| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| #include <rampart_sct_provider.h> |
| #include <rampart_sct_provider_utility.h> |
| #include <oxs_constants.h> |
| #include <oxs_buffer.h> |
| #include <axiom_element.h> |
| #include <rampart_constants.h> |
| #include <trust_sts_client.h> |
| #include <oxs_utility.h> |
| #include <rampart_handler_util.h> |
| |
| #define RAMPART_SCT_PROVIDER_HASH_PROB "Rampart_SCT_Prov_DB_Prop" |
| |
| static security_context_token_t* |
| sct_provider_obtain_token_from_sts( |
| const axutil_env_t* env, |
| rp_security_context_token_t* rp_sct, |
| axis2_msg_ctx_t* msg_ctx, |
| rampart_context_t *rampart_context); |
| |
| static rampart_context_t * |
| get_new_rampart_context( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx); |
| |
| |
| /* This method finds security context token using given parameters. If it is called without sct_id, |
| * it will request from STS/Stored context */ |
| static security_context_token_t* |
| sct_provider_get_sct( |
| const axutil_env_t* env, |
| rp_property_t *token, |
| axis2_bool_t is_encryption, |
| axis2_char_t *sct_id, |
| rampart_context_t* rampart_context, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| security_context_token_t* sct = NULL; |
| |
| /* if sct id is not given, check whether it is stored in rampart context */ |
| if(!sct_id) |
| { |
| if(is_encryption) |
| sct_id = rampart_context_get_encryption_token_id(rampart_context, env, msg_ctx); |
| else |
| sct_id = rampart_context_get_signature_token_id(rampart_context, env, msg_ctx); |
| } |
| |
| if(!sct_id) |
| { |
| /* if sct id is not there in rampart context, then it is not created. |
| * (1) If it is secure conversation token |
| * (a) If server side, we can't do anything. We have to fail. |
| * (b) If client side, we can request from STS |
| * (2) If it is security context token - sct agreed by server and client offline |
| * (a) If server side, can call get_sct method and if returned successfully, store it |
| * (b) If client side, same as server_side |
| */ |
| void* user_params = NULL; |
| rp_security_context_token_t* rp_sct = NULL; |
| |
| /* to check whether security context token or secure conversation token, rp_property (token) |
| * should be valid. If valid, we can extract the security context token property */ |
| if(!token) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]rampart policy property 'token' is not valid. Could not find whether " |
| "token is SecureConversationToken or SecurityContextToken."); |
| return NULL; |
| } |
| |
| rp_sct = (rp_security_context_token_t*)rp_property_get_value(token, env); |
| if(!rp_sct) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]value of rampart policy property 'token' is not valid. Could not find " |
| "whether token is SecureConversationToken or SecurityContextToken."); |
| return NULL; |
| } |
| |
| user_params = rampart_context_get_security_context_token_user_params(rampart_context, env); |
| |
| if(rp_security_context_token_get_is_secure_conversation_token(rp_sct, env)) |
| { |
| /* this is a secure conversation token */ |
| |
| axis2_bool_t is_server_side = AXIS2_FALSE; |
| is_server_side = axis2_msg_ctx_get_server_side(msg_ctx, env); |
| if(!is_server_side) |
| { |
| /* we can request sct from sts */ |
| |
| sct = sct_provider_obtain_token_from_sts(env, rp_sct, msg_ctx, rampart_context); |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart] Secure conversation token is requested without giving ID of SCT. " |
| "This cannot be done in server side."); |
| } |
| } |
| else |
| { |
| /* this is a security context token */ |
| |
| obtain_security_context_token_fn fn_get_sct = NULL; |
| fn_get_sct = rampart_context_get_obtain_security_context_token_fn(rampart_context, env); |
| sct = (security_context_token_t*)fn_get_sct( |
| env, is_encryption, msg_ctx, sct_id, RAMPART_SCT_ID_TYPE_UNKNOWN, user_params); |
| } |
| |
| /* if valid sct, then we have to store it */ |
| if(sct) |
| { |
| axis2_char_t *local_id = NULL; |
| axis2_char_t *global_id = NULL; |
| store_security_context_token_fn fn_store_sct = NULL; |
| |
| local_id = security_context_token_get_local_identifier(sct, env); |
| global_id = security_context_token_get_global_identifier(sct, env); |
