Examples with EntropyType org.apache.cxf.ws.security.sts.provider.model.EntropyType used on opensource projects

Example 1 with EntropyType

use of org.apache.cxf.ws.security.sts.provider.model.EntropyType in project cxf by apache.

the class RequestParser method parseKeyRequirements.

/**
 * Parse the Key and Encryption requirements into the KeyRequirements argument.
 */
private static boolean parseKeyRequirements(JAXBElement<?> jaxbElement, KeyRequirements keyRequirements, Map<String, Object> messageContext, STSPropertiesMBean stsProperties) {
    if (QNameConstants.AUTHENTICATION_TYPE.equals(jaxbElement.getName())) {
        String authenticationType = (String) jaxbElement.getValue();
        keyRequirements.setAuthenticationType(authenticationType);
    } else if (QNameConstants.KEY_TYPE.equals(jaxbElement.getName())) {
        String keyType = (String) jaxbElement.getValue();
        keyRequirements.setKeyType(keyType);
    } else if (QNameConstants.KEY_SIZE.equals(jaxbElement.getName())) {
        long keySize = ((Long) jaxbElement.getValue()).longValue();
        keyRequirements.setKeySize(keySize);
    } else if (QNameConstants.SIGNATURE_ALGORITHM.equals(jaxbElement.getName())) {
        String signatureAlgorithm = (String) jaxbElement.getValue();
        keyRequirements.setSignatureAlgorithm(signatureAlgorithm);
    } else if (QNameConstants.ENCRYPTION_ALGORITHM.equals(jaxbElement.getName())) {
        String encryptionAlgorithm = (String) jaxbElement.getValue();
        keyRequirements.setEncryptionAlgorithm(encryptionAlgorithm);
    } else if (QNameConstants.C14N_ALGORITHM.equals(jaxbElement.getName())) {
        String c14nAlgorithm = (String) jaxbElement.getValue();
        keyRequirements.setC14nAlgorithm(c14nAlgorithm);
    } else if (QNameConstants.COMPUTED_KEY_ALGORITHM.equals(jaxbElement.getName())) {
        String computedKeyAlgorithm = (String) jaxbElement.getValue();
        keyRequirements.setComputedKeyAlgorithm(computedKeyAlgorithm);
    } else if (QNameConstants.KEYWRAP_ALGORITHM.equals(jaxbElement.getName())) {
        String keywrapAlgorithm = (String) jaxbElement.getValue();
        keyRequirements.setKeywrapAlgorithm(keywrapAlgorithm);
    } else if (QNameConstants.USE_KEY.equals(jaxbElement.getName())) {
        UseKeyType useKey = (UseKeyType) jaxbElement.getValue();
        ReceivedCredential receivedCredential = parseUseKey(useKey, messageContext);
        keyRequirements.setReceivedCredential(receivedCredential);
    } else if (QNameConstants.ENTROPY.equals(jaxbElement.getName())) {
        EntropyType entropyType = (EntropyType) jaxbElement.getValue();
        Entropy entropy = parseEntropy(entropyType, stsProperties);
        keyRequirements.setEntropy(entropy);
    } else if (QNameConstants.SIGN_WITH.equals(jaxbElement.getName())) {
        String signWith = (String) jaxbElement.getValue();
        keyRequirements.setSignWith(signWith);
    } else if (QNameConstants.ENCRYPT_WITH.equals(jaxbElement.getName())) {
        String encryptWith = (String) jaxbElement.getValue();
        keyRequirements.setEncryptWith(encryptWith);
    } else if (QNameConstants.REQUEST_TYPE.equals(jaxbElement.getName())) {
    // NOPMD
    // Skip the request type.
    } else {
        return false;
    }
    return true;
}

Example 2 with EntropyType

use of org.apache.cxf.ws.security.sts.provider.model.EntropyType in project cxf by apache.

the class IssueSamlUnitTest method testIssueSaml2SymmetricKeyTokenSecretKey.

