Examples with SecurityToken org.apache.cxf.ws.security.tokenstore.SecurityToken used on opensource projects

Example 86 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project ddf by codice.

the class RestSecurity method createSamlHeader.

/**
     * Creates an authorization header to be returned to the browser if the token was successfully
     * exchanged for a SAML assertion
     *
     * @param subject - {@link ddf.security.Subject} to create the header from
     */
private static String createSamlHeader(Subject subject) {
    String encodedSamlHeader = null;
    org.w3c.dom.Element samlToken = null;
    try {
        for (Object principal : subject.getPrincipals().asList()) {
            if (principal instanceof SecurityAssertion) {
                SecurityToken securityToken = ((SecurityAssertion) principal).getSecurityToken();
                samlToken = securityToken.getToken();
            }
        }
        if (samlToken != null) {
            SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlToken);
            String saml = assertion.assertionToString();
            encodedSamlHeader = SAML_HEADER_PREFIX + deflateAndBase64Encode(saml);
        }
    } catch (WSSecurityException | ArithmeticException | IOException e) {
        LOGGER.info("Unable to parse SAML assertion from subject.", e);
    }
    return encodedSamlHeader;
}

Example 87 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project ddf by codice.

the class SecurityAssertionImplTest method testSampleAssertion.

@Test
public void testSampleAssertion() throws Exception {
    Element issuedAssertion = this.readDocument("/saml.xml").getDocumentElement();
    String assertionId = issuedAssertion.getAttributeNodeNS(null, "ID").getNodeValue();
    SecurityToken token = new SecurityToken(assertionId, issuedAssertion, null);
    SecurityAssertionImpl assertion = new SecurityAssertionImpl(token);
    assertNotNull(assertion.getSecurityToken());
    assertEquals(token, assertion.getSecurityToken());
    assertEquals(ISSUER, assertion.getIssuer());
    assertEquals(PRINCIPAL, assertion.getPrincipal().getName());
    assertEquals(PRINCIPAL, assertion.getPrincipal().toString());
    assertEquals(NUM_ATTRIBUTES, assertion.getAttributeStatements().size());
    assertEquals(NUM_NAUTH, assertion.getAuthnStatements().size());
    assertEquals(DatatypeConverter.parseDateTime(BEFORE).getTimeInMillis(), assertion.getNotBefore().getTime());
    assertEquals(DatatypeConverter.parseDateTime(AFTER).getTimeInMillis(), assertion.getNotOnOrAfter().getTime());
    //we don't currently parse these
    //        assertEquals(NUM_AUTHZ, assertion.getAuthzDecisionStatements().size());
    assertNotNull(assertion.toString());
    assertTrue(assertion.isPresentlyValid());
}

Example 88 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project ddf by codice.

the class RestSecurityTest method testNotSetSubjectOnClient.

@Test
public void testNotSetSubjectOnClient() throws Exception {
    Element samlToken = readDocument("/saml.xml").getDocumentElement();
    Subject subject = mock(Subject.class);
    SecurityAssertion assertion = mock(SecurityAssertion.class);
    SecurityToken token = new SecurityToken(UUID.randomUUID().toString(), samlToken, new Date(), new Date());
    when(assertion.getSecurityToken()).thenReturn(token);
    when(subject.getPrincipals()).thenReturn(new SimplePrincipalCollection(assertion, "sts"));
    WebClient client = WebClient.create("http://example.org");
    RestSecurity.setSubjectOnClient(subject, client);
    assertNull(client.getHeaders().get(RestSecurity.AUTH_HEADER));
}

Example 89 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project ddf by codice.

the class SecurityAssertionImplTest method getSecurityAssertion.

private SecurityAssertionImpl getSecurityAssertion(Element issuedAssertion) {
    String assertionId = issuedAssertion.getAttributeNodeNS(null, "ID").getNodeValue();
    SecurityToken token = new SecurityToken(assertionId, issuedAssertion, null);
    return new SecurityAssertionImpl(token);
}

Example 90 with SecurityToken

use of org.apache.cxf.ws.security.tokenstore.SecurityToken in project ddf by codice.

the class LogoutRequestServiceTest method setup.

@Before
public void setup() throws ParserConfigurationException, SAXException, IOException {
    simpleSign = mock(SimpleSign.class);
    idpMetadata = mock(IdpMetadata.class);
    relayStates = mock(RelayStates.class);
    sessionFactory = mock(SessionFactory.class);
    request = mock(HttpServletRequest.class);
    logoutMessage = mock(LogoutMessage.class);
    encryptionService = mock(EncryptionService.class);
    session = mock(HttpSession.class);
    securityTokenHolder = mock(SecurityTokenHolder.class);
    Element issuedAssertion = readSamlAssertion().getDocumentElement();
    String assertionId = issuedAssertion.getAttributeNodeNS(null, "ID").getNodeValue();
    SecurityToken token = new SecurityToken(assertionId, issuedAssertion, null);
    when(securityTokenHolder.getSecurityToken("idp")).thenReturn(token);
    logoutRequestService = new MockLogoutRequestService(simpleSign, idpMetadata, relayStates);
    logoutRequestService.setEncryptionService(encryptionService);
    logoutRequestService.setLogOutPageTimeOut(LOGOUT_PAGE_TIMEOUT);
    logoutRequestService.setLogoutMessage(logoutMessage);
    logoutRequestService.setRequest(request);
    logoutRequestService.setSessionFactory(sessionFactory);
    logoutRequestService.init();
    when(sessionFactory.getOrCreateSession(request)).thenReturn(session);
    when(session.getAttribute(eq(SecurityConstants.SAML_ASSERTION))).thenReturn(securityTokenHolder);
    when(request.getRequestURL()).thenReturn(new StringBuffer("www.url.com/url"));
    when(idpMetadata.getSigningCertificate()).thenReturn("signingCertificate");
    when(idpMetadata.getSingleLogoutBinding()).thenReturn(SamlProtocol.REDIRECT_BINDING);
    when(idpMetadata.getSingleLogoutLocation()).thenReturn(redirectLogoutUrl);
    System.setProperty("security.audit.roles", "none");
}