svn commit: r1162123 - in /webservices/wss4j/trunk/src: main/java/org/apache/ws/security/str/SecurityTokenRefSTRParser.java test/java/org/apache/ws/security/message/token/KerberosTest.java

[coheigea]

Author: coheigea
Date: Fri Aug 26 14:14:33 2011
New Revision: 1162123

URL: http://svn.apache.org/viewvc?rev=1162123&view=rev
Log:
[WSS-307] - Fixed a bug with decryption when the Kerberos Ticket comes before 
the ReferenceList + added a test

Modified:
    
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/SecurityTokenRefSTRParser.java
    
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java

Modified: 
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/SecurityTokenRefSTRParser.java
URL: 
http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/SecurityTokenRefSTRParser.java?rev=1162123&r1=1162122&r2=1162123&view=diff
==============================================================================
--- 
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/SecurityTokenRefSTRParser.java
 (original)
+++ 
webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/SecurityTokenRefSTRParser.java
 Fri Aug 26 14:14:33 2011
@@ -287,7 +287,7 @@ public class SecurityTokenRefSTRParser i
                 
(AssertionWrapper)result.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
             secretKey = 
                 getSecretKeyFromAssertion(assertion, secRef, data, wsDocInfo, 
bspCompliant);
-        } else if (WSConstants.SCT == action) {
+        } else if (WSConstants.SCT == action || WSConstants.BST == action) {
             secretKey = (byte[])result.get(WSSecurityEngineResult.TAG_SECRET);
         }
     }

Modified: 
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
URL: 
http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java?rev=1162123&r1=1162122&r2=1162123&view=diff
==============================================================================
--- 
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
 (original)
+++ 
webservices/wss4j/trunk/src/test/java/org/apache/ws/security/message/token/KerberosTest.java
 Fri Aug 26 14:14:33 2011
@@ -310,6 +310,62 @@ public class KerberosTest extends org.ju
      */
     @org.junit.Test
     @org.junit.Ignore
+    public void testKerberosEncryptionBSTFirst() throws Exception {
+        Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+
+        WSSecHeader secHeader = new WSSecHeader();
+        secHeader.insertSecurityHeader(doc);
+        
+        KerberosSecurity bst = new KerberosSecurity(doc);
+        bst.retrieveServiceTicket("alice", null, "b...@service.ws.apache.org");
+        bst.setID("Id-" + bst.hashCode());
+        
+        WSSecEncrypt builder = new WSSecEncrypt();
+        builder.setSymmetricEncAlgorithm(WSConstants.AES_128);
+        SecretKey secretKey = bst.getSecretKey();
+        builder.setSymmetricKey(secretKey);
+        builder.setEncryptSymmKey(false);
+        builder.setCustomReferenceValue(WSConstants.WSS_GSS_KRB_V5_AP_REQ);
+        builder.setEncKeyId(bst.getID());
+
+        Document encryptedDoc = builder.build(doc, null, secHeader);
+        
+        WSSecurityUtil.prependChildElement(secHeader.getSecurityHeader(), 
bst.getElement());
+        
+        if (LOG.isDebugEnabled()) {
+            String outputString = 
+                
org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(encryptedDoc);
+            LOG.debug(outputString);
+        }
+        
+        // Configure the Validator
+        WSSConfig wssConfig = WSSConfig.getNewInstance();
+        KerberosTokenValidator validator = new KerberosTokenValidator();
+        validator.setJaasLoginModuleName("bob");
+        validator.setServiceName("b...@service.ws.apache.org");
+        wssConfig.setValidator(WSSecurityEngine.BINARY_TOKEN, validator);
+        WSSecurityEngine secEngine = new WSSecurityEngine();
+        secEngine.setWssConfig(wssConfig);
+        
+        List<WSSecurityEngineResult> results = 
+            secEngine.processSecurityHeader(encryptedDoc, null, null, null);
+        WSSecurityEngineResult actionResult =
+            WSSecurityUtil.fetchActionResult(results, WSConstants.BST);
+        BinarySecurity token =
+            
(BinarySecurity)actionResult.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
+        assertTrue(token != null);
+        
+        Principal principal = 
(Principal)actionResult.get(WSSecurityEngineResult.TAG_PRINCIPAL);
+        assertTrue(principal instanceof KerberosPrincipal);
+        assertTrue(principal.getName().contains("alice"));
+    }
+    
+    /**
+     * Test using the KerberosSecurity class to retrieve a service ticket from 
a KDC, wrap it
+     * in a BinarySecurityToken, and use the session key to encrypt the SOAP 
Body.
+     */
+    @org.junit.Test
+    @org.junit.Ignore
     public void testKerberosEncryptionKI() throws Exception {
         Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);