Examples with AssertionInfoMap org.apache.cxf.ws.policy.AssertionInfoMap used on opensource projects

Example 21 with AssertionInfoMap

use of org.apache.cxf.ws.policy.AssertionInfoMap in project cxf by apache.

the class StaxSymmetricBindingHandler method handleBinding.

public void handleBinding() {
    AssertionInfoMap aim = getMessage().get(AssertionInfoMap.class);
    configureTimestamp(aim);
    assertPolicy(sbinding.getName());
    String asymSignatureAlgorithm = (String) getMessage().getContextualProperty(SecurityConstants.ASYMMETRIC_SIGNATURE_ALGORITHM);
    if (asymSignatureAlgorithm != null && sbinding.getAlgorithmSuite() != null) {
        sbinding.getAlgorithmSuite().getAlgorithmSuiteType().setAsymmetricSignature(asymSignatureAlgorithm);
    }
    String symSignatureAlgorithm = (String) getMessage().getContextualProperty(SecurityConstants.SYMMETRIC_SIGNATURE_ALGORITHM);
    if (symSignatureAlgorithm != null && sbinding.getAlgorithmSuite() != null) {
        sbinding.getAlgorithmSuite().getAlgorithmSuiteType().setSymmetricSignature(symSignatureAlgorithm);
    }
    // Set up CallbackHandler which wraps the configured Handler
    WSSSecurityProperties properties = getProperties();
    try {
        TokenStoreCallbackHandler callbackHandler = new TokenStoreCallbackHandler(properties.getCallbackHandler(), TokenStoreUtils.getTokenStore(message));
        properties.setCallbackHandler(callbackHandler);
    } catch (TokenStoreException e) {
        LOG.log(Level.FINE, e.getMessage(), e);
        throw new Fault(e);
    }
    if (sbinding.getProtectionOrder() == AbstractSymmetricAsymmetricBinding.ProtectionOrder.EncryptBeforeSigning) {
        doEncryptBeforeSign();
        assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_BEFORE_SIGNING));
    } else {
        doSignBeforeEncrypt();
        assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.SIGN_BEFORE_ENCRYPTING));
    }
    if (!isRequestor()) {
        properties.setEncryptSymmetricEncryptionKey(false);
    }
    configureLayout(aim);
    assertAlgorithmSuite(sbinding.getAlgorithmSuite());
    assertWSSProperties(sbinding.getName().getNamespaceURI());
    assertTrustProperties(sbinding.getName().getNamespaceURI());
    assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.ONLY_SIGN_ENTIRE_HEADERS_AND_BODY));
    if (sbinding.isProtectTokens()) {
        assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.PROTECT_TOKENS));
    }
}

Example 22 with AssertionInfoMap

use of org.apache.cxf.ws.policy.AssertionInfoMap in project cxf by apache.

the class AbstractStaxBindingHandler method getSignedParts.

