| <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en"><head><meta http-equiv="Content-Type" content="text/html;charset=UTF-8"/><link rel="stylesheet" href="../.resources/report.css" type="text/css"/><link rel="shortcut icon" href="../.resources/report.gif" type="image/gif"/><title>BindingBuilder.java</title><link rel="stylesheet" href="../.resources/prettify.css" type="text/css"/><script type="text/javascript" src="../.resources/prettify.js"></script></head><body onload="window['PR_TAB_WIDTH']=4;prettyPrint()"><div class="breadcrumb" id="breadcrumb"><span class="right"><a href="../.sessions.html" class="el_session">Sessions</a></span><a href="../index.html" class="el_report">Coverage Report</a> > <a href="index.html" class="el_package">org.apache.rampart.builder</a> > <span class="el_source">BindingBuilder.java</span></div><h1>BindingBuilder.java</h1><pre class="source lang-java linenums">/* |
| * Copyright 2004,2005 The Apache Software Foundation. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package org.apache.rampart.builder; |
| |
| import org.apache.axiom.om.OMElement; |
| import org.apache.axis2.client.Options; |
| import org.apache.commons.logging.Log; |
| import org.apache.commons.logging.LogFactory; |
| import org.apache.rahas.EncryptedKeyToken; |
| import org.apache.rahas.SimpleTokenStore; |
| import org.apache.rahas.TrustException; |
| import org.apache.rampart.RampartException; |
| import org.apache.rampart.RampartMessageData; |
| import org.apache.rampart.policy.RampartPolicyData; |
| import org.apache.rampart.policy.SupportingPolicyData; |
| import org.apache.rampart.util.RampartUtil; |
| import org.apache.ws.secpolicy.Constants; |
| import org.apache.ws.secpolicy.SPConstants; |
| import org.apache.ws.secpolicy.model.IssuedToken; |
| import org.apache.ws.secpolicy.model.SecureConversationToken; |
| import org.apache.ws.secpolicy.model.SupportingToken; |
| import org.apache.ws.secpolicy.model.Token; |
| import org.apache.ws.secpolicy.model.UsernameToken; |
| import org.apache.ws.secpolicy.model.X509Token; |
| import org.apache.ws.security.WSConstants; |
| import org.apache.ws.security.WSEncryptionPart; |
| import org.apache.ws.security.WSPasswordCallback; |
| import org.apache.ws.security.WSSecurityEngineResult; |
| import org.apache.ws.security.WSSecurityException; |
| import org.apache.ws.security.conversation.ConversationConstants; |
| import org.apache.ws.security.conversation.ConversationException; |
| import org.apache.ws.security.handler.WSHandlerConstants; |
| import org.apache.ws.security.handler.WSHandlerResult; |
| import org.apache.ws.security.message.WSSecDKSign; |
| import org.apache.ws.security.message.WSSecEncryptedKey; |
| import org.apache.ws.security.message.WSSecSignature; |
| import org.apache.ws.security.message.WSSecSignatureConfirmation; |
| import org.apache.ws.security.message.WSSecTimestamp; |
| import org.apache.ws.security.message.WSSecUsernameToken; |
| import org.apache.ws.security.message.token.SecurityTokenReference; |
| import org.apache.ws.security.util.WSSecurityUtil; |
| import org.w3c.dom.Document; |
| import org.w3c.dom.Element; |
| |
| import javax.security.auth.callback.CallbackHandler; |
| import javax.security.auth.callback.UnsupportedCallbackException; |
| import javax.xml.crypto.dsig.Reference; |
| |
| import java.io.IOException; |
| import java.util.*; |
| import java.util.Map.Entry; |
| |
| <span class="fc" id="L67">public abstract class BindingBuilder {</span> |
| <span class="fc" id="L68"> private static Log log = LogFactory.getLog(BindingBuilder.class);</span> |
| |
| private Element insertionLocation; |
| |
| <span class="fc" id="L72"> protected String mainSigId = null;</span> |
| |
| <span class="fc" id="L74"> protected ArrayList<String> encryptedTokensIdList = new ArrayList<String>();</span> |
| |
| protected Element timestampElement; |
| |
| protected Element mainRefListElement; |
| |
| |
| /** |
| * @param rmd |
| */ |
| protected void addTimestamp(RampartMessageData rmd) { |
| <span class="fc" id="L85"> log.debug("Adding timestamp");</span> |
| |
| <span class="fc" id="L87"> WSSecTimestamp timestampBuilder = new WSSecTimestamp();</span> |
| <span class="fc" id="L88"> timestampBuilder.setWsConfig(rmd.getConfig());</span> |
| |
| <span class="fc" id="L90"> timestampBuilder.setTimeToLive(RampartUtil.getTimeToLive(rmd));</span> |
| |
| // add the Timestamp to the SOAP Enevelope |
| |
| <span class="fc" id="L94"> timestampBuilder.build(rmd.getDocument(), rmd</span> |
| .getSecHeader()); |
| |
| <span class="pc bpc" id="L97" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L98"> log.debug("Timestamp id: " + timestampBuilder.getId());</span> |
| } |
| <span class="fc" id="L100"> rmd.setTimestampId(timestampBuilder.getId());</span> |
| |
| <span class="fc" id="L102"> this.timestampElement = timestampBuilder.getElement();</span> |
| <span class="fc" id="L103"> log.debug("Adding timestamp: DONE");</span> |
| <span class="fc" id="L104"> }</span> |
| |
| /** |
| * Add a UsernameToken to the security header |
| * @param rmd |
| * @return The <code>WSSecUsernameToken</code> instance |
| * @throws RampartException |
| */ |
| protected WSSecUsernameToken addUsernameToken(RampartMessageData rmd, UsernameToken token) throws RampartException { |
| |
