Examples with ReceivedToken org.apache.cxf.sts.request.ReceivedToken used on opensource projects

Example 76 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class TokenCancelOperation method cancel.

public RequestSecurityTokenResponseType cancel(RequestSecurityTokenType request, Principal principal, Map<String, Object> messageContext) {
    long start = System.currentTimeMillis();
    TokenCancellerParameters cancellerParameters = new TokenCancellerParameters();
    try {
        RequestRequirements requestRequirements = parseRequest(request, messageContext);
        KeyRequirements keyRequirements = requestRequirements.getKeyRequirements();
        TokenRequirements tokenRequirements = requestRequirements.getTokenRequirements();
        cancellerParameters.setStsProperties(stsProperties);
        cancellerParameters.setPrincipal(principal);
        cancellerParameters.setMessageContext(messageContext);
        cancellerParameters.setTokenStore(getTokenStore());
        cancellerParameters.setKeyRequirements(keyRequirements);
        cancellerParameters.setTokenRequirements(tokenRequirements);
        ReceivedToken cancelTarget = tokenRequirements.getCancelTarget();
        if (cancelTarget == null || cancelTarget.getToken() == null) {
            throw new STSException("No element presented for cancellation", STSException.INVALID_REQUEST);
        }
        cancellerParameters.setToken(cancelTarget);
        if (tokenRequirements.getTokenType() == null) {
            tokenRequirements.setTokenType(STSConstants.STATUS);
            LOG.fine("Received TokenType is null, falling back to default token type: " + STSConstants.STATUS);
        }
        // 
        // Cancel token
        // 
        TokenCancellerResponse tokenResponse = null;
        for (TokenCanceller tokenCanceller : tokencancellers) {
            if (tokenCanceller.canHandleToken(cancelTarget)) {
                try {
                    tokenResponse = tokenCanceller.cancelToken(cancellerParameters);
                } catch (RuntimeException ex) {
                    LOG.log(Level.WARNING, "", ex);
                    throw new STSException("Error while cancelling a token", ex, STSException.REQUEST_FAILED);
                }
                break;
            }
        }
        if (tokenResponse == null || tokenResponse.getToken() == null) {
            LOG.fine("No Token Canceller has been found that can handle this token");
            throw new STSException("No token canceller found for requested token type: " + tokenRequirements.getTokenType(), STSException.REQUEST_FAILED);
        }
        if (tokenResponse.getToken().getState() != STATE.CANCELLED) {
            LOG.log(Level.WARNING, "Token cancellation failed.");
            throw new STSException("Token cancellation failed.");
        }
        // prepare response
        try {
            RequestSecurityTokenResponseType response = createResponse(tokenRequirements);
            STSCancelSuccessEvent event = new STSCancelSuccessEvent(cancellerParameters, System.currentTimeMillis() - start);
            publishEvent(event);
            return response;
        } catch (Throwable ex) {
            LOG.log(Level.WARNING, "", ex);
            throw new STSException("Error in creating the response", ex, STSException.REQUEST_FAILED);
        }
    } catch (RuntimeException ex) {
        STSCancelFailureEvent event = new STSCancelFailureEvent(cancellerParameters, System.currentTimeMillis() - start, ex);
        publishEvent(event);
        throw ex;
    }
}

Example 77 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class TokenIssueOperation method issueSingle.

