Examples with WSSecDKEncrypt org.apache.wss4j.dom.message.WSSecDKEncrypt used on opensource projects

Example 1 with WSSecDKEncrypt

use of org.apache.wss4j.dom.message.WSSecDKEncrypt in project cxf by apache.

the class AsymmetricBindingHandler method doEncryptionDerived.

private WSSecBase doEncryptionDerived(AbstractTokenWrapper recToken, AbstractToken encrToken, List<WSEncryptionPart> encrParts, AlgorithmSuite algorithmSuite) {
    try {
        WSSecDKEncrypt dkEncr = new WSSecDKEncrypt(secHeader);
        dkEncr.setEncryptionSerializer(new StaxSerializer());
        dkEncr.setIdAllocator(wssConfig.getIdAllocator());
        dkEncr.setCallbackLookup(callbackLookup);
        dkEncr.setAttachmentCallbackHandler(new AttachmentCallbackHandler(message));
        dkEncr.setStoreBytesInAttachment(storeBytesInAttachment);
        dkEncr.setExpandXopInclude(isExpandXopInclude());
        dkEncr.setWsDocInfo(wsDocInfo);
        if (recToken.getToken().getVersion() == SPConstants.SPVersion.SP11) {
            dkEncr.setWscVersion(ConversationConstants.VERSION_05_02);
        }
        if (encrKey == null) {
            setupEncryptedKey(recToken, encrToken);
        }
        dkEncr.setExternalKey(this.encryptedKeyValue, this.encryptedKeyId);
        dkEncr.getParts().addAll(encrParts);
        dkEncr.setCustomValueType(WSS4JConstants.SOAPMESSAGE_NS11 + "#" + WSS4JConstants.ENC_KEY_VALUE_TYPE);
        AlgorithmSuiteType algType = algorithmSuite.getAlgorithmSuiteType();
        dkEncr.setSymmetricEncAlgorithm(algType.getEncryption());
        dkEncr.setDerivedKeyLength(algType.getEncryptionDerivedKeyLength() / 8);
        dkEncr.prepare();
        addDerivedKeyElement(dkEncr.getdktElement());
        Element refList = dkEncr.encryptForExternalRef(null, encrParts);
        if (refList != null) {
            insertBeforeBottomUp(refList);
        }
        return dkEncr;
    } catch (Exception e) {
        LOG.log(Level.FINE, e.getMessage(), e);
        unassertPolicy(recToken, e);
    }
    return null;
}

Example 2 with WSSecDKEncrypt

use of org.apache.wss4j.dom.message.WSSecDKEncrypt in project cxf by apache.

the class AsymmetricBindingHandler method encryptTokensInSecurityHeader.

private void encryptTokensInSecurityHeader(AbstractToken encryptionToken, WSSecBase encrBase) {
    List<WSEncryptionPart> secondEncrParts = new ArrayList<>();
    // Check for signature protection
    if (abinding.isEncryptSignature()) {
        assertPolicy(new QName(abinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_SIGNATURE));
        // Now encrypt the signature using the above token
        if (mainSigId != null) {
            WSEncryptionPart sigPart = new WSEncryptionPart(mainSigId, "Element");
            sigPart.setElement(bottomUpElement);
            secondEncrParts.add(sigPart);
        }
        if (sigConfList != null && !sigConfList.isEmpty()) {
            secondEncrParts.addAll(sigConfList);
        }
    }
    // Add any SupportingTokens that need to be encrypted
    if (isRequestor()) {
        secondEncrParts.addAll(encryptedTokensList);
    }
    if (secondEncrParts.isEmpty()) {
        return;
    }
    // Perform encryption
    if (encryptionToken.getDerivedKeys() == DerivedKeys.RequireDerivedKeys && encrBase instanceof WSSecDKEncrypt) {
        try {
            Element secondRefList = ((WSSecDKEncrypt) encrBase).encryptForExternalRef(null, secondEncrParts);
            if (secondRefList != null) {
                ((WSSecDKEncrypt) encrBase).addExternalRefElement(secondRefList);
            }
        } catch (WSSecurityException ex) {
            LOG.log(Level.FINE, ex.getMessage(), ex);
            throw new Fault(ex);
        }
    } else if (encrBase instanceof WSSecEncrypt) {
        try {
            // Encrypt, get hold of the ref list and add it
            Element secondRefList = saaj.getSOAPPart().createElementNS(WSS4JConstants.ENC_NS, WSS4JConstants.ENC_PREFIX + ":ReferenceList");
            if (lastEncryptedKeyElement != null) {
                insertAfter(secondRefList, lastEncryptedKeyElement);
            } else {
                this.insertBeforeBottomUp(secondRefList);
            }
            ((WSSecEncrypt) encrBase).encryptForRef(secondRefList, secondEncrParts);
        } catch (WSSecurityException ex) {
            LOG.log(Level.FINE, ex.getMessage(), ex);
            throw new Fault(ex);
        }
    }
}

Example 3 with WSSecDKEncrypt

use of org.apache.wss4j.dom.message.WSSecDKEncrypt in project cxf by apache.