| <span class="fc" id="L114"> log.debug("Adding a UsernameToken");</span> |
| |
| <span class="fc" id="L116"> RampartPolicyData rpd = rmd.getPolicyData();</span> |
| |
| //Get the user |
| //First try options |
| <span class="fc" id="L120"> Options options = rmd.getMsgContext().getOptions();</span> |
| <span class="fc" id="L121"> String user = options.getUserName();</span> |
| <span class="pc bpc" id="L122" title="3 of 4 branches missed."> if(user == null || user.length() == 0) {</span> |
| //Then try RampartConfig |
| <span class="pc bpc" id="L124" title="1 of 2 branches missed."> if(rpd.getRampartConfig() != null) {</span> |
| <span class="fc" id="L125"> user = rpd.getRampartConfig().getUser();</span> |
| } |
| } |
| |
| <span class="pc bpc" id="L129" title="2 of 4 branches missed."> if(user != null && !"".equals(user)) {</span> |
| <span class="pc bpc" id="L130" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L131"> log.debug("User : " + user);</span> |
| } |
| |
| // If NoPassword property is set we don't need to set the password |
| <span class="fc bfc" id="L135" title="All 2 branches covered."> if (token.isNoPassword()) {</span> |
| <span class="fc" id="L136"> WSSecUsernameToken utBuilder = new WSSecUsernameToken();</span> |
| <span class="fc" id="L137"> utBuilder.setUserInfo(user, null);</span> |
| <span class="fc" id="L138"> utBuilder.setPasswordType(null);</span> |
| <span class="pc bpc" id="L139" title="1 of 2 branches missed."> if (rmd.getConfig() != null) {</span> |
| <span class="fc" id="L140"> utBuilder.setWsConfig(rmd.getConfig());</span> |
| } |
| <span class="fc" id="L142"> return utBuilder;</span> |
| } |
| |
| //Get the password |
| |
| //First check options object for a password |
| <span class="fc" id="L148"> String password = options.getPassword();</span> |
| |
| <span class="pc bpc" id="L150" title="3 of 4 branches missed."> if(password == null || password.length() == 0) {</span> |
| |
| //Then try to get the password from the given callback handler |
| <span class="fc" id="L153"> CallbackHandler handler = RampartUtil.getPasswordCB(rmd);</span> |
| |
| <span class="pc bpc" id="L155" title="1 of 2 branches missed."> if(handler == null) {</span> |
| //If the callback handler is missing |
| <span class="nc" id="L157"> throw new RampartException("cbHandlerMissing");</span> |
| } |
| |
| <span class="fc" id="L160"> WSPasswordCallback[] cb = { new WSPasswordCallback(user,</span> |
| WSPasswordCallback.USERNAME_TOKEN) }; |
| try { |
| <span class="fc" id="L163"> handler.handle(cb);</span> |
| <span class="nc" id="L164"> } catch (Exception e) {</span> |
| <span class="nc" id="L165"> throw new RampartException("errorInGettingPasswordForUser", </span> |
| new String[]{user}, e); |
| <span class="fc" id="L167"> }</span> |
| |
| //get the password |
| <span class="fc" id="L170"> password = cb[0].getPassword();</span> |
| } |
| |
| <span class="pc bpc" id="L173" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L174"> log.debug("Password : " + password);</span> |
| } |
| |
| <span class="pc bpc" id="L177" title="2 of 4 branches missed."> if(password != null && !"".equals(password)) {</span> |
| //If the password is available then build the token |
| |
| <span class="fc" id="L180"> WSSecUsernameToken utBuilder = new WSSecUsernameToken();</span> |
| <span class="pc bpc" id="L181" title="1 of 2 branches missed."> if(rmd.getConfig() != null) {</span> |
| <span class="fc" id="L182"> utBuilder.setWsConfig(rmd.getConfig());</span> |
| } |
| <span class="pc bpc" id="L184" title="1 of 2 branches missed."> if (token.isHashPassword()) {</span> |
| <span class="nc" id="L185"> utBuilder.setPasswordType(WSConstants.PASSWORD_DIGEST); </span> |
| } else { |
| <span class="fc" id="L187"> utBuilder.setPasswordType(WSConstants.PASSWORD_TEXT);</span> |
| } |
| |
| <span class="fc" id="L190"> utBuilder.setUserInfo(user, password);</span> |
| |
| <span class="fc" id="L192"> return utBuilder;</span> |
| } else { |
| //If there's no password then throw an exception |
| <span class="nc" id="L195"> throw new RampartException("noPasswordForUser", </span> |
| new String[]{user}); |
| } |
| |
| } else { |
| <span class="nc" id="L200"> log.debug("No user value specified in the configuration");</span> |
| <span class="nc" id="L201"> throw new RampartException("userMissing");</span> |
| } |
| |
| } |
| |
| |
| /** |
| * @param rmd |
| * @param token |
| * @return |
| * @throws WSSecurityException |
| * @throws RampartException |
| */ |
| protected WSSecEncryptedKey getEncryptedKeyBuilder(RampartMessageData rmd, Token token) throws RampartException { |
| |
| <span class="fc" id="L216"> RampartPolicyData rpd = rmd.getPolicyData();</span> |
| <span class="fc" id="L217"> Document doc = rmd.getDocument();</span> |
| |
| <span class="fc" id="L219"> WSSecEncryptedKey encrKey = new WSSecEncryptedKey();</span> |
| |
| try { |
| <span class="fc" id="L222"> RampartUtil.setKeyIdentifierType(rmd, encrKey, token);</span> |
| <span class="fc" id="L223"> RampartUtil.setEncryptionUser(rmd, encrKey);</span> |
| |
| //TODO we do not need to pass keysize as it is taken from algorithm it self - verify |
| <span class="fc" id="L226"> encrKey.setKeyEncAlgo(rpd.getAlgorithmSuite().getAsymmetricKeyWrap());</span> |
| |
