Examples with ReceivedToken org.apache.cxf.sts.request.ReceivedToken used on opensource projects

Example 31 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class JWTProviderOnBehalfOfTest method createProviderParameters.

private TokenProviderParameters createProviderParameters(String tokenType, Object onBehalfOf) throws WSSecurityException {
    TokenProviderParameters parameters = new TokenProviderParameters();
    TokenRequirements tokenRequirements = new TokenRequirements();
    tokenRequirements.setTokenType(tokenType);
    if (onBehalfOf != null) {
        ReceivedToken onBehalfOfToken = new ReceivedToken(onBehalfOf);
        onBehalfOfToken.setState(STATE.VALID);
        tokenRequirements.setOnBehalfOf(onBehalfOfToken);
    }
    parameters.setTokenRequirements(tokenRequirements);
    KeyRequirements keyRequirements = new KeyRequirements();
    parameters.setKeyRequirements(keyRequirements);
    parameters.setPrincipal(new CustomTokenPrincipal("alice"));
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    parameters.setMessageContext(msgCtx);
    parameters.setAppliesToAddress("http://dummy-service.com/dummy");
    // Add STSProperties object
    StaticSTSProperties stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    parameters.setStsProperties(stsProperties);
    parameters.setEncryptionProperties(new EncryptionProperties());
    return parameters;
}

Example 32 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class CustomBSTTokenValidator method validateToken.

public TokenValidatorResponse validateToken(TokenValidatorParameters tokenParameters) {
    TokenValidatorResponse response = new TokenValidatorResponse();
    ReceivedToken validateTarget = tokenParameters.getToken();
    validateTarget.setState(STATE.INVALID);
    response.setToken(validateTarget);
    if (!validateTarget.isBinarySecurityToken()) {
        return response;
    }
    BinarySecurityTokenType binarySecurityToken = (BinarySecurityTokenType) validateTarget.getToken();
    // 
    if (Base64.getMimeEncoder().encodeToString("12345678".getBytes()).equals(binarySecurityToken.getValue())) {
        validateTarget.setState(STATE.VALID);
    }
    response.setPrincipal(new CustomTokenPrincipal("alice"));
    return response;
}

Example 33 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class SAMLProviderOnBehalfOfTest method createProviderParameters.

private TokenProviderParameters createProviderParameters(String tokenType, String keyType, Object onBehalfOf) throws WSSecurityException {
    TokenProviderParameters parameters = new TokenProviderParameters();
    TokenRequirements tokenRequirements = new TokenRequirements();
    tokenRequirements.setTokenType(tokenType);
    if (onBehalfOf != null) {
        ReceivedToken onBehalfOfToken = new ReceivedToken(onBehalfOf);
        onBehalfOfToken.setState(STATE.VALID);
        tokenRequirements.setOnBehalfOf(onBehalfOfToken);
    }
    parameters.setTokenRequirements(tokenRequirements);
    KeyRequirements keyRequirements = new KeyRequirements();
    keyRequirements.setKeyType(keyType);
    parameters.setKeyRequirements(keyRequirements);
    parameters.setPrincipal(new CustomTokenPrincipal("alice"));
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    parameters.setMessageContext(msgCtx);
    parameters.setAppliesToAddress("http://dummy-service.com/dummy");
    // Add STSProperties object
    StaticSTSProperties stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    parameters.setStsProperties(stsProperties);
    parameters.setEncryptionProperties(new EncryptionProperties());
    return parameters;
}

Example 34 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class SAMLTokenRenewerLifetimeTest method testSaml2ExceededConfiguredMaxLifetimeButUpdated.

/**
 * Renew SAML 2 token with a with a lifetime
 * which exceeds configured maximum lifetime
 * Lifetime reduced to maximum lifetime
 */
@org.junit.Test
public void testSaml2ExceededConfiguredMaxLifetimeButUpdated() throws Exception {
    // 30 minutes
    long maxLifetime = 30 * 60L;
    SAMLTokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    samlTokenRenewer.setVerifyProofOfPossession(false);
    samlTokenRenewer.setAllowRenewalAfterExpiry(true);
    DefaultConditionsProvider conditionsProvider = new DefaultConditionsProvider();
    conditionsProvider.setMaxLifetime(maxLifetime);
    conditionsProvider.setFailLifetimeExceedance(false);
    conditionsProvider.setAcceptClientLifetime(true);
    samlTokenRenewer.setConditionsProvider(conditionsProvider);
    TokenRenewerParameters renewerParameters = createRenewerParameters();
    // Set expected lifetime to 35 minutes
    Instant creationTime = Instant.now();
    long requestedLifetime = 35 * 60L;
    Instant expirationTime = creationTime.plusSeconds(requestedLifetime);
    Lifetime lifetime = new Lifetime();
    lifetime.setCreated(creationTime.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
    lifetime.setExpires(expirationTime.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)));
    renewerParameters.getTokenRequirements().setLifetime(lifetime);
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    // Create token.
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50, true, true);
    // Sleep to expire the token
    Thread.sleep(100);
    ReceivedToken renewTarget = new ReceivedToken(samlToken);
    renewTarget.setState(STATE.VALID);
    renewerParameters.getTokenRequirements().setRenewTarget(renewTarget);
    renewerParameters.setToken(renewTarget);
    assertTrue(samlTokenRenewer.canHandleToken(renewTarget));
    TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
    assertTrue(renewerResponse != null);
    assertTrue(renewerResponse.getToken() != null);
    long duration = Duration.between(renewerResponse.getCreated(), renewerResponse.getExpires()).getSeconds();
    assertEquals(maxLifetime, duration);
}

Example 35 with ReceivedToken

use of org.apache.cxf.sts.request.ReceivedToken in project cxf by apache.

the class SAMLTokenRenewerPOPTest method renewValidSAML1Assertion.

/**
 * Renew a valid SAML1 Assertion
 */
@org.junit.Test
public void renewValidSAML1Assertion() throws Exception {
    // Create the Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, true, false);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    // Validate the Assertion
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    ReceivedToken validateTarget = new ReceivedToken(samlToken);
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(samlTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
    try {
        samlTokenRenewer.renewToken(renewerParameters);
        fail("Expected failure on lack of proof of possession");
    } catch (Exception ex) {
    // expected
    }
    List<WSSecurityEngineResult> signedResults = new ArrayList<>();
    WSSecurityEngineResult signedResult = new WSSecurityEngineResult(WSConstants.SIGN);
    CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
    cryptoType.setAlias("myclientkey");
    signedResult.put(WSSecurityEngineResult.TAG_X509_CERTIFICATES, crypto.getX509Certificates(cryptoType));
    signedResults.add(signedResult);
    List<WSHandlerResult> handlerResults = new ArrayList<>();
    WSHandlerResult handlerResult = new WSHandlerResult(null, signedResults, Collections.singletonMap(WSConstants.SIGN, signedResults));
    handlerResults.add(handlerResult);
    Map<String, Object> messageContext = validatorParameters.getMessageContext();
    messageContext.put(WSHandlerConstants.RECV_RESULTS, handlerResults);
    // Now successfully renew the token
    TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
    assertTrue(renewerResponse != null);
    assertTrue(renewerResponse.getToken() != null);
}