| /* |
| * Copyright 2003-2004 The Apache Software Foundation. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| */ |
| |
| package org.apache.ws.sandbox.security.conversation; |
| |
| import java.util.HashMap; |
| import java.util.Vector; |
| |
| import javax.crypto.SecretKey; |
| import javax.crypto.spec.SecretKeySpec; |
| import javax.security.auth.callback.Callback; |
| import javax.security.auth.callback.CallbackHandler; |
| import javax.security.auth.callback.UnsupportedCallbackException; |
| import javax.xml.namespace.QName; |
| |
| import org.apache.commons.logging.Log; |
| import org.apache.commons.logging.LogFactory; |
| import org.apache.ws.sandbox.axis.security.conversation.ConvHandlerConstants; |
| import org.apache.ws.security.SOAPConstants; |
| import org.apache.ws.security.WSConstants; |
| import org.apache.ws.security.WSDocInfo; |
| import org.apache.ws.security.WSDocInfoStore; |
| import org.apache.ws.security.WSPasswordCallback; |
| import org.apache.ws.security.WSSConfig; |
| import org.apache.ws.security.WSSecurityEngine; |
| import org.apache.ws.security.WSSecurityException; |
| import org.apache.ws.security.processor.EncryptedKeyProcessor; |
| import org.apache.ws.security.components.crypto.Crypto; |
| import org.apache.ws.security.components.crypto.CryptoFactory; |
| import org.apache.ws.sandbox.security.conversation.message.info.DerivedKeyInfo; |
| import org.apache.ws.sandbox.security.conversation.message.info.SecurityContextInfo; |
| import org.apache.ws.sandbox.security.conversation.message.token.DerivedKeyToken; |
| import org.apache.ws.sandbox.security.conversation.message.token.SecurityContextToken; |
| import org.apache.ws.security.handler.WSHandlerConstants; |
| import org.apache.ws.security.message.EnvelopeIdResolver; |
| import org.apache.ws.security.message.token.Reference; |
| import org.apache.ws.security.message.token.SecurityTokenReference; |
| import org.apache.ws.sandbox.security.trust.TrustConstants; |
| import org.apache.ws.sandbox.security.trust.TrustEngine; |
| import org.apache.ws.sandbox.security.trust.WSTrustException; |
| import org.apache.ws.sandbox.security.trust.message.token.RequestSecurityTokenResponse; |
| import org.apache.ws.sandbox.security.trust.message.token.RequestedProofToken; |
| import org.apache.ws.security.util.WSSecurityUtil; |
| import org.apache.ws.security.util.Loader; |
| import org.apache.xml.security.encryption.XMLCipher; |
| import org.apache.xml.security.encryption.XMLEncryptionException; |
| import org.apache.xml.security.exceptions.XMLSecurityException; |
| import org.apache.xml.security.keys.KeyInfo; |
| import org.apache.xml.security.signature.XMLSignature; |
| import org.apache.xml.security.signature.XMLSignatureException; |
| import org.w3c.dom.Attr; |
| import org.w3c.dom.Document; |
| import org.w3c.dom.Element; |
| import org.w3c.dom.Node; |
| import org.w3c.dom.NodeList; |
| import org.w3c.dom.Text; |
| |
| /** |
| * Conversation Engine follows the basic structure of SecurityEngine<link> |
| * |
| * @author Dimuthu (muthulee@yahoo.com) |
| */ |
| public class ConversationEngine { |
| private static Log log = |
| LogFactory.getLog(ConversationEngine.class.getName()); |
| private static Log tlog = LogFactory.getLog("org.apache.ws.security.TIME"); |
| |
| private boolean doDebug = false; |
| |
| /** |
| * <code>wsc:DerivedKeyToken</code> as defined in WS Secure Conversation specification. |
| */ |
| protected static final QName DERIVEDKEY_TOKEN = |
| new QName( |
| ConversationConstants.WSC_NS, |
| ConversationConstants.DERIVED_KEY_TOKEN_LN); |
| |
| /** |
| * <code>wsc:SecurityContextToken</code> as defined in WS Secure Conversation specification. |
| */ |
| protected static final QName SCT_TOKEN = |
| new QName( |
| ConversationConstants.WSC_NS, |
| ConversationConstants.SECURITY_CONTEXT_TOKEN_LN); |
| /** |
| * Refer WS secure Conversation specification |
| */ |
