Examples with MessageVerifier org.apache.cxf.rs.security.httpsignature.MessageVerifier used on opensource projects

Example 1 with MessageVerifier

use of org.apache.cxf.rs.security.httpsignature.MessageVerifier in project cxf by apache.

the class JAXRSHTTPSignatureTest method testHttpSignatureResponseServiceProperties.

@Test
public void testHttpSignatureResponseServiceProperties() throws Exception {
    URL busFile = JAXRSHTTPSignatureTest.class.getResource("client.xml");
    CreateSignatureInterceptor signatureFilter = new CreateSignatureInterceptor();
    KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(ClassLoaderUtils.getResourceAsStream("keys/alice.jks", this.getClass()), "password".toCharArray());
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("alice", "password".toCharArray());
    assertNotNull(privateKey);
    MessageSigner messageSigner = new MessageSigner(keyId -> privateKey, "alice-key-id");
    signatureFilter.setMessageSigner(messageSigner);
    VerifySignatureClientFilter signatureResponseFilter = new VerifySignatureClientFilter();
    MessageVerifier messageVerifier = new MessageVerifier(new CustomPublicKeyProvider());
    signatureResponseFilter.setMessageVerifier(messageVerifier);
    List<Object> providers = new ArrayList<>();
    providers.add(signatureFilter);
    providers.add(signatureResponseFilter);
    String address = "http://localhost:" + PORT + "/httpsigresponseprops/bookstore/books";
    WebClient client = WebClient.create(address, providers, busFile.toString());
    client.type("application/xml").accept("application/xml");
    Response response = client.post(new Book("CXF", 126L));
    assertEquals(200, response.getStatus());
    Book returnedBook = response.readEntity(Book.class);
    assertEquals(126L, returnedBook.getId());
}

Example 2 with MessageVerifier

use of org.apache.cxf.rs.security.httpsignature.MessageVerifier in project cxf by apache.

the class JAXRSHTTPSignatureTest method testHttpSignatureEmptyResponse.

@Test
public void testHttpSignatureEmptyResponse() throws Exception {
    URL busFile = JAXRSHTTPSignatureTest.class.getResource("client.xml");
    CreateSignatureInterceptor signatureFilter = new CreateSignatureInterceptor();
    KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(ClassLoaderUtils.getResourceAsStream("keys/alice.jks", this.getClass()), "password".toCharArray());
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("alice", "password".toCharArray());
    assertNotNull(privateKey);
    MessageSigner messageSigner = new MessageSigner(keyId -> privateKey, "alice-key-id");
    signatureFilter.setMessageSigner(messageSigner);
    VerifySignatureClientFilter signatureResponseFilter = new VerifySignatureClientFilter();
    MessageVerifier messageVerifier = new MessageVerifier(new CustomPublicKeyProvider());
    signatureResponseFilter.setMessageVerifier(messageVerifier);
    String address = "http://localhost:" + PORT + "/httpsigresponse/bookstore/booksnoresp";
    WebClient client = WebClient.create(address, Arrays.asList(signatureFilter, signatureResponseFilter), busFile.toString());
    client.type("application/xml").accept("application/xml");
    Response response = client.post(new Book("CXF", 126L));
    assertEquals(204, response.getStatus());
}

Example 3 with MessageVerifier

use of org.apache.cxf.rs.security.httpsignature.MessageVerifier in project cxf by apache.

the class JAXRSHTTPSignatureTest method testHttpSignatureDigestResponse.

