Author: coheigea
Date: Tue Feb 11 11:47:52 2014
New Revision: 1567068
URL: http://svn.apache.org/r1567068
Log:
Added support for DOM Encryption Derived + tests
Added:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/EncryptionDerivedAction.java
- copied, changed from r1566679,
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSConstants.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSSConfig.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/WSHandler.java
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/DerivedKeyActionTest.java
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSConstants.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSConstants.java?rev=1567068&r1=1567067&r2=1567068&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSConstants.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSConstants.java
Tue Feb 11 11:47:52 2014
@@ -492,6 +492,7 @@ public final class WSConstants {
public static final int UT_NOPASSWORD = 0x2000; // perform UsernameToken
public static final int CUSTOM_TOKEN = 0x4000; // perform a Custom Token
action
public static final int DKT_SIGN = 0x8000; // Perform Signature with a
Derived Key
+ public static final int DKT_ENCR = 0x10000; // Perform Encryption with a
Derived Key
private WSConstants() {
// Complete
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSSConfig.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSSConfig.java?rev=1567068&r1=1567067&r2=1567068&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSSConfig.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/WSSConfig.java
Tue Feb 11 11:47:52 2014
@@ -92,6 +92,10 @@ public class WSSConfig {
org.apache.wss4j.dom.action.SignatureDerivedAction.class
);
tmp.put(
+ WSConstants.DKT_ENCR,
+ org.apache.wss4j.dom.action.EncryptionDerivedAction.class
+ );
+ tmp.put(
WSConstants.ST_SIGNED,
org.apache.wss4j.dom.action.SAMLTokenSignedAction.class
);
Copied:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/EncryptionDerivedAction.java
(from r1566679,
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java)
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/EncryptionDerivedAction.java?p2=webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/EncryptionDerivedAction.java&p1=webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java&r1=1566679&r2=1567068&rev=1567068&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/EncryptionDerivedAction.java
Tue Feb 11 11:47:52 2014
@@ -24,24 +24,23 @@ import java.util.List;
import javax.security.auth.callback.CallbackHandler;
+import org.apache.wss4j.common.EncryptionActionToken;
import org.apache.wss4j.common.SecurityActionToken;
-import org.apache.wss4j.common.SignatureActionToken;
import org.apache.wss4j.common.WSEncryptionPart;
-import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.derivedKey.ConversationConstants;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.dom.WSConstants;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.handler.WSHandler;
-import org.apache.wss4j.dom.message.WSSecDKSign;
+import org.apache.wss4j.dom.message.WSSecDKEncrypt;
import org.apache.wss4j.dom.message.WSSecEncryptedKey;
import org.apache.wss4j.dom.message.token.SecurityContextToken;
import org.apache.wss4j.dom.util.WSSecurityUtil;
import org.apache.xml.security.stax.impl.util.IDGenerator;
import org.w3c.dom.Document;
-public class SignatureDerivedAction implements Action {
+public class EncryptionDerivedAction implements Action {
public void execute(WSHandler handler, SecurityActionToken actionToken,
Document doc, RequestData reqData)
@@ -51,94 +50,83 @@ public class SignatureDerivedAction impl
callbackHandler = handler.getPasswordCallbackHandler(reqData);
}
- SignatureActionToken signatureToken = null;
- if (actionToken instanceof SignatureActionToken) {
- signatureToken = (SignatureActionToken)actionToken;