| protected static final QName REQUESTED_SECURITY_TOKEN_RESPONSE = |
| new QName( |
| TrustConstants.WST_NS, |
| TrustConstants.REQUEST_SECURITY_TOKEN_RESPONSE_LN); |
| /** |
| * <code>ds:Signature</code> as defined by XML Signature specification. |
| */ |
| protected static final QName SIGNATURE = |
| new QName(WSConstants.SIG_NS, WSConstants.SIG_LN); |
| /** |
| * <code>xenc:ReferenceList</code> as defined by XML Encryption specification, |
| */ |
| protected static final QName REFERENCE_LIST = |
| new QName(WSConstants.ENC_NS, WSConstants.REF_LIST_LN); |
| |
| protected static final QName SCT = SecurityContextToken.TOKEN; |
| |
| protected HashMap configurator = new HashMap(); |
| |
| protected String trustPropFile = null; |
| |
| protected boolean verifyTrust = false; |
| |
| protected WSSConfig wssConfig = WSSConfig.getDefaultWSConfig(); |
| |
| static { |
| org.apache.xml.security.Init.init(); |
| } |
| |
| public ConversationEngine(HashMap config) { |
| |
| this.configurator = config; |
| //TODO :: Move this out of here. |
| Boolean bool = null; |
| if ((bool = |
| (Boolean) configurator.get(ConvHandlerConstants.VERIFY_TRUST)) |
| == null) { |
| |
| } else { |
| this.verifyTrust = bool.booleanValue(); |
| if (verifyTrust) { |
| this.trustPropFile = |
| (String) configurator.get( |
| ConvHandlerConstants.TRUST_ENGINE_PROP); |
| } |
| } |
| } |
| |
| /** |
| * This method is extracted from org.apache.ws.security.SecurityEngine |
| * |
| * @param doc |
| * @param actor |
| * @param cb |
| * @return |
| * @throws ConversationException |
| */ |
| |
| public Vector processSecConvHeader( |
| Document doc, |
| String actor, |
| DerivedKeyCallbackHandler dkcb, |
| String callback) |
| throws ConversationException { |
| |
| doDebug = log.isDebugEnabled(); |
| if (doDebug) { |
| log.debug("enter processSecurityHeader()"); |
| } |
| |
| if (actor == null) { |
| actor = ""; |
| } |
| NodeList list = |
| doc.getElementsByTagNameNS( |
| WSConstants.WSSE_NS, |
| WSConstants.WSSE_LN); |
| int len = list.getLength(); |
| if (len == 0) { // No Security headers found |
| return null; |
| } |
| if (doDebug) { |
| log.debug("Found WS-Security header(s): " + len); |
| } |
| Element elem = null; |
| Attr attr = null; |
| String headerActor = null; |
| SOAPConstants sc = |
| WSSecurityUtil.getSOAPConstants(doc.getDocumentElement()); |
| Vector convResult = new Vector(); |
| |
| for (int i = 0; i < len; i++) { |
| elem = (Element) list.item(i); |
| attr = |
| elem.getAttributeNodeNS( |
| sc.getEnvelopeURI(), |
| sc.getRoleAttributeQName().getLocalPart()); |
| if (attr != null) { |
| headerActor = attr.getValue(); |
| } |
| if ((headerActor == null) |
| || (headerActor.length() == 0) |
| || headerActor.equalsIgnoreCase(actor) |
| || headerActor.equals(sc.getNextRoleURI())) { |
| if (doDebug) { |
| log.debug( |
| "Processing WS-Security header for '" |
| + actor |
| + "' actor."); |
| } |
| |
| try { |
| convResult = processConvHeader(elem, doc, dkcb, callback); |
| } catch (WSSecurityException e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| } catch (ConversationException e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| } |
| |
| } |
| } |
| return convResult; |
| } |
| |
| /** |
| * @param doc |
| * @param dkcbHandler |
| * @throws ConversationException |
| */ |
| |
| protected Vector processConvHeader( |
| Element securityHeader, |
| Document doc, |
| DerivedKeyCallbackHandler dkcbHandler, |
| String callback) |
| throws ConversationException, WSSecurityException { |
| |
| long t0 = 0, t1 = 0, t2 = 0; |
| if (tlog.isDebugEnabled()) { |
| t0 = System.currentTimeMillis(); |
| } |
| |
| NodeList list = securityHeader.getChildNodes(); |
| int len = list.getLength(); |
| Node elem; |
| String localName = null; |
| String namespace = null; |
| |
| if (tlog.isDebugEnabled()) { |
| t1 = System.currentTimeMillis(); |
| } |
| |
| Vector returnResults = new Vector(); |
| |
| for (int i = 0; i < len; i++) { |