| fn_store_sct = rampart_context_get_store_security_context_token_fn( |
| rampart_context, env); |
| if(fn_store_sct(env, msg_ctx, global_id, local_id, (void*)sct, user_params) |
| != AXIS2_SUCCESS) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart] Cannot store newly created security context token."); |
| security_context_token_free(sct, env); |
| sct = NULL; |
| } |
| |
| /* store the global id as encryption/signature id. if same key is used for encryption |
| * and signature, then store it at both place*/ |
| if(rampart_context_is_different_session_key_for_enc_and_sign(env, rampart_context)) |
| { |
| if(is_encryption) |
| rampart_context_set_encryption_token_id(rampart_context, env, global_id, msg_ctx); |
| else |
| rampart_context_set_signature_token_id(rampart_context, env, global_id, msg_ctx); |
| } |
| else |
| { |
| rampart_context_set_encryption_token_id(rampart_context, env, global_id, msg_ctx); |
| rampart_context_set_signature_token_id(rampart_context, env, global_id, msg_ctx); |
| } |
| } |
| } |
| else |
| { |
| /* sct_id is given. So get it from sct provider function. */ |
| |
| void* user_params = NULL; |
| obtain_security_context_token_fn fn_get_sct = NULL; |
| int id_type = RAMPART_SCT_ID_TYPE_GLOBAL; |
| |
| user_params = rampart_context_get_security_context_token_user_params(rampart_context, env); |
| fn_get_sct = rampart_context_get_obtain_security_context_token_fn(rampart_context, env); |
| |
| /* by looking at the first character of sct_id, we can say whether it is local id or global |
| * id. If first character is '#' then it is a local id */ |
| if(*sct_id == '#') |
| { |
| id_type = RAMPART_SCT_ID_TYPE_LOCAL; |
| } |
| sct = fn_get_sct(env, is_encryption, msg_ctx, sct_id, id_type, user_params); |
| } |
| |
| if(!sct) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart] Cannot find security context token for id [%s]", sct_id); |
| } |
| |
| return sct; |
| } |
| |
| /** |
| * Finds security context token and gets shared secret. |
| * returned buffer should NOT be cleared by the caller |
| * @param env Pointer to environment struct |
| * @param token rampart policy property of the token |
| * @param is_encryption boolean showing whether the token is needed for encryption or signature |
| * @param rampart_context pointer to rampart context structure |
| * @param msg_ctx pointer to message context structure |
| * @returns shared secret of the security context token. returned buffer should NOT be freed |
| */ |
| AXIS2_EXTERN oxs_buffer_t *AXIS2_CALL |
| sct_provider_get_secret( |
| const axutil_env_t* env, |
| rp_property_t *token, |
| axis2_bool_t is_encryption, |
| rampart_context_t* rampart_context, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| security_context_token_t* sct = NULL; |
| |
| sct = sct_provider_get_sct(env, token, is_encryption, NULL, rampart_context, msg_ctx); |
| if(!sct) |
| return NULL; |
| |
| return security_context_token_get_secret(sct, env); |
| } |
| |
| /** |
| * Finds security context token and gets shared secret. |
| * returned buffer should NOT be cleared by the caller |
| * @param env Pointer to environment struct |
| * @param sct_id id of security context token |
| * @param rampart_context pointer to rampart context structure |
| * @param msg_ctx pointer to message context structure |
| * @returns shared secret of the security context token. returned buffer should NOT be freed |
| */ |
| AXIS2_EXTERN oxs_buffer_t *AXIS2_CALL |
| sct_provider_get_secret_using_id( |
| const axutil_env_t* env, |
| axis2_char_t* sct_id, |
| rampart_context_t* rampart_context, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| security_context_token_t* sct = NULL; |
| |
| /* since we are getting secret using id, we don't need to specify whether encryption or |
| * signature. Also we don't need to care about policy property of token */ |
| sct = sct_provider_get_sct(env, NULL, AXIS2_TRUE, sct_id, rampart_context, msg_ctx); |
| |
| if(!sct) |
| return NULL; |
| |
| return security_context_token_get_secret(sct, env); |
| } |
| |
| /** |
| * Finds security context token and gets the xml representation of token |
| * @param env Pointer to environment struct |
| * @param token rampart policy property of the token |
