Examples with Fault org.apache.cxf.interceptor.Fault used on opensource projects

Example 71 with Fault

use of org.apache.cxf.interceptor.Fault in project cxf by apache.

the class AbstractSTSClient method createSecurityToken.

protected SecurityToken createSecurityToken(Element el, byte[] requestorEntropy) throws WSSecurityException, Base64DecodingException {
    if ("RequestSecurityTokenResponseCollection".equals(el.getLocalName())) {
        el = DOMUtils.getFirstElement(el);
    }
    if (!"RequestSecurityTokenResponse".equals(el.getLocalName())) {
        throw new Fault("Unexpected element " + el.getLocalName(), LOG);
    }
    el = DOMUtils.getFirstElement(el);
    Element rst = null;
    Element rar = null;
    Element rur = null;
    Element rpt = null;
    Element lte = null;
    Element entropy = null;
    String tt = null;
    String retKeySize = null;
    while (el != null) {
        String ln = el.getLocalName();
        if (namespace.equals(el.getNamespaceURI())) {
            if ("Lifetime".equals(ln)) {
                lte = el;
            } else if ("RequestedSecurityToken".equals(ln)) {
                rst = DOMUtils.getFirstElement(el);
            } else if ("RequestedAttachedReference".equals(ln)) {
                rar = DOMUtils.getFirstElement(el);
            } else if ("RequestedUnattachedReference".equals(ln)) {
                rur = DOMUtils.getFirstElement(el);
            } else if ("RequestedProofToken".equals(ln)) {
                rpt = el;
            } else if ("Entropy".equals(ln)) {
                entropy = el;
            } else if ("TokenType".equals(ln)) {
                tt = DOMUtils.getContent(el);
            } else if ("KeySize".equals(ln)) {
                retKeySize = DOMUtils.getContent(el);
            }
        }
        el = DOMUtils.getNextElement(el);
    }
    Element rstDec = rst;
    String id = findID(rar, rur, rstDec);
    if (StringUtils.isEmpty(id)) {
        LOG.fine("No ID extracted from token, so just making one up");
        id = WSSConfig.getNewInstance().getIdAllocator().createSecureId("_", null);
    }
    SecurityToken token = new SecurityToken(id, rstDec, lte);
    token.setAttachedReference(rar);
    token.setUnattachedReference(rur);
    token.setIssuerAddress(location);
    token.setTokenType(tt);
    byte[] secret = null;
    if (rpt != null) {
        Element child = DOMUtils.getFirstElement(rpt);
        QName childQname = DOMUtils.getElementQName(child);
        if (childQname.equals(new QName(namespace, "BinarySecret"))) {
            // First check for the binary secret
            String b64Secret = DOMUtils.getContent(child);
            secret = org.apache.xml.security.utils.XMLUtils.decode(b64Secret);
        } else if (childQname.equals(new QName(WSS4JConstants.ENC_NS, WSS4JConstants.ENC_KEY_LN))) {
            secret = decryptKey(child);
        } else if (childQname.equals(new QName(namespace, "ComputedKey"))) {
            // Handle the computed key
            Element computedKeyChild = entropy == null ? null : DOMUtils.getFirstElement(entropy);
            byte[] serviceEntr = null;
            if (computedKeyChild != null) {
                QName computedKeyChildQName = DOMUtils.getElementQName(computedKeyChild);
                if (computedKeyChildQName.equals(new QName(WSS4JConstants.ENC_NS, WSS4JConstants.ENC_KEY_LN))) {
                    serviceEntr = decryptKey(computedKeyChild);
                } else if (computedKeyChildQName.equals(new QName(namespace, "BinarySecret"))) {
                    String content = DOMUtils.getContent(computedKeyChild);
                    serviceEntr = org.apache.xml.security.utils.XMLUtils.decode(content);
                }
            }
            if (serviceEntr != null) {
                // Right now we only use PSHA1 as the computed key algo
                P_SHA1 psha1 = new P_SHA1();
                int length = 0;
                if (retKeySize != null) {
                    try {
                        length = Integer.parseInt(retKeySize);
                    } catch (NumberFormatException ex) {
                    // do nothing
                    }
                } else {
                    length = keySize;
                }
                if (length <= 0) {
                    length = 256;
                }
                try {
                    secret = psha1.createKey(requestorEntropy, serviceEntr, 0, length / 8);
                } catch (WSSecurityException e) {
                    throw new TrustException("DERIVED_KEY_ERROR", e, LOG);
                }
            } else {
                // Service entropy missing
                throw new TrustException("NO_ENTROPY", LOG);
            }
        }
    } else if (requestorEntropy != null) {
        // Use requester entropy as the key
        secret = requestorEntropy;
    }
    token.setSecret(secret);
    return token;
}

