`evaluateMessageSizeLimit(boolean enforcementEnabled, Integer messageSizeLimit, Integer messageSize, String description)`
Evaluate message size limit using the supplied parameters.
`static String`
`getActualReceiverEndpointURI(MessageContext messageContext)`
Extract the transport endpoint URI at which this message was received.
`static String`
`getActualReceiverEndpointURI(MessageContext messageContext, HttpServletRequest request)`
Extract the transport endpoint URI at which this message was received.
`static Integer`
`getBase64Size(String encoded)`
Efficiently get the size of Base64-encoded data if it were decoded.
`static Integer`
`getDeflatedSize(String deflatedAndEncoded, boolean estimated, Float inflationFactor)`
Get the size of deflated and Base64-encoded data if it were decoded then inflated.
`static URI`
`getEndpointURL(MessageContext messageContext)`
Get the response URL from the relying party endpoint.
`static URI`
`getEndpointURLOrNull(MessageContext messageContext)`
Get the response URL from the relying party endpoint.
`static String`
`getIntendedDestinationEndpointURI(MessageContext messageContext)`
Extract the message information which indicates to what receiver endpoint URI the SAML message was intended to be delivered.
`static MessageType`
`getMessageType(HttpServletRequest httpRequest)`
Get the type of message being processed.
`static String`
`getRelayState(MessageContext messageContext)`
Get the SAML protocol relay state from a message context.
`static boolean`
`isIntendedDestinationEndpointURIRequired(MessageContext messageContext)`
Determine whether the binding in use requires the presence within the message of information indicating the intended message destination endpoint URI.
`static boolean`
`isMessageSigned(MessageContext messageContext)`
Determine whether the SAML message represented by the message context is digitally signed.
`static boolean`
`isMessageSigned(MessageContext messageContext, boolean presenceSatisfies)`
Determine whether the SAML message represented by the message context is digitally signed.
`static boolean`
`isSigningCapableBinding(MessageContext messageContext)`
Determine whether the SAML binding to be used by the message context supports signatures at the binding layer.
`static void`
`setRelayState(MessageContext messageContext, String relayState)`
Set the SAML protocol relay state on a message context.
`static void`
`setSAML1ResponseRecipient(SAMLObject outboundMessage, String endpointURL)`
Sets the destination attribute on the outbound message if it is a `ResponseAbstractType` message.
`static void`
`setSAML2Destination(SAMLObject outboundMessage, String endpointURL)`
Sets the destination attribute on an outbound message if it is either a `RequestAbstractType` or a `StatusResponseType` message.
`static void`
`validateMessageTypeValues(HttpServletRequest httpRequest, MessageType messageType)`
Validate that an HTTP request has a valid number of values for the specified message type.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### LOG

@Nonnull private static final org.slf4j.Logger LOG
Logger.

## Constructor Details

### SAMLBindingSupport

private SAMLBindingSupport()
Constructor.

## Method Details

### getRelayState

@Nullable @NotEmpty public static String getRelayState(@Nonnull MessageContext messageContext)
Get the SAML protocol relay state from a message context.

Parameters:
  `messageContext` - the message context on which to operate
Returns:
  the relay state or null

### setRelayState

public static void setRelayState(@Nonnull MessageContext messageContext, @Nullable String relayState)
Set the SAML protocol relay state on a message context.

Parameters:
  `messageContext` - the message context on which to operate
  `relayState` - the relay state to set

### checkRelayState

public static boolean checkRelayState(@Nullable String relayState)
Checks that the relay state is 80 bytes or less if it is not null.

Parameters:
  `relayState` - relay state to check
Returns:
  true if the relay state is not empty and is less than 80 bytes

### getEndpointURLOrNull

@Nullable public static URI getEndpointURLOrNull(@Nonnull MessageContext messageContext)
Get the response URL from the relying party endpoint. If the SAML message is a response and the relying party endpoint contains a response location then that location is returned otherwise the normal endpoint location is returned.

Instead of raising an exception, this variant returns null in the event of an inability to identify a URL to return.

Parameters:
  `messageContext` - current message context
Returns:
  response URL from the relying party endpoint or null
Since:
  5.2.0

### getEndpointURL

@Nonnull public static URI getEndpointURL(@Nonnull MessageContext messageContext) throws BindingException
Get the response URL from the relying party endpoint. If the SAML message is a response and the relying party endpoint contains a response location then that location is returned otherwise the normal endpoint location is returned.

