Merge pull request #7477 from fhanik/feature/propagate_saml_authentication_exception

propagate saml authentication exception #7375

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlAuthenticationProvider.java

@@ -16,16 +16,12 @@
 package org.springframework.security.saml2.provider.service.authentication;
 
 import org.springframework.core.convert.converter.Converter;
-import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
 import org.springframework.security.authentication.AuthenticationProvider;
-import org.springframework.security.authentication.AuthenticationServiceException;
-import org.springframework.security.authentication.InsufficientAuthenticationException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
-import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.saml2.Saml2Exception;
 import org.springframework.security.saml2.credentials.Saml2X509Credential;
 import org.springframework.util.Assert;
@@ -79,18 +75,59 @@ import java.util.Set;
 import static java.lang.String.format;
 import static java.util.Collections.singleton;
 import static java.util.Collections.singletonList;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.DECRYPTION_ERROR;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.INVALID_DESTINATION;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.INVALID_ISSUER;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.MALFORMED_RESPONSE_DATA;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.SUBJECT_NOT_FOUND;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.UNKNOWN_RESPONSE_CLASS;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2ErrorCodes.USERNAME_NOT_FOUND;
 import static org.springframework.util.Assert.notNull;
 import static org.springframework.util.StringUtils.hasText;
 
 /**
+ * Implementation of {@link AuthenticationProvider} for SAML authentications when receiving a
+ * {@code Response} object containing an {@code Assertion}. This implementation uses
+ * the {@code OpenSAML 3} library.
+ *
+ * <p>
+ *  The {@link OpenSamlAuthenticationProvider} supports {@link Saml2AuthenticationToken} objects
+ *  that contain a SAML response in its decoded XML format {@link Saml2AuthenticationToken#getSaml2Response()}
+ *  along with the information about the asserting party, the identity provider (IDP), as well as
+ *  the relying party, the service provider (SP, this application).
+ * </p>
+ * <p>
+ *   The {@link Saml2AuthenticationToken} will be processed into a SAML Response object.
+ *   The SAML response object can be signed. If the Response is signed, a signature will not be required on the assertion.
+ * </p>
+ * <p>
+ *   While a response object can contain a list of assertion, this provider will only leverage
+ *   the first valid assertion for the purpose of authentication. Assertions that do not pass validation
+ *   will be ignored. If no valid assertions are found a {@link Saml2AuthenticationException} is thrown.
+ * </p>
+ * <p>
+ *   This provider supports two types of encrypted SAML elements
+ *   <ul>
+ *     <li><a href="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=17">EncryptedAssertion</a></li>
+ *     <li><a href="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=14">EncryptedID</a></li>
+ *   </ul>
+ *   If the assertion is encrypted, then signature validation on the assertion is no longer required.
+ * </p>
+ * <p>
+ *   This provider does not perform an X509 certificate validation on the configured asserting party, IDP, verification
+ *   certificates.
+ * </p>
  * @since 5.2
+ * @see <a href="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=38">SAML 2 StatusResponse</a>
+ * @see <a href="https://wiki.shibboleth.net/confluence/display/OS30/Home">OpenSAML 3</a>
  */
 public final class OpenSamlAuthenticationProvider implements AuthenticationProvider {
 
 	private static Log logger = LogFactory.getLog(OpenSamlAuthenticationProvider.class);
 
 	private final OpenSamlImplementation saml = OpenSamlImplementation.getInstance();
-	private Converter<Assertion, Collection<? extends GrantedAuthority>> authoritiesExtractor = (a -> singletonList(new SimpleGrantedAuthority("ROLE_USER")));
+	private Converter<Assertion, Collection<? extends GrantedAuthority>> authoritiesExtractor =
+			(a -> singletonList(new SimpleGrantedAuthority("ROLE_USER")));
 	private GrantedAuthoritiesMapper authoritiesMapper = (a -> a);
 	private Duration responseTimeValidationSkew = Duration.ofMinutes(5);
 
@@ -136,22 +173,17 @@ public final class OpenSamlAuthenticationProvider implements AuthenticationProvi
 	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
 		try {
 			Saml2AuthenticationToken token = (Saml2AuthenticationToken) authentication;
-			String xml = token.getSaml2Response();
-			Response samlResponse = getSaml2Response(xml);
-
+			Response samlResponse = getSaml2Response(token);
 			Assertion assertion = validateSaml2Response(token, token.getRecipientUri(), samlResponse);
-			final String username = getUsername(token, assertion);
-			if (username == null) {
-				throw new UsernameNotFoundException("Assertion [" +
-						assertion.getID() +
-						"] is missing a user identifier");
-			}
+			String username = getUsername(token, assertion);
 			return new Saml2Authentication(
 					() -> username, token.getSaml2Response(),
 					this.authoritiesMapper.mapAuthorities(getAssertionAuthorities(assertion))
 			);
-		}catch (Saml2Exception | IllegalArgumentException e) {
-			throw new AuthenticationServiceException(e.getMessage(), e);
+		} catch (Saml2AuthenticationException e) {
+			throw e;
+		} catch (Exception e) {
+			throw authException(Saml2ErrorCodes.INTERNAL_VALIDATION_ERROR, e.getMessage(), e);
 		}
 	}
 
@@ -167,93 +199,116 @@ public final class OpenSamlAuthenticationProvider implements AuthenticationProvi
 		return this.authoritiesExtractor.convert(assertion);
 	}
 
-	private String getUsername(Saml2AuthenticationToken token, Assertion assertion) {
-		final Subject subject = assertion.getSubject();
+	private String getUsername(Saml2AuthenticationToken token, Assertion assertion) throws Saml2AuthenticationException {
+		String username = null;
+		Subject subject = assertion.getSubject();
 		if (subject == null) {
-			return null;
+			throw authException(SUBJECT_NOT_FOUND, "Assertion [" + assertion.getID() + "] is missing a subject");
 		}
 		if (subject.getNameID() != null) {
-			return subject.getNameID().getValue();
+			username = subject.getNameID().getValue();
 		}
-		if (subject.getEncryptedID() != null) {
+		else if (subject.getEncryptedID() != null) {
 			NameID nameId = decrypt(token, subject.getEncryptedID());
-			return nameId.getValue();
+			username = nameId.getValue();
 		}
-		return null;
+		if (username == null) {
+			throw authException(USERNAME_NOT_FOUND, "Assertion [" + assertion.getID() + "] is missing a user identifier");
+		}
+		return username;
 	}
 
 	private Assertion validateSaml2Response(Saml2AuthenticationToken token,
 											String recipient,
-											Response samlResponse) throws AuthenticationException {
+											Response samlResponse) throws Saml2AuthenticationException {
+		//optional validation if the response contains a destination
 		if (hasText(samlResponse.getDestination()) && !recipient.equals(samlResponse.getDestination())) {
-			throw new Saml2Exception("Invalid SAML response destination: " + samlResponse.getDestination());
+			throw authException(INVALID_DESTINATION, "Invalid SAML response destination: " + samlResponse.getDestination());
 		}
 
-		final String issuer = samlResponse.getIssuer().getValue();
+		String issuer = samlResponse.getIssuer().getValue();
 		if (logger.isDebugEnabled()) {
-			logger.debug("Processing SAML response from " + issuer);
+			logger.debug("Validating SAML response from " + issuer);
 		}
-		if (token == null) {
-			throw new Saml2Exception(format("SAML 2 Provider for %s was not found.", issuer));
+		if (!hasText(issuer) || (!issuer.equals(token.getIdpEntityId()))) {
+			String message = String.format("Response issuer '%s' doesn't match '%s'", issuer, token.getIdpEntityId());
+			throw authException(INVALID_ISSUER, message);
 		}
+		Saml2AuthenticationException lastValidationError = null;
+
 		boolean responseSigned = hasValidSignature(samlResponse, token);
 		for (Assertion a : samlResponse.getAssertions()) {
 			if (logger.isDebugEnabled()) {
 				logger.debug("Checking plain assertion validity " + a);
 			}
-			if (isValidAssertion(recipient, a, token, !responseSigned)) {
-				if (logger.isDebugEnabled()) {
-					logger.debug("Found valid assertion. Skipping potential others.");
-				}
+			try {
+				validateAssertion(recipient, a, token, !responseSigned);
 				return a;
+			} catch (Saml2AuthenticationException e) {
+				lastValidationError = e;
 			}
 		}
 		for (EncryptedAssertion ea : samlResponse.getEncryptedAssertions()) {
 			if (logger.isDebugEnabled()) {
 				logger.debug("Checking encrypted assertion validity " + ea);
 			}
-
-			Assertion a = decrypt(token, ea);
-			if (isValidAssertion(recipient, a, token, false)) {
-				if (logger.isDebugEnabled()) {
-					logger.debug("Found valid encrypted assertion. Skipping potential others.");
-				}
+			try {
+				Assertion a = decrypt(token, ea);
+				validateAssertion(recipient, a, token, false);
 				return a;
+			} catch (Saml2AuthenticationException e) {
+				lastValidationError = e;
 			}
 		}
-		throw new InsufficientAuthenticationException("Unable to find a valid assertion");
+		if (lastValidationError != null) {
+			throw lastValidationError;
+		}
+		else {
+			throw authException(MALFORMED_RESPONSE_DATA, "No assertions found in response.");
+		}
 	}
 
-	private boolean hasValidSignature(SignableSAMLObject samlResponse, Saml2AuthenticationToken token) {
-		if (!samlResponse.isSigned()) {
+	private boolean hasValidSignature(SignableSAMLObject samlObject, Saml2AuthenticationToken token) {
+		if (!samlObject.isSigned()) {
+			if (logger.isDebugEnabled()) {
+				logger.debug("SAML object is not signed, no signatures found");
+			}
 			return false;
 		}
 
-		final List<X509Certificate> verificationKeys = getVerificationKeys(token);
+		List<X509Certificate> verificationKeys = getVerificationCertificates(token);
 		if (verificationKeys.isEmpty()) {
 			return false;
 		}
 
-		for (X509Certificate key : verificationKeys) {
-			final Credential credential = getVerificationCredential(key);
+		for (X509Certificate certificate : verificationKeys) {
+			Credential credential = getVerificationCredential(certificate);
 			try {
-				SignatureValidator.validate(samlResponse.getSignature(), credential);
+				SignatureValidator.validate(samlObject.getSignature(), credential);
+				if (logger.isDebugEnabled()) {
+					logger.debug("Valid signature found in SAML object:"+samlObject.getClass().getName());
+				}
 				return true;
 			}
 			catch (SignatureException ignored) {
-				logger.debug("Signature validation failed", ignored);
+				if (logger.isTraceEnabled()) {
+					logger.trace("Signature validation failed with cert:"+certificate.toString(), ignored);
+				}
+				else if (logger.isDebugEnabled()) {
+					logger.debug("Signature validation failed with cert:"+certificate.toString());
+				}
 			}
 		}
 		return false;
 	}
 
