Examples with TokenValidatorParameters org.apache.cxf.sts.token.validator.TokenValidatorParameters used on opensource projects

Example 11 with TokenValidatorParameters

use of org.apache.cxf.sts.token.validator.TokenValidatorParameters in project cxf by apache.

the class EventMapper method handleEvent.

protected void handleEvent(TokenValidatorParametersSupport event, Map<String, Object> map) {
    TokenValidatorParameters params = event.getTokenParameters();
    HttpServletRequest req = (HttpServletRequest) params.getMessageContext().get(AbstractHTTPDestination.HTTP_REQUEST);
    map.put(KEYS.REMOTE_HOST.name(), req.getRemoteHost());
    map.put(KEYS.REMOTE_PORT.name(), String.valueOf(req.getRemotePort()));
    map.put(KEYS.URL.name(), params.getMessageContext().get("org.apache.cxf.request.url"));
    map.put(KEYS.TOKENTYPE.name(), params.getTokenRequirements().getTokenType());
    if (params.getTokenRequirements().getActAs() != null) {
        map.put(KEYS.VALIDATE_PRINCIPAL.name(), params.getTokenRequirements().getValidateTarget().getPrincipal().getName());
    }
    if (params.getKeyRequirements() != null) {
        map.put(KEYS.KEYTYPE.name(), params.getKeyRequirements().getKeyType());
    }
    if (params.getPrincipal() != null) {
        map.put(KEYS.WS_SEC_PRINCIPAL.name(), params.getPrincipal().getName());
    }
    map.put(KEYS.REALM.name(), params.getRealm());
}

Example 12 with TokenValidatorParameters

use of org.apache.cxf.sts.token.validator.TokenValidatorParameters in project cxf by apache.

the class TokenValidateOperation method validate.

public RequestSecurityTokenResponseType validate(RequestSecurityTokenType request, Principal principal, Map<String, Object> messageContext) {
    long start = System.currentTimeMillis();
    TokenValidatorParameters validatorParameters = new TokenValidatorParameters();
    try {
        RequestRequirements requestRequirements = parseRequest(request, messageContext);
        TokenRequirements tokenRequirements = requestRequirements.getTokenRequirements();
        validatorParameters.setStsProperties(stsProperties);
        validatorParameters.setPrincipal(principal);
        validatorParameters.setMessageContext(messageContext);
        validatorParameters.setTokenStore(getTokenStore());
        // validatorParameters.setKeyRequirements(keyRequirements);
        validatorParameters.setTokenRequirements(tokenRequirements);
        ReceivedToken validateTarget = tokenRequirements.getValidateTarget();
        if (validateTarget == null || validateTarget.getToken() == null) {
            throw new STSException("No element presented for validation", STSException.INVALID_REQUEST);
        }
        validatorParameters.setToken(validateTarget);
        if (tokenRequirements.getTokenType() == null) {
            tokenRequirements.setTokenType(STSConstants.STATUS);
            LOG.fine("Received TokenType is null, falling back to default token type: " + STSConstants.STATUS);
        }
        // Get the realm of the request
        String realm = null;
        if (stsProperties.getRealmParser() != null) {
            RealmParser realmParser = stsProperties.getRealmParser();
            realm = realmParser.parseRealm(messageContext);
        }
        validatorParameters.setRealm(realm);
        TokenValidatorResponse tokenResponse = validateReceivedToken(principal, messageContext, realm, tokenRequirements, validateTarget);
        if (tokenResponse == null) {
            LOG.fine("No Token Validator has been found that can handle this token");
            tokenResponse = new TokenValidatorResponse();
            validateTarget.setState(STATE.INVALID);
            tokenResponse.setToken(validateTarget);
        }
        // 
        // Create a new token (if requested)
        // 
        TokenProviderResponse tokenProviderResponse = null;
        String tokenType = tokenRequirements.getTokenType();
        if (tokenResponse.getToken().getState() == STATE.VALID && !STSConstants.STATUS.equals(tokenType)) {
            TokenProviderParameters providerParameters = createTokenProviderParameters(requestRequirements, principal, messageContext);
            processValidToken(providerParameters, validateTarget, tokenResponse);
            // Check if the requested claims can be handled by the configured claim handlers
            providerParameters.setClaimsManager(claimsManager);
            Map<String, Object> additionalProperties = tokenResponse.getAdditionalProperties();
            if (additionalProperties != null) {
                providerParameters.setAdditionalProperties(additionalProperties);
            }
            realm = providerParameters.getRealm();
            for (TokenProvider tokenProvider : tokenProviders) {
                boolean canHandle = false;
                if (realm == null) {
                    canHandle = tokenProvider.canHandleToken(tokenType);
                } else {
                    canHandle = tokenProvider.canHandleToken(tokenType, realm);
                }
                if (canHandle) {
                    try {
                        tokenProviderResponse = tokenProvider.createToken(providerParameters);
                    } catch (STSException ex) {
                        LOG.log(Level.WARNING, "", ex);
                        throw ex;
                    } catch (RuntimeException ex) {
                        LOG.log(Level.WARNING, "", ex);
                        throw new STSException("Error in providing a token", ex, STSException.REQUEST_FAILED);
                    }
                    break;
                }
            }
            if (tokenProviderResponse == null || tokenProviderResponse.getToken() == null) {
                LOG.fine("No Token Provider has been found that can handle this token");
                throw new STSException("No token provider found for requested token type: " + tokenType, STSException.REQUEST_FAILED);
            }
        }
        // prepare response
        try {
            RequestSecurityTokenResponseType response = createResponse(tokenResponse, tokenProviderResponse, tokenRequirements);
            STSValidateSuccessEvent event = new STSValidateSuccessEvent(validatorParameters, System.currentTimeMillis() - start);
            publishEvent(event);
            return response;
        } catch (Throwable ex) {
            LOG.log(Level.WARNING, "", ex);
            throw new STSException("Error in creating the response", ex, STSException.REQUEST_FAILED);
        }
    } catch (RuntimeException ex) {
        STSValidateFailureEvent event = new STSValidateFailureEvent(validatorParameters, System.currentTimeMillis() - start, ex);
        publishEvent(event);
        throw ex;
    }
}

