Esempio n. 1
0
  static final TokenStore getTokenStore(Message message) {
    if (message == null) {
      return null;
    }

    return TokenStoreUtils.getTokenStore(message);
  }
Esempio n. 2
0
  public void handleBinding() {
    AssertionInfoMap aim = getMessage().get(AssertionInfoMap.class);
    configureTimestamp(aim);
    assertPolicy(sbinding.getName());

    String asymSignatureAlgorithm =
        (String)
            getMessage().getContextualProperty(SecurityConstants.ASYMMETRIC_SIGNATURE_ALGORITHM);
    if (asymSignatureAlgorithm != null && sbinding.getAlgorithmSuite() != null) {
      sbinding.getAlgorithmSuite().setAsymmetricSignature(asymSignatureAlgorithm);
    }
    String symSignatureAlgorithm =
        (String)
            getMessage().getContextualProperty(SecurityConstants.SYMMETRIC_SIGNATURE_ALGORITHM);
    if (symSignatureAlgorithm != null && sbinding.getAlgorithmSuite() != null) {
      sbinding.getAlgorithmSuite().setSymmetricSignature(symSignatureAlgorithm);
    }

    // Set up CallbackHandler which wraps the configured Handler
    WSSSecurityProperties properties = getProperties();
    TokenStoreCallbackHandler callbackHandler =
        new TokenStoreCallbackHandler(
            properties.getCallbackHandler(), TokenStoreUtils.getTokenStore(message));
    properties.setCallbackHandler(callbackHandler);

    if (sbinding.getProtectionOrder()
        == AbstractSymmetricAsymmetricBinding.ProtectionOrder.EncryptBeforeSigning) {
      doEncryptBeforeSign();
      assertPolicy(
          new QName(sbinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_BEFORE_SIGNING));
    } else {
      doSignBeforeEncrypt();
      assertPolicy(
          new QName(sbinding.getName().getNamespaceURI(), SPConstants.SIGN_BEFORE_ENCRYPTING));
    }

    if (!isRequestor()) {
      properties.setEncryptSymmetricEncryptionKey(false);
    }

    configureLayout(aim);
    assertAlgorithmSuite(sbinding.getAlgorithmSuite());
    assertWSSProperties(sbinding.getName().getNamespaceURI());
    assertTrustProperties(sbinding.getName().getNamespaceURI());
    assertPolicy(
        new QName(
            sbinding.getName().getNamespaceURI(), SPConstants.ONLY_SIGN_ENTIRE_HEADERS_AND_BODY));
    if (sbinding.isProtectTokens()) {
      assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.PROTECT_TOKENS));
    }
  }
Esempio n. 3
0
  private String setupEncryptedKey(AbstractTokenWrapper wrapper, AbstractToken sigToken)
      throws WSSecurityException {

    Date created = new Date();
    Date expires = new Date();
    expires.setTime(created.getTime() + 300000L);
    SecurityToken tempTok = new SecurityToken(IDGenerator.generateID(null), created, expires);

    KeyGenerator keyGenerator =
        KeyUtils.getKeyGenerator(
            sbinding.getAlgorithmSuite().getAlgorithmSuiteType().getEncryption());
    SecretKey symmetricKey = keyGenerator.generateKey();
    tempTok.setKey(symmetricKey);
    tempTok.setSecret(symmetricKey.getEncoded());

    TokenStoreUtils.getTokenStore(message).add(tempTok);

    return tempTok.getId();
  }
Esempio n. 4
0
  private void doSignBeforeEncrypt() {
    AbstractTokenWrapper sigAbstractTokenWrapper = getSignatureToken();
    assertTokenWrapper(sigAbstractTokenWrapper);
    AbstractToken sigToken = sigAbstractTokenWrapper.getToken();
    String sigTokId = null;

    try {
      SecurityToken sigTok = null;
      if (sigToken != null) {
        if (sigToken instanceof KerberosToken) {
          sigTok = getSecurityToken();
          if (isRequestor()) {
            addKerberosToken((KerberosToken) sigToken, false, true, true);
          }
        } else if (sigToken instanceof IssuedToken) {
          sigTok = getSecurityToken();
          addIssuedToken((IssuedToken) sigToken, sigTok, false, true);

