com.sun.xml.ws.security.secconv.WSSCPlugin Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of webservices-rt Show documentation
Show all versions of webservices-rt Show documentation
This module contains the Metro runtime code.
/*
* Copyright (c) 1997, 2020 Oracle and/or its affiliates. All rights reserved.
*
* This program and the accompanying materials are made available under the
* terms of the Eclipse Distribution License v. 1.0, which is available at
* http://www.eclipse.org/org/documents/edl-v10.php.
*
* SPDX-License-Identifier: BSD-3-Clause
*/
/*
* WSSCPlugin.java
*
* Created on February 7, 2006, 4:09 PM
*/
package com.sun.xml.ws.security.secconv;
import com.sun.xml.ws.api.addressing.AddressingVersion;
import com.sun.xml.ws.api.message.AddressingUtils;
import com.sun.xml.ws.api.message.Message;
import com.sun.xml.ws.api.message.Messages;
import com.sun.xml.ws.api.message.Packet;
import com.sun.xml.ws.api.message.MessageHeaders;
import com.sun.xml.ws.api.WSBinding;
import com.sun.xml.ws.api.model.wsdl.WSDLPort;
import com.sun.xml.ws.api.pipe.Engine;
import com.sun.xml.ws.api.pipe.Fiber;
import com.sun.xml.ws.api.pipe.Tube;
import com.sun.xml.ws.api.security.secconv.client.SCTokenConfiguration;
import com.sun.xml.ws.policy.AssertionSet;
import com.sun.xml.ws.policy.PolicyAssertion;
import com.sun.xml.ws.security.IssuedTokenContext;
import com.sun.xml.ws.security.impl.policy.PolicyUtil;
import com.sun.xml.ws.security.policy.AlgorithmSuite;
import com.sun.xml.ws.security.policy.SecureConversationToken;
import com.sun.xml.ws.security.policy.SecurityPolicyVersion;
import com.sun.xml.ws.security.trust.WSTrustConstants;
import com.sun.xml.ws.security.trust.WSTrustElementFactory;
import com.sun.xml.ws.api.security.trust.WSTrustException;
import com.sun.xml.ws.security.impl.policyconv.PolicyID;
import com.sun.xml.ws.security.impl.policyconv.SecurityPolicyUtil;
import com.sun.xml.ws.security.policy.Binding;
import com.sun.xml.ws.security.policy.Token;
import com.sun.xml.ws.security.trust.elements.BinarySecret;
import com.sun.xml.ws.security.trust.elements.CancelTarget;
import com.sun.xml.ws.security.trust.elements.Entropy;
import com.sun.xml.ws.security.trust.elements.RequestSecurityToken;
import com.sun.xml.ws.security.trust.elements.RequestSecurityTokenResponse;
import com.sun.xml.ws.security.trust.elements.str.SecurityTokenReference;
import java.net.URI;
import java.security.SecureRandom;
import jakarta.xml.soap.SOAPException;
import jakarta.xml.ws.soap.SOAPFaultException;
import jakarta.xml.bind.JAXBElement;
import jakarta.xml.bind.JAXBException;
import jakarta.xml.bind.Marshaller;
import jakarta.xml.bind.Unmarshaller;
import java.util.logging.Level;
import java.util.logging.Logger;
import com.sun.xml.ws.security.secconv.logging.LogDomainConstants;
import com.sun.xml.ws.security.secconv.logging.LogStringsMessages;
import com.sun.xml.ws.security.trust.WSTrustVersion;
import com.sun.xml.ws.security.trust.elements.BaseSTSRequest;
import com.sun.xml.ws.security.trust.elements.BaseSTSResponse;
import com.sun.xml.ws.security.trust.elements.Lifetime;
import com.sun.xml.ws.security.trust.elements.RenewTarget;
import com.sun.xml.ws.security.trust.elements.RequestSecurityTokenResponseCollection;
import com.sun.xml.ws.security.trust.util.WSTrustUtil;
import com.sun.xml.wss.XWSSecurityException;
import com.sun.xml.wss.impl.MessageConstants;
import com.sun.xml.wss.impl.policy.mls.DerivedTokenKeyBinding;
import com.sun.xml.wss.impl.policy.mls.SecureConversationTokenKeyBinding;
import com.sun.xml.wss.impl.policy.mls.SignaturePolicy;
import com.sun.xml.wss.provider.wsit.WSITClientAuthContext;
import com.sun.xml.wss.jaxws.impl.SecurityClientTube;
import java.io.StringWriter;
import java.util.Iterator;
import java.util.Set;
import jakarta.xml.bind.JAXBContext;
import javax.xml.stream.XMLOutputFactory;
import javax.xml.stream.XMLStreamException;
import javax.xml.stream.XMLStreamWriter;
/**
*
* @author ws-trust-impl-team
*
* ToDo: Handle Cancel request and response.