/**
 * Test to successfully issue a Saml2 SymmetricKey token. Rather than using a Nonce as the
 * Entropy, a secret key is supplied by the client instead.
 */
@org.junit.Test
public void testIssueSaml2SymmetricKeyTokenSecretKey() throws Exception {
    TokenIssueOperation issueOperation = new TokenIssueOperation();
    // Add Token Provider
    issueOperation.setTokenProviders(Collections.singletonList(new SAMLTokenProvider()));
    // Add Service
    ServiceMBean service = new StaticService();
    service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
    issueOperation.setServices(Collections.singletonList(service));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    issueOperation.setStsProperties(stsProperties);
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
    request.getAny().add(tokenType);
    JAXBElement<String> keyType = new JAXBElement<String>(QNameConstants.KEY_TYPE, String.class, STSConstants.SYMMETRIC_KEY_KEYTYPE);
    request.getAny().add(keyType);
    request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    Principal principal = new CustomTokenPrincipal("alice");
    msgCtx.put(SecurityContext.class.getName(), createSecurityContext(principal));
    // Now add Entropy
    BinarySecretType binarySecretType = new BinarySecretType();
    binarySecretType.setType(STSConstants.SYMMETRIC_KEY_TYPE);
    binarySecretType.setValue(WSSecurityUtil.generateNonce(256 / 8));
    JAXBElement<BinarySecretType> binarySecretTypeJaxb = new JAXBElement<BinarySecretType>(QNameConstants.BINARY_SECRET, BinarySecretType.class, binarySecretType);
    EntropyType entropyType = new EntropyType();
    entropyType.getAny().add(binarySecretTypeJaxb);
    JAXBElement<EntropyType> entropyJaxbType = new JAXBElement<>(QNameConstants.ENTROPY, EntropyType.class, entropyType);
    request.getAny().add(entropyJaxbType);
    RequestSecurityTokenResponseCollectionType response = issueOperation.issue(request, principal, msgCtx);
    List<RequestSecurityTokenResponseType> securityTokenResponse = response.getRequestSecurityTokenResponse();
    assertFalse(securityTokenResponse.isEmpty());
    // Test the generated token.
    Element assertion = null;
    for (Object tokenObject : securityTokenResponse.get(0).getAny()) {
        if (tokenObject instanceof JAXBElement<?> && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>) tokenObject).getName())) {
            RequestedSecurityTokenType rstType = (RequestedSecurityTokenType) ((JAXBElement<?>) tokenObject).getValue();
            assertion = (Element) rstType.getAny();
        }
    }
    assertNotNull(assertion);
    String tokenString = DOM2Writer.nodeToString(assertion);
    assertTrue(tokenString.contains("AttributeStatement"));
    assertTrue(tokenString.contains("alice"));
    assertFalse(tokenString.contains(SAML2Constants.CONF_BEARER));
    assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));
}

Example 3 with EntropyType

use of org.apache.cxf.ws.security.sts.provider.model.EntropyType in project cxf by apache.

the class IssueSamlUnitTest method testIssueSaml2SymmetricKeyToken.

