Author: coheigea
Date: Wed Apr 2 13:26:27 2014
New Revision: 1584023
URL: http://svn.apache.org/r1584023
Log:
Making setting AudienceRestrictions more configurable
Conflicts:
src/main/java/org/apache/ws/security/saml/ext/bean/ConditionsBean.java
src/main/java/org/apache/ws/security/saml/ext/builder/SAML1ComponentBuilder.java
src/main/java/org/apache/ws/security/saml/ext/builder/SAML2ComponentBuilder.java
src/test/java/org/apache/ws/security/saml/SamlConditionsTest.java
ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SamlConditionsTest.java
Added:
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/AudienceRestrictionBean.java
Modified:
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/ConditionsBean.java
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML1ComponentBuilder.java
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML2ComponentBuilder.java
webservices/wss4j/branches/1_6_x-fixes/src/test/java/org/apache/ws/security/saml/SamlConditionsTest.java
Added:
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/AudienceRestrictionBean.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/AudienceRestrictionBean.java?rev=1584023&view=auto
==============================================================================
---
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/AudienceRestrictionBean.java
(added)
+++
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/AudienceRestrictionBean.java
Wed Apr 2 13:26:27 2014
@@ -0,0 +1,99 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ws.security.saml.ext.bean;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Class AudienceRestrictionBean represents a SAML AudienceRestriction object
+ */
+public class AudienceRestrictionBean {
+ private final List<String> audienceURIs = new ArrayList<String>();
+
+ /**
+ * Constructor AudienceRestrictionBean creates a new
AudienceRestrictionBean instance.
+ */
+ public AudienceRestrictionBean() {
+ }
+
+ /**
+ * Constructor AudienceRestrictionBean creates a new
AudienceRestrictionBean instance.
+ *
+ * @param audienceURIs The audienceURI instances
+ */
+ public AudienceRestrictionBean(
+ List<String> audienceURIs
+ ) {
+ if (audienceURIs != null) {
+ this.audienceURIs.addAll(audienceURIs);
+ }
+ }
+
+ /**
+ * Get the audienceURI instances
+ *
+ * @return the audienceURI instances
+ */
+ public List<String> getAudienceURIs() {
+ return audienceURIs;
+ }
+
+ /**
+ * Set the audienceURI instance
+ *
+ * @param audienceURI the audienceURI instance to set
+ */
+ public void setAudienceURIs(List<String> audienceURIs) {
+ this.audienceURIs.clear();
+ this.audienceURIs.addAll(audienceURIs);
+ }
+
+ /**
+ * Method equals ...
+ *
+ * @param o of type Object
+ * @return boolean
+ */
+ @Override
+ public boolean equals(Object o) {
+ if (this == o) return true;
+ if (!(o instanceof AudienceRestrictionBean)) return false;
+
+ AudienceRestrictionBean that = (AudienceRestrictionBean) o;
+
+ if (!audienceURIs.equals(that.audienceURIs)) {
+ return false;
+ }
+
+ return true;
+ }
+
+ /**
+ * @return the hashcode of this object
+ */
+ @Override
+ public int hashCode() {
+ int result = 17;
+ result = 31 * result + audienceURIs.hashCode();
+ return result;
+ }
+
+}
Modified:
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/ConditionsBean.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/ConditionsBean.java?rev=1584023&r1=1584022&r2=1584023&view=diff
==============================================================================
---
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/ConditionsBean.java
(original)
+++
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/bean/ConditionsBean.java
Wed Apr 2 13:26:27 2014
@@ -19,6 +19,8 @@
package org.apache.ws.security.saml.ext.bean;
+import java.util.List;
+
import org.joda.time.DateTime;
@@ -33,6 +35,7 @@ public class ConditionsBean {
private DateTime notAfter;
private int tokenPeriodMinutes;
private String audienceURI;
+ private List<AudienceRestrictionBean> audienceRestrictions;
private boolean oneTimeUse;
private ProxyRestrictionBean proxyRestriction;
@@ -126,6 +129,7 @@ public class ConditionsBean {
*
* @return the audienceURI instance
*/
+ @Deprecated
public String getAudienceURI() {
return audienceURI;
}
@@ -135,9 +139,28 @@ public class ConditionsBean {
*
* @param audienceURI the audienceURI instance to set
*/
+ @Deprecated
public void setAudienceURI(String audienceURI) {
this.audienceURI = audienceURI;
}
+
+ /**
+ * Get the audienceRestrictions instances
+ *
+ * @return the audienceRestrictions instances
+ */
+ public List<AudienceRestrictionBean> getAudienceRestrictions() {
+ return audienceRestrictions;
+ }
+
+ /**
+ * Set the audienceRestrictions instance
+ *
+ * @param audienceRestrictions the audienceRestrictions instance to set
+ */
+ public void setAudienceRestrictions(List<AudienceRestrictionBean>
audienceRestrictions) {
+ this.audienceRestrictions = audienceRestrictions;
+ }
/**
* Get whether to include a OneTimeUse Element or not. Only applies to
SAML2.
