Author: veithen
Date: Wed Jul 16 18:14:24 2014
New Revision: 1611122

URL: http://svn.apache.org/r1611122
Log:
RAMPART-415: Applied Detelin Yordanov's patch to restore support for 
UsernameToken assertions with no password requirement.

Added:
    
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/policy/35.xml
   (with props)
    
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/services-35.xml
   (with props)
Modified:
    
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/RampartEngine.java
    
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
    axis/axis2/java/rampart/trunk/modules/rampart-integration/pom.xml
    
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/java/org/apache/rampart/RampartTest.java

Modified: 
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/RampartEngine.java
URL: 
http://svn.apache.org/viewvc/axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/RampartEngine.java?rev=1611122&r1=1611121&r2=1611122&view=diff
==============================================================================
--- 
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/RampartEngine.java
 (original)
+++ 
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/RampartEngine.java
 Wed Jul 16 18:14:24 2014
@@ -32,6 +32,7 @@ import org.apache.rampart.saml.SAMLAsser
 import org.apache.rampart.util.Axis2Util;
 import org.apache.rampart.util.RampartUtil;
 import org.apache.ws.secpolicy.WSSPolicyException;
+import org.apache.ws.secpolicy.model.UsernameToken;
 import org.apache.ws.security.*;
 import org.apache.ws.security.components.crypto.Crypto;
 
@@ -117,6 +118,19 @@ public class RampartEngine {
                        t0 = System.currentTimeMillis();
                }
 
+               //wss4j does not allow username tokens with no password per 
default, see https://issues.apache.org/jira/browse/WSS-420
+               //configure it to allow them explicitly if at least one 
username token assertion with no password requirement is found
+               if (!rmd.isInitiator()) {
+                   Collection<UsernameToken> usernameTokens = 
RampartUtil.getUsernameTokens(rpd);
+                   for (UsernameToken usernameTok : usernameTokens) {
+                       if (usernameTok.isNoPassword()) {
+                           log.debug("Found UsernameToken with no password 
assertion in policy, configuring ws security processing to allow username 
tokens without password." );
+                           
engine.getWssConfig().setAllowUsernameTokenNoPassword(true);
+                           break;
+                       }
+                   }
+               }
+               
                String actorValue = secHeader.getAttributeValue(new QName(rmd
                                .getSoapConstants().getEnvelopeURI(), "actor"));
 