+ EncryptionActionToken encryptionToken = null;
+ if (actionToken instanceof EncryptionActionToken) {
+ encryptionToken = (EncryptionActionToken)actionToken;
}
- if (signatureToken == null) {
- signatureToken = reqData.getSignatureToken();
+ if (encryptionToken == null) {
+ encryptionToken = reqData.getEncryptionToken();
}
WSPasswordCallback passwordCallback =
- handler.getPasswordCB(signatureToken.getUser(),
WSConstants.DKT_SIGN, callbackHandler, reqData);
- WSSecDKSign wsSign = new WSSecDKSign(reqData.getWssConfig());
+ handler.getPasswordCB(encryptionToken.getUser(),
WSConstants.DKT_ENCR, callbackHandler, reqData);
+ WSSecDKEncrypt wsEncrypt = new WSSecDKEncrypt(reqData.getWssConfig());
- if (signatureToken.getSignatureAlgorithm() != null) {
-
wsSign.setSignatureAlgorithm(signatureToken.getSignatureAlgorithm());
+ if (encryptionToken.getKeyIdentifierId() != 0) {
+
wsEncrypt.setKeyIdentifierType(encryptionToken.getKeyIdentifierId());
}
- if (signatureToken.getDigestAlgorithm() != null) {
- wsSign.setDigestAlgorithm(signatureToken.getDigestAlgorithm());
- }
- if (signatureToken.getC14nAlgorithm() != null) {
- wsSign.setSigCanonicalization(signatureToken.getC14nAlgorithm());
+
+ if (encryptionToken.getSymmetricAlgorithm() != null) {
+
wsEncrypt.setSymmetricEncAlgorithm(encryptionToken.getSymmetricAlgorithm());
}
- wsSign.setUserInfo(signatureToken.getUser(),
passwordCallback.getPassword());
+ wsEncrypt.setUserInfo(encryptionToken.getUser(),
passwordCallback.getPassword());
WSSecEncryptedKey encrKeyBuilder = null;
String sctId = null;
if (reqData.isUse200512Namespace()) {
- wsSign.setWscVersion(ConversationConstants.VERSION_05_12);
+ wsEncrypt.setWscVersion(ConversationConstants.VERSION_05_12);
} else {
- wsSign.setWscVersion(ConversationConstants.VERSION_05_02);
+ wsEncrypt.setWscVersion(ConversationConstants.VERSION_05_02);
}
- if (signatureToken.getDerivedKeyLength() > 0) {
- wsSign.setDerivedKeyLength(signatureToken.getDerivedKeyLength());
+ if (encryptionToken.getDerivedKeyLength() > 0) {
+
wsEncrypt.setDerivedKeyLength(encryptionToken.getDerivedKeyLength());
}
- String derivedKeyTokenReference =
signatureToken.getDerivedKeyTokenReference();
- if ("EncryptedKey".equals(derivedKeyTokenReference)) {
- encrKeyBuilder = new WSSecEncryptedKey();
- encrKeyBuilder.setUserInfo(signatureToken.getUser());
- if (signatureToken.getDerivedKeyIdentifier() != 0) {
-
encrKeyBuilder.setKeyIdentifierType(signatureToken.getDerivedKeyIdentifier());
- } else {
-
encrKeyBuilder.setKeyIdentifierType(WSConstants.THUMBPRINT_IDENTIFIER);
- }
- encrKeyBuilder.prepare(doc, signatureToken.getCrypto());
-
- byte[] ek = encrKeyBuilder.getEphemeralKey();
- String tokenIdentifier = encrKeyBuilder.getId();
-
- wsSign.setExternalKey(ek, tokenIdentifier);
- wsSign.setCustomValueType(WSConstants.WSS_ENC_KEY_VALUE_TYPE);
- } else if ("SecurityContextToken".equals(derivedKeyTokenReference)) {
+ String derivedKeyTokenReference =
encryptionToken.getDerivedKeyTokenReference();
+ if ("SecurityContextToken".equals(derivedKeyTokenReference)) {
sctId = IDGenerator.generateID("uuid:");
if (reqData.isUse200512Namespace()) {
- wsSign.setCustomValueType(WSConstants.WSC_SCT_05_12);
+ wsEncrypt.setCustomValueType(WSConstants.WSC_SCT_05_12);
} else {
- wsSign.setCustomValueType(WSConstants.WSC_SCT);
+ wsEncrypt.setCustomValueType(WSConstants.WSC_SCT);
}
- wsSign.setExternalKey(passwordCallback.getKey(), sctId);
+ wsEncrypt.setTokenIdDirectId(true);
+ wsEncrypt.setExternalKey(passwordCallback.getKey(), sctId);
} else {
- // DirectReference
-
- if (signatureToken.getDerivedKeyIdentifier() != 0) {
-
wsSign.setKeyIdentifierType(signatureToken.getDerivedKeyIdentifier());
+ encrKeyBuilder = new WSSecEncryptedKey();
+ encrKeyBuilder.setUserInfo(encryptionToken.getUser());
+ if (encryptionToken.getDerivedKeyIdentifier() != 0) {
+