| * @param is_encryption boolean showing whether the token is needed for encryption or signature |
| * @param rampart_context pointer to rampart context structure |
| * @param msg_ctx pointer to message context structure |
| * @returns shared secret of the security context token. returned buffer should NOT be freed |
| */ |
| AXIS2_EXTERN axiom_node_t *AXIS2_CALL |
| sct_provider_get_token( |
| const axutil_env_t* env, |
| rp_property_t *token, |
| axis2_bool_t is_encryption, |
| rampart_context_t* rampart_context, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| security_context_token_t* sct = NULL; |
| sct = sct_provider_get_sct(env, token, is_encryption, NULL, rampart_context, msg_ctx); |
| if(!sct) |
| return NULL; |
| |
| return security_context_token_get_token(sct, env); |
| } |
| |
| /** |
| * Finds security context token and gets the xml representation of key reference. This reference |
| * is used when security context token is included in the message |
| * @param env Pointer to environment struct |
| * @param token rampart policy property of the token |
| * @param is_encryption boolean showing whether the token is needed for encryption or signature |
| * @param rampart_context pointer to rampart context structure |
| * @param msg_ctx pointer to message context structure |
| * @returns shared secret of the security context token. returned buffer should NOT be freed |
| */ |
| AXIS2_EXTERN axiom_node_t* AXIS2_CALL |
| sct_provider_get_attached_reference( |
| const axutil_env_t* env, |
| rp_property_t *token, |
| axis2_bool_t is_encryption, |
| rampart_context_t* rampart_context, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| security_context_token_t* sct = NULL; |
| sct = sct_provider_get_sct(env, token, is_encryption, NULL, rampart_context, msg_ctx); |
| if(!sct) |
| return NULL; |
| |
| return security_context_token_get_attached_reference(sct, env); |
| } |
| |
| /** |
| * Finds security context token and gets the xml representation of key reference. This reference |
| * is used when security context token is NOT included in the message |
| * @param env Pointer to environment struct |
| * @param token rampart policy property of the token |
| * @param is_encryption boolean showing whether the token is needed for encryption or signature |
| * @param rampart_context pointer to rampart context structure |
| * @param msg_ctx pointer to message context structure |
| * @returns shared secret of the security context token. returned buffer should NOT be freed |
| */ |
| AXIS2_EXTERN axiom_node_t* AXIS2_CALL |
| sct_provider_get_unattached_reference( |
| const axutil_env_t* env, |
| rp_property_t *token, |
| axis2_bool_t is_encryption, |
| rampart_context_t* rampart_context, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| security_context_token_t* sct = NULL; |
| sct = sct_provider_get_sct(env, token, is_encryption, NULL, rampart_context, msg_ctx); |
| if(!sct) |
| return NULL; |
| |
| return security_context_token_get_unattached_reference(sct, env); |
| } |
| |
| /** |
| * Validates whether security context token is valid or not. Normally, we can directly send |
| * true as response. But if syntax of security context token is altered/added by using |
| * extensible mechanism (e.g having sessions, etc.) then user can implement this method. |
| * Axiom representation of the sct will be given as the parameter, because if sct is extended, |
| * we don't know the syntax. Method writer can implement whatever needed. |
| * @param env Pointer to environment struct |
| * @param sct_node axiom node representation of security context token. |
| * @param rampart_context pointer to rampart context structure |
| * @param msg_ctx pointer to message context structure |
| * @returns AXIS2_TRUE is sct is valid. AXIS2_FALSE otherwise. |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| sct_provider_validate_security_context_token( |
| const axutil_env_t *env, |
| axiom_node_t *sct_node, |
| rampart_context_t *rampart_context, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| validate_security_context_token_fn validate_fn = NULL; |
| void *user_param = NULL; |
| |
| validate_fn = rampart_context_get_validate_security_context_token_fn(rampart_context, env); |
