Examples with WSSecurityEngineResult org.apache.wss4j.dom.engine.WSSecurityEngineResult used on opensource projects

Example 76 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class SamlTokenTest method testSaml1TokenWithRoles.

/**
 * This test creates a SAML1 Assertion and sends it in the security header to the provider.
 */
@Test
public void testSaml1TokenWithRoles() throws Exception {
    Map<String, Object> outProperties = new HashMap<>();
    outProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.SAML_TOKEN_UNSIGNED);
    outProperties.put(ConfigurationConstants.SIG_KEY_ID, "DirectReference");
    outProperties.put(ConfigurationConstants.USER, "alice");
    outProperties.put("password", "password");
    outProperties.put(ConfigurationConstants.SIG_PROP_FILE, "alice.properties");
    SAML1CallbackHandler callbackHandler = new SAML1CallbackHandler();
    callbackHandler.setConfirmationMethod(SAML1Constants.CONF_HOLDER_KEY);
    callbackHandler.setSignAssertion(true);
    callbackHandler.setStatement(Statement.ATTR);
    callbackHandler.setConfirmationMethod(SAML1Constants.CONF_BEARER);
    outProperties.put(ConfigurationConstants.SAML_CALLBACK_REF, callbackHandler);
    Map<String, Object> inProperties = new HashMap<>();
    inProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.SAML_TOKEN_SIGNED);
    inProperties.put(ConfigurationConstants.SIG_VER_PROP_FILE, "insecurity.properties");
    final Map<QName, Object> customMap = new HashMap<>();
    CustomSamlValidator validator = new CustomSamlValidator();
    validator.setRequireSAML1Assertion(true);
    validator.setRequireSenderVouches(false);
    validator.setRequireBearer(true);
    customMap.put(WSConstants.SAML_TOKEN, validator);
    customMap.put(WSConstants.SAML2_TOKEN, validator);
    inProperties.put(WSS4JInInterceptor.VALIDATOR_MAP, customMap);
    List<String> xpaths = Arrays.asList("//wsse:Security", "//wsse:Security/saml1:Assertion");
    Map<String, String> inMessageProperties = new HashMap<>();
    inMessageProperties.put(SecurityConstants.VALIDATE_SAML_SUBJECT_CONFIRMATION, "false");
    Message message = makeInvocation(outProperties, xpaths, inProperties, inMessageProperties);
    final List<WSHandlerResult> handlerResults = CastUtils.cast((List<?>) message.get(WSHandlerConstants.RECV_RESULTS));
    SecurityContext sc = message.get(SecurityContext.class);
    assertNotNull(sc);
    assertTrue(sc.isUserInRole("user"));
    assertTrue(sc.isUserInRole("admin"));
    WSSecurityEngineResult actionResult = handlerResults.get(0).getActionResults().get(WSConstants.ST_SIGNED).get(0);
    SamlAssertionWrapper receivedAssertion = (SamlAssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
    assertTrue(receivedAssertion != null && receivedAssertion.getSaml1() != null);
    assertTrue(receivedAssertion.isSigned());
}

Example 77 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class WSS4JInOutTest method testCustomProcessorObject.