          if (sigTok == null && !isRequestor()) {
            org.apache.xml.security.stax.securityToken.SecurityToken securityToken =
                findInboundSecurityToken(WSSecurityEventConstants.SAML_TOKEN);
            sigTokId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
          }
        } else if (sigToken instanceof SecureConversationToken
            || sigToken instanceof SecurityContextToken
            || sigToken instanceof SpnegoContextToken) {
          sigTok = getSecurityToken();
          if (sigTok != null && isRequestor()) {
            WSSSecurityProperties properties = getProperties();
            WSSConstants.Action actionToPerform = WSSConstants.CUSTOM_TOKEN;
            properties.addAction(actionToPerform);
          } else if (sigTok == null && !isRequestor()) {
            org.apache.xml.security.stax.securityToken.SecurityToken securityToken =
                findInboundSecurityToken(WSSecurityEventConstants.SECURITY_CONTEXT_TOKEN);
            sigTokId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
          }
        } else if (sigToken instanceof X509Token) {
          if (isRequestor()) {
            sigTokId = setupEncryptedKey(sigAbstractTokenWrapper, sigToken);
          } else {
            org.apache.xml.security.stax.securityToken.SecurityToken securityToken =
                findEncryptedKeyToken();
            sigTokId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
          }
        } else if (sigToken instanceof UsernameToken) {
          unassertPolicy(sbinding, "UsernameTokens not supported with Symmetric binding");
          return;
        }
        assertToken(sigToken);
      } else {
        unassertPolicy(sbinding, "No signature token");
        return;
      }

      if (sigTok == null && StringUtils.isEmpty(sigTokId)) {
        unassertPolicy(sigAbstractTokenWrapper, "No signature token id");
        return;
      }
      if (sigTok == null) {
        sigTok = TokenStoreUtils.getTokenStore(message).getToken(sigTokId);
      }

      // Store key
      if (!(MessageUtils.isRequestor(message) && sigToken instanceof KerberosToken)) {
        storeSecurityToken(sigToken, sigTok);
      }

      // Add timestamp
      List<SecurePart> sigs = new ArrayList<>();
      if (timestampAdded) {
        SecurePart part =
            new SecurePart(new QName(WSSConstants.NS_WSU10, "Timestamp"), Modifier.Element);
        sigs.add(part);
      }
      sigs.addAll(this.getSignedParts());

      if (!isRequestor()) {
        addSignatureConfirmation(sigs);
      }

      if (!sigs.isEmpty()) {
        doSignature(sigAbstractTokenWrapper, sigToken, sigTok, sigs);
      }

      addSupportingTokens();
      removeSignatureIfSignedSAML();
      prependSignatureToSC();

      // Encryption
      List<SecurePart> enc = getEncryptedParts();

      // Check for signature protection
      if (sbinding.isEncryptSignature()) {
        SecurePart part =
            new SecurePart(new QName(WSSConstants.NS_DSIG, "Signature"), Modifier.Element);
        enc.add(part);
        if (signatureConfirmationAdded) {
          part = new SecurePart(WSSConstants.TAG_WSSE11_SIG_CONF, Modifier.Element);
          enc.add(part);
        }
        assertPolicy(
            new QName(sbinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_SIGNATURE));
      }

      // Do encryption
      if (isRequestor()) {
        enc.addAll(encryptedTokensList);
      }
      AbstractTokenWrapper encrAbstractTokenWrapper = getEncryptionToken();
      doEncryption(encrAbstractTokenWrapper, enc, false);

      putCustomTokenAfterSignature();
    } catch (Exception e) {
      throw new Fault(e);
    }
  }
Esempio n. 5
0
  private void doEncryptBeforeSign() {
    try {
      AbstractTokenWrapper encryptionWrapper = getEncryptionToken();
      assertTokenWrapper(encryptionWrapper);
      AbstractToken encryptionToken = encryptionWrapper.getToken();