| <span class="fc" id="L228"> encrKey.prepare(doc, RampartUtil.getEncryptionCrypto(rpd.getRampartConfig(), rmd.getCustomClassLoader()));</span> |
| |
| <span class="fc" id="L230"> return encrKey;</span> |
| <span class="nc" id="L231"> } catch (WSSecurityException e) {</span> |
| <span class="nc" id="L232"> throw new RampartException("errorCreatingEncryptedKey", e);</span> |
| } |
| } |
| |
| //Deprecated after 1.5 release |
| @Deprecated |
| protected WSSecSignature getSignatureBuider(RampartMessageData rmd, |
| Token token) throws RampartException { |
| <span class="nc" id="L240"> return getSignatureBuilder(rmd, token, null);</span> |
| } |
| |
| //Deprecated after 1.5 release |
| @Deprecated |
| protected WSSecSignature getSignatureBuider(RampartMessageData rmd, Token token, |
| String userCertAlias) throws RampartException { |
| <span class="nc" id="L247"> return getSignatureBuilder(rmd, token, userCertAlias);</span> |
| } |
| |
| protected WSSecSignature getSignatureBuilder(RampartMessageData rmd, |
| Token token)throws RampartException { |
| <span class="fc" id="L252"> return getSignatureBuilder(rmd, token, null);</span> |
| } |
| |
| protected WSSecSignature getSignatureBuilder(RampartMessageData rmd, Token token, |
| String userCertAlias) throws RampartException { |
| |
| <span class="fc" id="L258"> RampartPolicyData rpd = rmd.getPolicyData();</span> |
| |
| <span class="fc" id="L260"> WSSecSignature sig = new WSSecSignature();</span> |
| <span class="fc" id="L261"> checkForX509PkiPath(sig, token);</span> |
| <span class="fc" id="L262"> sig.setWsConfig(rmd.getConfig());</span> |
| |
| <span class="pc bpc" id="L264" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L265"> log.debug("Token inclusion: " + token.getInclusion());</span> |
| } |
| |
| <span class="fc" id="L268"> RampartUtil.setKeyIdentifierType(rmd, sig, token);</span> |
| |
| <span class="fc" id="L270"> String user = null;</span> |
| |
| <span class="fc bfc" id="L272" title="All 2 branches covered."> if (userCertAlias != null) {</span> |
| <span class="fc" id="L273"> user = userCertAlias;</span> |
| } |
| |
| // Get the user - First check whether userCertAlias present |
| <span class="fc bfc" id="L277" title="All 2 branches covered."> if (user == null) {</span> |
| <span class="fc" id="L278"> user = rpd.getRampartConfig().getUserCertAlias();</span> |
| } |
| |
| // If userCertAlias is not present, use user property as Alias |
| |
| <span class="fc bfc" id="L283" title="All 2 branches covered."> if (user == null) {</span> |
| <span class="fc" id="L284"> user = rpd.getRampartConfig().getUser();</span> |
| } |
| |
| <span class="fc" id="L287"> String password = null;</span> |
| |
| <span class="pc bpc" id="L289" title="2 of 4 branches missed."> if(user != null && !"".equals(user)) {</span> |
| <span class="pc bpc" id="L290" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L291"> log.debug("User : " + user);</span> |
| } |
| |
| //Get the password |
| <span class="fc" id="L295"> CallbackHandler handler = RampartUtil.getPasswordCB(rmd);</span> |
| |
| <span class="pc bpc" id="L297" title="1 of 2 branches missed."> if(handler == null) {</span> |
| //If the callback handler is missing |
| <span class="nc" id="L299"> throw new RampartException("cbHandlerMissing");</span> |
| } |
| |
| <span class="fc" id="L302"> WSPasswordCallback[] cb = { new WSPasswordCallback(user,</span> |
| WSPasswordCallback.SIGNATURE) }; |
| |
| try { |
| <span class="fc" id="L306"> handler.handle(cb);</span> |
| <span class="pc bpc" id="L307" title="2 of 4 branches missed."> if(cb[0].getPassword() != null && !"".equals(cb[0].getPassword())) {</span> |
| <span class="fc" id="L308"> password = cb[0].getPassword();</span> |
| <span class="pc bpc" id="L309" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L310"> log.debug("Password : " + password);</span> |
| } |
| } else { |
| //If there's no password then throw an exception |
| <span class="nc" id="L314"> throw new RampartException("noPasswordForUser", </span> |
| new String[]{user}); |
| } |
| <span class="nc" id="L317"> } catch (IOException e) {</span> |
| <span class="nc" id="L318"> throw new RampartException("errorInGettingPasswordForUser", </span> |
| new String[]{user}, e); |
| <span class="nc" id="L320"> } catch (UnsupportedCallbackException e) {</span> |
| <span class="nc" id="L321"> throw new RampartException("errorInGettingPasswordForUser", </span> |
| new String[]{user}, e); |
| <span class="fc" id="L323"> }</span> |
| |
| <span class="fc" id="L325"> } else {</span> |
| <span class="nc" id="L326"> log.debug("No user value specified in the configuration");</span> |
| <span class="nc" id="L327"> throw new RampartException("userMissing");</span> |
| } |
| |
| <span class="fc" id="L330"> sig.setUserInfo(user, password);</span> |
| <span class="fc" id="L331"> sig.setSignatureAlgorithm(rpd.getAlgorithmSuite().getAsymmetricSignature());</span> |
| <span class="fc" id="L332"> sig.setSigCanonicalization(rpd.getAlgorithmSuite().getInclusiveC14n());</span> |
| |
| try { |
| <span class="fc" id="L335"> sig.prepare(rmd.getDocument(), RampartUtil.getSignatureCrypto(rpd</span> |
| .getRampartConfig(), rmd.getCustomClassLoader()), |
| rmd.getSecHeader()); |
| <span class="nc" id="L338"> } catch (WSSecurityException e) {</span> |
| <span class="nc" id="L339"> throw new RampartException("errorInSignatureWithX509Token", e);</span> |
