Examples with WSSecSignature org.apache.wss4j.dom.message.WSSecSignature used on opensource projects

Example 1 with WSSecSignature

use of org.apache.wss4j.dom.message.WSSecSignature in project cxf by apache.

the class AbstractBindingBuilder method doEndorsedSignatures.

protected void doEndorsedSignatures(List<SupportingToken> tokenList, boolean isTokenProtection, boolean isSigProtect) {
    for (SupportingToken supportingToken : tokenList) {
        Object tempTok = supportingToken.getTokenImplementation();
        List<WSEncryptionPart> sigParts = new ArrayList<>();
        WSEncryptionPart sigPart = new WSEncryptionPart(mainSigId);
        sigPart.setElement(bottomUpElement);
        sigParts.add(sigPart);
        if (supportingToken.getSignedParts() != null) {
            for (WSEncryptionPart signedPart : supportingToken.getSignedParts()) {
                sigParts.add(signedPart);
            }
        }
        if (tempTok instanceof WSSecSignature) {
            WSSecSignature sig = (WSSecSignature) tempTok;
            if (isTokenProtection && sig.getBSTTokenId() != null) {
                WSEncryptionPart bstPart = new WSEncryptionPart(sig.getBSTTokenId());
                bstPart.setElement(sig.getBinarySecurityTokenElement());
                sigParts.add(bstPart);
            }
            try {
                List<Reference> referenceList = sig.addReferencesToSign(sigParts);
                sig.computeSignature(referenceList, false, null);
                addSig(sig.getSignatureValue());
                if (isSigProtect) {
                    WSEncryptionPart part = new WSEncryptionPart(sig.getId(), "Element");
                    encryptedTokensList.add(part);
                }
            } catch (WSSecurityException e) {
                unassertPolicy(supportingToken.getToken(), e);
            }
        } else if (tempTok instanceof WSSecurityTokenHolder) {
            SecurityToken token = ((WSSecurityTokenHolder) tempTok).getToken();
            if (isTokenProtection) {
                sigParts.add(new WSEncryptionPart(token.getId()));
            }
            try {
                if (supportingToken.getToken().getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
                    doSymmSignatureDerived(supportingToken.getToken(), token, sigParts, isTokenProtection, isSigProtect);
                } else {
                    doSymmSignature(supportingToken.getToken(), token, sigParts, isTokenProtection, isSigProtect);
                }
            } catch (Exception e) {
                LOG.log(Level.FINE, e.getMessage(), e);
            }
        } else if (tempTok instanceof WSSecUsernameToken) {
            WSSecUsernameToken utBuilder = (WSSecUsernameToken) tempTok;
            String id = utBuilder.getId();
            Instant created = Instant.now();
            Instant expires = created.plusSeconds(WSS4JUtils.getSecurityTokenLifetime(message) / 1000L);
            SecurityToken secToken = new SecurityToken(id, utBuilder.getUsernameTokenElement(), created, expires);
            if (isTokenProtection) {
                sigParts.add(new WSEncryptionPart(secToken.getId()));
            }
            try {
                byte[] secret = utBuilder.getDerivedKey();
                secToken.setSecret(secret);
                if (supportingToken.getToken().getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
                    doSymmSignatureDerived(supportingToken.getToken(), secToken, sigParts, isTokenProtection, isSigProtect);
                } else {
                    doSymmSignature(supportingToken.getToken(), secToken, sigParts, isTokenProtection, isSigProtect);
                }
            } catch (Exception e) {
                LOG.log(Level.FINE, e.getMessage(), e);
            }
        }
    }
}

Example 2 with WSSecSignature

use of org.apache.wss4j.dom.message.WSSecSignature in project cxf by apache.

the class AbstractBindingBuilder method addSignatureParts.

