This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch 3.1.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit d47efd2b073a7cbfa8bbd29cd8b666e330cfa952 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Wed Jan 17 11:32:04 2018 +0000 CXF-7613 - Support Derived keys policy validation for EndorsingSupportingTokens (cherry picked from commit ef477b7225535a3182694f4a99a949c7e4ce8803) # Conflicts: # rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractBindingPolicyValidator.java # rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java # rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AsymmetricBindingPolicyValidator.java # rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SymmetricBindingPolicyValidator.java # services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java --- .../AbstractBindingPolicyValidator.java | 8 +- .../AbstractSupportingTokenPolicyValidator.java | 10 +++ .../AsymmetricBindingPolicyValidator.java | 15 +--- .../EndorsingEncryptedTokenPolicyValidator.java | 6 ++ .../EndorsingTokenPolicyValidator.java | 6 ++ ...gnedEndorsingEncryptedTokenPolicyValidator.java | 6 ++ .../SignedEndorsingTokenPolicyValidator.java | 6 ++ .../SymmetricBindingPolicyValidator.java | 21 +---- .../sts/transport/TransportBindingTest.java | 40 +++++++++- .../apache/cxf/systest/sts/transport/DoubleIt.wsdl | 93 +++++++++++++++++++++- .../cxf/systest/sts/transport/cxf-client.xml | 8 ++ .../cxf/systest/sts/transport/cxf-service.xml | 7 ++ .../cxf/systest/sts/transport/cxf-stax-service.xml | 9 +++ 13 files changed, 199 insertions(+), 36 deletions(-) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractBindingPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractBindingPolicyValidator.java index c85ed23..e7a30bd 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractBindingPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractBindingPolicyValidator.java @@ -432,5 +432,11 @@ public abstract class AbstractBindingPolicyValidator implements SecurityPolicyVa } return false; } - + + protected void assertDerivedKeys(AbstractToken token, AssertionInfoMap aim) { + DerivedKeys derivedKeys = token.getDerivedKeys(); + if (derivedKeys != null) { + PolicyUtils.assertPolicy(aim, new QName(token.getName().getNamespaceURI(), derivedKeys.name())); + } + } } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java index 4a7c096..69afb7e 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java @@ -48,6 +48,8 @@ import org.apache.cxf.message.Message; import org.apache.cxf.security.transport.TLSSessionInfo; import org.apache.cxf.ws.policy.AssertionInfo; import org.apache.cxf.ws.policy.AssertionInfoMap; +import org.apache.cxf.ws.security.policy.PolicyUtils; +import org.apache.wss4j.common.WSS4JConstants; import org.apache.wss4j.common.saml.SAMLKeyInfo; import org.apache.wss4j.common.saml.SamlAssertionWrapper; import org.apache.wss4j.common.token.BinarySecurity; @@ -61,6 +63,8 @@ import org.apache.wss4j.dom.message.token.KerberosSecurity; import org.apache.wss4j.policy.SPConstants; import org.apache.wss4j.policy.model.AbstractSecuredParts; import org.apache.wss4j.policy.model.AbstractSecurityAssertion; +import org.apache.wss4j.policy.model.AbstractToken; +import org.apache.wss4j.policy.model.AbstractToken.DerivedKeys; import org.apache.wss4j.policy.model.EncryptedElements; import org.apache.wss4j.policy.model.EncryptedParts; import org.apache.wss4j.policy.model.Header; @@ -891,4 +895,10 @@ public abstract class AbstractSupportingTokenPolicyValidator extends AbstractSec this.enforceEncryptedTokens = enforceEncryptedTokens; } + protected void assertDerivedKeys(AbstractToken token, AssertionInfoMap aim) { + DerivedKeys derivedKeys = token.getDerivedKeys(); + if (derivedKeys != null) { + PolicyUtils.assertPolicy(aim, new QName(token.getName().getNamespaceURI(), derivedKeys.name())); + } + } } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AsymmetricBindingPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AsymmetricBindingPolicyValidator.java index 95fba63..b2c54c3 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AsymmetricBindingPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AsymmetricBindingPolicyValidator.java @@ -33,7 +33,6 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.policy.SP11Constants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.model.AbstractToken; -import org.apache.wss4j.policy.model.AbstractToken.DerivedKeys; import org.apache.wss4j.policy.model.AbstractTokenWrapper; import