| <span class="fc" id="L340"> }</span> |
| |
| <span class="fc" id="L342"> return sig;</span> |
| } |
| |
| /** |
| * @param rmd |
| * @param suppTokens |
| * @throws RampartException |
| */ |
| protected HashMap handleSupportingTokens(RampartMessageData rmd, SupportingToken suppTokens) |
| throws RampartException { |
| |
| //Create the list to hold the tokens |
| // TODO putting different types of objects. Need to figure out a way to add single types of objects |
| <span class="fc" id="L355"> HashMap endSuppTokMap = new HashMap();</span> |
| |
| <span class="pc bpc" id="L357" title="1 of 6 branches missed."> if(suppTokens != null && suppTokens.getTokens() != null &&</span> |
| suppTokens.getTokens().size() > 0) { |
| <span class="fc" id="L359"> log.debug("Processing supporting tokens");</span> |
| |
| <span class="fc" id="L361"> ArrayList tokens = suppTokens.getTokens();</span> |
| <span class="fc bfc" id="L362" title="All 2 branches covered."> for (Object objectToken : tokens) {</span> |
| <span class="fc" id="L363"> Token token = (Token) objectToken;</span> |
| <span class="fc" id="L364"> org.apache.rahas.Token endSuppTok = null;</span> |
| <span class="pc bpc" id="L365" title="1 of 4 branches missed."> if (token instanceof IssuedToken && rmd.isInitiator()) {</span> |
| <span class="fc" id="L366"> String id = RampartUtil.getIssuedToken(rmd, (IssuedToken) token);</span> |
| try { |
| <span class="fc" id="L368"> endSuppTok = rmd.getTokenStorage().getToken(id);</span> |
| <span class="nc" id="L369"> } catch (TrustException e) {</span> |
| <span class="nc" id="L370"> throw new RampartException("errorInRetrievingTokenId",</span> |
| new String[]{id}, e); |
| <span class="fc" id="L372"> }</span> |
| |
| <span class="pc bpc" id="L374" title="1 of 2 branches missed."> if (endSuppTok == null) {</span> |
| <span class="nc" id="L375"> throw new RampartException("errorInRetrievingTokenId",</span> |
| new String[]{id}); |
| } |
| |
| //Add the token to the header |
| <span class="fc" id="L380"> Element siblingElem = RampartUtil</span> |
| .insertSiblingAfter(rmd, this.getInsertionLocation(), |
| (Element) endSuppTok.getToken()); |
| <span class="fc" id="L383"> this.setInsertionLocation(siblingElem);</span> |
| |
| <span class="pc bpc" id="L385" title="1 of 2 branches missed."> if (suppTokens.isEncryptedToken()) {</span> |
| <span class="nc" id="L386"> this.encryptedTokensIdList.add(endSuppTok.getId());</span> |
| } |
| |
| //Add the extracted token |
| <span class="fc" id="L390"> endSuppTokMap.put(token, endSuppTok);</span> |
| |
| <span class="fc bfc" id="L392" title="All 2 branches covered."> } else if (token instanceof X509Token) {</span> |
| |
| //We have to use a cert |
| //Prepare X509 signature |
| <span class="fc" id="L396"> WSSecSignature sig = this.getSignatureBuilder(rmd, token);</span> |
| <span class="fc" id="L397"> Element bstElem = sig.getBinarySecurityTokenElement();</span> |
| <span class="pc bpc" id="L398" title="1 of 2 branches missed."> if (bstElem != null) {</span> |
| <span class="fc" id="L399"> bstElem = RampartUtil.insertSiblingAfter(rmd,</span> |
| this.getInsertionLocation(), bstElem); |
| <span class="fc" id="L401"> this.setInsertionLocation(bstElem);</span> |
| |
| <span class="fc" id="L403"> SupportingPolicyData supportingPolcy = new SupportingPolicyData();</span> |
| <span class="fc" id="L404"> supportingPolcy.build(suppTokens);</span> |
| <span class="fc" id="L405"> supportingPolcy.setSignatureToken(token);</span> |
| <span class="fc" id="L406"> supportingPolcy.setEncryptionToken(token);</span> |
| <span class="fc" id="L407"> rmd.getPolicyData().addSupportingPolicyData(supportingPolcy);</span> |
| |
| <span class="fc bfc" id="L409" title="All 2 branches covered."> if (suppTokens.isEncryptedToken()) {</span> |
| <span class="fc" id="L410"> this.encryptedTokensIdList.add(sig.getBSTTokenId());</span> |
| } |
| } |
| <span class="fc" id="L413"> endSuppTokMap.put(token, sig);</span> |
| |
| <span class="pc bpc" id="L415" title="1 of 2 branches missed."> } else if (token instanceof UsernameToken) {</span> |
| <span class="fc" id="L416"> WSSecUsernameToken utBuilder = addUsernameToken(rmd, (UsernameToken) token);</span> |
| |
| <span class="fc" id="L418"> utBuilder.prepare(rmd.getDocument());</span> |
| |
| //Add the UT |
| <span class="fc" id="L421"> Element elem = utBuilder.getUsernameTokenElement();</span> |
| <span class="fc" id="L422"> elem = RampartUtil.insertSiblingAfter(rmd, this.getInsertionLocation(), elem);</span> |
| |
| <span class="fc" id="L424"> encryptedTokensIdList.add(utBuilder.getId());</span> |
| |
| //Move the insert location to the next element |
| <span class="fc" id="L427"> this.setInsertionLocation(elem);</span> |
| <span class="fc" id="L428"> Date now = new Date();</span> |
| try { |
| <span class="fc" id="L430"> org.apache.rahas.Token tempTok = new org.apache.rahas.Token(</span> |
| utBuilder.getId(), (OMElement) elem, now, |
| new Date(now.getTime() + 300000)); |
| <span class="fc" id="L433"> endSuppTokMap.put(token, tempTok);</span> |
| <span class="nc" id="L434"> } catch (TrustException e) {</span> |
| <span class="nc" id="L435"> throw new RampartException("errorCreatingRahasToken", e);</span> |
| <span class="fc" id="L436"> }</span> |
| } |
| <span class="fc" id="L438"> }</span> |
