Author: coheigea
Date: Wed Aug 17 12:34:18 2011
New Revision: 1158656
URL: http://svn.apache.org/viewvc?rev=1158656&view=rev
Log:
[WSS-307] - Store the secret key in KerberosSecurity + added some tests to use
it for signature and encryption creation
- Verification/Decryption is not working yet.
Modified:
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/KerberosSecurity.java
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
Modified:
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/KerberosSecurity.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/KerberosSecurity.java?rev=1158656&r1=1158655&r2=1158656&view=diff
==============================================================================
---
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/KerberosSecurity.java
(original)
+++
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/KerberosSecurity.java
Wed Aug 17 12:34:18 2011
@@ -22,8 +22,10 @@ package org.apache.ws.security.message.t
import java.security.Principal;
import java.util.Set;
+import javax.crypto.SecretKey;
import javax.security.auth.Subject;
import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.kerberos.KerberosTicket;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
@@ -39,6 +41,7 @@ public class KerberosSecurity extends Bi
private static org.apache.commons.logging.Log log =
org.apache.commons.logging.LogFactory.getLog(KerberosSecurity.class);
+ private SecretKey secretKey;
/**
* This constructor creates a new Kerberos token object and initializes
@@ -151,6 +154,8 @@ public class KerberosSecurity extends Bi
new Object[] {"No Client principals found after login"}
);
}
+ // Store the TGT
+ KerberosTicket tgt = getKerberosTicket(clientSubject, null);
// Get the service ticket
KerberosClientAction action =
@@ -165,6 +170,12 @@ public class KerberosSecurity extends Bi
log.debug("Successfully retrieved a service ticket");
}
+ // Get the Service Ticket (private credential)
+ KerberosTicket serviceTicket = getKerberosTicket(clientSubject, tgt);
+ if (serviceTicket != null) {
+ secretKey = serviceTicket.getSessionKey();
+ }
+
setToken(ticket);
if ("".equals(getValueType())) {
@@ -173,6 +184,35 @@ public class KerberosSecurity extends Bi
}
/**
+ * Get a KerberosTicket from the clientSubject parameter, that is not
equal to the supplied KerberosTicket
+ * parameter (can be null)
+ */
+ private KerberosTicket getKerberosTicket(Subject clientSubject,
KerberosTicket previousTicket) {
+ Set<KerberosTicket> privateCredentials =
clientSubject.getPrivateCredentials(KerberosTicket.class);
+ if (privateCredentials == null || privateCredentials.isEmpty()) {
+ if (log.isDebugEnabled()) {
+ log.debug("Kerberos client subject private credentials are
null");
+ }
+ return null;
+ }
+
+ for (KerberosTicket privateCredential : privateCredentials) {
+ if (!privateCredential.equals(previousTicket)) {
+ return privateCredential;
+ }
+ }
+ return null;
+ }
+
+ /**
+ * Get the SecretKey associated with the service principal
+ * @return the SecretKey associated with the service principal
+ */
+ public SecretKey getSecretKey() {
+ return secretKey;
+ }
+
+ /**
* Return true if the valueType represents a Kerberos Token
* @param valueType the valueType of the token
* @return true if the valueType represents a Kerberos Token
Modified:
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java?rev=1158656&r1=1158655&r2=1158656&view=diff
==============================================================================
---
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
(original)
+++
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
Wed Aug 17 12:34:18 2011
@@ -25,7 +25,10 @@ import org.apache.ws.security.WSConstant
import org.apache.ws.security.WSSecurityEngineResult;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.common.SOAPUtil;
+import org.apache.ws.security.message.WSSecEncrypt;
import org.apache.ws.security.message.WSSecHeader;
+import org.apache.ws.security.message.WSSecSignature;
+import org.apache.ws.security.util.Base64;
import org.apache.ws.security.util.WSSecurityUtil;
import org.apache.ws.security.validate.KerberosTokenValidator;
import org.w3c.dom.Document;
@@ -33,7 +36,9 @@ import org.w3c.dom.Document;
import java.security.Principal;
import java.util.List;
+import javax.crypto.SecretKey;
import javax.security.auth.kerberos.KerberosPrincipal;
+import javax.xml.crypto.dsig.SignatureMethod;
/**
* This is a test for a WSS4J client retrieving a service ticket from a KDC,
and inserting
@@ -126,5 +131,98 @@ public class KerberosTest extends org.ju
}
+ /**
+ * Test using the KerberosSecurity class to retrieve a service ticket from
a KDC, wrap it
+ * in a BinarySecurityToken, and use the session key to sign the SOAP Body.
