Examples with WSSecurityEngineResult org.apache.wss4j.dom.engine.WSSecurityEngineResult used on opensource projects

Example 51 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class AsymmetricBindingHandler method setupEncryptedKey.

private void setupEncryptedKey(AbstractToken token) throws WSSecurityException {
    if (!isRequestor() && token.getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
        // If we already have them, simply return
        if (encryptedKeyId != null && encryptedKeyValue != null) {
            return;
        }
        // Use the secret from the incoming EncryptedKey element
        List<WSHandlerResult> results = CastUtils.cast((List<?>) message.getExchange().getInMessage().get(WSHandlerConstants.RECV_RESULTS));
        if (results != null) {
            WSSecurityEngineResult encryptedKeyResult = getEncryptedKeyResult();
            if (encryptedKeyResult != null) {
                encryptedKeyId = (String) encryptedKeyResult.get(WSSecurityEngineResult.TAG_ID);
                encryptedKeyValue = (byte[]) encryptedKeyResult.get(WSSecurityEngineResult.TAG_SECRET);
            }
            // Therefore we will create a new EncryptedKey
            if (encryptedKeyId == null && encryptedKeyValue == null) {
                createEncryptedKey(token);
            }
        } else {
            unassertPolicy(token, "No security results found");
        }
    } else {
        createEncryptedKey(token);
    }
}

Example 52 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class AsymmetricBindingHandler method getSAMLToken.

private String getSAMLToken() {
    List<WSHandlerResult> results = CastUtils.cast((List<?>) message.getExchange().getInMessage().get(WSHandlerConstants.RECV_RESULTS));
    for (WSHandlerResult rResult : results) {
        List<WSSecurityEngineResult> wsSecEngineResults = rResult.getResults();
        for (WSSecurityEngineResult wser : wsSecEngineResults) {
            Integer actInt = (Integer) wser.get(WSSecurityEngineResult.TAG_ACTION);
            if (actInt.intValue() == WSConstants.ST_SIGNED || actInt.intValue() == WSConstants.ST_UNSIGNED) {
                Instant created = Instant.now();
                Instant expires = created.plusSeconds(WSS4JUtils.getSecurityTokenLifetime(message) / 1000L);
                String id = (String) wser.get(WSSecurityEngineResult.TAG_ID);
                SecurityToken tempTok = new SecurityToken(id, created, expires);
                tempTok.setSecret((byte[]) wser.get(WSSecurityEngineResult.TAG_SECRET));
                tempTok.setX509Certificate((X509Certificate) wser.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE), null);
                SamlAssertionWrapper samlAssertion = (SamlAssertionWrapper) wser.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
                if (samlAssertion.getSamlVersion() == SAMLVersion.VERSION_20) {
                    tempTok.setTokenType(WSS4JConstants.WSS_SAML2_TOKEN_TYPE);
                } else {
                    tempTok.setTokenType(WSS4JConstants.WSS_SAML_TOKEN_TYPE);
                }
                message.put(SecurityConstants.TOKEN, tempTok);
                return id;
            }
        }
    }
    return null;
}

Example 53 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class SymmetricBindingHandler method getEncryptedKey.

private SecurityToken getEncryptedKey() {
    WSSecurityEngineResult encryptedKeyResult = getEncryptedKeyResult();
    if (encryptedKeyResult != null) {
        // Store it in the cache
        Instant created = Instant.now();
        Instant expires = created.plusSeconds(WSS4JUtils.getSecurityTokenLifetime(message) / 1000L);
        String encryptedKeyID = (String) encryptedKeyResult.get(WSSecurityEngineResult.TAG_ID);
        SecurityToken securityToken = new SecurityToken(encryptedKeyID, created, expires);
        securityToken.setSecret((byte[]) encryptedKeyResult.get(WSSecurityEngineResult.TAG_SECRET));
        securityToken.setSHA1(getSHA1((byte[]) encryptedKeyResult.get(WSSecurityEngineResult.TAG_ENCRYPTED_EPHEMERAL_KEY)));
        return securityToken;
    }
    return null;
}

Example 54 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class UsernameTokenInterceptor method processToken.