| } |
| |
| <span class="fc" id="L441"> return endSuppTokMap;</span> |
| } |
| /** |
| * @param tokenMap |
| * @param sigParts |
| * @throws RampartException |
| */ |
| protected List<WSEncryptionPart> addSignatureParts(HashMap tokenMap, List<WSEncryptionPart> sigParts) |
| throws RampartException { |
| |
| <span class="fc" id="L451"> Set entrySet = tokenMap.entrySet();</span> |
| |
| <span class="fc bfc" id="L453" title="All 2 branches covered."> for (Object anEntrySet : entrySet) {</span> |
| <span class="fc" id="L454"> Object tempTok = ((Entry) anEntrySet).getValue();</span> |
| <span class="fc" id="L455"> WSEncryptionPart part = null;</span> |
| |
| <span class="fc bfc" id="L457" title="All 2 branches covered."> if (tempTok instanceof org.apache.rahas.Token) {</span> |
| |
| <span class="fc" id="L459"> part = new WSEncryptionPart(</span> |
| ((org.apache.rahas.Token) tempTok).getId()); |
| |
| <span class="pc bpc" id="L462" title="1 of 2 branches missed."> } else if (tempTok instanceof WSSecSignature) {</span> |
| <span class="fc" id="L463"> WSSecSignature tempSig = (WSSecSignature) tempTok;</span> |
| <span class="pc bpc" id="L464" title="1 of 2 branches missed."> if (tempSig.getBSTTokenId() != null) {</span> |
| <span class="fc" id="L465"> part = new WSEncryptionPart(tempSig.getBSTTokenId());</span> |
| } |
| <span class="fc" id="L467"> } else {</span> |
| |
| <span class="nc" id="L469"> throw new RampartException("UnsupportedTokenInSupportingToken");</span> |
| } |
| <span class="fc" id="L471"> sigParts.add(part);</span> |
| <span class="fc" id="L472"> }</span> |
| |
| <span class="fc" id="L474"> return sigParts;</span> |
| } |
| |
| |
| public Element getInsertionLocation() { |
| <span class="fc" id="L479"> return insertionLocation;</span> |
| } |
| |
| public void setInsertionLocation(Element insertionLocation) { |
| <span class="fc" id="L483"> this.insertionLocation = insertionLocation;</span> |
| <span class="fc" id="L484"> }</span> |
| |
| |
| protected List<byte[]> doEndorsedSignatures(RampartMessageData rmd, HashMap tokenMap) throws RampartException { |
| |
| <span class="fc" id="L489"> Set tokenSet = tokenMap.keySet();</span> |
| |
| <span class="fc" id="L491"> List<byte[]> sigValues = new ArrayList<byte[]>();</span> |
| |
| <span class="fc bfc" id="L493" title="All 2 branches covered."> for (Object aTokenSet : tokenSet) {</span> |
| |
| <span class="fc" id="L495"> Token token = (Token) aTokenSet;</span> |
| |
| <span class="fc" id="L497"> Object tempTok = tokenMap.get(token);</span> |
| |
| // Migrating to a list |
| <span class="fc" id="L500"> List<WSEncryptionPart> sigParts = new ArrayList<WSEncryptionPart>();</span> |
| <span class="fc" id="L501"> sigParts.add(new WSEncryptionPart(this.mainSigId));</span> |
| |
| <span class="pc bpc" id="L503" title="1 of 2 branches missed."> if (tempTok instanceof org.apache.rahas.Token) {</span> |
| <span class="nc" id="L504"> org.apache.rahas.Token tok = (org.apache.rahas.Token) tempTok;</span> |
| <span class="nc bnc" id="L505" title="All 2 branches missed."> if (rmd.getPolicyData().isTokenProtection()) {</span> |
| <span class="nc" id="L506"> sigParts.add(new WSEncryptionPart(tok.getId()));</span> |
| } |
| |
| <span class="nc" id="L509"> this.doSymmSignature(rmd, token, (org.apache.rahas.Token) tempTok, sigParts);</span> |
| |
| <span class="pc bpc" id="L511" title="1 of 2 branches missed."> } else if (tempTok instanceof WSSecSignature) {</span> |
| <span class="fc" id="L512"> WSSecSignature sig = (WSSecSignature) tempTok;</span> |
| <span class="pc bpc" id="L513" title="3 of 4 branches missed."> if (rmd.getPolicyData().isTokenProtection() &&</span> |
| sig.getBSTTokenId() != null) { |
| <span class="nc" id="L515"> sigParts.add(new WSEncryptionPart(sig.getBSTTokenId()));</span> |
| } |
| |
| try { |
| |
| |
| <span class="fc" id="L521"> List<Reference> referenceList</span> |
| = sig.addReferencesToSign(sigParts, rmd.getSecHeader()); |
| |
| /** |
| * Before migration it was - this.setInsertionLocation(RampartUtil.insertSiblingAfter(rmd, this |
| * .getInsertionLocation(), supportingSignatureElement)); |
| * |
| * In this case we need to append <Signature>..</Signature> element to |
| * current insertion location |
| */ |
| |
| <span class="fc" id="L532"> sig.computeSignature(referenceList, false, this.getInsertionLocation());</span> |
| |
| <span class="fc" id="L534"> this.setInsertionLocation(sig.getSignatureElement());</span> |
| |
| <span class="nc" id="L536"> } catch (WSSecurityException e) {</span> |
| <span class="nc" id="L537"> throw new RampartException("errorInSignatureWithX509Token", e);</span> |
| <span class="fc" id="L538"> }</span> |
| <span class="fc" id="L539"> sigValues.add(sig.getSignatureValue());</span> |
| } |
| <span class="fc" id="L541"> } </span> |
| |
| <span class="fc" id="L543"> return sigValues;</span> |
| |
| } |
| |
| |
| protected byte[] doSymmSignature(RampartMessageData rmd, Token policyToken, org.apache.rahas.Token tok, |
| List<WSEncryptionPart> sigParts) throws RampartException { |
| |
| <span class="fc" id="L551"> Document doc = rmd.getDocument();</span> |
| |
| <span class="fc" id="L553"> RampartPolicyData rpd = rmd.getPolicyData();</span> |
| |
| <span class="fc bfc" id="L555" title="All 2 branches covered."> if(policyToken.isDerivedKeys()) {</span> |