protected void addSignatureParts(List<SupportingToken> tokenList, List<WSEncryptionPart> sigParts) {
    boolean useSTRTransform = MessageUtils.getContextualBoolean(message, SecurityConstants.USE_STR_TRANSFORM, true);
    for (SupportingToken supportingToken : tokenList) {
        Object tempTok = supportingToken.getTokenImplementation();
        WSEncryptionPart part = null;
        if (tempTok instanceof WSSecSignature) {
            WSSecSignature tempSig = (WSSecSignature) tempTok;
            SecurityTokenReference secRef = tempSig.getSecurityTokenReference();
            if (WSS4JConstants.WSS_SAML_KI_VALUE_TYPE.equals(secRef.getKeyIdentifierValueType()) || WSS4JConstants.WSS_SAML2_KI_VALUE_TYPE.equals(secRef.getKeyIdentifierValueType())) {
                Element secRefElement = cloneElement(secRef.getElement());
                addSupportingElement(secRefElement);
                part = new WSEncryptionPart("STRTransform", null, "Element");
                part.setId(tempSig.getSecurityTokenReferenceURI());
                part.setElement(secRefElement);
            } else {
                if (tempSig.getBSTTokenId() != null) {
                    part = new WSEncryptionPart(tempSig.getBSTTokenId());
                    part.setElement(tempSig.getBinarySecurityTokenElement());
                }
            }
        } else if (tempTok instanceof WSSecUsernameToken) {
            WSSecUsernameToken unt = (WSSecUsernameToken) tempTok;
            part = new WSEncryptionPart(unt.getId());
            part.setElement(unt.getUsernameTokenElement());
        } else if (tempTok instanceof BinarySecurity) {
            BinarySecurity bst = (BinarySecurity) tempTok;
            part = new WSEncryptionPart(bst.getID());
            part.setElement(bst.getElement());
        } else if (tempTok instanceof SamlAssertionWrapper) {
            SamlAssertionWrapper assertionWrapper = (SamlAssertionWrapper) tempTok;
            Document doc = assertionWrapper.getElement().getOwnerDocument();
            boolean saml1 = assertionWrapper.getSaml1() != null;
            if (useSTRTransform) {
                // TODO We only support using a KeyIdentifier for the moment
                SecurityTokenReference secRef = createSTRForSamlAssertion(doc, assertionWrapper.getId(), saml1, false);
                Element clone = cloneElement(secRef.getElement());
                addSupportingElement(clone);
                part = new WSEncryptionPart("STRTransform", null, "Element");
                part.setId(secRef.getID());
                part.setElement(clone);
            } else {
                part = new WSEncryptionPart(assertionWrapper.getId());
                part.setElement(assertionWrapper.getElement());
            }
        } else if (tempTok instanceof WSSecurityTokenHolder) {
            SecurityToken token = ((WSSecurityTokenHolder) tempTok).getToken();
            String tokenType = token.getTokenType();
            if (WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType) || WSS4JConstants.WSS_SAML2_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML2_NS.equals(tokenType)) {
                Document doc = token.getToken().getOwnerDocument();
                boolean saml1 = WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType);
                String id = token.getId();
                if (id == null || "".equals(id)) {
                    if (saml1) {
                        id = token.getToken().getAttributeNS(null, "AssertionID");
                    } else {
                        id = token.getToken().getAttributeNS(null, "ID");
                    }
                }
                if (useSTRTransform) {
                    SecurityTokenReference secRef = createSTRForSamlAssertion(doc, id, saml1, false);
                    Element clone = cloneElement(secRef.getElement());
                    addSupportingElement(clone);
                    part = new WSEncryptionPart("STRTransform", null, "Element");
                    part.setId(secRef.getID());
                    part.setElement(clone);
                } else {
                    part = new WSEncryptionPart(id);
                    part.setElement(token.getToken());
                }
            } else {
                String id = XMLUtils.getIDFromReference(token.getId());
                part = new WSEncryptionPart(id);
                part.setElement(token.getToken());
            }
        } else {
            unassertPolicy(supportingToken.getToken(), "UnsupportedTokenInSupportingToken: " + tempTok);
        }
        if (part != null) {
            sigParts.add(part);
        }
    }
}

Example 3 with WSSecSignature

use of org.apache.wss4j.dom.message.WSSecSignature in project cxf by apache.

the class TransportBindingHandler method doSignature.