Example 13 with TokenValidatorParameters

use of org.apache.cxf.sts.token.validator.TokenValidatorParameters in project cxf by apache.

the class SAMLTokenRenewerPOPTest method renewValidSAML1Assertion.

/**
 * Renew a valid SAML1 Assertion
 */
@org.junit.Test
public void renewValidSAML1Assertion() throws Exception {
    // Create the Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    Element samlToken = createSAMLAssertion(WSS4JConstants.WSS_SAML_TOKEN_TYPE, crypto, "mystskey", callbackHandler, 50000, true, false);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    // Validate the Assertion
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    ReceivedToken validateTarget = new ReceivedToken(samlToken);
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    assertTrue(samlTokenValidator.canHandleToken(validateTarget));
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken()));
    try {
        samlTokenRenewer.renewToken(renewerParameters);
        fail("Expected failure on lack of proof of possession");
    } catch (Exception ex) {
    // expected
    }
    List<WSSecurityEngineResult> signedResults = new ArrayList<>();
    WSSecurityEngineResult signedResult = new WSSecurityEngineResult(WSConstants.SIGN);
    CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
    cryptoType.setAlias("myclientkey");
    signedResult.put(WSSecurityEngineResult.TAG_X509_CERTIFICATES, crypto.getX509Certificates(cryptoType));
    signedResults.add(signedResult);
    List<WSHandlerResult> handlerResults = new ArrayList<>();
    WSHandlerResult handlerResult = new WSHandlerResult(null, signedResults, Collections.singletonMap(WSConstants.SIGN, signedResults));
    handlerResults.add(handlerResult);
    Map<String, Object> messageContext = validatorParameters.getMessageContext();
    messageContext.put(WSHandlerConstants.RECV_RESULTS, handlerResults);
    // Now successfully renew the token
    TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
    assertTrue(renewerResponse != null);
    assertTrue(renewerResponse.getToken() != null);
}

Example 14 with TokenValidatorParameters

use of org.apache.cxf.sts.token.validator.TokenValidatorParameters in project cxf by apache.

the class SAMLTokenRenewerRealmTest method testRealmB.