| try { |
| <span class="fc" id="L557"> WSSecDKSign dkSign = new WSSecDKSign(); </span> |
| |
| //Check whether it is security policy 1.2 and use the secure conversation accordingly |
| <span class="fc bfc" id="L560" title="All 2 branches covered."> if (SPConstants.SP_V12 == policyToken.getVersion()) {</span> |
| <span class="fc" id="L561"> dkSign.setWscVersion(ConversationConstants.VERSION_05_12);</span> |
| } |
| |
| //Check for whether the token is attached in the message or not |
| <span class="fc" id="L565"> boolean attached = false;</span> |
| |
| <span class="pc bpc" id="L567" title="2 of 8 branches missed."> if (SPConstants.INCLUDE_TOEKN_ALWAYS == policyToken.getInclusion() ||</span> |
| SPConstants.INCLUDE_TOKEN_ONCE == policyToken.getInclusion() || |
| (rmd.isInitiator() && SPConstants.INCLUDE_TOEKN_ALWAYS_TO_RECIPIENT |
| == policyToken.getInclusion())) { |
| <span class="fc" id="L571"> attached = true;</span> |
| } |
| |
| // Setting the AttachedReference or the UnattachedReference according to the flag |
| OMElement ref; |
| <span class="fc bfc" id="L576" title="All 2 branches covered."> if (attached) {</span> |
| <span class="fc" id="L577"> ref = tok.getAttachedReference();</span> |
| } else { |
| <span class="fc" id="L579"> ref = tok.getUnattachedReference();</span> |
| } |
| |
| <span class="fc bfc" id="L582" title="All 2 branches covered."> if(ref != null) {</span> |
| <span class="fc" id="L583"> dkSign.setExternalKey(tok.getSecret(), (Element) </span> |
| doc.importNode((Element) ref, true)); |
| <span class="pc bpc" id="L585" title="1 of 4 branches missed."> } else if (!rmd.isInitiator() && policyToken.isDerivedKeys()) { </span> |
| |
| // If the Encrypted key used to create the derived key is not |
| // attached use key identifier as defined in WSS1.1 section |
| // 7.7 Encrypted Key reference |
| <span class="fc" id="L590"> SecurityTokenReference tokenRef = new SecurityTokenReference(doc);</span> |
| <span class="pc bpc" id="L591" title="1 of 2 branches missed."> if(tok instanceof EncryptedKeyToken) {</span> |
| <span class="fc" id="L592"> tokenRef.setKeyIdentifierEncKeySHA1(((EncryptedKeyToken)tok).getSHA1());;</span> |
| } |
| <span class="fc" id="L594"> dkSign.setExternalKey(tok.getSecret(), tokenRef.getElement());</span> |
| <span class="fc" id="L595"> tokenRef.addTokenType(WSConstants.WSS_ENC_KEY_VALUE_TYPE); // TODO check this</span> |
| |
| <span class="fc" id="L597"> } else {</span> |
| <span class="fc" id="L598"> dkSign.setExternalKey(tok.getSecret(), tok.getId());</span> |
| } |
| |
| //Set the algo info |
| <span class="fc" id="L602"> dkSign.setSignatureAlgorithm(rpd.getAlgorithmSuite().getSymmetricSignature());</span> |
| <span class="fc" id="L603"> dkSign.setDerivedKeyLength(rpd.getAlgorithmSuite().getSignatureDerivedKeyLength()/8);</span> |
| <span class="fc bfc" id="L604" title="All 2 branches covered."> if(tok instanceof EncryptedKeyToken) {</span> |
| //Set the value type of the reference |
| <span class="fc" id="L606"> dkSign.setCustomValueType(WSConstants.SOAPMESSAGE_NS11 + "#"</span> |
| + WSConstants.ENC_KEY_VALUE_TYPE); |
| } |
| |
| <span class="fc" id="L610"> dkSign.prepare(doc, rmd.getSecHeader());</span> |
| |
| <span class="pc bpc" id="L612" title="1 of 2 branches missed."> if(rpd.isTokenProtection()) {</span> |
| |
| //Hack to handle reference id issues |
| //TODO Need a better fix |
| <span class="nc" id="L616"> String sigTokId = tok.getId();</span> |
| <span class="nc bnc" id="L617" title="All 2 branches missed."> if(sigTokId.startsWith("#")) {</span> |
| <span class="nc" id="L618"> sigTokId = sigTokId.substring(1);</span> |
| } |
| <span class="nc" id="L620"> sigParts.add(new WSEncryptionPart(sigTokId));</span> |
| } |
| |
| <span class="fc" id="L623"> dkSign.setParts(sigParts);</span> |
| |
| <span class="fc" id="L625"> List<Reference> referenceList</span> |
| = dkSign.addReferencesToSign(sigParts, rmd.getSecHeader()); |
| |
| //Add elements to header |
| //Do signature |
| <span class="pc bpc" id="L630" title="1 of 4 branches missed."> if (rpd.getProtectionOrder().equals(SPConstants.ENCRYPT_BEFORE_SIGNING) &&</span> |
| this.mainRefListElement != null ) { |
| |
| /** |
| * <xenc:ReferenceList> |
| * <xenc:DataReference URI="#EncDataId-2"/> |
| * </xenc:ReferenceList> |
| * If there is a reference list as above we need to first prepend reference list |
| * with the new derived key. Then we need to prepend Signature to newly added derived key. |
| */ |
| |
| // Add DeriveKey before ReferenceList |
| <span class="fc" id="L642"> RampartUtil.insertSiblingBefore(rmd, this.mainRefListElement, dkSign.getdktElement());</span> |
| |
| // Insert signature before DerivedKey |
| <span class="fc" id="L645"> dkSign.computeSignature(referenceList, true, dkSign.getdktElement());</span> |
| <span class="fc" id="L646"> this.setInsertionLocation(this.mainRefListElement);</span> |
| } else { |
| |
| /** |
| * Add <wsc:DerivedKeyToken>..</wsc:DerivedKeyToken> to security |
| * header. |
| */ |
| <span class="fc" id="L653"> dkSign.appendDKElementToHeader(rmd.getSecHeader());</span> |
| |
| <span class="fc" id="L655"> this.setInsertionLocation(dkSign.getdktElement());</span> |
| |
| /** |
| * In this case we need to insert <Signature>..</Signature> element |