      String tokenId = null;
      SecurityToken tok = null;
      if (encryptionToken instanceof KerberosToken) {
        tok = getSecurityToken();
        if (MessageUtils.isRequestor(message)) {
          addKerberosToken((KerberosToken) encryptionToken, false, true, true);
        }
      } else if (encryptionToken instanceof IssuedToken) {
        tok = getSecurityToken();
        addIssuedToken((IssuedToken) encryptionToken, tok, false, true);

        if (tok == null && !isRequestor()) {
          org.apache.xml.security.stax.securityToken.SecurityToken securityToken =
              findInboundSecurityToken(WSSecurityEventConstants.SAML_TOKEN);
          tokenId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
        }
      } else if (encryptionToken instanceof SecureConversationToken
          || encryptionToken instanceof SecurityContextToken
          || encryptionToken instanceof SpnegoContextToken) {
        tok = getSecurityToken();
        if (tok != null && isRequestor()) {
          WSSSecurityProperties properties = getProperties();
          WSSConstants.Action actionToPerform = WSSConstants.CUSTOM_TOKEN;
          properties.addAction(actionToPerform);
        } else if (tok == null && !isRequestor()) {
          org.apache.xml.security.stax.securityToken.SecurityToken securityToken =
              findInboundSecurityToken(WSSecurityEventConstants.SECURITY_CONTEXT_TOKEN);
          tokenId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
        }
      } else if (encryptionToken instanceof X509Token) {
        if (isRequestor()) {
          tokenId = setupEncryptedKey(encryptionWrapper, encryptionToken);
        } else {
          org.apache.xml.security.stax.securityToken.SecurityToken securityToken =
              findEncryptedKeyToken();
          tokenId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
        }
      } else if (encryptionToken instanceof UsernameToken) {
        unassertPolicy(sbinding, "UsernameTokens not supported with Symmetric binding");
        return;
      }
      assertToken(encryptionToken);
      if (tok == null) {
        tokenId = XMLUtils.getIDFromReference(tokenId);

        // Get hold of the token from the token storage
        tok = TokenStoreUtils.getTokenStore(message).getToken(tokenId);
      }

      // Store key
      if (!(MessageUtils.isRequestor(message) && encryptionToken instanceof KerberosToken)) {
        storeSecurityToken(encryptionToken, tok);
      }

      List<SecurePart> encrParts = null;
      List<SecurePart> sigParts = null;
      try {
        encrParts = getEncryptedParts();
        // Signed parts are determined before encryption because encrypted signed headers
        // will not be included otherwise
        sigParts = getSignedParts();
      } catch (SOAPException ex) {
        throw new Fault(ex);
      }

      addSupportingTokens();

      if (encryptionToken != null && encrParts.size() > 0) {
        if (isRequestor()) {
          encrParts.addAll(encryptedTokensList);
        }

        // Check for signature protection
        if (sbinding.isEncryptSignature()) {
          SecurePart part =
              new SecurePart(new QName(WSSConstants.NS_DSIG, "Signature"), Modifier.Element);
          encrParts.add(part);
          if (signatureConfirmationAdded) {
            part = new SecurePart(WSSConstants.TAG_WSSE11_SIG_CONF, Modifier.Element);
            encrParts.add(part);
          }
          assertPolicy(
              new QName(sbinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_SIGNATURE));
        }

        doEncryption(encryptionWrapper, encrParts, true);
      }

      if (timestampAdded) {
        SecurePart part =
            new SecurePart(new QName(WSSConstants.NS_WSU10, "Timestamp"), Modifier.Element);
        sigParts.add(part);
      }
      sigParts.addAll(this.getSignedParts());

      if (sigParts.size() > 0) {
        AbstractTokenWrapper sigAbstractTokenWrapper = getSignatureToken();
        if (sigAbstractTokenWrapper != null) {
          AbstractToken sigToken = sigAbstractTokenWrapper.getToken();
          if (isRequestor()) {
            doSignature(sigAbstractTokenWrapper, sigToken, tok, sigParts);
          } else {
            addSignatureConfirmation(sigParts);
            doSignature(sigAbstractTokenWrapper, sigToken, tok, sigParts);
          }
        }
      }

      removeSignatureIfSignedSAML();
      enforceEncryptBeforeSigningWithSignedSAML();
      prependSignatureToSC();
      putCustomTokenAfterSignature();
    } catch (RuntimeException ex) {
      throw ex;
    } catch (Exception ex) {
      throw new Fault(ex);
    }
  }