Examples with Event org.apache.xml.security.stax.securityEvent.SecurityEventConstants.Event used on opensource projects

Example 1 with Event

use of org.apache.xml.security.stax.securityEvent.SecurityEventConstants.Event in project cxf by apache.

the class StaxActionInInterceptor method handleMessage.

@Override
public void handleMessage(SoapMessage soapMessage) throws Fault {
    if (inActions == null || inActions.isEmpty()) {
        return;
    }
    @SuppressWarnings("unchecked") final List<SecurityEvent> incomingSecurityEventList = (List<SecurityEvent>) soapMessage.get(SecurityEvent.class.getName() + ".in");
    if (incomingSecurityEventList == null) {
        LOG.warning("Security processing failed (actions mismatch)");
        WSSecurityException ex = new WSSecurityException(WSSecurityException.ErrorCode.SECURITY_ERROR);
        throw WSS4JUtils.createSoapFault(soapMessage, soapMessage.getVersion(), ex);
    }
    // First check for a SOAP Fault with no security header if we are the client
    if (MessageUtils.isRequestor(soapMessage) && isEventInResults(WSSecurityEventConstants.NO_SECURITY, incomingSecurityEventList)) {
        OperationSecurityEvent securityEvent = (OperationSecurityEvent) findEvent(WSSecurityEventConstants.OPERATION, incomingSecurityEventList);
        if (securityEvent != null && soapMessage.getVersion().getFault().equals(securityEvent.getOperation())) {
            LOG.warning("Request does not contain Security header, but it's a fault.");
            return;
        }
    }
    for (XMLSecurityConstants.Action action : inActions) {
        Event requiredEvent = null;
        if (WSSConstants.TIMESTAMP.equals(action)) {
            requiredEvent = WSSecurityEventConstants.TIMESTAMP;
        } else if (WSSConstants.USERNAMETOKEN.equals(action)) {
            requiredEvent = WSSecurityEventConstants.USERNAME_TOKEN;
        } else if (XMLSecurityConstants.SIGNATURE.equals(action)) {
            requiredEvent = WSSecurityEventConstants.SignatureValue;
        } else if (WSSConstants.SAML_TOKEN_SIGNED.equals(action) || WSSConstants.SAML_TOKEN_UNSIGNED.equals(action)) {
            requiredEvent = WSSecurityEventConstants.SAML_TOKEN;
        }
        if (requiredEvent != null && !isEventInResults(requiredEvent, incomingSecurityEventList)) {
            LOG.warning("Security processing failed (actions mismatch)");
            WSSecurityException ex = new WSSecurityException(WSSecurityException.ErrorCode.SECURITY_ERROR);
            throw WSS4JUtils.createSoapFault(soapMessage, soapMessage.getVersion(), ex);
        }
        if (XMLSecurityConstants.ENCRYPT.equals(action)) {
            boolean foundEncryptionPart = isEventInResults(WSSecurityEventConstants.ENCRYPTED_PART, incomingSecurityEventList);
            if (!foundEncryptionPart) {
                foundEncryptionPart = isEventInResults(WSSecurityEventConstants.EncryptedElement, incomingSecurityEventList);
            }
            if (!foundEncryptionPart) {
                LOG.warning("Security processing failed (actions mismatch)");
                WSSecurityException ex = new WSSecurityException(WSSecurityException.ErrorCode.SECURITY_ERROR);
                throw WSS4JUtils.createSoapFault(soapMessage, soapMessage.getVersion(), ex);
            }
        }
    }
}

Example 2 with Event

use of org.apache.xml.security.stax.securityEvent.SecurityEventConstants.Event in project cxf by apache.

the class StaxSecurityContextInInterceptor method doResults.

private void doResults(SoapMessage msg, List<SecurityEvent> incomingSecurityEventList) throws WSSecurityException {
    // Now go through the results in a certain order to set up a security context. Highest priority is first.
    List<Event> desiredSecurityEvents = new ArrayList<>();
    desiredSecurityEvents.add(WSSecurityEventConstants.SAML_TOKEN);
    desiredSecurityEvents.add(WSSecurityEventConstants.USERNAME_TOKEN);
    desiredSecurityEvents.add(WSSecurityEventConstants.KERBEROS_TOKEN);
    desiredSecurityEvents.add(WSSecurityEventConstants.X509Token);
    desiredSecurityEvents.add(WSSecurityEventConstants.KeyValueToken);
    for (Event desiredEvent : desiredSecurityEvents) {
        SubjectAndPrincipalSecurityToken token = null;
        try {
            token = getSubjectPrincipalToken(incomingSecurityEventList, desiredEvent, msg);
        } catch (XMLSecurityException ex) {
        // proceed
        }
        if (token != null) {
            Principal p = token.getPrincipal();
            Subject subject = token.getSubject();
            if (subject != null) {
                String roleClassifier = (String) msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER);
                if (roleClassifier != null && !"".equals(roleClassifier)) {
                    String roleClassifierType = (String) msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER_TYPE);
                    if (roleClassifierType == null || "".equals(roleClassifierType)) {
                        roleClassifierType = "prefix";
                    }
                    msg.put(SecurityContext.class, new RolePrefixSecurityContextImpl(subject, roleClassifier, roleClassifierType));
                } else {
                    msg.put(SecurityContext.class, new DefaultSecurityContext(subject));
                }
                break;
            } else if (p != null) {
                Object receivedAssertion = null;
                if (desiredEvent == WSSecurityEventConstants.SAML_TOKEN) {
                    String roleAttributeName = (String) SecurityUtils.getSecurityPropertyValue(SecurityConstants.SAML_ROLE_ATTRIBUTENAME, msg);
                    if (roleAttributeName == null || roleAttributeName.length() == 0) {
                        roleAttributeName = SAML_ROLE_ATTRIBUTENAME_DEFAULT;
                    }
                    receivedAssertion = ((SAMLTokenPrincipal) token.getPrincipal()).getToken();
                    if (receivedAssertion != null) {
                        ClaimCollection claims = SAMLUtils.getClaims((SamlAssertionWrapper) receivedAssertion);
                        Set<Principal> roles = SAMLUtils.parseRolesFromClaims(claims, roleAttributeName, null);
                        SAMLSecurityContext context = new SAMLSecurityContext(p, roles, claims);
                        msg.put(SecurityContext.class, context);
                    }
                } else {
                    msg.put(SecurityContext.class, createSecurityContext(p));
                }
                break;
            }
        }
    }
}