Examples with TLSSessionInfo org.apache.cxf.security.transport.TLSSessionInfo used on opensource projects

Example 1 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class CallbackHandlerTlsCert method create.

@Override
public CallbackHandler create(Message message) {
    TLSSessionInfo tlsSession = message.get(TLSSessionInfo.class);
    if (tlsSession == null) {
        return null;
    }
    Certificate cert = getCertificate(message);
    String name = certMapper.getUserName(cert);
    String password = nameToPasswordMapper.getPassword(name);
    return new NamePasswordCallbackHandler(name, password);
}

Example 2 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class CertConstraintsInterceptor method handleMessage.

public void handleMessage(Message message) throws Fault {
    final CertConstraints certConstraints = (CertConstraints) message.getContextualProperty(CertConstraints.class.getName());
    if (certConstraints == null) {
        return;
    }
    if (isRequestor(message)) {
        try {
            String scheme = (String) message.get("http.scheme");
            if ("https".equals(scheme)) {
                final MessageTrustDecider orig = message.get(MessageTrustDecider.class);
                MessageTrustDecider trust = new HttpsMessageTrustDecider(certConstraints, orig);
                message.put(MessageTrustDecider.class, trust);
            } else {
                throw new UntrustedURLConnectionIOException("TLS is not in use");
            }
        } catch (UntrustedURLConnectionIOException ex) {
            throw new Fault(ex);
        }
    } else {
        try {
            TLSSessionInfo tlsInfo = message.get(TLSSessionInfo.class);
            final Certificate[] certs = tlsInfo.getPeerCertificates();
            if (certs == null || certs.length == 0) {
                throw new UntrustedURLConnectionIOException("No client certificates were found");
            }
            X509Certificate[] x509Certs = (X509Certificate[]) certs;
            if (!certConstraints.matches(x509Certs[0])) {
                throw new UntrustedURLConnectionIOException("The client certificate does not match the defined cert constraints");
            }
        } catch (UntrustedURLConnectionIOException ex) {
            throw new Fault(ex);
        }
    }
}

Example 3 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class AbstractHTTPDestination method propogateSecureSession.

/**
 * Propogate in the message a TLSSessionInfo instance representative
 * of the TLS-specific information in the HTTP request.
 *
 * @param request the Jetty request
 * @param message the Message
 */
private static void propogateSecureSession(HttpServletRequest request, Message message) {
    final String cipherSuite = (String) request.getAttribute(SSL_CIPHER_SUITE_ATTRIBUTE);
    if (cipherSuite != null) {
        final java.security.cert.Certificate[] certs = (java.security.cert.Certificate[]) request.getAttribute(SSL_PEER_CERT_CHAIN_ATTRIBUTE);
        message.put(TLSSessionInfo.class, new TLSSessionInfo(cipherSuite, null, certs));
    }
}

Example 4 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class SamlTokenInterceptor method processToken.

