/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <axis2_util.h>
#include <stdio.h>
#include <rampart_encryption.h>
#include <rampart_constants.h>
#include <rampart_sec_header_processor.h>
#include <rampart_username_token.h>
#include <rampart_timestamp_token.h>
#include <rampart_util.h>
#include <rampart_sec_processed_result.h>
#include <rampart_handler_util.h>
#include <rampart_token_processor.h>
#include <rampart_policy_validator.h>
#include <oxs_constants.h>
#include <oxs_ctx.h>
#include <oxs_error.h>
#include <oxs_utility.h>
#include <oxs_key.h>
#include <oxs_axiom.h>
#include <oxs_asym_ctx.h>
#include <oxs_tokens.h>
#include <oxs_derivation.h>
#include <axutil_utils.h>
#include <axutil_array_list.h>
#include <axis2_key_type.h>
#include <oxs_sign_ctx.h>
#include <oxs_xml_signature.h>
#include <oxs_key_mgr.h>
#include <rampart_replay_detector.h>
#include <rampart_sct_provider_utility.h>
#include <saml.h>
#include <rampart_saml.h>
#include <rampart_saml_token.h>
#include <axiom_util.h>
/*Private functions*/

/*Get the security context token and store it in key array*/
AXIS2_EXTERN axis2_status_t AXIS2_CALL
rampart_shp_add_security_context_token(
    const axutil_env_t* env,
    axis2_char_t* identifier,
    axis2_char_t* key_name,
    rampart_context_t* rampart_context,
    axis2_msg_ctx_t* msg_ctx)
{
    oxs_buffer_t *key_buf = NULL;
    oxs_key_t* key = NULL;

    /*get the shared secret and create the key*/
    key_buf = sct_provider_get_secret_using_id(env, identifier, rampart_context, msg_ctx);
    if(!key_buf)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
            "Cannot get shared secret of security context token");
        return AXIS2_FAILURE;
    }

    key = oxs_key_create(env);
    oxs_key_populate(key, env, oxs_buffer_get_data(key_buf, env), key_name,
        oxs_buffer_get_size(key_buf, env), OXS_KEY_USAGE_NONE);

    rampart_context_add_key(rampart_context, env, key);
    return AXIS2_SUCCESS;
}


static void
rampart_shp_store_token_id(const axutil_env_t *env, 
                         axiom_node_t *key_info_node, 
                         rampart_context_t *rampart_context, 
                         axiom_node_t *sec_node, 
                         axis2_bool_t is_encryption,
                         axis2_msg_ctx_t* msg_ctx)
{
    axis2_char_t *token_id = NULL;
    axiom_node_t* key_node = NULL;
    rp_property_t *token = NULL;
    rp_property_type_t token_type;
    rp_security_context_token_t *security_context_token = NULL;
    axis2_char_t *needed_value_type = NULL;
    axis2_char_t *wsc_ns_uri = NULL;

    if(is_encryption)
        token_id = rampart_context_get_encryption_token_id(rampart_context, env, msg_ctx);
    else
        token_id = rampart_context_get_signature_token_id(rampart_context, env, msg_ctx);

    /*if already stored, then can return*/
    if(token_id)
        return;

    /*if not symmetric binding, then return*/
    if (rampart_context_get_binding_type(rampart_context,env) != RP_PROPERTY_SYMMETRIC_BINDING)
        return;

    /*if not server side, then return*/
    if(!axis2_msg_ctx_get_server_side(msg_ctx,env))
        return;

    /*if the token to be used is not security context token, then return*/
    token = rampart_context_get_token(rampart_context, env,
                                      is_encryption, AXIS2_TRUE, AXIS2_TRUE);
    token_type = rp_property_get_type(token, env);
    if((token_type != RP_PROPERTY_SECURITY_CONTEXT_TOKEN) && (token_type != RP_PROPERTY_X509_TOKEN))
        return;

    /* Get the version of security context token */
    security_context_token = (rp_security_context_token_t *)rp_property_get_value(token, env);
    if(rp_security_context_token_get_sc10_security_context_token(security_context_token, env))
    {
        needed_value_type = OXS_VALUE_TYPE_SECURITY_CONTEXT_TOKEN_05_02;
        wsc_ns_uri = OXS_WSC_NS_05_02;
    }
    else
    {
        needed_value_type = OXS_VALUE_TYPE_SECURITY_CONTEXT_TOKEN_05_12;
        wsc_ns_uri = OXS_WSC_NS_05_12;
    }

    key_node = key_info_node;

    while(!token_id)
    {
        axis2_char_t* id = NULL;
        axis2_char_t *cur_local_name = NULL;
        axiom_node_t *str_node = NULL;
        axiom_node_t *ref_node = NULL;
        axis2_char_t *ref_val = NULL;

        /*Get the STR*/
        str_node = oxs_axiom_get_first_child_node_by_name(env, key_node, OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL);
        if(!str_node)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Failed to get security token reference node");
            break;
        }

        /*Get Reference element*/
        ref_node = oxs_axiom_get_first_child_node_by_name(env, str_node, OXS_NODE_REFERENCE, OXS_WSSE_XMLNS, NULL);
        if(!ref_node)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Failed to get reference node from security token reference");
            break;
        }

        /*Get the reference value in the @URI*/
        ref_val = oxs_token_get_reference(env, ref_node);
        if(ref_val[0] != '#')
        {
            axis2_char_t* value_type = NULL;
            value_type = oxs_token_get_reference_value_type(env, ref_node);
            if(!axutil_strcmp(value_type, needed_value_type))
            {
                token_id = axutil_strdup(env, ref_val);
                break;
            }
        }

        id = axutil_string_substring_starting_at(axutil_strdup(env, ref_val), 1);
        key_node = oxs_axiom_get_node_by_id(env, sec_node, OXS_ATTR_ID, id, OXS_WSU_XMLNS);
        if(!key_node)
            break;

        cur_local_name = axiom_util_get_localname(key_node, env);
        if(0 == axutil_strcmp(cur_local_name, OXS_NODE_SECURITY_CONTEXT_TOKEN))
        {
            axiom_node_t *identifier_node = NULL;

            
            /*Get the identifier node*/
            identifier_node = oxs_axiom_get_first_child_node_by_name(
                env, key_node, OXS_NODE_IDENTIFIER, wsc_ns_uri, NULL);

            if(!identifier_node)
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Cannot find identifier node in security context token");
                break;
            }
            token_id = oxs_axiom_get_node_content(env, identifier_node);
            break;
        }
        else if(0 == axutil_strcmp(cur_local_name, OXS_NODE_ENCRYPTED_KEY))
        {
            token_id = oxs_axiom_get_attribute_value_of_node_by_name(env, key_node, OXS_ATTR_ID, NULL);
            break;
        }
    }

    /*if same key is used for encryption and signature, then store it at both place*/
    if(rampart_context_is_different_session_key_for_enc_and_sign(env, rampart_context))
    {
        if(is_encryption)
            rampart_context_set_encryption_token_id(rampart_context, env, token_id, msg_ctx);
        else
            rampart_context_set_signature_token_id(rampart_context, env, token_id, msg_ctx);
    }
    else
    {
        rampart_context_set_encryption_token_id(rampart_context, env, token_id, msg_ctx);
        rampart_context_set_signature_token_id(rampart_context, env, token_id, msg_ctx);
    }
}

#if 0
/*Process a KeyInfo and return the key*/
static oxs_key_t* 
rampart_shp_get_key_for_key_info(const axutil_env_t* env, 
                                 axiom_node_t* key_info_node, 
                                 rampart_context_t* rampart_context, 
                                 axis2_msg_ctx_t *msg_ctx,
								 axis2_bool_t is_signature)
{
    oxs_key_t *key = NULL;
    axiom_node_t *str_node = NULL;
    axiom_node_t *ref_node = NULL;
    axis2_char_t *ref_val = NULL;
    axis2_char_t *id = NULL;
    axis2_bool_t external_reference = AXIS2_TRUE;

    /*Get the STR*/
    str_node = oxs_axiom_get_first_child_node_by_name(env, key_info_node, OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL);
    if(!str_node)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Failed to get security token reference node");
        return NULL;
    }

