import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
/**
 * New subject element.
 *
 * @param nameIdFormat the name id format
 * @param nameIdValue the name id value
 * @param recipient the recipient
 * @param notOnOrAfter the not on or after
 * @param inResponseTo the in response to
 * @return the subject
 */
public Subject newSubject(final String nameIdFormat, final String nameIdValue,
                          final String recipient, final DateTime notOnOrAfter,
                          final String inResponseTo) {

    final SubjectConfirmation confirmation = newSamlObject(SubjectConfirmation.class);
    confirmation.setMethod(SubjectConfirmation.METHOD_BEARER);

    final SubjectConfirmationData data = newSamlObject(SubjectConfirmationData.class);
    data.setRecipient(recipient);
    data.setNotOnOrAfter(notOnOrAfter);
    data.setInResponseTo(inResponseTo);

    confirmation.setSubjectConfirmationData(data);

    final Subject subject = newSamlObject(Subject.class);
    subject.setNameID(getNameID(nameIdFormat, nameIdValue));
    subject.getSubjectConfirmations().add(confirmation);
    return subject;
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
/**
 * New subject element.
 *
 * @param nameIdFormat the name id format
 * @param nameIdValue  the name id value
 * @param recipient    the recipient
 * @param notOnOrAfter the not on or after
 * @param inResponseTo the in response to
 * @return the subject
 */
public Subject newSubject(final String nameIdFormat, final String nameIdValue,
                          final String recipient, final ZonedDateTime notOnOrAfter,
                          final String inResponseTo) {

    LOGGER.debug("Building subject for NameID [{}]/[{}] and recipient [{}], in response to [{}]",
            nameIdValue, nameIdFormat, recipient, inResponseTo);
    final SubjectConfirmation confirmation = newSamlObject(SubjectConfirmation.class);
    confirmation.setMethod(SubjectConfirmation.METHOD_BEARER);

    final SubjectConfirmationData data = newSamlObject(SubjectConfirmationData.class);
    data.setRecipient(recipient);
    data.setNotOnOrAfter(DateTimeUtils.dateTimeOf(notOnOrAfter));
    data.setInResponseTo(inResponseTo);
    confirmation.setSubjectConfirmationData(data);

    final Subject subject = newSamlObject(Subject.class);
    subject.setNameID(getNameID(nameIdFormat, nameIdValue));
    subject.getSubjectConfirmations().add(confirmation);

    LOGGER.debug("Built subject [{}]", subject);
    return subject;
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
public SubjectConfirmationDataValidator(Function<T, SubjectConfirmationData> valueProvider, DateTimeComparator dateTimeComparator) {
    super(
        true,
        valueProvider,
        new RequiredValidator<>(SUBJECT_CONFIRMATION_DATA_NOT_PRESENT),
        new RequiredValidator<>(NOT_ON_OR_AFTER_NOT_PRESENT, SubjectConfirmationData::getNotOnOrAfter),
        TimeRestrictionValidators.notInPastValidator(dateTimeComparator,  SubjectConfirmationData::getNotOnOrAfter, NOT_ON_OR_AFTER_INVALID),
        new RequiredValidator<>(IN_RESPONSE_TO_NOT_PRESENT, SubjectConfirmationData::getInResponseTo),
        new RequiredValidator<>(RECIPIENT_NOT_PRESENT, SubjectConfirmationData::getRecipient)
    );
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
public static Subject aSubjectWithAssertions(List<Assertion> assertions, String requestId, String hubEntityId, String pid) {
    final NameID nameId = aNameId().withValue(pid).withNameQualifier("").withSpNameQualifier(hubEntityId).build();
    SubjectConfirmationDataBuilder subjectConfirmationDataBuilder = aSubjectConfirmationData().withInResponseTo(requestId);
    assertions.stream().forEach(subjectConfirmationDataBuilder::addAssertion);
    final SubjectConfirmationData subjectConfirmationData = subjectConfirmationDataBuilder.build();
    final SubjectConfirmation subjectConfirmation = SubjectConfirmationBuilder.aSubjectConfirmation()
        .withSubjectConfirmationData(subjectConfirmationData).build();

    return aSubject().withNameId(nameId).withSubjectConfirmation(subjectConfirmation).build();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
public static Subject aSubjectWithEncryptedAssertions(List<EncryptedAssertion> assertions, String requestId, String hubEntityId) {
    final NameID nameId = aNameId().withNameQualifier("").withSpNameQualifier(hubEntityId).build();

