Examples with AbstractToken org.apache.wss4j.policy.model.AbstractToken used on opensource projects

Example 26 with AbstractToken

use of org.apache.wss4j.policy.model.AbstractToken in project cxf by apache.

the class TransportBindingHandler method addSignedSupportingTokens.

private void addSignedSupportingTokens(SupportingTokens sgndSuppTokens) throws Exception {
    for (AbstractToken token : sgndSuppTokens.getTokens()) {
        assertToken(token);
        if (token != null && !isTokenRequired(token.getIncludeTokenType())) {
            continue;
        }
        if (token instanceof UsernameToken) {
            WSSecUsernameToken utBuilder = addUsernameToken((UsernameToken) token);
            if (utBuilder != null) {
                utBuilder.prepare();
                utBuilder.appendToHeader();
            }
        } else if (token instanceof IssuedToken || token instanceof KerberosToken || token instanceof SpnegoContextToken) {
            SecurityToken secTok = getSecurityToken();
            if (isTokenRequired(token.getIncludeTokenType())) {
                // Add the token
                addEncryptedKeyElement(cloneElement(secTok.getToken()));
            }
        } else if (token instanceof SamlToken) {
            SamlAssertionWrapper assertionWrapper = addSamlToken((SamlToken) token);
            if (assertionWrapper != null) {
                Element envelope = saaj.getSOAPPart().getEnvelope();
                envelope = (Element) DOMUtils.getDomElement(envelope);
                addSupportingElement(assertionWrapper.toDOM(envelope.getOwnerDocument()));
            }
        } else {
        // REVISIT - not supported for signed.  Exception?
        }
    }
}

Example 27 with AbstractToken

use of org.apache.wss4j.policy.model.AbstractToken in project cxf by apache.

the class AbstractBindingPolicyValidator method checkDerivedKeys.

/**
 * Check the derived key requirement.
 */
protected boolean checkDerivedKeys(AbstractTokenWrapper tokenWrapper, boolean hasDerivedKeys, List<WSSecurityEngineResult> signedResults, List<WSSecurityEngineResult> encryptedResults) {
    AbstractToken token = tokenWrapper.getToken();
    boolean isDerivedKeys = token.getDerivedKeys() == DerivedKeys.RequireDerivedKeys;
    // If derived keys are not required then just return
    if (!(token instanceof X509Token && isDerivedKeys)) {
        return true;
    }
    if (tokenWrapper instanceof EncryptionToken && !hasDerivedKeys && !encryptedResults.isEmpty()) {
        return false;
    } else if (tokenWrapper instanceof SignatureToken && !hasDerivedKeys && !signedResults.isEmpty()) {
        return false;
    } else if (tokenWrapper instanceof ProtectionToken && !hasDerivedKeys && !(signedResults.isEmpty() || encryptedResults.isEmpty())) {
        return false;
    }
    return true;
}

Example 28 with AbstractToken

use of org.apache.wss4j.policy.model.AbstractToken in project cxf by apache.

the class AsymmetricBindingPolicyValidator method checkInitiatorTokens.

private boolean checkInitiatorTokens(AbstractTokenWrapper wrapper, AsymmetricBinding binding, AssertionInfo ai, AssertionInfoMap aim, boolean hasDerivedKeys, List<WSSecurityEngineResult> signedResults, List<WSSecurityEngineResult> encryptedResults) {
    AbstractToken token = wrapper.getToken();
    if (token instanceof X509Token) {
        boolean foundCert = false;
        for (WSSecurityEngineResult result : signedResults) {
            X509Certificate cert = (X509Certificate) result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
            if (cert != null) {
                foundCert = true;
                break;
            }
        }
        if (!foundCert && !signedResults.isEmpty()) {
            String error = "An X.509 certificate was not used for the " + wrapper.getName();
            unassertPolicy(aim, wrapper.getName(), error);
            ai.setNotAsserted(error);
            return false;
        }
    }
    PolicyUtils.assertPolicy(aim, wrapper.getName());
    if (!checkDerivedKeys(wrapper, hasDerivedKeys, signedResults, encryptedResults)) {
        ai.setNotAsserted("Message fails the DerivedKeys requirement");
        return false;
    }
    assertDerivedKeys(wrapper.getToken(), aim);
    return true;
}

Example 29 with AbstractToken

use of org.apache.wss4j.policy.model.AbstractToken in project cxf by apache.

the class ConcreteSupportingTokenPolicyValidator method validatePolicies.