*/
public class WSSCPlugin {
private static final Logger log =
Logger.getLogger(
LogDomainConstants.WSSC_IMPL_DOMAIN,
LogDomainConstants.WSSC_IMPL_DOMAIN_BUNDLE);
//private WSTrustElementFactory eleFac = WSTrustElementFactory.newInstance();
//private WSSCVersion wsscVer = WSSCVersion.WSSC_10;
//private WSTrustVersion wsTrustVer = WSTrustVersion.WS_TRUST_10;
private static final int DEFAULT_KEY_SIZE = 256;
private static final String SC_ASSERTION = "SecureConversationAssertion";
private static final String FOR_CANCEL = "For Cancel";
private static SignaturePolicy renewSignaturePolicy = null;
private static PolicyID pid = new PolicyID();
private static Binding binding = null;
private Engine fiberEngine;
private Packet packet = null;
/** Creates a new instance of WSSCPlugin */
public WSSCPlugin() {
}
/*
public IssuedTokenContext process(final PolicyAssertion token, final WSDLPort wsdlPort, final WSBinding binding, final Pipe securityPipe, final Marshaller marshaller, final Unmarshaller unmarshaller, final String endPointAddress, final Packet packet, final AddressingVersion addVer){
this.packet = packet;
//==============================
// Get Required policy assertions
//==============================
final SecureConversationToken scToken = (SecureConversationToken)token;
final AssertionSet assertions = getAssertions(scToken);
Trust10 trust10 = null;
Trust13 trust13 = null;
SymmetricBinding symBinding = null;
for(PolicyAssertion policyAssertion : assertions){
SecurityPolicyVersion spVersion = getSPVersion(policyAssertion);
if(PolicyUtil.isTrust13(policyAssertion, spVersion)){
trust13 = (Trust13)policyAssertion;
}else if(PolicyUtil.isTrust10(policyAssertion, spVersion)){
trust10 = (Trust10)policyAssertion;
}else if(PolicyUtil.isSymmetricBinding(policyAssertion, spVersion)){
symBinding = (SymmetricBinding)policyAssertion;
}
}
int skl = DEFAULT_KEY_SIZE;
boolean reqClientEntropy = true;
if(symBinding!=null){
final AlgorithmSuite algoSuite = symBinding.getAlgorithmSuite();
skl = algoSuite.getMinSKLAlgorithm();
if(skl<1){
skl = DEFAULT_KEY_SIZE;
}
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE,
LogStringsMessages.WSSC_1006_SYM_BIN_KEYSIZE(skl, this.DEFAULT_KEY_SIZE));
}
}
if(trust10 != null){
final Set trustReqdProps = trust10.getRequiredProperties();
reqClientEntropy = trustReqdProps.contains(Constants.REQUIRE_CLIENT_ENTROPY);
}
if(trust13 != null){
final Set trustReqdProps = trust13.getRequiredProperties();
reqClientEntropy = trustReqdProps.contains(Constants.REQUIRE_CLIENT_ENTROPY);
}
//==============================
// Create RequestSecurityToken
//==============================
BaseSTSRequest rst = null;
try{
rst = createRequestSecurityToken(reqClientEntropy,skl);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(""), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(""), ex);
}
final BaseSTSResponse rstr = sendRequest(token, wsdlPort, binding, securityPipe, marshaller, unmarshaller, rst, wsscVer.getSCTRequestAction(), endPointAddress, addVer);
// Handle the RequestSecurityTokenResponse
final IssuedTokenContext context = new IssuedTokenContextImpl();
try {
processRequestSecurityTokenResponse(rst, rstr, context);
} catch (WSSecureConversationException ex){
throw new RuntimeException(ex);
}
context.setEndpointAddress(endPointAddress);
return context;
}
*/
public void process(IssuedTokenContext itc){
SCTokenConfiguration sctConfig = (SCTokenConfiguration)itc.getSecurityPolicy().get(0);
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
this.packet = sctConfig.getPacket();
//==============================
// Get Required policy assertions
//==============================
int skl = DEFAULT_KEY_SIZE;
if(sctConfig.isSymmetricBinding()){
skl = sctConfig.getKeySize();
if(skl<1){
skl = DEFAULT_KEY_SIZE;
}
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE, LogStringsMessages.WSSC_1006_SYM_BIN_KEYSIZE(skl, DEFAULT_KEY_SIZE));
}
}
//==============================
// Create RequestSecurityToken
//==============================
BaseSTSRequest rst = null;
try{
rst = createRequestSecurityToken(sctConfig, sctConfig.getReqClientEntropy(),skl);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(""), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(""), ex);
}/* catch (WSTrustException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0021_PROBLEM_CREATING_RST_TRUST(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0021_PROBLEM_CREATING_RST_TRUST(), ex);