@Test
public void testHttpSignatureDigestResponse() throws Exception {
    URL busFile = JAXRSHTTPSignatureTest.class.getResource("client.xml");
    CreateSignatureInterceptor signatureFilter = new CreateSignatureInterceptor();
    KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(ClassLoaderUtils.getResourceAsStream("keys/alice.jks", this.getClass()), "password".toCharArray());
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("alice", "password".toCharArray());
    assertNotNull(privateKey);
    MessageSigner messageSigner = new MessageSigner(keyId -> privateKey, "alice-key-id");
    signatureFilter.setMessageSigner(messageSigner);
    VerifySignatureClientFilter signatureResponseFilter = new VerifySignatureClientFilter();
    MessageVerifier messageVerifier = new MessageVerifier(new CustomPublicKeyProvider());
    signatureResponseFilter.setMessageVerifier(messageVerifier);
    String address = "http://localhost:" + PORT + "/httpsigrequired/bookstore/books";
    WebClient client = WebClient.create(address, Arrays.asList(signatureFilter, signatureResponseFilter), busFile.toString());
    client.type("application/xml").accept("application/xml");
    Response response = client.post(new Book("CXF", 126L));
    assertEquals(200, response.getStatus());
    Book returnedBook = response.readEntity(Book.class);
    assertEquals(126L, returnedBook.getId());
    String address2 = "http://localhost:" + PORT + "/httpsig/bookstore/books";
    client = WebClient.create(address2, Arrays.asList(signatureFilter, signatureResponseFilter), busFile.toString());
    client.type("application/xml").accept("application/xml");
    try {
        client.post(new Book("CXF", 126L));
        fail("Failure expected on no digest");
    } catch (Exception ex) {
    // expected
    }
}

Example 4 with MessageVerifier

use of org.apache.cxf.rs.security.httpsignature.MessageVerifier in project cxf by apache.

the class AbstractSignatureInFilter method createMessageVerifier.

protected MessageVerifier createMessageVerifier() {
    Properties props = KeyManagementUtils.loadSignatureInProperties();
    if (props == null) {
        throw new SignatureException("Signature properties are not configured correctly");
    }
    Message m = PhaseInterceptorChain.getCurrentMessage();
    PublicKey publicKey = KeyManagementUtils.loadPublicKey(m, props);
    String signatureAlgorithm = (String) m.getContextualProperty(HTTPSignatureConstants.RSSEC_SIGNATURE_ALGORITHM);
    if (signatureAlgorithm == null) {
        signatureAlgorithm = DefaultSignatureConstants.SIGNING_ALGORITHM;
    }
    final String finalSignatureAlgorithm = signatureAlgorithm;
    final Provider provider = Security.getProvider(DefaultSignatureConstants.SECURITY_PROVIDER);
    return new MessageVerifier(keyId -> publicKey, keyId -> provider, keyId -> finalSignatureAlgorithm);
}

Example 5 with MessageVerifier

use of org.apache.cxf.rs.security.httpsignature.MessageVerifier in project cxf by apache.

the class JAXRSHTTPSignatureTest method testHttpSignatureResponse.

@Test
public void testHttpSignatureResponse() throws Exception {
    URL busFile = JAXRSHTTPSignatureTest.class.getResource("client.xml");
    CreateSignatureInterceptor signatureFilter = new CreateSignatureInterceptor();
    KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(ClassLoaderUtils.getResourceAsStream("keys/alice.jks", this.getClass()), "password".toCharArray());
    PrivateKey privateKey = (PrivateKey) keyStore.getKey("alice", "password".toCharArray());
    assertNotNull(privateKey);
    MessageSigner messageSigner = new MessageSigner(keyId -> privateKey, "alice-key-id");
    signatureFilter.setMessageSigner(messageSigner);
    VerifySignatureClientFilter signatureResponseFilter = new VerifySignatureClientFilter();
    MessageVerifier messageVerifier = new MessageVerifier(new CustomPublicKeyProvider());
    signatureResponseFilter.setMessageVerifier(messageVerifier);
    List<Object> providers = new ArrayList<>();
    providers.add(signatureFilter);
    providers.add(signatureResponseFilter);
    String address = "http://localhost:" + PORT + "/httpsigresponse/bookstore/books";
    WebClient client = WebClient.create(address, providers, busFile.toString());
    client.type("application/xml").accept("application/xml");
    Response response = client.post(new Book("CXF", 126L));
    assertEquals(200, response.getStatus());
    Book returnedBook = response.readEntity(Book.class);
    assertEquals(126L, returnedBook.getId());
}