Modified: 
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
URL: 
http://svn.apache.org/viewvc/axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java?rev=1611122&r1=1611121&r2=1611122&view=diff
==============================================================================
--- 
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
 (original)
+++ 
axis/axis2/java/rampart/trunk/modules/rampart-core/src/main/java/org/apache/rampart/util/RampartUtil.java
 Wed Jul 16 18:14:24 2014
@@ -1929,4 +1929,60 @@ public class RampartUtil {
         QName value = code.getValueAsQName();
         return value == null ? false : 
value.getNamespaceURI().equals(WSConstants.WSSE_NS);
     }
+    
+    /**
+     * @param rpd Rampart policy data instance. Must not be null.
+     * @return A collection of all {@link UsernameToken} supporting token 
assertions in the specified Rampart policy instance. The method will check the 
following lists:
+     * <ul>
+     *     <li>{@link RampartPolicyData#getSupportingTokensList()}</li>
+     *     <li>{@link RampartPolicyData#getSignedSupportingTokens()}</li>
+     *     <li>{@link 
RampartPolicyData#getSignedEndorsingSupportingTokens()}</li>
+     *     <li>{@link RampartPolicyData#getEndorsingSupportingTokens()}</li>
+     *     <li>{@link RampartPolicyData#getEncryptedSupportingTokens()}</li>
+     *     <li>{@link 
RampartPolicyData#getSignedEncryptedSupportingTokens()}</li>
+     *     <li>{@link 
RampartPolicyData#getEndorsingEncryptedSupportingTokens()}</li>
+     *     <li>{@link 
RampartPolicyData#getSignedEndorsingEncryptedSupportingTokens()}</li>
+     * </ul>
+     */
+    public static Collection<UsernameToken> 
getUsernameTokens(RampartPolicyData rpd) {
+        Collection<UsernameToken> usernameTokens = new 
ArrayList<UsernameToken>();
+        
+        List<SupportingToken> supportingToks = rpd.getSupportingTokensList();
+        for (SupportingToken suppTok : supportingToks) {
+            usernameTokens.addAll(getUsernameTokens(suppTok));
+        }
+        
+        
usernameTokens.addAll(getUsernameTokens(rpd.getSignedSupportingTokens()));
+        
usernameTokens.addAll(getUsernameTokens(rpd.getSignedEndorsingSupportingTokens()));
+        
usernameTokens.addAll(getUsernameTokens(rpd.getEndorsingSupportingTokens()));
+        
usernameTokens.addAll(getUsernameTokens(rpd.getEncryptedSupportingTokens()));
+        
usernameTokens.addAll(getUsernameTokens(rpd.getSignedEncryptedSupportingTokens()));
+        
usernameTokens.addAll(getUsernameTokens(rpd.getEndorsingEncryptedSupportingTokens()));
+        
usernameTokens.addAll(getUsernameTokens(rpd.getSignedEndorsingEncryptedSupportingTokens()));
+
+        return usernameTokens;
+    }
+    
+    /**
+     * @param suppTok The {@link SupportingToken} assertion to check for 
username tokens.
+     * @return A collection of all tokens in the specified 
<code>suppTok</code> SupportingToken assertion which are instances of {@link 
UsernameToken}.
+     * If the specified  <code>suppTok</code> SupportingToken assertion is 
<code>null</code>, an empty collection will be returned.
+     */
+    public static Collection<UsernameToken> getUsernameTokens(SupportingToken 
suppTok) {
+        
+        if (suppTok == null) {
+            return new ArrayList<UsernameToken>();
+        }
+        
+        Collection<UsernameToken> usernameTokens = new 
ArrayList<UsernameToken>();
+        ArrayList tokens = suppTok.getTokens();
+        for (Iterator iter = tokens.iterator(); iter.hasNext();) {
+            org.apache.ws.secpolicy.model.Token token = 
(org.apache.ws.secpolicy.model.Token) iter.next();
+            if (token instanceof UsernameToken) {
+                usernameTokens.add((UsernameToken)token);
+            }
+        }
+        
+        return usernameTokens;
+    }
 }

Modified: axis/axis2/java/rampart/trunk/modules/rampart-integration/pom.xml
URL: 
http://svn.apache.org/viewvc/axis/axis2/java/rampart/trunk/modules/rampart-integration/pom.xml?rev=1611122&r1=1611121&r2=1611122&view=diff
==============================================================================
--- axis/axis2/java/rampart/trunk/modules/rampart-integration/pom.xml (original)
+++ axis/axis2/java/rampart/trunk/modules/rampart-integration/pom.xml Wed Jul 
16 18:14:24 2014
@@ -284,6 +284,10 @@
                                 <!-- Service 34 -->
                                 <copy overwrite="yes" 
file="src/test/resources/rampart/services-34.xml" 
tofile="target/temp-ramp/META-INF/services.xml" />
                                 <jar 
jarfile="target/test-resources/rampart_service_repo/services/SecureService34.aar"
 basedir="target/temp-ramp" />
+                                
+                                <!-- Service 35 -->
+                                <copy overwrite="yes" 
file="src/test/resources/rampart/services-35.xml" 
tofile="target/temp-ramp/META-INF/services.xml" />
+                                <jar 
jarfile="target/test-resources/rampart_service_repo/services/SecureService35.aar"
 basedir="target/temp-ramp" />
 
 
                                 <!-- Service SC-1 -->

Modified: 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/java/org/apache/rampart/RampartTest.java
URL: 
http://svn.apache.org/viewvc/axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/java/org/apache/rampart/RampartTest.java?rev=1611122&r1=1611121&r2=1611122&view=diff
==============================================================================
--- 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/java/org/apache/rampart/RampartTest.java
 (original)
+++ 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/java/org/apache/rampart/RampartTest.java
 Wed Jul 16 18:14:24 2014
@@ -96,7 +96,7 @@ public class RampartTest extends TestCas
             }
 