}*/
final BaseSTSResponse rstr = sendRequest(sctConfig, rst, itc.getEndpointAddress(), wsscVer.getSCTRequestAction());
if(log.isLoggable(Level.FINE)){
log.log(Level.FINE,
LogStringsMessages.WSSC_1012_RECEIVED_SCT_RSTR_ISSUE(WSTrustUtil.elemToString(rstr, wsTrustVer)));
}
// Handle the RequestSecurityTokenResponse
//final IssuedTokenContext context = new IssuedTokenContextImpl();
try {
processRequestSecurityTokenResponse(sctConfig, rst, rstr, itc);
} catch (WSSecureConversationException ex){
throw new RuntimeException(ex);
}
}
public void processRenew(final IssuedTokenContext itc){
SCTokenConfiguration sctConfig = (SCTokenConfiguration)itc.getSecurityPolicy().get(0);
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
this.packet = sctConfig.getPacket();
//==============================
// Get Required policy assertions
//==============================
int skl = DEFAULT_KEY_SIZE;
if(sctConfig.isSymmetricBinding()){
skl = sctConfig.getKeySize();
if(skl<1){
skl = DEFAULT_KEY_SIZE;
}
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE, LogStringsMessages.WSSC_1006_SYM_BIN_KEYSIZE(skl, DEFAULT_KEY_SIZE));
}
}
//======================================
// Create RequestSecurityToken for Renew
//======================================
BaseSTSRequest rst = null;
try{
rst = createRequestSecurityTokenForRenew(itc, sctConfig.getReqClientEntropy(),skl);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(""), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(""), ex);
}/* catch (WSTrustException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0021_PROBLEM_CREATING_RST_TRUST(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0021_PROBLEM_CREATING_RST_TRUST(), ex);
}*/
createRenewSignaturePolicy(sctConfig.getSCToken());
final BaseSTSResponse rstr = sendRequest(sctConfig, rst, itc.getEndpointAddress(), wsscVer.getSCTRenewRequestAction());
if(log.isLoggable(Level.FINE)){
log.log(Level.FINE,
LogStringsMessages.WSSC_1014_RECEIVED_SCT_RSTR_RENEW(WSTrustUtil.elemToString(rstr, wsTrustVer)));
}
try {
processRequestSecurityTokenResponse(sctConfig, rst, rstr, itc);
} catch (WSSecureConversationException ex){
throw new RuntimeException(ex);
}
}
private BaseSTSResponse sendRequest(final SCTokenConfiguration sctConfig, final BaseSTSRequest rst, final String endPointAddress, final String action) {
Marshaller marshaller;
Unmarshaller unmarshaller;
final JAXBContext jaxbContext;
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
WSTrustElementFactory eleFac = WSTrustElementFactory.newInstance(wsTrustVer);
jaxbContext = WSTrustElementFactory.getContext(wsTrustVer);
try {
marshaller = jaxbContext.createMarshaller();
unmarshaller = jaxbContext.createUnmarshaller();
} catch (JAXBException ex){
log.log(Level.SEVERE,"WSSC0016.problem.mar.unmar", ex);
throw new RuntimeException("Problem creating JAXB Marshaller/Unmarshaller", ex);
}
final Message request = Messages.create(marshaller, eleFac.toJAXBElement(rst), sctConfig.getWSBinding().getSOAPVersion());
// Log Request created
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE,
LogStringsMessages.WSSC_1009_SEND_REQ_MESSAGE(printMessageAsString(request)));
}
Packet reqPacket = new Packet(request);
if (sctConfig.getSCToken() != null){
reqPacket.invocationProperties.put(SC_ASSERTION, sctConfig.getSCToken());
}
if (sctConfig.getPacket() != null){
for(WSTrustConstants.STS_PROPERTIES stsProperty : WSTrustConstants.STS_PROPERTIES.values()) {
reqPacket.invocationProperties.put(stsProperty.toString(),sctConfig.getPacket().invocationProperties.get(stsProperty.toString()));
}
}
//reqPacket.setEndPointAddressString(endPointAddress);
reqPacket.endpointAddress = packet.endpointAddress;
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE,
LogStringsMessages.WSSC_1008_SET_EP_ADDRESS(endPointAddress));
}
// Add addressing headers to the message
try{
reqPacket = addAddressingHeaders(reqPacket, sctConfig.getWSDLPort(), sctConfig.getWSBinding(), action, sctConfig.getAddressingVersion());
}catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0017_PROBLEM_ADD_ADDRESS_HEADERS(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0017_PROBLEM_ADD_ADDRESS_HEADERS(), ex);
}
// Ideally this property for enabling FI or not should be available to the pipeline.
