This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/master by this push:
new 84e6de096 Reject duplicate C14N settings + Detect unknown top-level
policy assertions (#684)
84e6de096 is described below
commit 84e6de096e5fd0abcfcd27a9c2650e55c7959e0d
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Sep 10 10:16:01 2026 +0100
Reject duplicate C14N settings + Detect unknown top-level policy assertions
(#684)
---
.../apache/wss4j/policy/model/AlgorithmSuite.java | 7 +
.../wss4j/policy/stax/enforcer/PolicyEnforcer.java | 65 +++++-
.../policy/stax/test/UnknownAssertionsTest.java | 247 +++++++++++++++++++++
3 files changed, 308 insertions(+), 11 deletions(-)
diff --git
a/policy/src/main/java/org/apache/wss4j/policy/model/AlgorithmSuite.java
b/policy/src/main/java/org/apache/wss4j/policy/model/AlgorithmSuite.java
index f574de05c..f8639e484 100644
--- a/policy/src/main/java/org/apache/wss4j/policy/model/AlgorithmSuite.java
+++ b/policy/src/main/java/org/apache/wss4j/policy/model/AlgorithmSuite.java
@@ -748,6 +748,7 @@ public class AlgorithmSuite extends
AbstractSecurityAssertion implements PolicyC
//this means that if we have a compact policy only the first
alternative is visible
//in contrary to a normalized policy where just one alternative exists
if (alternatives.hasNext()) {
+ boolean c14nSeen = false;
List<Assertion> assertions = alternatives.next();
for (Assertion assertion : assertions) {
String assertionName = assertion.getName().getLocalPart();
@@ -772,6 +773,12 @@ public class AlgorithmSuite extends
AbstractSecurityAssertion implements PolicyC
}
C14NType c14NType = C14NType.lookUp(assertionName);
if (c14NType != null) {
+ // Reject duplicate C14N assertions instead of letting the
last one win,
+ // consistent with the sibling SOAPNorm/STR/XPath branches
below
+ if (c14nSeen) {
+ throw new
IllegalArgumentException(SPConstants.ERR_INVALID_POLICY);
+ }
+ c14nSeen = true;
algorithmSuite.setC14n(c14NType);
continue;
}
diff --git
a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
index 061ba2f88..97b6c8c5e 100644
---
a/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
+++
b/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/enforcer/PolicyEnforcer.java
@@ -45,6 +45,7 @@ import
org.apache.wss4j.policy.model.AbstractSecurityAssertion;
import org.apache.wss4j.policy.model.AbstractSymmetricAsymmetricBinding;
import org.apache.wss4j.policy.model.AbstractToken;
import org.apache.wss4j.policy.model.AlgorithmSuite;
+import org.apache.wss4j.policy.model.BootstrapPolicy;
import org.apache.wss4j.policy.model.ContentEncryptedElements;
import org.apache.wss4j.policy.model.EncryptedElements;
import org.apache.wss4j.policy.model.EncryptedParts;
@@ -128,6 +129,16 @@ public class PolicyEnforcer implements
SecurityEventListener {
private static final transient org.slf4j.Logger LOG =
org.slf4j.LoggerFactory.getLogger(PolicyEnforcer.class);
+ /**
+ * System property controlling how policy assertions which this enforcer
cannot enforce
+ * are handled. The default ("false") logs a warning and skips the
assertion (the
+ * historical behaviour). When set to "true", building the assertion state
map fails
+ * with a WSSPolicyException instead, so that the server cannot silently
enforce less
+ * than the policy it advertises.
