Examples with InboundWSSec org.apache.wss4j.stax.setup.InboundWSSec used on opensource projects

Example 1 with InboundWSSec

use of org.apache.wss4j.stax.setup.InboundWSSec in project cxf by apache.

the class WSS4JStaxInInterceptor method handleMessage.

@Override
public void handleMessage(SoapMessage soapMessage) throws Fault {
    if (soapMessage.containsKey(SECURITY_PROCESSED) || isGET(soapMessage)) {
        return;
    }
    soapMessage.getInterceptorChain().add(new StaxStartBodyInterceptor());
    XMLStreamReader originalXmlStreamReader = soapMessage.getContent(XMLStreamReader.class);
    XMLStreamReader newXmlStreamReader;
    soapMessage.getInterceptorChain().add(new StaxSecurityContextInInterceptor());
    try {
        @SuppressWarnings("unchecked") List<SecurityEvent> requestSecurityEvents = (List<SecurityEvent>) soapMessage.getExchange().get(SecurityEvent.class.getName() + ".out");
        WSSSecurityProperties secProps = createSecurityProperties();
        translateProperties(soapMessage, secProps);
        configureCallbackHandler(soapMessage, secProps);
        configureProperties(soapMessage, secProps);
        if (secProps.getActions() != null && secProps.getActions().size() > 0) {
            soapMessage.getInterceptorChain().add(new StaxActionInInterceptor(secProps.getActions()));
        }
        if (secProps.getAttachmentCallbackHandler() == null) {
            secProps.setAttachmentCallbackHandler(new AttachmentCallbackHandler(soapMessage));
        }
        final TokenStoreCallbackHandler callbackHandler = new TokenStoreCallbackHandler(secProps.getCallbackHandler(), TokenStoreUtils.getTokenStore(soapMessage));
        secProps.setCallbackHandler(callbackHandler);
        setTokenValidators(secProps, soapMessage);
        secProps.setMsgContext(soapMessage);
        final List<SecurityEventListener> securityEventListeners = configureSecurityEventListeners(soapMessage, secProps);
        boolean returnSecurityError = MessageUtils.getContextualBoolean(soapMessage, SecurityConstants.RETURN_SECURITY_ERROR, false);
        final InboundWSSec inboundWSSec = WSSec.getInboundWSSec(secProps, MessageUtils.isRequestor(soapMessage), returnSecurityError);
        newXmlStreamReader = inboundWSSec.processInMessage(originalXmlStreamReader, requestSecurityEvents, securityEventListeners);
        final Object provider = soapMessage.getExchange().get(Provider.class);
        if (provider != null && ThreadLocalSecurityProvider.isInstalled()) {
            newXmlStreamReader = new StreamReaderDelegate(newXmlStreamReader) {

                @Override
                public int next() throws XMLStreamException {
                    try {
                        ThreadLocalSecurityProvider.setProvider((Provider) provider);
                        return super.next();
                    } finally {
                        ThreadLocalSecurityProvider.unsetProvider();
                    }
                }
            };
        }
        soapMessage.setContent(XMLStreamReader.class, newXmlStreamReader);
        // Warning: The exceptions which can occur here are not security relevant exceptions
        // but configuration-errors. To catch security relevant exceptions you have to catch
        // them e.g.in the FaultOutInterceptor. Why? Because we do streaming security. This
        // interceptor doesn't handle the ws-security stuff but just setup the relevant stuff
        // for it. Exceptions will be thrown as a wrapped XMLStreamException during further
        // processing in the WS-Stack.
        soapMessage.put(SECURITY_PROCESSED, Boolean.TRUE);
    } catch (WSSecurityException e) {
        throw WSS4JUtils.createSoapFault(soapMessage, soapMessage.getVersion(), e);
    } catch (XMLSecurityException e) {
        throw new SoapFault(new Message("STAX_EX", LOG), e, soapMessage.getVersion().getSender());
    } catch (WSSPolicyException e) {
        throw new SoapFault(e.getMessage(), e, soapMessage.getVersion().getSender());
    } catch (XMLStreamException e) {
        throw new SoapFault(new Message("STAX_EX", LOG), e, soapMessage.getVersion().getSender());
    }
}