Examples with STSException org.apache.cxf.ws.security.sts.provider.STSException used on opensource projects

Example 16 with STSException

use of org.apache.cxf.ws.security.sts.provider.STSException in project cxf by apache.

the class RequestParser method parseEntropy.

/**
 * Parse an Entropy object
 * @param entropyType an EntropyType object
 * @param stsProperties A STSPropertiesMBean object used to decrypt an EncryptedKey
 */
private static Entropy parseEntropy(EntropyType entropyType, STSPropertiesMBean stsProperties) throws STSException {
    for (Object entropyObject : entropyType.getAny()) {
        if (entropyObject instanceof JAXBElement<?>) {
            JAXBElement<?> entropyObjectJaxb = (JAXBElement<?>) entropyObject;
            if (QNameConstants.BINARY_SECRET.equals(entropyObjectJaxb.getName())) {
                BinarySecretType binarySecretType = (BinarySecretType) entropyObjectJaxb.getValue();
                LOG.fine("Found BinarySecret Entropy type");
                Entropy entropy = new Entropy();
                BinarySecret binarySecret = new BinarySecret();
                binarySecret.setBinarySecretType(binarySecretType.getType());
                binarySecret.setBinarySecretValue(binarySecretType.getValue());
                entropy.setBinarySecret(binarySecret);
                return entropy;
            } else if (LOG.isLoggable(Level.FINE)) {
                LOG.fine("Unsupported Entropy type: " + entropyObjectJaxb.getName());
            }
        } else if (entropyObject instanceof Element && "EncryptedKey".equals(((Element) entropyObject).getLocalName())) {
            EncryptedKeyProcessor processor = new EncryptedKeyProcessor();
            Element entropyElement = (Element) entropyObject;
            RequestData requestData = new RequestData();
            requestData.setDecCrypto(stsProperties.getSignatureCrypto());
            requestData.setCallbackHandler(stsProperties.getCallbackHandler());
            requestData.setWssConfig(WSSConfig.getNewInstance());
            requestData.setWsDocInfo(new WSDocInfo(entropyElement.getOwnerDocument()));
            try {
                List<WSSecurityEngineResult> results = processor.handleToken(entropyElement, requestData);
                Entropy entropy = new Entropy();
                entropy.setDecryptedKey((byte[]) results.get(0).get(WSSecurityEngineResult.TAG_SECRET));
                return entropy;
            } catch (WSSecurityException e) {
                LOG.log(Level.WARNING, "", e);
                throw new STSException(e.getMessage(), e, STSException.INVALID_REQUEST);
            }
        } else {
            LOG.log(Level.WARNING, "An unknown element was received");
            throw new STSException("An unknown element was received", STSException.BAD_REQUEST);
        }
    }
    return null;
}

Example 17 with STSException

use of org.apache.cxf.ws.security.sts.provider.STSException in project cxf by apache.

the class StaticSTSProperties method configureProperties.

/**
 * Load the CallbackHandler, Crypto objects, if necessary.
 */
public void configureProperties() throws STSException {
    if (signatureCrypto == null && getSignatureCryptoProperties() != null) {
        ResourceManager resourceManager = getResourceManager();
        Properties sigProperties = SecurityUtils.loadProperties(resourceManager, getSignatureCryptoProperties());
        if (sigProperties == null) {
            LOG.fine("Cannot load signature properties using: " + getSignatureCryptoProperties());
            throw new STSException("Configuration error: cannot load signature properties");
        }
        try {
            signatureCrypto = CryptoFactory.getInstance(sigProperties);
        } catch (WSSecurityException ex) {
            LOG.fine("Error in loading the signature Crypto object: " + ex.getMessage());
            throw new STSException(ex.getMessage());
        }
    }
    if (encryptionCrypto == null && getEncryptionCryptoProperties() != null) {
        ResourceManager resourceManager = getResourceManager();
        Properties encrProperties = SecurityUtils.loadProperties(resourceManager, getEncryptionCryptoProperties());
        if (encrProperties == null) {
            LOG.fine("Cannot load encryption properties using: " + getEncryptionCryptoProperties());
            throw new STSException("Configuration error: cannot load encryption properties");
        }
        try {
            encryptionCrypto = CryptoFactory.getInstance(encrProperties);
        } catch (WSSecurityException ex) {
            LOG.fine("Error in loading the encryption Crypto object: " + ex.getMessage());
            throw new STSException(ex.getMessage());
        }
    }
    if (callbackHandler == null && getCallbackHandlerClass() != null) {
        try {
            callbackHandler = SecurityUtils.getCallbackHandler(getCallbackHandlerClass());
            if (callbackHandler == null) {
                LOG.fine("Cannot load CallbackHandler using: " + getCallbackHandlerClass());
                throw new STSException("Configuration error: cannot load callback handler");
            }
        } catch (Exception ex) {
            LOG.fine("Error in loading the callback handler: " + ex.getMessage());
            throw new STSException(ex.getMessage());
        }
    }
    WSSConfig.init();
}

Example 18 with STSException

use of org.apache.cxf.ws.security.sts.provider.STSException in project cxf by apache.

the class IssueOnbehalfofUnitTest method testIssueSaml2TokenOnBehalfOfSaml1SymmetricHOK.