/**
 * Validate policies.
 */
public void validatePolicies(PolicyValidatorParameters parameters, Collection<AssertionInfo> ais) {
    for (AssertionInfo ai : ais) {
        SupportingTokens binding = (SupportingTokens) ai.getAssertion();
        ai.setAsserted(true);
        setSignedParts(binding.getSignedParts());
        setEncryptedParts(binding.getEncryptedParts());
        setSignedElements(binding.getSignedElements());
        setEncryptedElements(binding.getEncryptedElements());
        List<AbstractToken> tokens = binding.getTokens();
        for (AbstractToken token : tokens) {
            if (!isTokenRequired(token, parameters.getMessage())) {
                continue;
            }
            boolean processingFailed = false;
            if (token instanceof UsernameToken) {
                if (!processUsernameTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof SamlToken) {
                if (!processSAMLTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof KerberosToken) {
                if (!processKerberosTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof X509Token) {
                if (!processX509Tokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof KeyValueToken) {
                if (!processKeyValueTokens(parameters)) {
                    processingFailed = true;
                }
            } else if (token instanceof SecurityContextToken || token instanceof SpnegoContextToken) {
                if (!processSCTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof IssuedToken) {
                IssuedToken issuedToken = (IssuedToken) token;
                if (isSamlTokenRequiredForIssuedToken(issuedToken) && !processSAMLTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else {
                processingFailed = true;
            }
            if (processingFailed) {
                ai.setNotAsserted("The received token does not match the supporting token requirement");
                continue;
            }
        }
    }
}

Example 30 with AbstractToken

use of org.apache.wss4j.policy.model.AbstractToken in project cxf by apache.

the class EncryptedTokenPolicyValidator method validatePolicies.

/**
 * Validate policies.
 */
public void validatePolicies(PolicyValidatorParameters parameters, Collection<AssertionInfo> ais) {
    // Tokens must be encrypted even if TLS is used unless we have a TransportBinding policy available
    if (isTLSInUse(parameters.getMessage())) {
        AssertionInfo transportAi = PolicyUtils.getFirstAssertionByLocalname(parameters.getAssertionInfoMap(), SPConstants.TRANSPORT_BINDING);
        super.setEnforceEncryptedTokens(transportAi == null);
    }
    for (AssertionInfo ai : ais) {
        SupportingTokens binding = (SupportingTokens) ai.getAssertion();
        ai.setAsserted(true);
        setSignedParts(binding.getSignedParts());
        setEncryptedParts(binding.getEncryptedParts());
        setSignedElements(binding.getSignedElements());
        setEncryptedElements(binding.getEncryptedElements());
        List<AbstractToken> tokens = binding.getTokens();
        for (AbstractToken token : tokens) {
            if (!isTokenRequired(token, parameters.getMessage())) {
                continue;
            }
            boolean processingFailed = false;
            if (token instanceof UsernameToken) {
                if (!processUsernameTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof KerberosToken) {
                if (!processKerberosTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof X509Token) {
                if (!processX509Tokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof KeyValueToken) {
                if (!processKeyValueTokens(parameters)) {
                    processingFailed = true;
                }
            } else if (token instanceof SecurityContextToken || token instanceof SpnegoContextToken) {
                if (!processSCTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof SamlToken) {
                if (!processSAMLTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else if (token instanceof IssuedToken) {
                IssuedToken issuedToken = (IssuedToken) token;
                if (isSamlTokenRequiredForIssuedToken(issuedToken) && !processSAMLTokens(parameters, false)) {
                    processingFailed = true;
                }
            } else {
                processingFailed = true;
            }
            if (processingFailed) {
                ai.setNotAsserted("The received token does not match the encrypted supporting token requirement");
                continue;
            }
        }
    }
}