Skip to content

Commit 10e493f

Browse files
pitbulkpitbulk
committed
Set strict default value as true
1 parent beb5c04 commit 10e493f

File tree

6 files changed

+17
-13
lines changed

6 files changed

+17
-13
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,10 @@ Add SAML support to your Java applications using this library.
66
Forget those complicated libraries and use that open source library provided and supported by OneLogin Inc.
77

88
Version >= 2.5.0 compatible with java7 / java8 / java9.
9+
2.5.0 sets the 'strict' setting parameter to true.
910
2.5.0 uses xmlsec 2.1.4 which fixes [CVE-2019-12400](https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-460281)
1011

12+
1113
Version 2.0.0 - 2.4.0, compatible with java7 / java8.
1214

1315
We [introduced some incompatibilities](https://github.com/onelogin/java-saml/issues/90), that could be fixed and make it compatible with java6.

‎core/src/main/java/com/onelogin/saml2/settings/Saml2Settings.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public class Saml2Settings {
3131
private static final Logger LOGGER = LoggerFactory.getLogger(Saml2Settings.class);
3232

3333
// Toolkit settings
34-
private boolean strict = false;
34+
private boolean strict = true;
3535
private boolean debug = false;
3636

3737
// SP

‎core/src/test/java/com/onelogin/saml2/test/authn/AuthnResponseTest.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -364,6 +364,7 @@ public void testGetNameIdNoKey() throws Exception {
364364
@Test
365365
public void testGetNameIdEmptyNameIDValue() throws Exception {
366366
Saml2Settings settings = new SettingsBuilder().fromFile("config/config.min.properties").build();
367+
settings.setStrict(false);
367368
String samlResponseEncoded = Util.getFileAsString("data/responses/invalids/empty_nameid.xml.base64");
368369
SamlResponse samlResponse = new SamlResponse(settings, newHttpRequest(samlResponseEncoded));
369370
String nameId = samlResponse.getNameId();
@@ -499,6 +500,7 @@ public void testGetNameIdDataWrongSPNameQualifier() throws Exception {
499500
@Test
500501
public void testGetNameIdDataEmptyNameIDValue() throws Exception {
501502
Saml2Settings settings = new SettingsBuilder().fromFile("config/config.min.properties").build();
503+
settings.setStrict(false);
502504
String samlResponseEncoded = Util.getFileAsString("data/responses/invalids/empty_nameid.xml.base64");
503505
SamlResponse samlResponse = new SamlResponse(settings, newHttpRequest(samlResponseEncoded));
504506
Map<String, String> nameIdData = samlResponse.getNameIdData();
@@ -2140,6 +2142,7 @@ public void testIsInValidEncIssues() throws IOException, Error, XPathExpressionE
21402142
@Test
21412143
public void testIsInValidCert() throws IOException, Error, XPathExpressionException, ParserConfigurationException, SAXException, SettingsException, ValidationError {
21422144
Saml2Settings settings = new SettingsBuilder().fromFile("config/config.invalididpcertstring.properties").build();
2145+
settings.setStrict(false);
21432146
String samlResponseEncoded = Util.getFileAsString("data/responses/valid_response.xml.base64");
21442147
SamlResponse samlResponse = new SamlResponse(settings, newHttpRequest(samlResponseEncoded));
21452148
assertFalse(samlResponse.isValid());

‎core/src/test/java/com/onelogin/saml2/test/settings/Saml2SettingsTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ public class Saml2SettingsTest {
3939
public void testIsStrict() {
4040
Saml2Settings settings = new Saml2Settings();
4141

42-
assertFalse(settings.isStrict());
43-
settings.setStrict(true);
4442
assertTrue(settings.isStrict());
4543
settings.setStrict(false);
4644
assertFalse(settings.isStrict());
45+
settings.setStrict(true);
46+
assertTrue(settings.isStrict());
4747
}
4848

4949
/**

‎core/src/test/java/com/onelogin/saml2/test/settings/SettingBuilderTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ public void testLoadFromFileEmpty() throws IOException, CertificateException, UR
7676
Saml2Settings setting = new SettingsBuilder().fromFile("config/config.empty.properties").build();
7777

7878
assertFalse(setting.isDebugActive());
79-
assertFalse(setting.isStrict());
79+
assertTrue(setting.isStrict());
8080