| elem = list.item(i); |
| if (elem.getNodeType() != Node.ELEMENT_NODE) { |
| continue; |
| } |
| QName el = new QName(elem.getNamespaceURI(), elem.getLocalName()); |
| |
| if (el.equals(REQUESTED_SECURITY_TOKEN_RESPONSE)) { |
| if (doDebug) { |
| log.debug("Found RequestedSecurityTokenResponse element"); |
| } |
| |
| returnResults.add( |
| this.handleRequestedSecurityTokenResponse( |
| (Element) elem, |
| dkcbHandler, |
| callback)); |
| |
| } else if (el.equals(SIGNATURE)) { |
| if (doDebug) { |
| log.debug("Found Signature element"); |
| } |
| |
| ConvEngineResult convResult = |
| this.VerifySignature((Element) elem, dkcbHandler); |
| returnResults.add(convResult); |
| } else if (el.equals(REFERENCE_LIST)) { |
| if (doDebug) { |
| log.debug("Found Reference List element"); |
| |
| } |
| Vector tmpVec = |
| handleReferenceList((Element) elem, dkcbHandler); |
| for (int j = 0; j < tmpVec.size(); j++) { |
| returnResults.add(tmpVec.get(j)); |
| } |
| } else if (el.equals(SCT)) { |
| SecurityContextToken sct = |
| new SecurityContextToken((Element) elem); |
| String uuid = sct.getIdentifier(); |
| ConvEngineResult convResult = |
| new ConvEngineResult(ConvEngineResult.SCT); |
| convResult.setUuid(uuid); |
| returnResults.add(convResult); |
| } |
| |
| } |
| return returnResults; |
| } |
| |
| public ConvEngineResult handleRequestedSecurityTokenResponse( |
| Element eleSTRes, |
| DerivedKeyCallbackHandler dkcbHandler, |
| String callback) |
| throws ConversationException { |
| String uuid = null; |
| RequestSecurityTokenResponse stRes = null; |
| |
| try { |
| if (verifyTrust) { |
| TrustEngine trstEngine = new TrustEngine(this.trustPropFile); |
| |
| // TODO :: Verify trust...... |
| System.out.println("...........Verifying trust........."); |
| |
| } |
| |
| //Now trust is verified. |
| |
| stRes = new RequestSecurityTokenResponse(eleSTRes, true); |
| SecurityContextToken SCT = |
| stRes.getRequestedSecurityToken().getSct(); |
| uuid = SCT.getIdentifier(); |
| RequestedProofToken proofToken = stRes.getRequestedProofToken(); |
| //TODO:: romove the hard coded decryption |
| |
| proofToken.doDecryption(callback, this.loadDecryptionCrypto()); |
| |
| SecurityContextInfo scInfo = null; |
| scInfo = new SecurityContextInfo(SCT, proofToken, 1); |
| |
| dkcbHandler.addSecurtiyContext(uuid, scInfo); |
| dkcbHandler.setDerivedKeyLength( |
| uuid, |
| ((Long) configurator.get(ConvHandlerConstants.KEY_LEGNTH)) |
| .longValue()); |
| |
| log.debug(" Done SecurityToekenResponse Handled"); |
| ConvEngineResult res = |
| new ConvEngineResult(ConvEngineResult.SECURITY_TOKEN_RESPONSE); |
| res.setUuid(uuid); |
| return res; |
| |
| } catch (WSTrustException e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| throw new ConversationException(""); |
| } catch (WSSecurityException e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| throw new ConversationException(""); |
| } |
| } |
| |
| private ConvEngineResult VerifySignature( |
| Element elem, |
| DerivedKeyCallbackHandler dkcbHandler) |
| throws ConversationException { |
| ConvEngineResult convResult = null; |
| XMLSignature sig = null; |
| // System.out.println("******** at VerifySignature"); |
| // ByteArrayOutputStream os = new ByteArrayOutputStream(); |
| // XMLUtils.outputDOM(elem, os, true); |
| // String osStr = os.toString(); |
| // System.out.println(osStr); |
| try { |
| sig = new XMLSignature(elem, null); |
| } catch (XMLSignatureException e2) { |
| throw new ConversationException("noXMLSig"); |
| } catch (XMLSecurityException e2) { |
| throw new ConversationException("noXMLSig"); |
| } |
| String sigMethodURI = sig.getSignedInfo().getSignatureMethodURI(); |
| //verifying the sinature |
| if (sigMethodURI.equals(XMLSignature.ALGO_ID_MAC_HMAC_SHA1)) { |
| |
| try { |
| //sign.verifiyXMLHMac_SHA1_Signarue(sig, dkcbHandler); |
| convResult = |
| this.verifiyXMLHMac_SHA1_Signarue(sig, dkcbHandler); |