org.apache.wss4j.policy.model.AsymmetricBinding; import org.apache.wss4j.policy.model.X509Token; @@ -156,7 +155,7 @@ public class AsymmetricBindingPolicyValidator extends AbstractBindingPolicyValid ai.setNotAsserted("Message fails the DerivedKeys requirement"); return false; } - assertToken(wrapper, aim); + assertDerivedKeys(wrapper.getToken(), aim); return true; } @@ -184,19 +183,9 @@ public class AsymmetricBindingPolicyValidator extends AbstractBindingPolicyValid ai.setNotAsserted("Message fails the DerivedKeys requirement"); return false; } - assertToken(wrapper, aim); + assertDerivedKeys(wrapper.getToken(), aim); return true; } - private void assertToken(AbstractTokenWrapper tokenWrapper, AssertionInfoMap aim) { - String namespace = tokenWrapper.getName().getNamespaceURI(); - - AbstractToken token = tokenWrapper.getToken(); - DerivedKeys derivedKeys = token.getDerivedKeys(); - if (derivedKeys != null) { - PolicyUtils.assertPolicy(aim, new QName(namespace, derivedKeys.name())); - } - } - } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingEncryptedTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingEncryptedTokenPolicyValidator.java index 333094c..e1b5e96 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingEncryptedTokenPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingEncryptedTokenPolicyValidator.java @@ -26,6 +26,7 @@ import javax.xml.namespace.QName; import org.apache.cxf.ws.policy.AssertionInfo; import org.apache.cxf.ws.security.policy.PolicyUtils; +import org.apache.wss4j.dom.WSConstants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.SPConstants; import org.apache.wss4j.policy.model.AbstractToken; @@ -79,6 +80,7 @@ public class EndorsingEncryptedTokenPolicyValidator extends AbstractSupportingTo List<AbstractToken> tokens = binding.getTokens(); for (AbstractToken token : tokens) { if (!isTokenRequired(token, parameters.getMessage())) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); assertSecurePartsIfTokenNotRequired(binding, parameters.getAssertionInfoMap()); continue; } @@ -122,6 +124,10 @@ public class EndorsingEncryptedTokenPolicyValidator extends AbstractSupportingTo ); continue; } + + if (derived && parameters.getResults().getActionResults().containsKey(WSConstants.DKT)) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); + } } } } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingTokenPolicyValidator.java index 47cdceb..c6e109a 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingTokenPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/EndorsingTokenPolicyValidator.java @@ -23,6 +23,7 @@ import java.util.Collection; import java.util.List; import org.apache.cxf.ws.policy.AssertionInfo; +import org.apache.wss4j.dom.WSConstants; import org.apache.wss4j.policy.SP11Constants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.model.AbstractToken; @@ -68,6 +69,7 @@ public class EndorsingTokenPolicyValidator extends AbstractSupportingTokenPolicy List<AbstractToken> tokens = binding.getTokens(); for (AbstractToken token : tokens) { if (!isTokenRequired(token, parameters.getMessage())) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); assertSecurePartsIfTokenNotRequired(binding, parameters.getAssertionInfoMap()); continue; } @@ -110,6 +112,10 @@ public class EndorsingTokenPolicyValidator extends AbstractSupportingTokenPolicy ); continue; } + + if (derived && parameters.getResults().getActionResults().containsKey(WSConstants.DKT)) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); + } } } } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingEncryptedTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingEncryptedTokenPolicyValidator.java index a57fbf4..92bbb1f 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingEncryptedTokenPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingEncryptedTokenPolicyValidator.java @@ -26,6 +26,7 @@ import javax.xml.namespace.QName; import org.apache.cxf.ws.policy.AssertionInfo; import org.apache.cxf.ws.security.policy.PolicyUtils; +import org.apache.wss4j.dom.WSConstants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.SPConstants; import org.apache.wss4j.policy.model.AbstractToken; @@ -79,6 +80,7 @@ public class SignedEndorsingEncryptedTokenPolicyValidator extends AbstractSuppor List<AbstractToken> tokens = binding.getTokens(); for (AbstractToken token : tokens) { if (!isTokenRequired(token, parameters.getMessage())) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); assertSecurePartsIfTokenNotRequired(binding, parameters.getAssertionInfoMap()); continue; } @@ -122,6 +124,10 @@ public class SignedEndorsingEncryptedTokenPolicyValidator extends AbstractSuppor ); continue; } + + if (derived && parameters.getResults().getActionResults().containsKey(WSConstants.DKT)) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); + } } } } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingTokenPolicyValidator.java index 77e7ebd..7b65962 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingTokenPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SignedEndorsingTokenPolicyValidator.java @@ -23,6 +23,7 @@ import java.util.Collection; import java.util.List; import org.apache.cxf.ws.policy.AssertionInfo; +import org.apache.wss4j.dom.WSConstants; import org.apache.wss4j.policy.SP11Constants; import org.apache.wss4j.policy.SP12Constants; import org.apache.wss4j.policy.model.AbstractToken; @@ -68,6 +69,7 @@ public class SignedEndorsingTokenPolicyValidator extends AbstractSupportingToken List<AbstractToken> tokens = binding.getTokens(); for (AbstractToken token : tokens) { if (!isTokenRequired(token, parameters.getMessage())) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); assertSecurePartsIfTokenNotRequired(binding, parameters.getAssertionInfoMap()); continue; } @@ -110,6 +112,10 @@ public class SignedEndorsingTokenPolicyValidator extends AbstractSupportingToken ); continue; } + + if (derived && parameters.getResults().getActionResults().containsKey(WSConstants.DKT)) { + assertDerivedKeys(token, parameters.getAssertionInfoMap()); + } } } } diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SymmetricBindingPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SymmetricBindingPolicyValidator.java index ab2fecd..15a85ac 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SymmetricBindingPolicyValidator.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SymmetricBindingPolicyValidator.java @@ -22,8 +22,6 @@ package org.apache.cxf.ws.security.wss4j.policyvalidators; import java.util.Collection; import java.util.List; -import javax.xml.namespace.QName; - import org.apache.cxf.ws.policy.AssertionInfo; import org.apache.cxf.ws.policy.AssertionInfoMap; import org.apache.cxf.ws.security.policy.PolicyUtils; @@ -31,9 +29,6 @@ import org.apache.wss4j.dom.WSConstants; import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.policy.SP11Constants; import org.apache.wss4j.policy.SP12Constants; -import org.apache.wss4j.policy.model.AbstractToken; -import org.apache.wss4j.policy.model.AbstractToken.DerivedKeys; -import org.apache.wss4j.policy.model.AbstractTokenWrapper; import org.apache.wss4j.policy.model.SymmetricBinding; /** @@ -101,7 +96,7 @@ public class SymmetricBindingPolicyValidator extends AbstractBindingPolicyValida ai.setNotAsserted("Message fails the DerivedKeys requirement"); return false; } - assertToken(binding.getEncryptionToken(), aim); + assertDerivedKeys(binding.getEncryptionToken().getToken(), aim); } if (binding.getSignatureToken() != null) { @@ -112,7 +107,7 @@ public class SymmetricBindingPolicyValidator extends AbstractBindingPolicyValida ai.setNotAsserted("Message fails the DerivedKeys requirement"); return false; } - assertToken(binding.getSignatureToken(), aim); + assertDerivedKeys(binding.getSignatureToken().getToken(), aim); } if (binding.getProtectionToken() != null) { @@ -123,19 +118,9 @@ public class SymmetricBindingPolicyValidator extends AbstractBindingPolicyValida ai.setNotAsserted("Message fails the DerivedKeys requirement"); return false; } - assertToken(binding.getProtectionToken(), aim); + assertDerivedKeys(binding.getProtectionToken().getToken(), aim); } return true; } - - private void assertToken(AbstractTokenWrapper tokenWrapper, AssertionInfoMap aim) { - String namespace = tokenWrapper.getName().getNamespaceURI(); - - AbstractToken token = tokenWrapper.getToken(); - DerivedKeys derivedKeys = token.getDerivedKeys(); - if (derivedKeys != null) { - PolicyUtils.assertPolicy(aim, new QName(namespace, derivedKeys.name())); - } - } } diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java index c492171..b87199c 100644 --- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java +++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java @@ -385,8 +385,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase { } @org.junit.Test - public void testSAML2EndorsingX509() throws Exception { - + public void testSAML2X509Endorsing() throws Exception { + // Only works for DOM (clients) if (test.isStreaming()) { return; @@ -419,7 +419,7 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase { } @org.junit.Test - public void testSAML2EndorsingSymmetric() throws Exception { + public void testSAML2SymmetricEndorsing() throws Exception { SpringBusFactory bf = new SpringBusFactory(); URL busFile = TransportBindingTest.class.getResource("cxf-client.xml"); @@ -447,6 +447,40 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase { bus.shutdown(true); } + @org.junit.Test + public void testSAML2SymmetricEndorsingDerived() throws Exception { + + // Only works for DOM (clients) + if (test.isStreaming()) { + return; + } + + SpringBusFactory bf = new SpringBusFactory(); + URL busFile = TransportBindingTest.class.getResource("cxf-client.xml"); + + Bus bus = bf.createBus(busFile.toString()); + BusFactory.setDefaultBus(bus); + BusFactory.setThreadDefaultBus(bus); + + URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl"); + Service service = Service.create(wsdl, SERVICE_QNAME); + QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2SymmetricEndorsingDerivedPort"); + DoubleItPortType transportSaml1Port = + service.getPort(portQName, DoubleItPortType.class); + updateAddressPort(transportSaml1Port, test.getPort()); + + TokenTestUtils.updateSTSPort((BindingProvider)transportSaml1Port, test.getStsPort()); + + if (test.isStreaming()) { + SecurityTestUtil.enableStreaming(transportSaml1Port); + } + + doubleIt(transportSaml1Port, 25); + + ((java.io.Closeable)transportSaml1Port).close(); + bus.shutdown(true); + } + private DOMSource createDOMRequest() throws ParserConfigurationException { // Creating a DOMSource Object for the request DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt.wsdl index 083f672..4da85f5 100644 --- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt.wsdl +++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt.wsdl @@ -94,6 +94,21 @@ </wsdl:output> </wsdl:operation> </wsdl:binding> + <wsdl:binding name="DoubleItTransportSAML2SymmetricEndorsingDerivedBinding" type="tns:DoubleItPortType"> + <wsp:PolicyReference URI="#DoubleItBindingTransportSAML2SymmetricEndorsingDerivedPolicy"/> + <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/> + <wsdl:operation name="DoubleIt"> + <soap:operation soapAction=""/> + <wsdl:input> + <soap:body use="literal"/> + <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/> + </wsdl:input> + <wsdl:output> + <soap:body use="literal"/> + <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/> + </wsdl:output> + </wsdl:operation> + </wsdl:binding> <wsdl:service name="DoubleItService"> <wsdl:port name="DoubleItTransportSAML1Port" binding="tns:DoubleItTransportSAML1Binding"> <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml1"/> @@ -112,6 +127,10 @@ binding="tns:DoubleItTransportSAML2SymmetricEndorsingBinding"> <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml2symmetricendorsing"/> </wsdl:port> + <wsdl:port name="DoubleItTransportSAML2SymmetricEndorsingDerivedPort" + binding="tns:DoubleItTransportSAML2SymmetricEndorsingDerivedBinding"> + <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml2symmetricendorsingderived"/> + </wsdl:port> </wsdl:service> <wsp:Policy wsu:Id="DoubleItBindingTransportSAML1Policy"> <wsp:ExactlyOne> @@ -429,7 +448,79 @@ </sp:RequestSecurityTokenTemplate> <wsp:Policy> <sp:RequireInternalReference/> - <!-- <sp:RequireDerivedKeys/> --> + </wsp:Policy> + <sp:Issuer> + <wsaw:Address>http://localhost:8080/STS/STSUT + </wsaw:Address> + <wsaw:Metadata> + <wsx:Metadata> + <wsx:MetadataSection> + <wsx:MetadataReference> + <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex + </wsaw:Address> + </wsx:MetadataReference> + </wsx:MetadataSection> + </wsx:Metadata> + </wsaw:Metadata> + </sp:Issuer> + </sp:IssuedToken> + </wsp:Policy> + </sp:EndorsingSupportingTokens> + <sp:Wss11> + <wsp:Policy> + <sp:MustSupportRefIssuerSerial/> + <sp:MustSupportRefThumbprint/> + <sp:MustSupportRefEncryptedKey/> + </wsp:Policy> + </sp:Wss11> + <sp:Trust13> + <wsp:Policy> + <sp:MustSupportIssuedTokens/> + <sp:RequireClientEntropy/> + <sp:RequireServerEntropy/> + </wsp:Policy> + </sp:Trust13> + </wsp:All> + </wsp:ExactlyOne> + </wsp:Policy> + <wsp:Policy wsu:Id="DoubleItBindingTransportSAML2SymmetricEndorsingDerivedPolicy"> + <wsp:ExactlyOne> + <wsp:All> + <wsam:Addressing