use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerTest method renewNotAllowedOfValidSAML1Assertion.
/**
* Renew a valid SAML1 Assertion. However, the issuer does not allow renewal
*/
@org.junit.Test
public void renewNotAllowedOfValidSAML1Assertion() throws Exception {
// Create the Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, false, false);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
// Validate the Assertion
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
assertTrue(samlTokenValidator.canHandleToken(validateTarget));
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
try {
samlTokenRenewer.renewToken(renewerParameters);
fail("Failure expected on attempting to renew a token that was not allowed to be renewed");
} catch (Exception ex) {
// expected
}
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerTest method renewValidSAML1Assertion.
/**
* Renew a valid SAML1 Assertion
*/
@org.junit.Test
public void renewValidSAML1Assertion() throws Exception {
// Create the Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, true, false);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
// Validate the Assertion
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
assertTrue(samlTokenValidator.canHandleToken(validateTarget));
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
String oldId = new SamlAssertionWrapper(samlToken).getId();
String newId = new SamlAssertionWrapper(renewerResponse.getToken()).getId();
assertFalse(oldId.equals(newId));
// Now validate it again
validateTarget = new ReceivedToken(renewerResponse.getToken());
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
// Now try to renew it again!
renewerParameters.setToken(validatorResponse.getToken());
samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerTest method renewExpiredSAML1Assertion.
/**
* Renew an expired SAML1 Assertion
*/
@org.junit.Test
public void renewExpiredSAML1Assertion() throws Exception {
// Create the Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50, true, true);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
// Sleep to expire the token
Thread.sleep(100);
// Validate the Assertion
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
assertTrue(samlTokenValidator.canHandleToken(validateTarget));
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
try {
samlTokenRenewer.renewToken(renewerParameters);
fail("Failure expected on an expired token, which is not allowed by default");
} catch (Exception ex) {
// expected
}
samlTokenRenewer.setAllowRenewalAfterExpiry(true);
TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
assertTrue(renewerResponse != null);
assertTrue(renewerResponse.getToken() != null);
String oldId = new SamlAssertionWrapper(samlToken).getId();
String newId = new SamlAssertionWrapper(renewerResponse.getToken()).getId();
assertFalse(oldId.equals(newId));
// Now validate it again
validateTarget = new ReceivedToken(renewerResponse.getToken());
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenRenewerTest method renewTooFarExpiredSAML2Assertion.
/**
* Renew an expired SAML2 Assertion that has expired greater than the maximum allowable time
* for renewal.
*/
@org.junit.Test
public void renewTooFarExpiredSAML2Assertion() throws Exception {
// Create the Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50, true, true);
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
// Sleep to expire the token
Thread.sleep(1500);
// Validate the Assertion
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
assertTrue(samlTokenValidator.canHandleToken(validateTarget));
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
// Renew the Assertion
TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
renewerParameters.setStsProperties(validatorParameters.getStsProperties());
renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
renewerParameters.setMessageContext(validatorParameters.getMessageContext());
renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
renewerParameters.setTokenStore(validatorParameters.getTokenStore());
renewerParameters.setToken(validatorResponse.getToken());
TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
samlTokenRenewer.setVerifyProofOfPossession(false);
samlTokenRenewer.setAllowRenewalAfterExpiry(true);
((SAMLTokenRenewer) samlTokenRenewer).setMaxExpiry(1L);
assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
try {
samlTokenRenewer.renewToken(renewerParameters);
fail("Failure expected as the token expired too long ago");
} catch (STSException ex) {
// Expected
}
}
use of javax.security.auth.callback.CallbackHandler in project cxf by apache.
the class SAMLTokenValidatorRealmTest method testRealmB.
/**
* Test a SAML 1.1 Assertion created in realm "B".
*/
@org.junit.Test
public void testRealmB() throws Exception {
TokenValidator samlTokenValidator = new SAMLTokenValidator();
TokenValidatorParameters validatorParameters = createValidatorParameters();
TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
// Create a ValidateTarget consisting of a SAML Assertion
Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
CallbackHandler callbackHandler = new PasswordCallbackHandler();
Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, "B");
Document doc = samlToken.getOwnerDocument();
samlToken = (Element) doc.appendChild(samlToken);
ReceivedToken validateTarget = new ReceivedToken(samlToken);
tokenRequirements.setValidateTarget(validateTarget);
validatorParameters.setToken(validateTarget);
// Validate the token - no realm is returned
TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
assertNull(validatorResponse.getTokenRealm());
// Now set the SAMLRealmCodec implementation on the Validator
SAMLRealmCodec samlRealmCodec = new IssuerSAMLRealmCodec();
((SAMLTokenValidator) samlTokenValidator).setSamlRealmCodec(samlRealmCodec);
validatorResponse = samlTokenValidator.validateToken(validatorParameters);
assertTrue(validatorResponse != null);
assertTrue(validatorResponse.getToken() != null);
assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
assertTrue(validatorResponse.getTokenRealm().equals("B"));
Principal principal = validatorResponse.getPrincipal();
assertTrue(principal != null && principal.getName() != null);
}
Aggregations