Parameters:
  `messageContext` - current message context
Returns:
  response URL from the relying party endpoint
Throws:
  `BindingException` - throw if no relying party endpoint is available

### setSAML1ResponseRecipient

public static void setSAML1ResponseRecipient(@Nonnull SAMLObject outboundMessage, @Nonnull @NotEmpty String endpointURL)
Sets the destination attribute on the outbound message if it is a `ResponseAbstractType` message.

Parameters:
  `outboundMessage` - outbound SAML message
  `endpointURL` - destination endpoint

### setSAML2Destination

public static void setSAML2Destination(@Nonnull SAMLObject outboundMessage, @Nonnull @NotEmpty String endpointURL)
Sets the destination attribute on an outbound message if it is either a `RequestAbstractType` or a `StatusResponseType` message.

Parameters:
  `outboundMessage` - outbound SAML message
  `endpointURL` - destination endpoint

### isMessageSigned

public static boolean isMessageSigned(@Nonnull MessageContext messageContext)
Determine whether the SAML message represented by the message context is digitally signed.

First the SAML protocol message is examined as to whether an XML signature is present at the DOM level; if yes return true. Finally, the presence of a binding signature is evaluated by looking at `SAMLBindingContext.hasBindingSignature()`.

Parameters:
  `messageContext` - current message context
Returns:
  true if the message is considered to be digitally signed, false otherwise

### isMessageSigned

public static boolean isMessageSigned(@Nonnull MessageContext messageContext, boolean presenceSatisfies)
Determine whether the SAML message represented by the message context is digitally signed.

First the SAML protocol message is examined as to whether an XML signature is present at the DOM level; if yes return true. Next if `presenceSatisfies` is true, then `SignableXMLObject.getSignature()` is evaluated for a non-null value; if yes return true. Finally, the presence of a binding signature is evaluated by looking at `SAMLBindingContext.hasBindingSignature()`.

Parameters:
  `messageContext` - current message context
  `presenceSatisfies` - whether the presence of a non-null `Signature` member satisfies the evaluation
Returns:
  true if the message is considered to be digitally signed, false otherwise

### isSigningCapableBinding

public static boolean isSigningCapableBinding(@Nonnull MessageContext messageContext)
Determine whether the SAML binding to be used by the message context supports signatures at the binding layer.

The capability of the binding is determined by extracting a `BindingDescriptor` from a `SAMLBindingContext`.

Parameters:
  `messageContext` - current message context
Returns:
  true if the message is considered to be digitally signed, false otherwise

### isIntendedDestinationEndpointURIRequired

public static boolean isIntendedDestinationEndpointURIRequired(@Nonnull MessageContext messageContext)
Determine whether the binding in use requires the presence within the message of information indicating the intended message destination endpoint URI.

Parameters:
  `messageContext` - current SAML message context
Returns:
  true if the intended message destination endpoint is required, false if not

### getIntendedDestinationEndpointURI

@Nullable public static String getIntendedDestinationEndpointURI(@Nonnull MessageContext messageContext) throws MessageException
Extract the message information which indicates to what receiver endpoint URI the SAML message was intended to be delivered.

Parameters:
  `messageContext` - the SAML message context being processed
Returns:
  the value of the intended destination endpoint URI, or null if not present or empty
Throws:
  `MessageException` - thrown if the message is not an instance of SAML message that could be processed by the decoder

### getActualReceiverEndpointURI

@Nonnull public static String getActualReceiverEndpointURI(@Nonnull MessageContext messageContext, @Nonnull HttpServletRequest request) throws MessageException
Extract the transport endpoint URI at which this message was received.

Parameters:
  `messageContext` - current message context
  `request` - the HttpServletRequest being evaluated
Returns:
  string representing the transport endpoint URI at which the current message was received
Throws:
  `MessageException` - thrown if the endpoint can not be looked up from the message context and converted to a string representation

### getActualReceiverEndpointURI

@Nullable public static String getActualReceiverEndpointURI(@Nonnull MessageContext messageContext) throws MessageException
Extract the transport endpoint URI at which this message was received.

Parameters:
  `messageContext` - current message context
Returns:
  string representing the transport endpoint URI at which the current message was received
Throws:
  `MessageException` - thrown if the endpoint can not be looked up from the message context and converted to a string representation
Since:
  5.2.0

### convertSAML2ArtifactEndpointIndex

public static int convertSAML2ArtifactEndpointIndex(@Nonnull byte[] artifactEndpointIndex)
Convert a 2-byte artifact endpoint index byte[] as typically used by SAML 2 artifact types to an integer, appropriate for use with `IndexedEndpoint` impls.

The max input value supported is 0x7FFF (32767), which is the largest possible unsigned 16 bit value. This should be more than sufficient for typical SAML cases.

