Examples with BinarySecurity org.apache.wss4j.common.token.BinarySecurity used on opensource projects

Example 6 with BinarySecurity

use of org.apache.wss4j.common.token.BinarySecurity in project cxf by apache.

the class AbstractSupportingTokenPolicyValidator method processX509Tokens.

/**
 * Process X509 Tokens.
 */
protected boolean processX509Tokens(PolicyValidatorParameters parameters, boolean derived) {
    List<WSSecurityEngineResult> tokenResults = null;
    if (parameters.getResults().getActionResults().containsKey(WSConstants.BST)) {
        tokenResults = new ArrayList<>();
        for (WSSecurityEngineResult wser : parameters.getResults().getActionResults().get(WSConstants.BST)) {
            BinarySecurity binarySecurity = (BinarySecurity) wser.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
            if (binarySecurity instanceof X509Security || binarySecurity instanceof PKIPathSecurity) {
                tokenResults.add(wser);
            }
        }
    }
    if (tokenResults == null || tokenResults.isEmpty()) {
        return false;
    }
    if (isSigned() && !areTokensSigned(tokenResults, parameters.getSignedResults(), parameters.getEncryptedResults(), parameters.getMessage())) {
        return false;
    }
    if (isEncrypted() && !areTokensEncrypted(tokenResults, parameters.getEncryptedResults())) {
        return false;
    }
    if (derived && parameters.getResults().getActionResults().containsKey(WSConstants.DKT)) {
        List<WSSecurityEngineResult> dktResults = new ArrayList<>(tokenResults.size());
        for (WSSecurityEngineResult wser : tokenResults) {
            WSSecurityEngineResult resultToStore = processX509DerivedTokenResult(wser, parameters.getResults());
            if (resultToStore != null) {
                dktResults.add(resultToStore);
            }
        }
        tokenResults.addAll(dktResults);
    }
    if (isEndorsing() && !checkEndorsed(tokenResults, parameters.getSignedResults(), parameters.getMessage(), parameters.getTimestampElement())) {
        return false;
    }
    return validateSignedEncryptedPolicies(tokenResults, parameters.getSignedResults(), parameters.getEncryptedResults(), parameters.getMessage());
}

Example 7 with BinarySecurity

use of org.apache.wss4j.common.token.BinarySecurity in project cxf by apache.

the class DoubleItBSTImpl method doubleIt.

public int doubleIt(int numberToDouble) throws DoubleItFault {
    if (numberToDouble == 0) {
        throw new DoubleItFault("0 can't be doubled!");
    }
    List<WSHandlerResult> results = CastUtils.cast((List<?>) wsContext.getMessageContext().get(WSHandlerConstants.RECV_RESULTS));
    Assert.assertNotNull("Security Results cannot be null", results);
    Assert.assertFalse(results.isEmpty());
    WSHandlerResult result = results.get(0);
    List<WSSecurityEngineResult> securityResults = result.getResults();
    Assert.assertNotNull("Security Results cannot be null", securityResults);
    Assert.assertFalse(securityResults.isEmpty());
    WSSecurityEngineResult securityResult = securityResults.get(0);
    BinarySecurity binarySecurityToken = (BinarySecurity) securityResult.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
    Assert.assertNotNull(binarySecurityToken);
    Assert.assertArrayEquals(binarySecurityToken.getToken(), "This is a token".getBytes());
    return numberToDouble * 2;
}

Example 8 with BinarySecurity

use of org.apache.wss4j.common.token.BinarySecurity in project cxf by apache.

the class CustomBSTTokenProvider method createToken.

public TokenProviderResponse createToken(TokenProviderParameters tokenParameters) {
    try {
        Document doc = DOMUtils.getEmptyDocument();
        // Mock up a BinarySecurityToken
        String id = "BST-1234";
        BinarySecurity bst = new BinarySecurity(doc);
        bst.addWSSENamespace();
        bst.addWSUNamespace();
        bst.setID(id);
        bst.setValueType(TOKEN_TYPE);
        bst.setEncodingType(BASE64_NS);
        bst.setToken("12345678".getBytes());
        TokenProviderResponse response = new TokenProviderResponse();
        response.setToken(bst.getElement());
        response.setTokenId(id);
        return response;
    } catch (Exception e) {
        e.printStackTrace();
        throw new STSException("Can't serialize SAML assertion", e, STSException.REQUEST_FAILED);
    }
}

Example 9 with BinarySecurity

use of org.apache.wss4j.common.token.BinarySecurity in project cxf by apache.

the class AbstractBindingBuilder method addSignatureParts.

