Examples with X509Token org.apache.wss4j.policy.model.X509Token used on opensource projects

Example 16 with X509Token

use of org.apache.wss4j.policy.model.X509Token in project cxf by apache.

the class AbstractBindingBuilder method checkForX509PkiPath.

private void checkForX509PkiPath(WSSecSignature sig, AbstractToken token) {
    if (token instanceof X509Token) {
        X509Token x509Token = (X509Token) token;
        TokenType tokenType = x509Token.getTokenType();
        if (tokenType == TokenType.WssX509PkiPathV1Token10 || tokenType == TokenType.WssX509PkiPathV1Token11) {
            sig.setUseSingleCertificate(false);
        }
    }
}

Example 17 with X509Token

use of org.apache.wss4j.policy.model.X509Token in project cxf by apache.

the class AbstractStaxBindingHandler method configureSignature.

protected void configureSignature(AbstractToken token, boolean attached) throws WSSecurityException {
    if (token instanceof X509Token) {
        X509Token x509Token = (X509Token) token;
        TokenType tokenType = x509Token.getTokenType();
        if (tokenType == TokenType.WssX509PkiPathV1Token10 || tokenType == TokenType.WssX509PkiPathV1Token11) {
            properties.setUseSingleCert(false);
        }
    }
    properties.setSignatureKeyIdentifier(getKeyIdentifierType(token));
    // Find out do we also need to include the token as per the Inclusion requirement
    WSSecurityTokenConstants.KeyIdentifier keyIdentifier = properties.getSignatureKeyIdentifier();
    if (token instanceof X509Token && isTokenRequired(token.getIncludeTokenType()) && (WSSecurityTokenConstants.KeyIdentifier_IssuerSerial.equals(keyIdentifier) || WSSecurityTokenConstants.KEYIDENTIFIER_THUMBPRINT_IDENTIFIER.equals(keyIdentifier) || WSSecurityTokenConstants.KEYIDENTIFIER_SECURITY_TOKEN_DIRECT_REFERENCE.equals(keyIdentifier))) {
        properties.setIncludeSignatureToken(true);
    } else {
        properties.setIncludeSignatureToken(false);
    }
    String userNameKey = SecurityConstants.SIGNATURE_USERNAME;
    if (binding instanceof SymmetricBinding) {
        userNameKey = SecurityConstants.ENCRYPT_USERNAME;
        properties.setSignatureAlgorithm(binding.getAlgorithmSuite().getSymmetricSignature());
    } else {
        properties.setSignatureAlgorithm(binding.getAlgorithmSuite().getAsymmetricSignature());
    }
    properties.setSignatureCanonicalizationAlgorithm(binding.getAlgorithmSuite().getC14n().getValue());
    String sigUser = (String) SecurityUtils.getSecurityPropertyValue(userNameKey, message);
    if (sigUser == null) {
        sigUser = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.USERNAME, message);
    }
    if (sigUser != null && properties.getSignatureUser() == null) {
        properties.setSignatureUser(sigUser);
    }
    AlgorithmSuiteType algType = binding.getAlgorithmSuite().getAlgorithmSuiteType();
    properties.setSignatureDigestAlgorithm(algType.getDigest());
    // sig.setSigCanonicalization(binding.getAlgorithmSuite().getC14n().getValue());
    boolean includePrefixes = MessageUtils.getContextualBoolean(message, SecurityConstants.ADD_INCLUSIVE_PREFIXES, true);
    properties.setAddExcC14NInclusivePrefixes(includePrefixes);
}

Example 18 with X509Token

use of org.apache.wss4j.policy.model.X509Token in project cxf by apache.

the class StaxAsymmetricBindingHandler method doSignature.

private void doSignature(AbstractTokenWrapper wrapper, List<SecurePart> sigParts) throws WSSecurityException, SOAPException {
    // Action
    WSSSecurityProperties properties = getProperties();
    WSSConstants.Action actionToPerform = XMLSecurityConstants.SIGNATURE;
    if (wrapper.getToken().getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
        actionToPerform = WSSConstants.SIGNATURE_WITH_DERIVED_KEY;
    }
    List<WSSConstants.Action> actionList = properties.getActions();
    // Add a Signature directly before Kerberos, otherwise just append it
    boolean actionAdded = false;
    for (int i = 0; i < actionList.size(); i++) {
        WSSConstants.Action action = actionList.get(i);
        if (action.equals(WSSConstants.KERBEROS_TOKEN)) {
            actionList.add(i, actionToPerform);
            actionAdded = true;
            break;
        }
    }
    if (!actionAdded) {
        actionList.add(actionToPerform);
    }
    properties.getSignatureSecureParts().addAll(sigParts);
    AbstractToken sigToken = wrapper.getToken();
    configureSignature(sigToken, false);
    if (abinding.isProtectTokens() && (sigToken instanceof X509Token) && sigToken.getIncludeTokenType() != IncludeTokenType.INCLUDE_TOKEN_NEVER) {
        SecurePart securePart = new SecurePart(new QName(WSSConstants.NS_WSSE10, "BinarySecurityToken"), Modifier.Element);
        properties.addSignaturePart(securePart);
    } else if (sigToken instanceof IssuedToken || sigToken instanceof SecurityContextToken || sigToken instanceof SecureConversationToken || sigToken instanceof SpnegoContextToken || sigToken instanceof SamlToken) {
        properties.setIncludeSignatureToken(false);
    }
    if (sigToken.getDerivedKeys() == DerivedKeys.RequireDerivedKeys) {
        properties.setSignatureAlgorithm(abinding.getAlgorithmSuite().getSymmetricSignature());
    }
}