/**
 * Identifies the portions of the message to be signed
 */
protected List<SecurePart> getSignedParts() throws SOAPException {
    SignedParts parts = null;
    SignedElements elements = null;
    AssertionInfoMap aim = message.get(AssertionInfoMap.class);
    AssertionInfo assertionInfo = PolicyUtils.getFirstAssertionByLocalname(aim, SPConstants.SIGNED_PARTS);
    if (assertionInfo != null) {
        parts = (SignedParts) assertionInfo.getAssertion();
        assertionInfo.setAsserted(true);
    }
    assertionInfo = PolicyUtils.getFirstAssertionByLocalname(aim, SPConstants.SIGNED_ELEMENTS);
    if (assertionInfo != null) {
        elements = (SignedElements) assertionInfo.getAssertion();
        assertionInfo.setAsserted(true);
    }
    List<SecurePart> signedParts = new ArrayList<>();
    if (parts != null) {
        if (parts.isBody()) {
            QName soapBody = new QName(WSSConstants.NS_SOAP12, "Body");
            SecurePart securePart = new SecurePart(soapBody, Modifier.Element);
            signedParts.add(securePart);
        }
        for (Header head : parts.getHeaders()) {
            String localName = head.getName();
            if (localName == null) {
                localName = "*";
            }
            QName qname = new QName(head.getNamespace(), localName);
            SecurePart securePart = new SecurePart(qname, Modifier.Element);
            securePart.setRequired(false);
            signedParts.add(securePart);
        }
        Attachments attachments = parts.getAttachments();
        if (attachments != null) {
            Modifier modifier = Modifier.Element;
            if (attachments.isContentSignatureTransform()) {
                modifier = Modifier.Content;
            }
            SecurePart securePart = new SecurePart("cid:Attachments", modifier);
            securePart.setRequired(false);
            signedParts.add(securePart);
        }
    }
    if (elements != null && elements.getXPaths() != null) {
        for (XPath xPath : elements.getXPaths()) {
            List<QName> qnames = org.apache.wss4j.policy.stax.PolicyUtils.getElementPath(xPath);
            if (!qnames.isEmpty()) {
                SecurePart securePart = new SecurePart(qnames.get(qnames.size() - 1), Modifier.Element);
                signedParts.add(securePart);
            }
        }
    }
    return signedParts;
}

Example 23 with AssertionInfoMap

use of org.apache.cxf.ws.policy.AssertionInfoMap in project cxf by apache.

the class AbstractStaxBindingHandler method getEncryptedParts.

/**
 * Identifies the portions of the message to be encrypted
 */
protected List<SecurePart> getEncryptedParts() throws SOAPException {
    EncryptedParts parts = null;
    EncryptedElements elements = null;
    ContentEncryptedElements celements = null;
    AssertionInfoMap aim = message.get(AssertionInfoMap.class);
    Collection<AssertionInfo> ais = PolicyUtils.getAllAssertionsByLocalname(aim, SPConstants.ENCRYPTED_PARTS);
    if (!ais.isEmpty()) {
        for (AssertionInfo ai : ais) {
            parts = (EncryptedParts) ai.getAssertion();
            ai.setAsserted(true);
        }
    }
    ais = PolicyUtils.getAllAssertionsByLocalname(aim, SPConstants.ENCRYPTED_ELEMENTS);
    if (!ais.isEmpty()) {
        for (AssertionInfo ai : ais) {
            elements = (EncryptedElements) ai.getAssertion();
            ai.setAsserted(true);
        }
    }
    ais = PolicyUtils.getAllAssertionsByLocalname(aim, SPConstants.CONTENT_ENCRYPTED_ELEMENTS);
    if (!ais.isEmpty()) {
        for (AssertionInfo ai : ais) {
            celements = (ContentEncryptedElements) ai.getAssertion();
            ai.setAsserted(true);
        }
    }
    List<SecurePart> encryptedParts = new ArrayList<>();
    if (parts != null) {
        if (parts.isBody()) {
            QName soapBody = new QName(WSSConstants.NS_SOAP12, "Body");
            SecurePart securePart = new SecurePart(soapBody, Modifier.Content);
            encryptedParts.add(securePart);
        }
        for (Header head : parts.getHeaders()) {
            String localName = head.getName();
            if (localName == null) {
                localName = "*";
            }
            QName qname = new QName(head.getNamespace(), localName);
            SecurePart securePart = new SecurePart(qname, Modifier.Element);
            securePart.setRequired(false);
            encryptedParts.add(securePart);
        }
        Attachments attachments = parts.getAttachments();
        if (attachments != null) {
            SecurePart securePart = new SecurePart("cid:Attachments", Modifier.Element);
            if (MessageUtils.getContextualBoolean(message, SecurityConstants.USE_ATTACHMENT_ENCRYPTION_CONTENT_ONLY_TRANSFORM, false)) {
                securePart.setModifier(Modifier.Content);
            }
            securePart.setRequired(false);
            encryptedParts.add(securePart);
        }
    }
    if (elements != null && elements.getXPaths() != null) {
        for (XPath xPath : elements.getXPaths()) {
            List<QName> qnames = org.apache.wss4j.policy.stax.PolicyUtils.getElementPath(xPath);
            if (!qnames.isEmpty()) {
                SecurePart securePart = new SecurePart(qnames.get(qnames.size() - 1), Modifier.Element);
                encryptedParts.add(securePart);
            }
        }
    }
    if (celements != null && celements.getXPaths() != null) {
        for (XPath xPath : celements.getXPaths()) {
            List<QName> qnames = org.apache.wss4j.policy.stax.PolicyUtils.getElementPath(xPath);
            if (!qnames.isEmpty()) {
                SecurePart securePart = new SecurePart(qnames.get(qnames.size() - 1), Modifier.Content);
                encryptedParts.add(securePart);
            }
        }
    }
    return encryptedParts;
}

