This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/WSS-712 in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 7461e6c09d6f55d58d88a7eeaa093dc69430a7a3 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Mon Oct 12 16:05:06 2026 +0100 WSS-712 - SignatureDigestAlgorithm of SAMLCallback not taken into account --- .../wss4j/dom/action/SAMLTokenUnsignedAction.java | 3 +- .../apache/wss4j/dom/saml/SamlTokenActionTest.java | 58 ++++++++++++++++++++++ 2 files changed, 60 insertions(+), 1 deletion(-) diff --git a/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java b/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java index f7cc633f9..b7f0ab02d 100644 --- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java +++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SAMLTokenUnsignedAction.java @@ -63,7 +63,8 @@ public class SAMLTokenUnsignedAction implements Action { samlCallback.getIssuerCrypto(), samlCallback.isSendKeyValue(), samlCallback.getCanonicalizationAlgorithm(), - samlCallback.getSignatureAlgorithm() + samlCallback.getSignatureAlgorithm(), + samlCallback.getSignatureDigestAlgorithm() ); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java index 9963c72a7..e8b2e309a 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenActionTest.java @@ -27,9 +27,12 @@ import javax.security.auth.callback.CallbackHandler; import org.apache.wss4j.common.util.SOAPUtil; import org.w3c.dom.Document; +import org.w3c.dom.Element; +import org.w3c.dom.NodeList; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; import org.apache.wss4j.common.ext.WSSecurityException; +import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.SamlAssertionWrapper; import org.apache.wss4j.common.util.XMLUtils; import org.apache.wss4j.dom.WSConstants; @@ -295,6 +298,61 @@ public class SamlTokenActionTest { assertTrue(receivedSamlAssertion.isSigned()); } + @Test + public void testSignedSAML2AssertionActionWithDigestAlgorithm() throws Exception { + final WSSConfig cfg = WSSConfig.getNewInstance(); + final RequestData reqData = new RequestData(); + reqData.setWssConfig(cfg); + reqData.setUsername("wss40"); + + CallbackHandler callbackHandler = new KeystoreCallbackHandler(); + + SAML2CallbackHandler samlCallbackHandler = new SAML2CallbackHandler(); + samlCallbackHandler.setStatement(SAML2CallbackHandler.Statement.AUTHN); + samlCallbackHandler.setIssuer("www.example.com"); + samlCallbackHandler.setSignAssertion(true); + samlCallbackHandler.setIssuerCrypto(crypto); + samlCallbackHandler.setIssuerName("wss40"); + samlCallbackHandler.setIssuerPassword("security"); + + final String digestAlgorithm = "http://www.w3.org/2001/04/xmlenc#sha512";; + CallbackHandler digestCallbackHandler = callbacks -> { + samlCallbackHandler.handle(callbacks); + ((SAMLCallback) callbacks[0]).setSignatureDigestAlgorithm(digestAlgorithm); + }; + + java.util.Map<String, Object> config = new java.util.TreeMap<>(); + config.put(WSHandlerConstants.SAML_CALLBACK_REF, digestCallbackHandler); + reqData.setMsgContext(config); + + final Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG); + CustomHandler handler = new CustomHandler(); + HandlerAction action = new HandlerAction(WSConstants.ST_UNSIGNED); + handler.send( + doc, + reqData, + Collections.singletonList(action), + true + ); + if (LOG.isDebugEnabled()) { + String outputString = XMLUtils.prettyDocumentToString(doc); + LOG.debug(outputString); + } + + NodeList digestMethods = doc.getElementsByTagNameNS(WSConstants.SIG_NS, "DigestMethod"); + assertEquals(1, digestMethods.getLength()); + assertEquals(digestAlgorithm, ((Element) digestMethods.item(0)).getAttributeNS(null, "Algorithm")); + + WSHandlerResult results = verify(doc, callbackHandler); + WSSecurityEngineResult actionResult = + results.getActionResults().get(WSConstants.ST_SIGNED).get(0); + + SamlAssertionWrapper receivedSamlAssertion = + (SamlAssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); + assertNotNull(receivedSamlAssertion); + assertTrue(receivedSamlAssertion.isSigned()); + } + private WSHandlerResult verify( Document doc, CallbackHandler callbackHandler ) throws Exception {