@@ -196,6 +219,13 @@ public class ConditionsBean {
return false;
}
+ if (audienceRestrictions == null && that.audienceRestrictions != null)
{
+ return false;
+ } else if (audienceRestrictions != null
+ && !audienceRestrictions.equals(that.audienceRestrictions)) {
+ return false;
+ }
+
if (oneTimeUse != that.oneTimeUse) return false;
if (proxyRestriction == null && that.proxyRestriction != null) {
@@ -223,6 +253,9 @@ public class ConditionsBean {
if (audienceURI != null) {
result = 31 * result + audienceURI.hashCode();
}
+ if (audienceRestrictions != null) {
+ result = 31 * result + audienceRestrictions.hashCode();
+ }
result = 31 * result + (oneTimeUse ? 1 : 0);
if (proxyRestriction != null) {
result = 31 * result + proxyRestriction.hashCode();
Modified:
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML1ComponentBuilder.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML1ComponentBuilder.java?rev=1584023&r1=1584022&r2=1584023&view=diff
==============================================================================
---
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML1ComponentBuilder.java
(original)
+++
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML1ComponentBuilder.java
Wed Apr 2 13:26:27 2014
@@ -24,6 +24,7 @@ import org.apache.ws.security.saml.ext.O
import org.apache.ws.security.saml.ext.bean.ActionBean;
import org.apache.ws.security.saml.ext.bean.AttributeBean;
import org.apache.ws.security.saml.ext.bean.AttributeStatementBean;
+import org.apache.ws.security.saml.ext.bean.AudienceRestrictionBean;
import org.apache.ws.security.saml.ext.bean.AuthDecisionStatementBean;
import org.apache.ws.security.saml.ext.bean.AuthenticationStatementBean;
import org.apache.ws.security.saml.ext.bean.ConditionsBean;
@@ -31,12 +32,10 @@ import org.apache.ws.security.saml.ext.b
import org.apache.ws.security.saml.ext.bean.SubjectBean;
import org.apache.ws.security.saml.ext.bean.SubjectLocalityBean;
import org.apache.ws.security.util.UUIDGenerator;
-
import org.joda.time.DateTime;
import org.opensaml.Configuration;
import org.opensaml.common.SAMLObjectBuilder;
import org.opensaml.common.SAMLVersion;
-
import org.opensaml.saml1.core.Action;
import org.opensaml.saml1.core.Assertion;
import org.opensaml.saml1.core.Attribute;
@@ -54,7 +53,6 @@ import org.opensaml.saml1.core.NameIdent
import org.opensaml.saml1.core.Subject;
import org.opensaml.saml1.core.SubjectConfirmation;
import org.opensaml.saml1.core.SubjectLocality;
-
import org.opensaml.xml.XMLObject;
import org.opensaml.xml.XMLObjectBuilderFactory;
import org.opensaml.xml.schema.XSString;
@@ -64,6 +62,7 @@ import org.opensaml.xml.security.x509.X5
import org.opensaml.xml.signature.KeyInfo;
import java.util.ArrayList;
+import java.util.Collections;
import java.util.List;
/**
@@ -242,7 +241,7 @@ public final class SAML1ComponentBuilder
* @param conditionsBean A ConditionsBean object
* @return a Conditions object
*/
- @SuppressWarnings("unchecked")
+ @SuppressWarnings({ "unchecked", "deprecation" })
public static Conditions createSamlv1Conditions(ConditionsBean
conditionsBean) {
if (conditionsV1Builder == null) {
conditionsV1Builder = (SAMLObjectBuilder<Conditions>)
@@ -285,6 +284,16 @@ public final class SAML1ComponentBuilder
conditions.getAudienceRestrictionConditions().add(audienceRestriction);
}
+ if (conditionsBean.getAudienceRestrictions() != null
+ && !conditionsBean.getAudienceRestrictions().isEmpty()) {
+ for (AudienceRestrictionBean audienceRestrictionBean
+ : conditionsBean.getAudienceRestrictions()) {
+ AudienceRestrictionCondition audienceRestriction =
+
createSamlv1AudienceRestriction(audienceRestrictionBean);
+
conditions.getAudienceRestrictionConditions().add(audienceRestriction);
+ }
+ }
+
return conditions;
}
@@ -294,9 +303,23 @@ public final class SAML1ComponentBuilder
* @param audienceURI of type String
* @return an AudienceRestrictionCondition object
