Author: coheigea
Date: Wed Jan 22 13:53:12 2014
New Revision: 1560353
URL: http://svn.apache.org/r1560353
Log:
[WSS-463] - Refactor Signature + Encryption referencing
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptedKeyOutputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java?rev=1560353&r1=1560352&r2=1560353&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptOutputProcessor.java
Wed Jan 22 13:53:12 2014
@@ -56,7 +56,6 @@ import org.apache.xml.security.stax.impl
import org.apache.xml.security.stax.impl.util.IDGenerator;
import org.apache.xml.security.stax.securityToken.OutboundSecurityToken;
import
org.apache.xml.security.stax.securityToken.SecurityTokenConstants.KeyIdentifier;
-import
org.apache.xml.security.stax.securityToken.SecurityTokenConstants.TokenType;
import org.apache.xml.security.stax.securityToken.SecurityTokenProvider;
/**
@@ -106,8 +105,7 @@ public class EncryptOutputProcessor exte
encryptionPartDef,
xmlSecStartElement,
outputProcessorChain.getDocumentContext().getEncoding(),
- securityToken.getSha1Identifier(),
- securityToken.getTokenType()
+ securityToken
);
internalEncryptionOutputProcessor.setXMLSecurityProperties(getSecurityProperties());
internalEncryptionOutputProcessor.setAction(getAction());
@@ -284,19 +282,17 @@ public class EncryptOutputProcessor exte
class InternalEncryptionOutputProcessor extends
AbstractInternalEncryptionOutputProcessor {
private boolean doEncryptedHeader = false;
- private final String sha1Identifier;
- private final TokenType tokenType;
+ private final OutboundSecurityToken securityToken;
InternalEncryptionOutputProcessor(EncryptionPartDef encryptionPartDef,
XMLSecStartElement xmlSecStartElement,
- String encoding, String
sha1Identifier, TokenType tokenType)
+ String encoding,
OutboundSecurityToken securityToken)
throws XMLSecurityException, XMLStreamException {
super(encryptionPartDef, xmlSecStartElement, encoding);
this.addBeforeProcessor(EncryptEndingOutputProcessor.class.getName());
this.addBeforeProcessor(InternalEncryptionOutputProcessor.class.getName());
this.addAfterProcessor(EncryptOutputProcessor.class.getName());
- this.sha1Identifier = sha1Identifier;
- this.tokenType = tokenType;
+ this.securityToken = securityToken;
}
protected OutputStream applyTransforms(OutputStream outputStream)
throws XMLSecurityException {
@@ -376,14 +372,20 @@ public class EncryptOutputProcessor exte
protected void createKeyInfoStructure(OutputProcessorChain
outputProcessorChain) throws XMLStreamException, XMLSecurityException {
createStartElementAndOutputAsEvent(outputProcessorChain,
XMLSecurityConstants.TAG_dsig_KeyInfo, true, null);
+ if (securityToken.getCustomTokenReference() != null) {
+ outputDOMElement(securityToken.getCustomTokenReference(),
outputProcessorChain);
+ createEndElementAndOutputAsEvent(outputProcessorChain,
XMLSecurityConstants.TAG_dsig_KeyInfo);
+ return;
+ }
+
KeyIdentifier keyIdentifier = ((WSSSecurityProperties)
getSecurityProperties()).getEncryptionKeyIdentifier();
if
(WSSecurityTokenConstants.KeyIdentifier_EncryptedKeySha1Identifier.equals(keyIdentifier))
{
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(1);
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_WSS_ENC_KEY_VALUE_TYPE));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
- if (sha1Identifier != null) {
- WSSUtils.createEncryptedKeySha1IdentifierStructure(this,
outputProcessorChain, sha1Identifier);
+ if (securityToken.getSha1Identifier() != null) {
+ WSSUtils.createEncryptedKeySha1IdentifierStructure(this,
outputProcessorChain, securityToken.getSha1Identifier());
} else {
WSSUtils.createEncryptedKeySha1IdentifierStructure(this,
outputProcessorChain, getEncryptionPartDef().getSymmetricKey());
}
@@ -392,28 +394,28 @@ public class EncryptOutputProcessor exte
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_Kerberos5_AP_REQ));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
- WSSUtils.createKerberosSha1IdentifierStructure(this,
outputProcessorChain, sha1Identifier);
+ WSSUtils.createKerberosSha1IdentifierStructure(this,
outputProcessorChain, securityToken.getSha1Identifier());
} else {
boolean isSAMLToken = false;
- if (WSSecurityTokenConstants.KerberosToken.equals(tokenType)) {
+ if
(WSSecurityTokenConstants.KerberosToken.equals(securityToken.getTokenType())) {
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_GSS_Kerberos5_AP_REQ));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
- } else if
(WSSecurityTokenConstants.Saml10Token.equals(tokenType)
- || WSSecurityTokenConstants.Saml11Token.equals(tokenType))
{
+ } else if