| user_param = rampart_context_get_security_context_token_user_params(rampart_context, env); |
| return validate_fn(env, sct_node, msg_ctx, user_param); |
| } |
| |
| /* This method will request security context token from STS */ |
| static security_context_token_t* |
| sct_provider_obtain_token_from_sts( |
| const axutil_env_t* env, |
| rp_security_context_token_t* rp_sct, |
| axis2_msg_ctx_t* msg_ctx, |
| rampart_context_t *rampart_context) |
| { |
| axis2_char_t* issuer_address = NULL; |
| axis2_char_t* client_home = NULL; |
| axis2_conf_ctx_t* conf_ctx = NULL; |
| axis2_ctx_t *ctx = NULL; |
| axutil_property_t *property = NULL; |
| axis2_char_t *addressing_version_from_msg_ctx = NULL; |
| axis2_bool_t is_soap11 = AXIS2_FALSE; |
| trust_sts_client_t* sts_client = NULL; |
| trust_context_t* trust_context = NULL; |
| trust_rst_t* rst = NULL; |
| trust_rstr_t* rstr = NULL; |
| security_context_token_t *sct = NULL; |
| neethi_policy_t *sts_policy = NULL; |
| neethi_policy_t *cloned_policy = NULL; |
| oxs_buffer_t *buffer = NULL; |
| axis2_bool_t is_sc10 = AXIS2_FALSE; |
| |
| /* Get the token issuer address. If the address is not valid, then issuer should be same as |
| the service. So get the service end point */ |
| issuer_address = rp_security_context_token_get_issuer(rp_sct, env); |
| if(!issuer_address) |
| { |
| axis2_endpoint_ref_t *endpoint = NULL; |
| endpoint = axis2_msg_ctx_get_to(msg_ctx, env); |
| |
| if(endpoint) |
| { |
| issuer_address = (axis2_char_t*)axis2_endpoint_ref_get_address(endpoint, env); |
| } |
| |
| if(!issuer_address) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Token issuer address is not valid."); |
| return NULL; |
| } |
| } |
| |
| is_sc10 = rp_security_context_token_get_sc10_security_context_token(rp_sct, env); |
| |
| /* Get the client home from msg_ctx */ |
| conf_ctx = axis2_msg_ctx_get_conf_ctx(msg_ctx, env); |
| if(conf_ctx) |
| { |
| axis2_conf_t *conf = NULL; |
| conf = axis2_conf_ctx_get_conf(conf_ctx, env); |
| if(conf) |
| { |
| client_home = (axis2_char_t*)axis2_conf_get_repo(conf, env); |
| } |
| } |
| |
| if(!client_home) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot get client home. Unable to send request to Security Token Service."); |
| return NULL; |
| } |
| |
| /* Get the addressing namespace to be used from msg_ctx */ |
| ctx = axis2_msg_ctx_get_base(msg_ctx, env); |
| property = axis2_ctx_get_property(ctx, env, AXIS2_WSA_VERSION); |
| if(property) |
| { |
| addressing_version_from_msg_ctx = axutil_property_get_value(property, env); |
| } |
| |
| /* get the soap version */ |
| is_soap11 = axis2_msg_ctx_get_is_soap_11(msg_ctx, env); |
| |
| /* Create sts client and set the values (client home, issuer_address, etc.) */ |
| sts_client = trust_sts_client_create(env); |
| if(!sts_client) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot create client to Security Token Service."); |
| return NULL; |
| } |
| |
| trust_sts_client_set_home_dir(sts_client, env, client_home); |
| trust_sts_client_set_issuer_address(sts_client, env, issuer_address); |
| |
| /* create trust context and populate it */ |
| trust_context = trust_context_create(env); |
| if(!trust_context) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot create trust context. Cannot communicate with Token Service."); |
| return NULL; |
| } |
| rst = trust_rst_create(env); |
| if(!trust_context) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot create token request. Cannot communicate with Token Service."); |
| return NULL; |
| } |
| trust_rst_set_request_type(rst, env, TRUST_REQ_TYPE_ISSUE); |
| if(is_sc10) |
| { |
| trust_rst_set_token_type(rst, env, OXS_VALUE_TYPE_SECURITY_CONTEXT_TOKEN_05_02); |
| trust_rst_set_wst_ns_uri(rst, env, TRUST_WST_XMLNS_05_02); |
| trust_rst_set_wsa_action(rst, env, SECCONV_200502_REQUEST_ISSUE_ACTION); |
| } |
| else |
| { |
| trust_rst_set_token_type(rst, env, OXS_VALUE_TYPE_SECURITY_CONTEXT_TOKEN_05_12); |
| trust_rst_set_wst_ns_uri(rst, env, TRUST_WST_XMLNS_05_12); |
| trust_rst_set_wsa_action(rst, env, SECCONV_200512_REQUEST_ISSUE_ACTION); |
| } |
| trust_context_set_rst(trust_context, env, rst); |
| |
| /* call sts_client to get the token from sts. We should create a clone of that policy */ |