-	private boolean isValidAssertion(String recipient, Assertion a, Saml2AuthenticationToken token, boolean signatureRequired) {
-		final SAML20AssertionValidator validator = getAssertionValidator(token);
+	private void validateAssertion(String recipient, Assertion a, Saml2AuthenticationToken token, boolean signatureRequired) {
+		SAML20AssertionValidator validator = getAssertionValidator(token);
 		Map<String, Object> validationParams = new HashMap<>();
 		validationParams.put(SAML2AssertionValidationParameters.SIGNATURE_REQUIRED, false);
 		validationParams.put(
 				SAML2AssertionValidationParameters.CLOCK_SKEW,
-				this.responseTimeValidationSkew
+				this.responseTimeValidationSkew.toMillis()
 		);
 		validationParams.put(
 				SAML2AssertionValidationParameters.COND_VALID_AUDIENCES,
@@ -267,55 +322,78 @@ public final class OpenSamlAuthenticationProvider implements AuthenticationProvi
 			if (logger.isDebugEnabled()) {
 				logger.debug(format("Assertion [%s] does not a valid signature.", a.getID()));
 			}
-			return false;
+			throw authException(Saml2ErrorCodes.INVALID_SIGNATURE, "Assertion doesn't have a valid signature.");
 		}
+		//ensure that OpenSAML doesn't attempt signature validation, already performed
 		a.setSignature(null);
 
-		// validation for recipient
+		//remainder of assertion validation
 		ValidationContext vctx = new ValidationContext(validationParams);
 		try {
-			final ValidationResult result = validator.validate(a, vctx);
-			final boolean valid = result.equals(ValidationResult.VALID);
+			ValidationResult result = validator.validate(a, vctx);
+			boolean valid = result.equals(ValidationResult.VALID);
 			if (!valid) {
 				if (logger.isDebugEnabled()) {
-					logger.debug(format("Failed to validate assertion from %s with user %s", token.getIdpEntityId(),
-							getUsername(token, a)
-					));
+					logger.debug(format("Failed to validate assertion from %s", token.getIdpEntityId()));
 				}
+				throw authException(Saml2ErrorCodes.INVALID_ASSERTION, vctx.getValidationFailureMessage());
 			}
-			return valid;
 		}
 		catch (AssertionValidationException e) {
 			if (logger.isDebugEnabled()) {
 				logger.debug("Failed to validate assertion:", e);
 			}
-			return false;
+			throw authException(Saml2ErrorCodes.INTERNAL_VALIDATION_ERROR, e.getMessage(), e);
 		}
 
 	}
 
-	private Response getSaml2Response(String xml) throws Saml2Exception, AuthenticationException {
-		final Object result = this.saml.resolve(xml);
-		if (result == null) {
-			throw new AuthenticationCredentialsNotFoundException("SAMLResponse returned null object");
-		}
-		else if (result instanceof Response) {
-			return (Response) result;
+	private Response getSaml2Response(Saml2AuthenticationToken token) throws Saml2Exception, Saml2AuthenticationException {
+		try {
+			Object result = this.saml.resolve(token.getSaml2Response());
+			if (result instanceof Response) {
+				return (Response) result;
+			}
+			else {
+				throw authException(UNKNOWN_RESPONSE_CLASS, "Invalid response class:" + result.getClass().getName());
+			}
+		} catch (Saml2Exception x) {
+			throw authException(MALFORMED_RESPONSE_DATA, x.getMessage(), x);
 		}
-		throw new IllegalArgumentException("Invalid response class:"+result.getClass().getName());
+
+	}
+
+	private Saml2Error validationError(String code, String description) {
+		return new Saml2Error(
+				code,
+				description
+		);
+	}
+
+	private Saml2AuthenticationException authException(String code, String description) throws Saml2AuthenticationException {
+		return new Saml2AuthenticationException(
+				validationError(code, description)
+		);
+	}
+
+
+	private Saml2AuthenticationException authException(String code, String description, Exception cause) throws Saml2AuthenticationException {
+		return new Saml2AuthenticationException(
+				validationError(code, description),
+				cause
+		);
 	}
 
 	private SAML20AssertionValidator getAssertionValidator(Saml2AuthenticationToken provider) {
 		List<ConditionValidator> conditions = Collections.singletonList(new AudienceRestrictionConditionValidator());
-		final BearerSubjectConfirmationValidator subjectConfirmationValidator =
-				new BearerSubjectConfirmationValidator();
+		BearerSubjectConfirmationValidator subjectConfirmationValidator = new BearerSubjectConfirmationValidator();
 
 		List<SubjectConfirmationValidator> subjects = Collections.singletonList(subjectConfirmationValidator);
 		List<StatementValidator> statements = Collections.emptyList();
 
 		Set<Credential> credentials = new HashSet<>();
-		for (X509Certificate key : getVerificationKeys(provider)) {
-			final Credential cred = getVerificationCredential(key);
+		for (X509Certificate key : getVerificationCertificates(provider)) {
+			Credential cred = getVerificationCredential(key);
 			credentials.add(cred);
 		}
 		CredentialResolver credentialsResolver = new CollectionCredentialResolver(credentials);
@@ -345,37 +423,38 @@ public final class OpenSamlAuthenticationProvider implements AuthenticationProvi
 		return decrypter;
 	}
 
-	private Assertion decrypt(Saml2AuthenticationToken token, EncryptedAssertion assertion) {
-		Saml2Exception last = null;
+	private Assertion decrypt(Saml2AuthenticationToken token, EncryptedAssertion assertion)
+			throws Saml2AuthenticationException {
+		Saml2AuthenticationException last = null;
 		List<Saml2X509Credential> decryptionCredentials = getDecryptionCredentials(token);
 		if (decryptionCredentials.isEmpty()) {
-			throw new Saml2Exception("No valid decryption credentials found.");
+			throw authException(DECRYPTION_ERROR, "No valid decryption credentials found.");
 		}
 		for (Saml2X509Credential key : decryptionCredentials) {
-			final Decrypter decrypter = getDecrypter(key);
+			Decrypter decrypter = getDecrypter(key);
 			try {
 				return decrypter.decrypt(assertion);
 			}
 			catch (DecryptionException e) {
-				last = new Saml2Exception(e);
+				last = authException(DECRYPTION_ERROR, e.getMessage(), e);
 			}
 		}
 		throw last;
 	}
 
-	private NameID decrypt(Saml2AuthenticationToken token, EncryptedID assertion) {
-		Saml2Exception last = null;
+	private NameID decrypt(Saml2AuthenticationToken token, EncryptedID assertion) throws Saml2AuthenticationException {
+		Saml2AuthenticationException last = null;
 		List<Saml2X509Credential> decryptionCredentials = getDecryptionCredentials(token);
 		if (decryptionCredentials.isEmpty()) {
-			throw new Saml2Exception("No valid decryption credentials found.");
+			throw authException(DECRYPTION_ERROR, "No valid decryption credentials found.");
 		}
 		for (Saml2X509Credential key : decryptionCredentials) {
-			final Decrypter decrypter = getDecrypter(key);
+			Decrypter decrypter = getDecrypter(key);
 			try {
 				return (NameID) decrypter.decrypt(assertion);
 			}
 			catch (DecryptionException e) {
-				last = new Saml2Exception(e);
+				last = authException(DECRYPTION_ERROR, e.getMessage(), e);
 			}
 		}
 		throw last;
@@ -391,7 +470,7 @@ public final class OpenSamlAuthenticationProvider implements AuthenticationProvi
 		return result;
 	}
 
-	private List<X509Certificate> getVerificationKeys(Saml2AuthenticationToken token) {
+	private List<X509Certificate> getVerificationCertificates(Saml2AuthenticationToken token) {
 		List<X509Certificate> result = new LinkedList<>();
 		for (Saml2X509Credential c : token.getX509Credentials()) {
 			if (c.isSignatureVerficationCredential()) {

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlAuthenticationRequestFactory.java

@@ -19,11 +19,8 @@ package org.springframework.security.saml2.provider.service.authentication;
 import org.springframework.util.Assert;
 
 import org.joda.time.DateTime;
-import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.core.Issuer;
-import org.opensaml.security.SecurityException;
-import org.opensaml.xmlsec.signature.support.SignatureException;
 
 import java.time.Clock;
 import java.time.Instant;
@@ -51,16 +48,11 @@ public class OpenSamlAuthenticationRequestFactory implements Saml2Authentication
 		issuer.setValue(request.getLocalSpEntityId());
 		auth.setIssuer(issuer);
 		auth.setDestination(request.getWebSsoUri());
-		try {
-			return this.saml.toXml(
-					auth,
-					request.getCredentials(),
-					request.getLocalSpEntityId()
-			);
-		}
-		catch (MarshallingException | SignatureException | SecurityException e) {
-			throw new IllegalStateException(e);
-		}
+		return this.saml.toXml(
+				auth,
+				request.getCredentials(),
+				request.getLocalSpEntityId()
+		);
 	}
 
 	/**

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlImplementation.java

@@ -15,14 +15,6 @@
  */
 package org.springframework.security.saml2.provider.service.authentication;
 
-import java.io.ByteArrayInputStream;
-import java.nio.charset.StandardCharsets;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import javax.xml.XMLConstants;
-import javax.xml.namespace.QName;
-
 import org.springframework.security.saml2.Saml2Exception;
 import org.springframework.security.saml2.credentials.Saml2X509Credential;
 
@@ -59,6 +51,14 @@ import org.opensaml.xmlsec.signature.support.SignatureSupport;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import javax.xml.XMLConstants;
+import javax.xml.namespace.QName;
+
 import static java.lang.Boolean.FALSE;
 import static java.lang.Boolean.TRUE;
 import static java.util.Arrays.asList;
@@ -165,10 +165,7 @@ final class OpenSamlImplementation {
 			QName defaultElementName = (QName) clazz.getDeclaredField("DEFAULT_ELEMENT_NAME").get(null);
 			return (T) getBuilderFactory().getBuilder(defaultElementName).buildObject(defaultElementName);
 		}
-		catch (IllegalAccessException e) {
-			throw new Saml2Exception("Could not create SAML object", e);
-		}
-		catch (NoSuchFieldException e) {
+		catch (NoSuchFieldException | IllegalAccessException e) {
 			throw new Saml2Exception("Could not create SAML object", e);
 		}
 	}
@@ -177,6 +174,28 @@ final class OpenSamlImplementation {
 		return resolve(xml.getBytes(StandardCharsets.UTF_8));
 	}
 
+	String toXml(XMLObject object, List<Saml2X509Credential> signingCredentials, String localSpEntityId) {
+		if (object instanceof SignableSAMLObject && null != hasSigningCredential(signingCredentials)) {
+			signXmlObject(
+					(SignableSAMLObject) object,
+					signingCredentials,
+					localSpEntityId
+			);
+		}
+		final MarshallerFactory marshallerFactory = XMLObjectProviderRegistrySupport.getMarshallerFactory();
+		try {
+			Element element = marshallerFactory.getMarshaller(object).marshall(object);
+			return SerializeSupport.nodeToString(element);
+		} catch (MarshallingException e) {
+			throw new Saml2Exception(e);
+		}
+	}
+
+	/*
+	 * ==============================================================
+	 * PRIVATE METHODS
+	 * ==============================================================
+	 */
 	private XMLObject resolve(byte[] xml) {
 		XMLObject parsed = parse(xml);
 		if (parsed != null) {
@@ -200,18 +219,6 @@ final class OpenSamlImplementation {
 		return XMLObjectProviderRegistrySupport.getUnmarshallerFactory();
 	}
 