             //for (int i = 34; i <= 34; i++) { //<-The number of tests we have
-            for (int i = 1; i <= 34; i++) { //<-The number of tests we have
+            for (int i = 1; i <= 35; i++) { //<-The number of tests we have
                 if(!basic256Supported && (i == 3 || i == 4 || i == 5)) {
                     //Skip the Basic256 tests
                     continue;

Added: 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/policy/35.xml
URL: 
http://svn.apache.org/viewvc/axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/policy/35.xml?rev=1611122&view=auto
==============================================================================
--- 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/policy/35.xml
 (added)
+++ 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/policy/35.xml
 Wed Jul 16 18:14:24 2014
@@ -0,0 +1,76 @@
+<wsp:Policy wsu:Id="EncrSupTokensUTNoPasswd"
+    
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
+    xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy";
+    xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing";
+    xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";>
+    <wsp:ExactlyOne>
+        <wsp:All>
+            <sp:SymmetricBinding>
+                <wsp:Policy>
+                    <sp:ProtectionToken>
+                        <wsp:Policy>
+                            <sp:X509Token 
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never";>
+                                <wsp:Policy>
+                                    <sp:RequireThumbprintReference />
+                                    <sp:WssX509V3Token10 />
+                                </wsp:Policy>
+                            </sp:X509Token>
+                        </wsp:Policy>
+                    </sp:ProtectionToken>
+                    <sp:AlgorithmSuite>
+                        <wsp:Policy>
+                            <sp:Basic128 />
+                        </wsp:Policy>
+                    </sp:AlgorithmSuite>
+                    <sp:Layout>
+                        <wsp:Policy>
+                            <sp:Lax />
+                        </wsp:Policy>
+                    </sp:Layout>
+                    <sp:OnlySignEntireHeadersAndBody />
+                </wsp:Policy>
+            </sp:SymmetricBinding>
+            <sp:EncryptedParts>
+                <sp:Body />
+            </sp:EncryptedParts>
+            <sp:SignedParts>
+                <sp:Body />
+            </sp:SignedParts>
+            <sp:EncryptedSupportingTokens>
+                <wsp:Policy>
+                    <sp:UsernameToken 
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient";>
+                        <wsp:Policy>
+                            <wsp:ExactlyOne>
+                                <wsp:All>
+                                    <sp:WssUsernameToken11 />
+                                    <sp:NoPassword />
+                                </wsp:All>
+                            </wsp:ExactlyOne>
+                        </wsp:Policy>
+                    </sp:UsernameToken>
+                </wsp:Policy>
+            </sp:EncryptedSupportingTokens>
+            
+            <ramp:RampartConfig 
xmlns:ramp="http://ws.apache.org/rampart/policy";>
+                <ramp:user>alice</ramp:user>
+                <ramp:encryptionUser>bob</ramp:encryptionUser>
+                
<ramp:passwordCallbackClass>org.apache.rampart.PWCallback</ramp:passwordCallbackClass>
+
+                <ramp:signatureCrypto>
+                    <ramp:crypto 
provider="org.apache.ws.security.components.crypto.Merlin">
+                        <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
+                        <ramp:property 
name="org.apache.ws.security.crypto.merlin.file">rampart/store.jks</ramp:property>
+                        <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.password">password</ramp:property>
+                    </ramp:crypto>
+                </ramp:signatureCrypto>
+                <ramp:encryptionCypto>
+                    <ramp:crypto 
provider="org.apache.ws.security.components.crypto.Merlin">
+                        <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
+                        <ramp:property 
name="org.apache.ws.security.crypto.merlin.file">rampart/store.jks</ramp:property>
+                        <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.password">password</ramp:property>
+                    </ramp:crypto>
+                </ramp:encryptionCypto>
+            </ramp:RampartConfig>
+        </wsp:All>
+    </wsp:ExactlyOne>
+</wsp:Policy>

Propchange: 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/policy/35.xml
------------------------------------------------------------------------------
    svn:eol-style = native