8181
assertTrue(setting.getSpEntityId().isEmpty());
8282
assertNull(setting.getSpAssertionConsumerServiceUrl());
@@ -130,7 +130,7 @@ public void testLoadFromFileMinProp() throws IOException, CertificateException,
130130
Saml2Settings setting = new SettingsBuilder().fromFile("config/config.min.properties").build();
131131

132132
assertFalse(setting.isDebugActive());
133-
assertFalse(setting.isStrict());
133+
assertTrue(setting.isStrict());
134134

135135
assertEquals("http://localhost:8080/java-saml-jspsample/metadata.jsp", setting.getSpEntityId());
136136
assertEquals("http://localhost:8080/java-saml-jspsample/acs.jsp", setting.getSpAssertionConsumerServiceUrl().toString());
@@ -569,7 +569,7 @@ public void testFromProperties() throws IOException, Error, CertificateException
569569
Saml2Settings setting2 = new SettingsBuilder().fromProperties(prop).build();
570570

571571
assertFalse(setting2.isDebugActive());
572-
assertFalse(setting2.isStrict());
572+
assertTrue(setting2.isStrict());
573573

574574
assertEquals("http://localhost:8080/java-saml-jspsample/metadata.jsp", setting2.getSpEntityId());
575575
assertEquals("http://localhost:8080/java-saml-jspsample/acs.jsp", setting2.getSpAssertionConsumerServiceUrl().toString());

‎samples/java-saml-tookit-jspsample/src/main/resources/onelogin.saml.properties‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# If 'strict' is True, then the Java Toolkit will reject unsigned
22
# or unencrypted messages if it expects them signed or encrypted
33
# Also will reject the messages if not strictly follow the SAML
4-
onelogin.saml2.strict = false
4+
onelogin.saml2.strict = true
55

66
# Enable debug mode (to print errors)
77
onelogin.saml2.debug = false
@@ -50,33 +50,32 @@ onelogin.saml2.sp.privatekey =
5050
#
5151

5252
# Identifier of the IdP entity (must be a URI)
53-
onelogin.saml2.idp.entityid = https://app.onelogin.com/saml/metadata/672234
53+
onelogin.saml2.idp.entityid =
5454

5555
# SSO endpoint info of the IdP. (Authentication Request protocol)
5656
# URL Target of the IdP where the SP will send the Authentication Request Message
57-
onelogin.saml2.idp.single_sign_on_service.url = https://sgarcia-us-preprod.onelogin.com/trust/saml2/http-post/sso/672234
58-
57+
onelogin.saml2.idp.single_sign_on_service.url =
5958
# SAML protocol binding to be used when returning the <Response>
6059
# message. Onelogin Toolkit supports for this endpoint the
6160
# HTTP-Redirect binding only
6261
onelogin.saml2.idp.single_sign_on_service.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
6362

6463
# SLO endpoint info of the IdP.
6564
# URL Location of the IdP where the SP will send the SLO Request
66-
onelogin.saml2.idp.single_logout_service.url = https://sgarcia-us-preprod.onelogin.com/trust/saml2/http-redirect/slo/672234
65+
onelogin.saml2.idp.single_logout_service.url =
6766

6867
# Optional SLO Response endpoint info of the IdP.
6968
# URL Location of the IdP where the SP will send the SLO Response. If left blank, same URL as onelogin.saml2.idp.single_logout_service.url will be used.
7069
# Some IdPs use a separate URL for sending a logout request and response, use this property to set the separate response url
71-
onelogin.saml2.idp.single_logout_service.response.url = https://sgarcia-us-preprod.onelogin.com/trust/saml2/http-redirect/slo/672234
70+
onelogin.saml2.idp.single_logout_service.response.url =
7271

7372
# SAML protocol binding to be used when returning the <Response>
7473
# message. Onelogin Toolkit supports for this endpoint the
7574
# HTTP-Redirect binding only
7675
onelogin.saml2.idp.single_logout_service.binding = urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
7776