encrKeyBuilder.setKeyIdentifierType(encryptionToken.getDerivedKeyIdentifier());
} else {
- wsSign.setKeyIdentifierType(WSConstants.THUMBPRINT_IDENTIFIER);
+
encrKeyBuilder.setKeyIdentifierType(WSConstants.THUMBPRINT_IDENTIFIER);
}
- byte[] key = null;
- if (passwordCallback.getKey() != null) {
- key = passwordCallback.getKey();
- } else if (signatureToken.getKey() != null) {
- key = signatureToken.getKey();
- } else {
- Crypto crypto = signatureToken.getCrypto();
- key = crypto.getPrivateKey(signatureToken.getUser(),
passwordCallback.getPassword()).getEncoded();
+ if (encryptionToken.getKeyTransportAlgorithm() != null) {
+
encrKeyBuilder.setKeyEncAlgo(encryptionToken.getKeyTransportAlgorithm());
}
- wsSign.setCrypto(signatureToken.getCrypto());
- wsSign.setExternalKey(key, (String)null);
+ if (encryptionToken.getDigestAlgorithm() != null) {
+
encrKeyBuilder.setDigestAlgorithm(encryptionToken.getDigestAlgorithm());
+ }
+ if (encryptionToken.getMgfAlgorithm() != null) {
+
encrKeyBuilder.setMGFAlgorithm(encryptionToken.getMgfAlgorithm());
+ }
+
+ encrKeyBuilder.prepare(doc, encryptionToken.getCrypto());
+
+ byte[] ek = encrKeyBuilder.getEphemeralKey();
+ String tokenIdentifier = encrKeyBuilder.getId();
+
+ wsEncrypt.setExternalKey(ek, tokenIdentifier);
+ wsEncrypt.setCustomValueType(WSConstants.WSS_ENC_KEY_VALUE_TYPE);
}
-
-
wsSign.setAttachmentCallbackHandler(reqData.getAttachmentCallbackHandler());
+
wsEncrypt.setAttachmentCallbackHandler(reqData.getAttachmentCallbackHandler());
try {
- List<WSEncryptionPart> parts = signatureToken.getParts();
+ List<WSEncryptionPart> parts = encryptionToken.getParts();
if (parts == null || parts.isEmpty()) {
WSEncryptionPart encP = new
WSEncryptionPart(reqData.getSoapConstants()
.getBodyQName().getLocalPart(),
reqData.getSoapConstants()
@@ -147,10 +135,10 @@ public class SignatureDerivedAction impl
parts.add(encP);
}
- wsSign.setParts(parts);
- wsSign.build(doc, reqData.getSecHeader());
+ wsEncrypt.setParts(parts);
+ wsEncrypt.build(doc, reqData.getSecHeader());
- wsSign.prependDKElementToHeader(reqData.getSecHeader());
+ wsEncrypt.prependDKElementToHeader(reqData.getSecHeader());
if (encrKeyBuilder != null) {
encrKeyBuilder.prependToHeader(reqData.getSecHeader());
@@ -159,9 +147,9 @@ public class SignatureDerivedAction impl
WSSecurityUtil.prependChildElement(reqData.getSecHeader().getSecurityHeader(),
sct.getElement());
}
- reqData.getSignatureValues().add(wsSign.getSignatureValue());
} catch (WSSecurityException e) {
- throw new
WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "empty", e, "Error
during Signature: ");
+ throw new
WSSecurityException(WSSecurityException.ErrorCode.FAILURE,
+ "empty", e, "Error during
Encryption: ");
}
}
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java?rev=1567068&r1=1567067&r2=1567068&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/SignatureDerivedAction.java
Tue Feb 11 11:47:52 2014
@@ -111,6 +111,7 @@ public class SignatureDerivedAction impl
wsSign.setCustomValueType(WSConstants.WSC_SCT);
}
+ wsSign.setTokenIdDirectId(true);
wsSign.setExternalKey(passwordCallback.getKey(), sctId);
} else {
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/WSHandler.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/WSHandler.java?rev=1567068&r1=1567067&r2=1567068&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/WSHandler.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/handler/WSHandler.java
Tue Feb 11 11:47:52 2014
@@ -142,7 +142,8 @@ public abstract class WSHandler {
} else if (actionToDo.getAction() == WSConstants.ST_SIGNED
&& actionToDo.getActionToken() == null) {
decodeSignatureParameter(reqData);
- } else if (actionToDo.getAction() == WSConstants.ENCR
+ } else if ((actionToDo.getAction() == WSConstants.ENCR
+ || actionToDo.getAction() == WSConstants.DKT_ENCR)
&& actionToDo.getActionToken() == null) {