+ */
+ public static final String FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY =
+ "org.apache.wss4j.policy.failOnUnsupportedAssertions";
+
private static final QName SOAP11_FAULT = new
QName(WSSConstants.NS_SOAP11, "Fault");
private static final QName SOAP12_FAULT = new
QName(WSSConstants.NS_SOAP12, "Fault");
@@ -231,7 +242,7 @@ public class PolicyEnforcer implements
SecurityEventListener {
if (policyOperator instanceof ExactlyOne) {
assertionStateMap.add(new
HashMap<SecurityEventConstants.Event,
Map<Assertion, List<Assertable>>>());
- buildAssertionStateMap(curPolicyComponent,
assertionStateMap, alternative++);
+ buildAssertionStateMap(curPolicyComponent,
assertionStateMap, alternative++, false);
} else {
buildAssertionStateMap(curPolicyComponent,
assertionStateMap);
}
@@ -246,7 +257,8 @@ public class PolicyEnforcer implements
SecurityEventListener {
PolicyComponent policyComponent,
List<Map<SecurityEventConstants.Event,
Map<Assertion, List<Assertable>>>> assertionStateMap,
- int alternative
+ int alternative,
+ boolean nestedPolicy
) throws WSSPolicyException {
if (policyComponent instanceof PolicyOperator) {
PolicyOperator policyOperator = (PolicyOperator) policyComponent;
@@ -254,7 +266,7 @@ public class PolicyEnforcer implements
SecurityEventListener {
Iterator<PolicyComponent> policyComponentIterator =
policyComponents.iterator();
while (policyComponentIterator.hasNext()) {
PolicyComponent curPolicyComponent =
policyComponentIterator.next();
- buildAssertionStateMap(curPolicyComponent, assertionStateMap,
alternative);
+ buildAssertionStateMap(curPolicyComponent, assertionStateMap,
alternative, nestedPolicy);
}
} else if (policyComponent instanceof AbstractSecurityAssertion) {
AbstractSecurityAssertion abstractSecurityAssertion =
(AbstractSecurityAssertion) policyComponent;
@@ -278,14 +290,46 @@ public class PolicyEnforcer implements
SecurityEventListener {
}
if (abstractSecurityAssertion instanceof
PolicyContainingAssertion) {
buildAssertionStateMap(((PolicyContainingAssertion)
abstractSecurityAssertion).getPolicy(),
- assertionStateMap, alternative);
- }
- } else if (!(policyComponent instanceof PrimitiveAssertion)) {
+ assertionStateMap, alternative, true);
+ }
+ } else if (policyComponent instanceof PrimitiveAssertion) {
+ if (!nestedPolicy) {
+ // A top-level PrimitiveAssertion is an assertion which no
registered builder
+ // converted into a security policy model object - a namespace
typo, an SP
+ // version mismatch, or a custom/unknown assertion. It cannot
be enforced by
+ // this layer: the server would silently enforce less than the
policy it
+ // advertises. Warn by default; fail if configured to do so.
+ handleUnknownAssertion(((PrimitiveAssertion)
policyComponent).getName().toString());
+ }
+ // Inside a PolicyContainingAssertion's nested policy the remaining
+ // PrimitiveAssertions are the standard leaves (e.g. sp:Basic256,
sp:Strict,
+ // sp:IncludeTimestamp, sp:WssX509V3Token10) which the parent
model's
+ // parseNestedPolicy already consumed by name and which are
enforced through the
+ // parent's assertion state. They are not unknown, so they are
deliberately
+ // skipped here (the historical behaviour).
+ } else {
throw new WSSPolicyException("Unsupported PolicyComponent: " +
policyComponent
+ " type: " +
policyComponent.getType());
}
}
+ /**
+ * Handle a policy assertion which this enforcer cannot enforce. By
default a warning is
+ * logged and the assertion is skipped (the historical behaviour). If the
+ * {@link #FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY} system property is set
to "true", a
+ * WSSPolicyException is thrown instead, so that a policy advertising more
than the
+ * enforcer can verify is rejected at build time rather than silently
under-enforced.
+ */
+ private void handleUnknownAssertion(String assertionName) throws
WSSPolicyException {
+ String msg = "Policy assertion " + assertionName
+ + " is unknown to the PolicyEnforcer and will NOT be enforced";
+ if
(Boolean.parseBoolean(System.getProperty(FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY,
"false"))) {
+ throw new WSSPolicyException(msg);
+ }