+ */
+ @org.junit.Test
+ @org.junit.Ignore
+ public void testKerberosSignature() throws Exception {
+ Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+
+ WSSecHeader secHeader = new WSSecHeader();
+ secHeader.insertSecurityHeader(doc);
+
+ KerberosSecurity bst = new KerberosSecurity(doc);
+ bst.retrieveServiceTicket("alice", null, "[email protected]");
+ WSSecurityUtil.prependChildElement(secHeader.getSecurityHeader(),
bst.getElement());
+
+ WSSecSignature sign = new WSSecSignature();
+ sign.setSignatureAlgorithm(SignatureMethod.HMAC_SHA1);
+ sign.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
+ sign.setCustomTokenValueType(WSConstants.WSS_KRB_KI_VALUE_TYPE);
+
+ SecretKey secretKey = bst.getSecretKey();
+ byte[] digestBytes =
WSSecurityUtil.generateDigest(secretKey.getEncoded());
+ sign.setCustomTokenId(Base64.encode(digestBytes));
+ sign.setSecretKey(secretKey.getEncoded());
+
+ Document signedDoc = sign.build(doc, null, secHeader);
+
+ if (LOG.isDebugEnabled()) {
+ String outputString =
+
org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(signedDoc);
+ LOG.debug(outputString);
+ }
+
+ /*
+ // Configure the Validator
+ WSSConfig wssConfig = WSSConfig.getNewInstance();
+ KerberosTokenValidator validator = new KerberosTokenValidator();
+ validator.setJaasLoginModuleName("bob");
+ validator.setServiceName("[email protected]");
+ wssConfig.setValidator(WSSecurityEngine.BINARY_TOKEN, validator);
+ WSSecurityEngine secEngine = new WSSecurityEngine();
+ secEngine.setWssConfig(wssConfig);
+
+ List<WSSecurityEngineResult> results =
+ secEngine.processSecurityHeader(doc, null, null, null);
+ WSSecurityEngineResult actionResult =
+ WSSecurityUtil.fetchActionResult(results, WSConstants.BST);
+ BinarySecurity token =
+
(BinarySecurity)actionResult.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
+ assertTrue(token != null);
+
+ Principal principal =
(Principal)actionResult.get(WSSecurityEngineResult.TAG_PRINCIPAL);
+ assertTrue(principal instanceof KerberosPrincipal);
+ assertTrue(principal.getName().contains("alice"));
+ */
+ }
+
+ /**
+ * Test using the KerberosSecurity class to retrieve a service ticket from
a KDC, wrap it
+ * in a BinarySecurityToken, and use the session key to encrypt the SOAP
Body.
+ */
+ @org.junit.Test
+ @org.junit.Ignore
+ public void testKerberosEncryption() throws Exception {
+ Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+
+ WSSecHeader secHeader = new WSSecHeader();
+ secHeader.insertSecurityHeader(doc);
+
+ KerberosSecurity bst = new KerberosSecurity(doc);
+ bst.retrieveServiceTicket("alice", null, "[email protected]");
+ bst.setID("Id-" + bst.hashCode());
+ WSSecurityUtil.prependChildElement(secHeader.getSecurityHeader(),
bst.getElement());
+
+ WSSecEncrypt builder = new WSSecEncrypt();
+ builder.setSymmetricEncAlgorithm(WSConstants.AES_128);
+ SecretKey secretKey = bst.getSecretKey();
+ builder.setSymmetricKey(secretKey);
+ builder.setEncryptSymmKey(false);
+ builder.setCustomReferenceValue(WSConstants.WSS_GSS_KRB_V5_AP_REQ);
+ builder.setEncKeyId(bst.getID());
+
+ Document encryptedDoc = builder.build(doc, null, secHeader);
+
+ if (LOG.isDebugEnabled()) {
+ String outputString =
+
org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(encryptedDoc);
+ LOG.debug(outputString);
+ }
+
+ }
+
}
