| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| package org.apache.wss4j.stax.impl.processor.output; |
| |
| import org.apache.wss4j.common.ext.WSPasswordCallback; |
| import org.apache.wss4j.common.ext.WSSecurityException; |
| import org.apache.wss4j.common.util.DateUtil; |
| import org.apache.wss4j.common.util.UsernameTokenUtil; |
| import org.apache.wss4j.stax.ext.WSSConstants; |
| import org.apache.wss4j.stax.ext.WSSSecurityProperties; |
| import org.apache.wss4j.stax.impl.securityToken.OutboundUsernameSecurityToken; |
| import org.apache.wss4j.stax.utils.WSSUtils; |
| import org.apache.xml.security.exceptions.XMLSecurityException; |
| import org.apache.xml.security.stax.ext.*; |
| import org.apache.xml.security.stax.ext.stax.XMLSecAttribute; |
| import org.apache.xml.security.stax.ext.stax.XMLSecEvent; |
| import org.apache.xml.security.stax.impl.util.IDGenerator; |
| import org.apache.xml.security.stax.securityToken.OutboundSecurityToken; |
| import org.apache.xml.security.stax.securityToken.SecurityTokenProvider; |
| import org.apache.xml.security.utils.XMLUtils; |
| |
| import javax.security.auth.callback.CallbackHandler; |
| import javax.xml.namespace.QName; |
| import javax.xml.stream.XMLStreamException; |
| |
| import java.time.Instant; |
| import java.time.ZoneOffset; |
| import java.util.ArrayList; |
| import java.util.List; |
| |
| public class UsernameTokenOutputProcessor extends AbstractOutputProcessor { |
| |
| public UsernameTokenOutputProcessor() throws XMLSecurityException { |
| super(); |
| addAfterProcessor(TimestampOutputProcessor.class.getName()); |
| addBeforeProcessor(WSSSignatureOutputProcessor.class.getName()); |
| addBeforeProcessor(EncryptOutputProcessor.class.getName()); |
| } |
| |
| @Override |
| public void processEvent(XMLSecEvent xmlSecEvent, OutputProcessorChain outputProcessorChain) |
| throws XMLStreamException, XMLSecurityException { |
| |
| try { |
| CallbackHandler callbackHandler = ((WSSSecurityProperties)getSecurityProperties()).getCallbackHandler(); |
| WSSConstants.UsernameTokenPasswordType usernameTokenPasswordType = |
| ((WSSSecurityProperties) getSecurityProperties()).getUsernameTokenPasswordType(); |
| |
| if (callbackHandler == null |
| && WSSConstants.UsernameTokenPasswordType.PASSWORD_NONE != usernameTokenPasswordType) { |
| throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "noCallback"); |
| } |
| |
| String password = null; |
| if (callbackHandler != null) { |
| WSPasswordCallback pwCb = |
| new WSPasswordCallback(((WSSSecurityProperties) getSecurityProperties()).getTokenUser(), |
| WSPasswordCallback.USERNAME_TOKEN); |
| WSSUtils.doPasswordCallback(callbackHandler, pwCb); |
| password = pwCb.getPassword(); |
| } |
| |
| if (password == null && WSSConstants.UsernameTokenPasswordType.PASSWORD_NONE != usernameTokenPasswordType) { |
| final Object[] args = {((WSSSecurityProperties) getSecurityProperties()).getTokenUser() }; |
| throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "noPassword", args); |
| } |
| |
| final String wsuId = IDGenerator.generateID(null); |
| |
| boolean useDerivedKeyForMAC = |
| ((WSSSecurityProperties)getSecurityProperties()).isUseDerivedKeyForMAC(); |
| int derivedIterations = |
| ((WSSSecurityProperties)getSecurityProperties()).getDerivedKeyIterations(); |
| byte[] salt = null; |
| if (WSSConstants.USERNAMETOKEN_SIGNED.equals(getAction())) { |
| salt = UsernameTokenUtil.generateSalt(useDerivedKeyForMAC); |
| } |
| |
| byte[] nonceValue = null; |
| if (usernameTokenPasswordType == WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST |
| || ((WSSSecurityProperties) getSecurityProperties()).isAddUsernameTokenNonce()) { |
| nonceValue = WSSConstants.generateBytes(16); |
| } |
| |
| String createdStr = ""; |
| if (usernameTokenPasswordType == WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST |
| || ((WSSSecurityProperties) getSecurityProperties()).isAddUsernameTokenCreated()) { |
| Instant created = Instant.now(); |
| createdStr = created.atZone(ZoneOffset.UTC).format(DateUtil.getDateTimeFormatter(true)); |
| } |
| |
| final OutputProcessor outputProcessor = this; |
| |
| final OutboundUsernameSecurityToken usernameSecurityToken = |
| new OutboundUsernameSecurityToken(((WSSSecurityProperties) getSecurityProperties()).getTokenUser(), |
| password, |
| createdStr, |
| nonceValue, |
| wsuId, |
| salt, |
| derivedIterations |
| ); |
| usernameSecurityToken.setProcessor(outputProcessor); |
| |
| SecurityTokenProvider<OutboundSecurityToken> securityTokenProvider = |
| new SecurityTokenProvider<OutboundSecurityToken>() { |
| |
| @Override |
| public OutboundSecurityToken getSecurityToken() throws WSSecurityException { |
| return usernameSecurityToken; |
| } |
| |
| @Override |
| public String getId() { |
| return wsuId; |
| } |
| }; |
| if (WSSConstants.USERNAMETOKEN_SIGNED.equals(getAction())) { |
| outputProcessorChain.getSecurityContext().registerSecurityTokenProvider(wsuId, securityTokenProvider); |
| outputProcessorChain.getSecurityContext().put(WSSConstants.PROP_USE_THIS_TOKEN_ID_FOR_SIGNATURE, wsuId); |
| } |