+ LOG.warn("{}. Set the {} system property to \"true\" to reject
unsupported assertions instead.",
+ msg, FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY);
+ }
+
private void addAssertionState(Map<Assertion, List<Assertable>>
assertables,
Assertion keyAssertion,
Assertable assertable) {
@@ -502,15 +546,14 @@ public class PolicyEnforcer implements
SecurityEventListener {
policyAsserter.assertPolicy(new QName(namespace,
SPConstants.SCOPE_POLICY_15));
}
}
+ } else if (abstractSecurityAssertion instanceof
PolicyContainingAssertion
+ || abstractSecurityAssertion instanceof BootstrapPolicy) {
+ policyAsserter.assertPolicy(abstractSecurityAssertion);
} else {
+
handleUnknownAssertion(abstractSecurityAssertion.getName().toString());
policyAsserter.assertPolicy(abstractSecurityAssertion);
}
- /*else if (abstractSecurityAssertion instanceof AsymmetricBinding) {
- } else if (abstractSecurityAssertion instanceof SymmetricBinding) {
- } else if (abstractSecurityAssertion instanceof TransportBinding) {
- } */
-
return assertableList;
}
diff --git
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/UnknownAssertionsTest.java
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/UnknownAssertionsTest.java
new file mode 100644
index 000000000..f1404ee4d
--- /dev/null
+++
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/UnknownAssertionsTest.java
@@ -0,0 +1,247 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.wss4j.policy.stax.test;
+
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+
+import javax.xml.namespace.QName;
+
+import org.apache.wss4j.common.WSSPolicyException;
+import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.policy.stax.enforcer.PolicyEnforcer;
+import org.apache.wss4j.stax.ext.WSSConstants;
+import org.apache.wss4j.stax.impl.securityToken.HttpsSecurityTokenImpl;
+import org.apache.wss4j.stax.impl.securityToken.X509SecurityTokenImpl;
+import org.apache.wss4j.stax.securityEvent.HttpsTokenSecurityEvent;
+import org.apache.wss4j.stax.securityEvent.OperationSecurityEvent;
+import org.apache.wss4j.stax.securityEvent.RequiredElementSecurityEvent;
+import org.apache.wss4j.stax.securityEvent.SignedPartSecurityEvent;
+import org.apache.wss4j.stax.securityEvent.TimestampSecurityEvent;
+import org.apache.wss4j.stax.securityEvent.X509TokenSecurityEvent;
+import org.apache.wss4j.stax.securityToken.WSSecurityTokenConstants;
+import org.apache.xml.security.stax.ext.XMLSecurityConstants;
+import
org.apache.xml.security.stax.securityEvent.ContentEncryptedElementSecurityEvent;
+import
org.apache.xml.security.stax.securityEvent.EncryptedElementSecurityEvent;
+import org.apache.xml.security.stax.securityToken.InboundSecurityToken;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * Tests for the handling of policy assertions which the PolicyEnforcer cannot
enforce:
+ * unknown assertions must be warned about (or rejected, when the
+ * {@link PolicyEnforcer#FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY} system
property is set),
+ * while stock policies - whose nested leaves and container assertions are
enforced via
+ * the parent model's assertion states - must never be flagged.
+ */
+public class UnknownAssertionsTest extends AbstractPolicyTestBase {
+
+ private static final String UNKNOWN_ASSERTION_POLICY =
+ "<foo:UnknownAssertion
xmlns:foo=\"http://www.example.org/custom-assertions\"/>";
+
+ /**
+ * A stock transport binding (nested AlgorithmSuite/Basic256 and
IncludeTimestamp
+ * leaves) must build and verify cleanly even with
failOnUnsupportedAssertions
+ * enabled - the nested leaves are consumed by the parent model's parser
and are
+ * not unknown.
+ */
+ @Test
+ public void
testStockTransportBindingPolicyWithFailOnUnsupportedAssertionsEnabled() throws
Exception {
+ String policyString =
+ "<sp:TransportBinding
xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\";
xmlns:sp3=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802\";>\n" +
+ "<wsp:Policy
xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\";>\n" +
+ " <sp:AlgorithmSuite>\n" +
+ " <wsp:Policy>\n" +
+ " <sp:Basic256/>\n" +
+ " </wsp:Policy>\n" +
+ " </sp:AlgorithmSuite>\n" +
+ "<sp:IncludeTimestamp/>\n" +
