Author: coheigea
Date: Fri Oct 4 15:52:55 2013
New Revision: 1529199
URL: http://svn.apache.org/r1529199
Log:
Fixed some issues relating to using the streaming code with IssuedTokens in CXF
Modified:
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SAMLUtil.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/WSSec.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSUtils.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SecurityTokenFactoryImpl.java
Modified:
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SAMLUtil.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SAMLUtil.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SAMLUtil.java
(original)
+++
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/wss4j/common/saml/SAMLUtil.java
Fri Oct 4 15:52:55 2013
@@ -226,9 +226,11 @@ public final class SAMLUtil {
//
// First try to find an EncryptedKey, BinarySecret or a
SecurityTokenReference via DOM
//
- SAMLKeyInfo samlKeyInfo =
keyInfoProcessor.processSAMLKeyInfo(keyInfoElement);
- if (samlKeyInfo != null) {
- return samlKeyInfo;
+ if (keyInfoProcessor != null) {
+ SAMLKeyInfo samlKeyInfo =
keyInfoProcessor.processSAMLKeyInfo(keyInfoElement);
+ if (samlKeyInfo != null) {
+ return samlKeyInfo;
+ }
}
return getCredentialDirectlyFromKeyInfo(keyInfoElement, sigCrypto);
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/WSSec.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/WSSec.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/WSSec.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/WSSec.java
Fri Oct 4 15:52:55 2013
@@ -110,18 +110,18 @@ public class WSSec {
securityProperties.setTimestampTTL(300);
}
} else if (WSSConstants.SIGNATURE.equals(action)) {
- if (securityProperties.getSignatureKeyStore() == null
- && securityProperties.getSignatureCryptoProperties() ==
null
- && securityProperties.getSignatureCrypto() == null) {
- throw new
WSSConfigurationException(WSSConfigurationException.ErrorCode.FAILURE,
"signatureKeyStoreNotSet");
- }
- if (securityProperties.getSignatureUser() == null
- &&
!WSSConstants.NS_XMLDSIG_HMACSHA1.equals(securityProperties.getSignatureAlgorithm()))
{
- throw new
WSSConfigurationException(WSSConfigurationException.ErrorCode.FAILURE,
"noSignatureUser");
- }
- if (securityProperties.getCallbackHandler() == null
- &&
!WSSConstants.NS_XMLDSIG_HMACSHA1.equals(securityProperties.getSignatureAlgorithm()))
{
- throw new
WSSConfigurationException(WSSConfigurationException.ErrorCode.FAILURE,
"noCallback");
+ if
(!WSSConstants.NS_XMLDSIG_HMACSHA1.equals(securityProperties.getSignatureAlgorithm()))
{
+ if (securityProperties.getSignatureKeyStore() == null
+ && securityProperties.getSignatureCryptoProperties()
== null
+ && securityProperties.getSignatureCrypto() == null) {
+ throw new
WSSConfigurationException(WSSConfigurationException.ErrorCode.FAILURE,
"signatureKeyStoreNotSet");
+ }
+ if (securityProperties.getSignatureUser() == null) {
+ throw new
WSSConfigurationException(WSSConfigurationException.ErrorCode.FAILURE,
"noSignatureUser");
+ }
+ if (securityProperties.getCallbackHandler() == null) {
+ throw new
WSSConfigurationException(WSSConfigurationException.ErrorCode.FAILURE,
"noCallback");
+ }
}
if (securityProperties.getSignatureAlgorithm() == null) {
securityProperties.setSignatureAlgorithm(WSSConstants.NS_XMLDSIG_RSASHA1);
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSUtils.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSUtils.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSUtils.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/WSSUtils.java
Fri Oct 4 15:52:55 2013
@@ -396,6 +396,21 @@ public class WSSUtils extends XMLSecurit
abstractOutputProcessor.createCharactersAndOutputAsEvent(outputProcessorChain,
referenceId);
abstractOutputProcessor.createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_KeyIdentifier);
}
+
+ public static void
createSAMLKeyIdentifierStructure(AbstractOutputProcessor
abstractOutputProcessor,
+
OutputProcessorChain outputProcessorChain,
+
WSSecurityTokenConstants.TokenType tokenType, String referenceId)
+ throws XMLStreamException, XMLSecurityException {
+ List<XMLSecAttribute> attributes = new ArrayList<XMLSecAttribute>(1);
