Repository: cxf Updated Branches: refs/heads/2.7.x-fixes 5eaa53d8c -> ddde19496
Fixed [CXF-6223]: Support message property for encryption certificate Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/ddde1949 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/ddde1949 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/ddde1949 Branch: refs/heads/2.7.x-fixes Commit: ddde19496693819ec4ae6a05d57a47a6ee9e44e5 Parents: 5eaa53d Author: Andrei Shakirin <[email protected]> Authored: Tue Jan 27 15:34:18 2015 +0100 Committer: Andrei Shakirin <[email protected]> Committed: Tue Jan 27 15:34:18 2015 +0100 ---------------------------------------------------------------------- .../cxf/ws/security/SecurityConstants.java | 8 ++++++ .../policyhandlers/AbstractBindingBuilder.java | 27 ++++++++++++++++---- 2 files changed, 30 insertions(+), 5 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/ddde1949/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java index 61691a1..fbac070 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java @@ -129,6 +129,14 @@ public final class SecurityConstants { */ public static final String ENCRYPT_CRYPTO = "ws-security.encryption.crypto"; + /** + * A message property for prepared X509 certificate to be used for encryption. + * If this is not defined, then the certificate will be either loaded from the + * keystore {@link ENCRYPT_PROPERTIES} or extracted from request + * (if {@link ENCRYPT_USERNAME} has value "useReqSigCert"). + */ + public static final String ENCRYPT_CERT = "ws-security.encryption.certificate"; + // // Boolean WS-Security configuration tags, e.g. the value should be "true" or "false". // http://git-wip-us.apache.org/repos/asf/cxf/blob/ddde1949/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java index 6137da6..b76c853 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java @@ -1444,13 +1444,11 @@ public abstract class AbstractBindingBuilder { encrKey.prepare(saaj.getSOAPPart(), crypto); if (alsoIncludeToken) { - CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS); - cryptoType.setAlias(encrUser); - X509Certificate[] certs = crypto.getX509Certificates(cryptoType); + X509Certificate encCert = getEncryptCert(crypto, encrUser); BinarySecurity bstToken = new X509Security(saaj.getSOAPPart()); - ((X509Security) bstToken).setX509Certificate(certs[0]); + ((X509Security) bstToken).setX509Certificate(encCert); bstToken.addWSUNamespace(); - bstToken.setID(wssConfig.getIdAllocator().createSecureId("X509-", certs[0])); + bstToken.setID(wssConfig.getIdAllocator().createSecureId("X509-", encCert)); WSSecurityUtil.prependChildElement( secHeader.getSecurityHeader(), bstToken.getElement() ); @@ -1460,6 +1458,18 @@ public abstract class AbstractBindingBuilder { return encrKey; } + private X509Certificate getEncryptCert(Crypto crypto, String encrUser) throws WSSecurityException { + // Check for prepared encryption certificate + X509Certificate encCert = (X509Certificate)message.getContextualProperty(SecurityConstants.ENCRYPT_CERT); + if (encCert != null) { + return encCert; + } + CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS); + cryptoType.setAlias(encrUser); + X509Certificate[] certs = crypto.getX509Certificates(cryptoType); + return certs[0]; + } + public Crypto getSignatureCrypto(TokenWrapper wrapper) throws WSSecurityException { return getCrypto(wrapper, SecurityConstants.SIGNATURE_CRYPTO, SecurityConstants.SIGNATURE_PROPERTIES); @@ -1610,6 +1620,13 @@ public abstract class AbstractBindingBuilder { public String setEncryptionUser(WSSecEncryptedKey encrKeyBuilder, TokenWrapper token, boolean sign, Crypto crypto) { + // Check for prepared certificate property + X509Certificate encrCert = (X509Certificate)message.getContextualProperty(SecurityConstants.ENCRYPT_CERT); + if (encrCert != null) { + encrKeyBuilder.setUseThisCert(encrCert); + return null; + } + String encrUser = (String)message.getContextualProperty(sign ? SecurityConstants.SIGNATURE_USERNAME : SecurityConstants.ENCRYPT_USERNAME);