7877
# Public x509 certificate of the IdP
79-
onelogin.saml2.idp.x509cert = -----BEGIN CERTIFICATE-----MIIGZTCCBE2gAwIBAgIULEW2UPHc+tQMo/j0NBM+8SbWK7IwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxKzApBgNVBAoMIk9uZUxvZ2luIFRlc3QgKHNnYXJjaWEtdXMtcHJlcHJvZCkxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwWT25lTG9naW4gQWNjb3VudCA4OTE0NjAeFw0xNzA2MjAxMDA4MTlaFw0yMjA2MjExMDA4MTlaMHIxCzAJBgNVBAYTAlVTMSswKQYDVQQKDCJPbmVMb2dpbiBUZXN0IChzZ2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDYwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDzOWemVjGJTRG72AlAYnNapp26qnnNeNQVt4e56xi+56hjW5OTfgriP27rvAOd+CePIYA3ZyL0pk2LOPA/JtA0JA8LKN1vcGvfJcrpcsbFM5Y2BN5wTnqprT8rvG5eFmeK4r72qJ4wb4bUZJroT9+fU/gs/JOizhP4Z79icLQcbTTe0mc4n+/yoTxThAAraAsiOr3KQzXlTYB8zPMA2GI9TJ5Djc+g52C2vk2OhLEaSAPXGKLhvWukbyUMS34ofnqHaNO0ZbwUmw+8lgHBjIndXsSaFsm18SPnKTtfs1cLekzDveFvJ0T5V8PQWooqWUdg3hkrIiKZpOIcz8uYElpkQDJ2q++MjC7VsT1tKkjMGTv7SMicPscxAG89OaWRg+zmaDzqvdtNPGFe+8oatXp0FBMsnlsyIwdcoHTstloVEcOTSiT8wmjvkkIg5YR6vScmLhR6AQArRP2lWR0kXoSddEDk5fFDG+qMLus+N09YfUOKPswP6MtT9vNhPeIBP87qZLl4qbVCY+TWdNr5lONAH+Xmtk3Pf2phg74qZIZ87bEmJBSXKp8/Qm6Y4ruj6S+SPYt3/vKw130VfaGaSFyOlfAq3naiJqffa2tzneJ7Om/sHFee2Zj2hYqncxu6KR1qeR7lucB5o7z0ljGeUukp8GiVcubsQ3RNnfuCdsaeSwIDAQABo4HyMIHvMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFKewY7diVRP96TRYhW2f/1ktWrJAMIGvBgNVHSMEgacwgaSAFKewY7diVRP96TRYhW2f/1ktWrJAoXakdDByMQswCQYDVQQGEwJVUzErMCkGA1UECgwiT25lTG9naW4gVGVzdCAoc2dhcmNpYS11cy1wcmVwcm9kKTEVMBMGA1UECwwMT25lTG9naW4gSWRQMR8wHQYDVQQDDBZPbmVMb2dpbiBBY2NvdW50IDg5MTQ2ghQsRbZQ8dz61Ayj+PQ0Ez7xJtYrsjAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBAC2TQ4yqwk0ePey99JYI5PfMRVEnUyyCSPfKmyVJgoOZwk97+CZuq1MNqGavcExd1ofc4wkN3unk/g7qVRPBV24k9FZaicYrp5maSHakL2SJD8qo/deohYFaeH8RzszxEZbJJYMLiXyRJi44T28TyF8admIwUJVg/KBhNAHi/IlAsRWPL92nWJjSCBHgiPaG5HF10t/GaQSJuQpdhxniUlseuqXZ/Qm0MjAgSTlyaBIxLyOErrpVujwiR5RTHLw0wn+2P0WmfVp7e79GOqzFuwmoLfxUtJgalc7av9VwFdEB2nWF2hu7BwE9rzg8FTaw1uAEu+LQ++IUuI+ydparFWoo/IwtSrXF59mBoKMld58K4L+TfWwUYF3hAmH2XNiSBTFZn1HBsK+XqS1CUGD8R0WSVvQC2jjFbxztFkrOIzz5ITLzKcjr1E86r5PvBQXeeTvVz6g2L+wEA5VXGYh/RItHEkuwn7EPWpvJUfc5B0m57rfr0+UqWZaLbhczrmHFn0HaDXcs2ldi7y+Eiv6IP3vrJrHhdCDlVPLQH8w0f4vNcR8YYVOfWFHYzyo4oqRYFMRmoqfubs90zGLcB5ugm56k5VaseP+VGwjjTEyiD4CYPLEvKm0Z2M0L6MIkhp/9VYl8ZAWvPGKFMSaANkiMlux2uEBeG3s4nLQcunumphAo-----END CERTIFICATE-----
78+
onelogin.saml2.idp.x509cert =
8079

8180
# Instead of use the whole x509cert you can use a fingerprint
8281
# (openssl x509 -noout -fingerprint -in "idp.crt" to generate it,

0 commit comments

Comments
 (0)