    /*Get Reference element*/
    ref_node = oxs_axiom_get_first_child_node_by_name(env, str_node, OXS_NODE_REFERENCE, OXS_WSSE_XMLNS, NULL);
    if(!ref_node)
    {
        axis2_char_t *value_type = NULL;
        axis2_char_t *value = NULL;
        oxs_key_t *key = NULL;

        ref_node = oxs_axiom_get_first_child_node_by_name(env, str_node, OXS_NODE_KEY_IDENTIFIER, OXS_WSSE_XMLNS, NULL);
        if(!ref_node)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Failed to get reference node from security token reference");
            return NULL;
        }
        value_type = oxs_axiom_get_attribute_value_of_node_by_name(env, ref_node, OXS_ATTR_VALUE_TYPE, NULL);
        if(axutil_strcmp(value_type, OXS_X509_ENCRYPTED_KEY_SHA1) == 0)
        {
			value = oxs_axiom_get_node_content(env, ref_node);
			if(!value)
			{
				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Failed to get value of EncryptedKeySHA1");
				return NULL;
			}

			key = rampart_context_get_key_using_hash(rampart_context, env, value);
			if(!key)
			{
				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Cannot get key corresponding to EncryptedKeySHA1");
			}            
        }
		/* SAML token reference */
		else if(axutil_strcmp(value_type, OXS_ST_KEY_ID_VALUE_TYPE) == 0)
		{
			axiom_node_t *assertion = NULL;						
			rampart_saml_token_t *saml = NULL;
            rampart_st_type_t tok_type;                        
			oxs_key_mgr_t *key_mgr = NULL;
			openssl_pkey_t *pvt_key = NULL;

			key_mgr = rampart_context_get_key_mgr(rampart_context, env);
            pvt_key = oxs_key_mgr_get_prv_key(key_mgr, env);
			if (!pvt_key)
			{
				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Cannot load private key");
				return NULL;					
			}                        
            
			assertion = oxs_saml_token_get_from_key_identifer_reference(env, ref_node, NULL);
			if (!assertion)
			{
				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Cannot get key SAML Assertion");
				return NULL;					
			}
			if (is_signature)
            {
                tok_type = RAMPART_ST_TYPE_SIGNATURE_TOKEN;
            }
            else
            {
                tok_type = RAMPART_ST_TYPE_ENCRYPTION_TOKEN;
            }
			saml = rampart_saml_add_token(rampart_context, env, assertion, str_node, tok_type); 
			key = rampart_saml_token_get_session_key(saml, env);
			if (!key) 
			{
				key = saml_assertion_get_session_key(env, assertion, 
                               pvt_key);
				rampart_saml_token_set_session_key(saml, env, key);
				oxs_key_set_name(key, env, "for-algo");
			}            
			if(!key)
			{
				AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Cannot get key corresponding to EncryptedKeySHA1");
			}
		}
		else 
		{
			AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Failed to identify Key Identifier %s", value_type);
            return NULL;
		}
        return key;        
    }
    else
    {
        /*Get the reference value in the @URI*/
        ref_val = oxs_token_get_reference(env, ref_node);
        if(ref_val[0] == '#')
        {
            /*Need to remove # sign from the ID*/
            id = axutil_string_substring_starting_at(axutil_strdup(env, ref_val), 1);
            external_reference = AXIS2_FALSE;
        }
        else
        {
            id = axutil_strdup(env, ref_val);
        }
    }

    if(!id)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp]Failed to get key name from reference node");
        return NULL;
    }
    
    key = rampart_context_get_key(rampart_context, env, id);
    if(!key && external_reference)
    {
        axis2_char_t* value_type = NULL;
        value_type = oxs_token_get_reference_value_type(env, ref_node);
        if((0 == axutil_strcmp(value_type, OXS_VALUE_TYPE_SECURITY_CONTEXT_TOKEN_05_02))||
            (0 == axutil_strcmp(value_type, OXS_VALUE_TYPE_SECURITY_CONTEXT_TOKEN_05_12)))
        {
            rampart_shp_add_security_context_token(env, id, id, rampart_context, msg_ctx);
        }
        key = rampart_context_get_key(rampart_context, env, id);
    }

	AXIS2_FREE(env->allocator, id);
    return key;
}
#endif

static axis2_bool_t
rampart_shp_validate_qnames(
    const axutil_env_t *env,
    axiom_node_t *node)

{
    axiom_element_t *node_ele = NULL;
    axutil_qname_t *qname = NULL;
    axutil_qname_t *node_qname = NULL;
    axis2_char_t *local_name = NULL;

    node_ele = axiom_node_get_data_element(node, env);
    if(!node_ele)
        return AXIS2_FALSE;

    local_name = axiom_element_get_localname(node_ele,env);
    if(!local_name){
        return AXIS2_FALSE;
    }
    if(axutil_strcmp(local_name, RAMPART_SECURITY_TIMESTAMP) == 0)
    {
        qname = axutil_qname_create(env, local_name, RAMPART_WSU_XMLNS, NULL/*RAMPART_WSU*/);
    }
    else if(axutil_strcmp(local_name, RAMPART_SECURITY_USERNAMETOKEN) ==0)
    {
        qname = axutil_qname_create(env, local_name, RAMPART_WSSE_XMLNS, NULL/*RAMPART_WSSE*/);
    }
    else if(axutil_strcmp(local_name,OXS_NODE_ENCRYPTED_KEY)==0)
    {
        qname = axutil_qname_create(env, local_name, OXS_ENC_NS, NULL/*OXS_XENC*/);
    }
    else if(axutil_strcmp(local_name, OXS_NODE_ENCRYPTED_DATA)==0)
    {
        qname = axutil_qname_create(env, local_name, OXS_ENC_NS, NULL/*OXS_XENC*/);
    }
    else if(axutil_strcmp(local_name, OXS_NODE_SIGNATURE)==0)
    {
        qname = axutil_qname_create(env, local_name, OXS_DSIG_NS, NULL/*OXS_DS*/);
    }
    else if(axutil_strcmp(local_name, OXS_NODE_BINARY_SECURITY_TOKEN) == 0)
    {
        return AXIS2_FALSE;
    }
    else if(axutil_strcmp(local_name, OXS_NODE_REFERENCE_LIST)==0)
    {
        return AXIS2_FALSE;
    }
    else
    {
        return AXIS2_FALSE;
    }

    if(!qname)
    {
        return AXIS2_FALSE;
    }
    node_qname = axiom_element_get_qname(node_ele, env, node);

    if(!node_qname)
    {
        axutil_qname_free(qname, env);
        qname = NULL;
        return AXIS2_FALSE;
    }

    if(axutil_qname_equals(qname, env, node_qname))
    {
        axutil_qname_free(qname, env);
        qname = NULL;
        return AXIS2_TRUE;
    }
    return AXIS2_FALSE;
}

/*static oxs_x509_cert_t *get_receiver_x509_cert(
    const axutil_env_t *env,
    rampart_context_t *rampart_context)
{
    return rampart_context_get_receiver_certificate(rampart_context, env);
}*/

static axis2_status_t
rampart_shp_process_signature_confirmation(const axutil_env_t *env,
                                   axis2_msg_ctx_t *msg_ctx,
                                   rampart_context_t *rampart_context,
                                   axiom_node_t *cur_node)
{
    rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_CONFIRM_FOUND, RAMPART_YES);
    return AXIS2_SUCCESS;
}

static axis2_status_t
rampart_shp_process_timestamptoken(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_node_t *ts_node)
{
    axis2_status_t valid_ts = AXIS2_FAILURE;

    if(!rampart_context_is_include_timestamp(rampart_context, env))
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Timestamp should not be in the message.");
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, 
            "Timestamp should not be in the message ", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx);
        return AXIS2_FAILURE;
    }
    else
    {
        if(!rampart_shp_validate_qnames(env, ts_node))
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, 
                "[rampart]QName for given timestamp is not valid.");
            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN,
                "Error in the Timestamp Element. ", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx);
            return AXIS2_FAILURE;
        }

        valid_ts = rampart_timestamp_token_validate(
            env, msg_ctx, ts_node, rampart_context_get_clock_skew_buffer(rampart_context, env));

        if (valid_ts)
        {
            AXIS2_LOG_INFO(env->log, "[rampart]Succesfully validated the timestamp ");
            return AXIS2_SUCCESS;
        }
        else
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Timestamp is not valid");
            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                "Timestamp is not valid", RAMPART_FAULT_IN_TIMESTAMP, msg_ctx);
            return AXIS2_FAILURE;
        }
    }
}

static axis2_status_t
rampart_shp_process_usernametoken(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_node_t *ut_node)
{
    axis2_status_t valid_user = AXIS2_FAILURE;

    if(!rampart_context_is_include_username_token(rampart_context, env))
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, 
            "[rampart]Username token should not be in the message.");
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, 
            "Username Token not expected", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx);
        return AXIS2_FAILURE;
    }
    else
    {
        if(!rampart_shp_validate_qnames(env, ut_node))
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, 
                "[rampart]Error in validating qnames for the username token");
            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, 
                "Error in the Username token.", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx);
            return AXIS2_FAILURE;
        }

        AXIS2_LOG_INFO(env->log, "[rampart]Validating UsernameToken");
        valid_user = rampart_username_token_validate(env, msg_ctx, ut_node, rampart_context);
    }

    if (valid_user)
    {
        AXIS2_LOG_INFO(env->log, "[rampart]Validating UsernameToken SUCCESS");
        return AXIS2_SUCCESS;
    }
    else
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Validating UsernameToken FAILED");
        if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env))
        {
            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_AUTHENTICATION, 
                "UsernameToken validation failed.", RAMPART_FAULT_IN_USERNAMETOKEN, msg_ctx);
        }
        return AXIS2_FAILURE;
    }
}

static axis2_status_t
rampart_shp_process_security_context_token(
    const axutil_env_t *env, 
    axiom_node_t *token_node, 
    rampart_context_t* rampart_context, 
    axis2_msg_ctx_t *msg_ctx)
{
    axiom_node_t *identifier_node = NULL;
    axis2_char_t *identifier = NULL;
    axis2_char_t *key_name = NULL;

    /*Check whether security context token is valid */
    if(sct_provider_validate_security_context_token(env, token_node, rampart_context, msg_ctx)
        != AXIS2_SUCCESS)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, 
            "Security context token validation failed.", 
            RAMPART_FAULT_INVALID_SECURITY_TOKEN, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, 
            "[rampart][shp] Security context token validation failed.");
        return AXIS2_FAILURE;
    }