| sts_policy = rp_security_context_token_get_bootstrap_policy(rp_sct, env); |
| if(sts_policy) |
| { |
| cloned_policy = neethi_engine_get_normalize(env, AXIS2_FALSE, sts_policy); |
| } |
| |
| buffer = trust_sts_client_request_security_token_using_policy( |
| sts_client, env, trust_context, cloned_policy, addressing_version_from_msg_ctx, |
| is_soap11, get_new_rampart_context(env, msg_ctx)); |
| |
| /* Obtain the reply from sts */ |
| rstr = trust_context_get_rstr(trust_context, env); |
| if(!rstr) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot get token response from Token Service. RSTR is invalid."); |
| return NULL; |
| } |
| |
| /* Create security context token and populate it with details given */ |
| sct = security_context_token_create(env); |
| if(is_sc10) |
| { |
| security_context_token_set_is_sc10(sct, env, AXIS2_TRUE); |
| } |
| else |
| { |
| security_context_token_set_is_sc10(sct, env, AXIS2_FALSE); |
| } |
| security_context_token_set_token(sct, env, trust_rstr_get_requested_security_token(rstr, env)); |
| security_context_token_set_attached_reference( |
| sct, env, trust_rstr_get_requested_attached_reference(rstr, env)); |
| security_context_token_set_unattached_reference( |
| sct, env, trust_rstr_get_requested_unattached_reference(rstr, env)); |
| if(buffer) |
| { |
| security_context_token_set_secret(sct, env, buffer); |
| } |
| else |
| { |
| security_context_token_set_requested_proof_token( |
| sct, env, trust_rstr_get_requested_proof_token(rstr, env)); |
| } |
| |
| /* Now we can clear unwanted stuff */ |
| trust_context_free(trust_context, env); |
| trust_sts_client_free(sts_client, env); |
| |
| return sct; |
| } |
| |
| /* Default place to store sct will be in a hash map. This will be the free method for that hash map. |
| * It will be called when hash map is destroyed */ |
| static void |
| sct_provider_sct_hash_store_free( |
| axutil_hash_t *sct_hash_store, |
| const axutil_env_t *env) |
| { |
| axutil_hash_index_t *hi = NULL; |
| |
| for (hi = axutil_hash_first(sct_hash_store, env); hi != NULL; hi = axutil_hash_next(env, hi)) |
| { |
| void *v = NULL; |
| axutil_hash_this(hi, NULL, NULL, &v); |
| if (v) |
| { |
| security_context_token_free((security_context_token_t*)v, env); |
| } |
| } |
| |
| axutil_hash_free(sct_hash_store, env); |
| } |
| |
| /* Default place to store sct will be in a hash map. This method creates the hash map and store it |
| * in context hierarchy. If it is already created, will get it from context hierarchy */ |
| static axutil_hash_t * |
| sct_provider_get_sct_hash_store( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t* msg_ctx) |
| { |
| axis2_conf_ctx_t *conf_ctx = NULL; |
| axis2_ctx_t *ctx = NULL; |
| axutil_property_t *property = NULL; |
| axutil_hash_t *hash_store = NULL; |
| |
| /* Get the conf ctx */ |
| conf_ctx = axis2_msg_ctx_get_conf_ctx(msg_ctx, env); |
| if(!conf_ctx) |
| { |
| AXIS2_LOG_ERROR(env->log,AXIS2_LOG_SI, |
| "[rampart]Config context is NULL. Cannot get security context token hash store."); |
| return NULL; |
| } |
| |
| ctx = axis2_conf_ctx_get_base(conf_ctx,env); |
| if(!ctx) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Axis2 context is NULL. Cannot get security context token hash store."); |
| return NULL; |
| } |
| |
| /* Get the hash store property */ |
| property = axis2_ctx_get_property(ctx, env, RAMPART_SCT_PROVIDER_HASH_PROB); |
| if(property) |
| { |
| /* Get the store */ |
| hash_store = (axutil_hash_t*)axutil_property_get_value(property, env); |
| } |
| else |
| { |
| axutil_property_t *hash_store_prop = NULL; |
| |
| hash_store = axutil_hash_make(env); |
| hash_store_prop = axutil_property_create_with_args(env, AXIS2_SCOPE_APPLICATION, |
| AXIS2_TRUE, (void *)sct_provider_sct_hash_store_free, hash_store); |
| axis2_ctx_set_property(ctx, env, RAMPART_SCT_PROVIDER_HASH_PROB, hash_store_prop); |
| } |
| |
| return hash_store; |
| } |
| |
| /** |
| * Default implementation of obtain sct function. If neither sct_provider nor user defined |
| * obtain function is given, this function will be used. (obtain_security_context_token_fn) |
| * @param env pointer to environment struct |