/**
 * Test to successfully issue a Saml2 SymmetricKey token.
 */
@org.junit.Test
public void testIssueSaml2SymmetricKeyToken() throws Exception {
    TokenIssueOperation issueOperation = new TokenIssueOperation();
    // Add Token Provider
    issueOperation.setTokenProviders(Collections.singletonList(new SAMLTokenProvider()));
    // Add Service
    ServiceMBean service = new StaticService();
    service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
    issueOperation.setServices(Collections.singletonList(service));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    issueOperation.setStsProperties(stsProperties);
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
    request.getAny().add(tokenType);
    JAXBElement<String> keyType = new JAXBElement<String>(QNameConstants.KEY_TYPE, String.class, STSConstants.SYMMETRIC_KEY_KEYTYPE);
    request.getAny().add(keyType);
    JAXBElement<String> computedKey = new JAXBElement<String>(QNameConstants.COMPUTED_KEY_ALGORITHM, String.class, STSConstants.COMPUTED_KEY_PSHA1);
    request.getAny().add(computedKey);
    request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    Principal principal = new CustomTokenPrincipal("alice");
    msgCtx.put(SecurityContext.class.getName(), createSecurityContext(principal));
    // Now add Entropy
    BinarySecretType binarySecretType = new BinarySecretType();
    binarySecretType.setType(STSConstants.NONCE_TYPE);
    binarySecretType.setValue(WSSecurityUtil.generateNonce(256 / 8));
    JAXBElement<BinarySecretType> binarySecretTypeJaxb = new JAXBElement<BinarySecretType>(QNameConstants.BINARY_SECRET, BinarySecretType.class, binarySecretType);
    EntropyType entropyType = new EntropyType();
    entropyType.getAny().add(binarySecretTypeJaxb);
    JAXBElement<EntropyType> entropyJaxbType = new JAXBElement<>(QNameConstants.ENTROPY, EntropyType.class, entropyType);
    request.getAny().add(entropyJaxbType);
    RequestSecurityTokenResponseCollectionType response = issueOperation.issue(request, principal, msgCtx);
    List<RequestSecurityTokenResponseType> securityTokenResponse = response.getRequestSecurityTokenResponse();
    assertFalse(securityTokenResponse.isEmpty());
    // Test the generated token.
    Element assertion = null;
    for (Object tokenObject : securityTokenResponse.get(0).getAny()) {
        if (tokenObject instanceof JAXBElement<?> && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>) tokenObject).getName())) {
            RequestedSecurityTokenType rstType = (RequestedSecurityTokenType) ((JAXBElement<?>) tokenObject).getValue();
            assertion = (Element) rstType.getAny();
            break;
        }
    }
    assertNotNull(assertion);
    String tokenString = DOM2Writer.nodeToString(assertion);
    assertTrue(tokenString.contains("AttributeStatement"));
    assertTrue(tokenString.contains("alice"));
    assertFalse(tokenString.contains(SAML2Constants.CONF_BEARER));
    assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));
}

Example 4 with EntropyType

use of org.apache.cxf.ws.security.sts.provider.model.EntropyType in project cxf by apache.

the class IssueSamlUnitTest method testIssueSaml2SymmetricKeyTokenEncryptedKey.