    /*Get the identifier node*/
    identifier_node = oxs_axiom_get_first_child_node_by_name(
        env, token_node, OXS_NODE_IDENTIFIER, OXS_WSC_NS_05_02, NULL);

    if(!identifier_node)
    {
        /* check other namespace as well */
        identifier_node = oxs_axiom_get_first_child_node_by_name(
            env, token_node, OXS_NODE_IDENTIFIER, OXS_WSC_NS_05_12, NULL);
    }

    if(!identifier_node)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, 
            "Cannot find identifier node in security context token", 
            RAMPART_FAULT_INVALID_SECURITY_TOKEN, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, 
            "[rampart][shp] Cannot find identifier node in security context token");
        return AXIS2_FAILURE;
    }

    identifier = oxs_axiom_get_node_content(env, identifier_node);
    if(!identifier)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN, 
            "Cannot find identifier content in security context token", 
            RAMPART_FAULT_INVALID_SECURITY_TOKEN, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, 
            "[rampart][shp] Cannot find identifier content in security context token");
        return AXIS2_FAILURE;
    }

    key_name = oxs_axiom_get_attribute_value_of_node_by_name(
        env, token_node, OXS_ATTR_ID, OXS_WSU_XMLNS);
    return rampart_shp_add_security_context_token(
        env, identifier, key_name, rampart_context, msg_ctx);
}

static axis2_status_t
rampart_shp_process_encrypted_key(const axutil_env_t *env,
                                  axis2_msg_ctx_t *msg_ctx,
                                  rampart_context_t *rampart_context,
                                  axiom_soap_envelope_t *soap_envelope,
                                  axiom_node_t *sec_node,
                                  axiom_node_t *encrypted_key_node)
{
    axiom_node_t *ref_list_node = NULL;
    axiom_node_t *enc_mtd_node = NULL;
    axutil_array_list_t *reference_list = NULL;
    axis2_char_t *enc_asym_algo = NULL;
    axis2_status_t status = AXIS2_FAILURE;
    oxs_asym_ctx_t *asym_ctx = NULL;
    oxs_key_t *decrypted_sym_key = NULL;
	oxs_key_mgr_t *key_mgr = NULL;
    axis2_char_t *enc_asym_algo_in_pol = NULL;
    axis2_char_t *enc_sym_algo_in_pol = NULL;
    openssl_pkey_t *open_prvkey = NULL;
    int i = 0;
    /*void *key_buf = NULL;*/
	axis2_char_t *prv_key_file = NULL;

    /*Get EncryptedData references */
    ref_list_node = oxs_axiom_get_first_child_node_by_name(
                        env, encrypted_key_node, OXS_NODE_REFERENCE_LIST, OXS_ENC_NS, NULL);
    
    /* reference list is not a mandatory item in encrypted key. */
    if(ref_list_node)
    {
        reference_list = oxs_token_get_reference_list_data(env, ref_list_node);
    }

    /*Get the algorithm to decrypt the sesison key*/
    enc_mtd_node = oxs_axiom_get_first_child_node_by_name(
                       env, encrypted_key_node, OXS_NODE_ENCRYPTION_METHOD, OXS_ENC_NS, NULL);
    enc_asym_algo = oxs_token_get_encryption_method(env, enc_mtd_node);

    /*If the reference list > 0 then We have nodes to decrypt. Next step is to get the encrypted key*/
    /*Obtain the session key which is encrypted*/
    /*Create an asym_ctx*/
    /*We should verify the algorithm with policy*/

    enc_asym_algo_in_pol = rampart_context_get_enc_asym_algo(rampart_context, env);
    if(!enc_asym_algo_in_pol)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, "Error in the policy. No asym algo", RAMPART_FAULT_IN_POLICY, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Assymetric enc algorithm not specified in policy.");
        return AXIS2_FAILURE;
    }

    /*If the algo tally with the policy?*/
    if(axutil_strcmp(enc_asym_algo_in_pol, enc_asym_algo) != 0)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "The key is encrypted with the wrong algorithm");
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                      "The key is encrypted with the wrong algorithm", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx);
        return AXIS2_FAILURE;
    }
    
	key_mgr = rampart_context_get_key_mgr(rampart_context, env);
    asym_ctx = oxs_asym_ctx_create(env);
    oxs_asym_ctx_set_algorithm(asym_ctx, env, enc_asym_algo);

   /* key_buf = rampart_context_get_prv_key(rampart_context, env);
    if(key_buf)
    {
        axis2_key_type_t type = 0;
        type = rampart_context_get_prv_key_type(rampart_context, env);
        if(type == AXIS2_KEY_TYPE_PEM)
        {
			oxs_key_mgr_set_format(key_mgr, env, OXS_KEY_MGR_FORMAT_PEM);
			oxs_key_mgr_set_pem_buf(key_mgr, env, key_buf);
        }
    } */   
    oxs_asym_ctx_set_operation(asym_ctx, env, OXS_ASYM_CTX_OPERATION_PRV_DECRYPT);
	prv_key_file = rampart_context_get_private_key_file(rampart_context, env);   
	oxs_key_mgr_set_format(key_mgr, env,  oxs_util_get_format_by_file_extension(env, prv_key_file));

    /* TODO:Populate assymetric context */
	open_prvkey = oxs_key_mgr_get_prv_key(key_mgr, env); 
    oxs_asym_ctx_set_private_key(asym_ctx, env, open_prvkey);

    /*Create an empty key*/
    decrypted_sym_key = oxs_key_create(env);

    /*Call decrypt for the EncryptedKey*/
    status = oxs_xml_enc_decrypt_key(env, asym_ctx,
                                     sec_node, encrypted_key_node,  decrypted_sym_key);


    if(AXIS2_FAILURE == status)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Cannot decrypt the EncryptedKey");
        rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, "Key decryption failed", RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx);
        oxs_asym_ctx_free(asym_ctx, env);
        asym_ctx = NULL;
        return AXIS2_FAILURE;
    }
    /*We need to set the session key name= EncryptedKey@Id*/
    if(decrypted_sym_key){
        axis2_char_t *key_id = NULL;

        key_id = oxs_axiom_get_attribute_value_of_node_by_name(env, encrypted_key_node, OXS_ATTR_ID, NULL);
        if(!key_id){
            key_id = "SESSION_KEY";
        }
        
        oxs_key_set_name(decrypted_sym_key, env, key_id);
    }
    /*Now we need to set this to the rampart context for future use*/
    rampart_context_add_key(rampart_context, env, decrypted_sym_key);

    /*Alright now we have the key used to encrypt the elements in the reference_list*/
    /*Go thru each and every node in the list and decrypt them*/

    /*Before decrypt we should get the symmetric algo from policy.
      So for each encrypted element we can compare the algo. */
    enc_sym_algo_in_pol = rampart_context_get_enc_sym_algo(rampart_context, env);
    if(!enc_sym_algo_in_pol)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                                      "Error in the policy. No summetric algo", RAMPART_FAULT_IN_POLICY, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[rampart][shp] Symetric enc algorithm not specified in policy.");
        oxs_asym_ctx_free(asym_ctx, env);
        asym_ctx = NULL;
        return AXIS2_FAILURE;
    }
    
    /* In some cases there might not be any references in the list. For example when the derived keys are in use. 
     * If there are references, that means those references are encrypted using the session key. So we need to decrypt 'em*/
    if(reference_list){
      for(i=0 ; i < axutil_array_list_size(reference_list, env); i++ )
      {
        axis2_char_t *id = NULL;
        axis2_char_t *id2 = NULL;
        axiom_node_t *enc_data_node = NULL;
        axiom_node_t *envelope_node = NULL;
        oxs_ctx_t *ctx = NULL;
        axiom_node_t *decrypted_node = NULL;
        axiom_node_t *mtd_node = NULL;
        axis2_char_t *sym_algo = NULL;
        axiom_soap_body_t *soap_body = NULL;

        /*This need to be done in order to build the soap body.Do not remove.*/
        soap_body = axiom_soap_envelope_get_body(soap_envelope, env);

        /*Get the i-th element and decrypt it */
        id = (axis2_char_t*)axutil_array_list_get(reference_list, env, i);
        AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] Decrypting node, ID=%s", id);

        /*Need to remove # sign from the ID*/
        id2 = axutil_string_substring_starting_at(id, 1);
        envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env);

        /*Search for the node by its ID*/
        enc_data_node = oxs_axiom_get_node_by_id(env, envelope_node, OXS_ATTR_ID, id2, NULL);
        if(!enc_data_node)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Node with ID=%s cannot be found", id);

            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, "Cannot find EncryptedData element", 
                                        RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx);
            oxs_asym_ctx_free(asym_ctx, env);
            asym_ctx = NULL;
            return AXIS2_FAILURE;
        }
        /*Create an enc_ctx*/
        mtd_node = oxs_axiom_get_first_child_node_by_name(
                       env, enc_data_node, OXS_NODE_ENCRYPTION_METHOD, OXS_ENC_NS, NULL);

        if(!mtd_node)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Cannot find EncryptionMethod Element");
            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, "Cannot find EncryptionMethod Element", 
                                    RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx);
            oxs_asym_ctx_free(asym_ctx, env);
            asym_ctx = NULL;
            return AXIS2_FAILURE;
        }

        sym_algo = oxs_token_get_encryption_method(env, mtd_node);
        if(!sym_algo)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Cannot get the Symmetric Algorithm from Soap message.");
            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK, "Cannot find EncryptionMethod Element", 
                            RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx);
            oxs_asym_ctx_free(asym_ctx, env);
            asym_ctx = NULL;

            return AXIS2_FAILURE;
        }
        /*Would the encryption method tally with the policy?*/
        if(axutil_strcmp(sym_algo, enc_sym_algo_in_pol)!=0)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                            "The content is encrypted with the wrong algorithm");
            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                          "The content is encrypted with the wrong algorithm",
                                          RAMPART_FAULT_IN_ENCRYPTED_KEY, msg_ctx);
            oxs_asym_ctx_free(asym_ctx, env);
            asym_ctx = NULL;
            return AXIS2_FAILURE;

