Repository: cxf-fediz
Updated Branches:
refs/heads/1.1.x-fixes 40860d311 -> e8897bf3c
Adding a "Kerberos" profile to the STS
Conflicts:
pom.xml
services/sts/pom.xml
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/e8897bf3
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/e8897bf3
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/e8897bf3
Branch: refs/heads/1.1.x-fixes
Commit: e8897bf3c7770e3f4771d9d47af5d0446414af4d
Parents: 40860d3
Author: Colm O hEigeartaigh <[email protected]>
Authored: Mon Aug 25 15:36:28 2014 +0100
Committer: Colm O hEigeartaigh <[email protected]>
Committed: Mon Aug 25 15:50:58 2014 +0100
----------------------------------------------------------------------
pom.xml | 4 +-
services/sts/pom.xml | 7 +
.../sts/src/main/webapp/WEB-INF/kerberos.jaas | 8 ++
.../sts/src/main/webapp/WEB-INF/kerberos.xml | 78 +++++++++++
.../main/webapp/WEB-INF/userClaimsKerberos.xml | 138 +++++++++++++++++++
5 files changed, 233 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e8897bf3/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index a2ddf07..fa065a8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,7 +34,7 @@
<properties>
<commons.lang.version>3.3.2</commons.lang.version>
<commons.logging.version>1.1.3</commons.logging.version>
- <cxf.version>2.7.12</cxf.version>
+ <cxf.version>2.7.13-SNAPSHOT</cxf.version>
<cxf.build-utils.version>2.6.0</cxf.build-utils.version>
<ehcache.version>2.5.1</ehcache.version>
<httpclient.version>4.3.3</httpclient.version>
@@ -53,7 +53,7 @@
<spring.version>3.1.4.RELEASE</spring.version>
<spring.security.version>3.1.4.RELEASE</spring.security.version>
<tomcat.version>7.0.54</tomcat.version>
- <wss4j.version>1.6.16</wss4j.version>
+ <wss4j.version>1.6.17-SNAPSHOT</wss4j.version>
<tomcat.url>http://localhost:8080/manager/text</tomcat.url>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e8897bf3/services/sts/pom.xml
----------------------------------------------------------------------
diff --git a/services/sts/pom.xml b/services/sts/pom.xml
index b533d44..9a4f045 100644
--- a/services/sts/pom.xml
+++ b/services/sts/pom.xml
@@ -320,5 +320,12 @@
</dependency>
</dependencies>
</profile>
+ <profile>
+ <id>kerberos</id>
+ <properties>
+ <adapter.resource>kerberos</adapter.resource>
+ </properties>
+ </profile>
+
</profiles>
</project>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e8897bf3/services/sts/src/main/webapp/WEB-INF/kerberos.jaas
----------------------------------------------------------------------
diff --git a/services/sts/src/main/webapp/WEB-INF/kerberos.jaas
b/services/sts/src/main/webapp/WEB-INF/kerberos.jaas
new file mode 100644
index 0000000..b773cf6
--- /dev/null
+++ b/services/sts/src/main/webapp/WEB-INF/kerberos.jaas
@@ -0,0 +1,8 @@
+
+alice {
+ com.sun.security.auth.module.Krb5LoginModule required
refreshKrb5Config=true useKeyTab=true keyTab="/etc/alice.keytab"
principal="alice";
+};
+
+bob {
+ com.sun.security.auth.module.Krb5LoginModule required
refreshKrb5Config=true useKeyTab=true storeKey=true keyTab="/etc/bob.keytab"
principal="bob/service.ws.apache.org";
+};
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e8897bf3/services/sts/src/main/webapp/WEB-INF/kerberos.xml
----------------------------------------------------------------------
diff --git a/services/sts/src/main/webapp/WEB-INF/kerberos.xml
b/services/sts/src/main/webapp/WEB-INF/kerberos.xml
new file mode 100644
index 0000000..06ef44e
--- /dev/null
+++ b/services/sts/src/main/webapp/WEB-INF/kerberos.xml
@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans";
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xmlns:util="http://www.springframework.org/schema/util";
+ xmlns:jaxws="http://cxf.apache.org/jaxws";
+ xsi:schemaLocation="
+ http://www.springframework.org/schema/beans
+ http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+ http://www.springframework.org/schema/util
+ http://www.springframework.org/schema/util/spring-util-2.0.xsd
+ http://cxf.apache.org/jaxws
+ http://cxf.apache.org/schemas/jaxws.xsd";>
+
+ <import resource="userClaimsKerberos.xml" />
+
+ <util:list id="claimHandlerList">
+ <ref bean="claimsHandlerA" />
+ <ref bean="claimsHandlerB" />
+ </util:list>
+
+ <bean id="claimsHandlerA"
+ class="org.apache.cxf.fediz.service.sts.realms.RealmFileClaimsHandler">
+ <property name="userClaims" ref="userClaimsREALMA" />
+ <property name="supportedClaims" ref="supportedClaims" />
+ <property name="realm" value="REALMA" />
+ </bean>
+
+ <bean id="claimsHandlerB"
+ class="org.apache.cxf.fediz.service.sts.realms.RealmFileClaimsHandler">
+ <property name="userClaims" ref="userClaimsREALMB" />
+ <property name="supportedClaims" ref="supportedClaims" />
+ <property name="realm" value="REALMB" />
+ </bean>
+
+ <bean id="kerberosValidator"
class="org.apache.wss4j.dom.validate.KerberosTokenValidator">
+ <property name="contextName" value="bob"/>