/**
 * Test to successfully issue a SAML 2 token on-behalf-of a SAML 1 Symmetric HOK token
 */
@org.junit.Test
public void testIssueSaml2TokenOnBehalfOfSaml1SymmetricHOK() throws Exception {
    TokenIssueOperation issueOperation = new TokenIssueOperation();
    // Add Token Provider
    issueOperation.setTokenProviders(Collections.singletonList(new SAMLTokenProvider()));
    // Add Token Validator
    issueOperation.setTokenValidators(Collections.singletonList(new SAMLTokenValidator()));
    // Add Service
    ServiceMBean service = new StaticService();
    service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
    issueOperation.setServices(Collections.singletonList(service));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    issueOperation.setStsProperties(stsProperties);
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
    request.getAny().add(tokenType);
    // Get a SAML Token via the SAMLTokenProvider
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, null, STSConstants.SYMMETRIC_KEY_TYPE);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    OnBehalfOfType onbehalfof = new OnBehalfOfType();
    onbehalfof.setAny(samlToken);
    JAXBElement<OnBehalfOfType> onbehalfofType = new JAXBElement<OnBehalfOfType>(QNameConstants.ON_BEHALF_OF, OnBehalfOfType.class, onbehalfof);
    request.getAny().add(onbehalfofType);
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    // This should fail as the default DelegationHandler does not allow HolderOfKey
    try {
        issueOperation.issue(request, null, msgCtx);
        fail("Failure expected as HolderOfKey is not allowed by default");
    } catch (STSException ex) {
    // expected
    }
    TokenDelegationHandler delegationHandler = new HOKDelegationHandler();
    issueOperation.setDelegationHandlers(Collections.singletonList(delegationHandler));
    RequestSecurityTokenResponseCollectionType response = issueOperation.issue(request, null, msgCtx);
    List<RequestSecurityTokenResponseType> securityTokenResponse = response.getRequestSecurityTokenResponse();
    assertFalse(securityTokenResponse.isEmpty());
}

Example 19 with STSException

use of org.apache.cxf.ws.security.sts.provider.STSException in project cxf by apache.

the class IssueOnbehalfofUnitTest method testSaml2AudienceRestriction.

/**
 * Test to unsuccessfully issue a SAML 2 token on-behalf-of a SAML 2 token. The
 * problem is that the Audience Restriction URLs in the original token do not
 * match the AppliesTo address.
 */
@org.junit.Test
public void testSaml2AudienceRestriction() throws Exception {
    TokenIssueOperation issueOperation = new TokenIssueOperation();
    // Add Token Provider
    issueOperation.setTokenProviders(Collections.singletonList(new SAMLTokenProvider()));
    // Add Token Validator
    issueOperation.setTokenValidators(Collections.singletonList(new SAMLTokenValidator()));
    // Add Service
    ServiceMBean service = new StaticService();
    service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
    issueOperation.setServices(Collections.singletonList(service));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    issueOperation.setStsProperties(stsProperties);
    TokenDelegationHandler delegationHandler = new SAMLDelegationHandler();
    issueOperation.setDelegationHandlers(Collections.singletonList(delegationHandler));
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
    request.getAny().add(tokenType);
    // Get a SAML Token via the SAMLTokenProvider
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", callbackHandler);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    OnBehalfOfType onbehalfof = new OnBehalfOfType();
    onbehalfof.setAny(samlToken);
    JAXBElement<OnBehalfOfType> onbehalfofType = new JAXBElement<OnBehalfOfType>(QNameConstants.ON_BEHALF_OF, OnBehalfOfType.class, onbehalfof);
    request.getAny().add(onbehalfofType);
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    // Issue a token - this should work
    issueOperation.issue(request, null, msgCtx);
    request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy2"));
    // This should fail
    try {
        issueOperation.issue(request, null, msgCtx);
        fail("Failure expected due to AudienceRestriction");
    } catch (STSException ex) {
    // expected
    }
}

Example 20 with STSException

use of org.apache.cxf.ws.security.sts.provider.STSException in project cxf by apache.

the class IssueOnbehalfofUnitTest method testIssueSaml2TokenOnBehalfOfSaml2PublicKeyHOK.

/**
 * Test to successfully issue a SAML 2 token on-behalf-of a SAML 2 PublicKey HOK token
 */
@org.junit.Test
public void testIssueSaml2TokenOnBehalfOfSaml2PublicKeyHOK() throws Exception {
    TokenIssueOperation issueOperation = new TokenIssueOperation();
    // Add Token Provider
    issueOperation.setTokenProviders(Collections.singletonList(new SAMLTokenProvider()));
    // Add Token Validator
    issueOperation.setTokenValidators(Collections.singletonList(new SAMLTokenValidator()));
    // Add Service
    ServiceMBean service = new StaticService();
    service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
    issueOperation.setServices(Collections.singletonList(service));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    issueOperation.setStsProperties(stsProperties);
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
    request.getAny().add(tokenType);
    // Get a SAML Token via the SAMLTokenProvider
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", callbackHandler, null, STSConstants.PUBLIC_KEY_KEYTYPE);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    OnBehalfOfType onbehalfof = new OnBehalfOfType();
    onbehalfof.setAny(samlToken);
    JAXBElement<OnBehalfOfType> onbehalfofType = new JAXBElement<OnBehalfOfType>(QNameConstants.ON_BEHALF_OF, OnBehalfOfType.class, onbehalfof);
    request.getAny().add(onbehalfofType);
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    // This should fail as the default DelegationHandler does not allow HolderOfKey
    try {
        issueOperation.issue(request, null, msgCtx);
        fail("Failure expected as HolderOfKey is not allowed by default");
    } catch (STSException ex) {
    // expected
    }
    TokenDelegationHandler delegationHandler = new HOKDelegationHandler();
    issueOperation.setDelegationHandlers(Collections.singletonList(delegationHandler));
    RequestSecurityTokenResponseCollectionType response = issueOperation.issue(request, null, msgCtx);
    List<RequestSecurityTokenResponseType> securityTokenResponse = response.getRequestSecurityTokenResponse();
    assertFalse(securityTokenResponse.isEmpty());
}