public RequestSecurityTokenResponseType issueSingle(RequestSecurityTokenType request, Principal principal, Map<String, Object> messageContext) {
    long start = System.currentTimeMillis();
    TokenProviderParameters providerParameters = new TokenProviderParameters();
    try {
        RequestRequirements requestRequirements = parseRequest(request, messageContext);
        providerParameters = createTokenProviderParameters(requestRequirements, principal, messageContext);
        providerParameters.setClaimsManager(claimsManager);
        String realm = providerParameters.getRealm();
        TokenRequirements tokenRequirements = requestRequirements.getTokenRequirements();
        String tokenType = tokenRequirements.getTokenType();
        if (stsProperties.getSamlRealmCodec() != null) {
            SamlAssertionWrapper assertion = fetchSAMLAssertionFromWSSecuritySAMLToken(messageContext);
            if (assertion != null) {
                String wssecRealm = stsProperties.getSamlRealmCodec().getRealmFromToken(assertion);
                SAMLTokenPrincipal samlPrincipal = new SAMLTokenPrincipalImpl(assertion);
                if (LOG.isLoggable(Level.FINE)) {
                    LOG.fine("SAML token realm of user '" + samlPrincipal.getName() + "' is " + wssecRealm);
                }
                ReceivedToken wssecToken = new ReceivedToken(assertion.getElement());
                wssecToken.setState(STATE.VALID);
                TokenValidatorResponse tokenResponse = new TokenValidatorResponse();
                tokenResponse.setPrincipal(samlPrincipal);
                tokenResponse.setToken(wssecToken);
                tokenResponse.setTokenRealm(wssecRealm);
                tokenResponse.setAdditionalProperties(new HashMap<String, Object>());
                processValidToken(providerParameters, wssecToken, tokenResponse);
                providerParameters.setPrincipal(wssecToken.getPrincipal());
            }
        }
        // Validate OnBehalfOf token if present
        if (providerParameters.getTokenRequirements().getOnBehalfOf() != null) {
            ReceivedToken validateTarget = providerParameters.getTokenRequirements().getOnBehalfOf();
            handleDelegationToken(validateTarget, providerParameters, principal, messageContext, realm, requestRequirements);
        }
        // See whether ActAs is allowed or not
        if (providerParameters.getTokenRequirements().getActAs() != null) {
            ReceivedToken validateTarget = providerParameters.getTokenRequirements().getActAs();
            handleDelegationToken(validateTarget, providerParameters, principal, messageContext, realm, requestRequirements);
        }
        // create token
        TokenProviderResponse tokenResponse = null;
        for (TokenProvider tokenProvider : tokenProviders) {
            boolean canHandle = false;
            if (realm == null) {
                canHandle = tokenProvider.canHandleToken(tokenType);
            } else {
                canHandle = tokenProvider.canHandleToken(tokenType, realm);
            }
            if (canHandle) {
                try {
                    tokenResponse = tokenProvider.createToken(providerParameters);
                } catch (STSException ex) {
                    LOG.log(Level.WARNING, "", ex);
                    throw ex;
                } catch (RuntimeException ex) {
                    LOG.log(Level.WARNING, "", ex);
                    throw new STSException("Error in providing a token", ex, STSException.REQUEST_FAILED);
                }
                break;
            }
        }
        if (tokenResponse == null || tokenResponse.getToken() == null) {
            LOG.log(Level.WARNING, "No token provider found for requested token type: " + tokenType);
            throw new STSException("No token provider found for requested token type: " + tokenType, STSException.REQUEST_FAILED);
        }
        // prepare response
        try {
            KeyRequirements keyRequirements = requestRequirements.getKeyRequirements();
            EncryptionProperties encryptionProperties = providerParameters.getEncryptionProperties();
            RequestSecurityTokenResponseType response = createResponse(encryptionProperties, tokenResponse, tokenRequirements, keyRequirements);
            STSIssueSuccessEvent event = new STSIssueSuccessEvent(providerParameters, System.currentTimeMillis() - start);
            publishEvent(event);
            return response;
        } catch (Throwable ex) {
            LOG.log(Level.WARNING, "", ex);
            throw new STSException("Error in creating the response", ex, STSException.REQUEST_FAILED);
        }
    } catch (RuntimeException ex) {
        LOG.log(Level.SEVERE, "Cannot issue token: " + ex.getMessage(), ex);
        STSIssueFailureEvent event = new STSIssueFailureEvent(providerParameters, System.currentTimeMillis() - start, ex);
        publishEvent(event);
        throw ex;
    }
}

Example 78 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class UsernameTokenDelegationHandler method isDelegationAllowed.

public TokenDelegationResponse isDelegationAllowed(TokenDelegationParameters tokenParameters) {
    TokenDelegationResponse response = new TokenDelegationResponse();
    ReceivedToken delegateTarget = tokenParameters.getToken();
    response.setToken(delegateTarget);
    response.setDelegationAllowed(true);
    return response;
}

Example 79 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class ActAsAttributeStatementProvider method getStatement.

/**
 * Get an AttributeStatementBean using the given parameters.
 */
public AttributeStatementBean getStatement(TokenProviderParameters providerParameters) {
    AttributeStatementBean attrBean = new AttributeStatementBean();
    TokenRequirements tokenRequirements = providerParameters.getTokenRequirements();
    ReceivedToken actAs = tokenRequirements.getActAs();
    try {
        if (actAs != null) {
            List<AttributeBean> attributeList = new ArrayList<>();
            String tokenType = tokenRequirements.getTokenType();
            AttributeBean parameterBean = handleAdditionalParameters(actAs.getToken(), tokenType);
            if (!parameterBean.getAttributeValues().isEmpty()) {
                attributeList.add(parameterBean);
            }
            attrBean.setSamlAttributes(attributeList);
        }
    } catch (WSSecurityException ex) {
        throw new STSException(ex.getMessage(), ex);
    }
    return attrBean;
}

Example 80 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class DefaultSubjectProvider method getPrincipal.

/**
 * Get the Principal (which is used as the Subject). By default, we check the following (in order):
 *  - A valid OnBehalfOf principal
 *  - A valid principal associated with a token received as ValidateTarget
 *  - The principal associated with the request. We don't need to check to see if it is "valid" here, as it
 *    is not parsed by the STS (but rather the WS-Security layer).
 */
protected Principal getPrincipal(SubjectProviderParameters subjectProviderParameters) {
    TokenProviderParameters providerParameters = subjectProviderParameters.getProviderParameters();
    Principal principal = null;
    // if validation was successful, the principal was set in ReceivedToken
    if (providerParameters.getTokenRequirements().getOnBehalfOf() != null) {
        ReceivedToken receivedToken = providerParameters.getTokenRequirements().getOnBehalfOf();
        if (receivedToken.getState().equals(STATE.VALID)) {
            principal = receivedToken.getPrincipal();
        }
    } else if (providerParameters.getTokenRequirements().getValidateTarget() != null) {
        ReceivedToken receivedToken = providerParameters.getTokenRequirements().getValidateTarget();
        if (receivedToken.getState().equals(STATE.VALID)) {
            principal = receivedToken.getPrincipal();
        }
    } else {
        principal = providerParameters.getPrincipal();
    }
    return principal;
}