| * @param is_encryption boolean denotes sct is needed for encryption or signature |
| * @param msg_ctx pointer to message context structure |
| * @param sct_id identifier of security context token. Can be NULL |
| * @param sct_id_type type of sct id. can be global, local or unknown |
| * @param user_params parameter provided by user (not used in this method) |
| * return security context token if found. NULL otherwise. |
| */ |
| AXIS2_EXTERN void* AXIS2_CALL |
| sct_provider_obtain_sct_default( |
| const axutil_env_t *env, |
| axis2_bool_t is_encryption, |
| axis2_msg_ctx_t* msg_ctx, |
| axis2_char_t *sct_id, |
| int sct_id_type, |
| void* user_params) |
| { |
| axutil_hash_t *hash_store = NULL; |
| security_context_token_t *sct = NULL; |
| |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart]Using default sct provider obtain function."); |
| |
| /* sct should be get from global pool */ |
| axutil_allocator_switch_to_global_pool(env->allocator); |
| |
| /* Get sct hash store */ |
| hash_store = sct_provider_get_sct_hash_store(env, msg_ctx); |
| if(!hash_store) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot find security context token storage."); |
| return NULL; |
| } |
| |
| /* get the sct if sct_id is given */ |
| if(sct_id) |
| { |
| /* set env */ |
| axutil_hash_set_env(hash_store, env); |
| |
| sct = (security_context_token_t *)axutil_hash_get( |
| hash_store, sct_id, AXIS2_HASH_KEY_STRING); |
| } |
| else |
| { |
| /* we don't support stored security context token in default implementation. |
| * Otherwise, it will be a security hole. */ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Default implementation does not support stored security context token." |
| " Please provide sct_provider module."); |
| } |
| axutil_allocator_switch_to_local_pool(env->allocator); |
| |
| return sct; |
| } |
| |
| /** |
| * Default implementation of store sct function. If neither sct_provider nor user defined |
| * store function is given, this function will be used. (store_security_context_token_fn) |
| * @param env pointer to environment struct |
| * @param msg_ctx pointer to message context structure |
| * @param sct_global_id global identifier of security context token. Can be NULL |
| * @param sct_local_id local identifier of security context token. Can be NULL |
| * @param sct security context token to be stored |
| * @param user_params parameter provided by user (not used in this method) |
| * return AXIS2_SUCCESS if stored. AXIS2_FAILURE otherwise. |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| sct_provider_store_sct_default( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t* msg_ctx, |
| axis2_char_t *sct_global_id, |
| axis2_char_t *sct_local_id, |
| void *sct, |
| void *user_params) |
| { |
| axutil_hash_t *hash_store = NULL; |
| axis2_status_t status = AXIS2_SUCCESS; |
| |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart]Using default sct provider store function."); |
| |
| /* if given sct is null, then we can't store it */ |
| if(!sct) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Security context token to be stored in not valid."); |
| return AXIS2_FAILURE; |
| } |
| |
| /* sct should be stored in global pool */ |
| axutil_allocator_switch_to_global_pool(env->allocator); |
| |
| /* Get sct hash store */ |
| hash_store = sct_provider_get_sct_hash_store(env, msg_ctx); |
| if(hash_store) |
| { |
| /* set env */ |
| axutil_hash_set_env(hash_store, env); |
| |
| /* store sct */ |
| if(sct_global_id) |
| { |
| axutil_hash_set(hash_store, sct_global_id, AXIS2_HASH_KEY_STRING, sct); |
| if(sct_local_id) |
| { |
| security_context_token_increment_ref(sct, env); |
| axutil_hash_set(hash_store, sct_local_id, AXIS2_HASH_KEY_STRING, sct); |
| } |
| } |
| else |
| { |
| if(sct_local_id) |
| { |
| axutil_hash_set(hash_store, sct_local_id, AXIS2_HASH_KEY_STRING, sct); |
| } |
| else |
| { |
| /* if both local_id and global_id are NULL, then we can't store it */ |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Security context token identifiers are not valid. " |
| "Cannot store security context token. "); |
| status = AXIS2_FAILURE; |
| } |
| } |
| } |
| else |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot find security context token storage."); |