the class SymmetricBindingHandler method doEncryptionDerived.

private WSSecBase doEncryptionDerived(AbstractTokenWrapper recToken, SecurityToken encrTok, AbstractToken encrToken, boolean attached, List<WSEncryptionPart> encrParts, boolean atEnd) {
    try {
        WSSecDKEncrypt dkEncr = new WSSecDKEncrypt(secHeader);
        dkEncr.setEncryptionSerializer(new StaxSerializer());
        dkEncr.setIdAllocator(wssConfig.getIdAllocator());
        dkEncr.setCallbackLookup(callbackLookup);
        dkEncr.setAttachmentCallbackHandler(new AttachmentCallbackHandler(message));
        dkEncr.setStoreBytesInAttachment(storeBytesInAttachment);
        dkEncr.setExpandXopInclude(isExpandXopInclude());
        dkEncr.setWsDocInfo(wsDocInfo);
        if (recToken.getToken().getVersion() == SPConstants.SPVersion.SP11) {
            dkEncr.setWscVersion(ConversationConstants.VERSION_05_02);
        }
        if (attached && encrTok.getAttachedReference() != null) {
            dkEncr.setExternalKey(encrTok.getSecret(), cloneElement(encrTok.getAttachedReference()));
        } else if (encrTok.getUnattachedReference() != null) {
            dkEncr.setExternalKey(encrTok.getSecret(), cloneElement(encrTok.getUnattachedReference()));
        } else if (!isRequestor() && encrTok.getSHA1() != null) {
            // If the Encrypted key used to create the derived key is not
            // attached use key identifier as defined in WSS1.1 section
            // 7.7 Encrypted Key reference
            SecurityTokenReference tokenRef = new SecurityTokenReference(saaj.getSOAPPart());
            String tokenType = encrTok.getTokenType();
            if (encrToken instanceof KerberosToken) {
                tokenRef.setKeyIdentifier(WSS4JConstants.WSS_KRB_KI_VALUE_TYPE, encrTok.getSHA1(), true);
                if (tokenType == null) {
                    tokenType = WSS4JConstants.WSS_GSS_KRB_V5_AP_REQ;
                }
            } else {
                tokenRef.setKeyIdentifierEncKeySHA1(encrTok.getSHA1());
                if (tokenType == null) {
                    tokenType = WSS4JConstants.WSS_ENC_KEY_VALUE_TYPE;
                }
            }
            tokenRef.addTokenType(tokenType);
            dkEncr.setExternalKey(encrTok.getSecret(), tokenRef.getElement());
        } else {
            if (attached) {
                String id = encrTok.getWsuId();
                if (id == null && (encrToken instanceof SecureConversationToken || encrToken instanceof SecurityContextToken)) {
                    dkEncr.setTokenIdDirectId(true);
                    id = encrTok.getId();
                } else if (id == null) {
                    id = encrTok.getId();
                }
                if (id.startsWith("#")) {
                    id = id.substring(1);
                }
                dkEncr.setExternalKey(encrTok.getSecret(), id);
            } else {
                dkEncr.setTokenIdDirectId(true);
                dkEncr.setExternalKey(encrTok.getSecret(), encrTok.getId());
            }
        }
        if (encrTok.getSHA1() != null) {
            String tokenType = encrTok.getTokenType();
            if (tokenType == null) {
                tokenType = WSS4JConstants.WSS_ENC_KEY_VALUE_TYPE;
            }
            dkEncr.setCustomValueType(tokenType);
        } else {
            String tokenType = encrTok.getTokenType();
            if (WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType)) {
                dkEncr.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
                dkEncr.setCustomValueType(WSS4JConstants.WSS_SAML_KI_VALUE_TYPE);
            } else if (WSS4JConstants.WSS_SAML2_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML2_NS.equals(tokenType)) {
                dkEncr.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
                dkEncr.setCustomValueType(WSS4JConstants.WSS_SAML2_KI_VALUE_TYPE);
            } else if (encrToken instanceof UsernameToken) {
                dkEncr.setCustomValueType(WSS4JConstants.WSS_USERNAME_TOKEN_VALUE_TYPE);
            } else {
                dkEncr.setCustomValueType(tokenType);
            }
        }
        AlgorithmSuiteType algType = sbinding.getAlgorithmSuite().getAlgorithmSuiteType();
        dkEncr.setSymmetricEncAlgorithm(algType.getEncryption());
        dkEncr.setDerivedKeyLength(algType.getEncryptionDerivedKeyLength() / 8);
        dkEncr.prepare();
        Element encrDKTokenElem = null;
        encrDKTokenElem = dkEncr.getdktElement();
        addDerivedKeyElement(encrDKTokenElem);
        Element refList = dkEncr.encryptForExternalRef(null, encrParts);
        List<Element> attachments = dkEncr.getAttachmentEncryptedDataElements();
        addAttachmentsForEncryption(atEnd, refList, attachments);
        return dkEncr;
    } catch (Exception e) {
        LOG.log(Level.FINE, e.getMessage(), e);
        unassertPolicy(recToken, e);
    }
    return null;
}