| } catch (WSSecurityException e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| } |
| |
| } else { |
| throw new ConversationException("Failed"); |
| } |
| return convResult; |
| } |
| |
| /** |
| * This method is extracted from WSSecurityEngine. |
| * <p/> |
| * Dereferences and decodes encrypted data elements. |
| */ |
| private Vector handleReferenceList( |
| Element elem, |
| DerivedKeyCallbackHandler dkcbHandler) |
| throws WSSecurityException { |
| Vector results = new Vector(); |
| Document doc = elem.getOwnerDocument(); |
| Node tmpE = null; |
| for (tmpE = elem.getFirstChild(); |
| tmpE != null; |
| tmpE = tmpE.getNextSibling()) { |
| if (tmpE.getNodeType() != Node.ELEMENT_NODE) { |
| continue; |
| } |
| if (!tmpE.getNamespaceURI().equals(WSConstants.ENC_NS)) { |
| continue; |
| } |
| if (tmpE.getLocalName().equals("DataReference")) { |
| String dataRefURI = ((Element) tmpE).getAttribute("URI"); |
| ConvEngineResult convRes = |
| decryptDataRef(doc, dataRefURI, dkcbHandler); |
| results.add((Object) convRes); |
| } else if (tmpE.getLocalName().equals("KeyReference")) { |
| String keyRefURI = ((Element) tmpE).getAttribute("URI"); |
| } |
| } |
| return results; |
| } |
| |
| private ConvEngineResult decryptDataRef( |
| Document doc, |
| String dataRefURI, |
| DerivedKeyCallbackHandler dkcbHandler) |
| throws WSSecurityException { |
| |
| log.debug("ConversationEngine :: Found data refernce: " + dataRefURI); |
| |
| ConvEngineResult convResult = null; |
| /* |
| * Look up the encrypted data. First try wsu:Id="someURI". If no such Id then |
| * try the generic lookup to find Id="someURI" |
| */ |
| Element encBodyData = null; |
| if ((encBodyData = |
| WSSecurityUtil.getElementByWsuId( |
| doc, |
| dataRefURI)) |
| == null) { |
| encBodyData = WSSecurityUtil.getElementByGenId(doc, dataRefURI); |
| } |
| if (encBodyData == null) { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY, |
| "dataRef", |
| new Object[] { dataRefURI }); |
| } |
| |
| Element tmpE = null; |
| log.debug( |
| "ConversationEngine :: Going to figure out the key to decrypt"); |
| byte[] decryptedBytes = null; |
| |
| /* |
| * Decryption is performed in 3 major steps |
| */ |
| |
| //Step 1 : Get the key from SecurityTokenReference. |
| |
| log.debug( |
| "ConversationEngine:: Going to look for SecurityTokenReference"); |
| |
| if ((tmpE = |
| (Element) WSSecurityUtil.findElement( |
| (Node) encBodyData, |
| "SecurityTokenReference", |
| WSConstants.WSSE_NS)) |
| != null) { |
| SecurityTokenReference secRef = |
| new SecurityTokenReference( |
| tmpE); |
| |
| try { |
| convResult = |
| this.handleSecurityTokenReference(secRef, dkcbHandler); |
| decryptedBytes = convResult.getKeyAssociated(); |
| } catch (ConversationException e2) { |
| // TODO Auto-generated catch block |
| e2.printStackTrace(); |
| } |
| |
| } else { |
| //TODO:: Provide more info |
| throw new WSSecurityException(WSSecurityException.FAILURE); |
| } |
| |
| // Step 2 :: Now figure out the encryption algorithm |
| String symEncAlgo = getEncAlgo(encBodyData); |
| SecretKey symmetricKey = |
| WSSecurityUtil.prepareSecretKey(symEncAlgo, decryptedBytes); |
| |
| |
| // Step 3 :: initialize Cipher .... |
| XMLCipher xmlCipher = null; |
| try { |
| xmlCipher = XMLCipher.getInstance(symEncAlgo); |
| xmlCipher.init(XMLCipher.DECRYPT_MODE, symmetricKey); |
| } catch (XMLEncryptionException e1) { |
| throw new WSSecurityException( |
| WSSecurityException.UNSUPPORTED_ALGORITHM, |
| null, |
| null, |
| e1); |
| } |
| |
| |
| |
| WSSecurityEngine eng = new WSSecurityEngine(); |
| boolean content = this.isContent(encBodyData);//Whether content encryption or element encryption |
| |
| if (content) { |
| encBodyData = (Element) encBodyData.getParentNode(); |
| }else{ |
| System.out.println("Not content:-)"); |
| } |
| |
| try { |
| xmlCipher.doFinal(doc, encBodyData, content); |
| } catch (Exception e) { |
| throw new WSSecurityException( |