wsp:Optional="false"> + <wsp:Policy/> + </wsam:Addressing> + <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";> + <wsp:Policy> + <sp:TransportToken> + <wsp:Policy> + <sp:HttpsToken> + <wsp:Policy/> + </sp:HttpsToken> + </wsp:Policy> + </sp:TransportToken> + <sp:AlgorithmSuite> + <wsp:Policy> + <sp:Basic128/> + </wsp:Policy> + </sp:AlgorithmSuite> + <sp:Layout> + <wsp:Policy> + <sp:Lax/> + </wsp:Policy> + </sp:Layout> + <sp:IncludeTimestamp/> + </wsp:Policy> + </sp:TransportBinding> + <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";> + <wsp:Policy> + <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient";> + <sp:RequestSecurityTokenTemplate> + <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType> + <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType> + </sp:RequestSecurityTokenTemplate> + <wsp:Policy> + <sp:RequireInternalReference/> + <sp:RequireDerivedKeys/> </wsp:Policy> <sp:Issuer> <wsaw:Address>http://localhost:8080/STS/STSUT diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-client.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-client.xml index e241cbd..567d845 100644 --- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-client.xml +++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-client.xml @@ -89,6 +89,14 @@ <entry key="security.sts.client" value-ref="stsClient"/> </jaxws:properties> </jaxws:client> + <jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItTransportSAML2SymmetricEndorsingDerivedPort"; createdFromAPI="true"> + <jaxws:properties> + <entry key="security.username" value="myclientkey"/> + <entry key="security.signature.properties" value="clientKeystore.properties"/> + <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/> + <entry key="security.sts.client" value-ref="stsClient"/> + </jaxws:properties> + </jaxws:client> <http:conduit name="https://localhost.*";> <http:tlsClientParameters disableCNCheck="true"> <sec:keyManagers keyPassword="ckpass"> diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-service.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-service.xml index 3bf0fc6..ebb1bcb 100644 --- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-service.xml +++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-service.xml @@ -59,6 +59,13 @@ <entry key="ws-security.enable.timestamp.cache" value="false"/> </jaxws:properties> </jaxws:endpoint> + <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt"; id="doubleittransportsaml2symmetricderived" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItTransportSAML2SymmetricEndorsingDerivedPort" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.transport.Server}/doubleit/services/doubleittransportsaml2symmetricendorsingderived"; wsdlLocation="org/apache/cxf/systest/sts/ [...] + <jaxws:properties> + <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/> + <entry key="security.signature.properties" value="serviceKeystore.properties"/> + <entry key="ws-security.enable.timestamp.cache" value="false"/> + </jaxws:properties> + </jaxws:endpoint> <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf"> <httpj:engine port="${testutil.ports.transport.Server}"> <httpj:tlsServerParameters> diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-stax-service.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-stax-service.xml index 9d17c9f..6142c9e 100644 --- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-stax-service.xml +++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/cxf-stax-service.xml @@ -66,6 +66,15 @@ <entry key="ws-security.enable.timestamp.cache" value="false"/> </jaxws:properties> </jaxws:endpoint> + <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt"; id="doubleittransportsaml2symmetricendorsingderived" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItTransportSAML2SymmetricEndorsingDerivedPort" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.transport.StaxServer}/doubleit/services/doubleittransportsaml2symmetricendorsingderived"; wsdlLocation="org/apache/cxf [...] + <jaxws:properties> + <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/> + <entry key="security.signature.properties" value="serviceKeystore.properties"/> + <entry key="ws-security.is-bsp-compliant" value="false"/> + <entry key="ws-security.enable.streaming" value="true"/> + <entry key="ws-security.enable.timestamp.cache" value="false"/> + </jaxws:properties> + </jaxws:endpoint> <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf"> <httpj:engine port="${testutil.ports.transport.StaxServer}"> <httpj:tlsServerParameters> -- To stop receiving notification emails like this one, please contact "[email protected]" <[email protected]>.