protected void processToken(SoapMessage message) {
    Header h = findSecurityHeader(message, false);
    if (h == null) {
        return;
    }
    boolean utWithCallbacks = MessageUtils.getContextualBoolean(message, SecurityConstants.VALIDATE_TOKEN, true);
    Element el = (Element) h.getObject();
    Element child = DOMUtils.getFirstElement(el);
    while (child != null) {
        if (SPConstants.USERNAME_TOKEN.equals(child.getLocalName()) && WSS4JConstants.WSSE_NS.equals(child.getNamespaceURI())) {
            try {
                boolean bspCompliant = isWsiBSPCompliant(message);
                boolean allowNSPasswdTypes = allowNamespaceQualifiedPWDTypes(message);
                Principal principal;
                Subject subject = null;
                Object transformedToken = null;
                if (utWithCallbacks) {
                    final WSSecurityEngineResult result = validateToken(child, message);
                    subject = (Subject) result.get(WSSecurityEngineResult.TAG_SUBJECT);
                    transformedToken = result.get(WSSecurityEngineResult.TAG_TRANSFORMED_TOKEN);
                    principal = (Principal) result.get(WSSecurityEngineResult.TAG_PRINCIPAL);
                    if (principal == null) {
                        principal = parseTokenAndCreatePrincipal(child, bspCompliant, allowNSPasswdTypes);
                    }
                } else {
                    principal = parseTokenAndCreatePrincipal(child, bspCompliant, allowNSPasswdTypes);
                    WSS4JTokenConverter.convertToken(message, principal);
                }
                SecurityContext sc = message.get(SecurityContext.class);
                if (sc == null || sc.getUserPrincipal() == null) {
                    if (transformedToken instanceof SamlAssertionWrapper) {
                        message.put(SecurityContext.class, createSecurityContext(message, (SamlAssertionWrapper) transformedToken));
                    } else if (subject != null && principal != null) {
                        message.put(SecurityContext.class, createSecurityContext(principal, subject));
                    } else {
                        UsernameTokenPrincipal utPrincipal = (UsernameTokenPrincipal) principal;
                        String nonce = null;
                        if (utPrincipal.getNonce() != null) {
                            nonce = XMLUtils.encodeToString(utPrincipal.getNonce());
                        }
                        subject = createSubject(utPrincipal.getName(), utPrincipal.getPassword(), utPrincipal.isPasswordDigest(), nonce, utPrincipal.getCreatedTime());
                        message.put(SecurityContext.class, createSecurityContext(utPrincipal, subject));
                    }
                }
                if (principal instanceof UsernameTokenPrincipal) {
                    storeResults((UsernameTokenPrincipal) principal, subject, message);
                }
            } catch (WSSecurityException | Base64DecodingException ex) {
                throw new Fault(ex);
            }
        }
        child = DOMUtils.getNextElement(child);
    }
}

Example 55 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class UsernameTokenInterceptor method validateToken.

protected WSSecurityEngineResult validateToken(Element tokenElement, final SoapMessage message) throws WSSecurityException, Base64DecodingException {
    boolean bspCompliant = isWsiBSPCompliant(message);
    boolean allowNoPassword = isAllowNoPassword(message.get(AssertionInfoMap.class));
    UsernameTokenProcessor p = new UsernameTokenProcessor();
    RequestData data = new CXFRequestData();
    Object o = SecurityUtils.getSecurityPropertyValue(SecurityConstants.CALLBACK_HANDLER, message);
    try {
        data.setCallbackHandler(SecurityUtils.getCallbackHandler(o));
    } catch (Exception ex) {
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, ex);
    }
    data.setMsgContext(message);
    // Configure replay caching
    ReplayCache nonceCache = WSS4JUtils.getReplayCache(message, SecurityConstants.ENABLE_NONCE_CACHE, SecurityConstants.NONCE_CACHE_INSTANCE);
    data.setNonceReplayCache(nonceCache);
    data.setAllowUsernameTokenNoPassword(allowNoPassword);
    data.setWssConfig(WSSConfig.getNewInstance());
    if (!bspCompliant) {
        data.setDisableBSPEnforcement(true);
    }
    data.setMsgContext(message);
    WSDocInfo wsDocInfo = new WSDocInfo(tokenElement.getOwnerDocument());
    data.setWsDocInfo(wsDocInfo);
    try {
        List<WSSecurityEngineResult> results = p.handleToken(tokenElement, data);
        return results.get(0);
    } catch (WSSecurityException ex) {
        throw WSS4JUtils.createSoapFault(message, message.getVersion(), ex);
    }
}