Author: coheigea
Date: Mon Jan 28 14:16:44 2013
New Revision: 1439416
URL: http://svn.apache.org/viewvc?rev=1439416&view=rev
Log:
Merged revisions 1439415 via git cherry-pick from
https://svn.apache.org/repos/asf/cxf/trunk
........
r1439415 | coheigea | 2013-01-28 14:15:42 +0000 (Mon, 28 Jan 2013) | 2 lines
Some updates to the token interceptors
........
Modified:
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractTokenInterceptor.java
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/KerberosTokenInterceptor.java
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/UsernameTokenInterceptor.java
Modified:
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractTokenInterceptor.java
URL:
http://svn.apache.org/viewvc/cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractTokenInterceptor.java?rev=1439416&r1=1439415&r2=1439416&view=diff
==============================================================================
---
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractTokenInterceptor.java
(original)
+++
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractTokenInterceptor.java
Mon Jan 28 14:16:44 2013
@@ -20,7 +20,7 @@
package org.apache.cxf.ws.security.wss4j;
import java.util.Collection;
-import java.util.HashSet;
+import java.util.Collections;
import java.util.Set;
import java.util.logging.Logger;
@@ -42,11 +42,13 @@ import org.apache.cxf.helpers.DOMUtils;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.message.MessageUtils;
import org.apache.cxf.phase.Phase;
+import org.apache.cxf.security.transport.TLSSessionInfo;
import org.apache.cxf.service.model.EndpointInfo;
import org.apache.cxf.ws.policy.AssertionInfo;
import org.apache.cxf.ws.policy.AssertionInfoMap;
import org.apache.cxf.ws.policy.PolicyException;
import org.apache.cxf.ws.security.SecurityConstants;
+import org.apache.cxf.ws.security.policy.SP12Constants;
import org.apache.cxf.ws.security.policy.model.Token;
import org.apache.cxf.ws.security.tokenstore.TokenStore;
import org.apache.ws.security.WSConstants;
@@ -58,11 +60,8 @@ import org.apache.ws.security.WSPassword
*/
public abstract class AbstractTokenInterceptor extends AbstractSoapInterceptor
{
private static final Logger LOG =
LogUtils.getL7dLogger(AbstractSoapInterceptor.class);
- private static final Set<QName> HEADERS = new HashSet<QName>();
- static {
- HEADERS.add(new QName(WSConstants.WSSE_NS, "Security"));
- HEADERS.add(new QName(WSConstants.WSSE11_NS, "Security"));
- }
+ private static final Set<QName> HEADERS =
+ Collections.singleton(new QName(WSConstants.WSSE_NS, "Security"));
/**
* @param p
@@ -109,6 +108,37 @@ public abstract class AbstractTokenInter
protected abstract Token assertTokens(SoapMessage message);
+ protected Token assertTokens(SoapMessage message, QName assertion, boolean
signed) {
+ AssertionInfoMap aim = message.get(AssertionInfoMap.class);
+ Collection<AssertionInfo> ais = aim.getAssertionInfo(assertion);
+ Token tok = null;
+ for (AssertionInfo ai : ais) {
+ tok = (Token)ai.getAssertion();
+ ai.setAsserted(true);
+ }
+ ais = aim.getAssertionInfo(SP12Constants.SUPPORTING_TOKENS);
+ for (AssertionInfo ai : ais) {
+ ai.setAsserted(true);
+ }
+
+ if (signed || isTLSInUse(message)) {
+ ais = aim.getAssertionInfo(SP12Constants.SIGNED_SUPPORTING_TOKENS);
+ for (AssertionInfo ai : ais) {
+ ai.setAsserted(true);
+ }
+ }
+ return tok;
+ }
+
+ protected boolean isTLSInUse(SoapMessage message) {
+ // See whether TLS is in use or not
+ TLSSessionInfo tlsInfo = message.get(TLSSessionInfo.class);
+ if (tlsInfo != null) {
+ return true;
+ }
+ return false;
+ }
+
protected CallbackHandler getCallback(SoapMessage message) {
//Then try to get the password from the given callback handler
Object o =
message.getContextualProperty(SecurityConstants.CALLBACK_HANDLER);
Modified:
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/KerberosTokenInterceptor.java
URL:
http://svn.apache.org/viewvc/cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/KerberosTokenInterceptor.java?rev=1439416&r1=1439415&r2=1439416&view=diff
==============================================================================
---
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/KerberosTokenInterceptor.java