-	String toXml(XMLObject object, List<Saml2X509Credential> signingCredentials, String localSpEntityId)
-			throws MarshallingException, SignatureException, SecurityException {
-		if (object instanceof SignableSAMLObject && null != hasSigningCredential(signingCredentials)) {
-			signXmlObject(
-					(SignableSAMLObject) object,
-					getSigningCredential(signingCredentials, localSpEntityId)
-			);
-		}
-		final MarshallerFactory marshallerFactory = XMLObjectProviderRegistrySupport.getMarshallerFactory();
-		Element element = marshallerFactory.getMarshaller(object).marshall(object);
-		return SerializeSupport.nodeToString(element);
-	}
 
 	private Saml2X509Credential hasSigningCredential(List<Saml2X509Credential> credentials) {
 		for (Saml2X509Credential c : credentials) {
@@ -222,22 +229,12 @@ final class OpenSamlImplementation {
 		return null;
 	}
 
-	private void signXmlObject(SignableSAMLObject object, Credential credential)
-			throws MarshallingException, SecurityException, SignatureException {
-		SignatureSigningParameters parameters = new SignatureSigningParameters();
-		parameters.setSigningCredential(credential);
-		parameters.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
-		parameters.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
-		parameters.setSignatureCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
-		SignatureSupport.signObject(object, parameters);
-	}
-
 	private Credential getSigningCredential(List<Saml2X509Credential> signingCredential,
 											String localSpEntityId
 	) {
 		Saml2X509Credential credential = hasSigningCredential(signingCredential);
 		if (credential == null) {
-			throw new IllegalArgumentException("no signing credential configured");
+			throw new Saml2Exception("no signing credential configured");
 		}
 		BasicCredential cred = getBasicCredential(credential);
 		cred.setEntityId(localSpEntityId);
@@ -245,6 +242,21 @@ final class OpenSamlImplementation {
 		return cred;
 	}
 
+	private void signXmlObject(SignableSAMLObject object, List<Saml2X509Credential> signingCredentials, String entityId) {
+		SignatureSigningParameters parameters = new SignatureSigningParameters();
+		Credential credential = getSigningCredential(signingCredentials, entityId);
+		parameters.setSigningCredential(credential);
+		parameters.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+		parameters.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
+		parameters.setSignatureCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
+		try {
+			SignatureSupport.signObject(object, parameters);
+		} catch (MarshallingException | SignatureException | SecurityException e) {
+			throw new Saml2Exception(e);
+		}
+
+	}
+
 	private BasicX509Credential getBasicCredential(Saml2X509Credential credential) {
 		return CredentialSupport.getSimpleCredential(
 				credential.getCertificate(),

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationException.java

@@ -0,0 +1,106 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.util.Assert;
+
+/**
+ * This exception is thrown for all SAML 2.0 related {@link Authentication} errors.
+ *
+ * <p>
+ * There are a number of scenarios where an error may occur, for example:
+ * <ul>
+ *  <li>The response or assertion request is missing or malformed</li>
+ *  <li>Missing or invalid subject</li>
+ *  <li>Missing or invalid signatures</li>
+ *  <li>The time period validation for the assertion fails</li>
+ *  <li>One of the assertion conditions was not met</li>
+ *  <li>Decryption failed</li>
+ *  <li>Unable to locate a subject identifier, commonly known as username</li>
+ * </ul>
+ *
+ * @since 5.2
+ */
+public class Saml2AuthenticationException extends AuthenticationException {
+	private Saml2Error error;
+
+	/**
+	 * Constructs a {@code Saml2AuthenticationException} using the provided parameters.
+	 *
+	 * @param error the {@link Saml2Error SAML 2.0 Error}
+	 */
+	public Saml2AuthenticationException(Saml2Error error) {
+		this(error, error.getDescription());
+	}
+
+	/**
+	 * Constructs a {@code Saml2AuthenticationException} using the provided parameters.
+	 *
+	 * @param error the {@link Saml2Error SAML 2.0 Error}
+	 * @param cause the root cause
+	 */
+	public Saml2AuthenticationException(Saml2Error error, Throwable cause) {
+		this(error, cause.getMessage(), cause);
+	}
+
+	/**
+	 * Constructs a {@code Saml2AuthenticationException} using the provided parameters.
+	 *
+	 * @param error the {@link Saml2Error SAML 2.0 Error}
+	 * @param message the detail message
+	 */
+	public Saml2AuthenticationException(Saml2Error error, String message) {
+		super(message);
+		this.setError(error);
+	}
+
+	/**
+	 * Constructs a {@code Saml2AuthenticationException} using the provided parameters.
+	 *
+	 * @param error the {@link Saml2Error SAML 2.0 Error}
+	 * @param message the detail message
+	 * @param cause the root cause
+	 */
+	public Saml2AuthenticationException(Saml2Error error, String message, Throwable cause) {
+		super(message, cause);
+		this.setError(error);
+	}
+
+	/**
+	 * Returns the {@link Saml2Error SAML 2.0 Error}.
+	 *
+	 * @return the {@link Saml2Error}
+	 */
+	public Saml2Error getError() {
+		return this.error;
+	}
+
+	private void setError(Saml2Error error) {
+		Assert.notNull(error, "error cannot be null");
+		this.error = error;
+	}
+
+	@Override
+	public String toString() {
+		final StringBuffer sb = new StringBuffer("Saml2AuthenticationException{");
+		sb.append("error=").append(error);
+		sb.append('}');
+		return sb.toString();
+	}
+}

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2AuthenticationRequestFactory.java

@@ -16,6 +16,8 @@
 
 package org.springframework.security.saml2.provider.service.authentication;
 
+import org.springframework.security.saml2.Saml2Exception;
+
 /**
  * Component that generates an AuthenticationRequest, <code>samlp:AuthnRequestType</code> as defined by
  * https://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf
@@ -33,6 +35,7 @@ public interface Saml2AuthenticationRequestFactory {
 	 *                accompanying data
 	 * @return XML data in the format of a String. This data may be signed, encrypted, both signed and encrypted or
 	 * neither signed and encrypted
+	 * @throws Saml2Exception when a SAML library exception occurs
 	 */
 	String createAuthenticationRequest(Saml2AuthenticationRequest request);
 }

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Error.java

@@ -0,0 +1,75 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+import org.springframework.security.core.SpringSecurityCoreVersion;
+import org.springframework.util.Assert;
+
+import java.io.Serializable;
+
+/**
+ * A representation of an SAML 2.0 Error.
+ *
+ * <p>
+ * At a minimum, an error response will contain an error code.
+ * The commonly used error code are defined in this class
+ * or a new codes can be defined in the future as arbitrary strings.
+ * </p>
+ * @since 5.2
+ */
+public class Saml2Error implements Serializable {
+	private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
+
+	private final String errorCode;
+	private final String description;
+
+	/**
+	 * Constructs a {@code Saml2Error} using the provided parameters.
+	 *
+	 * @param errorCode the error code
+	 * @param description the error description
+	 */
+	public Saml2Error(String errorCode, String description) {
+		Assert.hasText(errorCode, "errorCode cannot be empty");
+		this.errorCode = errorCode;
+		this.description = description;
+	}
+
+	/**
+	 * Returns the error code.
+	 *
+	 * @return the error code
+	 */
+	public final String getErrorCode() {
+		return this.errorCode;
+	}
+
+	/**
+	 * Returns the error description.
+	 *
+	 * @return the error description
+	 */
+	public final String getDescription() {
+		return this.description;
+	}
+
+	@Override
+	public String toString() {
+		return "[" + this.getErrorCode() + "] " +
+				(this.getDescription() != null ? this.getDescription() : "");
+	}
+}

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2ErrorCodes.java

@@ -0,0 +1,96 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+/**
+ * A list of SAML known 2 error codes used during SAML authentication.
+ *
+ * @since 5.2
+ */
+public interface Saml2ErrorCodes {
+	/**
+	 * SAML Data does not represent a SAML 2 Response object.
+	 * A valid XML object was received, but that object was not a
+	 * SAML 2 Response object of type {@code ResponseType} per specification
+	 * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=46
+	 */
+	String UNKNOWN_RESPONSE_CLASS = "unknown_response_class";
+	/**
+	 * The response data is malformed or incomplete.
+	 * An invalid XML object was received, and XML unmarshalling failed.
+	 */
+	String MALFORMED_RESPONSE_DATA = "malformed_response_data";
+	/**
+	 * Response destination does not match the request URL.
+	 * A SAML 2 response object was received at a URL that
+	 * did not match the URL stored in the {code Destination} attribute
+	 * in the Response object.
+	 * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=38
+	 */
+	String INVALID_DESTINATION = "invalid_destination";
+	/**
+	 * The assertion was not valid.
+	 * The assertion used for authentication failed validation.
+	 * Details around the failure will be present in the error description.
+	 */
+	String INVALID_ASSERTION = "invalid_assertion";
+	/**
+	 * The signature of response or assertion was invalid.
+	 * Either the response or the assertion was missing a signature
+	 * or the signature could not be verified using the system's
+	 * configured credentials. Most commonly the IDP's
+	 * X509 certificate.
+	 */
+	String INVALID_SIGNATURE = "invalid_signature";
+	/**
+	 * The assertion did not contain a subject element.
+	 * The subject element, type SubjectType, contains
+	 * a {@code NameID} or an {@code EncryptedID} that is used
+	 * to assign the authenticated principal an identifier,
+	 * typically a username.
+	 *
+	 * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=18
+	 */
+	String SUBJECT_NOT_FOUND = "subject_not_found";
+	/**
+	 * The subject did not contain a user identifier
+	 * The assertion contained a subject element, but the subject
+	 * element did not have a {@code NameID} or {@code EncryptedID}
+	 * element
+	 *
+	 * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=18
+	 */
+	String USERNAME_NOT_FOUND = "username_not_found";
+	/**
+	 * The system failed to decrypt an assertion or a name identifier.
+	 * This error code will be thrown if the decryption of either a
+	 * {@code EncryptedAssertion} or {@code EncryptedID} fails.
+	 * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=17
+	 */
+	String DECRYPTION_ERROR = "decryption_error";
+	/**
+	 * An Issuer element contained a value that didn't
+	 * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf#page=15
+	 */
+	String INVALID_ISSUER = "invalid_issuer";
+	/**
+	 * An error happened during validation.
+	 * Used when internal, non classified, errors are caught during the
+	 * authentication process.
+	 */
+	String INTERNAL_VALIDATION_ERROR = "internal_validation_error";
+}

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/credentials/Saml2X509CredentialTests.java