Example 72 with Fault

use of org.apache.cxf.interceptor.Fault in project cxf by apache.

the class STSTokenRetriever method getToken.

public static SecurityToken getToken(Message message, TokenRequestParams params, STSTokenCacher tokenCacher) {
    Object o = SecurityUtils.getSecurityPropertyValue(SecurityConstants.STS_APPLIES_TO, message);
    String appliesTo = o == null ? null : o.toString();
    if (appliesTo == null) {
        String endpointAddress = message.getContextualProperty(Message.ENDPOINT_ADDRESS).toString();
        // Strip out any query parameters if they exist
        int query = endpointAddress.indexOf('?');
        if (query > 0) {
            endpointAddress = endpointAddress.substring(0, query);
        }
        appliesTo = endpointAddress;
    }
    STSClient client = STSUtils.getClientWithIssuer(message, "sts", params.getIssuer());
    synchronized (client) {
        try {
            client.setMessage(message);
            // Transpose ActAs/OnBehalfOf info from original request to the STS client.
            Object token = SecurityUtils.getSecurityPropertyValue(SecurityConstants.STS_TOKEN_ACT_AS, message);
            if (token != null) {
                client.setActAs(token);
            }
            token = SecurityUtils.getSecurityPropertyValue(SecurityConstants.STS_TOKEN_ON_BEHALF_OF, message);
            if (token != null) {
                client.setOnBehalfOf(token);
            }
            boolean enableAppliesTo = client.isEnableAppliesTo();
            Element onBehalfOfToken = client.getOnBehalfOfToken();
            Element actAsToken = client.getActAsToken();
            String key = appliesTo;
            if (!enableAppliesTo || key == null || key.isEmpty()) {
                key = ASSOCIATED_TOKEN;
            }
            boolean cacheToken = isCachedTokenFromEndpoint(message, onBehalfOfToken, actAsToken);
            // Try to retrieve a cached token from the message
            SecurityToken secToken = tokenCacher.retrieveToken(message, cacheToken);
            // Otherwise try to get a cached token corresponding to the delegation token
            if (secToken == null && onBehalfOfToken != null) {
                secToken = tokenCacher.retrieveToken(message, onBehalfOfToken, key);
            }
            if (secToken == null && actAsToken != null) {
                secToken = tokenCacher.retrieveToken(message, actAsToken, key);
            }
            if (secToken != null) {
                // Check to see whether the token needs to be renewed
                secToken = renewToken(message, secToken, params, tokenCacher);
            } else {
                secToken = getTokenFromSTS(message, client, appliesTo, params);
            }
            if (secToken != null) {
                tokenCacher.storeToken(message, onBehalfOfToken, secToken.getId(), key);
                tokenCacher.storeToken(message, actAsToken, secToken.getId(), key);
                tokenCacher.storeToken(message, secToken, cacheToken);
            }
            return secToken;
        } catch (RuntimeException e) {
            throw e;
        } catch (Exception e) {
            throw new Fault(e);
        } finally {
            client.setTrust((Trust10) null);
            client.setTrust((Trust13) null);
            client.setTemplate(null);
            client.setAddressingNamespace(null);
        }
    }
}

Example 73 with Fault

use of org.apache.cxf.interceptor.Fault in project cxf by apache.

the class STSTokenRetriever method renewToken.