+ if (WSSecurityTokenConstants.Saml10Token.equals(tokenType) ||
WSSecurityTokenConstants.Saml11Token.equals(tokenType)) {
+
attributes.add(abstractOutputProcessor.createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_SAML10_TYPE));
+ } else if (WSSecurityTokenConstants.Saml20Token.equals(tokenType)) {
+
attributes.add(abstractOutputProcessor.createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_SAML20_TYPE));
+ }
+
abstractOutputProcessor.createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_KeyIdentifier, false, attributes);
+
abstractOutputProcessor.createCharactersAndOutputAsEvent(outputProcessorChain,
referenceId);
+
abstractOutputProcessor.createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_KeyIdentifier);
+ }
public static void
createUsernameTokenReferenceStructure(AbstractOutputProcessor
abstractOutputProcessor,
OutputProcessorChain outputProcessorChain, String tokenId)
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
Fri Oct 4 15:52:55 2013
@@ -235,22 +235,41 @@ public class EncryptOutputProcessor exte
WSSUtils.createKerberosSha1IdentifierStructure(this,
outputProcessorChain, sha1Identifier);
} else {
+ boolean isSAMLToken = false;
if (WSSecurityTokenConstants.KerberosToken.equals(tokenType)) {
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_GSS_Kerberos5_AP_REQ));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
+ } else if
(WSSecurityTokenConstants.Saml10Token.equals(tokenType)
+ || WSSecurityTokenConstants.Saml11Token.equals(tokenType))
{
+ List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
+ attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
+
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML11_TOKEN_PROFILE_TYPE));
+ createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
+ isSAMLToken = true;
+ } else if
(WSSecurityTokenConstants.Saml20Token.equals(tokenType)) {
+ List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
+ attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
+
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML20_TOKEN_PROFILE_TYPE));
+ createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
+ isSAMLToken = true;
} else {
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, true, null);
}
- List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(1);
- attributes.add(createAttribute(WSSConstants.ATT_NULL_URI, "#"
+ getEncryptionPartDef().getKeyId()));
- if (WSSecurityTokenConstants.KerberosToken.equals(tokenType)) {
-
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_GSS_Kerberos5_AP_REQ));
+ if (isSAMLToken) {
+ // Always use KeyIdentifier regardless of the configured
KeyIdentifier value
+ WSSUtils.createSAMLKeyIdentifierStructure(this,
outputProcessorChain, tokenType, getEncryptionPartDef().getKeyId());
+ } else {
+ List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(1);
+ attributes.add(createAttribute(WSSConstants.ATT_NULL_URI,
"#" + getEncryptionPartDef().getKeyId()));
+ if
(WSSecurityTokenConstants.KerberosToken.equals(tokenType)) {
+
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_GSS_Kerberos5_AP_REQ));
+ }
+ createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_Reference, false, attributes);
+ createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_Reference);
}
- createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_Reference, false, attributes);
- createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_Reference);
}
createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference);
createEndElementAndOutputAsEvent(outputProcessorChain,
XMLSecurityConstants.TAG_dsig_KeyInfo);
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
Fri Oct 4 15:52:55 2013
@@ -91,11 +91,14 @@ public class SAMLTokenOutputProcessor ex
}
boolean senderVouches = false;
+ boolean hok = false;
List<String> methods =
samlAssertionWrapper.getConfirmationMethods();
if (methods != null && methods.size() > 0) {
String confirmMethod = methods.get(0);
if (OpenSAMLUtil.isMethodSenderVouches(confirmMethod)) {
senderVouches = true;
+ } else if (OpenSAMLUtil.isMethodHolderOfKey(confirmMethod)) {
+ hok = true;
}
}
@@ -175,7 +178,7 @@ public class SAMLTokenOutputProcessor ex