Example 19 with X509Token

use of org.apache.wss4j.policy.model.X509Token in project cxf by apache.

the class StaxSymmetricBindingHandler method doSignBeforeEncrypt.

private void doSignBeforeEncrypt() {
    AbstractTokenWrapper sigAbstractTokenWrapper = getSignatureToken();
    assertTokenWrapper(sigAbstractTokenWrapper);
    AbstractToken sigToken = sigAbstractTokenWrapper.getToken();
    String sigTokId = null;
    try {
        SecurityToken sigTok = null;
        if (sigToken != null) {
            if (sigToken instanceof KerberosToken) {
                sigTok = getSecurityToken();
                if (isRequestor()) {
                    addKerberosToken((KerberosToken) sigToken, false, true, true);
                }
            } else if (sigToken instanceof IssuedToken) {
                sigTok = getSecurityToken();
                addIssuedToken(sigToken, sigTok, false, true);
                if (sigTok == null && !isRequestor()) {
                    org.apache.xml.security.stax.securityToken.SecurityToken securityToken = findInboundSecurityToken(WSSecurityEventConstants.SAML_TOKEN);
                    sigTokId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
                }
            } else if (sigToken instanceof SecureConversationToken || sigToken instanceof SecurityContextToken || sigToken instanceof SpnegoContextToken) {
                sigTok = getSecurityToken();
                if (sigTok != null && isRequestor()) {
                    WSSSecurityProperties properties = getProperties();
                    WSSConstants.Action actionToPerform = WSSConstants.CUSTOM_TOKEN;
                    properties.addAction(actionToPerform);
                } else if (sigTok == null && !isRequestor()) {
                    org.apache.xml.security.stax.securityToken.SecurityToken securityToken = findInboundSecurityToken(WSSecurityEventConstants.SECURITY_CONTEXT_TOKEN);
                    sigTokId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
                }
            } else if (sigToken instanceof X509Token) {
                if (isRequestor()) {
                    sigTokId = setupEncryptedKey(sigAbstractTokenWrapper, sigToken);
                } else {
                    org.apache.xml.security.stax.securityToken.SecurityToken securityToken = findEncryptedKeyToken();
                    sigTokId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
                }
            } else if (sigToken instanceof UsernameToken) {
                unassertPolicy(sbinding, "UsernameTokens not supported with Symmetric binding");
                return;
            }
            assertToken(sigToken);
        } else {
            unassertPolicy(sbinding, "No signature token");
            return;
        }
        if (sigTok == null && StringUtils.isEmpty(sigTokId)) {
            unassertPolicy(sigAbstractTokenWrapper, "No signature token id");
            return;
        }
        if (sigTok == null) {
            sigTok = TokenStoreUtils.getTokenStore(message).getToken(sigTokId);
        }
        // Store key
        if (!(MessageUtils.isRequestor(message) && sigToken instanceof KerberosToken)) {
            storeSecurityToken(sigToken, sigTok);
        }
        // Add timestamp
        List<SecurePart> sigs = new ArrayList<>();
        if (timestampAdded) {
            SecurePart part = new SecurePart(new QName(WSSConstants.NS_WSU10, "Timestamp"), Modifier.Element);
            sigs.add(part);
        }
        sigs.addAll(this.getSignedParts());
        if (!isRequestor()) {
            addSignatureConfirmation(sigs);
        }
        if (!sigs.isEmpty()) {
            doSignature(sigAbstractTokenWrapper, sigToken, sigTok, sigs);
        }
        addSupportingTokens();
        removeSignatureIfSignedSAML();
        prependSignatureToSC();
        // Encryption
        List<SecurePart> enc = getEncryptedParts();
        // Check for signature protection
        if (sbinding.isEncryptSignature()) {
            SecurePart part = new SecurePart(new QName(XMLSecurityConstants.NS_DSIG, "Signature"), Modifier.Element);
            enc.add(part);
            if (signatureConfirmationAdded) {
                part = new SecurePart(WSSConstants.TAG_WSSE11_SIG_CONF, Modifier.Element);
                enc.add(part);
            }
            assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_SIGNATURE));
        }
        // Do encryption
        if (isRequestor()) {
            enc.addAll(encryptedTokensList);
        }
        AbstractTokenWrapper encrAbstractTokenWrapper = getEncryptionToken();
        doEncryption(encrAbstractTokenWrapper, enc, false);
        putCustomTokenAfterSignature();
    } catch (Exception e) {
        throw new Fault(e);
    }
}