(WSSecurityTokenConstants.Saml10Token.equals(securityToken.getTokenType())
+ ||
WSSecurityTokenConstants.Saml11Token.equals(securityToken.getTokenType())) {
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML11_TOKEN_PROFILE_TYPE));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
isSAMLToken = true;
- } else if
(WSSecurityTokenConstants.Saml20Token.equals(tokenType)) {
+ } else if
(WSSecurityTokenConstants.Saml20Token.equals(securityToken.getTokenType())) {
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_SAML20_TOKEN_PROFILE_TYPE));
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, false, attributes);
isSAMLToken = true;
- } else if
(WSSecurityTokenConstants.EncryptedKeyToken.equals(tokenType)) {
+ } else if
(WSSecurityTokenConstants.EncryptedKeyToken.equals(securityToken.getTokenType()))
{
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
attributes.add(createAttribute(WSSConstants.ATT_wsse11_TokenType,
WSSConstants.NS_WSS_ENC_KEY_VALUE_TYPE));
@@ -424,29 +426,29 @@ public class EncryptOutputProcessor exte
if (isSAMLToken) {
// Always use KeyIdentifier regardless of the configured
KeyIdentifier value
- WSSUtils.createSAMLKeyIdentifierStructure(this,
outputProcessorChain, tokenType, getEncryptionPartDef().getKeyId());
+ WSSUtils.createSAMLKeyIdentifierStructure(this,
outputProcessorChain, securityToken.getTokenType(),
getEncryptionPartDef().getKeyId());
} else {
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(1);
attributes.add(createAttribute(WSSConstants.ATT_NULL_URI,
"#" + getEncryptionPartDef().getKeyId()));
- if
(WSSecurityTokenConstants.KerberosToken.equals(tokenType)) {
+ if
(WSSecurityTokenConstants.KerberosToken.equals(securityToken.getTokenType())) {
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_GSS_Kerberos5_AP_REQ));
- } else if
(WSSecurityTokenConstants.DerivedKeyToken.equals(tokenType)) {
+ } else if
(WSSecurityTokenConstants.DerivedKeyToken.equals(securityToken.getTokenType()))
{
boolean use200512Namespace =
((WSSSecurityProperties)getSecurityProperties()).isUse200512Namespace();
if (use200512Namespace) {
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_WSC_05_12 + "/dk"));
} else {
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_WSC_05_02 + "/dk"));
}
- } else if
(WSSecurityTokenConstants.SpnegoContextToken.equals(tokenType)
- ||
WSSecurityTokenConstants.SecurityContextToken.equals(tokenType)
- ||
WSSecurityTokenConstants.SecureConversationToken.equals(tokenType)) {
+ } else if
(WSSecurityTokenConstants.SpnegoContextToken.equals(securityToken.getTokenType())
+ ||
WSSecurityTokenConstants.SecurityContextToken.equals(securityToken.getTokenType())
+ ||
WSSecurityTokenConstants.SecureConversationToken.equals(securityToken.getTokenType()))
{
boolean use200512Namespace =
((WSSSecurityProperties)getSecurityProperties()).isUse200512Namespace();
if (use200512Namespace) {
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_WSC_05_12 + "/sct"));
} else {
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_WSC_05_12 + "/sct"));
}
- } else if
(WSSecurityTokenConstants.EncryptedKeyToken.equals(tokenType)) {
+ } else if
(WSSecurityTokenConstants.EncryptedKeyToken.equals(securityToken.getTokenType()))
{
attributes.add(createAttribute(WSSConstants.ATT_NULL_ValueType,
WSSConstants.NS_WSS_ENC_KEY_VALUE_TYPE));
}
createStartElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_Reference, false, attributes);
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptedKeyOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptedKeyOutputProcessor.java?rev=1560353&r1=1560352&r2=1560353&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptedKeyOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/EncryptedKeyOutputProcessor.java
Wed Jan 22 13:53:12 2014
@@ -365,6 +365,11 @@ public class EncryptedKeyOutputProcessor
boolean useSingleCertificate)
throws XMLStreamException, XMLSecurityException {
+ if (securityToken.getCustomTokenReference() != null) {
+ outputDOMElement(securityToken.getCustomTokenReference(),
outputProcessorChain);
+ return;
+ }
+
List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(2);
attributes.add(createAttribute(WSSConstants.ATT_wsu_Id,
IDGenerator.generateID(null)));
if
(WSSecurityTokenConstants.KeyIdentifier_SecurityTokenDirectReference.equals(keyIdentifier)
&& !useSingleCertificate) {
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java?rev=1560353&r1=1560352&r2=1560353&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/SAMLTokenOutputProcessor.java
Wed Jan 22 13:53:12 2014
@@ -53,19 +53,13 @@ import org.apache.xml.security.stax.ext.
