Examples with SecurityEvent org.apache.xml.security.stax.securityEvent.SecurityEvent used on opensource projects

Example 1 with SecurityEvent

use of org.apache.xml.security.stax.securityEvent.SecurityEvent in project cxf by apache.

the class XmlSecInInterceptor method configureSecurityEventListener.

protected SecurityEventListener configureSecurityEventListener(final Crypto sigCrypto, final Message msg, XMLSecurityProperties securityProperties) {
    final List<SecurityEvent> incomingSecurityEventList = new LinkedList<>();
    SecurityEventListener securityEventListener = new SecurityEventListener() {

        @Override
        public void registerSecurityEvent(SecurityEvent securityEvent) throws XMLSecurityException {
            if (securityEvent.getSecurityEventType() == SecurityEventConstants.AlgorithmSuite) {
                if (encryptionProperties != null) {
                    checkEncryptionAlgorithms((AlgorithmSuiteSecurityEvent) securityEvent);
                }
                if (sigProps != null) {
                    checkSignatureAlgorithms((AlgorithmSuiteSecurityEvent) securityEvent);
                }
            } else if (securityEvent.getSecurityEventType() != SecurityEventConstants.EncryptedKeyToken && securityEvent instanceof TokenSecurityEvent<?>) {
                checkSignatureTrust(sigCrypto, msg, (TokenSecurityEvent<?>) securityEvent);
            }
            incomingSecurityEventList.add(securityEvent);
        }
    };
    msg.getExchange().put(SecurityEvent.class.getName() + ".in", incomingSecurityEventList);
    msg.put(SecurityEvent.class.getName() + ".in", incomingSecurityEventList);
    return securityEventListener;
}

Example 2 with SecurityEvent

use of org.apache.xml.security.stax.securityEvent.SecurityEvent in project cxf by apache.

the class XmlSecOutInterceptor method configureEncryption.

private void configureEncryption(Message message, XMLSecurityProperties properties) throws Exception {
    String symEncAlgo = encryptionProperties.getEncryptionSymmetricKeyAlgo() == null ? XMLCipher.AES_256 : encryptionProperties.getEncryptionSymmetricKeyAlgo();
    properties.setEncryptionSymAlgorithm(symEncAlgo);
    properties.setEncryptionKey(getSymmetricKey(symEncAlgo));
    if (encryptSymmetricKey) {
        X509Certificate sendingCert = null;
        String userName = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.ENCRYPT_USERNAME, message);
        if (RSSecurityUtils.USE_REQUEST_SIGNATURE_CERT.equals(userName) && !MessageUtils.isRequestor(message)) {
            sendingCert = message.getExchange().getInMessage().getContent(X509Certificate.class);
            if (sendingCert == null) {
                @SuppressWarnings("unchecked") final List<SecurityEvent> incomingSecurityEventList = (List<SecurityEvent>) message.getExchange().get(SecurityEvent.class.getName() + ".in");
                sendingCert = getUseReqSigCert(incomingSecurityEventList);
            }
        } else {
            CryptoLoader loader = new CryptoLoader();
            Crypto crypto = loader.getCrypto(message, SecurityConstants.ENCRYPT_CRYPTO, SecurityConstants.ENCRYPT_PROPERTIES);
            userName = RSSecurityUtils.getUserName(crypto, userName);
            if (StringUtils.isEmpty(userName)) {
                throw new Exception("User name is not available");
            }
            sendingCert = getCertificateFromCrypto(crypto, userName);
        }
        if (sendingCert == null) {
            throw new Exception("Sending certificate is not available");
        }
        properties.setEncryptionUseThisCertificate(sendingCert);
        properties.setEncryptionKeyIdentifier(convertKeyIdentifier(encryptionProperties.getEncryptionKeyIdType()));
        properties.setEncryptionKeyName(encryptionProperties.getEncryptionKeyName());
        if (encryptionProperties.getEncryptionKeyTransportAlgo() != null) {
            properties.setEncryptionKeyTransportAlgorithm(encryptionProperties.getEncryptionKeyTransportAlgo());
        }
        if (encryptionProperties.getEncryptionDigestAlgo() != null) {
            properties.setEncryptionKeyTransportDigestAlgorithm(encryptionProperties.getEncryptionDigestAlgo());
        }
    }
    properties.addAction(XMLSecurityConstants.ENCRYPT);
    if (elementsToEncrypt == null || elementsToEncrypt.isEmpty()) {
        LOG.fine("No Elements to encrypt are specified, so the entire request is encrypt");
        SecurePart securePart = new SecurePart((QName) null, SecurePart.Modifier.Element);
        securePart.setSecureEntireRequest(true);
        properties.addEncryptionPart(securePart);
    } else {
        for (QName element : elementsToEncrypt) {
            SecurePart securePart = new SecurePart(element, SecurePart.Modifier.Element);
            properties.addEncryptionPart(securePart);
        }
    }
}

Example 3 with SecurityEvent

use of org.apache.xml.security.stax.securityEvent.SecurityEvent in project cxf by apache.

the class StaxCryptoCoverageChecker method handleMessage.

