Author: dkulp Date: Thu Oct 25 14:55:39 2012 New Revision: 1402179 URL: http://svn.apache.org/viewvc?rev=1402179&view=rev Log: Merged revisions 1401805 via git cherry-pick from https://svn.apache.org/repos/asf/cxf/branches/2.6.x-fixes
........ r1401805 | dkulp | 2012-10-24 14:17:09 -0400 (Wed, 24 Oct 2012) | 11 lines Merged revisions 1401791 via git cherry-pick from https://svn.apache.org/repos/asf/cxf/trunk ........ r1401791 | dkulp | 2012-10-24 13:32:25 -0400 (Wed, 24 Oct 2012) | 3 lines [CXF-4595] RequireClientCertificate is not validated Patch from Jason Pell applied ........ ........ Modified: cxf/branches/2.5.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/TransportBindingPolicyValidator.java cxf/branches/2.5.x-fixes/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/policy/PolicyAlternativeTest.java cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/DoubleItPolicy.wsdl cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/client/client.xml cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/server/server.xml Modified: cxf/branches/2.5.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/TransportBindingPolicyValidator.java URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/TransportBindingPolicyValidator.java?rev=1402179&r1=1402178&r2=1402179&view=diff ============================================================================== --- cxf/branches/2.5.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/TransportBindingPolicyValidator.java (original) +++ cxf/branches/2.5.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/TransportBindingPolicyValidator.java Thu Oct 25 14:55:39 2012 @@ -68,7 +68,6 @@ public class TransportBindingPolicyValid // HttpsToken is validated by the HttpsTokenInterceptorProvider if (binding.getTransportToken() != null) { assertPolicy(aim, binding.getTransportToken()); - assertPolicy(aim, binding.getTransportToken().getToken()); } // Check the AlgorithmSuite Modified: cxf/branches/2.5.x-fixes/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/policy/PolicyAlternativeTest.java URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/policy/PolicyAlternativeTest.java?rev=1402179&r1=1402178&r2=1402179&view=diff ============================================================================== --- cxf/branches/2.5.x-fixes/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/policy/PolicyAlternativeTest.java (original) +++ cxf/branches/2.5.x-fixes/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/policy/PolicyAlternativeTest.java Thu Oct 25 14:55:39 2012 @@ -143,6 +143,38 @@ public class PolicyAlternativeTest exten ((java.io.Closeable)utPort).close(); bus.shutdown(true); } + + /** + * The client does not require a client cert so invocation should fail + * + * @throws Exception + */ + @org.junit.Test + public void testRequireClientCertToken() throws Exception { + SpringBusFactory bf = new SpringBusFactory(); + URL busFile = PolicyAlternativeTest.class.getResource("client/client.xml"); + + Bus bus = bf.createBus(busFile.toString()); + SpringBusFactory.setDefaultBus(bus); + SpringBusFactory.setThreadDefaultBus(bus); + + URL wsdl = PolicyAlternativeTest.class.getResource("DoubleItPolicy.wsdl"); + Service service = Service.create(wsdl, SERVICE_QNAME); + QName portQName = new QName(NAMESPACE, "DoubleItClientCertPort"); + DoubleItPortType utPort = + service.getPort(portQName, DoubleItPortType.class); + updateAddressPort(utPort, PORT2); + + try { + utPort.doubleIt(25); + fail("Failure expected because no client certificate"); + } catch (javax.xml.ws.soap.SOAPFaultException ex) { + assertTrue(ex.getMessage().contains("HttpsToken")); + } + + ((java.io.Closeable)utPort).close(); + bus.shutdown(true); + } /** * The client uses a Transport binding policy with a Endorsing Supporting X509 Token. The client does Modified: cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/DoubleItPolicy.wsdl URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/DoubleItPolicy.wsdl?rev=1402179&r1=1402178&r2=1402179&view=diff ============================================================================== --- cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/DoubleItPolicy.wsdl (original) +++ cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/DoubleItPolicy.wsdl Thu Oct 25 14:55:39 2012 @@ -54,6 +54,9 @@ <wsdl:port name="DoubleItUsernameTokenPort" binding="tns:DoubleItInlinePolicyBinding"> <soap:address location="http://localhost:9010/DoubleItUsernameToken"; /> </wsdl:port> + <wsdl:port name="DoubleItClientCertPort" binding="tns:DoubleItInlinePolicyBinding"> + <soap:address location="https://localhost:9011/DoubleItClientCert"; /> + </wsdl:port> <wsdl:port name="DoubleItNoSecurityPort" binding="tns:DoubleItInlinePolicyBinding"> <soap:address location="http://localhost:9010/DoubleItNoSecurity"; /> </wsdl:port> Modified: cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/client/client.xml URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/client/client.xml?rev=1402179&r1=1402178&r2=1402179&view=diff ============================================================================== --- cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/client/client.xml (original) +++ cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/client/client.xml Thu Oct 25 14:55:39 2012 @@ -98,6 +98,22 @@ </jaxws:features> </jaxws:client> + <jaxws:client + name="{http://www.example.org/contract/DoubleIt}DoubleItClientCertPort"; createdFromAPI="true"> + + <jaxws:properties> + <entry key="ws-security.username" value="Alice" /> + <entry key="ws-security.callback-handler" + value="org.apache.cxf.systest.ws.wssec10.client.UTPasswordCallback" /> + </jaxws:properties> + <jaxws:features> + <p:policies> + <wsp:PolicyReference xmlns:wsp="http://www.w3.org/ns/ws-policy"; URI="#UsernameToken" /> + </p:policies> + </jaxws:features> + + </jaxws:client> + <jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItTransportSupportingSignedPort"; createdFromAPI="true"> <jaxws:properties> Modified: cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/server/server.xml URL: http://svn.apache.org/viewvc/cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/server/server.xml?rev=1402179&r1=1402178&r2=1402179&view=diff ============================================================================== --- cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/server/server.xml (original) +++ cxf/branches/2.5.x-fixes/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/policy/server/server.xml Thu Oct 25 14:55:39 2012 @@ -134,6 +134,26 @@ </jaxws:endpoint> + <jaxws:endpoint id="ClientCertTokenEndpoint" + address="https://localhost:${testutil.ports.Server.2}/DoubleItClientCert"; + serviceName="s:DoubleItService" endpointName="s:DoubleItClientCertPort" + xmlns:s="http://www.example.org/contract/DoubleIt"; implementor="org.apache.cxf.systest.ws.common.DoubleItPortTypeImpl" + wsdlLocation="org/apache/cxf/systest/ws/policy/DoubleItPolicy.wsdl"> + + <jaxws:properties> + <entry key="ws-security.callback-handler" + value="org.apache.cxf.systest.ws.wssec10.client.UTPasswordCallback" /> + </jaxws:properties> + + <jaxws:features> + <p:policies> + <wsp:PolicyReference xmlns:wsp="http://www.w3.org/ns/ws-policy"; + URI="#RequireClientCertificatePolicy" /> + </p:policies> + </jaxws:features> + + </jaxws:endpoint> + <jaxws:endpoint id="TransportSupportingSigned" address="https://localhost:${testutil.ports.Server.2}/DoubleItTransportSupportingSigned"; @@ -305,6 +325,38 @@ </wsp:ExactlyOne> </wsp:Policy> + <wsp:Policy wsu:Id="RequireClientCertificatePolicy" + xmlns:wsp="http://www.w3.org/ns/ws-policy"; + xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; + xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy";> + <wsp:ExactlyOne> + <wsp:All> + <sp:TransportBinding> + <wsp:Policy> + <sp:TransportToken> + <wsp:Policy> + <sp:HttpsToken RequireClientCertificate="true" /> + </wsp:Policy> + </sp:TransportToken> + <sp:AlgorithmSuite> + <wsp:Policy> + <sp:Basic256 /> + </wsp:Policy> + </sp:AlgorithmSuite> + </wsp:Policy> + </sp:TransportBinding> + <sp:SupportingTokens> + <wsp:Policy> + <sp:UsernameToken> + <wsp:Policy> + <sp:WssUsernameToken11 /> + </wsp:Policy> + </sp:UsernameToken> + </wsp:Policy> + </sp:SupportingTokens> + </wsp:All> + </wsp:ExactlyOne> + </wsp:Policy> </beans>