Added: 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/services-35.xml
URL: 
http://svn.apache.org/viewvc/axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/services-35.xml?rev=1611122&view=auto
==============================================================================
--- 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/services-35.xml
 (added)
+++ 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/services-35.xml
 Wed Jul 16 18:14:24 2014
@@ -0,0 +1,94 @@
+<service name="SecureService35">
+
+       <module ref="addressing"/>
+       <module ref="rampart"/>
+
+       <parameter locked="false" 
name="ServiceClass">org.apache.rampart.Service</parameter>
+
+       <operation name="echo">
+               <messageReceiver 
class="org.apache.axis2.receivers.RawXMLINOutMessageReceiver"/>
+               <actionMapping>urn:echo</actionMapping>
+       </operation>
+
+        <operation name="returnError">
+        <messageReceiver 
class="org.apache.axis2.receivers.RawXMLINOutMessageReceiver"/>
+        <actionMapping>urn:returnError</actionMapping>
+    </operation>
+
+    <wsp:Policy wsu:Id="EncrSupTokensUTNoPasswd"
+        
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
+        xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy";
+        xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing";
+        xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";>
+        <wsp:ExactlyOne>
+            <wsp:All>
+                <sp:SymmetricBinding>
+                    <wsp:Policy>
+                        <sp:ProtectionToken>
+                            <wsp:Policy>
+                                <sp:X509Token 
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never";>
+                                    <wsp:Policy>
+                                        <sp:RequireThumbprintReference />
+                                        <sp:WssX509V3Token10 />
+                                    </wsp:Policy>
+                                </sp:X509Token>
+                            </wsp:Policy>
+                        </sp:ProtectionToken>
+                        <sp:AlgorithmSuite>
+                            <wsp:Policy>
+                                <sp:Basic128 />
+                            </wsp:Policy>
+                        </sp:AlgorithmSuite>
+                        <sp:Layout>
+                            <wsp:Policy>
+                                <sp:Lax />
+                            </wsp:Policy>
+                        </sp:Layout>
+                        <sp:OnlySignEntireHeadersAndBody />
+                    </wsp:Policy>
+                </sp:SymmetricBinding>
+                <sp:EncryptedParts>
+                    <sp:Body />
+                </sp:EncryptedParts>
+                <sp:SignedParts>
+                    <sp:Body />
+                </sp:SignedParts>
+                <sp:EncryptedSupportingTokens>
+                    <wsp:Policy>
+                        <sp:UsernameToken 
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient";>
+                            <wsp:Policy>
+                                <wsp:ExactlyOne>
+                                    <wsp:All>
+                                        <sp:WssUsernameToken11 />
+                                        <sp:NoPassword />
+                                    </wsp:All>
+                                </wsp:ExactlyOne>
+                            </wsp:Policy>
+                        </sp:UsernameToken>
+                    </wsp:Policy>
+                </sp:EncryptedSupportingTokens>
+                
+                <ramp:RampartConfig 
xmlns:ramp="http://ws.apache.org/rampart/policy";>
+                    <ramp:user>bob</ramp:user>
+                    <ramp:encryptionUser>alice</ramp:encryptionUser>
+                    
<ramp:passwordCallbackClass>org.apache.rampart.PWCallback</ramp:passwordCallbackClass>
+
+                    <ramp:signatureCrypto>
+                        <ramp:crypto 
provider="org.apache.ws.security.components.crypto.Merlin">
+                            <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
+                            <ramp:property 
name="org.apache.ws.security.crypto.merlin.file">rampart/store.jks</ramp:property>
+                            <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.password">password</ramp:property>
+                        </ramp:crypto>
+                    </ramp:signatureCrypto>
+                    <ramp:encryptionCypto>
+                        <ramp:crypto 
provider="org.apache.ws.security.components.crypto.Merlin">
+                            <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
+                            <ramp:property 
name="org.apache.ws.security.crypto.merlin.file">rampart/store.jks</ramp:property>
+                            <ramp:property 
name="org.apache.ws.security.crypto.merlin.keystore.password">password</ramp:property>
+                        </ramp:crypto>
+                    </ramp:encryptionCypto>
+                </ramp:RampartConfig>
+            </wsp:All>
+        </wsp:ExactlyOne>
+    </wsp:Policy>
+</service>

Propchange: 
axis/axis2/java/rampart/trunk/modules/rampart-integration/src/test/resources/rampart/services-35.xml
------------------------------------------------------------------------------
    svn:eol-style = native


Reply via email to