Parameters:
  `artifactEndpointIndex` - the endpoint index byte array, must have length == 2, and big endian byte order.
Returns:
  the convert integer value

### checkSAML1MessageType

public static void checkSAML1MessageType(boolean expectRequest, @Nonnull SAMLObject message) throws MessageDecodingException
Evaluate a SAML 1 message `SAMLObject` as to whether it is the expected message type (request vs response).

Parameters:
  `expectRequest` - true if a SAML 1 request is expected (an instance of `RequestAbstractType`, false if a SAML 1 response is expected (an instance of `ResponseAbstractType`
  `message` - the message to evaluate
Throws:
  `MessageDecodingException` - if the message being evaluated is not the expected type

### checkSAML2MessageType

public static void checkSAML2MessageType(boolean expectRequest, @Nonnull SAMLObject message) throws MessageDecodingException
Evaluate a SAML 2 message `SAMLObject` as to whether it is the expected message type (request vs response).

Parameters:
  `expectRequest` - true if a SAML 2 request is expected (an instance of `RequestAbstractType`, false if a SAML 2 response is expected (an instance of `ResponseAbstractType`
  `message` - the message to evaluate
Throws:
  `MessageDecodingException` - if the message being evaluated is not the expected type

### getMessageType

@Nullable public static MessageType getMessageType(@Nonnull HttpServletRequest httpRequest)
Get the type of message being processed.

Parameters:
  `httpRequest` - the HTTP request
Returns:
  the message type, or null if the HTTP request is malformed with respect to SAML message parameters

### validateMessageTypeValues

public static void validateMessageTypeValues(@Nonnull HttpServletRequest httpRequest, @Nonnull MessageType messageType) throws MessageDecodingException
Validate that an HTTP request has a valid number of values for the specified message type.

Parameters:
  `httpRequest` - the HTTP request
  `messageType` - the message type
Throws:
  `MessageDecodingException` - if the HTTP request has an invalid number of values for the specified message type

### evaluateMessageSizeLimit

public static void evaluateMessageSizeLimit(boolean enforcementEnabled, @Nullable Integer messageSizeLimit, @Nullable Integer messageSize) throws MessageDecodingException
Evaluate message size limit using the supplied parameters.

Parameters:
  `enforcementEnabled` - whether enforcement of message size limit is enabled
  `messageSizeLimit` - the message size limit
  `messageSize` - the received message size
Throws:
  `MessageDecodingException` - if evaluation is enabled and either 1) message size exceeds the limit or 2) the message size or limit is null

### evaluateMessageSizeLimit

public static void evaluateMessageSizeLimit(boolean enforcementEnabled, @Nullable Integer messageSizeLimit, @Nullable Integer messageSize, @Nullable String description) throws MessageDecodingException
Evaluate message size limit using the supplied parameters.

Parameters:
  `enforcementEnabled` - whether enforcement of message size limit is enabled
  `messageSizeLimit` - the message size limit
  `messageSize` - the received message size
  `description` - description of what is being evaluated
Throws:
  `MessageDecodingException` - if evaluation is enabled and either 1) message size exceeds the limit or 2) the message size or limit is null

### getBase64Size

@Nonnull public static Integer getBase64Size(@Nullable String encoded)
Efficiently get the size of Base64-encoded data if it were decoded.

Parameters:
  `encoded` - the Base64-encoded data
Returns:
  the size of the data when decoded, in bytes

### getDeflatedSize

@Nonnull public static Integer getDeflatedSize(@Nullable String deflatedAndEncoded, boolean estimated, @Nullable Float inflationFactor) throws MessageDecodingException
Get the size of deflated and Base64-encoded data if it were decoded then inflated.

If `estimated` is true, then the size is estimated efficiently by simply applying the specified `inflationFactor` against the result of `getBase64Size(String)`. This is very fast but the accuracy will depend entirely on the `inflationFactor` that is used, so it must be chosen based on knowledge of the compressibility of the data.

If `estimated` is false, then the encoded data is actually Base64-decoded and then inflated and the size is the length of the resulting `byte[]`. This is computationally more expensive, but will give an exact size.

Parameters:
  `deflatedAndEncoded` - the deflated and Base64-encoded data
  `estimated` - flag indicating whether an exact or an estimated value should be determined
  `inflationFactor` - for estimated mode the multiplier applied against the Base64-decoded size. Should be greater than 1.0
Returns:
  the size of the data when Base64-decoded and inflated, in bytes
Throws:
  `MessageDecodingException` - if estimated was true and inflationFactor is null, or if there was a fatal error during Base64-decoding or inflation