// As a workaround for now, we
// copy the property for the client packet to the reqPacket mananually here.
if (sctConfig.getPacket() != null){
reqPacket.contentNegotiation = sctConfig.getPacket().contentNegotiation;
}
copyStandardSecurityProperties(sctConfig.getPacket(),reqPacket);
// Send the message
Packet respPacket = null;
if(sctConfig.getClientTube() != null){
reqPacket = ((SecurityClientTube)sctConfig.getClientTube()).processClientRequestPacket(reqPacket);
Tube tubeline = sctConfig.getNextTube();
Fiber fiber = getFiberEngine().createFiber();
respPacket = fiber.runSync(tubeline, reqPacket);
respPacket = ((SecurityClientTube)sctConfig.getClientTube()).processClientResponsePacket(respPacket);
}else{
WSITClientAuthContext wsitAuthCtx = (WSITClientAuthContext)sctConfig.getOtherOptions().get(MessageConstants.WSIT_CLIENT_AUTHCONTEXT);
if (wsitAuthCtx != null){
try{
respPacket = wsitAuthCtx.secureRequest(reqPacket, null, true);
} catch (XWSSecurityException e) {
throw new RuntimeException( e);
}
}
}
// Obtain the RequestSecurtyTokenResponse
final Message response = respPacket.getMessage();
BaseSTSResponse rstr = null;
if (!response.isFault()){
JAXBElement rstrEle = null;
try {
rstrEle = (JAXBElement)response.readPayloadAsJAXB(unmarshaller);
}catch (JAXBException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0018_ERR_JAXB_RSTR(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0018_ERR_JAXB_RSTR(), ex);
}
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13.getNamespaceURI())){
try {
rstr = eleFac.createRSTRCollectionFrom(rstrEle);
} catch (Exception e) {
rstr = eleFac.createRSTRFrom(rstrEle);
}
}else{
rstr = eleFac.createRSTRFrom(rstrEle);
}
} else {
try{
//SOAPFaultBuilder builder = SOAPFaultBuilder.create(response);
//throw (SOAPFaultException)builder.createException(null, response);
throw new SOAPFaultException(response.readAsSOAPMessage().getSOAPBody().getFault());
} catch (Exception ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0022_PROBLEM_CREATING_FAULT(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0022_PROBLEM_CREATING_FAULT(), ex);
}
}
return rstr;
}
private AssertionSet getAssertions(final SecureConversationToken scToken) {
return scToken.getBootstrapPolicy().getAssertionSet();
}
/*
public IssuedTokenContext processCancellation(final IssuedTokenContext ctx, final WSDLPort wsdlPort, final WSBinding binding, final Pipe securityPipe, final Marshaller marshaller, final Unmarshaller unmarshaller, final String endPointAddress, final AddressingVersion addVer){
//==============================
// Create RequestSecurityToken
//==============================
BaseSTSRequest rst = null;
try{
rst = createRequestSecurityTokenForCancel(ctx);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(FOR_CANCEL), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(FOR_CANCEL), ex);
}
final BaseSTSResponse rstr = sendRequest(null, wsdlPort, binding, securityPipe, marshaller, unmarshaller, rst, wsscVer.getSCTCancelRequestAction(), endPointAddress, addVer);
// Handle the RequestSecurityTokenResponse
try {
processRequestSecurityTokenResponse(rst, rstr, ctx);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0020_PROBLEM_CREATING_RSTR(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0020_PROBLEM_CREATING_RSTR(), ex);
