Examples with TokenValidator org.apache.cxf.sts.token.validator.TokenValidator used on opensource projects

Example 11 with TokenValidator

use of org.apache.cxf.sts.token.validator.TokenValidator in project OpenAM by OpenRock.

the class TokenValidateOperationProviderTest method testDelegate.

@Test
public void testDelegate() throws STSInitializationException {
    TokenOperationFactory mockOperationFactory = mock(TokenOperationFactory.class);
    TokenValidator mockValidator = mock(TokenValidator.class);
    when(mockOperationFactory.getTokenValidator(any(TokenType.class), any(ValidationInvocationContext.class), any(boolean.class))).thenReturn(mockValidator);
    TokenValidateOperationProvider validateOperationProvider = Guice.createInjector(new MyModule(mockOperationFactory)).getInstance(TokenValidateOperationProvider.class);
    assertTrue(validateOperationProvider.get() instanceof TokenValidateOperationProvider.TokenValidateOperationWrapper);
}

Example 12 with TokenValidator

use of org.apache.cxf.sts.token.validator.TokenValidator in project cxf by apache.

the class SAMLTokenRenewerTest method renewSAML1AssertionDifferentAppliesTo.

/**
 * Renew a valid SAML1 Assertion but sending a different AppliesTo address.
 */
@org.junit.Test
public void renewSAML1AssertionDifferentAppliesTo() throws Exception {
    // Create the Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, true, false);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    // Validate the Assertion
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    ReceivedToken validateTarget = new ReceivedToken(samlToken);
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(samlTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertNotNull(validatorResponse);
    assertNotNull(validatorResponse.getToken());
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy2");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    samlTokenRenewer.setVerifyProofOfPossession(false);
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
    try {
        samlTokenRenewer.renewToken(renewerParameters);
        fail("Failure expected on sending a different AppliesTo address");
    } catch (Exception ex) {
    // expected
    }
}

Example 13 with TokenValidator

use of org.apache.cxf.sts.token.validator.TokenValidator in project cxf by apache.

the class SAMLTokenRenewerTest method renewExpiredSAML2Assertion.

/**
 * Renew an expired SAML2 Assertion
 */
@org.junit.Test
public void renewExpiredSAML2Assertion() throws Exception {
    // Create the Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML2_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50, true, true);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    // Sleep to expire the token
    Thread.sleep(100);
    // Validate the Assertion
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    ReceivedToken validateTarget = new ReceivedToken(samlToken);
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(samlTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertNotNull(validatorResponse);
    assertNotNull(validatorResponse.getToken());
    assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    samlTokenRenewer.setVerifyProofOfPossession(false);
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
    try {
        samlTokenRenewer.renewToken(renewerParameters);
        fail("Failure expected on an expired token, which is not allowed by default");
    } catch (Exception ex) {
    // expected
    }
    samlTokenRenewer.setAllowRenewalAfterExpiry(true);
    TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
    assertNotNull(renewerResponse);
    assertNotNull(renewerResponse.getToken());
    String oldId = new SamlAssertionWrapper(samlToken).getId();
    String newId = new SamlAssertionWrapper(renewerResponse.getToken()).getId();
    assertFalse(oldId.equals(newId));
    // Now validate it again
    validateTarget = new ReceivedToken(renewerResponse.getToken());
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertNotNull(validatorResponse);
    assertNotNull(validatorResponse.getToken());
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
}

Example 14 with TokenValidator

use of org.apache.cxf.sts.token.validator.TokenValidator in project cxf by apache.

the class SAMLTokenRenewerPOPTest method renewValidSAML1AssertionWrongPOP.

/**
 * Renew a valid SAML1 Assertion
 */
@org.junit.Test
public void renewValidSAML1AssertionWrongPOP() throws Exception {
    // Create the Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, true, false);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    // Validate the Assertion
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    ReceivedToken validateTarget = new ReceivedToken(samlToken);
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(samlTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertNotNull(validatorResponse);
    assertNotNull(validatorResponse.getToken());
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
    try {
        samlTokenRenewer.renewToken(renewerParameters);
        fail("Expected failure on lack of proof of possession");
    } catch (Exception ex) {
    // expected
    }
    WSSecurityEngineResult signedResult = new WSSecurityEngineResult(WSConstants.SIGN);
    CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
    cryptoType.setAlias("myservicekey");
    signedResult.put(WSSecurityEngineResult.TAG_X509_CERTIFICATES, crypto.getX509Certificates(cryptoType));
    List<WSSecurityEngineResult> signedResults = Collections.singletonList(signedResult);
    WSHandlerResult handlerResult = new WSHandlerResult(null, signedResults, Collections.singletonMap(WSConstants.SIGN, signedResults));
    Map<String, Object> messageContext = validatorParameters.getMessageContext();
    messageContext.put(WSHandlerConstants.RECV_RESULTS, Collections.singleton(handlerResult));
    try {
        samlTokenRenewer.renewToken(renewerParameters);
        fail("Expected failure on wrong signature key");
    } catch (Exception ex) {
    // expected
    }
}

Example 15 with TokenValidator

use of org.apache.cxf.sts.token.validator.TokenValidator in project cxf by apache.

the class AbstractOperation method validateReceivedToken.

protected TokenValidatorResponse validateReceivedToken(Principal principal, Map<String, Object> messageContext, String realm, TokenRequirements tokenRequirements, ReceivedToken token) {
    token.setState(STATE.NONE);
    TokenRequirements validateRequirements = new TokenRequirements();
    validateRequirements.setValidateTarget(token);
    TokenValidatorParameters validatorParameters = new TokenValidatorParameters();
    validatorParameters.setStsProperties(stsProperties);
    validatorParameters.setPrincipal(principal);
    validatorParameters.setMessageContext(messageContext);
    validatorParameters.setTokenStore(getTokenStore());
    validatorParameters.setKeyRequirements(null);
    validatorParameters.setTokenRequirements(validateRequirements);
    validatorParameters.setToken(token);
    if (tokenValidators.isEmpty()) {
        LOG.fine("No token validators have been configured to validate the received token");
    }
    TokenValidatorResponse tokenResponse = null;
    for (TokenValidator tokenValidator : tokenValidators) {
        final boolean canHandle;
        if (realm == null) {
            canHandle = tokenValidator.canHandleToken(token);
        } else {
            canHandle = tokenValidator.canHandleToken(token, realm);
        }
        if (canHandle) {
            try {
                tokenResponse = tokenValidator.validateToken(validatorParameters);
                token = tokenResponse.getToken();
                // The parsed principal/roles is set if available. It's up to other
                // components to deal with the STATE of the validation
                token.setPrincipal(tokenResponse.getPrincipal());
                token.setRoles(tokenResponse.getRoles());
            } catch (RuntimeException ex) {
                LOG.log(Level.WARNING, "Failed to validate the token", ex);
                token.setState(STATE.INVALID);
            }
            break;
        }
    }
    if (tokenResponse == null) {
        LOG.fine("No token validator has been configured to validate the received token");
    }
    return tokenResponse;
}