| * before this.mainRefListElement element. In other words we need to |
| * prepend <Signature>...</Signature> element to this.mainRefListElement. |
| */ |
| <span class="fc" id="L662"> dkSign.computeSignature(referenceList, false, this.getInsertionLocation());</span> |
| <span class="fc" id="L663"> this.setInsertionLocation(dkSign.getSignatureElement());</span> |
| } |
| |
| <span class="fc" id="L666"> return dkSign.getSignatureValue();</span> |
| |
| <span class="nc" id="L668"> } catch (ConversationException e) {</span> |
| <span class="nc" id="L669"> throw new RampartException(</span> |
| "errorInDerivedKeyTokenSignature", e); |
| <span class="nc" id="L671"> } catch (WSSecurityException e) {</span> |
| <span class="nc" id="L672"> throw new RampartException(</span> |
| "errorInDerivedKeyTokenSignature", e); |
| } |
| } else { |
| try { |
| <span class="fc" id="L677"> WSSecSignature sig = new WSSecSignature();</span> |
| <span class="fc" id="L678"> sig.setWsConfig(rmd.getConfig());</span> |
| |
| // If a EncryptedKeyToken is used, set the correct value type to |
| // be used in the wsse:Reference in ds:KeyInfo |
| <span class="pc bpc" id="L682" title="1 of 2 branches missed."> if (policyToken instanceof X509Token) {</span> |
| <span class="fc bfc" id="L683" title="All 2 branches covered."> if (rmd.isInitiator()) {</span> |
| <span class="fc" id="L684"> sig.setCustomTokenValueType(WSConstants.SOAPMESSAGE_NS11 + "#"</span> |
| + WSConstants.ENC_KEY_VALUE_TYPE); |
| <span class="fc" id="L686"> sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);</span> |
| } else { |
| // the tok has to be an EncryptedKey token |
| <span class="fc" id="L689"> sig.setEncrKeySha1value(((EncryptedKeyToken) tok).getSHA1());</span> |
| <span class="fc" id="L690"> sig.setKeyIdentifierType(WSConstants.ENCRYPTED_KEY_SHA1_IDENTIFIER);</span> |
| } |
| |
| <span class="nc bnc" id="L693" title="All 2 branches missed."> } else if (policyToken instanceof IssuedToken) {</span> |
| |
| <span class="nc" id="L695"> sig.setCustomTokenValueType(RampartUtil.getSAML10AssertionNamespace());</span> |
| <span class="nc" id="L696"> sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);</span> |
| } |
| |
| String sigTokId; |
| |
| <span class="pc bpc" id="L701" title="1 of 2 branches missed."> if ( policyToken instanceof SecureConversationToken) {</span> |
| <span class="nc" id="L702"> sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);</span> |
| <span class="nc" id="L703"> OMElement ref = tok.getAttachedReference();</span> |
| <span class="nc bnc" id="L704" title="All 2 branches missed."> if(ref == null) {</span> |
| <span class="nc" id="L705"> ref = tok.getUnattachedReference();</span> |
| } |
| |
| <span class="nc bnc" id="L708" title="All 2 branches missed."> if (ref != null) {</span> |
| <span class="nc" id="L709"> sigTokId = SimpleTokenStore.getIdFromSTR(ref);</span> |
| } else { |
| <span class="nc" id="L711"> sigTokId = tok.getId();</span> |
| } |
| <span class="nc" id="L713"> } else {</span> |
| <span class="fc" id="L714"> sigTokId = tok.getId();</span> |
| } |
| |
| //Hack to handle reference id issues |
| //TODO Need a better fix |
| <span class="pc bpc" id="L719" title="1 of 2 branches missed."> if(sigTokId.startsWith("#")) {</span> |
| <span class="nc" id="L720"> sigTokId = sigTokId.substring(1);</span> |
| } |
| |
| <span class="fc" id="L723"> sig.setCustomTokenId(sigTokId);</span> |
| <span class="fc" id="L724"> sig.setSecretKey(tok.getSecret());</span> |
| <span class="fc" id="L725"> sig.setSignatureAlgorithm(rpd.getAlgorithmSuite().getAsymmetricSignature());// TODO one is redundant ?..</span> |
| <span class="fc" id="L726"> sig.setSignatureAlgorithm(rpd.getAlgorithmSuite().getSymmetricSignature());</span> |
| <span class="fc" id="L727"> sig.prepare(rmd.getDocument(), RampartUtil.getSignatureCrypto(rpd</span> |
| .getRampartConfig(), rmd.getCustomClassLoader()), |
| rmd.getSecHeader()); |
| |
| <span class="fc" id="L731"> sig.setParts(sigParts);</span> |
| <span class="fc" id="L732"> List<Reference> referenceList</span> |
| = sig.addReferencesToSign(sigParts, rmd.getSecHeader()); |
| |
| //Do signature |
| <span class="pc bpc" id="L736" title="1 of 4 branches missed."> if (rpd.getProtectionOrder().equals(SPConstants.ENCRYPT_BEFORE_SIGNING)</span> |
| && this.mainRefListElement != null) { |
| |
| /** |
| * In this case we need to insert <Signature>..</Signature> element |
| * before this.mainRefListElement element. In other words we need to |
| * prepend <Signature>...</Signature> element to this.mainRefListElement. |
| * this.mainRefListElement is equivalent to |
| * <xenc:ReferenceList> |
| * <xenc:DataReference URI="#EncDataId-2"/> |
| * </xenc:ReferenceList> |
| */ |
| <span class="fc" id="L748"> sig.computeSignature(referenceList, true, this.mainRefListElement);</span> |
| <span class="fc" id="L749"> this.setInsertionLocation(this.mainRefListElement);</span> |
| } else { |
| |
| /** |
| * In this case we need to append <Signature>..</Signature> element to |
| * current insertion location. |
| */ |
| <span class="fc" id="L756"> sig.computeSignature(referenceList, false, this.getInsertionLocation());</span> |
| <span class="fc" id="L757"> this.setInsertionLocation(sig.getSignatureElement());</span> |
| } |
| |
| |
| <span class="fc" id="L761"> return sig.getSignatureValue();</span> |
