litsec / eidas-opensaml Goto Github PK

View Code? Open in Web Editor NEW

14.0 6.0 3.0 6.18 MB

OpenSAML extensions for the eIDAS Framework

License: Apache License 2.0

Java 100.00%

eidas eidas-framework eidas-opensaml opensaml-extensions opensaml

eidas-opensaml's Introduction

eidas-opensaml

OpenSAML extensions for the eIDAS Framework.

Note: For OpenSAML 5 support, please use the https://github.com/swedenconnect/opensaml-eidas repository. This repo will only support earlier versions of OpenSAML ...

Note: Support for OpenSAML 2.X and 3.X has been discontinued. The last release of eidas-opensaml supporting OpenSAML 2.X is 1.0.6 and the last release supporting OpenSAML 3.X is 1.4.5.

eIDAS (EU REGULATION 910/2014 on electronic identification and trust services for electronic transactions in the European internal market) defines requirements on cross-border recognition of electronic identification means in EU.

The eIDAS technical specifications defines a number of SAML elements and attribute definitions which are normally not supported by standard SAML software. The eidas-opensaml Open Source Java library extends the OpenSAML framework with support for the definitions from the eIDAS technical specifications.

The following eIDAS specifications are implemented:

See https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/eIDAS+eID+Profile for the eIDAS eID Profile.

How to use the use the eidas-opensaml library

The eidas-opensaml artifacts are published to Maven central and a dependency to the library should be included as follows in the application POM-file:

<dependency>
  <groupId>se.litsec.eidas</groupId>
  <artifactId>eidas-opensaml4</artifactId>
  <version>${eidas-opensaml.version}</version>
</dependency>

Documentation

API documentation - https://litsec.github.io/eidas-opensaml/javadoc/opensaml4/2.1.1.

Examples

Creating an eIDAS AuthnRequest message

The eIDAS SAML Message Format v1.2 specification describes how a SAML AuthnRequest message should be put together to comply to the eIDAS specifications.

CreateAuthnRequestExample.java illustrates how you could create an authentication request message using the eidas-opensaml library.

Parsing an Assertion

An assertion issued from an eIDAS service will contain the attributes defined in eIDAS SAML Attribute Profile.

ParseAssertionExample.java shows how to parse an Assertion and get hold of all attribute values.

Contact and support

Contact Litsec Labs if you have any questions or suggestions ...

Resources

eIDAS Specifications

Swedish eID Framework

Technical specifications for the Swedish eID Framework
Sweden Connect - The portal for the Sweden Connect federation.
Sweden Connect - Sandbox - The portal for the Swedish eID and eIDAS test infrastructure.

OpenSAML and Shibboleth

Shibboleth Identity Provider v4 - built using OpenSAML 4.x

eidas-opensaml's People

Contributors

Stargazers

Watchers

Forkers

malinn bennypi klhgovernikus

eidas-opensaml's Issues

Add security configuration for eIDAS algorithms

When using OpenSAML out of the box you'll get the defaults that the OpenSAML developers thinks are sensible defaults. We should add support so that it is easy to set up a system to use the eIDAS defaults when it comes to algorithms.

Requires #24 to be done first.

Add support for eIDAS Message Format v1.2

Add support for new features in eIDAS Message Format v1.2.

eIDAS Message Format_v1.2_final.docx

Add support for the latest versions of eIDAS specs.

We should support
eIDAS Message Format_v1.2_draft_1.95.docx and
2017_11_29_eIDAS Crypto Requirements_v1.2_DRAFT3_CT.pdf which are likely to be the next official versions.

Fix vulnerabilities reported by Snyk

Snyk reports the following vulnerabilities for the eidas-opensaml dependencies:

HIGH SEVERITY:

Unexpected Code Execution
Vulnerable module: org.bouncycastle:bcprov-jdk15on
Introduced through: org.opensaml:[email protected], org.opensaml:[email protected] and others.

MEDIUM SEVERITY:

Deserialization of Untrusted Data
Vulnerable module: com.google.guava:guava
Introduced through: net.shibboleth.utilities:[email protected] and com.google.guava:[email protected]

MEDIUM SEVERITY:

Insecure Encryption
Vulnerable module: org.bouncycastle:bcprov-jdk15on
Introduced through: org.opensaml:[email protected], org.opensaml:[email protected] and others

LICENSE: Consider adding a classpath exception / switching to LGPL

For eIDAS implementors that are releasing their code under non-GPL licenses or building proprietary implementations it would be beneficial to have the code licensed more permissively.

On the other hand I completely acknowledge the Free Software arguments about releasing libraries under the full GPL (Why you shouldn't use the Lesser GPL for your next library).

Would the copyright holders consider modifying the license to include a linking exception or switching to the LGPL (or another more permissive license)?

Add official URI:s for eIDAS non-notified LoA:s

Version 1.2 of the message profile defines URI:s for non-notified schemes. Up until now we have used our own as placeholders. This needs to be fixed.

Upgrade to OpenSAML 3.4.2

We should upgrade to OpenSAML 3.4.2 to get the latest bug fixes and functionality.

Fix potential namespace problems concerning CurrentAddress value attribute

The CurrentAddress attribute is something very special. I sucks. It's value is the Base64 encoding of an XML-structure, but it isn't a valid XML-document of its own. We'll have to make a fix for the case when the eidas namespace prefix isn't defined anywhere in the document, but appears in the decoded CurrentAddress value. There have been cases when that has happened. So, instead of trying to convince everyone that the fault is made by the issuer of the assertion, let's just implement a sensible workaround ...

Add dependency to opensaml-security-ext

To be able to support ECDH (as mandated by the eIDAS crypto spec) we should add a dependency to the opensaml-security-ext library.

Add support for eIDAS legal person attributes

Add support for the attributes defined in section 2.3 of "eIDAS SAML Attribute Profile".

Upgrade to OpenSAML 4

OpenSAML 3 will be end-of-life 31/12 2020, so we should make an OpenSAML 4 version.

AdminUnitFirstLine is added twice during marshalling

Hi there,

we discovered a bug where the AdminUnitFirstLine in a StrcutedAddress is added twice if AdminUnitSecondLine is also present.
This bug is present in the OpenSAML 3 and OpenSAML 4 versions of this extension, we did not examine OpenSAML 2.

I will create a pull request to show and fix this bug.

Make SPTypeEnumeration an Enum Class

SPTypeEnumeration ist a final class with two public static final instances of itself, PUBLIC and PRIVATE.
It contains most of a typical Enum class, but is missing the valueOf(...) method.
As this class contains no functionality to create an object from a String representation of public or private, it is quite a hassle to determine if an arbitrary String is equal to the value of PRIVATE or PUBLIC.

My suggestion would be to make this a public enum class or add a valueOf(...) method to this class. If this suggestion is approved, I'm happy to provide a pull request.

Add support for the MetadataServiceList element

An eIDAS node makes use of an XML document that is called MetadataServiceList in order to get information about the member state keys, and URL:s to connectors and proxy services.

The eidas-opensaml library should include a representation of this XML element.