    SubjectConfirmationDataBuilder subjectConfirmationDataBuilder = aSubjectConfirmationData().withInResponseTo(requestId);
    assertions.stream().forEach(subjectConfirmationDataBuilder::addAssertion);

    final SubjectConfirmationData subjectConfirmationData = subjectConfirmationDataBuilder.build();
    final SubjectConfirmation subjectConfirmation = SubjectConfirmationBuilder.aSubjectConfirmation()
            .withSubjectConfirmationData(subjectConfirmationData).build();

    return aSubject().withNameId(nameId).withSubjectConfirmation(subjectConfirmation).build();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
@SuppressWarnings("unchecked")
@Test
public void handleSuccessfullyDecryptsAssertionsInAttributeQuery() {
    MatchingService delegate = mock(MatchingService.class);
    MatchingServiceRequestContext requestContext = new MatchingServiceRequestContext(attributeQueryDocument);
    when(serviceLocator.findServiceFor(requestContext)).thenReturn(delegate);

    Subject subject = mock(Subject.class);
    SubjectConfirmation subjectConfirmation = mock(SubjectConfirmation.class);
    SubjectConfirmationData subjectConfirmationData = mock(SubjectConfirmationData.class);
    EncryptedAssertion encryptedAssertion = mock(EncryptedAssertion.class);
    when(subject.getSubjectConfirmations()).thenReturn(Arrays.asList(subjectConfirmation));
    when(subjectConfirmation.getSubjectConfirmationData()).thenReturn(subjectConfirmationData);
    when(subjectConfirmationData.getUnknownXMLObjects(EncryptedAssertion.DEFAULT_ELEMENT_NAME)).thenReturn(Arrays.asList(encryptedAssertion));
    when(attributeQuery.getSubject()).thenReturn(subject);

    service.handle(requestContext);

    assertThat(requestContext.getAttributeQuery(), sameInstance(attributeQuery));
    assertThat(requestContext.getAssertions(), equalTo(Collections.emptyList()));

    ArgumentCaptor<ValidatedEncryptedAssertionContainer> encryptedAssertionContainerArgumentCaptor = ArgumentCaptor.forClass(ValidatedEncryptedAssertionContainer.class);
    verify(assertionDecrypter).decryptAssertions(encryptedAssertionContainerArgumentCaptor.capture());
    assertThat(encryptedAssertionContainerArgumentCaptor.getValue().getEncryptedAssertions(), equalTo(Arrays.asList(encryptedAssertion)));

    verify(serviceLocator).findServiceFor(requestContext);
    verify(delegate).handle(requestContext);
    verifyNoMoreInteractions(delegate, serviceLocator);
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
@Test
public void shouldGenerateNoErrorsWhenSubjectConfirmationDataIsValid() {
    SubjectConfirmationData subjectConfirmationData = aSubjectConfirmationData().build();

    Messages messages = validator.validate(subjectConfirmationData, messages());

    assertThat(messages.hasErrors()).isFalse();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
@Test
public void shouldGenerateErrorWhenSubjectConfirmationDataNotOnOrAfterIsMissing() throws Exception {
    SubjectConfirmationData subjectConfirmationData = aSubjectConfirmationData().withNotOnOrAfter(null).build();

    Messages messages = validator.validate(subjectConfirmationData, messages());

    assertThat(messages.hasErrorLike(NOT_ON_OR_AFTER_NOT_PRESENT)).isTrue();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
@Test
public void shouldGenerateErrorWhenSubjectConfirmationDataNotOnOrAfterIsInThePast() throws Exception {
    SubjectConfirmationData subjectConfirmationData = aSubjectConfirmationData().withNotOnOrAfter(DateTime.now().minusMinutes(5)).withNotBefore(DateTime.now()).build();

    Messages messages = validator.validate(subjectConfirmationData, messages());

    assertThat(messages.hasErrorLike(NOT_ON_OR_AFTER_INVALID)).isTrue();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
@Test
public void shouldGenerateErrorWhenSubjectConfirmationDataHasNoInResponseTo() throws Exception {
    SubjectConfirmationData subjectConfirmationData = aSubjectConfirmationData().withNotBefore(DateTime.now()).withInResponseTo(null).build();

    Messages messages = validator.validate(subjectConfirmationData, messages());

    assertThat(messages.hasErrorLike(IN_RESPONSE_TO_NOT_PRESENT)).isTrue();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
@Test
public void shouldGenerateErrorWhenSubjectConfirmationDataHasNoRecipient() throws Exception {
    SubjectConfirmationData subjectConfirmationData = aSubjectConfirmationData().withNotBefore(DateTime.now()).withRecipient(null).build();