/**
 * Test to successfully issue a Saml2 SymmetricKey token. Rather than using a Nonce as the Entropy,
 * a secret key is supplied by the client instead in an EncryptedKey structure.
 */
@org.junit.Test
public void testIssueSaml2SymmetricKeyTokenEncryptedKey() throws Exception {
    TokenIssueOperation issueOperation = new TokenIssueOperation();
    // Add Token Provider
    issueOperation.setTokenProviders(Collections.singletonList(new SAMLTokenProvider()));
    // Add Service
    ServiceMBean service = new StaticService();
    service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
    issueOperation.setServices(Collections.singletonList(service));
    // Add STSProperties object
    STSPropertiesMBean stsProperties = new StaticSTSProperties();
    Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());
    stsProperties.setEncryptionCrypto(crypto);
    stsProperties.setSignatureCrypto(crypto);
    stsProperties.setEncryptionUsername("myservicekey");
    stsProperties.setSignatureUsername("mystskey");
    stsProperties.setCallbackHandler(new PasswordCallbackHandler());
    stsProperties.setIssuer("STS");
    issueOperation.setStsProperties(stsProperties);
    // Mock up a request
    RequestSecurityTokenType request = new RequestSecurityTokenType();
    JAXBElement<String> tokenType = new JAXBElement<String>(QNameConstants.TOKEN_TYPE, String.class, WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
    request.getAny().add(tokenType);
    JAXBElement<String> keyType = new JAXBElement<String>(QNameConstants.KEY_TYPE, String.class, STSConstants.SYMMETRIC_KEY_KEYTYPE);
    request.getAny().add(keyType);
    request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));
    // Mock up message context
    MessageImpl msg = new MessageImpl();
    WrappedMessageContext msgCtx = new WrappedMessageContext(msg);
    Principal principal = new CustomTokenPrincipal("alice");
    msgCtx.put(SecurityContext.class.getName(), createSecurityContext(principal));
    // Now add Entropy
    Document doc = DOMUtils.createDocument();
    WSSecEncryptedKey builder = new WSSecEncryptedKey(doc);
    builder.setUserInfo("mystskey");
    builder.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);
    builder.setKeyEncAlgo(WSS4JConstants.KEYTRANSPORT_RSAOAEP);
    KeyGenerator keyGen = KeyUtils.getKeyGenerator(WSConstants.AES_128);
    SecretKey symmetricKey = keyGen.generateKey();
    builder.prepare(stsProperties.getSignatureCrypto(), symmetricKey);
    Element encryptedKeyElement = builder.getEncryptedKeyElement();
    byte[] secret = symmetricKey.getEncoded();
    EntropyType entropyType = new EntropyType();
    entropyType.getAny().add(encryptedKeyElement);
    JAXBElement<EntropyType> entropyJaxbType = new JAXBElement<>(QNameConstants.ENTROPY, EntropyType.class, entropyType);
    request.getAny().add(entropyJaxbType);
    RequestSecurityTokenResponseCollectionType response = issueOperation.issue(request, principal, msgCtx);
    List<RequestSecurityTokenResponseType> securityTokenResponse = response.getRequestSecurityTokenResponse();
    assertFalse(securityTokenResponse.isEmpty());
    // Test the generated token.
    Element assertion = null;
    for (Object tokenObject : securityTokenResponse.get(0).getAny()) {
        if (tokenObject instanceof JAXBElement<?> && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>) tokenObject).getName())) {
            RequestedSecurityTokenType rstType = (RequestedSecurityTokenType) ((JAXBElement<?>) tokenObject).getValue();
            assertion = (Element) rstType.getAny();
        }
    }
    assertNotNull(assertion);
    String tokenString = DOM2Writer.nodeToString(assertion);
    assertTrue(tokenString.contains("AttributeStatement"));
    assertTrue(tokenString.contains("alice"));
    assertFalse(tokenString.contains(SAML2Constants.CONF_BEARER));
    assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));
    // Test that the (encrypted) secret sent in Entropy was used in the SAML Subject KeyInfo
    SamlAssertionWrapper assertionWrapper = new SamlAssertionWrapper(assertion);
    RequestData data = new RequestData();
    Properties properties = new Properties();
    properties.put("org.apache.wss4j.crypto.provider", "org.apache.wss4j.common.crypto.Merlin");
    properties.put("org.apache.wss4j.crypto.merlin.keystore.password", "sspass");
    properties.put("org.apache.wss4j.crypto.merlin.keystore.file", "keys/servicestore.jks");
    data.setDecCrypto(CryptoFactory.getInstance(properties));
    data.setCallbackHandler(new PasswordCallbackHandler());
    data.setWssConfig(WSSConfig.getNewInstance());
    data.setWsDocInfo(new WSDocInfo(assertion.getOwnerDocument()));
    assertionWrapper.parseSubject(new WSSSAMLKeyInfoProcessor(data), data.getSigVerCrypto(), data.getCallbackHandler());
    SAMLKeyInfo samlKeyInfo = assertionWrapper.getSubjectKeyInfo();
    assertArrayEquals(secret, samlKeyInfo.getSecret());
}

Example 5 with EntropyType

use of org.apache.cxf.ws.security.sts.provider.model.EntropyType in project cxf by apache.

the class TokenIssueOperation method createResponse.