securityToken.setProcessor(finalSAMLTokenOutputProcessor);
- } else {
+ } else if (WSSConstants.SAML_TOKEN_SIGNED.equals(action) && hok) {
final SAMLKeyInfo samlKeyInfo = new SAMLKeyInfo();
SubjectBean subjectBean = samlCallback.getSubject();
@@ -273,9 +276,10 @@ public class SAMLTokenOutputProcessor ex
};
outputProcessorChain.getSecurityContext().registerSecurityTokenProvider(tokenId,
securityTokenProvider);
- if (WSSConstants.SAML_TOKEN_SIGNED.equals(action)) {
-
outputProcessorChain.getSecurityContext().put(WSSConstants.PROP_USE_THIS_TOKEN_ID_FOR_SIGNATURE,
tokenId);
- }
+
outputProcessorChain.getSecurityContext().put(WSSConstants.PROP_USE_THIS_TOKEN_ID_FOR_SIGNATURE,
tokenId);
+ } else {
+ finalSAMLTokenOutputProcessor = new
FinalSAMLTokenOutputProcessor(null, samlAssertionWrapper,
+
securityTokenReferenceId, senderVouches);
}
finalSAMLTokenOutputProcessor.setXMLSecurityProperties(getSecurityProperties());
@@ -358,22 +362,16 @@ public class SAMLTokenOutputProcessor ex
String referenceId, String tokenId) throws XMLStreamException,
XMLSecurityException {
List<XMLSecAttribute> attributes = new ArrayList<XMLSecAttribute>(2);
+ WSSecurityTokenConstants.TokenType tokenType =
WSSecurityTokenConstants.Saml11Token;
if (samlAssertionWrapper.getSamlVersion() == SAMLVersion.VERSION_11) {
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML11_TOKEN_PROFILE_TYPE));
} else {
+ tokenType = WSSecurityTokenConstants.Saml20Token;
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML20_TOKEN_PROFILE_TYPE));
}
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id, referenceId));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
- attributes = new ArrayList<XMLSecAttribute>(1);
- if (samlAssertionWrapper.getSamlVersion() == SAMLVersion.VERSION_11) {
- attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_SAML10_TYPE));
- } else {
- attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_SAML20_TYPE));
- }
- createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_KeyIdentifier, false, attributes);
- createCharactersAndOutputAsEvent(outputProcessorChain, tokenId);
- createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_KeyIdentifier);
+ WSSUtils.createSAMLKeyIdentifierStructure(this, outputProcessorChain,
tokenType, tokenId);
createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference);
}
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
Fri Oct 4 15:52:55 2013
@@ -94,26 +94,33 @@ public class WSSSignatureEndingOutputPro
if
(WSSecurityTokenConstants.KeyIdentifier_KeyValue.equals(keyIdentifier)) {
WSSUtils.createKeyValueTokenStructure(this, outputProcessorChain,
x509Certificates);
} else {
+ boolean isSAMLToken = false;
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
- if
(WSSecurityTokenConstants.KeyIdentifier_SecurityTokenDirectReference.equals(keyIdentifier)
&& !useSingleCertificate) {
-
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_X509PKIPathv1));
- } else if
(WSSecurityTokenConstants.KeyIdentifier_EncryptedKeySha1Identifier.equals(keyIdentifier)
- ||
WSSecurityTokenConstants.KeyIdentifier_EncryptedKey.equals(keyIdentifier)) {
-
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_WSS_ENC_KEY_VALUE_TYPE));
- } else if
(WSSecurityTokenConstants.Saml10Token.equals(securityToken.getTokenType())
- ||
WSSecurityTokenConstants.Saml11Token.equals(securityToken.getTokenType())) {
+ if
(WSSecurityTokenConstants.Saml10Token.equals(securityToken.getTokenType())
+ ||
WSSecurityTokenConstants.Saml11Token.equals(securityToken.getTokenType())) {
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML11_TOKEN_PROFILE_TYPE));
+ isSAMLToken = true;
} else if
(WSSecurityTokenConstants.Saml20Token.equals(securityToken.getTokenType())) {
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML20_TOKEN_PROFILE_TYPE));
+ isSAMLToken = true;
} else if
(WSSecurityTokenConstants.KerberosToken.equals(securityToken.getTokenType())) {
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_GSS_Kerberos5_AP_REQ));
+ } else if
(WSSecurityTokenConstants.KeyIdentifier_SecurityTokenDirectReference.equals(keyIdentifier)
&& !useSingleCertificate) {
+
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_X509PKIPathv1));
+ } else if