    Messages messages = validator.validate(subjectConfirmationData, messages());

    assertThat(messages.hasErrorLike(RECIPIENT_NOT_PRESENT)).isTrue();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
private Subject aSubjectWithEncryptedAssertion(final EncryptedAssertion encryptedAssertion,
                                               final String requestId,
                                               final String hubEntityId) {
    final NameID nameId = aNameId().withNameQualifier("").withSpNameQualifier(hubEntityId).build();
    final SubjectConfirmationData subjectConfirmationData = aSubjectConfirmationData().withInResponseTo(requestId).addAssertion(encryptedAssertion).build();
    final SubjectConfirmation subjectConfirmation = aSubjectConfirmation().withSubjectConfirmationData(subjectConfirmationData).build();

    return aSubject().withNameId(nameId).withSubjectConfirmation(subjectConfirmation).build();
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
public void validate(Subject subject, String expectedInResponseTo) {
    if (subject == null) {
        throw new SamlResponseValidationException("Subject is missing from the assertion.");
    }

    if (subject.getSubjectConfirmations().size() != 1) {
        throw new SamlResponseValidationException("Exactly one subject confirmation is expected.");
    }

    SubjectConfirmation subjectConfirmation = subject.getSubjectConfirmations().get(0);
    if (!METHOD_BEARER.equals(subjectConfirmation.getMethod())) {
        throw new SamlResponseValidationException("Subject confirmation method must be 'bearer'.");
    }

    SubjectConfirmationData subjectConfirmationData = subjectConfirmation.getSubjectConfirmationData();
    if (subjectConfirmationData == null) {
        throw new SamlResponseValidationException("Subject confirmation data is missing from the assertion.");
    }

    timeRestrictionValidator.validateNotBefore(subjectConfirmationData.getNotBefore());

    DateTime notOnOrAfter = subjectConfirmationData.getNotOnOrAfter();
    if (notOnOrAfter == null) {
        throw new SamlResponseValidationException("Subject confirmation data must contain 'NotOnOrAfter'.");
    }

    timeRestrictionValidator.validateNotOnOrAfter(notOnOrAfter);

    String actualInResponseTo = subjectConfirmationData.getInResponseTo();
    if (actualInResponseTo == null) {
        throw new SamlResponseValidationException("Subject confirmation data must contain 'InResponseTo'.");
    }

    if (!expectedInResponseTo.equals(actualInResponseTo)) {
        throw new SamlResponseValidationException(String.format("'InResponseTo' must match requestId. Expected %s but was %s", expectedInResponseTo, actualInResponseTo));
    }

    if (subject.getNameID() == null) {
        throw new SamlResponseValidationException("NameID is missing from the subject of the assertion.");
    }
}
 

import org.opensaml.saml.saml2.core.SubjectConfirmationData; //导入依赖的package包/类
/**
 * Validate Bearer subject confirmation data
 *  - notBefore
 *  - NotOnOrAfter
 *  - recipient
 *
 * @param data the data
 * @param context the context
 * @return true if all Bearer subject checks are passing
 */
protected final boolean isValidBearerSubjectConfirmationData(final SubjectConfirmationData data,
                                                             final SAML2MessageContext context) {
    if (data == null) {
        logger.debug("SubjectConfirmationData cannot be null for Bearer confirmation");
        return false;
    }

    // TODO Validate inResponseTo

    if (data.getNotBefore() != null) {
        logger.debug("SubjectConfirmationData notBefore must be null for Bearer confirmation");
        return false;
    }

    if (data.getNotOnOrAfter() == null) {
        logger.debug("SubjectConfirmationData notOnOrAfter cannot be null for Bearer confirmation");
        return false;
    }

    if (data.getNotOnOrAfter().plusSeconds(acceptedSkew).isBeforeNow()) {
        logger.debug("SubjectConfirmationData notOnOrAfter is too old");
        return false;
    }

    try {
        if (data.getRecipient() == null) {
            logger.debug("SubjectConfirmationData recipient cannot be null for Bearer confirmation");
            return false;
        } else {
            final Endpoint endpoint = context.getSAMLEndpointContext().getEndpoint();
            if (endpoint == null) {
                logger.warn("No endpoint was found in the SAML endpoint context");
                return false;
            }

            final URI recipientUri = new URI(data.getRecipient());
            final URI appEndpointUri = new URI(endpoint.getLocation());
            if (!UriUtils.urisEqualAfterPortNormalization(recipientUri, appEndpointUri)) {
                logger.debug("SubjectConfirmationData recipient {} does not match SP assertion consumer URL, found. SP ACS URL from context: {}", recipientUri, appEndpointUri);
                return false;
            }
        }
    } catch (URISyntaxException use) {
        logger.error("Unable to check SubjectConfirmationData recipient, a URI has invalid syntax.", use);
        return false;
    }
    
    return true;
}