Examples with SCTValidator org.apache.cxf.sts.token.validator.SCTValidator used on opensource projects

Example 1 with SCTValidator

use of org.apache.cxf.sts.token.validator.SCTValidator in project cxf by apache.

the class RequestParserUnitTest method testValidateSCT.

/**
 * Test for fetching (and validating) a referenced SecurityContextToken.
 */
@org.junit.Test
public void testValidateSCT() throws Exception {
    Element secHeaderElement = (Element) parseStringToElement(SECURITY_HEADER).getFirstChild();
    RequestSecurityTokenType request = createJaxbObject(VALIDATE_SCT_REFERENCE);
    RequestParser parser = new RequestParser();
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgContext = new WrappedMessageContext(msg);
    // Process the security header and store the results in the message context
    WSSecurityEngine securityEngine = new WSSecurityEngine();
    RequestData reqData = new RequestData();
    reqData.setCallbackHandler(new PasswordCallbackHandler());
    WSHandlerResult results = securityEngine.processSecurityHeader(secHeaderElement, reqData);
    msgContext.put(WSHandlerConstants.RECV_RESULTS, Collections.singletonList(results));
    RequestRequirements requestRequirements = parser.parseRequest(request, msgContext, null, null);
    SCTValidator sctValidator = new SCTValidator();
    assertTrue(sctValidator.canHandleToken(requestRequirements.getTokenRequirements().getValidateTarget()));
}

Example 2 with SCTValidator

use of org.apache.cxf.sts.token.validator.SCTValidator in project cxf by apache.

the class ValidateSCTUnitTest method testValidateSCT.

/**
 * Test to successfully validate a SecurityContextToken
 */
@org.junit.Test
public void testValidateSCT() throws Exception {
    TokenValidateOperation validateOperation = new TokenValidateOperation();
    validateOperation.setTokenStore(tokenStore);
    // Add Token Validator
    validateOperation.setTokenValidators(Collections.singletonList(new SCTValidator()));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    validateOperation.setStsProperties(stsProperties);
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, STSConstants.STATUS);
    request.getAny().add(tokenType);
    // Get a SecurityContextToken via the SCTProvider
    TokenProviderResponse providerResponse = createSCT();
    Element sct = (Element) providerResponse.getToken();
    ValidateTargetType validateTarget = new ValidateTargetType();
    validateTarget.setAny(sct);
    JAXBElement<ValidateTargetType> validateTargetType = new JAXBElement<ValidateTargetType>(QNameConstants.VALIDATE_TARGET, ValidateTargetType.class, validateTarget);
    request.getAny().add(validateTargetType);
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    Principal principal = new CustomTokenPrincipal("alice");
    msgCtx.put(SecurityContext.class.getName(), createSecurityContext(principal));
    // Validate a token
    RequestSecurityTokenResponseType response = validateOperation.validate(request, principal, msgCtx);
    assertTrue(validateResponse(response));
    // Now remove the token from the cache before validating again
    tokenStore.remove(tokenStore.getToken(providerResponse.getTokenId()).getId());
    assertNull(tokenStore.getToken(providerResponse.getTokenId()));
    response = validateOperation.validate(request, principal, msgCtx);
    assertFalse(validateResponse(response));
}