+ <property name="serviceName" value="[email protected]"/>
+ </bean>
+
+ <jaxws:endpoint id="transportSTSRealmAKerberos"
+ implementor="#transportSTSProviderBean"
address="/REALMA/STSServiceTransportKerberos"
+ wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
+ xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/";
+ serviceName="ns1:SecurityTokenService"
endpointName="ns1:TransportKerberos_Port">
+ <jaxws:properties>
+ <entry key="ws-security.bst.validator"
value-ref="kerberosValidator"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+ <jaxws:endpoint id="transportSTSRealmBKerberos"
+ implementor="#transportSTSProviderBean"
address="/REALMB/STSServiceTransportKerberos"
+ wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
+ xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/";
+ serviceName="ns1:SecurityTokenService"
endpointName="ns1:TransportKerberos_Port">
+ <jaxws:properties>
+ <entry key="ws-security.bst.validator"
value-ref="kerberosValidator"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+</beans>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/e8897bf3/services/sts/src/main/webapp/WEB-INF/userClaimsKerberos.xml
----------------------------------------------------------------------
diff --git a/services/sts/src/main/webapp/WEB-INF/userClaimsKerberos.xml
b/services/sts/src/main/webapp/WEB-INF/userClaimsKerberos.xml
new file mode 100644
index 0000000..38ff27c
--- /dev/null
+++ b/services/sts/src/main/webapp/WEB-INF/userClaimsKerberos.xml
@@ -0,0 +1,138 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans";
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xmlns:util="http://www.springframework.org/schema/util";
+ xsi:schemaLocation="
+ http://www.springframework.org/schema/beans
+ http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+ http://www.springframework.org/schema/util
+ http://www.springframework.org/schema/util/spring-util-2.0.xsd";>
+
+ <util:map id="userClaimsREALMA">
+ <entry key="[email protected]" value-ref="REALMA_aliceClaims" />
+ <entry key="bob/[email protected]"
value-ref="REALMA_bobClaims" />
+ <entry key="[email protected]" value-ref="REALMA_tedClaims" />
+ </util:map>
+
+ <util:map id="REALMA_aliceClaims">
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";
+ value="Alice" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname";
+ value="Smith" />
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+ value="[email protected]" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ value="User" />
+ </util:map>
+
+ <util:map id="REALMA_bobClaims">
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";
+ value="Bob" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname";
+ value="Windsor" />
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+ value="[email protected]" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ value="User,Manager,Admin" />
+ </util:map>
+
+ <util:map id="REALMA_tedClaims">
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";
+ value="Ted" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname";
+ value="Cooper" />
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+ value="[email protected]" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ value="" />
+ </util:map>
+
+ <util:map id="userClaimsREALMB">
+ <entry key="ALICE" value-ref="REALMB_aliceClaims" />
+ <entry key="BOB" value-ref="REALMB_bobClaims" />
+ <entry key="TED" value-ref="REALMB_tedClaims" />
+ </util:map>
+
+ <util:map id="REALMB_aliceClaims">
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";
+ value="Alice" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname";
+ value="Smith" />
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+ value="[email protected]" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ value="USER" />
+ </util:map>
+
+ <util:map id="REALMB_bobClaims">
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";
+ value="Bob" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname";
+ value="Windsor" />
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+ value="[email protected]" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ value="USER,MANAGER,ADMIN" />
+ </util:map>
+
+ <util:map id="REALMB_tedClaims">
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";
+ value="Ted" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname";
+ value="Cooper" />
+ <entry
+
key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";
+ value="[email protected]" />
+ <entry
+ key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role";
+ value="" />
+ </util:map>
+
+ <util:list id="supportedClaims">
+
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname</value>
+
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</value>
+
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</value>
+
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role</value>
+ </util:list>
+
+</beans>
\ No newline at end of file