        }
        /*Get ready for the decryption. Create an encryption ctx*/
        ctx = oxs_ctx_create(env);
        oxs_ctx_set_key(ctx, env, decrypted_sym_key);
        status = oxs_xml_enc_decrypt_node(env, ctx, enc_data_node, &decrypted_node);

        if(AXIS2_FAILURE == status)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                "[rampart]Decryption of node with ID [%s] failed.", id);
            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                                          "Data decryption failed", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx);
            oxs_asym_ctx_free(asym_ctx, env);
            asym_ctx = NULL;
            return AXIS2_FAILURE;
        }
        /*Check if the signture is encrypted*/
        if(0 == axutil_strcmp( OXS_NODE_SIGNATURE , axiom_util_get_localname(decrypted_node, env))){
            rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_ENCRYPTED, RAMPART_YES);
        }
        /*Check if the body is encrypted*/
        if(0 == axutil_strcmp(OXS_NODE_BODY , axiom_util_get_localname(axiom_node_get_parent(decrypted_node, env), env))){
             rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_BODY_ENCRYPTED, RAMPART_YES);
        }

        /*Free*/
        oxs_ctx_free(ctx, env);
        ctx = NULL;

        AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] Node ID=%s decrypted successfuly", id);
      }/*end of For loop*/
    }

    /*Set the security processed result*/
    rampart_set_security_processed_result(
        env, msg_ctx, RAMPART_SPR_ENC_CHECKED, RAMPART_YES);

    /*Free*/
    if(asym_ctx){
        oxs_asym_ctx_free(asym_ctx, env);
        asym_ctx = NULL;
    }

    if(reference_list){
        axutil_array_list_free(reference_list, env);
        reference_list = NULL;
    }
    return AXIS2_SUCCESS;
}


static axis2_status_t
rampart_shp_process_reference_list(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_soap_envelope_t *soap_envelope,
    axiom_node_t *sec_node,
    axiom_node_t *ref_list_node)
{

    axutil_array_list_t *reference_list = NULL;
    axis2_status_t status = AXIS2_FAILURE;
    int i = 0;

    reference_list = oxs_token_get_reference_list_data(env,
                     ref_list_node);

    if((!reference_list) || (0 == axutil_array_list_size(reference_list, env)))
    {
        if (reference_list)
        {
            axutil_array_list_free(reference_list, env);
            reference_list = NULL;
        }

        AXIS2_LOG_INFO(env->log,
                       "[rampart][shp] Nothing Encrypted Outside security header");
        return AXIS2_SUCCESS;
    }
    /*Go thru each and every element in the ReferenceList*/
    for(i=0 ; i < axutil_array_list_size(reference_list, env); i++ )
    {
        axis2_char_t *id = NULL;
        axis2_char_t *id2 = NULL;
        axiom_node_t *enc_data_node = NULL;
        axiom_node_t *envelope_node = NULL;
        axiom_soap_body_t *soap_body = NULL;
        axiom_node_t *key_info_node = NULL;

        soap_body = axiom_soap_envelope_get_body(soap_envelope, env);

        id = (axis2_char_t*)axutil_array_list_get(reference_list, env, i);

        id2 = axutil_string_substring_starting_at(axutil_strdup(env, id), 1);

        envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env);

        /*Search for the node by its ID*/
        enc_data_node = oxs_axiom_get_node_by_id(env, envelope_node, OXS_ATTR_ID, id2, NULL);
        if(!enc_data_node)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                            "[rampart][shp] Node with ID=%s cannot be found", id2);
            rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                                          "Cannot find EncryptedData element", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx);
            axutil_array_list_free(reference_list, env);
            reference_list = NULL;
            AXIS2_FREE(env->allocator, id2);
            id2 = NULL;
            return AXIS2_FAILURE;
        }

        AXIS2_FREE(env->allocator, id2);
        id2 = NULL;

        key_info_node = oxs_axiom_get_first_child_node_by_name(env, enc_data_node,
                        OXS_NODE_KEY_INFO, OXS_DSIG_NS, NULL);

        if(key_info_node)
        {
            oxs_key_t *key_to_decrypt = NULL;
            axis2_char_t *token_type = NULL;
            axis2_char_t *reference_method = NULL;
            oxs_x509_cert_t *cert = NULL;

            /*Get the sesison key*/
            /*key_to_decrypt = rampart_shp_get_key_for_key_info(env, key_info_node, rampart_context, msg_ctx, AXIS2_FALSE);*/
            if(rampart_token_process_key_info(env, key_info_node, sec_node, rampart_context,
                msg_ctx, AXIS2_FALSE, &cert, &key_to_decrypt, &token_type, &reference_method)
                != AXIS2_SUCCESS)
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                "[rampart]On processing ReferenceList, failed to get the key to decrypt");
                return AXIS2_FAILURE;
            }
            
            /*if security context token is used, then store it. It will be used by the server to encrypt the message*/
            rampart_shp_store_token_id(env, key_info_node, rampart_context, sec_node, AXIS2_TRUE, msg_ctx);

            if(key_to_decrypt)
            {
                /*Now if everything is fine we need to decrypt*/
                oxs_ctx_t *ctx = NULL;
                axiom_node_t *decrypted_node = NULL;

                ctx = oxs_ctx_create(env);
                oxs_ctx_set_key(ctx, env, key_to_decrypt);
                status = oxs_xml_enc_decrypt_node(env, ctx, enc_data_node, &decrypted_node);

                if(AXIS2_FAILURE == status)
                {
                        rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                                          "Data decryption failed", RAMPART_FAULT_IN_ENCRYPTED_DATA, msg_ctx);
                        return AXIS2_FAILURE;
                }
                /*Check if the signture is encrypted*/
                if(0 == axutil_strcmp( OXS_NODE_SIGNATURE , axiom_util_get_localname(decrypted_node, env))){
                    rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_ENCRYPTED, RAMPART_YES);
                }
                /*Check if the body is encrypted*/
                if(0 == axutil_strcmp(OXS_NODE_BODY , axiom_util_get_localname(axiom_node_get_parent(decrypted_node, env), env))){
                    rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_BODY_ENCRYPTED, RAMPART_YES);
                }

                /*Free*/
                oxs_ctx_free(ctx, env);
                ctx = NULL;
            }
            else
            {
                /*Can't help. Error retrieving the key to decrypt the reference. */
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,  "[rampart][shp] On processing ReferenceList, failed to get the key to decrypt");
                return AXIS2_FAILURE;
            }
        }
    }

    axutil_array_list_free(reference_list, env);
    reference_list = NULL;
    return status;
}

#if 0
static axis2_status_t
rampart_shp_process_sym_binding_signature(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_soap_envelope_t *soap_envelope,
    axiom_node_t *sec_node,
    axiom_node_t *sig_node)
{
    axis2_status_t status = AXIS2_FAILURE;
    oxs_sign_ctx_t *sign_ctx = NULL;
    axiom_node_t *envelope_node = NULL;
    axiom_node_t *key_info_node = NULL;
    oxs_key_t *key_to_verify = NULL;

    /*Get the envelope node*/
    envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env);
   
    /*Get the KeyInfo node*/
    key_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node,
                            OXS_NODE_KEY_INFO, OXS_DSIG_NS, NULL);
    if(key_info_node)
    {
        key_to_verify = rampart_shp_get_key_for_key_info(env, key_info_node,rampart_context, msg_ctx, AXIS2_TRUE);
    }

    if(!key_to_verify)
    {
        /*It's an error*/
        rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                                          "Signature Verification failed. Cannot get the key to verify", 
                                RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[Rampart][shp] Signature Verification failed. Cannot get the key to verify");

        return AXIS2_FAILURE;
    } 
    /*if security context token is used, then store it. It will be used by the server to sign the message*/
    rampart_shp_store_token_id(env, key_info_node, rampart_context, sec_node, AXIS2_FALSE, msg_ctx);

    /*Create sign context*/
    sign_ctx = oxs_sign_ctx_create(env);
    oxs_sign_ctx_set_operation(sign_ctx, env, OXS_SIGN_OPERATION_VERIFY);
    oxs_sign_ctx_set_secret(sign_ctx, env, key_to_verify);
    status = oxs_xml_sig_verify(env, sign_ctx, sig_node, envelope_node);
    if(status != AXIS2_SUCCESS)
    {
        if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env))
        {
            rampart_create_fault_envelope( env, RAMPART_FAULT_INVALID_SECURITY,
                "Signature Verification failed.", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
        }