}
return ctx;
}*/
public void processCancellation(final IssuedTokenContext itc){
SCTokenConfiguration sctConfig = (SCTokenConfiguration)itc.getSecurityPolicy().get(0);
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
this.packet = sctConfig.getPacket();
//==============================
// Create RequestSecurityToken
//==============================
BaseSTSRequest rst = null;
try{
rst = createRequestSecurityTokenForCancel(sctConfig, itc);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(FOR_CANCEL), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0024_ERROR_CREATING_RST(FOR_CANCEL), ex);
}
final BaseSTSResponse rstr = sendRequest(sctConfig, rst, itc.getEndpointAddress(), wsscVer.getSCTCancelRequestAction());
if(log.isLoggable(Level.FINE)){
log.log(Level.FINE,
LogStringsMessages.WSSC_1016_RECEIVED_SCT_RSTR_CANCEL(WSTrustUtil.elemToString(rstr, wsTrustVer)));
}
// Handle the RequestSecurityTokenResponse
try {
processRequestSecurityTokenResponse(sctConfig, rst, rstr, itc);
} catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0020_PROBLEM_CREATING_RSTR(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0020_PROBLEM_CREATING_RSTR(), ex);
}
}
/*
private BaseSTSResponse sendRequest(final PolicyAssertion issuedToken, final WSDLPort wsdlPort, final WSBinding binding, final Pipe securityPipe, final Marshaller marshaller, final Unmarshaller unmarshaller, final BaseSTSRequest rst, final String action, final String endPointAddress, final AddressingVersion addVer) {
// Marshaller marshaller;
//Unmarshaller unmarshaller;
// try {
// marshaller = jbCxt.createMarshaller();
// unmarshaller = jbCxt.createUnmarshaller();
//} catch (JAXBException ex){
// log.log(Level.SEVERE,"WSSC0016.problem.mar.unmar", ex);
// throw new RuntimeException("Problem creating JAXB Marshaller/Unmarshaller", ex);
//}
final Message request = Messages.create(marshaller, eleFac.toJAXBElement(rst), binding.getSOAPVersion());
// Log Request created
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE,
LogStringsMessages.WSSC_1009_SEND_REQ_MESSAGE(printMessageAsString(request)));
}
Packet reqPacket = new Packet(request);
if (issuedToken != null){
reqPacket.invocationProperties.put(SC_ASSERTION, issuedToken);
}
if (packet != null){
for(WSTrustConstants.STS_PROPERTIES stsProperty : WSTrustConstants.STS_PROPERTIES.values()) {
reqPacket.invocationProperties.put(stsProperty.toString(),packet.invocationProperties.get(stsProperty.toString()));
}
}
reqPacket.setEndPointAddressString(endPointAddress);
if (log.isLoggable(Level.FINE)) {
log.log(Level.FINE,
LogStringsMessages.WSSC_1008_SET_EP_ADDRESS(endPointAddress));
}
// Add addressing headers to the message
try{
reqPacket = addAddressingHeaders(reqPacket, wsdlPort, binding, action, addVer);
}catch (WSSecureConversationException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0017_PROBLEM_ADD_ADDRESS_HEADERS(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0017_PROBLEM_ADD_ADDRESS_HEADERS(), ex);
}
// Ideally this property for enabling FI or not should be available to the pipeline.
// As a workaround for now, we
// copy the property for the client packet to the reqPacket mananually here.