protected RequestSecurityTokenResponseType createResponse(EncryptionProperties encryptionProperties, TokenProviderResponse tokenResponse, TokenRequirements tokenRequirements, KeyRequirements keyRequirements) throws WSSecurityException {
    RequestSecurityTokenResponseType response = QNameConstants.WS_TRUST_FACTORY.createRequestSecurityTokenResponseType();
    String context = tokenRequirements.getContext();
    if (context != null) {
        response.setContext(context);
    }
    // TokenType
    JAXBElement<String> jaxbTokenType = QNameConstants.WS_TRUST_FACTORY.createTokenType(tokenRequirements.getTokenType());
    response.getAny().add(jaxbTokenType);
    // RequestedSecurityToken
    RequestedSecurityTokenType requestedTokenType = QNameConstants.WS_TRUST_FACTORY.createRequestedSecurityTokenType();
    JAXBElement<RequestedSecurityTokenType> requestedToken = QNameConstants.WS_TRUST_FACTORY.createRequestedSecurityToken(requestedTokenType);
    tokenWrapper.wrapToken(tokenResponse.getToken(), requestedTokenType);
    response.getAny().add(requestedToken);
    if (returnReferences) {
        // RequestedAttachedReference
        TokenReference attachedReference = tokenResponse.getAttachedReference();
        final RequestedReferenceType requestedAttachedReferenceType;
        if (attachedReference != null) {
            requestedAttachedReferenceType = createRequestedReference(attachedReference, true);
        } else {
            requestedAttachedReferenceType = createRequestedReference(tokenResponse.getTokenId(), tokenRequirements.getTokenType(), true);
        }
        JAXBElement<RequestedReferenceType> requestedAttachedReference = QNameConstants.WS_TRUST_FACTORY.createRequestedAttachedReference(requestedAttachedReferenceType);
        response.getAny().add(requestedAttachedReference);
        // RequestedUnattachedReference
        TokenReference unAttachedReference = tokenResponse.getUnAttachedReference();
        final RequestedReferenceType requestedUnattachedReferenceType;
        if (unAttachedReference != null) {
            requestedUnattachedReferenceType = createRequestedReference(unAttachedReference, false);
        } else {
            requestedUnattachedReferenceType = createRequestedReference(tokenResponse.getTokenId(), tokenRequirements.getTokenType(), false);
        }
        JAXBElement<RequestedReferenceType> requestedUnattachedReference = QNameConstants.WS_TRUST_FACTORY.createRequestedUnattachedReference(requestedUnattachedReferenceType);
        response.getAny().add(requestedUnattachedReference);
    }
    // AppliesTo
    response.getAny().add(tokenRequirements.getAppliesTo());
    // RequestedProofToken
    if (tokenResponse.isComputedKey() && keyRequirements.getComputedKeyAlgorithm() != null) {
        JAXBElement<String> computedKey = QNameConstants.WS_TRUST_FACTORY.createComputedKey(keyRequirements.getComputedKeyAlgorithm());
        RequestedProofTokenType requestedProofTokenType = QNameConstants.WS_TRUST_FACTORY.createRequestedProofTokenType();
        requestedProofTokenType.setAny(computedKey);
        JAXBElement<RequestedProofTokenType> requestedProofToken = QNameConstants.WS_TRUST_FACTORY.createRequestedProofToken(requestedProofTokenType);
        response.getAny().add(requestedProofToken);
    } else if (tokenResponse.getEntropy() != null) {
        Object token = constructSecretToken(tokenResponse.getEntropy(), encryptionProperties, keyRequirements);
        RequestedProofTokenType requestedProofTokenType = QNameConstants.WS_TRUST_FACTORY.createRequestedProofTokenType();
        requestedProofTokenType.setAny(token);
        JAXBElement<RequestedProofTokenType> requestedProofToken = QNameConstants.WS_TRUST_FACTORY.createRequestedProofToken(requestedProofTokenType);
        response.getAny().add(requestedProofToken);
    }
    // Entropy
    if (tokenResponse.isComputedKey() && tokenResponse.getEntropy() != null) {
        Object token = constructSecretToken(tokenResponse.getEntropy(), encryptionProperties, keyRequirements);
        EntropyType entropyType = QNameConstants.WS_TRUST_FACTORY.createEntropyType();
        entropyType.getAny().add(token);
        JAXBElement<EntropyType> entropyElement = QNameConstants.WS_TRUST_FACTORY.createEntropy(entropyType);
        response.getAny().add(entropyElement);
    }
    // Lifetime
    if (includeLifetimeElement) {
        LifetimeType lifetime = createLifetime(tokenResponse.getCreated(), tokenResponse.getExpires());
        JAXBElement<LifetimeType> lifetimeType = QNameConstants.WS_TRUST_FACTORY.createLifetime(lifetime);
        response.getAny().add(lifetimeType);
    }
    // KeySize
    long keySize = tokenResponse.getKeySize();
    if (keySize <= 0) {
        keySize = keyRequirements.getKeySize();
    }
    if (keyRequirements.getKeySize() > 0) {
        JAXBElement<Long> keySizeType = QNameConstants.WS_TRUST_FACTORY.createKeySize(keySize);
        response.getAny().add(keySizeType);
    }
    return response;
}