| final FinalUsernameTokenOutputProcessor finalUsernameTokenOutputProcessor = |
| new FinalUsernameTokenOutputProcessor(wsuId, nonceValue, password, createdStr, salt, derivedIterations, getAction()); |
| finalUsernameTokenOutputProcessor.setXMLSecurityProperties(getSecurityProperties()); |
| finalUsernameTokenOutputProcessor.setAction(getAction()); |
| finalUsernameTokenOutputProcessor.init(outputProcessorChain); |
| |
| } finally { |
| outputProcessorChain.removeProcessor(this); |
| } |
| outputProcessorChain.processEvent(xmlSecEvent); |
| } |
| |
| static class FinalUsernameTokenOutputProcessor extends AbstractOutputProcessor { |
| |
| private String wsuId; |
| private byte[] nonceValue; |
| private String password; |
| private String created; |
| private byte[] salt; |
| private int iterations; |
| private XMLSecurityConstants.Action action; |
| |
| FinalUsernameTokenOutputProcessor(String wsuId, byte[] nonceValue, String password, |
| String created, byte[] salt, |
| int iterations, XMLSecurityConstants.Action action) |
| throws XMLSecurityException { |
| super(); |
| this.addAfterProcessor(UsernameTokenOutputProcessor.class.getName()); |
| this.addAfterProcessor(UsernameTokenOutputProcessor.class.getName()); |
| this.wsuId = wsuId; |
| this.nonceValue = nonceValue; |
| this.password = password; |
| this.created = created; |
| this.salt = salt; |
| this.iterations = iterations; |
| this.action = action; |
| } |
| |
| @Override |
| public void processEvent(XMLSecEvent xmlSecEvent, OutputProcessorChain outputProcessorChain) |
| throws XMLStreamException, XMLSecurityException { |
| |
| outputProcessorChain.processEvent(xmlSecEvent); |
| |
| if (WSSUtils.isSecurityHeaderElement(xmlSecEvent, ((WSSSecurityProperties) getSecurityProperties()).getActor())) { |
| |
| final QName headerElementName = WSSConstants.TAG_WSSE_USERNAME_TOKEN; |
| OutputProcessorUtils.updateSecurityHeaderOrder(outputProcessorChain, headerElementName, getAction(), false); |
| |
| OutputProcessorChain subOutputProcessorChain = outputProcessorChain.createSubChain(this); |
| |
| List<XMLSecAttribute> attributes = new ArrayList<>(1); |
| attributes.add(createAttribute(WSSConstants.ATT_WSU_ID, this.wsuId)); |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, headerElementName, false, attributes); |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE_USERNAME, false, null); |
| createCharactersAndOutputAsEvent(subOutputProcessorChain, |
| ((WSSSecurityProperties) getSecurityProperties()).getTokenUser()); |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE_USERNAME); |
| if (((WSSSecurityProperties) getSecurityProperties()).getUsernameTokenPasswordType() |
| != WSSConstants.UsernameTokenPasswordType.PASSWORD_NONE && !WSSConstants.USERNAMETOKEN_SIGNED.equals(action)) { |
| attributes = new ArrayList<>(1); |
| attributes.add(createAttribute(WSSConstants.ATT_NULL_Type, |
| ((WSSSecurityProperties) getSecurityProperties()).getUsernameTokenPasswordType() |
| == WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST |
| ? WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST.getNamespace() |
| : WSSConstants.UsernameTokenPasswordType.PASSWORD_TEXT.getNamespace())); |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE_PASSWORD, false, attributes); |
| createCharactersAndOutputAsEvent(subOutputProcessorChain, |
| ((WSSSecurityProperties) getSecurityProperties()).getUsernameTokenPasswordType() |
| == WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST |
| ? UsernameTokenUtil.doPasswordDigest(this.nonceValue, created, this.password) |
| : this.password); |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE_PASSWORD); |
| } |
| |
| if (salt != null) { |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE11_SALT, true, null); |
| createCharactersAndOutputAsEvent(subOutputProcessorChain, XMLUtils.encodeToString(this.salt)); |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE11_SALT); |
| |
| if (iterations > 0) { |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE11_ITERATION, true, null); |
| createCharactersAndOutputAsEvent(subOutputProcessorChain, "" + iterations); |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE11_ITERATION); |
| } |
| } |
| |
| if (nonceValue != null && !WSSConstants.USERNAMETOKEN_SIGNED.equals(action)) { |
| attributes = new ArrayList<>(1); |
| attributes.add(createAttribute(WSSConstants.ATT_NULL_ENCODING_TYPE, WSSConstants.SOAPMESSAGE_NS10_BASE64_ENCODING)); |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE_NONCE, false, attributes); |
| createCharactersAndOutputAsEvent(subOutputProcessorChain, |
| XMLUtils.encodeToString(this.nonceValue)); |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSSE_NONCE); |
| } |
| |
| if (!"".equals(created)) { |
| createStartElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSU_CREATED, false, null); |
| createCharactersAndOutputAsEvent(subOutputProcessorChain, created); |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, WSSConstants.TAG_WSU_CREATED); |
| } |
| |
| createEndElementAndOutputAsEvent(subOutputProcessorChain, headerElementName); |
| |
| outputProcessorChain.removeProcessor(this); |
| } |
| } |
| } |
| } |