if (packet != null){
reqPacket.contentNegotiation = packet.contentNegotiation;
}
copyStandardSecurityProperties(packet,reqPacket);
// Send the message
final Packet respPacket = securityPipe.process(reqPacket);
// Obtain the RequestSecurtyTokenResponse
final Message response = respPacket.getMessage();
BaseSTSResponse rstr = null;
if (!response.isFault()){
JAXBElement rstrEle = null;
try {
rstrEle = (JAXBElement)response.readPayloadAsJAXB(unmarshaller);
}catch (JAXBException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0018_ERR_JAXB_RSTR(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0018_ERR_JAXB_RSTR(), ex);
}
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13.getNamespaceURI())){
rstr = eleFac.createRSTRCollectionFrom(rstrEle);
}else{
rstr = eleFac.createRSTRFrom(rstrEle);
}
} else {
try{
// SOAPFaultBuilder builder = SOAPFaultBuilder.create(response);
//throw (SOAPFaultException)builder.createException(null, response);
throw new SOAPFaultException(response.readAsSOAPMessage().getSOAPBody().getFault());
} catch (SOAPException ex){
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0022_PROBLEM_CREATING_FAULT(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0022_PROBLEM_CREATING_FAULT(), ex);
}
}
return rstr;
}*/
/*
private RequestSecurityToken createRequestSecurityToken(final boolean reqClientEntropy,final int skl) throws WSSecureConversationException{
final URI tokenType = URI.create(wsscVer.getSCTTokenTypeURI());
final URI requestType = URI.create(wsTrustVer.getIssueRequestTypeURI());
final SecureRandom random = new SecureRandom();
final byte[] rawValue = new byte[skl/8];
random.nextBytes(rawValue);
final BinarySecret secret = eleFac.createBinarySecret(rawValue, wsTrustVer.getNonceBinarySecretTypeURI());
final Entropy entropy = reqClientEntropy?eleFac.createEntropy(secret):null;
RequestSecurityToken rst = null;
try {
rst = eleFac.createRSTForIssue(tokenType, requestType, null, null, null, entropy, null);
rst.setKeySize(skl);
rst.setKeyType(URI.create(wsTrustVer.getSymmetricKeyTypeURI()));
rst.setComputedKeyAlgorithm(URI.create(wsTrustVer.getCKPSHA1algorithmURI()));
} catch (WSTrustException ex){
throw new WSSecureConversationException(ex);
}
return rst;
}*/
private RequestSecurityToken createRequestSecurityToken(final SCTokenConfiguration sctConfig, final boolean reqClientEntropy,final int skl) throws WSSecureConversationException{
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
WSTrustElementFactory eleFac = WSTrustElementFactory.newInstance(wsTrustVer);
final URI tokenType = URI.create(wsscVer.getSCTTokenTypeURI());
final URI requestType = URI.create(wsTrustVer.getIssueRequestTypeURI());
final SecureRandom random = new SecureRandom();
final byte[] rawValue = new byte[skl/8];
random.nextBytes(rawValue);
final BinarySecret secret = eleFac.createBinarySecret(rawValue, wsTrustVer.getNonceBinarySecretTypeURI());
final Entropy entropy = reqClientEntropy?eleFac.createEntropy(secret):null;
Lifetime lifetime = null;
if(sctConfig.getSCTokenTimeout() > 0){
// Create Lifetime
long currentTime = WSTrustUtil.getCurrentTimeWithOffset();
lifetime = WSTrustUtil.createLifetime(currentTime, sctConfig.getSCTokenTimeout(), wsTrustVer);
}
RequestSecurityToken rst = null;
try {
rst = eleFac.createRSTForIssue(tokenType, requestType, null, null, null, entropy, lifetime);
rst.setKeySize(skl);
rst.setKeyType(URI.create(wsTrustVer.getSymmetricKeyTypeURI()));
rst.setComputedKeyAlgorithm(URI.create(wsTrustVer.getCKPSHA1algorithmURI()));
} catch (WSTrustException ex){
throw new WSSecureConversationException(ex);
}
if(log.isLoggable(Level.FINE)){
log.log(Level.FINE, LogStringsMessages.WSSC_1011_CREATED_SCT_RST_ISSUE(WSTrustUtil.elemToString(rst, wsTrustVer)));
}
return rst;
}
private RequestSecurityToken createRequestSecurityTokenForRenew( final IssuedTokenContext itc, final boolean reqClientEntropy,final int skl) throws WSSecureConversationException{
SCTokenConfiguration sctConfig = (SCTokenConfiguration)itc.getSecurityPolicy().get(0);
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