Example 20 with X509Token

use of org.apache.wss4j.policy.model.X509Token in project cxf by apache.

the class StaxSymmetricBindingHandler method doEncryptBeforeSign.

private void doEncryptBeforeSign() {
    try {
        AbstractTokenWrapper encryptionWrapper = getEncryptionToken();
        assertTokenWrapper(encryptionWrapper);
        AbstractToken encryptionToken = encryptionWrapper.getToken();
        String tokenId = null;
        SecurityToken tok = null;
        if (encryptionToken instanceof KerberosToken) {
            tok = getSecurityToken();
            if (MessageUtils.isRequestor(message)) {
                addKerberosToken((KerberosToken) encryptionToken, false, true, true);
            }
        } else if (encryptionToken instanceof IssuedToken) {
            tok = getSecurityToken();
            addIssuedToken(encryptionToken, tok, false, true);
            if (tok == null && !isRequestor()) {
                org.apache.xml.security.stax.securityToken.SecurityToken securityToken = findInboundSecurityToken(WSSecurityEventConstants.SAML_TOKEN);
                tokenId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
            }
        } else if (encryptionToken instanceof SecureConversationToken || encryptionToken instanceof SecurityContextToken || encryptionToken instanceof SpnegoContextToken) {
            tok = getSecurityToken();
            if (tok != null && isRequestor()) {
                WSSSecurityProperties properties = getProperties();
                WSSConstants.Action actionToPerform = WSSConstants.CUSTOM_TOKEN;
                properties.addAction(actionToPerform);
            } else if (tok == null && !isRequestor()) {
                org.apache.xml.security.stax.securityToken.SecurityToken securityToken = findInboundSecurityToken(WSSecurityEventConstants.SECURITY_CONTEXT_TOKEN);
                tokenId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
            }
        } else if (encryptionToken instanceof X509Token) {
            if (isRequestor()) {
                tokenId = setupEncryptedKey(encryptionWrapper, encryptionToken);
            } else {
                org.apache.xml.security.stax.securityToken.SecurityToken securityToken = findEncryptedKeyToken();
                tokenId = WSS4JUtils.parseAndStoreStreamingSecurityToken(securityToken, message);
            }
        } else if (encryptionToken instanceof UsernameToken) {
            unassertPolicy(sbinding, "UsernameTokens not supported with Symmetric binding");
            return;
        }
        assertToken(encryptionToken);
        if (tok == null) {
            tokenId = XMLUtils.getIDFromReference(tokenId);
            // Get hold of the token from the token storage
            tok = TokenStoreUtils.getTokenStore(message).getToken(tokenId);
        }
        // Store key
        if (!(MessageUtils.isRequestor(message) && encryptionToken instanceof KerberosToken)) {
            storeSecurityToken(encryptionToken, tok);
        }
        List<SecurePart> encrParts = null;
        List<SecurePart> sigParts = null;
        try {
            encrParts = getEncryptedParts();
            // Signed parts are determined before encryption because encrypted signed headers
            // will not be included otherwise
            sigParts = getSignedParts();
        } catch (SOAPException ex) {
            throw new Fault(ex);
        }
        addSupportingTokens();
        if (encryptionToken != null && !encrParts.isEmpty()) {
            if (isRequestor()) {
                encrParts.addAll(encryptedTokensList);
            }
            // Check for signature protection
            if (sbinding.isEncryptSignature()) {
                SecurePart part = new SecurePart(new QName(XMLSecurityConstants.NS_DSIG, "Signature"), Modifier.Element);
                encrParts.add(part);
                if (signatureConfirmationAdded) {
                    part = new SecurePart(WSSConstants.TAG_WSSE11_SIG_CONF, Modifier.Element);
                    encrParts.add(part);
                }
                assertPolicy(new QName(sbinding.getName().getNamespaceURI(), SPConstants.ENCRYPT_SIGNATURE));
            }
            doEncryption(encryptionWrapper, encrParts, true);
        }
        if (timestampAdded) {
            SecurePart part = new SecurePart(new QName(WSSConstants.NS_WSU10, "Timestamp"), Modifier.Element);
            sigParts.add(part);
        }
        sigParts.addAll(this.getSignedParts());
        if (!sigParts.isEmpty()) {
            AbstractTokenWrapper sigAbstractTokenWrapper = getSignatureToken();
            if (sigAbstractTokenWrapper != null) {
                AbstractToken sigToken = sigAbstractTokenWrapper.getToken();
                if (isRequestor()) {
                    doSignature(sigAbstractTokenWrapper, sigToken, tok, sigParts);
                } else {
                    addSignatureConfirmation(sigParts);
                    doSignature(sigAbstractTokenWrapper, sigToken, tok, sigParts);
                }
            }
        }
        removeSignatureIfSignedSAML();
        enforceEncryptBeforeSigningWithSignedSAML();
        prependSignatureToSC();
        putCustomTokenAfterSignature();
    } catch (RuntimeException ex) {
        throw ex;
    } catch (Exception ex) {
        throw new Fault(ex);
    }
}