Example 24 with AssertionInfoMap

use of org.apache.cxf.ws.policy.AssertionInfoMap in project cxf by apache.

the class UsernameTokenInterceptor method addToken.

protected void addToken(SoapMessage message) {
    UsernameToken tok = assertTokens(message);
    Header h = findSecurityHeader(message, true);
    Element el = (Element) h.getObject();
    Document doc = el.getOwnerDocument();
    WSSecUsernameToken utBuilder = addUsernameToken(message, doc, tok);
    if (utBuilder == null) {
        AssertionInfoMap aim = message.get(AssertionInfoMap.class);
        Collection<AssertionInfo> ais = PolicyUtils.getAllAssertionsByLocalname(aim, SPConstants.USERNAME_TOKEN);
        for (AssertionInfo ai : ais) {
            if (ai.isAsserted()) {
                ai.setAsserted(false);
            }
        }
        return;
    }
    utBuilder.prepare();
    el.appendChild(utBuilder.getUsernameTokenElement());
}

Example 25 with AssertionInfoMap

use of org.apache.cxf.ws.policy.AssertionInfoMap in project cxf by apache.

the class UsernameTokenInterceptor method assertTokens.

private UsernameToken assertTokens(SoapMessage message, UsernameTokenPrincipal princ, boolean signed) {
    AssertionInfoMap aim = message.get(AssertionInfoMap.class);
    Collection<AssertionInfo> ais = PolicyUtils.getAllAssertionsByLocalname(aim, SPConstants.USERNAME_TOKEN);
    UsernameToken tok = null;
    for (AssertionInfo ai : ais) {
        tok = (UsernameToken) ai.getAssertion();
        ai.setAsserted(true);
        if ((tok.getPasswordType() == UsernameToken.PasswordType.HashPassword) && (princ == null || !princ.isPasswordDigest())) {
            ai.setNotAsserted("Password hashing policy not enforced");
        } else {
            PolicyUtils.assertPolicy(aim, SPConstants.HASH_PASSWORD);
        }
        if ((tok.getPasswordType() != UsernameToken.PasswordType.NoPassword) && isNonEndorsingSupportingToken(tok) && (princ == null || princ.getPassword() == null)) {
            ai.setNotAsserted("Username Token No Password supplied");
        } else {
            PolicyUtils.assertPolicy(aim, SPConstants.NO_PASSWORD);
        }
        if (tok.isCreated() && (princ == null || princ.getCreatedTime() == null)) {
            ai.setNotAsserted("No Created Time");
        } else {
            PolicyUtils.assertPolicy(aim, SP13Constants.CREATED);
        }
        if (tok.isNonce() && princ.getNonce() == null) {
            ai.setNotAsserted("No Nonce");
        } else {
            PolicyUtils.assertPolicy(aim, SP13Constants.NONCE);
        }
    }
    PolicyUtils.assertPolicy(aim, SPConstants.USERNAME_TOKEN10);
    PolicyUtils.assertPolicy(aim, SPConstants.USERNAME_TOKEN11);
    PolicyUtils.assertPolicy(aim, SPConstants.SUPPORTING_TOKENS);
    if (signed || isTLSInUse(message)) {
        PolicyUtils.assertPolicy(aim, SPConstants.SIGNED_SUPPORTING_TOKENS);
    }
    return tok;
}