@@ -0,0 +1,149 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.credentials;
+
+import org.springframework.security.converter.RsaKeyConverters;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.ExpectedException;
+
+import java.io.ByteArrayInputStream;
+import java.security.PrivateKey;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.DECRYPTION;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.ENCRYPTION;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.SIGNING;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.VERIFICATION;
+
+public class Saml2X509CredentialTests {
+
+	@Rule
+	public ExpectedException exception = ExpectedException.none();
+
+	private Saml2X509Credential credential;
+	private PrivateKey key;
+	private X509Certificate certificate;
+
+	@Before
+	public void setup() throws Exception {
+		String keyData = "-----BEGIN PRIVATE KEY-----\n" +
+				"MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBANG7v8QjQGU3MwQE\n" +
+				"VUBxvH6Uuiy/MhZT7TV0ZNjyAF2ExA1gpn3aUxx6jYK5UnrpxRRE/KbeLucYbOhK\n" +
+				"cDECt77Rggz5TStrOta0BQTvfluRyoQtmQ5Nkt6Vqg7O2ZapFt7k64Sal7AftzH6\n" +
+				"Q2BxWN1y04bLdDrH4jipqRj/2qEFAgMBAAECgYEAj4ExY1jjdN3iEDuOwXuRB+Nn\n" +
+				"x7pC4TgntE2huzdKvLJdGvIouTArce8A6JM5NlTBvm69mMepvAHgcsiMH1zGr5J5\n" +
+				"wJz23mGOyhM1veON41/DJTVG+cxq4soUZhdYy3bpOuXGMAaJ8QLMbQQoivllNihd\n" +
+				"vwH0rNSK8LTYWWPZYIECQQDxct+TFX1VsQ1eo41K0T4fu2rWUaxlvjUGhK6HxTmY\n" +
+				"8OMJptunGRJL1CUjIb45Uz7SP8TPz5FwhXWsLfS182kRAkEA3l+Qd9C9gdpUh1uX\n" +
+				"oPSNIxn5hFUrSTW1EwP9QH9vhwb5Vr8Jrd5ei678WYDLjUcx648RjkjhU9jSMzIx\n" +
+				"EGvYtQJBAMm/i9NR7IVyyNIgZUpz5q4LI21rl1r4gUQuD8vA36zM81i4ROeuCly0\n" +
+				"KkfdxR4PUfnKcQCX11YnHjk9uTFj75ECQEFY/gBnxDjzqyF35hAzrYIiMPQVfznt\n" +
+				"YX/sDTE2AdVBVGaMj1Cb51bPHnNC6Q5kXKQnj/YrLqRQND09Q7ParX0CQQC5NxZr\n" +
+				"9jKqhHj8yQD6PlXTsY4Occ7DH6/IoDenfdEVD5qlet0zmd50HatN2Jiqm5ubN7CM\n" +
+				"INrtuLp4YHbgk1mi\n" +
+				"-----END PRIVATE KEY-----";
+		key = RsaKeyConverters.pkcs8().convert(new ByteArrayInputStream(keyData.getBytes(UTF_8)));
+		final CertificateFactory factory = CertificateFactory.getInstance("X.509");
+		String certificateData = "-----BEGIN CERTIFICATE-----\n" +
+				"MIICgTCCAeoCCQCuVzyqFgMSyDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMC\n" +
+				"VVMxEzARBgNVBAgMCldhc2hpbmd0b24xEjAQBgNVBAcMCVZhbmNvdXZlcjEdMBsG\n" +
+				"A1UECgwUU3ByaW5nIFNlY3VyaXR5IFNBTUwxCzAJBgNVBAsMAnNwMSAwHgYDVQQD\n" +
+				"DBdzcC5zcHJpbmcuc2VjdXJpdHkuc2FtbDAeFw0xODA1MTQxNDMwNDRaFw0yODA1\n" +
+				"MTExNDMwNDRaMIGEMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjES\n" +
+				"MBAGA1UEBwwJVmFuY291dmVyMR0wGwYDVQQKDBRTcHJpbmcgU2VjdXJpdHkgU0FN\n" +
+				"TDELMAkGA1UECwwCc3AxIDAeBgNVBAMMF3NwLnNwcmluZy5zZWN1cml0eS5zYW1s\n" +
+				"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRu7/EI0BlNzMEBFVAcbx+lLos\n" +
+				"vzIWU+01dGTY8gBdhMQNYKZ92lMceo2CuVJ66cUURPym3i7nGGzoSnAxAre+0YIM\n" +
+				"+U0razrWtAUE735bkcqELZkOTZLelaoOztmWqRbe5OuEmpewH7cx+kNgcVjdctOG\n" +
+				"y3Q6x+I4qakY/9qhBQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAAeViTvHOyQopWEi\n" +
+				"XOfI2Z9eukwrSknDwq/zscR0YxwwqDBMt/QdAODfSwAfnciiYLkmEjlozWRtOeN+\n" +
+				"qK7UFgP1bRl5qksrYX5S0z2iGJh0GvonLUt3e20Ssfl5tTEDDnAEUMLfBkyaxEHD\n" +
+				"RZ/nbTJ7VTeZOSyRoVn5XHhpuJ0B\n" +
+				"-----END CERTIFICATE-----";
+		certificate = (X509Certificate) factory
+				.generateCertificate(new ByteArrayInputStream(certificateData.getBytes(UTF_8)));
+	}
+
+	@Test
+	public void constructorWhenRelyingPartyWithCredentialsThenItSucceeds() {
+		new Saml2X509Credential(key, certificate, SIGNING);
+		new Saml2X509Credential(key, certificate, SIGNING, DECRYPTION);
+		new Saml2X509Credential(key, certificate, DECRYPTION);
+	}
+
+	@Test
+	public void constructorWhenAssertingPartyWithCredentialsThenItSucceeds() {
+		new Saml2X509Credential(certificate, VERIFICATION);
+		new Saml2X509Credential(certificate, VERIFICATION, ENCRYPTION);
+		new Saml2X509Credential(certificate, ENCRYPTION);
+	}
+
+	@Test
+	public void constructorWhenRelyingPartyWithoutCredentialsThenItFails() {
+		exception.expect(IllegalArgumentException.class);
+		new Saml2X509Credential(null, (X509Certificate) null, SIGNING);
+	}
+
+	@Test
+	public void constructorWhenRelyingPartyWithoutPrivateKeyThenItFails() {
+		exception.expect(IllegalArgumentException.class);
+		new Saml2X509Credential(null, certificate, SIGNING);
+	}
+
+	@Test
+	public void constructorWhenRelyingPartyWithoutCertificateThenItFails() {
+		exception.expect(IllegalArgumentException.class);
+		new Saml2X509Credential(key, null, SIGNING);
+	}
+
+	@Test
+	public void constructorWhenAssertingPartyWithoutCertificateThenItFails() {
+		exception.expect(IllegalArgumentException.class);
+		new Saml2X509Credential(null, SIGNING);
+	}
+
+	@Test
+	public void constructorWhenRelyingPartyWithEncryptionUsageThenItFails() {
+		exception.expect(IllegalStateException.class);
+		new Saml2X509Credential(key, certificate, ENCRYPTION);
+	}
+
+	@Test
+	public void constructorWhenRelyingPartyWithVerificationUsageThenItFails() {
+		exception.expect(IllegalStateException.class);
+		new Saml2X509Credential(key, certificate, VERIFICATION);
+	}
+
+	@Test
+	public void constructorWhenAssertingPartyWithSigningUsageThenItFails() {
+		exception.expect(IllegalStateException.class);
+		new Saml2X509Credential(certificate, SIGNING);
+	}
+
+	@Test
+	public void constructorWhenAssertingPartyWithDecryptionUsageThenItFails() {
+		exception.expect(IllegalStateException.class);
+		new Saml2X509Credential(certificate, DECRYPTION);
+	}
+
+
+}

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlAuthenticationProviderTests.java