private byte[] doSignature(boolean tokenIncluded, SecurityToken secTok, AbstractToken token, SupportingTokens wrapper, List<WSEncryptionPart> sigParts) throws Exception {
    WSSecSignature sig = new WSSecSignature(secHeader);
    sig.setIdAllocator(wssConfig.getIdAllocator());
    sig.setCallbackLookup(callbackLookup);
    sig.setAttachmentCallbackHandler(new AttachmentCallbackHandler(message));
    sig.setStoreBytesInAttachment(storeBytesInAttachment);
    sig.setExpandXopInclude(isExpandXopInclude());
    sig.setWsDocInfo(wsDocInfo);
    // Setting the AttachedReference or the UnattachedReference according to the flag
    Element ref;
    if (tokenIncluded) {
        ref = secTok.getAttachedReference();
    } else {
        ref = secTok.getUnattachedReference();
    }
    if (ref != null) {
        SecurityTokenReference secRef = new SecurityTokenReference(cloneElement(ref), new BSPEnforcer());
        sig.setSecurityTokenReference(secRef);
        sig.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
    } else if (token instanceof UsernameToken) {
        sig.setCustomTokenId(secTok.getId());
        sig.setCustomTokenValueType(WSS4JConstants.WSS_USERNAME_TOKEN_VALUE_TYPE);
        int type = tokenIncluded ? WSConstants.CUSTOM_SYMM_SIGNING : WSConstants.CUSTOM_SYMM_SIGNING_DIRECT;
        sig.setKeyIdentifierType(type);
    } else if (secTok.getTokenType() == null) {
        sig.setCustomTokenValueType(WSS4JConstants.WSS_SAML_KI_VALUE_TYPE);
        sig.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
    } else {
        String id = secTok.getWsuId();
        if (id == null) {
            sig.setCustomTokenId(secTok.getId());
            sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING_DIRECT);
        } else {
            sig.setCustomTokenId(secTok.getWsuId());
            sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
        }
        String tokenType = secTok.getTokenType();
        if (WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType)) {
            sig.setCustomTokenValueType(WSS4JConstants.WSS_SAML_KI_VALUE_TYPE);
            sig.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
        } else if (WSS4JConstants.WSS_SAML2_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML2_NS.equals(tokenType)) {
            sig.setCustomTokenValueType(WSS4JConstants.WSS_SAML2_KI_VALUE_TYPE);
            sig.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
        } else {
            sig.setCustomTokenValueType(tokenType);
        }
    }
    Crypto crypto = null;
    if (secTok.getSecret() == null) {
        sig.setX509Certificate(secTok.getX509Certificate());
        crypto = secTok.getCrypto();
        if (crypto == null) {
            crypto = getSignatureCrypto();
        }
        if (crypto == null) {
            LOG.fine("No signature Crypto properties are available");
            Exception ex = new Exception("No signature Crypto properties are available");
            throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, ex);
        }
        String uname = crypto.getX509Identifier(secTok.getX509Certificate());
        if (uname == null) {
            String userNameKey = SecurityConstants.SIGNATURE_USERNAME;
            uname = (String) SecurityUtils.getSecurityPropertyValue(userNameKey, message);
        }
        String password = getPassword(uname, token, WSPasswordCallback.SIGNATURE);
        sig.setUserInfo(uname, password);
        sig.setSignatureAlgorithm(binding.getAlgorithmSuite().getAsymmetricSignature());
    } else {
        crypto = getSignatureCrypto();
        sig.setSecretKey(secTok.getSecret());
        sig.setSignatureAlgorithm(binding.getAlgorithmSuite().getSymmetricSignature());
    }
    sig.setSigCanonicalization(binding.getAlgorithmSuite().getC14n().getValue());
    AlgorithmSuiteType algType = binding.getAlgorithmSuite().getAlgorithmSuiteType();
    sig.setDigestAlgo(algType.getDigest());
    sig.prepare(crypto);
    sig.getParts().addAll(sigParts);
    List<Reference> referenceList = sig.addReferencesToSign(sigParts);
    // Do signature
    if (bottomUpElement == null) {
        sig.computeSignature(referenceList, false, null);
    } else {
        sig.computeSignature(referenceList, true, bottomUpElement);
    }
    bottomUpElement = sig.getSignatureElement();
    mainSigId = sig.getId();
    return sig.getSignatureValue();
}

Example 4 with WSSecSignature

use of org.apache.wss4j.dom.message.WSSecSignature in project cxf by apache.

the class TransportBindingHandler method doX509TokenSignature.

private byte[] doX509TokenSignature(AbstractToken token, SupportingTokens wrapper) throws Exception {
    List<WSEncryptionPart> sigParts = signPartsAndElements(wrapper.getSignedParts(), wrapper.getSignedElements());
    if (token.getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
        WSSecEncryptedKey encrKey = getEncryptedKeyBuilder(token);
        assertPolicy(wrapper);
        Element bstElem = encrKey.getBinarySecurityTokenElement();
        if (bstElem != null) {
            addTopDownElement(bstElem);
        }
        encrKey.appendToHeader();
        WSSecDKSign dkSig = new WSSecDKSign(secHeader);
        dkSig.setIdAllocator(wssConfig.getIdAllocator());
        dkSig.setCallbackLookup(callbackLookup);
        if (token.getVersion() == SPConstants.SPVersion.SP11) {
            dkSig.setWscVersion(ConversationConstants.VERSION_05_02);
        }
        dkSig.setSigCanonicalization(binding.getAlgorithmSuite().getC14n().getValue());
        dkSig.setSignatureAlgorithm(binding.getAlgorithmSuite().getSymmetricSignature());
        dkSig.setAttachmentCallbackHandler(new AttachmentCallbackHandler(message));
        dkSig.setStoreBytesInAttachment(storeBytesInAttachment);
        dkSig.setExpandXopInclude(isExpandXopInclude());
        dkSig.setWsDocInfo(wsDocInfo);
        AlgorithmSuiteType algType = binding.getAlgorithmSuite().getAlgorithmSuiteType();
        dkSig.setDerivedKeyLength(algType.getSignatureDerivedKeyLength() / 8);
        dkSig.setExternalKey(encrKey.getEphemeralKey(), encrKey.getId());
        dkSig.prepare();
        dkSig.getParts().addAll(sigParts);
        List<Reference> referenceList = dkSig.addReferencesToSign(sigParts);
        // Do signature
        dkSig.appendDKElementToHeader();
        dkSig.computeSignature(referenceList, false, null);
        return dkSig.getSignatureValue();
    }
    WSSecSignature sig = getSignatureBuilder(token, false, false);
    assertPolicy(wrapper);
    if (sig != null) {
        sig.prependBSTElementToHeader();
        List<Reference> referenceList = sig.addReferencesToSign(sigParts);
        if (bottomUpElement == null) {
            sig.computeSignature(referenceList, false, null);
        } else {
            sig.computeSignature(referenceList, true, bottomUpElement);
        }
        bottomUpElement = sig.getSignatureElement();
        mainSigId = sig.getId();
        return sig.getSignatureValue();
    }
    return new byte[0];
}