| WSSecurityException.FAILED_ENC_DEC, |
| null, |
| null, |
| e); |
| } |
| return convResult; |
| } |
| |
| public ConvEngineResult handleSecurityTokenReference( |
| SecurityTokenReference secRef2DkToken, |
| DerivedKeyCallbackHandler dkcbHandler) |
| throws ConversationException { |
| |
| if (secRef2DkToken.containsReference()) { |
| Reference ref = null; |
| try { |
| ref = secRef2DkToken.getReference(); |
| } catch (WSSecurityException e1) { |
| e1.printStackTrace(); |
| throw new ConversationException(e1.getMessage()); |
| } |
| |
| String valueType = ref.getValueType(); |
| // System.out.println("ref.getURI()" + ref.getURI()); |
| |
| //If the reference type is a derived key token |
| if (valueType.equals(ConversationConstants.TOKEN_TYPE_DERIVED_KEY_TOKEN)) { |
| //Get hold of the DerivedKeyToken 'Element' |
| Element ele = |
| WSSecurityUtil.getElementByWsuId( |
| secRef2DkToken.getElement().getOwnerDocument(), |
| ref.getURI()); |
| if (ele == null) { |
| throw new ConversationException("Cannot find referenced Derived Key"); |
| } |
| String uuid = null; |
| DerivedKeyToken dkToken = null; |
| try { |
| dkToken = new DerivedKeyToken(ele); //Cover the 'Element' into 'DerivedKeyToken' object |
| if (dkToken.getSecuityTokenReference() == null) { |
| //if dkToken doesn't have a STR find a SecurityContextToken in the SOAP Envelope |
| SecurityContextToken secContextTk = |
| ConversationUtil.getSCT(dkToken); |
| uuid = secContextTk.getIdentifier(); |
| log.debug( |
| "ConversationEngine :: The uuid is found " + uuid); |
| DerivedKeyInfo dkInfo = new DerivedKeyInfo(dkToken); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| } else { ///i.e. dkToken has a STR |
| SecurityTokenReference str2Base = |
| dkToken.getSecuityTokenReference(); |
| if (str2Base.containsReference()) { |
| Reference ref2Base = str2Base.getReference(); |
| |
| if (ref2Base |
| .getValueType() |
| .equals("http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID")) { |
| /* ok now I have a SAML token. What should I do ? |
| * -Decrypt the secret. |
| * -create tempUUID |
| * -add the scTInfo into dkcbHandler |
| * -add the derived key token to dkcbHandler. |
| */ |
| uuid = ref2Base.getURI(); |
| if(dkcbHandler.getSession(uuid)==null){ |
| byte[] key = handleSAML(ref2Base.getElement().getOwnerDocument(), uuid); |
| System.out.println("I am here :-)"); |
| SecurityContextInfo sctInfo = new SecurityContextInfo( |
| uuid, |
| key, |
| 1); |
| dkcbHandler.addSecurtiyContext( |
| uuid, |
| sctInfo); |
| } |
| DerivedKeyInfo dkInfo = new DerivedKeyInfo(dkToken); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| } |
| |
| |
| |
| //TODO :: Add other tokens else if |
| } else if(str2Base.containsKeyIdentifier()){ |
| Element elem = str2Base.getFirstElement(); |
| //.getKeyIdentifier()System.out.println("KeyIdentifier :: He ehee ........"); |
| String value = elem.getAttribute("ValueType"); |
| if("http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID".equals(value)){ |
| uuid = ((Text)elem.getChildNodes().item(0)).getNodeValue(); |
| if(dkcbHandler.getSession(uuid)==null){ |
| byte[] key = handleSAML(elem.getOwnerDocument(), uuid); |
| System.out.println("UUID of SAML is"+uuid); |
| SecurityContextInfo sctInfo = new SecurityContextInfo( |
| uuid, |
| key, |
| 1); |
| dkcbHandler.addSecurtiyContext(uuid,sctInfo); |
| } |
| DerivedKeyInfo dkInfo = new DerivedKeyInfo(dkToken); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| } |
| |
| }else{ |
| throw new ConversationException("Cannot handle this type of security token reference: " + dkToken.getSecuityTokenReference().getReference().getValueType()); |
| } |
| } //////end :if dkToken has a STR |
| //TODO :: Ask ruchith to throw correct exception |
| } catch (WSSecurityException e2) { |
| e2.printStackTrace(); |
| } catch (ConversationException e2) { |
| e2.printStackTrace(); |
| } |
| |
| String identifier = |
