Author: coheigea
Date: Mon Apr 7 05:18:45 2014
New Revision: 1585389
URL: http://svn.apache.org/r1585389
Log:
Removed checkValidity calls on certificates
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/validate/SignatureTrustValidator.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/X509SecurityTokenImpl.java
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/validate/SignatureTrustValidator.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/validate/SignatureTrustValidator.java?rev=1585389&r1=1585388&r2=1585389&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/validate/SignatureTrustValidator.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/validate/SignatureTrustValidator.java
Mon Apr 7 05:18:45 2014
@@ -20,8 +20,6 @@
package org.apache.wss4j.dom.validate;
import java.security.PublicKey;
-import java.security.cert.CertificateExpiredException;
-import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;
import java.util.Collection;
import java.util.regex.Pattern;
@@ -84,19 +82,7 @@ public class SignatureTrustValidator imp
*/
protected void validateCertificates(X509Certificate[] certificates)
throws WSSecurityException {
- try {
- for (int i = 0; i < certificates.length; i++) {
- certificates[i].checkValidity();
- }
- } catch (CertificateExpiredException e) {
- throw new WSSecurityException(
- WSSecurityException.ErrorCode.FAILED_CHECK, "invalidCert", e
- );
- } catch (CertificateNotYetValidException e) {
- throw new WSSecurityException(
- WSSecurityException.ErrorCode.FAILED_CHECK, "invalidCert", e
- );
- }
+ // Nothing
}
/**
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java?rev=1585389&r1=1585388&r2=1585389&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
Mon Apr 7 05:18:45 2014
@@ -23,8 +23,6 @@ import java.security.Key;
import java.security.Principal;
import java.security.PrivateKey;
import java.security.PublicKey;
-import java.security.cert.CertificateExpiredException;
-import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;
import java.util.Collection;
import java.util.List;
@@ -192,36 +190,28 @@ public class SamlSecurityTokenImpl exten
if (samlAssertionWrapper == null) {
return;
}
- try {
- String confirmMethod = null;
- List<String> methods =
samlAssertionWrapper.getConfirmationMethods();
- if (methods != null && methods.size() > 0) {
- confirmMethod = methods.get(0);
- }
- // If HOK + Token is signed then we don't need to verify the
subject cert, as we
- // indirectly trust it
- if (!OpenSAMLUtil.isMethodHolderOfKey(confirmMethod) &&
!samlAssertionWrapper.isSigned()) {
- X509Certificate[] x509Certificates = getX509Certificates();
- if (x509Certificates != null && x509Certificates.length > 0) {
- //todo I don't think the checkValidity is necessary
because the CertPathChecker
- x509Certificates[0].checkValidity();
- boolean enableRevocation = false;
- Collection<Pattern> subjectCertConstraints = null;
- if (securityProperties != null) {
- enableRevocation =
securityProperties.isEnableRevocation();
- subjectCertConstraints =
securityProperties.getSubjectCertConstraints();
- }
- crypto.verifyTrust(x509Certificates, enableRevocation,
subjectCertConstraints);
- }
- PublicKey publicKey = getPublicKey();
- if (publicKey != null) {
- crypto.verifyTrust(publicKey);
+ String confirmMethod = null;
+ List<String> methods = samlAssertionWrapper.getConfirmationMethods();
+ if (methods != null && methods.size() > 0) {
+ confirmMethod = methods.get(0);
+ }
+ // If HOK + Token is signed then we don't need to verify the subject
cert, as we
+ // indirectly trust it
+ if (!OpenSAMLUtil.isMethodHolderOfKey(confirmMethod) &&
!samlAssertionWrapper.isSigned()) {
+ X509Certificate[] x509Certificates = getX509Certificates();
+ if (x509Certificates != null && x509Certificates.length > 0) {
+ boolean enableRevocation = false;
+ Collection<Pattern> subjectCertConstraints = null;
+ if (securityProperties != null) {
+ enableRevocation = securityProperties.isEnableRevocation();
+ subjectCertConstraints =
securityProperties.getSubjectCertConstraints();
}
+ crypto.verifyTrust(x509Certificates, enableRevocation,
subjectCertConstraints);
+ }
+ PublicKey publicKey = getPublicKey();
+ if (publicKey != null) {
+ crypto.verifyTrust(publicKey);
}
- } catch (CertificateExpiredException e) {
- throw new
WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION, e);
- } catch (CertificateNotYetValidException e) {
- throw new
WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION, e);
}
}
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/X509SecurityTokenImpl.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/X509SecurityTokenImpl.java?rev=1585389&r1=1585388&r2=1585389&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/X509SecurityTokenImpl.java
(original)
+++
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/X509SecurityTokenImpl.java
Mon Apr 7 05:18:45 2014
@@ -35,8 +35,6 @@ import javax.security.auth.callback.Call
import java.security.Key;
import java.security.Principal;
-import java.security.cert.CertificateExpiredException;
-import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;
import java.util.Collection;
import java.util.regex.Matcher;
@@ -109,25 +107,15 @@ public abstract class X509SecurityTokenI
@Override
public void verify() throws XMLSecurityException {
//todo overall call verify on wrapping tokens for non top-level
SecurityTokens!?
- try {
- X509Certificate[] x509Certificates = getX509Certificates();
- if (x509Certificates != null && x509Certificates.length > 0) {
- //todo I don't think the checkValidity is necessary because
the CertPathChecker
- // in crypto-verify trust should already do the job
- x509Certificates[0].checkValidity();
-
- boolean enableRevocation = false;
- Collection<Pattern> subjectCertConstraints = null;
- if (securityProperties != null) {
- enableRevocation = securityProperties.isEnableRevocation();
- subjectCertConstraints =
securityProperties.getSubjectCertConstraints();
- }
- getCrypto().verifyTrust(x509Certificates, enableRevocation,
subjectCertConstraints);
+ X509Certificate[] x509Certificates = getX509Certificates();
+ if (x509Certificates != null && x509Certificates.length > 0) {
+ boolean enableRevocation = false;
+ Collection<Pattern> subjectCertConstraints = null;
+ if (securityProperties != null) {
+ enableRevocation = securityProperties.isEnableRevocation();
+ subjectCertConstraints =
securityProperties.getSubjectCertConstraints();
}
- } catch (CertificateExpiredException e) {
- throw new
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY, e);
- } catch (CertificateNotYetValidException e) {
- throw new
WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY, e);
+ getCrypto().verifyTrust(x509Certificates, enableRevocation,
subjectCertConstraints);
}
}