@@ -0,0 +1,357 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+import org.springframework.security.core.Authentication;
+
+import org.hamcrest.BaseMatcher;
+import org.hamcrest.Description;
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.ExpectedException;
+import org.opensaml.core.xml.XMLObject;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.EncryptedAssertion;
+import org.opensaml.saml.saml2.core.EncryptedID;
+import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.Response;
+
+import static java.util.Collections.emptyList;
+import static org.springframework.security.saml2.provider.service.authentication.TestSaml2AuthenticationObjects.assertion;
+import static org.springframework.security.saml2.provider.service.authentication.TestSaml2AuthenticationObjects.response;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2CryptoTestSupport.encryptAssertion;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2CryptoTestSupport.encryptNameId;
+import static org.springframework.security.saml2.provider.service.authentication.Saml2CryptoTestSupport.signXmlObject;
+import static org.springframework.security.saml2.provider.service.authentication.TestSaml2X509Credentials.assertingPartyCredentials;
+import static org.springframework.security.saml2.provider.service.authentication.TestSaml2X509Credentials.relyingPartyCredentials;
+import static org.springframework.test.util.AssertionErrors.assertTrue;
+import static org.springframework.util.StringUtils.hasText;
+
+public class OpenSamlAuthenticationProviderTests {
+
+	private static String username = "test@saml.user";
+	private static String recipientUri = "https://localhost/login/saml2/sso/idp-alias";
+	private static String recipientEntityId = "https://localhost/saml2/service-provider-metadata/idp-alias";
+	private static String idpEntityId = "https://some.idp.test/saml2/idp";
+
+	private OpenSamlAuthenticationProvider provider;
+	private OpenSamlImplementation saml;
+	private Saml2AuthenticationToken token;
+
+	@Rule
+	public ExpectedException exception = ExpectedException.none();
+
+	@Before
+	public void setup() {
+		saml = OpenSamlImplementation.getInstance();
+		provider = new OpenSamlAuthenticationProvider();
+		token = new Saml2AuthenticationToken(
+				"responseXml",
+				recipientUri,
+				idpEntityId,
+				recipientEntityId,
+				relyingPartyCredentials()
+		);
+	}
+
+	@Test
+	public void supportsWhenSaml2AuthenticationTokenThenReturnTrue() {
+
+		assertTrue(
+				OpenSamlAuthenticationProvider.class + "should support " + token.getClass(),
+				provider.supports(token.getClass())
+		);
+	}
+
+	@Test
+	public void supportsWhenNotSaml2AuthenticationTokenThenReturnFalse() {
+		assertTrue(
+				OpenSamlAuthenticationProvider.class + "should not support " + Authentication.class,
+				!provider.supports(Authentication.class)
+		);
+	}
+
+	@Test
+	public void authenticateWhenUnknownDataClassThenThrowAuthenticationException() {
+		Assertion assertion = defaultAssertion();
+		token = responseXml(assertion, idpEntityId);
+		exception.expect(authenticationMatcher(Saml2ErrorCodes.UNKNOWN_RESPONSE_CLASS));
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenXmlErrorThenThrowAuthenticationException() {
+		token = new Saml2AuthenticationToken(
+				"invalid xml string",
+				recipientUri,
+				idpEntityId,
+				recipientEntityId,
+				relyingPartyCredentials()
+		);
+		exception.expect(authenticationMatcher(Saml2ErrorCodes.MALFORMED_RESPONSE_DATA));
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenInvalidDestinationThenThrowAuthenticationException() {
+		Response response = response(recipientUri + "invalid", idpEntityId);
+		token = responseXml(response, idpEntityId);
+		exception.expect(authenticationMatcher(Saml2ErrorCodes.INVALID_DESTINATION));
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenNoAssertionsPresentThenThrowAuthenticationException() {
+		Response response = response(recipientUri, idpEntityId);
+		token = responseXml(response, idpEntityId);
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.MALFORMED_RESPONSE_DATA,
+						"No assertions found in response."
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenInvalidSignatureOnAssertionThenThrowAuthenticationException() {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		response.getAssertions().add(assertion);
+		token = responseXml(response, idpEntityId);
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.INVALID_SIGNATURE
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenOpenSAMLValidationErrorThenThrowAuthenticationException() throws Exception {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		assertion
+				.getSubject()
+				.getSubjectConfirmations()
+				.get(0)
+				.getSubjectConfirmationData()
+				.setNotOnOrAfter(DateTime.now().minus(Duration.standardDays(3)));
+		signXmlObject(
+				assertion,
+				assertingPartyCredentials(),
+				recipientEntityId
+		);
+		response.getAssertions().add(assertion);
+		token = responseXml(response, idpEntityId);
+
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.INVALID_ASSERTION
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenMissingSubjectThenThrowAuthenticationException()  {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		assertion.setSubject(null);
+		signXmlObject(
+				assertion,
+				assertingPartyCredentials(),
+				recipientEntityId
+		);
+		response.getAssertions().add(assertion);
+		token = responseXml(response, idpEntityId);
+
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.SUBJECT_NOT_FOUND
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenUsernameMissingThenThrowAuthenticationException() throws Exception {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		assertion
+				.getSubject()
+				.getNameID()
+				.setValue(null);
+		signXmlObject(
+				assertion,
+				assertingPartyCredentials(),
+				recipientEntityId
+		);
+		response.getAssertions().add(assertion);
+		token = responseXml(response, idpEntityId);
+
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.USERNAME_NOT_FOUND
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenEncryptedAssertionWithoutSignatureThenItSucceeds() throws Exception {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials());
+		response.getEncryptedAssertions().add(encryptedAssertion);
+		token = responseXml(response, idpEntityId);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenEncryptedNameIdWithSignatureThenItSucceeds() throws Exception {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		NameID nameId = assertion.getSubject().getNameID();
+		EncryptedID encryptedID = encryptNameId(nameId, assertingPartyCredentials());
+		assertion.getSubject().setNameID(null);
+		assertion.getSubject().setEncryptedID(encryptedID);
+		signXmlObject(
+				assertion,
+				assertingPartyCredentials(),
+				recipientEntityId
+		);
+		response.getAssertions().add(assertion);
+		token = responseXml(response, idpEntityId);
+		provider.authenticate(token);
+	}
+
+
+	@Test
+	public void authenticateWhenDecryptionKeysAreMissingThenThrowAuthenticationException() throws Exception {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials());
+		response.getEncryptedAssertions().add(encryptedAssertion);
+		token = responseXml(response, idpEntityId);
+
+		token = new Saml2AuthenticationToken(
+				token.getSaml2Response(),
+				recipientUri,
+				idpEntityId,
+				recipientEntityId,
+				emptyList()
+		);
+
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.DECRYPTION_ERROR,
+						"No valid decryption credentials found."
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	@Test
+	public void authenticateWhenDecryptionKeysAreWrongThenThrowAuthenticationException() throws Exception {
+		Response response = response(recipientUri, idpEntityId);
+		Assertion assertion = defaultAssertion();
+		EncryptedAssertion encryptedAssertion = encryptAssertion(assertion, assertingPartyCredentials());
+		response.getEncryptedAssertions().add(encryptedAssertion);
+		token = responseXml(response, idpEntityId);
+
+		token = new Saml2AuthenticationToken(
+				token.getSaml2Response(),
+				recipientUri,
+				idpEntityId,
+				recipientEntityId,
+				assertingPartyCredentials()
+		);
+
+		exception.expect(
+				authenticationMatcher(
+						Saml2ErrorCodes.DECRYPTION_ERROR,
+						"Failed to decrypt EncryptedData"
+				)
+		);
+		provider.authenticate(token);
+	}
+
+	private Assertion defaultAssertion() {
+		return assertion(
+				username,
+				idpEntityId,
+				recipientEntityId,
+				recipientUri
+		);
+	}
+
+	private Saml2AuthenticationToken responseXml(
+			XMLObject object,
+			String issuerEntityId
+	) {
+		String xml = saml.toXml(object, emptyList(), issuerEntityId);
+		return new Saml2AuthenticationToken(
+				xml,
+				recipientUri,
+				idpEntityId,
+				recipientEntityId,
+				relyingPartyCredentials()
+		);
+
+	}
+
+	private BaseMatcher<Saml2AuthenticationException> authenticationMatcher(String code) {
+		return authenticationMatcher(code, null);
+	}
+
+	private BaseMatcher<Saml2AuthenticationException> authenticationMatcher(String code, String description) {
+		return new BaseMatcher<Saml2AuthenticationException>() {
+			private Object value = null;
+
+			@Override
+			public boolean matches(Object item) {
+				if (!(item instanceof Saml2AuthenticationException)) {
+					value = item;
+					return false;
+				}
+				Saml2AuthenticationException ex = (Saml2AuthenticationException) item;
+				if (!code.equals(ex.getError().getErrorCode())) {
+					value = item;
+					return false;
+				}
+				if (hasText(description)) {
+					if (!description.equals(ex.getError().getDescription())) {
+						value = item;
+						return false;
+					}
+				}
+				return true;
+			}
+
+			@Override
+			public void describeTo(Description desc) {
+				String excepting = "Saml2AuthenticationException[code="+code+"; description="+description+"]";
+				desc.appendText(excepting);
+
+			}
+		};
+	}
+}

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/Saml2CryptoTestSupport.java

@@ -0,0 +1,169 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+import org.springframework.security.saml2.Saml2Exception;
+import org.springframework.security.saml2.credentials.Saml2X509Credential;
+
+import org.apache.xml.security.algorithms.JCEMapper;
+import org.apache.xml.security.encryption.XMLCipherParameters;
+import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.saml.common.SignableSAMLObject;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.EncryptedAssertion;
+import org.opensaml.saml.saml2.core.EncryptedID;
+import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.encryption.Encrypter;
+import org.opensaml.security.SecurityException;
+import org.opensaml.security.credential.BasicCredential;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialSupport;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.x509.BasicX509Credential;
+import org.opensaml.xmlsec.SignatureSigningParameters;
+import org.opensaml.xmlsec.encryption.support.DataEncryptionParameters;
+import org.opensaml.xmlsec.encryption.support.EncryptionException;
+import org.opensaml.xmlsec.encryption.support.KeyEncryptionParameters;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+import org.opensaml.xmlsec.signature.support.SignatureException;
+import org.opensaml.xmlsec.signature.support.SignatureSupport;
+
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.cert.X509Certificate;
+import java.util.List;
+import javax.crypto.SecretKey;
+
+import static java.util.Arrays.asList;
+import static org.opensaml.security.crypto.KeySupport.generateKey;
+
+final class Saml2CryptoTestSupport {
+	static void signXmlObject(SignableSAMLObject object, List<Saml2X509Credential> signingCredentials, String entityId) {
+		SignatureSigningParameters parameters = new SignatureSigningParameters();
+		Credential credential = getSigningCredential(signingCredentials, entityId);
+		parameters.setSigningCredential(credential);
+		parameters.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+		parameters.setSignatureReferenceDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256);
+		parameters.setSignatureCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
+		try {
+			SignatureSupport.signObject(object, parameters);
+		} catch (MarshallingException | SignatureException | SecurityException e) {
+			throw new Saml2Exception(e);
+		}
+
+	}
+
+	static EncryptedAssertion encryptAssertion(Assertion assertion, List<Saml2X509Credential> encryptionCredentials) {
+		X509Certificate certificate = getEncryptionCertificate(encryptionCredentials);
+		Encrypter encrypter = getEncrypter(certificate);
+		try {
+			Encrypter.KeyPlacement keyPlacement = Encrypter.KeyPlacement.valueOf("PEER");
+			encrypter.setKeyPlacement(keyPlacement);
+			return encrypter.encrypt(assertion);
+		}
+		catch (EncryptionException e) {
+			throw new Saml2Exception("Unable to encrypt assertion.", e);
+		}
+	}
+
+	static EncryptedID encryptNameId(NameID nameID, List<Saml2X509Credential> encryptionCredentials) {
+		X509Certificate certificate = getEncryptionCertificate(encryptionCredentials);
+		Encrypter encrypter = getEncrypter(certificate);
+		try {
+			Encrypter.KeyPlacement keyPlacement = Encrypter.KeyPlacement.valueOf("PEER");
+			encrypter.setKeyPlacement(keyPlacement);
+			return encrypter.encrypt(nameID);
+		}
+		catch (EncryptionException e) {
+			throw new Saml2Exception("Unable to encrypt nameID.", e);
+		}
+	}
+
+	private static Encrypter getEncrypter(X509Certificate certificate) {
+		Credential credential = CredentialSupport.getSimpleCredential(certificate, null);
+		final String dataAlgorithm = XMLCipherParameters.AES_256;
+		final String keyAlgorithm = XMLCipherParameters.RSA_1_5;
+		SecretKey secretKey = generateKeyFromURI(dataAlgorithm);
+		BasicCredential dataCredential = new BasicCredential(secretKey);
+		DataEncryptionParameters dataEncryptionParameters = new DataEncryptionParameters();
+		dataEncryptionParameters.setEncryptionCredential(dataCredential);
+		dataEncryptionParameters.setAlgorithm(dataAlgorithm);
+
+		KeyEncryptionParameters keyEncryptionParameters = new KeyEncryptionParameters();
+		keyEncryptionParameters.setEncryptionCredential(credential);
+		keyEncryptionParameters.setAlgorithm(keyAlgorithm);
+
+		Encrypter encrypter = new Encrypter(dataEncryptionParameters, asList(keyEncryptionParameters));
+
+		return encrypter;
+	}
+
+	private static SecretKey generateKeyFromURI(String algoURI) {
+		try {
+			String jceAlgorithmName = JCEMapper.getJCEKeyAlgorithmFromURI(algoURI);
+			int keyLength = JCEMapper.getKeyLengthFromURI(algoURI);
+			return generateKey(jceAlgorithmName, keyLength, null);
+		}
+		catch (NoSuchAlgorithmException | NoSuchProviderException e) {
+			throw new Saml2Exception(e);
+		}
+	}
+
+	private static X509Certificate getEncryptionCertificate(List<Saml2X509Credential> encryptionCredentials) {
+		X509Certificate certificate = null;
+		for (Saml2X509Credential credential : encryptionCredentials) {
+			if (credential.isEncryptionCredential()) {
+				certificate = credential.getCertificate();
+				break;
+			}
+		}
+		if (certificate == null) {
+			throw new Saml2Exception("No valid encryption certificate found");
+		}
+		return certificate;
+	}
+
+	private static Saml2X509Credential hasSigningCredential(List<Saml2X509Credential> credentials) {
+		for (Saml2X509Credential c : credentials) {
+			if (c.isSigningCredential()) {
+				return c;
+			}
+		}
+		return null;
+	}
+
+	private static Credential getSigningCredential(List<Saml2X509Credential> signingCredential,
+			String localSpEntityId
+	) {
+		Saml2X509Credential credential = hasSigningCredential(signingCredential);
+		if (credential == null) {
+			throw new Saml2Exception("no signing credential configured");
+		}
+		BasicCredential cred = getBasicCredential(credential);
+		cred.setEntityId(localSpEntityId);
+		cred.setUsageType(UsageType.SIGNING);
+		return cred;
+	}
+
+	private static BasicX509Credential getBasicCredential(Saml2X509Credential credential) {
+		return CredentialSupport.getSimpleCredential(
+				credential.getCertificate(),
+				credential.getPrivateKey()
+		);
+	}
+
+}