(WSSecurityTokenConstants.KeyIdentifier_EncryptedKeySha1Identifier.equals(keyIdentifier)
+ ||
WSSecurityTokenConstants.KeyIdentifier_EncryptedKey.equals(keyIdentifier)) {
+
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_WSS_ENC_KEY_VALUE_TYPE));
}
+
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
String tokenId = securityToken.getId();
- if
(WSSecurityTokenConstants.KeyIdentifier_IssuerSerial.equals(keyIdentifier)) {
+ if (isSAMLToken) {
+ // Always use KeyIdentifier regardless of the configured
KeyIdentifier value
+ WSSUtils.createSAMLKeyIdentifierStructure(this,
outputProcessorChain, securityToken.getTokenType(), tokenId);
+ } else if
(WSSecurityTokenConstants.KeyIdentifier_IssuerSerial.equals(keyIdentifier)) {
WSSUtils.createX509IssuerSerialStructure(this,
outputProcessorChain, x509Certificates);
} else if
(WSSecurityTokenConstants.KeyIdentifier_SkiKeyIdentifier.equals(keyIdentifier))
{
WSSUtils.createX509SubjectKeyIdentifierStructure(this,
outputProcessorChain, x509Certificates);
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
Fri Oct 4 15:52:55 2013
@@ -18,30 +18,40 @@
*/
package org.apache.wss4j.stax.impl.securityToken;
+import java.io.IOException;
+import java.security.Key;
+import java.security.Principal;
+import java.security.PublicKey;
+import java.security.cert.CertificateExpiredException;
+import java.security.cert.CertificateNotYetValidException;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
+import javax.crypto.spec.SecretKeySpec;
+import javax.security.auth.Subject;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.UnsupportedCallbackException;
+
+import org.w3c.dom.Element;
import org.apache.wss4j.common.crypto.Crypto;
+import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.principal.SAMLTokenPrincipal;
import org.apache.wss4j.common.saml.OpenSAMLUtil;
+import org.apache.wss4j.common.saml.SAMLKeyInfo;
+import org.apache.wss4j.common.saml.SAMLUtil;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
import org.apache.wss4j.stax.ext.WSInboundSecurityContext;
import org.apache.wss4j.stax.ext.WSSSecurityProperties;
import org.apache.wss4j.stax.securityToken.SamlSecurityToken;
import org.apache.wss4j.stax.securityToken.WSSecurityTokenConstants;
import org.apache.xml.security.exceptions.XMLSecurityException;
+import org.apache.xml.security.stax.config.JCEAlgorithmMapper;
import org.apache.xml.security.stax.ext.XMLSecurityConstants;
import
org.apache.xml.security.stax.impl.securityToken.AbstractInboundSecurityToken;
import org.apache.xml.security.stax.securityToken.InboundSecurityToken;
import org.opensaml.common.SAMLVersion;
-import javax.security.auth.Subject;
-import java.security.Key;
-import java.security.Principal;
-import java.security.PublicKey;
-import java.security.cert.CertificateExpiredException;
-import java.security.cert.CertificateNotYetValidException;
-import java.security.cert.X509Certificate;
-import java.util.List;
-
public class SamlSecurityTokenImpl extends AbstractInboundSecurityToken
implements SamlSecurityToken {
private final SamlAssertionWrapper samlAssertionWrapper;
@@ -49,6 +59,42 @@ public class SamlSecurityTokenImpl exten
private Crypto crypto;
private WSSSecurityProperties securityProperties;
private Principal principal;
+ private SAMLKeyInfo subjectKeyInfo;
+
+ public SamlSecurityTokenImpl(WSInboundSecurityContext
wsInboundSecurityContext, String id,
+ WSSecurityTokenConstants.KeyIdentifier
keyIdentifier,
+ WSSSecurityProperties securityProperties)
throws WSSecurityException {
+ super(wsInboundSecurityContext, id, keyIdentifier, false);
+ this.securityProperties = securityProperties;
+ if (securityProperties.getCallbackHandler() != null) {
+ // Try to get the Assertion from a CallbackHandler
+ WSPasswordCallback pwcb =
+ new WSPasswordCallback(id,
WSPasswordCallback.Usage.CUSTOM_TOKEN);
+ try {
+ securityProperties.getCallbackHandler().handle(new
Callback[]{pwcb});
+ } catch (IOException e) {
+ throw new
WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "noPassword", e);
+ } catch (UnsupportedCallbackException e) {
+ throw new
WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "noPassword", e);
+ }
+ Element assertionElem = pwcb.getCustomToken();
