...
Direct configuration of an STSClient bean in the properties:
In this scenario, a STSClient object is created directly as a property of the client object. The wsdlLocation, service/endpoint names, etc... are all configured in line for that client.
![]() Code Block |
|
|
<jaxws:client name="{http://cxf.apache.org/}MyService" createdFromAPI="true">
<jaxws:properties>
<entry key="ws-security.sts.client">
<!-- direct STSClient config and creation -->
<bean class="org.apache.cxf.ws.security.trust.STSClient">
<constructor-arg ref="cxf"/>
<property name="wsdlLocation"
value="target/wsdl/trust.wsdl"/>
<property name="serviceName"
value="{http://cxf.apache.org/securitytokenservice}SecurityTokenService"/>
<property name="endpointName"
value="{http://cxf.apache.org/securitytokenservice}SecurityTokenEndpoint"/>
<property name="properties">
<map>
<entry key="ws-security.username" value="alice"/>
<entry key="ws-security.callback-handler"
value="client.MyCallbackHandler"/>
<entry key="ws-security.signature.properties"
value="clientKeystore.properties"/>
<entry key="ws-security.encryption.properties"
value="clientKeystore.properties"/>
<entry key="ws-security.encryption.username"
value="mystskey"/>
</map>
</property>
</bean>
</entry>
</jaxws:properties>
</jaxws:client>
|
...
This also works for "code first" cases as you can do:
![]() Code Block |
|
|
STSClient sts = new STSClient(...);
sts.setXXXX(....)
.....
((BindingProvider)port).getRequestContext().put("ws-security.sts.client", sts);
|
Sample clientKeystore.properties format:
![]() Code Block |
|
|
org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=KeystorePasswordHere
org.apache.ws.security.crypto.merlin.keystore.alias=ClientKeyAlias
org.apache.ws.security.crypto.merlin.keystore.file=NameOfKeystore.jks
|
Indirect configuration based on endpoint name:
If the runtime does not find a STSClient bean configured directly on the client, it checks the configuration for a STSClient bean with the name of the endpoint appended with ".sts-client". For example, if the endpoint name for your client is "{http://cxf.apache.org/}TestEndpoint", then it can be configured as:
![]() Code Block |
|
|
<bean name="{http://cxf.apache.org/}TestEndpoint.sts-client"
class="org.apache.cxf.ws.security.trust.STSClient" abstract="true">
<property name="wsdlLocation" value="WSDL/wsdl/trust.wsdl"/>
<property name="serviceName"
value="{http://cxf.apache.org/securitytokenservice}SecurityTokenService"/>
<property name="endpointName"
value="{http://cxf.apache.org/securitytokenservice}SecurityTokenEndpoint"/>
<property name="properties">
<map>
<entry key="ws-security.signature.properties"
value="etc/alice.properties"/>
<entry key="ws-security.encryption.properties"
value="etc/bob.properties"/>
<entry key="ws-security.encryption.username" value="stskeyname"/>
</map>
</property>
</bean>
|
...
For example, the following code fragment demonstrates how to use an interceptor to dynamically set the content of the ActAs element in the STS RST, by specifying a value for SecurityConstants.STS_TOKEN_ACT_AS. Note that this interceptor is applied to the secured client, the initiator, and not to the STSClient's interceptor chain.
![]() Code Block |
|
|
public class ActAsOutInterceptor extends AbstractPhaseInterceptor<Message> {
ActAsOutInterceptor () {
// This can be in any stage before the WS-SP interceptors
// setup the STS client and issued token interceptor.
super(Phase.SETUP);
}
@Override
public void handleMessage(Message message) throws Fault {
message.put(SecurityConstants.STS_TOKEN_ACT_AS, ...);
}
}
|
Alternatively, the ActAs content may be set directly on the STS as shown below.
![]() Code Block |
|
|
<bean name="{http://cxf.apache.org/}TestEndpoint.sts-client"
class="org.apache.cxf.ws.security.trust.STSClient" abstract="true">
<property name="wsdlLocation" value="WSDL/wsdl/trust.wsdl"/>
<property name="serviceName"
value="{http://cxf.apache.org/securitytokenservice}SecurityTokenService"/>
<property name="endpointName"
value="{http://cxf.apache.org/securitytokenservice}SecurityTokenEndpoint"/>
<property name="actAs" value="..."/>
<property name="properties">
<map>
...
</map>
</property>
</bean>
|
...
As of CXF 2.4.7 and 2.5.3, CXF contains (client) support for WS-Trust using SPNego. See the following blog for an explanation of what this entails, and how to run some system tests in CXF for this feature.
WS-Trust using XKMS
Since CXF 2.7.7 Security Token Service (STS) can be configured to use XKMS Crypto provider. In this case X509 certificates can be located centrally and managed using standard XKMS interface. STS will automatically invoke XKMS client for locate or validate corresponded X509 certificate. See the following blog for the details and sample.
This feature can be especially useful for STS scenario with SymmetricKey. With this scenario, the STS and the WS consumer negotiate a symmetric key:
- The WS-Client authenticates himself to STS and contributes material to the creation of symmetric key.
- The STS verifies WS-Client authentication and generates symmetric key using material received from WS-Client
- The STS encrypts symmetric key using WS-Service public key and inserts the encrypted key together with security token into SAML assertion
- The STS signs SAML assertion and sends it together with key material for generation symmetric key to the WS-Client.
- The WS-Client generates short-lived symmetric key from own material and the key material from the STS.
- The WS-Client inserts the SAML token, into the message header. It encrypts the message texts or/and signs the message with the generated symmetric key. It then sends the user's message to the WS-Service.
- The WS-Service checks the signature in the SAML token and uses its private key to decrypt the symmetric key contained in the SAML token.
- The WS-Service verifies the signature of the WS-Client (Holder-of-Key) with the decrypted symmetric key. In this way, the STS confirms that the Holder-of-Key is the subject (the user) in the assertion.
- The WS-Service uses the symmetric key to decrypt the message text.
On the step (3) STS needs the public key (certificate) of target WS-Service. Normally STS servers not only one, but multiple services (restricted by url patterns in TokenServiceProvider). This can be a serious drawback to manage public certificates of all services into STS local keystore.
XKMS Crypto provider provides elegant solution of this using following configuration:
- encryptionUsername (in StaticSTSProperties or jaxws:endpoint properties) should be set into special value: useEndpointAsCertAlias (STSConstants.USE_ENDPOINT_AS_CERT_ALIAS)
- encryptionCrypto should be set to XKMS Crypto implementation
- Service certificates should be saved into XKMS under service endpoint (use Application "urn:apache:cxf:service:endpoint" and service endpoint as identifier)
In this case STS recognizes encryptionName constant and will ask XKMS Crypto for the service certificate using AppliesTo endpoint address. XKMS will locate service certificate using this endpoint address.
STS can server multiple WS-Services and doesn't care about services certificates locally - they are stored and managed in central XKMS repository.
The following blog explains the details and contains the sample code.
Blogs on WS-Trust in CXF
Some blogs for up-to-date information about WS-Trust and other security topics in CXF:
http://coheigea.blogspot.com/
http://owulff.blogspot.com/
WS-Trust 