Example 5 with WSSecSignature

use of org.apache.wss4j.dom.message.WSSecSignature in project cxf by apache.

the class AbstractBindingBuilder method doSymmSignature.

private void doSymmSignature(AbstractToken policyToken, SecurityToken tok, List<WSEncryptionPart> sigParts, boolean isTokenProtection, boolean isSigProtect) throws WSSecurityException {
    WSSecSignature sig = new WSSecSignature(secHeader);
    sig.setIdAllocator(wssConfig.getIdAllocator());
    sig.setCallbackLookup(callbackLookup);
    sig.setAttachmentCallbackHandler(new AttachmentCallbackHandler(message));
    sig.setStoreBytesInAttachment(storeBytesInAttachment);
    sig.setExpandXopInclude(isExpandXopInclude());
    sig.setWsDocInfo(wsDocInfo);
    // be used in the wsse:Reference in ds:KeyInfo
    if (policyToken instanceof X509Token) {
        if (isRequestor()) {
            // TODO Add support for SAML2 here
            sig.setCustomTokenValueType(WSS4JConstants.SOAPMESSAGE_NS11 + "#" + WSS4JConstants.ENC_KEY_VALUE_TYPE);
            sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
        } else {
            // the tok has to be an EncryptedKey token
            sig.setEncrKeySha1value(tok.getSHA1());
            sig.setKeyIdentifierType(WSConstants.ENCRYPTED_KEY_SHA1_IDENTIFIER);
        }
    } else {
        String tokenType = tok.getTokenType();
        if (WSS4JConstants.WSS_SAML_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML_NS.equals(tokenType)) {
            sig.setCustomTokenValueType(WSS4JConstants.WSS_SAML_KI_VALUE_TYPE);
        } else if (WSS4JConstants.WSS_SAML2_TOKEN_TYPE.equals(tokenType) || WSS4JConstants.SAML2_NS.equals(tokenType)) {
            sig.setCustomTokenValueType(WSS4JConstants.WSS_SAML2_KI_VALUE_TYPE);
        } else if (tokenType != null) {
            sig.setCustomTokenValueType(tokenType);
        } else if (policyToken instanceof UsernameToken) {
            sig.setCustomTokenValueType(WSS4JConstants.WSS_USERNAME_TOKEN_VALUE_TYPE);
        } else {
            sig.setCustomTokenValueType(WSS4JConstants.WSS_SAML_KI_VALUE_TYPE);
        }
        sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
    }
    String sigTokId = tok.getWsuId();
    if (sigTokId == null) {
        sigTokId = tok.getId();
    }
    sigTokId = XMLUtils.getIDFromReference(sigTokId);
    sig.setCustomTokenId(sigTokId);
    sig.setSecretKey(tok.getSecret());
    sig.setSignatureAlgorithm(binding.getAlgorithmSuite().getSymmetricSignature());
    AlgorithmSuiteType algType = binding.getAlgorithmSuite().getAlgorithmSuiteType();
    sig.setDigestAlgo(algType.getDigest());
    sig.setSigCanonicalization(binding.getAlgorithmSuite().getC14n().getValue());
    sig.prepare(getSignatureCrypto());
    sig.getParts().addAll(sigParts);
    List<Reference> referenceList = sig.addReferencesToSign(sigParts);
    // Do signature
    sig.computeSignature(referenceList, false, null);
    if (isSigProtect) {
        WSEncryptionPart part = new WSEncryptionPart(sig.getId(), "Element");
        encryptedTokensList.add(part);
    }
    addSig(sig.getSignatureValue());
}