+ "</wsp:Policy>\n" +
+ "</sp:TransportBinding>";
+
System.setProperty(PolicyEnforcer.FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY,
"true");
+ try {
+ PolicyEnforcer policyEnforcer =
buildAndStartPolicyEngine(policyString);
+ TimestampSecurityEvent timestampSecurityEvent = new
TimestampSecurityEvent();
+ policyEnforcer.registerSecurityEvent(timestampSecurityEvent);
+
+ RequiredElementSecurityEvent requiredElementSecurityEvent = new
RequiredElementSecurityEvent();
+ List<QName> headerPath = new ArrayList<>();
+ headerPath.addAll(WSSConstants.SOAP_11_WSSE_SECURITY_HEADER_PATH);
+ headerPath.add(WSSConstants.TAG_WSU_TIMESTAMP);
+ requiredElementSecurityEvent.setElementPath(headerPath);
+ policyEnforcer.registerSecurityEvent(requiredElementSecurityEvent);
+
+ HttpsTokenSecurityEvent httpsTokenSecurityEvent = new
HttpsTokenSecurityEvent();
+ HttpsSecurityTokenImpl httpsSecurityToken = new
HttpsSecurityTokenImpl(true, "username");
+
httpsSecurityToken.addTokenUsage(WSSecurityTokenConstants.TOKENUSAGE_MAIN_SIGNATURE);
+ httpsTokenSecurityEvent.setSecurityToken(httpsSecurityToken);
+ policyEnforcer.registerSecurityEvent(httpsTokenSecurityEvent);
+
+ OperationSecurityEvent operationSecurityEvent = new
OperationSecurityEvent();
+ operationSecurityEvent.setOperation(WSDL_DEFINITIONS);
+ policyEnforcer.registerSecurityEvent(operationSecurityEvent);
+
+ List<XMLSecurityConstants.ContentType> protectionOrder = new
LinkedList<>();
+ protectionOrder.add(XMLSecurityConstants.ContentType.SIGNATURE);
+ protectionOrder.add(XMLSecurityConstants.ContentType.ENCRYPTION);
+ EncryptedElementSecurityEvent encryptedElementSecurityEvent =
+ new EncryptedElementSecurityEvent(null, true,
protectionOrder);
+ headerPath = new ArrayList<>();
+ headerPath.addAll(WSSConstants.SOAP_11_WSSE_SECURITY_HEADER_PATH);
+ headerPath.add(WSSConstants.TAG_dsig_Signature);
+ encryptedElementSecurityEvent.setElementPath(headerPath);
+
policyEnforcer.registerSecurityEvent(encryptedElementSecurityEvent);
+
+ encryptedElementSecurityEvent = new
EncryptedElementSecurityEvent(null, true, protectionOrder);
+ headerPath = new ArrayList<>();
+ headerPath.addAll(WSSConstants.SOAP_11_WSSE_SECURITY_HEADER_PATH);
+ headerPath.add(WSSConstants.TAG_WSSE11_SIG_CONF);
+ encryptedElementSecurityEvent.setElementPath(headerPath);
+
policyEnforcer.registerSecurityEvent(encryptedElementSecurityEvent);
+
+ SignedPartSecurityEvent signedPartSecurityEvent = new
SignedPartSecurityEvent(null, true, protectionOrder);
+
signedPartSecurityEvent.setElementPath(WSSConstants.SOAP_11_BODY_PATH);
+ policyEnforcer.registerSecurityEvent(signedPartSecurityEvent);
+
+ policyEnforcer.doFinal();
+ } finally {
+
System.clearProperty(PolicyEnforcer.FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY);
+ }
+ }
+
+ /**
+ * A stock asymmetric binding whose tokens are carried in
InitiatorToken/RecipientToken
+ * wrappers (with nested X509Token leaves such as sp:WssX509V3Token11)
must build and
+ * verify cleanly even with failOnUnsupportedAssertions enabled - the
token wrappers
+ * are recognized containers whose nested policies are enforced via the
+ * PolicyContainingAssertion recursion.
+ */
+ @Test
+ public void
testAsymmetricBindingWithTokenWrappersAndFailOnUnsupportedAssertionsEnabled()
throws Exception {
+ String policyString =
+ "<sp:AsymmetricBinding
xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\";
xmlns:sp3=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802\";>\n" +
+ "<wsp:Policy
xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\";>\n" +
+ "<sp:InitiatorToken>\n" +
+ " <wsp:Policy>\n" +
+ " <sp:X509Token>\n" +
+ "
<sp:IssuerName>CN=transmitter,OU=swssf,C=CH</sp:IssuerName>\n" +
+ " <wsp:Policy
xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\";>\n" +
+ " <sp:RequireThumbprintReference/>\n" +
+ " <sp:WssX509V3Token11/>\n" +
+ " </wsp:Policy>\n" +
+ " </sp:X509Token>\n" +
+ " </wsp:Policy>\n" +
+ "</sp:InitiatorToken>\n" +
+ "<sp:RecipientToken>\n" +
+ " <wsp:Policy>\n" +
+ " <sp:X509Token>\n" +
+ "
<sp:IssuerName>CN=transmitter,OU=swssf,C=CH</sp:IssuerName>\n" +
+ " <wsp:Policy
xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\";>\n" +
+ " <sp:RequireThumbprintReference/>\n" +
+ " <sp:WssX509V3Token11/>\n" +
+ " </wsp:Policy>\n" +
+ " </sp:X509Token>\n" +
+ " </wsp:Policy>\n" +
+ "</sp:RecipientToken>\n" +
+ " <sp:AlgorithmSuite>\n" +
+ " <wsp:Policy>\n" +
+ " <sp:Basic256/>\n" +
+ " </wsp:Policy>\n" +
+ " </sp:AlgorithmSuite>\n" +
+ "</wsp:Policy>\n" +
+ "</sp:AsymmetricBinding>";
+
System.setProperty(PolicyEnforcer.FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY,
"true");
+ try {
+ PolicyEnforcer policyEnforcer =
buildAndStartPolicyEngine(policyString);
+ X509TokenSecurityEvent initiatorX509TokenSecurityEvent = new
X509TokenSecurityEvent();
+ X509SecurityTokenImpl securityToken =
getX509Token(WSSecurityTokenConstants.X509V3Token);
+
securityToken.addTokenUsage(WSSecurityTokenConstants.TOKENUSAGE_MAIN_SIGNATURE);
+ initiatorX509TokenSecurityEvent.setSecurityToken(securityToken);
+
policyEnforcer.registerSecurityEvent(initiatorX509TokenSecurityEvent);
+
+ X509TokenSecurityEvent recipientX509TokenSecurityEvent = new
X509TokenSecurityEvent();
+ securityToken = getX509Token(WSSecurityTokenConstants.X509V3Token);
+
securityToken.addTokenUsage(WSSecurityTokenConstants.TOKENUSAGE_MAIN_ENCRYPTION);
+ recipientX509TokenSecurityEvent.setSecurityToken(securityToken);
+
policyEnforcer.registerSecurityEvent(recipientX509TokenSecurityEvent);
+
+ List<XMLSecurityConstants.ContentType> protectionOrder = new
LinkedList<>();
+ protectionOrder.add(XMLSecurityConstants.ContentType.SIGNATURE);
+ protectionOrder.add(XMLSecurityConstants.ContentType.ENCRYPTION);
+ SignedPartSecurityEvent signedPartSecurityEvent =
+ new SignedPartSecurityEvent(
+
(InboundSecurityToken)recipientX509TokenSecurityEvent.getSecurityToken(), true,
protectionOrder);
+
signedPartSecurityEvent.setElementPath(WSSConstants.SOAP_11_BODY_PATH);
+ policyEnforcer.registerSecurityEvent(signedPartSecurityEvent);
+
+ ContentEncryptedElementSecurityEvent
contentEncryptedElementSecurityEvent =
+ new ContentEncryptedElementSecurityEvent(
+
(InboundSecurityToken)recipientX509TokenSecurityEvent.getSecurityToken(), true,
protectionOrder);
+
contentEncryptedElementSecurityEvent.setElementPath(WSSConstants.SOAP_11_BODY_PATH);
+
policyEnforcer.registerSecurityEvent(contentEncryptedElementSecurityEvent);
+
+ OperationSecurityEvent operationSecurityEvent = new
OperationSecurityEvent();
+ operationSecurityEvent.setOperation(WSDL_DEFINITIONS);
+ policyEnforcer.registerSecurityEvent(operationSecurityEvent);
+
+ policyEnforcer.doFinal();
+ } finally {
+
System.clearProperty(PolicyEnforcer.FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY);
+ }
+ }
+
+ /**
+ * A genuinely unknown top-level assertion (no registered builder) is
skipped with a
+ * warning by default - the historical behaviour - so the policy still
builds.
+ */
+ @Test
+ public void testUnknownPrimitiveAssertionIsSkippedByDefault() throws
Exception {
+ PolicyEnforcer policyEnforcer =
buildAndStartPolicyEngine(UNKNOWN_ASSERTION_POLICY);
+ OperationSecurityEvent operationSecurityEvent = new
OperationSecurityEvent();
+ operationSecurityEvent.setOperation(WSDL_DEFINITIONS);
+ policyEnforcer.registerSecurityEvent(operationSecurityEvent);
+ policyEnforcer.doFinal();
+ }
+
+ /**
+ * The same unknown top-level assertion must fail the policy build when
+ * failOnUnsupportedAssertions is enabled.
+ */
+ @Test
+ public void testUnknownPrimitiveAssertionFailsWhenConfigured() throws
Exception {
+
System.setProperty(PolicyEnforcer.FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY,
"true");
+ try {
+ PolicyEnforcer policyEnforcer =
buildAndStartPolicyEngine(UNKNOWN_ASSERTION_POLICY);
+ OperationSecurityEvent operationSecurityEvent = new
OperationSecurityEvent();
+ operationSecurityEvent.setOperation(WSDL_DEFINITIONS);
+ try {
+ policyEnforcer.registerSecurityEvent(operationSecurityEvent);
+ fail("Exception expected");
+ } catch (WSSecurityException e) {
+ assertTrue(e.getCause() instanceof WSSPolicyException);
+
assertTrue(e.getCause().getMessage().contains("UnknownAssertion"));
+ }
+ } finally {
+
System.clearProperty(PolicyEnforcer.FAIL_ON_UNSUPPORTED_ASSERTIONS_PROPERTY);
+ }
+ }
+}