/**
 * Test a SAML 1.1 Assertion created in realm "B".
 */
@org.junit.Test
public void testRealmB() throws Exception {
    // Create a RenewTarget consisting of a SAML Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    TokenProviderParameters providerParameters = createProviderParameters(WSS4JConstants.WSS_SAML_TOKEN_TYPE, STSConstants.BEARER_KEY_KEYTYPE, crypto, "mystskey", callbackHandler);
    Element samlToken = createSAMLAssertion(providerParameters, "B", 50, true, true);
    // Sleep to expire the token
    Thread.sleep(100);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    SAMLRealmCodec samlRealmCodec = new IssuerSAMLRealmCodec();
    ((SAMLTokenValidator) samlTokenValidator).setSamlRealmCodec(samlRealmCodec);
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    ReceivedToken renewTarget = new ReceivedToken(samlToken);
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    tokenRequirements.setValidateTarget(renewTarget);
    validatorParameters.setToken(renewTarget);
    // Validate the token
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
    assertTrue(validatorResponse.getTokenRealm().equals("B"));
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    samlTokenRenewer.setVerifyProofOfPossession(false);
    samlTokenRenewer.setAllowRenewalAfterExpiry(true);
    Map<String, RealmProperties> samlRealms = getSamlRealms();
    ((SAMLTokenRenewer) samlTokenRenewer).setRealmMap(samlRealms);
    String realm = validatorResponse.getTokenRealm();
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken(), realm));
    TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
    assertTrue(renewerResponse != null);
    assertTrue(renewerResponse.getToken() != null);
    // Now validate it again
    ReceivedToken validateTarget = new ReceivedToken(renewerResponse.getToken());
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
}

Example 15 with TokenValidatorParameters

use of org.apache.cxf.sts.token.validator.TokenValidatorParameters in project cxf by apache.

the class SAMLTokenRenewerRealmTest method testRealmA.

/**
 * Test a SAML 1.1 Assertion created in realm "A".
 */
@org.junit.Test
public void testRealmA() throws Exception {
    // Create a RenewTarget consisting of a SAML Assertion
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    CallbackHandler callbackHandler = new PasswordCallbackHandler();
    TokenProviderParameters providerParameters = createProviderParameters(WSS4JConstants.WSS_SAML_TOKEN_TYPE, STSConstants.BEARER_KEY_KEYTYPE, crypto, "mystskey", callbackHandler);
    Element samlToken = createSAMLAssertion(providerParameters, "A", 50, true, true);
    // Sleep to expire the token
    Thread.sleep(100);
    Document doc = samlToken.getOwnerDocument();
    samlToken = (Element) doc.appendChild(samlToken);
    TokenValidator samlTokenValidator = new SAMLTokenValidator();
    SAMLRealmCodec samlRealmCodec = new IssuerSAMLRealmCodec();
    ((SAMLTokenValidator) samlTokenValidator).setSamlRealmCodec(samlRealmCodec);
    TokenValidatorParameters validatorParameters = createValidatorParameters();
    ReceivedToken renewTarget = new ReceivedToken(samlToken);
    TokenRequirements tokenRequirements = validatorParameters.getTokenRequirements();
    tokenRequirements.setValidateTarget(renewTarget);
    validatorParameters.setToken(renewTarget);
    // Validate the token
    TokenValidatorResponse validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.EXPIRED);
    assertTrue(validatorResponse.getTokenRealm().equals("A"));
    // Renew the Assertion
    TokenRenewerParameters renewerParameters = new TokenRenewerParameters();
    renewerParameters.setAppliesToAddress("http://dummy-service.com/dummy");
    renewerParameters.setStsProperties(validatorParameters.getStsProperties());
    renewerParameters.setPrincipal(new CustomTokenPrincipal("alice"));
    renewerParameters.setMessageContext(validatorParameters.getMessageContext());
    renewerParameters.setKeyRequirements(validatorParameters.getKeyRequirements());
    renewerParameters.setTokenRequirements(validatorParameters.getTokenRequirements());
    renewerParameters.setTokenStore(validatorParameters.getTokenStore());
    renewerParameters.setToken(validatorResponse.getToken());
    TokenRenewer samlTokenRenewer = new SAMLTokenRenewer();
    samlTokenRenewer.setVerifyProofOfPossession(false);
    samlTokenRenewer.setAllowRenewalAfterExpiry(true);
    Map<String, RealmProperties> samlRealms = getSamlRealms();
    ((SAMLTokenRenewer) samlTokenRenewer).setRealmMap(samlRealms);
    String realm = validatorResponse.getTokenRealm();
    assertTrue(samlTokenRenewer.canHandleToken(validatorResponse.getToken(), realm));
    TokenRenewerResponse renewerResponse = samlTokenRenewer.renewToken(renewerParameters);
    assertTrue(renewerResponse != null);
    assertTrue(renewerResponse.getToken() != null);
    // Now validate it again
    ReceivedToken validateTarget = new ReceivedToken(renewerResponse.getToken());
    tokenRequirements.setValidateTarget(validateTarget);
    validatorParameters.setToken(validateTarget);
    validatorResponse = samlTokenValidator.validateToken(validatorParameters);
    assertTrue(validatorResponse != null);
    assertTrue(validatorResponse.getToken() != null);
    assertTrue(validatorResponse.getToken().getState() == STATE.VALID);
}