Examples with WSSecurityEngineResult org.apache.wss4j.dom.engine.WSSecurityEngineResult used on opensource projects

Example 56 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class IssuedTokenPolicyValidator method validatePolicies.

/**
 * Validate policies.
 */
public void validatePolicies(PolicyValidatorParameters parameters, Collection<AssertionInfo> ais) {
    List<WSSecurityEngineResult> samlResults = parameters.getSamlResults();
    if (samlResults != null) {
        for (WSSecurityEngineResult samlResult : samlResults) {
            SamlAssertionWrapper samlAssertion = (SamlAssertionWrapper) samlResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
            if (validateSAMLToken(parameters, samlAssertion, ais)) {
                // Store token on the security context
                SecurityToken token = createSecurityToken(samlAssertion);
                parameters.getMessage().getExchange().put(SecurityConstants.TOKEN, token);
                return;
            }
        }
    }
    List<WSSecurityEngineResult> bstResults = parameters.getResults().getActionResults().get(WSConstants.BST);
    if (bstResults != null) {
        for (WSSecurityEngineResult bstResult : bstResults) {
            BinarySecurity binarySecurity = (BinarySecurity) bstResult.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
            if (Boolean.TRUE.equals(bstResult.get(WSSecurityEngineResult.TAG_VALIDATED_TOKEN)) && validateBinarySecurityToken(parameters, binarySecurity, ais)) {
                // Store token on the security context
                SecurityToken token = createSecurityToken(binarySecurity);
                parameters.getMessage().getExchange().put(SecurityConstants.TOKEN, token);
                return;
            }
        }
    }
}

Example 57 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class AbstractBindingPolicyValidator method isEncryptedBeforeSigned.

/**
 * Check to see if encryption was applied before signature.
 * Note that results are stored in the reverse order.
 */
private boolean isEncryptedBeforeSigned(List<WSSecurityEngineResult> results) {
    boolean encrypted = false;
    for (WSSecurityEngineResult result : results) {
        Integer actInt = (Integer) result.get(WSSecurityEngineResult.TAG_ACTION);
        List<WSDataRef> el = CastUtils.cast((List<?>) result.get(WSSecurityEngineResult.TAG_DATA_REF_URIS));
        if (actInt.intValue() == WSConstants.ENCR && el != null) {
            encrypted = true;
        }
        // Don't count an endorsing signature
        if (actInt.intValue() == WSConstants.SIGN && el != null && !(el.size() == 1 && el.get(0).getName().equals(SIG_QNAME))) {
            return encrypted;
        }
    }
    return false;
}

Example 58 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class AbstractBindingPolicyValidator method isSignatureEncrypted.

/**
 * Check whether the primary Signature (and all SignatureConfirmation) elements were encrypted
 */
protected boolean isSignatureEncrypted(List<WSSecurityEngineResult> results) {
    boolean foundPrimarySignature = false;
    for (int i = results.size() - 1; i >= 0; i--) {
        WSSecurityEngineResult result = results.get(i);
        Integer actInt = (Integer) result.get(WSSecurityEngineResult.TAG_ACTION);
        if (actInt.intValue() == WSConstants.SIGN && !foundPrimarySignature) {
            foundPrimarySignature = true;
            Element sigElement = (Element) result.get(WSSecurityEngineResult.TAG_TOKEN_ELEMENT);
            if (sigElement == null || !isElementEncrypted(sigElement, results)) {
                return false;
            }
        } else if (actInt.intValue() == WSConstants.SC) {
            Element sigElement = (Element) result.get(WSSecurityEngineResult.TAG_TOKEN_ELEMENT);
            if (sigElement == null || !isElementEncrypted(sigElement, results)) {
                return false;
            }
        }
    }
    return true;
}

Example 59 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class AbstractBindingPolicyValidator method isTokenProtected.

/**
 * Check whether the token protection policy is followed. In other words, check that the
 * signature token was itself signed.
 */
protected boolean isTokenProtected(List<WSSecurityEngineResult> results, List<WSSecurityEngineResult> signedResults) {
    for (WSSecurityEngineResult result : signedResults) {
        // Get the Token result that was used for the signature
        WSSecurityEngineResult tokenResult = findCorrespondingToken(result, results);
        if (tokenResult == null) {
            return false;
        }
        // Now go through what was signed and see if the token itself was signed
        List<WSDataRef> sl = CastUtils.cast((List<?>) result.get(WSSecurityEngineResult.TAG_DATA_REF_URIS));
        boolean found = false;
        if (sl != null) {
            for (WSDataRef dataRef : sl) {
                Element referenceElement = dataRef.getProtectedElement();
                if (referenceElement != null && referenceElement.equals(tokenResult.get(WSSecurityEngineResult.TAG_TOKEN_ELEMENT))) {
                    found = true;
                }
            }
        }
        if (!found) {
            return false;
        }
    }
    return true;
}

Example 60 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class AbstractSupportingTokenPolicyValidator method processUsernameTokens.

/**
 * Process UsernameTokens.
 */
protected boolean processUsernameTokens(PolicyValidatorParameters parameters, boolean derived) {
    if (!parameters.isUtWithCallbacks()) {
        return true;
    }
    if (parameters.getUsernameTokenResults().isEmpty()) {
        return false;
    }
    List<WSSecurityEngineResult> tokenResults = new ArrayList<>();
    tokenResults.addAll(parameters.getUsernameTokenResults());
    if (isSigned() && !areTokensSigned(tokenResults, parameters.getSignedResults(), parameters.getEncryptedResults(), parameters.getMessage())) {
        return false;
    }
    if (isEncrypted() && !areTokensEncrypted(tokenResults, parameters.getEncryptedResults())) {
        return false;
    }
    if (derived && parameters.getResults().getActionResults().containsKey(WSConstants.DKT)) {
        for (WSSecurityEngineResult wser : parameters.getUsernameTokenResults()) {
            byte[] secret = (byte[]) wser.get(WSSecurityEngineResult.TAG_SECRET);
            if (secret != null) {
                WSSecurityEngineResult dktResult = getMatchingDerivedKey(secret, parameters.getResults());
                if (dktResult != null) {
                    tokenResults.add(dktResult);
                }
            }
        }
    }
    return !((isEndorsing() && !checkEndorsed(tokenResults, parameters.getSignedResults(), parameters.getMessage(), parameters.getTimestampElement())) || !validateSignedEncryptedPolicies(tokenResults, parameters.getSignedResults(), parameters.getEncryptedResults(), parameters.getMessage()));
}