        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[Rampart][shp]Signature Verification failed.");

        return AXIS2_FAILURE;
    }
    /*Free Sign Ctx*/ 
    oxs_sign_ctx_free(sign_ctx, env);
    sign_ctx = NULL;

    return status;
}

static axis2_status_t
rampart_shp_process_asym_binding_signature(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_soap_envelope_t *soap_envelope,
    axiom_node_t *sec_node,
    axiom_node_t *sig_node,
    axis2_bool_t is_endorsing)
{

    oxs_sign_ctx_t *sign_ctx = NULL;
    axis2_status_t status = AXIS2_FAILURE;
    axis2_char_t *digest_mtd_pol = NULL;
    axis2_char_t *sig_mtd_pol = NULL;
    axiom_node_t *sign_info_node = NULL;
    axiom_node_t *cur_node = NULL;
    rp_property_t *token = NULL;
    axis2_bool_t server_side = AXIS2_FALSE;
    axis2_char_t *eki = NULL;
    rp_property_type_t token_type;
    axiom_node_t *str_node = NULL;
    axiom_node_t *str_child_node = NULL;
    axis2_char_t *str_child_name = NULL;
    oxs_x509_cert_t *cert = NULL;
    axiom_node_t *key_info_child_node = NULL;
    axiom_node_t *envelope_node = NULL;
    axis2_bool_t is_include_token = AXIS2_FALSE;

    server_side = axis2_msg_ctx_get_server_side(msg_ctx,env);
    sig_mtd_pol = rampart_context_get_asym_sig_algo(rampart_context,env);
    digest_mtd_pol = rampart_context_get_digest_mtd(rampart_context,env);

    if(!sig_mtd_pol || !digest_mtd_pol)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_FAILED_CHECK,
                                      "Error in the policy. No signature algo", RAMPART_FAULT_IN_POLICY, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[rampart][shp] Error in policy, Specifying signature algorithms.");
        return AXIS2_FAILURE;
    }

    sign_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node,
                     OXS_NODE_SIGNEDINFO, OXS_DSIG_NS, NULL);

    if(!sign_info_node)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                      "Sign info node not found.", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[rampart][shp] Sign info cannot be found.Verifycation failed");
        return AXIS2_FAILURE;
    }

    cur_node = axiom_node_get_first_element(sign_info_node, env);
    while(cur_node)
    {
        axis2_char_t *localname =  NULL;
        localname  = axiom_util_get_localname(cur_node, env);
        if(axutil_strcmp(localname, OXS_NODE_SIGNATURE_METHOD)==0)
        {
            /*Verify the signature method with policy*/
            axis2_char_t *sig_mtd = NULL;
            sig_mtd = oxs_token_get_signature_method(env, cur_node);
            if(sig_mtd)
            {
                if(axutil_strcmp(sig_mtd_pol, sig_mtd)!=0)
                {
                    rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                  "Signed with Invalid algorithm", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                    AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                    "[rampart][shp] Signed with Invalid algorithm");

                    return AXIS2_FAILURE;
                }
            }

            else
            {
                rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                              "Signature method element not found .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                "[rampart][shp] Signature method element not found");
                return AXIS2_FAILURE;
            }
        }
        else if(axutil_strcmp(localname, OXS_NODE_REFERENCE) == 0)
        {
            /*Verify each digest method with policy*/
            axiom_node_t *digest_mtd_node = NULL;
            axis2_char_t *digest_mtd = NULL;
            digest_mtd_node  = oxs_axiom_get_first_child_node_by_name(env, cur_node,
                               OXS_NODE_DIGEST_METHOD, OXS_DSIG_NS, NULL);
            if(digest_mtd_node)
            {
                digest_mtd = oxs_token_get_digest_method(env, digest_mtd_node);
                if(digest_mtd)
                {
                    if(axutil_strcmp(digest_mtd_pol, digest_mtd)!=0)
                    {
                        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                      "Digest created with Invalid algorithm", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Digest Created with Invalid algorithm");

                        return AXIS2_FAILURE;
                    }
                }
                else
                {
                    return AXIS2_FAILURE;
                }
            }
            else
            {
                return AXIS2_FAILURE;
            }
        }
        else
        {
            /*we do not need to process at this moment*/
        }
        cur_node = axiom_node_get_next_sibling(cur_node, env);
    }/*Eof While*/
    /*Get the key identifiers and build the certificate*/
    /*First we should verify with policy*/

    if(is_endorsing)
        token = rampart_context_get_endorsing_token(rampart_context, env);
    else
        token = rampart_context_get_token(rampart_context, env,
                                      AXIS2_FALSE, server_side, AXIS2_TRUE);

    if(!token)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Signature Token is not specified");
        return AXIS2_FAILURE;
    }
    token_type = rp_property_get_type(token, env);

    if(!rampart_context_is_token_type_supported(token_type, env))
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_UNSUPPORTED_SECURITY_TOKEN,
                                      "The token type does not supported", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[rampart][shp] The token type does not supported");

        return  AXIS2_FAILURE;
    }
    
    is_include_token = rampart_context_is_token_include(
                           rampart_context, token, token_type, server_side, AXIS2_TRUE, env);

    key_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node,
                    OXS_NODE_KEY_INFO, OXS_DSIG_NS, NULL );

    if(!key_info_node)
    {
        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                      "Key Info node is not in the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[rampart][shp]Verify failed. Key Info node is not in the message.");
        return AXIS2_FAILURE;
    }
    str_node = oxs_axiom_get_first_child_node_by_name(env, key_info_node,
               OXS_NODE_SECURITY_TOKEN_REFRENCE, OXS_WSSE_XMLNS, NULL);

    if(str_node)
    {
        /* A <wsse:SecurityTokenReference> element MAY reference an X.509 token type
         * by one of the following means:
         *  - Reference to a Subject Key Identifier (<wsse:KeyIdentifier>)
         *  - Reference to a Binary Security Token (<wsse:Reference> element that
         *    references a local <wsse:BinarySecurityToken> element or a remote data
         *    source that contains the token data itself)
         *  - Reference to an Issuer and Serial Number (<ds:X509Data> element that 
         *    contains a <ds:X509IssuerSerial> element that uniquely identifies an 
         *    end entity certificate)
         */
        str_child_node = axiom_node_get_first_element(str_node,env);
        if(str_child_node)
        {
            str_child_name = axiom_util_get_localname(str_child_node, env);
            if(str_child_name)
            {
                if(is_include_token)
                {
                    /* The <wsse:Reference> element is used to reference 
                     * an X.509 security token value by means of a URI reference.
                     */
                    if(axutil_strcmp(str_child_name, OXS_NODE_REFERENCE)!=0)
                    {
                        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                      "Token is not in the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                        "[rampart][shp] Token is not included in the message ");

                        return AXIS2_FAILURE;
                    }
                    cert = oxs_x509_cert_create(env);
                    status = rampart_token_process_direct_ref(env, str_child_node, sec_node, cert);
                    if(status == AXIS2_FAILURE)
                    {
                        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                      "Processing Direct Reference Failed .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                        "[Rampart][shp]Processing Direct Reference Failed.");
                        return AXIS2_FAILURE;
                    }
                    status = rampart_context_set_found_cert_in_shp(rampart_context, env, AXIS2_TRUE);
                    if(status == AXIS2_FAILURE)
                    {
                        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                        "[Rampart][shp]Setting Certificate into rmapart context failed.");
                        return AXIS2_FAILURE;
                    }
                    status = rampart_context_set_receiver_cert_found_in_shp(rampart_context, env, cert);
                }
                else
                {
                    if(0 == axutil_strcmp(str_child_name, OXS_NODE_EMBEDDED))
                    {
                        if(!rampart_context_is_key_identifier_type_supported(
                                    rampart_context, token, RAMPART_STR_EMBEDDED, env))
                        {
                            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                          "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Key Reference Info mismatch (%s, %s)", str_child_name, OXS_NODE_EMBEDDED);
                            return AXIS2_FAILURE;
                        }
                        cert = oxs_x509_cert_create(env);
                        status = rampart_token_process_embedded(env, str_child_node, cert);
                        if(status == AXIS2_FAILURE)
                        {
                            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                          "Processing Embedded Token Failed .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Processing Embedded Token Failed.");
                            return AXIS2_FAILURE;
                        }
                        status = rampart_context_set_found_cert_in_shp(rampart_context, env, AXIS2_TRUE);
                        if(status == AXIS2_FAILURE)
                        {
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Setting Certificate into rmapart context failed.");
                            return AXIS2_FAILURE;
                        }
                        status = rampart_context_set_receiver_cert_found_in_shp(rampart_context, env, cert);
                    }
                    else if(0 == axutil_strcmp(str_child_name, OXS_NODE_KEY_IDENTIFIER))
                    {
                        if(!rampart_context_is_key_identifier_type_supported(
                                    rampart_context, token, RAMPART_STR_KEY_IDENTIFIER, env))
                        {
                            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                          "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Key Reference Info mismatch (%s, %s)", str_child_name, OXS_NODE_KEY_IDENTIFIER);
                            return AXIS2_FAILURE;
                        }
                        cert = get_certificate_by_key_identifier(env, rampart_context, str_child_node);
                        if(!cert)
                        {
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Couldn't find a certificate which matched given key information.");
                            return AXIS2_FAILURE;
                        }
                        
                        rampart_context_set_found_cert_in_shp(rampart_context, env, AXIS2_TRUE);
                        rampart_context_set_receiver_cert_found_in_shp(rampart_context, env, cert);
                        status = AXIS2_SUCCESS;
                    }
                    else if(0 == axutil_strcmp(str_child_name, OXS_NODE_X509_DATA))
                    {
                        /* The <ds:X509IssuerSerial> element is used to specify 
                         * a reference to an X.509 security token by means of 
                         * the certificate issuer name and serial number.
                         */
                        