WSTrustElementFactory eleFac = WSTrustElementFactory.newInstance(wsTrustVer);
final URI tokenType = URI.create(wsscVer.getSCTTokenTypeURI());
final URI requestType = URI.create(wsTrustVer.getRenewRequestTypeURI());
final SecureRandom random = new SecureRandom();
final byte[] rawValue = new byte[skl/8];
random.nextBytes(rawValue);
final BinarySecret secret = eleFac.createBinarySecret(rawValue, wsTrustVer.getNonceBinarySecretTypeURI());
final Entropy entropy = reqClientEntropy?eleFac.createEntropy(secret):null;
final RenewTarget target = eleFac.createRenewTarget((SecurityTokenReference)itc.getUnAttachedSecurityTokenReference());
RequestSecurityToken rst = null;
try {
rst = eleFac.createRSTForRenew(tokenType, requestType, null, target, null, null);
rst.setEntropy(entropy);
rst.setKeySize(skl);
rst.setKeyType(URI.create(wsTrustVer.getSymmetricKeyTypeURI()));
rst.setComputedKeyAlgorithm(URI.create(wsTrustVer.getCKPSHA1algorithmURI()));
} catch (WSTrustException ex){
throw new WSSecureConversationException(ex);
}
Lifetime lifetime = null;
if(sctConfig.getSCTokenTimeout() > 0){
// Create Lifetime
long currentTime = WSTrustUtil.getCurrentTimeWithOffset();
lifetime = WSTrustUtil.createLifetime(currentTime, sctConfig.getSCTokenTimeout(), wsTrustVer);
rst.setLifetime(lifetime);
}
//final RequestSecurityToken rst = eleFac.createRSTForRenew(null, requestType, null, target, null, null);
if(log.isLoggable(Level.FINE)){
log.log(Level.FINE, LogStringsMessages.WSSC_1013_CREATED_SCT_RST_RENEW(WSTrustUtil.elemToString(rst, wsTrustVer)));
}
return rst;
}
private RequestSecurityToken createRequestSecurityTokenForCancel(final SCTokenConfiguration sctConfig, final IssuedTokenContext ctx) throws WSSecureConversationException{
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
WSTrustVersion wsTrustVer = null;
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13_NS_URI)){
wsTrustVer = WSTrustVersion.WS_TRUST_13;
}else{
wsTrustVer = WSTrustVersion.WS_TRUST_10;
}
WSTrustElementFactory eleFac = WSTrustElementFactory.newInstance(wsTrustVer);
URI requestType = URI.create(wsTrustVer.getCancelRequestTypeURI());
final CancelTarget target = eleFac.createCancelTarget((SecurityTokenReference)ctx.getUnAttachedSecurityTokenReference());
final RequestSecurityToken rst = eleFac.createRSTForCancel(requestType, target);
if(log.isLoggable(Level.FINE)){
log.log(Level.FINE, LogStringsMessages.WSSC_1015_CREATED_SCT_RST_CANCEL(WSTrustUtil.elemToString(rst, wsTrustVer)));
}
return rst;
}
/*
private RequestSecurityToken createRequestSecurityTokenForCancel(final IssuedTokenContext ctx) throws WSSecureConversationException{
URI requestType = null;
requestType = URI.create(wsTrustVer.getCancelRequestTypeURI());
final CancelTarget target = eleFac.createCancelTarget((SecurityTokenReference)ctx.getUnAttachedSecurityTokenReference());
final RequestSecurityToken rst = eleFac.createRSTForCancel(requestType, target);
return rst;
}*/
/*
private void processRequestSecurityTokenResponse(final BaseSTSRequest rst, final BaseSTSResponse rstr, final IssuedTokenContext context)
throws WSSecureConversationException {
SCTokenConfiguration sctConfig = (SCTokenConfiguration)context.getSecurityPolicy().get(0);
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
final WSSCClientContract contract = WSSCFactory.newWSSCClientContract(config);
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13.getNamespaceURI())){
contract.handleRSTRC((RequestSecurityToken)rst, (RequestSecurityTokenResponseCollection)rstr, context);
}else{
contract.handleRSTR((RequestSecurityToken)rst, (RequestSecurityTokenResponse)rstr, context);
}
}*/
private void processRequestSecurityTokenResponse(final SCTokenConfiguration sctConfig, final BaseSTSRequest rst, final BaseSTSResponse rstr, final IssuedTokenContext context)
throws WSSecureConversationException {
WSSCVersion wsscVer = WSSCVersion.getInstance(sctConfig.getProtocol());
final WSSCClientContract contract = WSSCFactory.newWSSCClientContract();
if(wsscVer.getNamespaceURI().equals(WSSCVersion.WSSC_13.getNamespaceURI())){
try {