*/
- @SuppressWarnings("unchecked")
+ @Deprecated
public static AudienceRestrictionCondition
createSamlv1AudienceRestriction(String audienceURI) {
+ AudienceRestrictionBean audienceRestrictionBean = new
AudienceRestrictionBean();
+
audienceRestrictionBean.setAudienceURIs(Collections.singletonList(audienceURI));
+ return createSamlv1AudienceRestriction(audienceRestrictionBean);
+ }
+
+ /**
+ * Create an AudienceRestrictionCondition object
+ *
+ * @param audienceRestrictionBean of type AudienceRestrictionBean
+ * @return an AudienceRestrictionCondition object
+ */
+ @SuppressWarnings("unchecked")
+ public static AudienceRestrictionCondition
+ createSamlv1AudienceRestriction(AudienceRestrictionBean
audienceRestrictionBean) {
if (audienceRestrictionV1Builder == null) {
audienceRestrictionV1Builder =
(SAMLObjectBuilder<AudienceRestrictionCondition>)
builderFactory.getBuilder(AudienceRestrictionCondition.DEFAULT_ELEMENT_NAME);
@@ -308,9 +331,12 @@ public final class SAML1ComponentBuilder
AudienceRestrictionCondition audienceRestriction =
audienceRestrictionV1Builder.buildObject();
- Audience audience = audienceV1Builder.buildObject();
- audience.setUri(audienceURI);
- audienceRestriction.getAudiences().add(audience);
+
+ for (String audienceURI : audienceRestrictionBean.getAudienceURIs()) {
+ Audience audience = audienceV1Builder.buildObject();
+ audience.setUri(audienceURI);
+ audienceRestriction.getAudiences().add(audience);
+ }
return audienceRestriction;
}
Modified:
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML2ComponentBuilder.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML2ComponentBuilder.java?rev=1584023&r1=1584022&r2=1584023&view=diff
==============================================================================
---
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML2ComponentBuilder.java
(original)
+++
webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/builder/SAML2ComponentBuilder.java
Wed Apr 2 13:26:27 2014
@@ -23,6 +23,7 @@ import org.apache.ws.security.WSSecurity
import org.apache.ws.security.saml.ext.bean.ActionBean;
import org.apache.ws.security.saml.ext.bean.AttributeBean;
import org.apache.ws.security.saml.ext.bean.AttributeStatementBean;
+import org.apache.ws.security.saml.ext.bean.AudienceRestrictionBean;
import org.apache.ws.security.saml.ext.bean.AuthDecisionStatementBean;
import org.apache.ws.security.saml.ext.bean.AuthenticationStatementBean;
import org.apache.ws.security.saml.ext.bean.ConditionsBean;
@@ -32,7 +33,6 @@ import org.apache.ws.security.saml.ext.b
import org.apache.ws.security.saml.ext.bean.SubjectConfirmationDataBean;
import org.apache.ws.security.saml.ext.bean.SubjectLocalityBean;
import org.apache.ws.security.util.UUIDGenerator;
-
import org.joda.time.DateTime;
import org.opensaml.Configuration;
import org.opensaml.common.SAMLObjectBuilder;
@@ -67,6 +67,7 @@ import org.opensaml.xml.schema.impl.XSSt
import org.opensaml.xml.signature.KeyInfo;
import java.util.ArrayList;
+import java.util.Collections;
import java.util.List;
/**
@@ -176,7 +177,7 @@ public final class SAML2ComponentBuilder
* @param conditionsBean A ConditionsBean object
* @return a Conditions object
*/
- @SuppressWarnings("unchecked")
+ @SuppressWarnings({ "unchecked", "deprecation" })
public static Conditions createConditions(ConditionsBean conditionsBean) {
if (conditionsBuilder == null) {
conditionsBuilder = (SAMLObjectBuilder<Conditions>)
@@ -219,6 +220,16 @@ public final class SAML2ComponentBuilder
conditions.getAudienceRestrictions().add(audienceRestriction);
}
+ if (conditionsBean.getAudienceRestrictions() != null
+ && !conditionsBean.getAudienceRestrictions().isEmpty()) {
+ for (AudienceRestrictionBean audienceRestrictionBean
+ : conditionsBean.getAudienceRestrictions()) {
+ AudienceRestriction audienceRestriction =
+ createAudienceRestriction(audienceRestrictionBean);