EncryptionActionToken actionToken =
reqData.getEncryptionToken();
if (actionToken == null) {
@@ -218,6 +219,7 @@ public abstract class WSHandler {
case WSConstants.ENCR:
case WSConstants.SIGN:
case WSConstants.DKT_SIGN:
+ case WSConstants.DKT_ENCR:
case WSConstants.ST_SIGNED:
case WSConstants.ST_UNSIGNED:
case WSConstants.TS:
@@ -1272,6 +1274,9 @@ public abstract class WSHandler {
case WSConstants.ENCR:
reason = WSPasswordCallback.SECRET_KEY;
break;
+ case WSConstants.DKT_ENCR:
+ reason = WSPasswordCallback.SECRET_KEY;
+ break;
}
return new WSPasswordCallback(username, reason);
}
Modified:
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/DerivedKeyActionTest.java
URL:
http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/DerivedKeyActionTest.java?rev=1567068&r1=1567067&r2=1567068&view=diff
==============================================================================
---
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/DerivedKeyActionTest.java
(original)
+++
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/DerivedKeyActionTest.java
Tue Feb 11 11:47:52 2014
@@ -325,6 +325,79 @@ public class DerivedKeyActionTest extend
verify(doc, secretKeyCallbackHandler);
}
+
+ @org.junit.Test
+ public void testEncryptionThumbprintSHA1() throws Exception {
+ final WSSConfig cfg = WSSConfig.getNewInstance();
+ final RequestData reqData = new RequestData();
+ reqData.setWssConfig(cfg);
+ reqData.setUsername("wss40");
+
+ java.util.Map<String, Object> config = new java.util.TreeMap<String,
Object>();
+ config.put(WSHandlerConstants.ENC_PROP_FILE, "wss40.properties");
+ config.put(WSHandlerConstants.PW_CALLBACK_REF, callbackHandler);
+ config.put(WSHandlerConstants.DERIVED_TOKEN_REFERENCE, "EncryptedKey");
+ config.put(WSHandlerConstants.DERIVED_TOKEN_KEY_ID, "Thumbprint");
+ reqData.setMsgContext(config);
+
+ final Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+ CustomHandler handler = new CustomHandler();
+ HandlerAction action = new HandlerAction(WSConstants.DKT_ENCR);
+ handler.send(
+ doc,
+ reqData,
+ Collections.singletonList(action),
+ true
+ );
+ String outputString =
+ XMLUtils.PrettyDocumentToString(doc);
+
Assert.assertTrue(outputString.contains(ConversationConstants.WSC_NS_05_12));
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(outputString);
+ }
+
+ verify(doc);
+ }
+
+ @org.junit.Test
+ public void testEncryptionSCT() throws Exception {
+ final WSSConfig cfg = WSSConfig.getNewInstance();
+ final RequestData reqData = new RequestData();
+ reqData.setWssConfig(cfg);
+ reqData.setUsername("wss40");
+
+ // Generate a Key
+ SecretKeyCallbackHandler secretKeyCallbackHandler = new
SecretKeyCallbackHandler();
+ KeyGenerator keyGen = KeyGenerator.getInstance("AES");
+ keyGen.init(128);
+ SecretKey key = keyGen.generateKey();
+ byte[] keyData = key.getEncoded();
+ secretKeyCallbackHandler.setOutboundSecret(keyData);
+
+ java.util.Map<String, Object> config = new java.util.TreeMap<String,
Object>();
+ config.put(WSHandlerConstants.PW_CALLBACK_REF,
secretKeyCallbackHandler);
+ config.put(WSHandlerConstants.DERIVED_TOKEN_REFERENCE,
"SecurityContextToken");
+ config.put(WSHandlerConstants.DERIVED_TOKEN_KEY_ID, "Thumbprint");
+ reqData.setMsgContext(config);
+
+ final Document doc = SOAPUtil.toSOAPPart(SOAPUtil.SAMPLE_SOAP_MSG);
+ CustomHandler handler = new CustomHandler();
+ HandlerAction action = new HandlerAction(WSConstants.DKT_ENCR);
+ handler.send(
+ doc,
+ reqData,
+ Collections.singletonList(action),
+ true
+ );
+ String outputString =
+ XMLUtils.PrettyDocumentToString(doc);
+
Assert.assertTrue(outputString.contains(ConversationConstants.WSC_NS_05_12));
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(outputString);
+ }
+
+ verify(doc, secretKeyCallbackHandler);
+ }
private List<WSSecurityEngineResult> verify(Document doc) throws Exception
{
return verify(doc, callbackHandler);