| ConversationUtil.generateIdentifier(uuid, dkToken.getID()); |
| WSPasswordCallback pwCb = |
| new WSPasswordCallback( |
| identifier, |
| WSPasswordCallback.UNKNOWN); |
| Callback[] callbacks = new Callback[1]; |
| callbacks[0] = pwCb; |
| try { |
| dkcbHandler.handle(callbacks); |
| } catch (Exception e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| } |
| byte[] arr = pwCb.getKey(); |
| ConvEngineResult res = |
| new ConvEngineResult(ConvEngineResult.ENCRYPT_DERIVED_KEY); |
| res.setKeyAssociated(arr); |
| return res; |
| } else { |
| throw new ConversationException("ConversationEngine :: SecurityTokenRerence doesn't contain DerivedKeys"); |
| } |
| } else { |
| throw new ConversationException("ConversationEngine ::SecurityTokenRerence doesn't contain refernce"); |
| } |
| |
| } |
| |
| /** |
| * @param sig - XML Signature obeject containing the XMLSignature element. |
| * @param cb - Callback handler to get the symmetric key. |
| * @return |
| */ |
| private ConvEngineResult verifiyXMLHMac_SHA1_Signarue( |
| XMLSignature sig, |
| DerivedKeyCallbackHandler dkcbHandler) |
| throws WSSecurityException { |
| |
| log.debug("Verifying HMAC-SHA1 Signature......"); |
| |
| String userName = null; |
| long t0 = 0, t1 = 0, t2 = 0; |
| if (tlog.isDebugEnabled()) { |
| t0 = System.currentTimeMillis(); |
| } |
| ConvEngineResult convResult = null; |
| if (sig == null) { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY_TOKEN, |
| "XMLSignature object is null"); |
| } /* Following lines of code - upto WSDocInfoStore.lookup(docHash) is copied |
| * from the verifyXMLSignature() method. |
| * |
| */ |
| |
| sig.addResourceResolver( |
| EnvelopeIdResolver.getInstance()); |
| KeyInfo info = sig.getKeyInfo(); |
| if (info == null) { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY, |
| "unsupportedKeyInfo"); |
| } |
| Node node = |
| WSSecurityUtil.getDirectChild( |
| info.getElement(), |
| SecurityTokenReference.SECURITY_TOKEN_REFERENCE, |
| WSConstants.WSSE_NS); |
| if (node == null) { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY, |
| "unsupportedKeyInfo"); |
| } |
| SecurityTokenReference secRef = |
| new SecurityTokenReference( |
| (Element) node); |
| Document docSig = sig.getDocument(); |
| int docHash = docSig.hashCode(); |
| if (doDebug) { |
| log.debug("XML Verify doc: " + docHash); |
| } /* |
| * Her we get some information about the document that is being processed, |
| * in partucular the crypto implementation, and already detected BST that |
| * may be used later during dereferencing. |
| */ |
| WSDocInfo wsDocInfo = WSDocInfoStore.lookup(docHash); |
| if (secRef.containsReference()) { |
| Element token = |
| secRef.getTokenElement(sig.getDocument(), wsDocInfo); |
| /* check token type: We support Derivedkey tokens now. |
| * We will support security context tokens. |
| */ |
| QName el = new QName(token.getNamespaceURI(), token.getLocalName()); |
| if (el.equals(DERIVEDKEY_TOKEN)) { |
| DerivedKeyToken dkToken = new DerivedKeyToken(token); |
| DerivedKeyInfo dkInfo = null; |
| |
| String uuid = null; |
| |
| try { |
| if (dkToken.getSecuityTokenReference() == null) { |
| //if dkToken doesn't have a STR |
| SecurityContextToken secContextTk = |
| ConversationUtil.getSCT(dkToken); |
| uuid = secContextTk.getIdentifier(); |
| log.debug( |
| "ConversationEngine :: The uuid is found " + uuid); |
| dkInfo = new DerivedKeyInfo(dkToken); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| } else { ///i.e. dkToken has a STR |
| SecurityTokenReference str2Base = |
| dkToken.getSecuityTokenReference(); |
| if (str2Base.containsReference()) { |
| Reference ref2Base = str2Base.getReference(); |
| //TODO:: Find where can I find the constants. |
| if (ref2Base |
| .getValueType() |
| .equals("http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID")) { |
| /* ok now I have a SAML token. What should I do ? |
| * -Decrypt the secret. |
| * -create tempUUID |
