This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch CXF-8051 in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 1115a4cf5d7a9bdf84fc542fe6a7014ec05572db Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Jul 2 15:00:30 2019 +0100 CXF-8051 - Inline any xop Include references in a received SecurityToken if MTOM is enabled --- .../apache/cxf/ws/security/trust/STSClient.java | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSClient.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSClient.java index 59e343b..11b811a 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSClient.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSClient.java @@ -27,10 +27,18 @@ import java.util.logging.Logger; import org.w3c.dom.Element; import org.apache.cxf.Bus; +import org.apache.cxf.attachment.AttachmentUtil; import org.apache.cxf.common.logging.LogUtils; import org.apache.cxf.helpers.DOMUtils; import org.apache.cxf.interceptor.Fault; +import org.apache.cxf.message.Message; +import org.apache.cxf.phase.PhaseInterceptorChain; import org.apache.cxf.ws.security.tokenstore.SecurityToken; +import org.apache.cxf.ws.security.wss4j.AttachmentCallbackHandler; +import org.apache.wss4j.common.ext.WSSecurityException; +import org.apache.wss4j.common.util.XMLUtils; +import org.apache.wss4j.dom.WSConstants; +import org.apache.wss4j.dom.util.WSSecurityUtil; /** * A extension of AbstractSTSClient to communicate with an STS and return a SecurityToken @@ -62,6 +70,7 @@ public class STSClient extends AbstractSTSClient { SecurityToken token = createSecurityToken(getDocumentElement(response.getResponse()), response.getEntropy()); + inlineAttachments(token); if (response.getCert() != null) { token.setX509Certificate(response.getCert(), response.getCrypto()); @@ -81,6 +90,8 @@ public class STSClient extends AbstractSTSClient { STSResponse response = renew(tok); SecurityToken token = createSecurityToken(getDocumentElement(response.getResponse()), null); + inlineAttachments(token); + if (token.getTokenType() == null) { String tokenTypeFromTemplate = getTokenTypeFromTemplate(); if (tokenTypeFromTemplate != null) { @@ -100,6 +111,19 @@ public class STSClient extends AbstractSTSClient { return validateSecurityToken(tok, validateTokenType); } + private void inlineAttachments(SecurityToken token) throws WSSecurityException { + Message msg = PhaseInterceptorChain.getCurrentMessage(); + if (AttachmentUtil.isMtomEnabled(msg)) { + Element requestedSecurityTokenElement = token.getToken(); + if (requestedSecurityTokenElement != null) { + // Look for xop:Include Nodes + inline the contents + List<Element> includeElements = + XMLUtils.findElements(requestedSecurityTokenElement.getFirstChild(), "Include", WSConstants.XOP_NS); + WSSecurityUtil.inlineAttachments(includeElements, new AttachmentCallbackHandler(msg), true); + } + } + } + protected List<SecurityToken> validateSecurityToken(SecurityToken tok, String tokentype) throws Exception { STSResponse response = validate(tok, tokentype);