import org.apache.xml.security.stax.ext.XMLSecurityConstants;
import org.apache.xml.security.stax.ext.stax.XMLSecAttribute;
import org.apache.xml.security.stax.ext.stax.XMLSecEvent;
-import org.apache.xml.security.stax.ext.stax.XMLSecNamespace;
import
org.apache.xml.security.stax.impl.securityToken.GenericOutboundSecurityToken;
import org.apache.xml.security.stax.impl.util.IDGenerator;
import org.apache.xml.security.stax.securityEvent.TokenSecurityEvent;
import org.apache.xml.security.stax.securityToken.OutboundSecurityToken;
import org.apache.xml.security.stax.securityToken.SecurityTokenProvider;
import org.opensaml.common.SAMLVersion;
-import org.w3c.dom.Attr;
import org.w3c.dom.Element;
-import org.w3c.dom.NamedNodeMap;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-import org.w3c.dom.Text;
public class SAMLTokenOutputProcessor extends AbstractOutputProcessor {
@@ -116,24 +110,24 @@ public class SAMLTokenOutputProcessor ex
XMLSecurityConstants.Action action = getAction();
boolean includeSTR = false;
+
+ GenericOutboundSecurityToken securityToken = null;
+
+ // See if a token is already available
+ String sigTokenId =
+
outputProcessorChain.getSecurityContext().get(WSSConstants.PROP_USE_THIS_TOKEN_ID_FOR_SIGNATURE);
+ SecurityTokenProvider<OutboundSecurityToken>
signatureTokenProvider = null;
+ if (sigTokenId != null) {
+ signatureTokenProvider =
+
outputProcessorChain.getSecurityContext().getSecurityTokenProvider(sigTokenId);
+ if (signatureTokenProvider != null) {
+ securityToken =
+
(GenericOutboundSecurityToken)signatureTokenProvider.getSecurityToken();
+ }
+ }
if (WSSConstants.SAML_TOKEN_SIGNED.equals(action) &&
senderVouches) {
- GenericOutboundSecurityToken securityToken = null;
includeSTR = true;
-
- // See if a token is already available
- String sigTokenId =
-
outputProcessorChain.getSecurityContext().get(WSSConstants.PROP_USE_THIS_TOKEN_ID_FOR_SIGNATURE);
- SecurityTokenProvider<OutboundSecurityToken>
signatureTokenProvider = null;
- if (sigTokenId != null) {
- signatureTokenProvider =
-
outputProcessorChain.getSecurityContext().getSecurityTokenProvider(sigTokenId);
- if (signatureTokenProvider != null) {
- securityToken =
-
(GenericOutboundSecurityToken)signatureTokenProvider.getSecurityToken();
- }
- }
-
if (securityToken == null) {
CryptoType cryptoType = new
CryptoType(CryptoType.TYPE.ALIAS);
cryptoType.setAlias(samlCallback.getIssuerKeyName());
@@ -223,6 +217,13 @@ public class SAMLTokenOutputProcessor ex
}
}
}
+
+ final Element ref;
+ if (securityToken != null) {
+ ref = securityToken.getCustomTokenReference();
+ } else {
+ ref = null;
+ }
finalSAMLTokenOutputProcessor = new
FinalSAMLTokenOutputProcessor(null, samlAssertionWrapper,
securityTokenReferenceId, senderVouches, includeSTR);
@@ -276,6 +277,7 @@ public class SAMLTokenOutputProcessor ex
};
}
this.samlSecurityToken.setProcessor(finalSAMLTokenOutputProcessor);
+ this.samlSecurityToken.setCustomTokenReference(ref);
return this.samlSecurityToken;
}
@@ -402,7 +404,7 @@ public class SAMLTokenOutputProcessor ex
}
WSSUtils.updateSecurityHeaderOrder(outputProcessorChain,
headerElementName, getAction(), false);