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/TestSaml2AuthenticationObjects.java

@@ -0,0 +1,112 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+import org.joda.time.DateTime;
+import org.joda.time.Duration;
+import org.opensaml.saml.common.SAMLVersion;
+import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.Conditions;
+import org.opensaml.saml.saml2.core.Issuer;
+import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.Response;
+import org.opensaml.saml.saml2.core.Subject;
+import org.opensaml.saml.saml2.core.SubjectConfirmation;
+import org.opensaml.saml.saml2.core.SubjectConfirmationData;
+
+import java.util.UUID;
+
+final class TestSaml2AuthenticationObjects {
+	private static OpenSamlImplementation saml = OpenSamlImplementation.getInstance();
+
+	static Response response(String destination, String issuerEntityId) {
+		Response response = saml.buildSAMLObject(Response.class);
+		response.setID("R"+UUID.randomUUID().toString());
+		response.setIssueInstant(DateTime.now());
+		response.setVersion(SAMLVersion.VERSION_20);
+		response.setID("_" + UUID.randomUUID().toString());
+		response.setDestination(destination);
+		response.setIssuer(issuer(issuerEntityId));
+		return response;
+	}
+	static Assertion assertion(
+			String username,
+			String issuerEntityId,
+			String recipientEntityId,
+			String recipientUri
+	) {
+		Assertion assertion = saml.buildSAMLObject(Assertion.class);
+		assertion.setID("A"+ UUID.randomUUID().toString());
+		assertion.setIssueInstant(DateTime.now());
+		assertion.setVersion(SAMLVersion.VERSION_20);
+		assertion.setIssueInstant(DateTime.now());
+		assertion.setIssuer(issuer(issuerEntityId));
+		assertion.setSubject(subject(username));
+		assertion.setConditions(conditions());
+
+		SubjectConfirmation subjectConfirmation = subjectConfirmation();
+		subjectConfirmation.setMethod(SubjectConfirmation.METHOD_BEARER);
+		SubjectConfirmationData confirmationData = subjectConfirmationData(recipientEntityId);
+		confirmationData.setRecipient(recipientUri);
+		subjectConfirmation.setSubjectConfirmationData(confirmationData);
+		assertion.getSubject().getSubjectConfirmations().add(subjectConfirmation);
+		return assertion;
+	}
+
+
+	static Issuer issuer(String entityId) {
+		Issuer issuer = saml.buildSAMLObject(Issuer.class);
+		issuer.setValue(entityId);
+		return issuer;
+	}
+
+	static Subject subject(String principalName) {
+		Subject subject = saml.buildSAMLObject(Subject.class);
+
+		if (principalName != null) {
+			subject.setNameID(nameId(principalName));
+		}
+
+		return subject;
+	}
+
+	static NameID nameId(String principalName) {
+		NameID nameId = saml.buildSAMLObject(NameID.class);
+		nameId.setValue(principalName);
+		return nameId;
+	}
+
+	static SubjectConfirmation subjectConfirmation() {
+		return saml.buildSAMLObject(SubjectConfirmation.class);
+	}
+
+	static SubjectConfirmationData subjectConfirmationData(String recipient) {
+		SubjectConfirmationData subject = saml.buildSAMLObject(SubjectConfirmationData.class);
+		subject.setRecipient(recipient);
+		subject.setNotBefore(DateTime.now().minus(Duration.millis(5 * 60 * 1000)));
+		subject.setNotOnOrAfter(DateTime.now().plus(Duration.millis(5 * 60 * 1000)));
+		return subject;
+	}
+
+	static Conditions conditions() {
+		Conditions conditions = saml.buildSAMLObject(Conditions.class);
+		conditions.setNotBefore(DateTime.now().minus(Duration.millis(5 * 60 * 1000)));
+		conditions.setNotOnOrAfter(DateTime.now().plus(Duration.millis(5 * 60 * 1000)));
+		return conditions;
+	}
+
+}

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/TestSaml2X509Credentials.java