@Test
public void testCustomProcessorObject() throws Exception {
    Document doc = readDocument("wsse-request-clean.xml");
    WSS4JOutInterceptor ohandler = new WSS4JOutInterceptor();
    PhaseInterceptor<SoapMessage> handler = ohandler.createEndingInterceptor();
    SoapMessage msg = getSoapMessageForDom(doc);
    msg.put(ConfigurationConstants.ACTION, ConfigurationConstants.SIGNATURE);
    msg.put(ConfigurationConstants.SIG_PROP_FILE, "outsecurity.properties");
    msg.put(ConfigurationConstants.USER, "myalias");
    msg.put("password", "myAliasPassword");
    handler.handleMessage(msg);
    SOAPMessage saajMsg = msg.getContent(SOAPMessage.class);
    doc = saajMsg.getSOAPPart();
    assertValid("//wsse:Security", doc);
    assertValid("//wsse:Security/ds:Signature", doc);
    byte[] docbytes = getMessageBytes(doc);
    StaxUtils.read(new ByteArrayInputStream(docbytes));
    final Map<String, Object> properties = new HashMap<>();
    final Map<QName, Object> customMap = new HashMap<>();
    customMap.put(new QName(WSS4JConstants.SIG_NS, WSS4JConstants.SIG_LN), CustomProcessor.class);
    properties.put(WSS4JInInterceptor.PROCESSOR_MAP, customMap);
    WSS4JInInterceptor inHandler = new WSS4JInInterceptor(properties);
    SoapMessage inmsg = new SoapMessage(new MessageImpl());
    Exchange ex = new ExchangeImpl();
    ex.setInMessage(inmsg);
    inmsg.setContent(SOAPMessage.class, saajMsg);
    inHandler.setProperty(ConfigurationConstants.ACTION, ConfigurationConstants.SIGNATURE);
    inHandler.handleMessage(inmsg);
    List<WSHandlerResult> results = getResults(inmsg);
    assertTrue(results != null && results.size() == 1);
    List<WSSecurityEngineResult> signatureResults = results.get(0).getActionResults().get(WSConstants.SIGN);
    assertTrue(signatureResults.size() == 1);
    Object obj = signatureResults.get(0).get("foo");
    assertNotNull(obj);
    assertEquals(obj.getClass().getName(), CustomProcessor.class.getName());
}

Example 78 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class WSS4JInOutTest method testDirectReferenceSignature.

@Test
public void testDirectReferenceSignature() throws Exception {
    Map<String, Object> outProperties = new HashMap<>();
    outProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.SIGNATURE);
    outProperties.put(ConfigurationConstants.SIG_PROP_FILE, "outsecurity.properties");
    outProperties.put(ConfigurationConstants.USER, "myalias");
    outProperties.put(ConfigurationConstants.SIG_KEY_ID, "DirectReference");
    outProperties.put("password", "myAliasPassword");
    Map<String, Object> inProperties = new HashMap<>();
    inProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.SIGNATURE);
    inProperties.put(ConfigurationConstants.SIG_VER_PROP_FILE, "insecurity.properties");
    List<String> xpaths = new ArrayList<>();
    xpaths.add("//wsse:Security");
    xpaths.add("//wsse:Security/wsse:BinarySecurityToken");
    xpaths.add("//wsse:Security/ds:Signature");
    List<WSHandlerResult> handlerResults = getResults(makeInvocation(outProperties, xpaths, inProperties));
    WSSecurityEngineResult actionResult = handlerResults.get(0).getActionResults().get(WSConstants.SIGN).get(0);
    X509Certificate certificate = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
    assertNotNull(certificate);
}

Example 79 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class CustomProcessor method handleToken.

public final java.util.List<WSSecurityEngineResult> handleToken(final org.w3c.dom.Element elem, final RequestData data) throws WSSecurityException {
    final WSSecurityEngineResult result = new WSSecurityEngineResult(WSConstants.SIGN);
    result.put("foo", this);
    data.getWsDocInfo().addResult(result);
    return java.util.Collections.singletonList(result);
}

Example 80 with WSSecurityEngineResult

use of org.apache.wss4j.dom.engine.WSSecurityEngineResult in project cxf by apache.

the class WSS4JInOutTest method testSignature.

@Test
public void testSignature() throws Exception {
    Map<String, Object> outProperties = new HashMap<>();
    outProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.SIGNATURE);
    outProperties.put(ConfigurationConstants.SIG_PROP_FILE, "outsecurity.properties");
    outProperties.put(ConfigurationConstants.USER, "myalias");
    outProperties.put("password", "myAliasPassword");
    Map<String, Object> inProperties = new HashMap<>();
    inProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.SIGNATURE);
    inProperties.put(ConfigurationConstants.SIG_VER_PROP_FILE, "insecurity.properties");
    List<String> xpaths = new ArrayList<>();
    xpaths.add("//wsse:Security");
    xpaths.add("//wsse:Security/ds:Signature");
    List<WSHandlerResult> handlerResults = getResults(makeInvocation(outProperties, xpaths, inProperties));
    WSSecurityEngineResult actionResult = handlerResults.get(0).getActionResults().get(WSConstants.SIGN).get(0);
    X509Certificate certificate = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
    assertNotNull(certificate);
}