                        if(!rampart_context_is_key_identifier_type_supported(
                                    rampart_context, token, RAMPART_STR_ISSUER_SERIAL, env))
                        {
                            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                          "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Key Reference Info mismatch (%s, %s)", str_child_name, OXS_NODE_X509_DATA);
                            return AXIS2_FAILURE;
                        }
                        cert = get_certificate_by_issuer_serial(env, rampart_context, str_child_node);
                        if(!cert)
                        {
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                            "[Rampart][shp]Couldn't find a certificate which matched given key information.");
                            return AXIS2_FAILURE;
                        }
                        
                        rampart_context_set_found_cert_in_shp(rampart_context, env, AXIS2_TRUE);
                        rampart_context_set_receiver_cert_found_in_shp(rampart_context, env, cert);
                        status = AXIS2_SUCCESS;
                    }
                    else
                    {
                        rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY,
                                                      "Key Reference Type not supported .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI ,
                                        "[Rampart][shp]Key Reference %s not supported ", str_child_name);
                        return AXIS2_FAILURE;
                    }
                }
                if(status != AXIS2_SUCCESS || !cert)
                {
                    rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN,
                                                  "Cannot load the key to verify the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                    AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI ,
                                    "[Rampart][shp] Cannot load the key to verify the message");
                    return AXIS2_FAILURE;
                }
            }
            else
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                "[Rampart][shp]Cannot get the key Reference Type from the message.");
                return AXIS2_FAILURE;
            }
        }
        else
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                            "[Rampart][shp]No Child node in the Security Token Reference Element.");
            return AXIS2_FAILURE;
        }
    }

    /*So there may be scenarios where there is no Security Token Reference Element.*/
    else
    {

        /*In such case policy support only Isssuer Serial scenario.*/

        if(axutil_strcmp(eki, RAMPART_STR_ISSUER_SERIAL)==0)
        {
            key_info_child_node = axiom_node_get_first_element(key_info_node, env);
            if(key_info_child_node)
            {
                axis2_char_t *key_info_child_name = NULL;
                key_info_child_name = axiom_util_get_localname(key_info_child_node, env);
                if(key_info_child_name)
                {
                    if(0 == axutil_strcmp(key_info_child_name, OXS_NODE_X509_DATA))
                    {
                        status = rampart_token_process_x509_data(env, key_info_child_node, cert);
                        if(status != AXIS2_SUCCESS || !cert)
                        {
                            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY_TOKEN,
                                                          "Cannot load the key to verify the message .", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
                            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI ,
                                            "[Rampart][shp] Cannot load the key to verify the message");
                            return AXIS2_FAILURE;
                        }
                    }
                    else
                    {
                        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                        "[Rampart][shp]Cannot get the key Reference Type from the message.");
                        return AXIS2_FAILURE;
                    }
                }
                else
                {
                    AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                    "[Rampart][shp]Cannot get the key Reference Type from the message.");
                    return AXIS2_FAILURE;
                }
            }
            else
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                                "[Rampart][shp]Cannot get the key Reference Type from the message.");
                return AXIS2_FAILURE;
            }
        }

        else
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                            "[Rampart][shp]Can't be used as a direct child of Key Info");
            return AXIS2_FAILURE;
        }
    }

    sign_ctx = oxs_sign_ctx_create(env);

    if(!sign_ctx)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[Rampart][shp]Sign context creation failed. Out of Memeory.");
        return AXIS2_FAILURE;
    }

    /*Set the required values in sig_ctx*/

    oxs_sign_ctx_set_operation(sign_ctx, env, OXS_SIGN_OPERATION_VERIFY);
    oxs_sign_ctx_set_certificate(sign_ctx, env, cert);

    envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env);
    if(!envelope_node)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[Rampart][shp]Cannot get the Envelope node from envelope.");
        return AXIS2_FAILURE;
    }

    /*Verify the signature*/

    status = oxs_xml_sig_verify(env, sign_ctx, sig_node, envelope_node);
    if(status != AXIS2_SUCCESS)
    {
        if(!axis2_msg_ctx_get_fault_soap_envelope(msg_ctx, env))
        {
            rampart_create_fault_envelope(
                env, RAMPART_FAULT_INVALID_SECURITY,
                "Signature Verification failed.", RAMPART_FAULT_IN_SIGNATURE, msg_ctx);
        }

        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "[Rampart][shp]Signature Verification failed.");

        return AXIS2_FAILURE;
    }

    if(sign_ctx)
    {
        oxs_sign_ctx_free(sign_ctx, env);
        sign_ctx = NULL;
    }

    return status;
}

static axis2_status_t
rampart_shp_process_signature(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_soap_envelope_t *soap_envelope,
    axiom_node_t *sec_node,
    axiom_node_t *sig_node)
{
    rp_property_type_t binding_type;
    axis2_status_t status = AXIS2_FAILURE;

    binding_type = rampart_context_get_binding_type(rampart_context, env);

    if(binding_type == RP_PROPERTY_ASYMMETRIC_BINDING)
    {
        status = rampart_shp_process_asym_binding_signature(env, msg_ctx, rampart_context,
            soap_envelope, sec_node, sig_node, AXIS2_FALSE);
    }
    else if(binding_type == RP_PROPERTY_SYMMETRIC_BINDING)
    {
        status = rampart_shp_process_sym_binding_signature(env, msg_ctx, rampart_context,
            soap_envelope, sec_node, sig_node);
    }
    else if(binding_type == RP_PROPERTY_TRANSPORT_BINDING)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Transport Binding Not supported");
        /*Not supported*/
    }
    else
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] Binding type not supported");
        /*Not supported*/
    }

    /* We need to set the Signature Value in the Security Processed Results.
     * This is required for the Signature Confirmation support */
    if(AXIS2_SUCCESS == status)
    {
        axis2_char_t *sig_val = NULL;
        axiom_node_t *sig_val_node = NULL;

        sig_val_node = oxs_axiom_get_first_child_node_by_name(env, sig_node,
            OXS_NODE_SIGNATURE_VALUE, OXS_DSIG_NS, OXS_DS);
        sig_val = oxs_token_get_signature_value(env, sig_val_node);

        rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_VERIFIED, RAMPART_YES);
        rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_VALUE, sig_val);
    }
    else
    {
        rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_VERIFIED, RAMPART_NO);
    }
    return status;
}
#endif

static axis2_status_t
rampart_shp_process_signature(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_soap_envelope_t *soap_envelope,
    axiom_node_t *sec_node,
    axiom_node_t *sig_node)
{
    /* Steps:
     * (1)get the session key/certificate from key info
     * (2)validate signature based on what is available in the incoming message
     * (3)In the validation step, we can get all the nodes which were included in the signature
     * (4)Check whether this is signature or endorsing, based on the nodes included in signature
     * (5)Get the parameters (algorithm, key) from policy and validate incoming signature
     * (6)Get nodes to be included in the signature based on policy and check whether any of them
     *    are missed in the signature. Also, check any additional nodes included in the signature
     * (7)Store the signature to use in signature confirmation
     */
    axiom_node_t *key_info_node = NULL;
    oxs_key_t *symmetric_key = NULL;
    oxs_x509_cert_t *public_cert = NULL;
    oxs_sign_ctx_t *sign_ctx = NULL;
    axutil_array_list_t *signed_parts = NULL;
    int signed_parts_size = 0;
    int i = 0;
    axis2_bool_t is_endorsing = AXIS2_FALSE;
    axis2_char_t *token_type = NULL;
    axis2_char_t *reference_method = NULL;
    axiom_node_t *envelope_node = NULL;
    axis2_char_t *sig_val = NULL;


    /* Step 1: Get the session key or certificate from the message */
    key_info_node = oxs_axiom_get_first_child_node_by_name(env, sig_node, OXS_NODE_KEY_INFO,
        OXS_DSIG_NS, NULL);

    if(!key_info_node)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
            "Signature verification failed. Key Info node is not available in the message.");
        return AXIS2_FAILURE;
    }

    if(rampart_token_process_key_info(env, key_info_node, sec_node, rampart_context, msg_ctx,
        AXIS2_TRUE, &public_cert, &symmetric_key, &token_type, &reference_method) != AXIS2_SUCCESS)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
            "Signature verification failed. Unable to identify signing key from key info.");
        return AXIS2_FAILURE;
    }

    /* if we reach here, either symmetric key or public certificate should be valid */
    /* if security context token or X509 token is used, then store it. It will be used by the
     * server to sign the message */
    rampart_shp_store_token_id(env, key_info_node, rampart_context, sec_node, AXIS2_FALSE, msg_ctx);

    /* receiver certificate should be stored only if token is included as reference or embedded */
    if((public_cert) &&
        ((0 == axutil_strcmp(reference_method, OXS_NODE_REFERENCE))
            || (0 == axutil_strcmp(reference_method, OXS_NODE_EMBEDDED))))
    {
        rampart_context_set_found_cert_in_shp(rampart_context, env, AXIS2_TRUE);
        rampart_context_set_receiver_cert_found_in_shp(rampart_context, env, public_cert);
    }

    /* Step 2: validate signature */
    sign_ctx = oxs_sign_ctx_create(env);
    if(!sign_ctx)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
            "Insufficient memory. Sign context creation failed.");
        return AXIS2_FAILURE;
    }
    oxs_sign_ctx_set_operation(sign_ctx, env, OXS_SIGN_OPERATION_VERIFY);
    oxs_sign_ctx_set_certificate(sign_ctx, env, public_cert);
    oxs_sign_ctx_set_secret(sign_ctx, env, symmetric_key);

    envelope_node = axiom_soap_envelope_get_base_node(soap_envelope, env);
    if(!envelope_node)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Cannot get the Envelope node from envelope.");
        return AXIS2_FAILURE;
    }

    if(oxs_xml_sig_verify(env, sign_ctx, sig_node, envelope_node) != AXIS2_SUCCESS)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Signature Verification failed.");
        return AXIS2_FAILURE;
    }