(original)
+++
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/KerberosTokenInterceptor.java
Mon Jan 28 14:16:44 2013
@@ -21,7 +21,6 @@ package org.apache.cxf.ws.security.wss4j
import java.security.Principal;
import java.util.ArrayList;
-import java.util.Collection;
import java.util.List;
import javax.security.auth.callback.CallbackHandler;
@@ -37,14 +36,12 @@ import org.apache.cxf.helpers.DOMUtils;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.interceptor.security.DefaultSecurityContext;
import org.apache.cxf.security.SecurityContext;
-import org.apache.cxf.ws.policy.AssertionInfo;
-import org.apache.cxf.ws.policy.AssertionInfoMap;
import org.apache.cxf.ws.security.SecurityConstants;
import org.apache.cxf.ws.security.policy.SP12Constants;
-import org.apache.cxf.ws.security.policy.model.KerberosToken;
import org.apache.cxf.ws.security.policy.model.Token;
import org.apache.cxf.ws.security.tokenstore.SecurityToken;
import org.apache.cxf.ws.security.tokenstore.TokenStore;
+import org.apache.ws.security.WSConstants;
import org.apache.ws.security.WSDocInfo;
import org.apache.ws.security.WSSConfig;
import org.apache.ws.security.WSSecurityEngineResult;
@@ -75,7 +72,8 @@ public class KerberosTokenInterceptor ex
Element el = (Element)h.getObject();
Element child = DOMUtils.getFirstElement(el);
while (child != null) {
- if ("BinarySecurityToken".equals(child.getLocalName())) {
+ if (WSConstants.BINARY_TOKEN_LN.equals(child.getLocalName())
+ && WSConstants.WSSE_NS.equals(child.getNamespaceURI())) {
try {
List<WSSecurityEngineResult> bstResults =
processToken(child, message);
if (bstResults != null) {
@@ -88,7 +86,7 @@ public class KerberosTokenInterceptor ex
WSHandlerResult rResult = new WSHandlerResult(null,
bstResults);
results.add(0, rResult);
- assertTokens(message);
+ assertTokens(message, SP12Constants.KERBEROS_TOKEN,
false);
Principal principal =
(Principal)bstResults.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
@@ -145,25 +143,9 @@ public class KerberosTokenInterceptor ex
}
protected Token assertTokens(SoapMessage message) {
- AssertionInfoMap aim = message.get(AssertionInfoMap.class);
- Collection<AssertionInfo> ais =
aim.getAssertionInfo(SP12Constants.KERBEROS_TOKEN);
- KerberosToken tok = null;
- for (AssertionInfo ai : ais) {
- tok = (KerberosToken)ai.getAssertion();
- ai.setAsserted(true);
- }
- ais = aim.getAssertionInfo(SP12Constants.SUPPORTING_TOKENS);
- for (AssertionInfo ai : ais) {
- ai.setAsserted(true);
- }
- ais = aim.getAssertionInfo(SP12Constants.SIGNED_SUPPORTING_TOKENS);
- for (AssertionInfo ai : ais) {
- ai.setAsserted(true);
- }
- return tok;
+ return assertTokens(message, SP12Constants.KERBEROS_TOKEN, true);
}
-
protected void addToken(SoapMessage message) {
SecurityToken securityToken = getSecurityToken(message);
if (securityToken == null || securityToken.getToken() == null) {
Modified:
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java
URL:
http://svn.apache.org/viewvc/cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java?rev=1439416&r1=1439415&r2=1439416&view=diff
==============================================================================
---
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java
(original)
+++
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java
Mon Jan 28 14:16:44 2013
@@ -51,6 +51,7 @@ import org.apache.cxf.ws.security.Securi
import org.apache.cxf.ws.security.policy.SP12Constants;
import org.apache.cxf.ws.security.policy.model.SamlToken;
import org.apache.cxf.ws.security.policy.model.Token;
+import org.apache.ws.security.WSConstants;
import org.apache.ws.security.WSDocInfo;
import org.apache.ws.security.WSPasswordCallback;
import org.apache.ws.security.WSSConfig;
@@ -86,7 +87,9 @@ public class SamlTokenInterceptor extend
Element el = (Element)h.getObject();
Element child = DOMUtils.getFirstElement(el);
while (child != null) {
- if ("Assertion".equals(child.getLocalName())) {
+ if ("Assertion".equals(child.getLocalName())
+ && (WSConstants.SAML_NS.equals(child.getNamespaceURI())
+ || WSConstants.SAML2_NS.equals(child.getNamespaceURI()))) {
try {
List<WSSecurityEngineResult> samlResults =