| status = AXIS2_FAILURE; |
| } |
| |
| axutil_allocator_switch_to_local_pool(env->allocator); |
| return status; |
| |
| } |
| |
| /** |
| * Default implementation of delete sct function. If neither sct_provider nor user defined |
| * store function is given, this function will be used. (delete_security_context_token_fn) |
| * @param env pointer to environment struct |
| * @param msg_ctx pointer to message context structure |
| * @param sct_id identifier of security context token. Should not be NULL. |
| * @param sct_id_type type of sct id. can be global or local. |
| * @param user_params parameter provided by user (not used in this method) |
| * @return AXIS2_SUCCESS if deleted. AXIS2_FAILURE otherwise. |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| sct_provider_delete_sct_default( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t* msg_ctx, |
| axis2_char_t *sct_id, |
| int sct_id_type, |
| void* user_params) |
| { |
| /* delete method is not implemented, because we are still not supporting sct cancel function */ |
| |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart]Using default sct provider delete function."); |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| /** |
| * Default implementation of validate sct function. If neither sct_provider nor user defined |
| * store function is given, this function will be used. (validate_security_context_token_fn) |
| * @param env pointer to environment struct |
| * @param sct_node axiom representation of security context token |
| * @param user_params parameter provided by user (not used in this method) |
| * @return AXIS2_SUCCESS if valid. AXIS2_FAILURE otherwise. |
| */ |
| AXIS2_EXTERN axis2_status_t AXIS2_CALL |
| sct_provider_validate_sct_default( |
| const axutil_env_t *env, |
| axiom_node_t *sct_node, |
| axis2_msg_ctx_t *msg_ctx, |
| void *user_params) |
| { |
| /* default implementation does not need to validate anything. We haven't extended the |
| * functionality of sct */ |
| |
| AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart]Using default sct provider validate function."); |
| |
| return AXIS2_SUCCESS; |
| } |
| |
| /* this is used to create a new rampart context and copy details given by rampart specific |
| * assertions. */ |
| static rampart_context_t * |
| get_new_rampart_context( |
| const axutil_env_t *env, |
| axis2_msg_ctx_t *msg_ctx) |
| { |
| rampart_context_t *in_rampart_ctx = NULL; |
| rampart_context_t *out_rampart_ctx = NULL; |
| oxs_key_mgr_t *key_mgr = NULL; |
| |
| in_rampart_ctx = (rampart_context_t*)rampart_get_rampart_configuration( |
| env, msg_ctx, RAMPART_CONFIGURATION); |
| |
| /* rampart context is not given by user. It was built by policy */ |
| if(!in_rampart_ctx) |
| { |
| return NULL; |
| } |
| |
| out_rampart_ctx = rampart_context_create(env); |
| if(!out_rampart_ctx) |
| { |
| AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, |
| "[rampart]Cannot create new rampart context. Insufficient memory."); |
| return NULL; |
| } |
| |
| rampart_context_set_ttl(out_rampart_ctx, env, rampart_context_get_ttl(in_rampart_ctx, env)); |
| rampart_context_set_user(out_rampart_ctx, env, |
| axutil_strdup(env, rampart_context_get_user(in_rampart_ctx, env))); |
| rampart_context_set_password_type(out_rampart_ctx, env, |
| rampart_context_get_password_type(in_rampart_ctx, env)); |
| rampart_context_set_password(out_rampart_ctx, env, |
| rampart_context_get_password(in_rampart_ctx, env)); |
| rampart_context_set_pwcb_function(out_rampart_ctx, env, |
| rampart_context_get_pwcb_function(in_rampart_ctx, env), |
| rampart_context_get_pwcb_user_params(in_rampart_ctx, env)); |
| rampart_context_set_replay_detect_function(out_rampart_ctx, env, |
| rampart_context_get_replay_detect_function(in_rampart_ctx, env), |
| rampart_context_get_rd_user_params(in_rampart_ctx, env)); |
| rampart_context_set_rd_val(out_rampart_ctx, env, |
| rampart_context_get_rd_val(in_rampart_ctx, env)); |
| |
| /* set key manager as well */ |
| key_mgr = rampart_context_get_key_mgr(in_rampart_ctx, env); |
| if(key_mgr) |
| { |
| oxs_key_mgr_increment_ref(key_mgr, env); |
| rampart_context_set_key_mgr(out_rampart_ctx, env, key_mgr); |
| } |
| |
| return out_rampart_ctx; |
| } |