    /* Step 3: get all the nodes which were included in the signature */
    signed_parts = oxs_sign_ctx_get_sign_parts(sign_ctx, env);
    signed_parts_size = axutil_array_list_size(signed_parts, env);
    if(signed_parts_size == 0)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "None of the nodes are included in the signature.");
        return AXIS2_FAILURE;
    }

    /* Step 4 - 6: verify whether the signature is according to the policy */
    if(signed_parts_size == 1)
    {
        /* It could be endorsing signature */
        /* TODO WS-SecurityPolicy 1.2 allows endorsing signature to include some other parts as
         * well. Rampart/C is not supporting it.
         */
        oxs_sign_part_t *sign_part = NULL;
        axiom_node_t *sign_node = NULL;
        sign_part = (oxs_sign_part_t*)axutil_array_list_get(signed_parts, env, 0);
        sign_node = oxs_sign_part_get_node(sign_part, env);
        is_endorsing = oxs_axiom_check_node_name(env, sign_node, OXS_NODE_SIGNATURE, OXS_DSIG_NS);
        if(is_endorsing)
        {
            rp_property_t *token = NULL;
            rp_property_type_t rp_token_type;

            /* check whether we need endorsing signature*/
            token = rampart_context_get_endorsing_token(rampart_context, env);
            if(!token)
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "Endorsing Token is not specified");
                return AXIS2_FAILURE;
            }

            /* check whether the algorithms are according to endorsing token */
            rp_token_type = rp_property_get_type(token, env);
            if(rp_token_type == RP_PROPERTY_X509_TOKEN)
            {
                axis2_char_t *sign_mtd_algo_provided = NULL;
                axis2_char_t *sign_mtd_algo_needed = NULL;
                sign_mtd_algo_provided = oxs_sign_ctx_get_sign_mtd_algo(sign_ctx, env);
                sign_mtd_algo_needed = rampart_context_get_asym_sig_algo(rampart_context,env);
                if(axutil_strcmp(sign_mtd_algo_provided, sign_mtd_algo_needed) != 0)
                {
                    AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                        "Endorsing signature algorithm is not valid. Expected [%s], given [%s]",
                        sign_mtd_algo_needed, sign_mtd_algo_provided);
                    return AXIS2_FAILURE;
                }
            }
            else
            {
                /* TODO for the moment, we support only asymmetric endorsing using x509 */
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                    "Endorsing signature with non-x509 token is not allowed");
                return AXIS2_FAILURE;
            }
        } /* else part is covered below. It will include the part where signed_parts_size != 1 */
    }

    /* TODO validate the token type, inclusion method, reference method here */

    if(!is_endorsing)
    {
        /* normal signature. Validate whether this signature is valid */
        axutil_array_list_t *nodes_to_sign = NULL;
        int nodes_to_sign_size = 0;
        rp_property_type_t binding_type;
        axis2_char_t *sign_mtd_algo_provided = NULL;
        axis2_char_t *sign_mtd_algo_needed = NULL;
        axis2_char_t *digest_mtd_algo_needed = NULL;

        /* Check the algorithms */
        sign_mtd_algo_provided = oxs_sign_ctx_get_sign_mtd_algo(sign_ctx, env);
        binding_type = rampart_context_get_binding_type(rampart_context, env);
        if(binding_type == RP_PROPERTY_ASYMMETRIC_BINDING)
        {
            sign_mtd_algo_needed = rampart_context_get_asym_sig_algo(rampart_context,env);
        }
        else if(binding_type == RP_PROPERTY_SYMMETRIC_BINDING)
        {
            sign_mtd_algo_needed = rampart_context_get_sym_sig_algo(rampart_context,env);
        }
        else
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                "Signature is not supported for Transport binding");
            return AXIS2_FAILURE;
        }

        if(axutil_strcmp(sign_mtd_algo_provided, sign_mtd_algo_needed) != 0)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                "Signature algorithm is not valid. Expected [%s], given [%s]",
                sign_mtd_algo_needed, sign_mtd_algo_provided);
            return AXIS2_FAILURE;
        }

        /* Get the nodes to be signed and check whether they are signed */
        nodes_to_sign = axutil_array_list_create(env, 0);
        if(rampart_context_get_nodes_to_sign(rampart_context, env, soap_envelope, nodes_to_sign)
            != AXIS2_SUCCESS)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                "Cannot get information about nodes to be signed from policy.");
            return AXIS2_FAILURE;
        }

        nodes_to_sign_size = axutil_array_list_size(nodes_to_sign, env);
        if(nodes_to_sign_size != signed_parts_size)
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                "Number of nodes to be signed [%d] and number of nodes which were included in the "
                "signature [%d] are different.", nodes_to_sign_size, signed_parts_size);
            return AXIS2_FAILURE;
        }

        /* Get digest method and check for validity */
        digest_mtd_algo_needed = rampart_context_get_digest_mtd(rampart_context,env);

        for(i = 0; i < signed_parts_size; ++i)
        {
            oxs_sign_part_t *sign_part = NULL;
            axiom_node_t *signed_node = NULL;
            axis2_char_t *digest_mtd_algo_provided = NULL;
            int j = 0;
            axis2_bool_t match_found = AXIS2_FALSE;

            sign_part = (oxs_sign_part_t*)axutil_array_list_get(signed_parts, env, i);

            /* Check for digest method validity */
            digest_mtd_algo_provided = oxs_sign_part_get_digest_mtd(sign_part, env);
            if(axutil_strcmp(digest_mtd_algo_provided, digest_mtd_algo_needed) != 0)
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                    "Digest algorithm is not valid. Expected [%s], given [%s]",
                    digest_mtd_algo_needed, digest_mtd_algo_provided);
                return AXIS2_FAILURE;
            }

            signed_node = oxs_sign_part_get_node(sign_part, env);

            for(j=0; i< nodes_to_sign_size; ++j)
            {
                axiom_node_t *node_to_be_signed = NULL;
                node_to_be_signed =  (axiom_node_t*)axutil_array_list_get(nodes_to_sign, env, j);
                if(node_to_be_signed == signed_node)
                {
                    match_found = AXIS2_TRUE;
                    break;
                }
            }

            if(!match_found)
            {
                AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
                    "Some nodes that should be signed are not signed.");
                return AXIS2_FAILURE;
            }
        }
    }

    /* signature is successful */
    sig_val = oxs_sign_ctx_get_sig_val(sign_ctx, env);
    if(is_endorsing)
    {
        rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_ENDORSED_VALUE, sig_val);
    }
    else
    {
        rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_SIG_VALUE, sig_val);
    }


    if(sign_ctx)
    {
        oxs_sign_ctx_free(sign_ctx, env);
        sign_ctx = NULL;
    }

    return AXIS2_SUCCESS;
}

/***/
static axis2_status_t 
rampart_shp_detect_replays(const axutil_env_t *env,
                            axis2_msg_ctx_t *msg_ctx,
                            rampart_context_t *rampart_context,
                            axiom_soap_envelope_t *soap_envelope,
                            axiom_node_t *sec_node)
{
    axis2_bool_t need_replay_detection = AXIS2_FALSE;
    axis2_status_t status = AXIS2_FAILURE;

        if((NULL == rampart_context_get_rd_val(rampart_context, env)) && (NULL == rampart_context_get_replay_detector_name(rampart_context, env)))
		{
            AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] Replay detection is not specified. Nothing to do");
            need_replay_detection = AXIS2_FALSE;
        }
		else
		{
            AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] Checking message for replay.");
            need_replay_detection = AXIS2_TRUE;
        }
        if(AXIS2_TRUE == need_replay_detection)
		{
			axis2_char_t* replay_detector_name = rampart_context_get_replay_detector_name(rampart_context, env);
			if (replay_detector_name)
			{
				rampart_replay_detector_t* replay_detector = (rampart_replay_detector_t*)rampart_context_get_replay_detector(rampart_context, env);
				if (!replay_detector)
				{
					AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart][shp] Cannot find the replay detector module");
					rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, "Message is replayed", RAMPART_FAULT_MSG_REPLAYED, msg_ctx);
					return AXIS2_FAILURE;
				}

				AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] Using replay module.");
				status = RAMPART_REPLAY_DETECTOR_IS_REPLAYED(replay_detector, env, msg_ctx, rampart_context);
				if(status != AXIS2_SUCCESS)
				{
					/*Scream .. replayed*/
					AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart][shp] Message can be replayed");
					rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, "Message is replayed", RAMPART_FAULT_MSG_REPLAYED, msg_ctx);
					return AXIS2_FAILURE;
				}
				else
				{
					AXIS2_LOG_INFO(env->log, "[rampart][shp] Checked message for replays. Not a replay.");
				}
			}
			else
			{
				rampart_is_replayed_fn rd_fn = NULL;
				AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] Replay module not defined. Using replay function.");
				