+ conditions.getAudienceRestrictions().add(audienceRestriction);
+ }
+ }
+
if (conditionsBean.isOneTimeUse()) {
conditions.getConditions().add(createOneTimeUse());
}
@@ -235,8 +246,23 @@ public final class SAML2ComponentBuilder
* @param audienceURI of type String
* @return an AudienceRestriction object
*/
- @SuppressWarnings("unchecked")
+ @Deprecated
public static AudienceRestriction createAudienceRestriction(String
audienceURI) {
+ AudienceRestrictionBean audienceRestrictionBean = new
AudienceRestrictionBean();
+
audienceRestrictionBean.setAudienceURIs(Collections.singletonList(audienceURI));
+ return createAudienceRestriction(audienceRestrictionBean);
+ }
+
+ /**
+ * Create an AudienceRestriction object
+ *
+ * @param audienceRestrictionBean of type AudienceRestrictionBean
+ * @return an AudienceRestriction object
+ */
+ @SuppressWarnings("unchecked")
+ public static AudienceRestriction createAudienceRestriction(
+ AudienceRestrictionBean audienceRestrictionBean
+ ) {
if (audienceRestrictionBuilder == null) {
audienceRestrictionBuilder =
(SAMLObjectBuilder<AudienceRestriction>)
builderFactory.getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
@@ -247,9 +273,12 @@ public final class SAML2ComponentBuilder
}
AudienceRestriction audienceRestriction =
audienceRestrictionBuilder.buildObject();
- Audience audience = audienceBuilder.buildObject();
- audience.setAudienceURI(audienceURI);
- audienceRestriction.getAudiences().add(audience);
+
+ for (String audienceURI : audienceRestrictionBean.getAudienceURIs()) {
+ Audience audience = audienceBuilder.buildObject();
+ audience.setAudienceURI(audienceURI);
+ audienceRestriction.getAudiences().add(audience);
+ }
return audienceRestriction;
}
Modified:
webservices/wss4j/branches/1_6_x-fixes/src/test/java/org/apache/ws/security/saml/SamlConditionsTest.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/test/java/org/apache/ws/security/saml/SamlConditionsTest.java?rev=1584023&r1=1584022&r2=1584023&view=diff
==============================================================================
---
webservices/wss4j/branches/1_6_x-fixes/src/test/java/org/apache/ws/security/saml/SamlConditionsTest.java
(original)
+++
webservices/wss4j/branches/1_6_x-fixes/src/test/java/org/apache/ws/security/saml/SamlConditionsTest.java
Wed Apr 2 13:26:27 2014
@@ -20,6 +20,7 @@
package org.apache.ws.security.saml;
import java.util.ArrayList;
+import java.util.Collections;
import java.util.List;
import org.apache.ws.security.WSConstants;
@@ -35,6 +36,7 @@ import org.apache.ws.security.message.WS
import org.apache.ws.security.message.WSSecSAMLToken;
import org.apache.ws.security.saml.ext.AssertionWrapper;
import org.apache.ws.security.saml.ext.SAMLParms;
+import org.apache.ws.security.saml.ext.bean.AudienceRestrictionBean;
import org.apache.ws.security.saml.ext.bean.ConditionsBean;
import org.apache.ws.security.saml.ext.bean.ProxyRestrictionBean;
import org.apache.ws.security.util.WSSecurityUtil;
@@ -308,6 +310,138 @@ public class SamlConditionsTest extends
}
/**
+ * Test that creates, sends and processes an unsigned SAML 2
authentication assertion
+ * with an AudienceRestriction Element
+ */
+ @SuppressWarnings("deprecation")
+ @org.junit.Test
+ public void testSAML2AudienceRestrictionOldAPI() throws Exception {
+ SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler();
+ callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN);
+ callbackHandler.setIssuer("www.example.com");
+
+ ConditionsBean conditions = new ConditionsBean();
+ conditions.setTokenPeriodMinutes(5);
+
+ conditions.setAudienceURI("http://apache.org/one";);
+
+ callbackHandler.setConditions(conditions);
+
+ SAMLParms samlParms = new SAMLParms();
+ samlParms.setCallbackHandler(callbackHandler);
+ AssertionWrapper assertion = new AssertionWrapper(samlParms);
+
+ WSSecSAMLToken wsSign = new WSSecSAMLToken();
+
+ Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+ WSSecHeader secHeader = new WSSecHeader();
+ secHeader.insertSecurityHeader(doc);
+
+ Document unsignedDoc = wsSign.build(doc, assertion, secHeader);
+
+ String outputString =
+
org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(unsignedDoc);
+ assertTrue(outputString.contains("AudienceRestriction"));
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(outputString);
+ }
+
+ verify(unsignedDoc);
+ }
+
+ /**
+ * Test that creates, sends and processes an unsigned SAML 2
authentication assertion
+ * with an AudienceRestriction Element
+ */
+ @org.junit.Test
+ public void testSAML2AudienceRestriction() throws Exception {
+ SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler();
+ callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN);
+ callbackHandler.setIssuer("www.example.com");
+
+ ConditionsBean conditions = new ConditionsBean();
+ conditions.setTokenPeriodMinutes(5);
+ List<String> audiences = new ArrayList<String>();
+ audiences.add("http://apache.org/one";);
+ audiences.add("http://apache.org/two";);
+ AudienceRestrictionBean audienceRestrictionBean = new
AudienceRestrictionBean();
+ audienceRestrictionBean.setAudienceURIs(audiences);
+
conditions.setAudienceRestrictions(Collections.singletonList(audienceRestrictionBean));
+
+ callbackHandler.setConditions(conditions);
+
+ SAMLParms samlParms = new SAMLParms();
+ samlParms.setCallbackHandler(callbackHandler);
+ AssertionWrapper assertion = new AssertionWrapper(samlParms);
+
+ WSSecSAMLToken wsSign = new WSSecSAMLToken();
+
+ Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+ WSSecHeader secHeader = new WSSecHeader();
+ secHeader.insertSecurityHeader(doc);
+
+ Document unsignedDoc = wsSign.build(doc, assertion, secHeader);
+
+ String outputString =
+
org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(unsignedDoc);
+ assertTrue(outputString.contains("AudienceRestriction"));
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(outputString);
+ }
+
+ verify(unsignedDoc);
+ }
+
+ /**
+ * Test that creates, sends and processes an unsigned SAML 2
authentication assertion
+ * with two AudienceRestriction Elements
+ */
+ @org.junit.Test
+ public void testSAML2AudienceRestrictionSeparateRestrictions() throws
Exception {
+ SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler();
+ callbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN);
+ callbackHandler.setIssuer("www.example.com");
+
+ ConditionsBean conditions = new ConditionsBean();
+ conditions.setTokenPeriodMinutes(5);
+
+ List<AudienceRestrictionBean> audiencesRestrictions =
+ new ArrayList<AudienceRestrictionBean>();
+ AudienceRestrictionBean audienceRestrictionBean = new
AudienceRestrictionBean();
+
audienceRestrictionBean.setAudienceURIs(Collections.singletonList("http://apache.org/one";));
+ audiencesRestrictions.add(audienceRestrictionBean);
+
+ audienceRestrictionBean = new AudienceRestrictionBean();
+
audienceRestrictionBean.setAudienceURIs(Collections.singletonList("http://apache.org/two";));
+ audiencesRestrictions.add(audienceRestrictionBean);
+
+ conditions.setAudienceRestrictions(audiencesRestrictions);
+
+ callbackHandler.setConditions(conditions);
+
+ SAMLParms samlParms = new SAMLParms();
+ samlParms.setCallbackHandler(callbackHandler);
+ AssertionWrapper assertion = new AssertionWrapper(samlParms);
+
+ WSSecSAMLToken wsSign = new WSSecSAMLToken();
+
+ Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+ WSSecHeader secHeader = new WSSecHeader();
+ secHeader.insertSecurityHeader(doc);
+
+ Document unsignedDoc = wsSign.build(doc, assertion, secHeader);
+
+ String outputString =
+
org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(unsignedDoc);
+ assertTrue(outputString.contains("AudienceRestriction"));
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(outputString);
+ }
+
+ verify(unsignedDoc);
+ }
+
+ /**
* Verifies the soap envelope
* <p/>
*