| * -add the scTInfo into dkcbHandler |
| * -add the derived key token to dkcbHandler. |
| */ |
| uuid = ref2Base.getURI(); |
| if(dkcbHandler.getSession(uuid)==null){ |
| byte[] key = handleSAML(docSig, uuid); |
| System.out.println("I am here :-)"); |
| SecurityContextInfo sctInfo = |
| new SecurityContextInfo( |
| uuid, |
| key, |
| 1); |
| dkcbHandler.addSecurtiyContext( |
| uuid, |
| sctInfo); |
| } |
| dkInfo = new DerivedKeyInfo(dkToken); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| } |
| } else if(str2Base.containsKeyIdentifier()){ |
| Element elem = str2Base.getFirstElement(); |
| //.getKeyIdentifier()System.out.println("KeyIdentifier :: He ehee ........"); |
| String value = elem.getAttribute("ValueType"); |
| if("http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID".equals(value)){ |
| uuid = ((Text)elem.getChildNodes().item(0)).getNodeValue(); |
| if(dkcbHandler.getSession(uuid)==null){ |
| byte[] key = handleSAML(elem.getOwnerDocument(), uuid); |
| System.out.println("UUID of SAML is"+uuid); |
| SecurityContextInfo sctInfo = new SecurityContextInfo(uuid,key,1); |
| dkcbHandler.addSecurtiyContext(uuid,sctInfo); |
| } |
| dkInfo = new DerivedKeyInfo(dkToken); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| } |
| |
| } else { |
| throw new ConversationException("Don't know how to process here"); |
| } |
| |
| } |
| //String uuid = "aNewUuid"; |
| String dkId = dkToken.getID(); |
| userName = ConversationUtil.generateIdentifier(uuid, dkId); |
| convResult = |
| new ConvEngineResult(ConvEngineResult.SIGN_DERIVED_KEY); |
| dkcbHandler.addDerivedKey(uuid, dkInfo); |
| log.debug( |
| "ConversationEngine: added for signature varification. uuil:" |
| + uuid |
| + " id:" |
| + dkId); |
| } catch (ConversationException e) { |
| // TODO Auto-generated catch block |
| e.printStackTrace(); |
| //TODO :: Ask ruchith to throw correct exception |
| } catch (WSSecurityException e2) { |
| // TODO Auto-generated catch block |
| e2.printStackTrace(); |
| } |
| |
| |
| } else if (el.equals(SCT_TOKEN)) { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY, |
| "SCT is not Yet supported", |
| new Object[] { el.toString()}); |
| } else { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY, |
| "unsupportedToken", |
| new Object[] { el.toString()}); |
| } |
| |
| if (tlog.isDebugEnabled()) { |
| t1 = System.currentTimeMillis(); |
| } |
| |
| try { |
| // get the key from the callback handler |
| WSPasswordCallback callbacks[] = |
| { |
| new WSPasswordCallback( |
| userName, |
| WSPasswordCallback.UNKNOWN)}; |
| try { |
| dkcbHandler.handle(callbacks); |
| } catch (UnsupportedCallbackException e) { |
| e.printStackTrace(); |
| throw new WSSecurityException( |
| WSSecurityException.FAILED_SIGNATURE, |
| "password call back failed", |
| new Object[] { e.toString()}); |
| } // get the key and check whether it is null |
| byte[] keyBytes = callbacks[0].getKey(); |
| if (keyBytes == null) { |
| throw new WSSecurityException( |
| WSSecurityException.INVALID_SECURITY, |
| "password call bac in DerivedKeyTokenHandler failed"); |
| } |
| |
| convResult.setKeyAssociated(keyBytes); |
| //System.out.println(new String(keyBytes)); |
| SecretKey symetricKey = |
| new SecretKeySpec( |
| keyBytes, |
| XMLSignature.ALGO_ID_MAC_HMAC_SHA1); |
| if (sig.checkSignatureValue(symetricKey)) { |
| if (tlog.isDebugEnabled()) { |
| t2 = System.currentTimeMillis(); |
| tlog.debug( |
| "Verify: total= " |
| + (t2 - t0) |
| + ", Find-the token refernced by wsse:Reference= " |
| + (t1 - t0) |
| + ", password call back & verify= " |
| + (t2 - t1)); |
| } |
| |
| } else { |
| throw new WSSecurityException( |
| WSSecurityException.FAILED_CHECK); |
| } |
| } catch (XMLSignatureException e1) { |
| throw new WSSecurityException(WSSecurityException.FAILED_CHECK); |
| } |
| |
| } |
| |
| return convResult; |
| } |
| |
| /** |
| * Extracted from WSSecurityEngine. |
| * |
| * @param encBodyData |