				/*Is replayed*/
				rd_fn = rampart_context_get_replay_detect_function(rampart_context, env);
				if(rd_fn)
				{
					status  = (*rd_fn)(env, msg_ctx, rampart_context, rampart_context_get_rd_user_params(rampart_context, env));
					if(status != AXIS2_SUCCESS)
					{
						/*Scream .. replayed*/
						AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,"[rampart][shp] Message can be replayed");
						rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, "Message is replayed", RAMPART_FAULT_MSG_REPLAYED, msg_ctx);
						return AXIS2_FAILURE;
					}
					else
					{
						AXIS2_LOG_INFO(env->log, "[rampart][shp] Checked message for replays. Not a replay.");
					}
				}
				else
				{
					AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart][shp] No replay detection function specified. Nothing to do. ");
				}
			}
        }
        return AXIS2_SUCCESS;
}

static axis2_status_t
rampart_shp_process_derived_key(const axutil_env_t *env,
                            axis2_msg_ctx_t *msg_ctx,
                            rampart_context_t *rampart_context,
                            axiom_node_t *sec_node,
                            axiom_node_t *dk_node)
{
    oxs_key_t *session_key = NULL;
    oxs_key_t *derived_key = NULL;
    axis2_char_t *token_type = NULL;
    axis2_char_t *reference_method = NULL;
    oxs_x509_cert_t* cert = NULL; 

    /* Get the session key. */ 
    /*session_key = rampart_shp_get_key_for_key_info(
        env, dk_node, rampart_context, msg_ctx, AXIS2_TRUE);*/
    if(rampart_token_process_key_info(env, dk_node, sec_node, rampart_context, msg_ctx, AXIS2_TRUE,
        &cert, &session_key, &token_type, &reference_method) != AXIS2_SUCCESS)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
            "[rampart]Failed to get the session key. Cannot derive the key");
        return AXIS2_FAILURE;
    }
    if(!session_key)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,  
            "[rampart]Failed to get the session key. Cannot derive the key");
        return AXIS2_FAILURE;
    }

    /*Derive the key*/
    derived_key = oxs_derivation_extract_derived_key_from_token(env, dk_node, sec_node, session_key); 
    
    /*Add to the rampart context*/
    rampart_context_add_key(rampart_context, env, derived_key);

    return AXIS2_SUCCESS; 
}

static axis2_status_t
rampart_shp_process_saml_token(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_node_t *saml_node)
{
    axis2_bool_t server_side = AXIS2_FALSE;
    rampart_saml_token_t *saml = NULL;
    axis2_char_t *sub_conf = NULL;
    server_side = axis2_msg_ctx_get_server_side(msg_ctx, env);

    if(AXIS2_FAILURE == rampart_saml_token_validate(env, rampart_context, saml_node))
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart][shp] SAML Signature Verification Failed");
        return AXIS2_FAILURE;
    }
    sub_conf = rampart_saml_token_get_subject_confirmation(env, saml_node);
    if(sub_conf && axutil_strcmp(sub_conf, SAML_SUB_CONFIRMATION_SENDER_VOUCHES) == 0)
    {
        if(!rampart_context_is_include_supporting_token(rampart_context, env, !server_side,
            AXIS2_FALSE, RP_PROPERTY_SAML_TOKEN) && !rampart_context_is_include_supporting_token(
            rampart_context, env, !server_side, AXIS2_FALSE, RP_PROPERTY_ISSUED_TOKEN))
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[Rampart][shp] Unexpected SAML token.");
            return AXIS2_FAILURE;
        }
    }
    else if(sub_conf && axutil_strcmp(sub_conf, SAML_SUB_CONFIRMATION_HOLDER_OF_KEY) == 0)
    {
        if(!rampart_context_is_include_protection_saml_token(rampart_context, !server_side,
            AXIS2_FALSE, env))
        {
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[Rampart][shp] Unexpected SAML token.");
            return AXIS2_FAILURE;
        }
    }
    /* Set the SAML token to the rampart context */
    saml = rampart_saml_token_create(env, saml_node, RAMPART_ST_CONFIR_TYPE_UNSPECIFIED);
    rampart_context_add_saml_token(rampart_context, env, saml);
    return AXIS2_SUCCESS;
}

/*Public functions*/

AXIS2_EXTERN axis2_status_t AXIS2_CALL
rampart_shp_process_sec_header(
    const axutil_env_t *env,
    axis2_msg_ctx_t *msg_ctx,
    rampart_context_t *rampart_context,
    axiom_soap_envelope_t *soap_envelope,
    axiom_node_t *sec_node)
{
    axiom_node_t *cur_node = NULL;
    axis2_status_t status = AXIS2_FAILURE;
    /*axis2_bool_t first_signature = AXIS2_TRUE;*/

    AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart]Processing security header in Strict layout");

    cur_node = axiom_node_get_first_child(sec_node, env);

    /*Loop all security headers*/
    while(cur_node)
    {
        axis2_char_t *cur_local_name = NULL;
        cur_local_name = axiom_util_get_localname(cur_node, env);
        AXIS2_LOG_DEBUG(env->log, AXIS2_LOG_SI, "[rampart]Processing security header element %s",
            cur_local_name);

        /* TODO validate the namespace */

        if(!axutil_strcmp(cur_local_name, OXS_NODE_ENCRYPTED_KEY))
        {
            status = rampart_shp_process_encrypted_key(env, msg_ctx, rampart_context,
                soap_envelope, sec_node, cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_SECURITY_CONTEXT_TOKEN))
        {
            status = rampart_shp_process_security_context_token(env, cur_node, rampart_context,
                msg_ctx);
        }
        else if(!axutil_strcmp(cur_local_name, RAMPART_SECURITY_TIMESTAMP))
        {
            status = rampart_shp_process_timestamptoken(env, msg_ctx, rampart_context, cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, RAMPART_SECURITY_USERNAMETOKEN))
        {
            status = rampart_shp_process_usernametoken(env, msg_ctx, rampart_context, cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_SIGNATURE))
        {
            status = rampart_shp_process_signature(env, msg_ctx, rampart_context, soap_envelope,
                sec_node, cur_node);
#if 0
            if(first_signature)
            {
                status = rampart_shp_process_signature(env, msg_ctx, rampart_context,
                    soap_envelope, sec_node, cur_node);
                first_signature = AXIS2_FALSE;
            }
            else /*endorsing*/
            {
                /* TODO this way of validating endorsing signature is wrong. Correct it */
                status = rampart_shp_process_asym_binding_signature(env, msg_ctx, rampart_context,
                    soap_envelope, sec_node, cur_node, AXIS2_TRUE);
                if(AXIS2_SUCCESS == status)
                {
                    axis2_char_t *sig_val = NULL;
                    axiom_node_t *sig_val_node = NULL;
                    sig_val_node = oxs_axiom_get_first_child_node_by_name(env, cur_node,
                        OXS_NODE_SIGNATURE_VALUE, OXS_DSIG_NS, OXS_DS);
                    sig_val = oxs_token_get_signature_value(env, sig_val_node);
                    rampart_set_security_processed_result(env, msg_ctx, RAMPART_SPR_ENDORSED_VALUE,
                        sig_val);
                }
            }
#endif
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_REFERENCE_LIST))
        {
            status = rampart_shp_process_reference_list(env, msg_ctx, rampart_context,
                soap_envelope, sec_node, cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_DERIVED_KEY_TOKEN))
        {
            /* We need to extract this and store in the rampart context*/
            status = rampart_shp_process_derived_key(env, msg_ctx, rampart_context, sec_node,
                cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_ENCRYPTED_DATA))
        {
            /* We do nothing. But this is possible when a security header is Encrypted. 
             * But it would be decrypted thru a ref list */
            status = AXIS2_SUCCESS;
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_SIGNATURE_CONFIRMATION))
        {
            status = rampart_shp_process_signature_confirmation(env, msg_ctx, rampart_context,
                cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_BINARY_SECURITY_TOKEN))
        {
            /*We do nothing.*/
            status = AXIS2_SUCCESS;
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_SAML_ASSERTION))
        {
            status = rampart_shp_process_saml_token(env, msg_ctx, rampart_context, cur_node);
        }
        else if(!axutil_strcmp(cur_local_name, OXS_NODE_SECURITY_TOKEN_REFRENCE))
        {
            /*We do nothing.*/
            status = AXIS2_SUCCESS;
        }
        else
        {
            /* if the security header is unknown, we should not continue. */
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Unknown security header %s",
                cur_local_name);
            status = AXIS2_FAILURE;
        }

        if(status != AXIS2_SUCCESS)
        {
            axis2_char_t *reason = NULL;
            reason = axutil_stracat(env, cur_local_name, " processing failed");
            rampart_create_fault_envelope(env, RAMPART_FAULT_INVALID_SECURITY, reason,
                cur_local_name, msg_ctx);
            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, reason);
            AXIS2_FREE(env->allocator, reason);
            return AXIS2_FAILURE;
        }

        /* Get next node */
        cur_node = axiom_node_get_next_sibling(cur_node, env);
    }/*Eof while loop*/

    AXIS2_LOG_INFO(env->log, "Security header processing done");

    /*Now detect replays*/
    status = rampart_shp_detect_replays(env, msg_ctx, rampart_context, soap_envelope, sec_node);
    if(status != AXIS2_SUCCESS)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Message replay detected.");
        return AXIS2_FAILURE;
    }

    /* Now validate security policies, those cannot be checked on the fly */
    status = rampart_pv_validate_sec_header(env, rampart_context, sec_node, msg_ctx);
    if(status != AXIS2_SUCCESS)
    {
        AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI, "[rampart]Security policy validation failed.");
        return AXIS2_FAILURE;
    }
    return AXIS2_SUCCESS;
}