protected void processToken(SoapMessage message) {
    Header h = findSecurityHeader(message, false);
    if (h == null) {
        return;
    }
    Element el = (Element) h.getObject();
    Element child = DOMUtils.getFirstElement(el);
    while (child != null) {
        if ("Assertion".equals(child.getLocalName()) && (WSS4JConstants.SAML_NS.equals(child.getNamespaceURI()) || WSS4JConstants.SAML2_NS.equals(child.getNamespaceURI()))) {
            try {
                List<WSSecurityEngineResult> samlResults = processToken(child, message);
                if (samlResults != null) {
                    List<WSHandlerResult> results = CastUtils.cast((List<?>) message.get(WSHandlerConstants.RECV_RESULTS));
                    if (results == null) {
                        results = new ArrayList<>();
                        message.put(WSHandlerConstants.RECV_RESULTS, results);
                    }
                    boolean signed = false;
                    for (WSSecurityEngineResult result : samlResults) {
                        SamlAssertionWrapper wrapper = (SamlAssertionWrapper) result.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
                        if (wrapper.isSigned()) {
                            signed = true;
                            break;
                        }
                    }
                    assertTokens(message, SPConstants.SAML_TOKEN, signed);
                    Integer key = WSConstants.ST_UNSIGNED;
                    if (signed) {
                        key = WSConstants.ST_SIGNED;
                    }
                    WSHandlerResult rResult = new WSHandlerResult(null, samlResults, Collections.singletonMap(key, samlResults));
                    results.add(0, rResult);
                    // Check version against policy
                    AssertionInfoMap aim = message.get(AssertionInfoMap.class);
                    for (AssertionInfo ai : PolicyUtils.getAllAssertionsByLocalname(aim, SPConstants.SAML_TOKEN)) {
                        SamlToken samlToken = (SamlToken) ai.getAssertion();
                        for (WSSecurityEngineResult result : samlResults) {
                            SamlAssertionWrapper assertionWrapper = (SamlAssertionWrapper) result.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
                            if (!checkVersion(aim, samlToken, assertionWrapper)) {
                                ai.setNotAsserted("Wrong SAML Version");
                            }
                            TLSSessionInfo tlsInfo = message.get(TLSSessionInfo.class);
                            Certificate[] tlsCerts = null;
                            if (tlsInfo != null) {
                                tlsCerts = tlsInfo.getPeerCertificates();
                            }
                            if (!DOMSAMLUtil.checkHolderOfKey(assertionWrapper, null, tlsCerts)) {
                                ai.setNotAsserted("Assertion fails holder-of-key requirements");
                                continue;
                            }
                            if (!DOMSAMLUtil.checkSenderVouches(assertionWrapper, tlsCerts, null, null)) {
                                ai.setNotAsserted("Assertion fails sender-vouches requirements");
                                continue;
                            }
                        }
                    }
                    if (signed) {
                        Principal principal = (Principal) samlResults.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
                        SecurityContext sc = message.get(SecurityContext.class);
                        if (sc == null || sc.getUserPrincipal() == null) {
                            message.put(SecurityContext.class, new DefaultSecurityContext(principal, null));
                        }
                    }
                }
            } catch (WSSecurityException ex) {
                throw WSS4JUtils.createSoapFault(message, message.getVersion(), ex);
            }
        }
        child = DOMUtils.getNextElement(child);
    }
}

Example 5 with TLSSessionInfo

use of org.apache.cxf.security.transport.TLSSessionInfo in project cxf by apache.

the class IssuedTokenPolicyValidator method validateSAMLToken.

private boolean validateSAMLToken(PolicyValidatorParameters parameters, SamlAssertionWrapper samlAssertion, Collection<AssertionInfo> ais) {
    boolean asserted = true;
    for (AssertionInfo ai : ais) {
        IssuedToken issuedToken = (IssuedToken) ai.getAssertion();
        ai.setAsserted(true);
        assertToken(issuedToken, parameters.getAssertionInfoMap());
        if (!isTokenRequired(issuedToken, parameters.getMessage())) {
            continue;
        }
        if (samlAssertion == null) {
            asserted = false;
            ai.setNotAsserted("The received token does not match the token inclusion requirement");
            continue;
        }
        Element template = issuedToken.getRequestSecurityTokenTemplate();
        if (template != null && !checkIssuedTokenTemplate(template, samlAssertion)) {
            asserted = false;
            ai.setNotAsserted("Error in validating the IssuedToken policy");
            continue;
        }
        Element claims = issuedToken.getClaims();
        if (claims != null) {
            String dialect = claims.getAttributeNS(null, "Dialect");
            if (claimsValidator.getDialect().equals(dialect) && !claimsValidator.validatePolicy(claims, samlAssertion)) {
                asserted = false;
                ai.setNotAsserted("Error in validating the Claims policy");
                continue;
            }
        }
        TLSSessionInfo tlsInfo = parameters.getMessage().get(TLSSessionInfo.class);
        Certificate[] tlsCerts = null;
        if (tlsInfo != null) {
            tlsCerts = tlsInfo.getPeerCertificates();
        }
        if (!checkHolderOfKey(samlAssertion, parameters.getSignedResults(), tlsCerts)) {
            asserted = false;
            ai.setNotAsserted("Assertion fails holder-of-key requirements");
            continue;
        }
    }
    return asserted;
}