@@ -0,0 +1,190 @@
+/*
+ * Copyright 2002-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.saml2.provider.service.authentication;
+
+import org.springframework.security.saml2.Saml2Exception;
+import org.springframework.security.saml2.credentials.Saml2X509Credential;
+
+import org.opensaml.security.crypto.KeySupport;
+
+import java.io.ByteArrayInputStream;
+import java.security.KeyException;
+import java.security.PrivateKey;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.List;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.DECRYPTION;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.ENCRYPTION;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.SIGNING;
+import static org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.VERIFICATION;
+
+final class TestSaml2X509Credentials {
+	static List<Saml2X509Credential> assertingPartyCredentials() {
+		return Arrays.asList(
+				new Saml2X509Credential(
+						idpPrivateKey(),
+						idpCertificate(),
+						SIGNING,
+						DECRYPTION
+				),
+				new Saml2X509Credential(
+						spCertificate(),
+						ENCRYPTION,
+						VERIFICATION
+				)
+		);
+	}
+
+	static List<Saml2X509Credential> relyingPartyCredentials() {
+		return Arrays.asList(
+				new Saml2X509Credential(
+						spPrivateKey(),
+						spCertificate(),
+						SIGNING,
+						DECRYPTION
+				),
+				new Saml2X509Credential(
+						idpCertificate(),
+						ENCRYPTION,
+						VERIFICATION
+				)
+		);
+	}
+
+	private static X509Certificate certificate(String cert) {
+		ByteArrayInputStream certBytes = new ByteArrayInputStream(cert.getBytes());
+		try {
+			return (X509Certificate) CertificateFactory
+					.getInstance("X.509")
+					.generateCertificate(certBytes);
+		}
+		catch (CertificateException e) {
+			throw new Saml2Exception(e);
+		}
+	}
+
+	private static PrivateKey privateKey(String key) {
+		try {
+			return KeySupport.decodePrivateKey(key.getBytes(UTF_8), new char[0]);
+		}
+		catch (KeyException e) {
+			throw new Saml2Exception(e);
+		}
+	}
+
+	private static X509Certificate idpCertificate()  {
+		return certificate("-----BEGIN CERTIFICATE-----\n"
+				+ "MIIEEzCCAvugAwIBAgIJAIc1qzLrv+5nMA0GCSqGSIb3DQEBCwUAMIGfMQswCQYD\n"
+				+ "VQQGEwJVUzELMAkGA1UECAwCQ08xFDASBgNVBAcMC0Nhc3RsZSBSb2NrMRwwGgYD\n"
+				+ "VQQKDBNTYW1sIFRlc3RpbmcgU2VydmVyMQswCQYDVQQLDAJJVDEgMB4GA1UEAwwX\n"
+				+ "c2ltcGxlc2FtbHBocC5jZmFwcHMuaW8xIDAeBgkqhkiG9w0BCQEWEWZoYW5pa0Bw\n"
+				+ "aXZvdGFsLmlvMB4XDTE1MDIyMzIyNDUwM1oXDTI1MDIyMjIyNDUwM1owgZ8xCzAJ\n"
+				+ "BgNVBAYTAlVTMQswCQYDVQQIDAJDTzEUMBIGA1UEBwwLQ2FzdGxlIFJvY2sxHDAa\n"
+				+ "BgNVBAoME1NhbWwgVGVzdGluZyBTZXJ2ZXIxCzAJBgNVBAsMAklUMSAwHgYDVQQD\n"
+				+ "DBdzaW1wbGVzYW1scGhwLmNmYXBwcy5pbzEgMB4GCSqGSIb3DQEJARYRZmhhbmlr\n"
+				+ "QHBpdm90YWwuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4cn62\n"
+				+ "E1xLqpN34PmbrKBbkOXFjzWgJ9b+pXuaRft6A339uuIQeoeH5qeSKRVTl32L0gdz\n"
+				+ "2ZivLwZXW+cqvftVW1tvEHvzJFyxeTW3fCUeCQsebLnA2qRa07RkxTo6Nf244mWW\n"
+				+ "RDodcoHEfDUSbxfTZ6IExSojSIU2RnD6WllYWFdD1GFpBJOmQB8rAc8wJIBdHFdQ\n"
+				+ "nX8Ttl7hZ6rtgqEYMzYVMuJ2F2r1HSU1zSAvwpdYP6rRGFRJEfdA9mm3WKfNLSc5\n"
+				+ "cljz0X/TXy0vVlAV95l9qcfFzPmrkNIst9FZSwpvB49LyAVke04FQPPwLgVH4gph\n"
+				+ "iJH3jvZ7I+J5lS8VAgMBAAGjUDBOMB0GA1UdDgQWBBTTyP6Cc5HlBJ5+ucVCwGc5\n"
+				+ "ogKNGzAfBgNVHSMEGDAWgBTTyP6Cc5HlBJ5+ucVCwGc5ogKNGzAMBgNVHRMEBTAD\n"
+				+ "AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAvMS4EQeP/ipV4jOG5lO6/tYCb/iJeAduO\n"
+				+ "nRhkJk0DbX329lDLZhTTL/x/w/9muCVcvLrzEp6PN+VWfw5E5FWtZN0yhGtP9R+v\n"
+				+ "ZnrV+oc2zGD+no1/ySFOe3EiJCO5dehxKjYEmBRv5sU/LZFKZpozKN/BMEa6CqLu\n"
+				+ "xbzb7ykxVr7EVFXwltPxzE9TmL9OACNNyF5eJHWMRMllarUvkcXlh4pux4ks9e6z\n"
+				+ "V9DQBy2zds9f1I3qxg0eX6JnGrXi/ZiCT+lJgVe3ZFXiejiLAiKB04sXW3ti0LW3\n"
+				+ "lx13Y1YlQ4/tlpgTgfIJxKV6nyPiLoK0nywbMd+vpAirDt2Oc+hk\n"
+				+ "-----END CERTIFICATE-----\n");
+	}
+
+
+	private static PrivateKey idpPrivateKey() {
+		return privateKey("-----BEGIN PRIVATE KEY-----\n"
+				+ "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC4cn62E1xLqpN3\n"
+				+ "4PmbrKBbkOXFjzWgJ9b+pXuaRft6A339uuIQeoeH5qeSKRVTl32L0gdz2ZivLwZX\n"
+				+ "W+cqvftVW1tvEHvzJFyxeTW3fCUeCQsebLnA2qRa07RkxTo6Nf244mWWRDodcoHE\n"
+				+ "fDUSbxfTZ6IExSojSIU2RnD6WllYWFdD1GFpBJOmQB8rAc8wJIBdHFdQnX8Ttl7h\n"
+				+ "Z6rtgqEYMzYVMuJ2F2r1HSU1zSAvwpdYP6rRGFRJEfdA9mm3WKfNLSc5cljz0X/T\n"
+				+ "Xy0vVlAV95l9qcfFzPmrkNIst9FZSwpvB49LyAVke04FQPPwLgVH4gphiJH3jvZ7\n"
+				+ "I+J5lS8VAgMBAAECggEBAKyxBlIS7mcp3chvq0RF7B3PHFJMMzkwE+t3pLJcs4cZ\n"
+				+ "nezh/KbREfP70QjXzk/llnZCvxeIs5vRu24vbdBm79qLHqBuHp8XfHHtuo2AfoAQ\n"
+				+ "l4h047Xc/+TKMivnPQ0jX9qqndKDLqZDf5wnbslDmlskvF0a/MjsLU0TxtOfo+dB\n"
+				+ "t55FW11cGqxZwhS5Gnr+cbw3OkHz23b9gEOt9qfwPVepeysbmm9FjU+k4yVa7rAN\n"
+				+ "xcbzVb6Y7GCITe2tgvvEHmjB9BLmWrH3mZ3Af17YU/iN6TrpPd6Sj3QoS+2wGtAe\n"
+				+ "HbUs3CKJu7bIHcj4poal6Kh8519S+erJTtqQ8M0ZiEECgYEA43hLYAPaUueFkdfh\n"
+				+ "9K/7ClH6436CUH3VdizwUXi26fdhhV/I/ot6zLfU2mgEHU22LBECWQGtAFm8kv0P\n"
+				+ "zPn+qjaR3e62l5PIlSYbnkIidzoDZ2ztu4jF5LgStlTJQPteFEGgZVl5o9DaSZOq\n"
+				+ "Yd7G3XqXuQ1VGMW58G5FYJPtA1cCgYEAz5TPUtK+R2KXHMjUwlGY9AefQYRYmyX2\n"
+				+ "Tn/OFgKvY8lpAkMrhPKONq7SMYc8E9v9G7A0dIOXvW7QOYSapNhKU+np3lUafR5F\n"
+				+ "4ZN0bxZ9qjHbn3AMYeraKjeutHvlLtbHdIc1j3sxe/EzltRsYmiqLdEBW0p6hwWg\n"
+				+ "tyGhYWVyaXMCgYAfDOKtHpmEy5nOCLwNXKBWDk7DExfSyPqEgSnk1SeS1HP5ctPK\n"
+				+ "+1st6sIhdiVpopwFc+TwJWxqKdW18tlfT5jVv1E2DEnccw3kXilS9xAhWkfwrEvf\n"
+				+ "V5I74GydewFl32o+NZ8hdo9GL1I8zO1rIq/et8dSOWGuWf9BtKu/vTGTTQKBgFxU\n"
+				+ "VjsCnbvmsEwPUAL2hE/WrBFaKocnxXx5AFNt8lEyHtDwy4Sg1nygGcIJ4sD6koQk\n"
+				+ "RdClT3LkvR04TAiSY80bN/i6ZcPNGUwSaDGZEWAIOSWbkwZijZNFnSGOEgxZX/IG\n"
+				+ "yd39766vREEMTwEeiMNEOZQ/dmxkJm4OOVe25cLdAoGACOtPnq1Fxay80UYBf4rQ\n"
+				+ "+bJ9yX1ulB8WIree1hD7OHSB2lRHxrVYWrglrTvkh63Lgx+EcsTV788OsvAVfPPz\n"
+				+ "BZrn8SdDlQqalMxUBYEFwnsYD3cQ8yOUnijFVC4xNcdDv8OIqVgSk4KKxU5AshaA\n" + "xk6Mox+u8Cc2eAK12H13i+8=\n"
+				+ "-----END PRIVATE KEY-----\n");
+	}
+
+	private static X509Certificate spCertificate() {
+
+		return certificate("-----BEGIN CERTIFICATE-----\n" +
+				"MIICgTCCAeoCCQCuVzyqFgMSyDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMC\n" +
+				"VVMxEzARBgNVBAgMCldhc2hpbmd0b24xEjAQBgNVBAcMCVZhbmNvdXZlcjEdMBsG\n" +
+				"A1UECgwUU3ByaW5nIFNlY3VyaXR5IFNBTUwxCzAJBgNVBAsMAnNwMSAwHgYDVQQD\n" +
+				"DBdzcC5zcHJpbmcuc2VjdXJpdHkuc2FtbDAeFw0xODA1MTQxNDMwNDRaFw0yODA1\n" +
+				"MTExNDMwNDRaMIGEMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjES\n" +
+				"MBAGA1UEBwwJVmFuY291dmVyMR0wGwYDVQQKDBRTcHJpbmcgU2VjdXJpdHkgU0FN\n" +
+				"TDELMAkGA1UECwwCc3AxIDAeBgNVBAMMF3NwLnNwcmluZy5zZWN1cml0eS5zYW1s\n" +
+				"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRu7/EI0BlNzMEBFVAcbx+lLos\n" +
+				"vzIWU+01dGTY8gBdhMQNYKZ92lMceo2CuVJ66cUURPym3i7nGGzoSnAxAre+0YIM\n" +
+				"+U0razrWtAUE735bkcqELZkOTZLelaoOztmWqRbe5OuEmpewH7cx+kNgcVjdctOG\n" +
+				"y3Q6x+I4qakY/9qhBQIDAQABMA0GCSqGSIb3DQEBCwUAA4GBAAeViTvHOyQopWEi\n" +
+				"XOfI2Z9eukwrSknDwq/zscR0YxwwqDBMt/QdAODfSwAfnciiYLkmEjlozWRtOeN+\n" +
+				"qK7UFgP1bRl5qksrYX5S0z2iGJh0GvonLUt3e20Ssfl5tTEDDnAEUMLfBkyaxEHD\n" +
+				"RZ/nbTJ7VTeZOSyRoVn5XHhpuJ0B\n" +
+				"-----END CERTIFICATE-----");
+	}
+
+	private static PrivateKey spPrivateKey() {
+		return privateKey("-----BEGIN PRIVATE KEY-----\n" +
+				"MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBANG7v8QjQGU3MwQE\n" +
+				"VUBxvH6Uuiy/MhZT7TV0ZNjyAF2ExA1gpn3aUxx6jYK5UnrpxRRE/KbeLucYbOhK\n" +
+				"cDECt77Rggz5TStrOta0BQTvfluRyoQtmQ5Nkt6Vqg7O2ZapFt7k64Sal7AftzH6\n" +
+				"Q2BxWN1y04bLdDrH4jipqRj/2qEFAgMBAAECgYEAj4ExY1jjdN3iEDuOwXuRB+Nn\n" +
+				"x7pC4TgntE2huzdKvLJdGvIouTArce8A6JM5NlTBvm69mMepvAHgcsiMH1zGr5J5\n" +
+				"wJz23mGOyhM1veON41/DJTVG+cxq4soUZhdYy3bpOuXGMAaJ8QLMbQQoivllNihd\n" +
+				"vwH0rNSK8LTYWWPZYIECQQDxct+TFX1VsQ1eo41K0T4fu2rWUaxlvjUGhK6HxTmY\n" +
+				"8OMJptunGRJL1CUjIb45Uz7SP8TPz5FwhXWsLfS182kRAkEA3l+Qd9C9gdpUh1uX\n" +
+				"oPSNIxn5hFUrSTW1EwP9QH9vhwb5Vr8Jrd5ei678WYDLjUcx648RjkjhU9jSMzIx\n" +
+				"EGvYtQJBAMm/i9NR7IVyyNIgZUpz5q4LI21rl1r4gUQuD8vA36zM81i4ROeuCly0\n" +
+				"KkfdxR4PUfnKcQCX11YnHjk9uTFj75ECQEFY/gBnxDjzqyF35hAzrYIiMPQVfznt\n" +
+				"YX/sDTE2AdVBVGaMj1Cb51bPHnNC6Q5kXKQnj/YrLqRQND09Q7ParX0CQQC5NxZr\n" +
+				"9jKqhHj8yQD6PlXTsY4Occ7DH6/IoDenfdEVD5qlet0zmd50HatN2Jiqm5ubN7CM\n" +
+				"INrtuLp4YHbgk1mi\n" +
+				"-----END PRIVATE KEY-----");
+	}
+
+}

samples/boot/saml2login/src/integration-test/java/org/springframework/security/samples/Saml2LoginIntegrationTests.java

@@ -22,11 +22,15 @@ import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMock
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.http.MediaType;
+import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException;
 import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.util.AssertionErrors;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.ResultActions;
+import org.springframework.test.web.servlet.ResultMatcher;
 
 import net.shibboleth.utilities.java.support.xml.SerializeSupport;
+import org.hamcrest.Matcher;
 import org.joda.time.DateTime;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -62,9 +66,11 @@ import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import java.util.UUID;
+import javax.servlet.http.HttpSession;
 
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.startsWith;
 import static org.springframework.security.samples.OpenSamlActionTestingSupport.buildConditions;
 import static org.springframework.security.samples.OpenSamlActionTestingSupport.buildIssuer;
@@ -74,6 +80,9 @@ import static org.springframework.security.samples.OpenSamlActionTestingSupport.
 import static org.springframework.security.samples.OpenSamlActionTestingSupport.encryptNameId;
 import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
 import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated;
+import static org.springframework.security.web.WebAttributes.AUTHENTICATION_EXCEPTION;
+import static org.springframework.test.util.AssertionErrors.assertEquals;
+import static org.springframework.test.util.AssertionErrors.assertTrue;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
@@ -86,6 +95,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 public class Saml2LoginIntegrationTests {
 
 	static final String LOCAL_SP_ENTITY_ID = "http://localhost:8080/saml2/service-provider-metadata/simplesamlphp";
+	static final String USERNAME = "testuser@spring.security.saml";
 
 	@Autowired
 	MockMvc mockMvc;
@@ -97,21 +107,21 @@ public class Saml2LoginIntegrationTests {
 	}
 
 	@Test
-	public void redirectToLoginPageSingleProvider() throws Exception {
+	public void applicationAccessWhenSingleProviderAndUnauthenticatedThenRedirectsToAuthNRequest() throws Exception {
 		mockMvc.perform(get("http://localhost:8080/some/url"))
 				.andExpect(status().is3xxRedirection())
 				.andExpect(redirectedUrl("http://localhost:8080/saml2/authenticate/simplesamlphp"));
 	}
 
 	@Test
-	public void testAuthNRequest() throws Exception {
+	public void authenticateRequestWhenUnauthenticatedThenRespondsWithRedirectAuthNRequestXML() throws Exception {
 		mockMvc.perform(get("http://localhost:8080/saml2/authenticate/simplesamlphp"))
 				.andExpect(status().is3xxRedirection())
 				.andExpect(header().string("Location", startsWith("https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php?SAMLRequest=")));
 	}
 
 	@Test
-	public void testRelayState() throws Exception {
+	public void authenticateRequestWhenRelayStateThenRespondsWithRedirectAndEncodedRelayState() throws Exception {
 		mockMvc.perform(
 				get("http://localhost:8080/saml2/authenticate/simplesamlphp")
 						.param("RelayState", "relay state value with spaces")
@@ -122,96 +132,136 @@ public class Saml2LoginIntegrationTests {
 	}
 
