use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerLifetimeTest method testSaml2ExceededConfiguredMaxLifetimeButUpdated.
/**
* Renew SAML 2 token with a with a lifetime
* which exceeds configured maximum lifetime
* Lifetime reduced to maximum lifetime
*/
@org.junit.Test
public void testSaml2ExceededConfiguredMaxLifetimeButUpdated() throws Exception {
// 30 minutes
long maxLifetime = 30 * 60L;
SAMLTokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
samlTokenRenewer.setAllowRenewalAfterExpiry(true);
DefaultConditionsProvider conditionsProvider = new DefaultConditionsProvider();
conditionsProvider.setMaxLifetime(maxLifetime);
conditionsProvider.setFailLifetimeExceedance(false);
conditionsProvider.setAcceptClientLifetime(true);
samlTokenRenewer.setConditionsProvider(conditionsProvider);
TokenRenewerParameters renewerParameters = createRenewerParameters();
// Set expected lifetime to 35 minutes
Instant creationTime = Instant.now();
long requestedLifetime = 35 * 60L;
Instant expirationTime = creationTime.plusSeconds(requestedLifetime);
Lifetime lifetime = new Lifetime();
lifetime.setCreated(creationTime.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
lifetime.setExpires(expirationTime.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
renewerParameters.getTokenRequirements().setLifetime(lifetime);
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
// Create token.
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50, true, true);
// Sleep to expire the token
Thread.sleep(100);
ReceivedToken renewTarget = new ReceivedToken(samlToken);
renewTarget.setState(STATE.VALID);
renewerParameters.getTokenRequirements().setRenewTarget(renewTarget);
renewerParameters.setToken(renewTarget);
assertTrue(samlTokenRenewer.canHandleToken(renewTarget));
TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
long duration = Duration.between(renewerResponse.getCreated(), renewerResponse.getExpires()).getSeconds();
assertEquals(maxLifetime, duration);
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerPOPTest method renewValidSAML1Assertion.
/**
* Renew a valid SAML1 Assertion
*/
@org.junit.Test
public void renewValidSAML1Assertion() throws Exception {
// Create the Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, true, false);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
// Validate the Assertion
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
assertTrue(samlTokenValidator.canHandleToken(validateTarget));
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
try {
samlTokenRenewer.renewToken(renewerParameters);
fail("Expected failure on lack of proof of possession");
} catch (Exception ex) {
// expected
}
List<WSSecurityEngineResult> signedResults = new ArrayList<>();
WSSecurityEngineResult signedResult = new WSSecurityEngineResult(WSConstants.SIGN);
CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
cryptoType.setAlias("myclientkey");
signedResult.put(WSSecurityEngineResult.TAG_X509_CERTIFICATES, crypto.getX509Certificates(cryptoType));
signedResults.add(signedResult);
List<WSHandlerResult> handlerResults = new ArrayList<>();
WSHandlerResult handlerResult = new WSHandlerResult(null, signedResults, Collections.singletonMap(WSConstants.SIGN, signedResults));
handlerResults.add(handlerResult);
Map<String, Object> messageContext = validatorParameters.getMessageContext();
messageContext.put(WSHandlerConstants.RECV_RESULTS, handlerResults);
// Now successfully renew the token
TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerRealmTest method testRealmB.
/**
* Test a SAML 1.1 Assertion created in realm "B".
*/
@org.junit.Test
public void testRealmB() throws Exception {
// Create a RenewTarget consisting of a SAML Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
TokenProviderParameters providerParameters = createProviderParameters(WSS4JConstants.WSS_SAML_TOKEN_TYPE, STSConstants.BEARER_KEY_KEYTYPE, crypto, "mystskey", callbackHandler);
Element samlToken = createSAMLAssertion(providerParameters, "B", 50, true, true);
// Sleep to expire the token
Thread.sleep(100);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
TokenValidator samlTokenValidator = new SAMLTokenValidator();
SAMLRealmCodec samlRealmCodec = new IssuerSAMLRealmCodec();
((SAMLTokenValidator) samlTokenValidator).setSamlRealmCodec(samlRealmCodec);
TokenValidatorParameters validatorParameters = createValidatorParameters();
ReceivedToken renewTarget = new ReceivedToken(samlToken);
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
tokenRequirements.setValidateTarget(renewTarget);
validatorParameters.setToken(renewTarget);
// Validate the token
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
assertTrue(validatorResponse.getTokenRealm().equals("B"));
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
samlTokenRenewer.setAllowRenewalAfterExpiry(true);
Map<String, RealmProperties> samlRealms = getSamlRealms();
((SAMLTokenRenewer) samlTokenRenewer).setRealmMap(samlRealms);
String realm = validatorResponse.getTokenRealm();
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken(), realm));
TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
// Now validate it again
ReceivedToken validateTarget = new ReceivedToken(renewerResponse.getToken());
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerRealmTest method testRealmA.
/**
* Test a SAML 1.1 Assertion created in realm "A".
*/
@org.junit.Test
public void testRealmA() throws Exception {
// Create a RenewTarget consisting of a SAML Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
TokenProviderParameters providerParameters = createProviderParameters(WSS4JConstants.WSS_SAML_TOKEN_TYPE, STSConstants.BEARER_KEY_KEYTYPE, crypto, "mystskey", callbackHandler);
Element samlToken = createSAMLAssertion(providerParameters, "A", 50, true, true);
// Sleep to expire the token
Thread.sleep(100);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
TokenValidator samlTokenValidator = new SAMLTokenValidator();
SAMLRealmCodec samlRealmCodec = new IssuerSAMLRealmCodec();
((SAMLTokenValidator) samlTokenValidator).setSamlRealmCodec(samlRealmCodec);
TokenValidatorParameters validatorParameters = createValidatorParameters();
ReceivedToken renewTarget = new ReceivedToken(samlToken);
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
tokenRequirements.setValidateTarget(renewTarget);
validatorParameters.setToken(renewTarget);
// Validate the token
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
assertTrue(validatorResponse.getTokenRealm().equals("A"));
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
samlTokenRenewer.setAllowRenewalAfterExpiry(true);
Map<String, RealmProperties> samlRealms = getSamlRealms();
((SAMLTokenRenewer) samlTokenRenewer).setRealmMap(samlRealms);
String realm = validatorResponse.getTokenRealm();
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken(), realm));
TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
// Now validate it again
ReceivedToken validateTarget = new ReceivedToken(renewerResponse.getToken());
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerTest method renewExpiredNotAllowedSAML2Assertion.
/**
* Renew an expired SAML2 Assertion. However the issuer does not allow the renewal of expired
* tokens.
*/
@org.junit.Test
public void renewExpiredNotAllowedSAML2Assertion() throws Exception {
// Create the Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50, true, false);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
// Sleep to expire the token
Thread.sleep(100);
// Validate the Assertion
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
assertTrue(samlTokenValidator.canHandleToken(validateTarget));
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
samlTokenRenewer.setAllowRenewalAfterExpiry(true);
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
try {
samlTokenRenewer.renewToken(renewerParameters);
fail("Failure on attempting to renew an expired token, which is not allowed");
} catch (Exception ex) {
// expected
}
}
Aggregations