@Override
public void handleMessage(SoapMessage soapMessage) throws Fault {
    @SuppressWarnings("unchecked") final List<SecurityEvent> incomingSecurityEventList = (List<SecurityEvent>) soapMessage.get(SecurityEvent.class.getName() + ".in");
    List<SecurityEvent> results = new ArrayList<>();
    if (incomingSecurityEventList != null) {
        // Get all Signed/Encrypted Results
        results.addAll(getEventFromResults(WSSecurityEventConstants.SIGNED_PART, incomingSecurityEventList));
        results.addAll(getEventFromResults(WSSecurityEventConstants.SignedElement, incomingSecurityEventList));
        if (encryptBody || encryptUsernameToken) {
            results.addAll(getEventFromResults(WSSecurityEventConstants.ENCRYPTED_PART, incomingSecurityEventList));
            results.addAll(getEventFromResults(WSSecurityEventConstants.EncryptedElement, incomingSecurityEventList));
        }
    }
    try {
        checkSignedBody(results);
        checkEncryptedBody(results);
        if (signTimestamp) {
            // We only insist on the Timestamp being signed if it is actually present in the message
            List<SecurityEvent> timestampResults = getEventFromResults(WSSecurityEventConstants.TIMESTAMP, incomingSecurityEventList);
            if (!timestampResults.isEmpty()) {
                checkSignedTimestamp(results);
            }
        }
        if (signAddressingHeaders) {
            AddressingProperties addressingProperties = (AddressingProperties) soapMessage.get("javax.xml.ws.addressing.context.inbound");
            checkSignedAddressing(results, addressingProperties);
        }
        if (signUsernameToken || encryptUsernameToken) {
            // We only insist on the UsernameToken being signed/encrypted if it is actually
            // present in the message
            List<SecurityEvent> usernameTokenResults = getEventFromResults(WSSecurityEventConstants.USERNAME_TOKEN, incomingSecurityEventList);
            if (!usernameTokenResults.isEmpty()) {
                if (signUsernameToken) {
                    checkSignedUsernameToken(results);
                }
                if (encryptUsernameToken) {
                    checkEncryptedUsernameToken(results);
                }
            }
        }
    } catch (WSSecurityException e) {
        throw createSoapFault(soapMessage.getVersion(), e);
    }
}

Example 4 with SecurityEvent

use of org.apache.xml.security.stax.securityEvent.SecurityEvent in project cxf by apache.

the class StaxCryptoCoverageChecker method checkSignedTimestamp.

private void checkSignedTimestamp(List<SecurityEvent> results) throws WSSecurityException {
    if (!signTimestamp) {
        return;
    }
    boolean isTimestampSigned = false;
    for (SecurityEvent signedEvent : results) {
        AbstractSecuredElementSecurityEvent securedEvent = (AbstractSecuredElementSecurityEvent) signedEvent;
        if (!securedEvent.isSigned()) {
            continue;
        }
        List<QName> signedPath = securedEvent.getElementPath();
        if (isTimestamp(signedPath)) {
            isTimestampSigned = true;
            break;
        }
    }
    if (!isTimestampSigned) {
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, new Exception("The Timestamp is not signed"));
    }
}

Example 5 with SecurityEvent

use of org.apache.xml.security.stax.securityEvent.SecurityEvent in project santuario-java by apache.

the class DecryptionTest method checkMultipleEncryptedElementSecurityEvents.

protected void checkMultipleEncryptedElementSecurityEvents(TestSecurityEventListener securityEventListener) {
    List<SecurityEvent> encryptedElements = securityEventListener.getSecurityEvents(SecurityEventConstants.EncryptedElement);
    assertTrue(encryptedElements.size() == 2);
    EncryptedElementSecurityEvent encryptedElementEvent = (EncryptedElementSecurityEvent) encryptedElements.get(0);
    assertNotNull(encryptedElementEvent);
    assertEquals(encryptedElementEvent.getElementPath().size(), 2);
    assertEquals("{urn:example:po}PurchaseOrder", encryptedElementEvent.getElementPath().get(0).toString());
    assertEquals("{urn:example:po}ShippingAddress", encryptedElementEvent.getElementPath().get(1).toString());
    assertTrue(encryptedElementEvent.isEncrypted());
    encryptedElementEvent = (EncryptedElementSecurityEvent) encryptedElements.get(1);
    assertNotNull(encryptedElementEvent);
    assertEquals(encryptedElementEvent.getElementPath().size(), 2);
    assertEquals("{urn:example:po}PurchaseOrder", encryptedElementEvent.getElementPath().get(0).toString());
    assertEquals("{urn:example:po}PaymentInfo", encryptedElementEvent.getElementPath().get(1).toString());
    assertTrue(encryptedElementEvent.isEncrypted());
}