protected void addSignatureParts(List<SupportingToken> tokenList, List<WSEncryptionPart> sigParts) {
    boolean useSTRTransform = MessageUtils.getContextualBoolean(message, SecurityConstants.USE_STR_TRANSFORM, true);
    for (SupportingToken supportingToken : tokenList) {
        Object tempTok = supportingToken.getTokenImplementation();
        WSEncryptionPart part = null;
        if (tempTok instanceof WSSecSignature) {
            WSSecSignature tempSig = (WSSecSignature) tempTok;
            SecurityTokenReference secRef = tempSig.getSecurityTokenReference();
            if (WSS4JConstants.WSS_SAML_KI_VALUE_TYPE.equals(secRef.getKeyIdentifierValueType()) || WSS4JConstants.WSS_SAML2_KI_VALUE_TYPE.equals(secRef.getKeyIdentifierValueType())) {
                Element secRefElement = cloneElement(secRef.getElement());
                addSupportingElement(secRefElement);
                part = new WSEncryptionPart("STRTransform", null, "Element");
                part.setId(tempSig.getSecurityTokenReferenceURI());
                part.setElement(secRefElement);
            } else {
                if (tempSig.getBSTTokenId() != null) {
                    part = new WSEncryptionPart(tempSig.getBSTTokenId());
                    part.setElement(tempSig.getBinarySecurityTokenElement());
                }
            }
        } else if (tempTok instanceof WSSecUsernameToken) {
            WSSecUsernameToken unt = (WSSecUsernameToken) tempTok;
            part = new WSEncryptionPart(unt.getId());
            part.setElement(unt.getUsernameTokenElement());
        } else if (tempTok instanceof BinarySecurity) {
            BinarySecurity bst = (BinarySecurity) tempTok;
            part = new WSEncryptionPart(bst.getID());
            part.setElement(bst.getElement());
        } else if (tempTok instanceof SamlAssertionWrapper) {
            SamlAssertionWrapper assertionWrapper = (SamlAssertionWrapper) tempTok;
            Document doc = assertionWrapper.getElement().getOwnerDocument();
            boolean saml1 = assertionWrapper.getSaml1() != null;
            if (useSTRTransform) {
                // TODO We only support using a KeyIdentifier for the moment
                SecurityTokenReference secRef = createSTRForSamlAssertion(doc, assertionWrapper.getId(), saml1, false);
                Element clone = cloneElement(secRef.getElement());
                addSupportingElement(clone);
                part = new WSEncryptionPart("STRTransform", null, "Element");
                part.setId(secRef.getID());
                part.setElement(clone);
            } else {
                part = new WSEncryptionPart(assertionWrapper.getId());
                part.setElement(assertionWrapper.getElement());
            }
        } else if (tempTok instanceof WSSecurityTokenHolder) {
            SecurityToken token = ((WSSecurityTokenHolder) tempTok).getToken();
            String tokenType = token.getTokenType();
            if (WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType) || WSS4JConstants.WSS_SAML2_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML2_NS.equals(tokenType)) {
                Document doc = token.getToken().getOwnerDocument();
                boolean saml1 = WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType);
                String id = token.getId();
                if (id == null || "".equals(id)) {
                    if (saml1) {
                        id = token.getToken().getAttributeNS(null, "AssertionID");
                    } else {
                        id = token.getToken().getAttributeNS(null, "ID");
                    }
                }
                if (useSTRTransform) {
                    SecurityTokenReference secRef = createSTRForSamlAssertion(doc, id, saml1, false);
                    Element clone = cloneElement(secRef.getElement());
                    addSupportingElement(clone);
                    part = new WSEncryptionPart("STRTransform", null, "Element");
                    part.setId(secRef.getID());
                    part.setElement(clone);
                } else {
                    part = new WSEncryptionPart(id);
                    part.setElement(token.getToken());
                }
            } else {
                String id = XMLUtils.getIDFromReference(token.getId());
                part = new WSEncryptionPart(id);
                part.setElement(token.getToken());
            }
        } else {
            unassertPolicy(supportingToken.getToken(), "UnsupportedTokenInSupportingToken: " + tempTok);
        }
        if (part != null) {
            sigParts.add(part);
        }
    }
}

Example 10 with BinarySecurity

use of org.apache.wss4j.common.token.BinarySecurity in project cxf by apache.

the class AbstractBindingBuilder method getEncryptedKeyBuilder.

protected WSSecEncryptedKey getEncryptedKeyBuilder(AbstractToken token, SecretKey symmetricKey) throws WSSecurityException {
    WSSecEncryptedKey encrKey = new WSSecEncryptedKey(secHeader);
    encrKey.setIdAllocator(wssConfig.getIdAllocator());
    encrKey.setCallbackLookup(callbackLookup);
    encrKey.setAttachmentCallbackHandler(new AttachmentCallbackHandler(message));
    encrKey.setStoreBytesInAttachment(storeBytesInAttachment);
    Crypto crypto = getEncryptionCrypto();
    message.getExchange().put(SecurityConstants.ENCRYPT_CRYPTO, crypto);
    setKeyIdentifierType(encrKey, token);
    boolean alsoIncludeToken = false;
    // Find out do we also need to include the token as per the Inclusion requirement
    if (token instanceof X509Token && token.getIncludeTokenType() != IncludeTokenType.INCLUDE_TOKEN_NEVER && encrKey.getKeyIdentifierType() != WSConstants.BST_DIRECT_REFERENCE) {
        alsoIncludeToken = true;
    }
    String encrUser = setEncryptionUser(encrKey, token, false, crypto);
    AlgorithmSuiteType algType = binding.getAlgorithmSuite().getAlgorithmSuiteType();
    encrKey.setKeyEncAlgo(algType.getAsymmetricKeyWrap());
    encrKey.setMGFAlgorithm(algType.getMGFAlgo());
    encrKey.prepare(crypto, symmetricKey);
    if (alsoIncludeToken) {
        X509Certificate encCert = getEncryptCert(crypto, encrUser);
        BinarySecurity bstToken = new X509Security(saaj.getSOAPPart());
        ((X509Security) bstToken).setX509Certificate(encCert);
        bstToken.addWSUNamespace();
        bstToken.setID(wssConfig.getIdAllocator().createSecureId("X509-", encCert));
        WSSecurityUtil.prependChildElement(secHeader.getSecurityHeaderElement(), bstToken.getElement());
        bstElement = bstToken.getElement();
    }
    return encrKey;
}