 	@Test
-	public void signedResponse() throws Exception {
-		final String username = "testuser@spring.security.saml";
-		Assertion assertion = buildAssertion(username);
+	public void authenticateWhenResponseIsSignedThenItSucceeds() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
 		Response response = buildResponse(assertion);
 		signXmlObject(response, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
-		String xml = toXml(response);
-		mockMvc.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
-				.contentType(MediaType.APPLICATION_FORM_URLENCODED)
-				.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
-				.andExpect(status().is3xxRedirection()).andExpect(redirectedUrl("/"))
-				.andExpect(authenticated().withUsername(username));
+		sendResponse(response, "/")
+				.andExpect(authenticated().withUsername(USERNAME));
 	}
 
 	@Test
-	public void signedAssertion() throws Exception {
-		final String username = "testuser@spring.security.saml";
-		Assertion assertion = buildAssertion(username);
+	public void authenticateWhenAssertionIsThenItSignedSucceeds() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
 		Response response = buildResponse(assertion);
 		signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
-		String xml = toXml(response);
-		final ResultActions actions = mockMvc
-				.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
-						.contentType(MediaType.APPLICATION_FORM_URLENCODED)
-						.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
-				.andExpect(status().is3xxRedirection()).andExpect(redirectedUrl("/"))
-				.andExpect(authenticated().withUsername(username));
+		sendResponse(response, "/")
+				.andExpect(authenticated().withUsername(USERNAME));
 	}
 
 	@Test
-	public void unsigned() throws Exception {
-		Assertion assertion = buildAssertion("testuser@spring.security.saml");
+	public void authenticateWhenXmlObjectIsNotSignedThenItFails() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
 		Response response = buildResponse(assertion);
-		String xml = toXml(response);
-		mockMvc.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
-				.contentType(MediaType.APPLICATION_FORM_URLENCODED)
-				.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
-				.andExpect(status().is3xxRedirection())
-				.andExpect(redirectedUrl("/login?error"))
+		sendResponse(response, "/login?error")
 				.andExpect(unauthenticated());
 	}
 
 	@Test
-	public void signedResponseEncryptedAssertion() throws Exception {
-		final String username = "testuser@spring.security.saml";
-		Assertion assertion = buildAssertion(username);
+	public void authenticateWhenResponseIsSignedAndAssertionIsEncryptedThenItSucceeds() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
 		EncryptedAssertion encryptedAssertion =
 				OpenSamlActionTestingSupport.encryptAssertion(assertion, decodeCertificate(spCertificate));
 		Response response = buildResponse(encryptedAssertion);
 		signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
-		String xml = toXml(response);
-		final ResultActions actions = mockMvc
-				.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
-						.contentType(MediaType.APPLICATION_FORM_URLENCODED)
-						.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
-				.andExpect(status().is3xxRedirection()).andExpect(redirectedUrl("/"))
-				.andExpect(authenticated().withUsername(username));
+		sendResponse(response, "/")
+				.andExpect(authenticated().withUsername(USERNAME));
 	}
 
 	@Test
-	public void unsignedResponseEncryptedAssertion() throws Exception {
-		final String username = "testuser@spring.security.saml";
-		Assertion assertion = buildAssertion(username);
+	public void authenticateWhenResponseIsNotSignedAndAssertionIsEncryptedThenItSucceeds() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
 		EncryptedAssertion encryptedAssertion =
 				OpenSamlActionTestingSupport.encryptAssertion(assertion, decodeCertificate(spCertificate));
 		Response response = buildResponse(encryptedAssertion);
-		String xml = toXml(response);
-		final ResultActions actions = mockMvc
-				.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
-						.contentType(MediaType.APPLICATION_FORM_URLENCODED)
-						.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
-				.andExpect(status().is3xxRedirection()).andExpect(redirectedUrl("/"))
-				.andExpect(authenticated().withUsername(username));
+		sendResponse(response, "/")
+				.andExpect(authenticated().withUsername(USERNAME));
 	}
 
 	@Test
-	public void signedResponseEncryptedNameId() throws Exception {
-		final String username = "testuser@spring.security.saml";
-		Assertion assertion = buildAssertion(username);
+	public void authenticateWhenResponseIsSignedAndNameIDisEncryptedThenItSucceeds() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
 		final EncryptedID nameId = encryptNameId(assertion.getSubject().getNameID(), decodeCertificate(spCertificate));
 		assertion.getSubject().setEncryptedID(nameId);
 		assertion.getSubject().setNameID(null);
 		Response response = buildResponse(assertion);
 		signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
+		sendResponse(response, "/")
+				.andExpect(authenticated().withUsername(USERNAME));
+	}
+
+	@Test
+	public void authenticateWhenSignatureKeysDontMatchThenItFails() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
+		Response response = buildResponse(assertion);
+		signXmlObject(assertion, getSigningCredential(spCertificate, spPrivateKey, UsageType.SIGNING));
+		sendResponse(response, "/login?error")
+				.andExpect(
+						saml2AuthenticationExceptionMatcher(
+								"invalid_signature",
+								equalTo("Assertion doesn't have a valid signature.")
+						)
+				);
+	}
+
+	@Test
+	public void authenticateWhenNotOnOrAfterDontMatchThenItFails() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
+		assertion.getConditions().setNotOnOrAfter(DateTime.now().minusDays(1));
+		Response response = buildResponse(assertion);
+		signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
+		sendResponse(response, "/login?error")
+				.andExpect(
+						saml2AuthenticationExceptionMatcher(
+								"invalid_assertion",
+								containsString("Assertion 'assertion' with NotOnOrAfter condition of")
+						)
+				);
+	}
+
+	@Test
+	public void authenticateWhenNotOnOrBeforeDontMatchThenItFails() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
+		assertion.getConditions().setNotBefore(DateTime.now().plusDays(1));
+		Response response = buildResponse(assertion);
+		signXmlObject(assertion, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
+		sendResponse(response, "/login?error")
+				.andExpect(
+						saml2AuthenticationExceptionMatcher(
+								"invalid_assertion",
+								containsString("Assertion 'assertion' with NotBefore condition of")
+						)
+				);
+	}
+
+	@Test
+	public void authenticateWhenIssuerIsInvalidThenItFails() throws Exception {
+		Assertion assertion = buildAssertion(USERNAME);
+		Response response = buildResponse(assertion);
+		response.getIssuer().setValue("invalid issuer");
+		signXmlObject(response, getSigningCredential(idpCertificate, idpPrivateKey, UsageType.SIGNING));
+		sendResponse(response, "/login?error")
+				.andExpect(unauthenticated())
+				.andExpect(
+						saml2AuthenticationExceptionMatcher(
+								"invalid_issuer",
+								containsString(
+										"Response issuer 'invalid issuer' doesn't match "+
+										"'https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php'"
+								)
+						)
+				);
+	}
+
+	private ResultActions sendResponse(
+			Response response,
+			String redirectUrl) throws Exception {
 		String xml = toXml(response);
-		final ResultActions actions = mockMvc
-				.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
-						.contentType(MediaType.APPLICATION_FORM_URLENCODED)
-						.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
-				.andExpect(status().is3xxRedirection()).andExpect(redirectedUrl("/"))
-				.andExpect(authenticated().withUsername(username));
+		return mockMvc.perform(post("http://localhost:8080/login/saml2/sso/simplesamlphp")
+				.contentType(MediaType.APPLICATION_FORM_URLENCODED)
+				.param("SAMLResponse", OpenSamlActionTestingSupport.encode(xml.getBytes(UTF_8))))
+				.andExpect(status().is3xxRedirection())
+				.andExpect(redirectedUrl(redirectUrl));
 	}
 
 	private Response buildResponse(Assertion assertion) {
@@ -359,4 +409,42 @@ public class Saml2LoginIntegrationTests {
 			"RZ/nbTJ7VTeZOSyRoVn5XHhpuJ0B\n" +
 			"-----END CERTIFICATE-----";
 
+	private String spPrivateKey = "-----BEGIN PRIVATE KEY-----\n" +
+			"MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBANG7v8QjQGU3MwQE\n" +
+			"VUBxvH6Uuiy/MhZT7TV0ZNjyAF2ExA1gpn3aUxx6jYK5UnrpxRRE/KbeLucYbOhK\n" +
+			"cDECt77Rggz5TStrOta0BQTvfluRyoQtmQ5Nkt6Vqg7O2ZapFt7k64Sal7AftzH6\n" +
+			"Q2BxWN1y04bLdDrH4jipqRj/2qEFAgMBAAECgYEAj4ExY1jjdN3iEDuOwXuRB+Nn\n" +
+			"x7pC4TgntE2huzdKvLJdGvIouTArce8A6JM5NlTBvm69mMepvAHgcsiMH1zGr5J5\n" +
+			"wJz23mGOyhM1veON41/DJTVG+cxq4soUZhdYy3bpOuXGMAaJ8QLMbQQoivllNihd\n" +
+			"vwH0rNSK8LTYWWPZYIECQQDxct+TFX1VsQ1eo41K0T4fu2rWUaxlvjUGhK6HxTmY\n" +
+			"8OMJptunGRJL1CUjIb45Uz7SP8TPz5FwhXWsLfS182kRAkEA3l+Qd9C9gdpUh1uX\n" +
+			"oPSNIxn5hFUrSTW1EwP9QH9vhwb5Vr8Jrd5ei678WYDLjUcx648RjkjhU9jSMzIx\n" +
+			"EGvYtQJBAMm/i9NR7IVyyNIgZUpz5q4LI21rl1r4gUQuD8vA36zM81i4ROeuCly0\n" +
+			"KkfdxR4PUfnKcQCX11YnHjk9uTFj75ECQEFY/gBnxDjzqyF35hAzrYIiMPQVfznt\n" +
+			"YX/sDTE2AdVBVGaMj1Cb51bPHnNC6Q5kXKQnj/YrLqRQND09Q7ParX0CQQC5NxZr\n" +
+			"9jKqhHj8yQD6PlXTsY4Occ7DH6/IoDenfdEVD5qlet0zmd50HatN2Jiqm5ubN7CM\n" +
+			"INrtuLp4YHbgk1mi\n" +
+			"-----END PRIVATE KEY-----";
+
+	private static ResultMatcher saml2AuthenticationExceptionMatcher(
+			String code,
+			Matcher<String> message
+	) {
+		return result -> {
+			final HttpSession session = result.getRequest().getSession(false);
+			AssertionErrors.assertNotNull("HttpSession", session);
+			Object exception = session.getAttribute(AUTHENTICATION_EXCEPTION);
+			AssertionErrors.assertNotNull(AUTHENTICATION_EXCEPTION, exception);
+			if (!(exception instanceof Saml2AuthenticationException)) {
+				AssertionErrors.fail(
+						"Invalid exception type",
+						Saml2AuthenticationException.class,
+						exception.getClass().getName()
+				);
+			}
+			Saml2AuthenticationException se = (Saml2AuthenticationException) exception;
+			assertEquals("SAML 2 Error Code", code, se.getError().getErrorCode());
+			assertTrue("SAML 2 Error Description", message.matches(se.getError().getDescription()));
+		};
+	}
 }