| * @return |
| * @throws WSSecurityException |
| */ |
| private String getEncAlgo(Node encBodyData) throws WSSecurityException { |
| Element tmpE = |
| (Element) WSSecurityUtil.findElement( |
| encBodyData, |
| "EncryptionMethod", |
| WSConstants.ENC_NS); |
| String symEncAlgo = null; |
| if (tmpE != null) { |
| symEncAlgo = tmpE.getAttribute("Algorithm"); |
| } |
| if (symEncAlgo == null) { |
| throw new WSSecurityException( |
| WSSecurityException.UNSUPPORTED_ALGORITHM, |
| "noEncAlgo"); |
| } |
| if (doDebug) { |
| log.debug("Sym Enc Algo: " + symEncAlgo); |
| } |
| return symEncAlgo; |
| } //TODO :: Remove this. Temporary method. |
| |
| |
| private Crypto loadDecryptionCrypto() { |
| Crypto crypto = null; |
| String encPropFile = (String)configurator.get(WSHandlerConstants.DEC_PROP_FILE); |
| crypto = CryptoFactory.getInstance(encPropFile); |
| return crypto; |
| } |
| |
| /** |
| * This method will be scrapped after the re-architecture. |
| * Not so elegant work-around. |
| * |
| */ |
| private byte[] handleSAML(Document doc, String assertionId) throws ConversationException{ |
| |
| try { |
| Crypto crypto = this.loadDecryptionCrypto(); |
| //get the security header block |
| //get the saml assertion |
| |
| Element ele=WSSecurityUtil.findWsseSecurityHeaderBlock(doc, doc.getDocumentElement(), false); |
| Element samEle =(Element)WSSecurityUtil.getDirectChild(ele, "Assertion", "urn:oasis:names:tc:SAML:1.0:assertion" ); |
| // SAMLAssertion assertion = new SAMLAssertion(samEle); |
| // |
| // Iterator itr = assertion.getStatements(); |
| // |
| // SAMLAuthenticationStatement auth = (SAMLAuthenticationStatement)itr.next(); |
| // Element eleEnc = auth.getSubject().getConfirmationData(); |
| // |
| |
| Element eleEnc = (Element)samEle.getElementsByTagNameNS("http://www.w3.org/2001/04/xmlenc#","EncryptedKey").item(0); |
| String cb = (String)this.configurator.get(WSHandlerConstants.PW_CALLBACK_CLASS); |
| |
| CallbackHandler cbHandler = null; |
| if (cb != null) { |
| Class cbClass = null; |
| try { |
| cbClass = Loader.loadClass(cb); |
| cbHandler = (CallbackHandler) cbClass.newInstance(); |
| |
| } catch (ClassNotFoundException e) { |
| throw new ConversationException("Cannot find passwordcallback"); |
| } catch (InstantiationException e2) { |
| // TODO Auto-generated catch block |
| e2.printStackTrace(); |
| } catch (IllegalAccessException e2) { |
| // TODO Auto-generated catch block |
| e2.printStackTrace(); |
| } |
| |
| }else{ |
| throw new ConversationException("Cannot find passwordcallback"); |
| } |
| |
| EncryptedKeyProcessor processor = new EncryptedKeyProcessor(); |
| processor.handleEncryptedKey(eleEnc, cbHandler, crypto); |
| byte[] key = processor.getDecryptedBytes(); |
| |
| return key; |
| |
| }catch (WSSecurityException e1) { |
| // TODO Auto-generated catch block |
| e1.printStackTrace(); |
| throw new ConversationException("Cannot find passwordcallback"); |
| } |
| |
| } |
| /** |
| * |
| * Taken from WSSecurityEngine |
| * |
| * @param encBodyData |
| * @return |
| */ |
| private boolean isContent(Node encBodyData) { |
| /* |
| * Depending on the encrypted data type (Content or Element) the encBodyData either |
| * holds the element whose contents where encrypted, e.g. soapenv:Body, or the |
| * xenc:EncryptedData element (in case of Element encryption). In either case we need |
| * to get the xenc:EncryptedData element. So get it. The findElement method returns |
| * immediatly if its already the correct element. |
| * Then we can get the Type attribute. |
| */ |
| |
| Element tmpE = (Element) WSSecurityUtil.findElement(encBodyData, |
| "EncryptedData", WSConstants.ENC_NS); |
| String typeStr = null; |
| boolean content = true; |
| if (tmpE != null) { |
| typeStr = tmpE.getAttribute("Type"); |
| } |
| if (typeStr != null) { |
| content = typeStr.equals(WSConstants.ENC_NS + "Content") ? true : false; |
| } |
| return content; |
| } |
| |
| } |