+ if (assertionElem == null) {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.SECURITY_TOKEN_UNAVAILABLE,
"noToken", id
+ );
+ }
+ this.samlAssertionWrapper = new
SamlAssertionWrapper(assertionElem);
+
+ subjectKeyInfo =
+ SAMLUtil.getCredentialFromSubject(samlAssertionWrapper, null,
+
securityProperties.getSignatureVerificationCrypto(),
+
securityProperties.getCallbackHandler());
+ } else {
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.SECURITY_TOKEN_UNAVAILABLE,
"noToken", id
+ );
+ }
+ }
public SamlSecurityTokenImpl(SamlAssertionWrapper samlAssertionWrapper,
InboundSecurityToken subjectSecurityToken,
WSInboundSecurityContext
wsInboundSecurityContext, Crypto crypto,
@@ -73,6 +119,11 @@ public class SamlSecurityTokenImpl exten
protected Key getKey(String algorithmURI,
XMLSecurityConstants.AlgorithmUsage algorithmUsage, String correlationID)
throws XMLSecurityException {
if (this.subjectSecurityToken != null) {
return subjectSecurityToken.getSecretKey(algorithmURI,
algorithmUsage, correlationID);
+ } else if (subjectKeyInfo != null && subjectKeyInfo.getSecret() !=
null) {
+ byte[] secret = subjectKeyInfo.getSecret();
+
+ String algoFamily =
JCEAlgorithmMapper.getJCEKeyAlgorithmFromURI(algorithmURI);
+ return new SecretKeySpec(secret, algoFamily);
}
return super.getKey(algorithmURI, algorithmUsage, correlationID);
}
@@ -81,6 +132,8 @@ public class SamlSecurityTokenImpl exten
protected PublicKey getPubKey(String algorithmURI,
XMLSecurityConstants.AlgorithmUsage algorithmUsage, String correlationID)
throws XMLSecurityException {
if (this.subjectSecurityToken != null) {
return subjectSecurityToken.getPublicKey(algorithmURI,
algorithmUsage, correlationID);
+ } else if (subjectKeyInfo != null && subjectKeyInfo.getPublicKey() !=
null) {
+ return subjectKeyInfo.getPublicKey();
}
return super.getPubKey(algorithmURI, algorithmUsage, correlationID);
}
@@ -89,6 +142,8 @@ public class SamlSecurityTokenImpl exten
public PublicKey getPublicKey() throws XMLSecurityException {
if (this.subjectSecurityToken != null) {
return subjectSecurityToken.getPublicKey();
+ } else if (subjectKeyInfo != null && subjectKeyInfo.getPublicKey() !=
null) {
+ return subjectKeyInfo.getPublicKey();
}
return super.getPublicKey();
}
@@ -97,6 +152,8 @@ public class SamlSecurityTokenImpl exten
public X509Certificate[] getX509Certificates() throws XMLSecurityException
{
if (this.subjectSecurityToken != null) {
return subjectSecurityToken.getX509Certificates();
+ } else if (subjectKeyInfo != null && subjectKeyInfo.getCerts() !=
null) {
+ return subjectKeyInfo.getCerts();
}
return super.getX509Certificates();
}
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SecurityTokenFactoryImpl.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SecurityTokenFactoryImpl.java?rev=1529199&r1=1529198&r2=1529199&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SecurityTokenFactoryImpl.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SecurityTokenFactoryImpl.java
Fri Oct 4 15:52:55 2013
@@ -245,12 +245,16 @@ public class SecurityTokenFactoryImpl ex
}
SecurityTokenProvider<? extends InboundSecurityToken>
securityTokenProvider =
inboundSecurityContext.getSecurityTokenProvider(keyIdentifierType.getValue());
- if (securityTokenProvider == null) {
- throw new WSSecurityException(
-
WSSecurityException.ErrorCode.SECURITY_TOKEN_UNAVAILABLE, "noToken",
keyIdentifierType.getValue());
- }
- return
createSecurityTokenProxy(securityTokenProvider.getSecurityToken(),
+ if (securityTokenProvider != null) {
+ return
createSecurityTokenProxy(securityTokenProvider.getSecurityToken(),
WSSecurityTokenConstants.KeyIdentifier_SecurityTokenDirectReference);
+ }
+
+ // Delegate to a CallbackHandler, in case the token is not
in the request
+ return new
SamlSecurityTokenImpl((WSInboundSecurityContext) inboundSecurityContext,
+
keyIdentifierType.getValue(),
+
WSSecurityTokenConstants.KeyIdentifier_ExternalReference,
+ securityProperties);
} else if
(WSSConstants.NS_Kerberos5_AP_REQ_SHA1.equals(valueType)) {
SecurityTokenProvider<? extends InboundSecurityToken>
securityTokenProvider =
inboundSecurityContext.getSecurityTokenProvider(keyIdentifierType.getValue());