private static SecurityToken renewToken(Message message, SecurityToken tok, TokenRequestParams params, STSTokenCacher tokenCacher) {
    String imminentExpiryValue = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.STS_TOKEN_IMMINENT_EXPIRY_VALUE, message);
    long imminentExpiry = 10L;
    if (imminentExpiryValue != null) {
        imminentExpiry = Long.parseLong(imminentExpiryValue);
    }
    // If the token has not expired then we don't need to renew it
    if (!(tok.isExpired() || tok.isAboutToExpire(imminentExpiry))) {
        return tok;
    }
    // Remove token from cache
    try {
        tokenCacher.removeToken(message, tok);
    } catch (TokenStoreException ex) {
        throw new Fault(ex);
    }
    // If the user has explicitly disabled Renewing then we can't renew a token,
    // so just get a new one
    STSClient client = STSUtils.getClientWithIssuer(message, "sts", params.getIssuer());
    if (!client.isAllowRenewing()) {
        return getToken(message, params, tokenCacher);
    }
    synchronized (client) {
        try {
            Map<String, Object> ctx = client.getRequestContext();
            mapSecurityProps(message, ctx);
            client.setMessage(message);
            String addressingNamespace = getAddressingNamespaceURI(message);
            if (addressingNamespace != null) {
                client.setAddressingNamespace(addressingNamespace);
            }
            client.setTrust(params.getTrust10());
            client.setTrust(params.getTrust13());
            client.setTemplate(params.getTokenTemplate());
            return client.renewSecurityToken(tok);
        } catch (RuntimeException ex) {
            LOG.log(Level.WARNING, "Error renewing a token", ex);
            boolean issueAfterFailedRenew = SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.STS_ISSUE_AFTER_FAILED_RENEW, message, true);
            if (issueAfterFailedRenew) {
                // Perhaps the STS does not support renewing, so try to issue a new token
                return getToken(message, params, tokenCacher);
            }
            throw ex;
        } catch (Exception ex) {
            LOG.log(Level.WARNING, "Error renewing a token", ex);
            boolean issueAfterFailedRenew = SecurityUtils.getSecurityPropertyBoolean(SecurityConstants.STS_ISSUE_AFTER_FAILED_RENEW, message, true);
            if (issueAfterFailedRenew) {
                // Perhaps the STS does not support renewing, so try to issue a new token
                return getToken(message, params, tokenCacher);
            }
            throw new Fault(ex);
        } finally {
            client.setTrust((Trust10) null);
            client.setTrust((Trust13) null);
            client.setTemplate(null);
            client.setAddressingNamespace(null);
        }
    }
}

Example 74 with Fault

use of org.apache.cxf.interceptor.Fault in project cxf by apache.

the class AuthPolicyValidatingInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    AuthorizationPolicy policy = message.get(AuthorizationPolicy.class);
    if (policy == null || policy.getUserName() == null || policy.getPassword() == null) {
        String name = null;
        if (policy != null) {
            name = policy.getUserName();
        }
        org.apache.cxf.common.i18n.Message errorMsg = new org.apache.cxf.common.i18n.Message("NO_USER_PASSWORD", BUNDLE, name);
        LOG.warning(errorMsg.toString());
        throw new SecurityException(errorMsg.toString());
    }
    try {
        super.validate(message);
    } catch (Exception ex) {
        throw new Fault(ex);
    }
}

Example 75 with Fault

use of org.apache.cxf.interceptor.Fault in project cxf by apache.

the class STSClient method validateSecurityToken.

protected List<SecurityToken> validateSecurityToken(SecurityToken tok, String tokentype) throws Exception {
    STSResponse response = validate(tok, tokentype);
    Element el = getDocumentElement(response.getResponse());
    if ("RequestSecurityTokenResponseCollection".equals(el.getLocalName())) {
        el = DOMUtils.getFirstElement(el);
    }
    if (!"RequestSecurityTokenResponse".equals(el.getLocalName())) {
        throw new Fault("Unexpected element " + el.getLocalName(), LOG);
    }
    el = DOMUtils.getFirstElement(el);
    String reason = null;
    boolean valid = false;
    List<SecurityToken> tokens = new LinkedList<>();
    while (el != null) {
        if ("Status".equals(el.getLocalName())) {
            Element e2 = DOMUtils.getFirstChildWithName(el, el.getNamespaceURI(), "Code");
            String s = DOMUtils.getContent(e2);
            valid = s.endsWith("/status/valid");
            e2 = DOMUtils.getFirstChildWithName(el, el.getNamespaceURI(), "Reason");
            if (e2 != null) {
                reason = DOMUtils.getContent(e2);
            }
        } else if ("RequestedSecurityToken".equals(el.getLocalName())) {
            SecurityToken token = createSecurityToken(getDocumentElement(response.getResponse()), response.getEntropy());
            if (response.getCert() != null) {
                token.setX509Certificate(response.getCert(), response.getCrypto());
            }
            if (token.getTokenType() == null) {
                String tokenTypeFromTemplate = getTokenTypeFromTemplate();
                if (tokenTypeFromTemplate != null) {
                    token.setTokenType(tokenTypeFromTemplate);
                } else if (tokenType != null) {
                    token.setTokenType(tokenType);
                }
            }
            tokens.add(token);
        }
        el = DOMUtils.getNextElement(el);
    }
    if (!valid) {
        throw new TrustException(LOG, "VALIDATION_FAILED", reason);
    }
    if (tokens.isEmpty()) {
        tokens.add(tok);
    }
    return tokens;
}