58 lines
2.6 KiB
Plaintext
58 lines
2.6 KiB
Plaintext
<!---v0.2 13:19 12.01.2021--->
|
|
<cfinclude template="app_saml_config.cfm"/>
|
|
<cfinclude template="saml.cfm"/>
|
|
|
|
<cfparam name="target_page" default=""/>
|
|
|
|
<cfset ksFile = CreateObject("Java", "java.io.File").init(request.SAML.KEYSTORE_FILE_NAME) />
|
|
<cfset ksInputStream = CreateObject("Java", "java.io.FileInputStream").init(ksFile) />
|
|
<cfset keystore = CreateObject("Java", "java.security.KeyStore").getInstance("JKS") />
|
|
<cfset keystore.load(ksInputStream, request.SAML.KEYSTORE_PASS.toCharArray()) />
|
|
<!---<cfset certificate = keystore.getCertificate(request.SAML.CERTIFICATE_ALIAS) />--->
|
|
<cfset privateKey = keystore.getKey(request.SAML.CERTIFICATE_ALIAS, request.SAML.KEY_PASS.toCharArray()) />
|
|
<cfif isnull(privateKey)>
|
|
<cfthrow type="custom" message="Private Key Not Found" detail="Cannot obtain key #request.SAML.CERTIFICATE_ALIAS# from keystore"/>
|
|
</cfif>
|
|
|
|
<!---<cfdump var=#keystore.getKey(request.SAML.CERTIFICATE_ALIAS, request.SAML.KEY_PASS.toCharArray())#/>--->
|
|
<!---<cfset signingCertString = binaryEncode(certificate.getEncoded(),"base64") />
|
|
<cfset encryptionCertString = signingCertString />--->
|
|
|
|
<cfset currentUTC = DateConvert("local2UTC", Now()) />
|
|
|
|
<cfoutput>
|
|
<cfsavecontent variable="authnRequestXml"><?xml version="1.0" encoding="UTF-8"?>
|
|
<saml2p:AuthnRequest
|
|
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
|
|
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
ID="id#CreateUUID()#"
|
|
Version="2.0"
|
|
ProviderName="MMS"
|
|
IssueInstant="#DateFormat(currentUTC,"yyyy-mm-dd")#T#TimeFormat(currentUTC,"HH:MM:ss")#Z"
|
|
Destination="#request.SAML.IDP_URL#"
|
|
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
|
AssertionConsumerServiceURL="#request.SAML.baseUrl#sso.cfm">
|
|
<saml2:Issuer>#request.SAML.baseUrl#metadata.cfm</saml2:Issuer>
|
|
</saml2p:AuthnRequest>
|
|
</cfsavecontent>
|
|
</cfoutput>
|
|
|
|
<cfscript>
|
|
login64 = binaryEncode(deflate(authnRequestXml),"base64");
|
|
loginUrlEnc = urlEncodeRfc2396(login64);
|
|
loginSigAlgUrl = urlEncodeRfc2396('http://www.w3.org/2001/04/xmldsig-more##rsa-sha256');
|
|
relayState = urlEncodeRfc2396(target_page);
|
|
if (len(target_page)) { //empty RelayState would not be accepted
|
|
relayStateX = "&RelayState=#urlEncodeRfc2396(target_page)#";
|
|
} else {
|
|
relayStateX = "";
|
|
}
|
|
loginRequest2Sign = "SAMLRequest=#loginUrlEnc##relayStateX#&SigAlg=#loginSigAlgUrl#"; //parameter order matters
|
|
signature = sign(loginRequest2Sign, privateKey, 'SHA256withRSA');
|
|
signature64 = binaryEncode(signature,"base64");
|
|
signatureForUrl = urlEncodeRfc2396(signature64);
|
|
loginRequest = "#loginRequest2Sign#&Signature=#signatureForUrl#";
|
|
</cfscript>
|
|
|
|
<cflocation url="#request.SAML.IDP_URL#?#loginRequest#" addtoken="No"/>
|