- outputSamlAssertion(samlAssertionWrapper.toDOM(null),
subOutputProcessorChain);
+ outputDOMElement(samlAssertionWrapper.toDOM(null),
subOutputProcessorChain);
if (includeSTR) {
WSSUtils.updateSecurityHeaderOrder(
outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference, getAction(), false);
@@ -432,43 +434,4 @@ public class SAMLTokenOutputProcessor ex
createEndElementAndOutputAsEvent(outputProcessorChain,
WSSConstants.TAG_wsse_SecurityTokenReference);
}
- //todo serialize directly from SAML XMLObject?
- private void outputSamlAssertion(Element element, OutputProcessorChain
outputProcessorChain)
- throws XMLStreamException, XMLSecurityException {
-
- NamedNodeMap namedNodeMap = element.getAttributes();
- List<XMLSecAttribute> attributes = new
ArrayList<XMLSecAttribute>(namedNodeMap.getLength());
- List<XMLSecNamespace> namespaces = new
ArrayList<XMLSecNamespace>(namedNodeMap.getLength());
- for (int i = 0; i < namedNodeMap.getLength(); i++) {
- Attr attribute = (Attr) namedNodeMap.item(i);
- if (attribute.getPrefix() == null) {
- attributes.add(
- createAttribute(
- new QName(attribute.getNamespaceURI(),
attribute.getLocalName()), attribute.getValue()));
- } else if ("xmlns".equals(attribute.getPrefix()) ||
"xmlns".equals(attribute.getLocalName())) {
- namespaces.add(createNamespace(attribute.getLocalName(),
attribute.getValue()));
- } else {
- attributes.add(
- createAttribute(
- new QName(attribute.getNamespaceURI(),
attribute.getLocalName(), attribute.getPrefix()),
- attribute.getValue()));
- }
- }
-
- QName elementName = new QName(element.getNamespaceURI(),
element.getLocalName(), element.getPrefix());
- createStartElementAndOutputAsEvent(outputProcessorChain, elementName,
namespaces, attributes);
- NodeList childNodes = element.getChildNodes();
- for (int i = 0; i < childNodes.getLength(); i++) {
- Node childNode = childNodes.item(i);
- switch (childNode.getNodeType()) {
- case Node.ELEMENT_NODE:
- outputSamlAssertion((Element) childNode,
outputProcessorChain);
- break;
- case Node.TEXT_NODE:
- createCharactersAndOutputAsEvent(outputProcessorChain,
((Text) childNode).getData());
- break;
- }
- }
- createEndElementAndOutputAsEvent(outputProcessorChain, elementName);
- }
}
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java?rev=1560353&r1=1560352&r2=1560353&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/output/WSSSignatureEndingOutputProcessor.java
Wed Jan 22 13:53:12 2014
@@ -39,6 +39,7 @@ import org.apache.xml.security.stax.secu
import javax.xml.stream.XMLStreamConstants;
import javax.xml.stream.XMLStreamException;
+
import java.security.cert.X509Certificate;
import java.security.Key;
import java.util.*;
@@ -87,6 +88,11 @@ public class WSSSignatureEndingOutputPro
boolean useSingleCertificate)
throws XMLStreamException, XMLSecurityException {
+ if (securityToken.getCustomTokenReference() != null) {
+ outputDOMElement(securityToken.getCustomTokenReference(),
outputProcessorChain);
+ return;
+ }
+
WSSecurityTokenConstants.KeyIdentifier keyIdentifier =
getSecurityProperties().getSignatureKeyIdentifier();
X509Certificate[] x509Certificates =
securityToken.getX509Certificates();