contract.handleRSTRC((RequestSecurityToken) rst, (RequestSecurityTokenResponseCollection) rstr, context);
} catch (Exception ex) {
contract.handleRSTR((RequestSecurityToken)rst, (RequestSecurityTokenResponse)rstr, context);
}
}else{
contract.handleRSTR((RequestSecurityToken)rst, (RequestSecurityTokenResponse)rstr, context);
}
}
private String printMessageAsString(final Message message) {
final StringWriter writer = new StringWriter();
final XMLOutputFactory factory = XMLOutputFactory.newInstance();
try {
final XMLStreamWriter streamWriter = factory.createXMLStreamWriter(writer);
message.writeTo(streamWriter);
streamWriter.flush();
return writer.toString();
} catch (XMLStreamException ex) {
log.log(Level.SEVERE,
LogStringsMessages.WSSC_0025_PROBLEM_PRINTING_MSG(), ex);
throw new RuntimeException(LogStringsMessages.WSSC_0025_PROBLEM_PRINTING_MSG(), ex);
}
}
private Packet addAddressingHeaders(final Packet packet, final WSDLPort wsdlPort, final WSBinding binding, final String action, final AddressingVersion addVer)throws WSSecureConversationException {
final MessageHeaders list = packet.getMessage().getHeaders();
AddressingUtils.fillRequestAddressingHeaders(list, packet, addVer,binding.getSOAPVersion(),false,action);
return packet;
}
private void copyStandardSecurityProperties(Packet packet, Packet requestPacket) {
/*String username = (String) packet.invocationProperties.get(com.sun.xml.wss.XWSSConstants.USERNAME_PROPERTY);
if (username != null) {
requestPacket.invocationProperties.put(com.sun.xml.wss.XWSSConstants.USERNAME_PROPERTY, username);
}
String password = (String) packet.invocationProperties.get(com.sun.xml.wss.XWSSConstants.PASSWORD_PROPERTY);
if (password != null) {
requestPacket.invocationProperties.put(com.sun.xml.wss.XWSSConstants.PASSWORD_PROPERTY, password);
}*/
Set set = packet.invocationProperties.keySet();
for (Iterator it = set.iterator(); it.hasNext();) {
String key = (String)it.next();
requestPacket.invocationProperties.put(key, packet.invocationProperties.get(key));
}
}
private void createRenewSignaturePolicy(final Token token){
renewSignaturePolicy = new SignaturePolicy();
//renewSignaturePolicy.setUUID(pid.generateID());
renewSignaturePolicy.setUUID("_99");
SecurityPolicyVersion spVersion = token.getSecurityPolicyVersion();
SecureConversationTokenKeyBinding sct = new SecureConversationTokenKeyBinding();
SecureConversationToken scToken = (SecureConversationToken)token;
if(scToken.isRequireDerivedKeys()){
DerivedTokenKeyBinding dtKB = new DerivedTokenKeyBinding();
dtKB.setOriginalKeyBinding(sct);
renewSignaturePolicy.setKeyBinding(dtKB);
dtKB.setUUID("_100");
}else{
renewSignaturePolicy.setKeyBinding(sct);
}
if(spVersion == SecurityPolicyVersion.SECURITYPOLICY200507){
sct.setIncludeToken(((Token)token).getIncludeToken());
} else{
// SecurityPolicy 1.2
sct.setIncludeToken(SecurityPolicyVersion.SECURITYPOLICY200507.includeTokenAlwaysToRecipient);
}
sct.setUUID(((Token)token).getTokenId());
final AssertionSet assertions = getAssertions(scToken);
for(PolicyAssertion policyAssertion : assertions){
if(PolicyUtil.isBinding(policyAssertion, spVersion)){
binding =(Binding) policyAssertion;
}
}
//SignaturePolicy sp = scPlugin.getRenewSignaturePolicy();
SignaturePolicy.FeatureBinding spFB = (SignaturePolicy.FeatureBinding)renewSignaturePolicy.getFeatureBinding();
AlgorithmSuite as = binding.getAlgorithmSuite();
SecurityPolicyUtil.setCanonicalizationMethod(spFB, as);
}
public SignaturePolicy getRenewSignaturePolicy(){
return renewSignaturePolicy;
}
public AlgorithmSuite getAlgorithmSuite(){
return binding.getAlgorithmSuite();
}
private SecurityPolicyVersion getSPVersion(PolicyAssertion pa){
String nsUri = pa.getName().getNamespaceURI();
// Default SPVersion
SecurityPolicyVersion spVersion = SecurityPolicyVersion.SECURITYPOLICY200507;
// If spec version, update
if(SecurityPolicyVersion.SECURITYPOLICY12NS.namespaceUri.equals(nsUri)){
spVersion = SecurityPolicyVersion.SECURITYPOLICY12NS;
}
return spVersion;
}
private Engine getFiberEngine() {
if (fiberEngine == null) {
fiberEngine = Fiber.current().owner;
}
return fiberEngine;
}
}