| |
| <span class="nc" id="L763"> } catch (WSSecurityException e) {</span> |
| <span class="nc" id="L764"> throw new RampartException("errorInSignatureWithACustomToken", e);</span> |
| } |
| |
| } |
| } |
| |
| |
| /** |
| * Get hold of the token from the token storage |
| * @param rmd |
| * @param tokenId |
| * @return token from the token storage |
| * @throws RampartException |
| */ |
| protected org.apache.rahas.Token getToken(RampartMessageData rmd, |
| String tokenId) throws RampartException { |
| org.apache.rahas.Token tok; |
| try { |
| <span class="fc" id="L782"> tok = rmd.getTokenStorage().getToken(tokenId);</span> |
| <span class="nc" id="L783"> } catch (TrustException e) {</span> |
| <span class="nc" id="L784"> throw new RampartException("errorInRetrievingTokenId", </span> |
| new String[]{tokenId}, e); |
| <span class="fc" id="L786"> }</span> |
| |
| <span class="pc bpc" id="L788" title="1 of 2 branches missed."> if(tok == null) {</span> |
| <span class="nc" id="L789"> throw new RampartException("errorInRetrievingTokenId", </span> |
| new String[]{tokenId}); |
| } |
| <span class="fc" id="L792"> return tok;</span> |
| } |
| |
| |
| protected void addSignatureConfirmation(RampartMessageData rmd, List<WSEncryptionPart> sigParts) { |
| |
| <span class="fc bfc" id="L798" title="All 2 branches covered."> if(!rmd.getPolicyData().isSignatureConfirmation()) {</span> |
| |
| //If we don't require sig confirmation simply go back :-) |
| <span class="fc" id="L801"> return;</span> |
| } |
| |
| <span class="fc" id="L804"> Document doc = rmd.getDocument();</span> |
| |
| <span class="fc" id="L806"> List<WSHandlerResult> results</span> |
| = (List<WSHandlerResult>)rmd.getMsgContext().getProperty(WSHandlerConstants.RECV_RESULTS); |
| /* |
| * loop over all results gathered by all handlers in the chain. For each |
| * handler result get the various actions. After that loop we have all |
| * signature results in the signatureActions list. |
| */ |
| <span class="fc" id="L813"> List<WSSecurityEngineResult> signatureActions = new ArrayList<WSSecurityEngineResult>();</span> |
| <span class="fc bfc" id="L814" title="All 2 branches covered."> for (Object result : results) {</span> |
| <span class="fc" id="L815"> WSHandlerResult wshResult = (WSHandlerResult) result;</span> |
| |
| <span class="fc" id="L817"> WSSecurityUtil.fetchAllActionResults(wshResult.getResults(),</span> |
| WSConstants.SIGN, signatureActions); |
| <span class="fc" id="L819"> WSSecurityUtil.fetchAllActionResults(wshResult.getResults(),</span> |
| WSConstants.ST_SIGNED, signatureActions); |
| <span class="fc" id="L821"> WSSecurityUtil.fetchAllActionResults(wshResult.getResults(),</span> |
| WSConstants.UT_SIGN, signatureActions); |
| <span class="fc" id="L823"> }</span> |
| |
| // prepare a SignatureConfirmation token |
| <span class="fc" id="L826"> WSSecSignatureConfirmation wsc = new WSSecSignatureConfirmation();</span> |
| <span class="pc bpc" id="L827" title="1 of 2 branches missed."> if (signatureActions.size() > 0) {</span> |
| <span class="pc bpc" id="L828" title="1 of 2 branches missed."> if (log.isDebugEnabled()) {</span> |
| <span class="nc" id="L829"> log.debug("Signature Confirmation: number of Signature results: "</span> |
| + signatureActions.size()); |
| } |
| <span class="fc bfc" id="L832" title="All 2 branches covered."> for (WSSecurityEngineResult signatureAction : signatureActions) {</span> |
| <span class="fc" id="L833"> byte[] sigVal = (byte[]) signatureAction.get(WSSecurityEngineResult.TAG_SIGNATURE_VALUE);</span> |
| <span class="fc" id="L834"> wsc.setSignatureValue(sigVal);</span> |
| <span class="fc" id="L835"> wsc.prepare(doc);</span> |
| <span class="fc" id="L836"> RampartUtil.appendChildToSecHeader(rmd, wsc.getSignatureConfirmationElement());</span> |
| <span class="pc bpc" id="L837" title="1 of 2 branches missed."> if (sigParts != null) {</span> |
| <span class="fc" id="L838"> sigParts.add(new WSEncryptionPart(wsc.getId()));</span> |
| } |
| <span class="fc" id="L840"> }</span> |
| } else { |
| //No Sig value |
| <span class="nc" id="L843"> wsc.prepare(doc);</span> |
| <span class="nc" id="L844"> RampartUtil.appendChildToSecHeader(rmd, wsc.getSignatureConfirmationElement());</span> |
| <span class="nc bnc" id="L845" title="All 2 branches missed."> if(sigParts != null) {</span> |
| <span class="nc" id="L846"> sigParts.add(new WSEncryptionPart(wsc.getId()));</span> |
| } |
| } |
| <span class="fc" id="L849"> }</span> |
| private void checkForX509PkiPath(WSSecSignature sig, Token token){ |
| <span class="pc bpc" id="L851" title="1 of 2 branches missed."> if (token instanceof X509Token) {</span> |
| <span class="fc" id="L852"> X509Token x509Token = (X509Token) token;</span> |
| <span class="pc bpc" id="L853" title="2 of 4 branches missed."> if (x509Token.getTokenVersionAndType().equals(Constants.WSS_X509_PKI_PATH_V1_TOKEN10)</span> |
| || x509Token.getTokenVersionAndType().equals(Constants.WSS_X509_PKI_PATH_V1_TOKEN11)) { |
| <span class="nc" id="L855"> sig.setUseSingleCertificate(false);</span> |
| } |
| } |
| <span class="fc" id="L858"> }</span> |
| |
| |
| } |
| </pre><div class="footer"><span class="right">Created with <a href="http://www.eclemma.org/jacoco">JaCoCo</a> 0.6.1.201212231917</span></div></body></html> |