processToken(child, message);
if (samlResults != null) {
@@ -99,7 +102,16 @@ public class SamlTokenInterceptor extend
WSHandlerResult rResult = new WSHandlerResult(null,
samlResults);
results.add(0, rResult);
- assertTokens(message);
+ boolean signed = false;
+ for (WSSecurityEngineResult result : samlResults) {
+ AssertionWrapper wrapper =
+
(AssertionWrapper)result.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
+ if (wrapper.isSigned()) {
+ signed = true;
+ break;
+ }
+ }
+ assertTokens(message, SP12Constants.SAML_TOKEN,
signed);
Principal principal =
(Principal)samlResults.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
@@ -163,25 +175,9 @@ public class SamlTokenInterceptor extend
}
protected Token assertTokens(SoapMessage message) {
- AssertionInfoMap aim = message.get(AssertionInfoMap.class);
- Collection<AssertionInfo> ais =
aim.getAssertionInfo(SP12Constants.SAML_TOKEN);
- SamlToken tok = null;
- for (AssertionInfo ai : ais) {
- tok = (SamlToken)ai.getAssertion();
- ai.setAsserted(true);
- }
- ais = aim.getAssertionInfo(SP12Constants.SUPPORTING_TOKENS);
- for (AssertionInfo ai : ais) {
- ai.setAsserted(true);
- }
- ais = aim.getAssertionInfo(SP12Constants.SIGNED_SUPPORTING_TOKENS);
- for (AssertionInfo ai : ais) {
- ai.setAsserted(true);
- }
- return tok;
+ return assertTokens(message, SP12Constants.SAML_TOKEN, true);
}
-
protected void addToken(SoapMessage message) {
WSSConfig.init();
SamlToken tok = (SamlToken)assertTokens(message);
Modified:
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/UsernameTokenInterceptor.java
URL:
http://svn.apache.org/viewvc/cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/UsernameTokenInterceptor.java?rev=1439416&r1=1439415&r2=1439416&view=diff
==============================================================================
---
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/UsernameTokenInterceptor.java
(original)
+++
cxf/branches/2.7.x-fixes/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/UsernameTokenInterceptor.java
Mon Jan 28 14:16:44 2013
@@ -78,7 +78,8 @@ public class UsernameTokenInterceptor ex
Element el = (Element)h.getObject();
Element child = DOMUtils.getFirstElement(el);
while (child != null) {
- if (SPConstants.USERNAME_TOKEN.equals(child.getLocalName())) {
+ if (SPConstants.USERNAME_TOKEN.equals(child.getLocalName())
+ && WSConstants.WSSE_NS.equals(child.getNamespaceURI())) {
try {
final WSUsernameTokenPrincipal princ = getPrincipal(child,
message);
if (princ != null) {
@@ -97,7 +98,7 @@ public class UsernameTokenInterceptor ex
WSHandlerResult rResult = new WSHandlerResult(null, v);
results.add(0, rResult);
- assertTokens(message, princ);
+ assertTokens(message, princ, false);
message.put(WSS4JInInterceptor.PRINCIPAL_RESULT,
princ);
SecurityContext sc =
message.get(SecurityContext.class);
@@ -205,10 +206,14 @@ public class UsernameTokenInterceptor ex
}
protected UsernameToken assertTokens(SoapMessage message) {
- return (UsernameToken)assertTokens(message, null);
+ return (UsernameToken)assertTokens(message,
SP12Constants.USERNAME_TOKEN, true);
}
- private UsernameToken assertTokens(SoapMessage message,
WSUsernameTokenPrincipal princ) {
+ private UsernameToken assertTokens(
+ SoapMessage message,
+ WSUsernameTokenPrincipal princ,
+ boolean signed
+ ) {
AssertionInfoMap aim = message.get(AssertionInfoMap.class);
Collection<AssertionInfo> ais =
aim.getAssertionInfo(SP12Constants.USERNAME_TOKEN);
UsernameToken tok = null;
@@ -227,9 +232,11 @@ public class UsernameTokenInterceptor ex
for (AssertionInfo ai : ais) {
ai.setAsserted(true);
}
- ais = aim.getAssertionInfo(SP12Constants.SIGNED_SUPPORTING_TOKENS);
- for (AssertionInfo ai : ais) {
- ai.setAsserted(true);
+ if (signed || isTLSInUse(message)) {
+ ais = aim.getAssertionInfo(SP12Constants.SIGNED_SUPPORTING_TOKENS);
+ for (AssertionInfo ai : ais) {
+ ai.setAsserted(true);
+ }
}
return tok;
}
@@ -255,7 +262,7 @@ public class UsernameTokenInterceptor ex
}
protected void addToken(SoapMessage message) {
- UsernameToken tok = assertTokens(message, null);
+ UsernameToken tok = assertTokens(message);
Header h = findSecurityHeader(message, true);
WSSecUsernameToken utBuilder =
