cxf git commit: [CXF-5674] - CXF Support in "Audience Restriction" of SAML 2 (SOAP)
Repository: cxf Updated Branches: refs/heads/3.0.x-fixes c015b609b -> ff2987db4 [CXF-5674] - CXF Support in "Audience Restriction" of SAML 2 (SOAP) Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/ff2987db Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/ff2987db Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/ff2987db Branch: refs/heads/3.0.x-fixes Commit: ff2987db4950611b0e770b1fd6bd4e501c997a41 Parents: c015b60 Author: Colm O hEigeartaigh Authored: Fri Jan 16 14:58:30 2015 + Committer: Colm O hEigeartaigh Committed: Fri Jan 16 15:44:13 2015 + -- .../cxf/ws/security/SecurityConstants.java | 10 +- .../ws/security/wss4j/WSS4JInInterceptor.java | 20 .../security/wss4j/WSS4JStaxInInterceptor.java | 22 + .../saml/Saml2AudienceRestrictionValidator.java | 92 --- .../cxf/systest/ws/saml/SamlTokenTest.java | 96 +++- .../StaxSaml2AudienceRestrictionValidator.java | 82 - .../cxf/systest/ws/saml/DoubleItSaml.wsdl | 3 + .../org/apache/cxf/systest/ws/saml/server.xml | 19 ++-- .../apache/cxf/systest/ws/saml/stax-server.xml | 20 ++-- 9 files changed, 168 insertions(+), 196 deletions(-) -- http://git-wip-us.apache.org/repos/asf/cxf/blob/ff2987db/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java -- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java index b5b32b3..daedbb0 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java @@ -229,6 +229,13 @@ public final class SecurityConstants { */ public static final String SC_FROM_JAAS_SUBJECT = "ws-security.sc.jaas-subject"; +/** + * Enable SAML AudienceRestriction validation. If this is set to "true", then IF the + * SAML Token contains Audience Restriction URIs, one of them must match either the + * request URL or the Service QName. The default is "true". + */ +public static final String AUDIENCE_RESTRICTION_VALIDATION = "ws-security.validate.audience-restriction"; + // // Non-boolean WS-Security Configuration parameters // @@ -633,7 +640,8 @@ public final class SecurityConstants { CACHE_IDENTIFIER, CACHE_ISSUED_TOKEN_IN_ENDPOINT, PREFER_WSMEX_OVER_STS_CLIENT_CONFIG, DELEGATED_CREDENTIAL, KERBEROS_USE_CREDENTIAL_DELEGATION, KERBEROS_IS_USERNAME_IN_SERVICENAME_FORM, STS_TOKEN_IMMINENT_EXPIRY_VALUE, -KERBEROS_REQUEST_CREDENTIAL_DELEGATION, ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL +KERBEROS_REQUEST_CREDENTIAL_DELEGATION, ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL, +AUDIENCE_RESTRICTION_VALIDATION })); ALL_PROPERTIES = Collections.unmodifiableSet(s); } http://git-wip-us.apache.org/repos/asf/cxf/blob/ff2987db/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java -- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java index 4fec350..2ab48ea 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java @@ -216,6 +216,8 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { } reqData.setWssConfig(config); +// Add Audience Restrictions for SAML +configureAudienceRestriction(msg, reqData); SOAPMessage doc = getSOAPMessage(msg); @@ -339,6 +341,24 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { reqData = null; } } + +private void configureAudienceRestriction(SoapMessage msg, RequestData reqData) { +// Add Audience Restrictions for SAML +boolean enableAudienceRestriction = +MessageUtils.getContextualBoolean(msg, + SecurityConstants.AUDIENCE_RESTRICTION_VALIDATION, + true); +if (enableAudienceRestriction) { +List audiences = new ArrayList(); +if (msg.getContextualProperty(org.apache.cxf.message.Message.REQUEST_URL) != null) { + audiences.add((String)msg.getContextualProperty(org.apache.cxf.
[2/2] cxf git commit: [CXF-5674] - CXF Support in "Audience Restriction" of SAML 2 (SOAP)
[CXF-5674] - CXF Support in "Audience Restriction" of SAML 2 (SOAP) Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/abafca6d Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/abafca6d Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/abafca6d Branch: refs/heads/master Commit: abafca6d4a4f48e4affdc67f368a1ab33cdd79e0 Parents: 6359c93 Author: Colm O hEigeartaigh Authored: Fri Jan 16 14:58:30 2015 + Committer: Colm O hEigeartaigh Committed: Fri Jan 16 15:43:48 2015 + -- .../cxf/ws/security/SecurityConstants.java | 10 +- .../ws/security/wss4j/WSS4JInInterceptor.java | 20 .../security/wss4j/WSS4JStaxInInterceptor.java | 22 + .../saml/Saml2AudienceRestrictionValidator.java | 92 --- .../cxf/systest/ws/saml/SamlTokenTest.java | 96 +++- .../StaxSaml2AudienceRestrictionValidator.java | 82 - .../cxf/systest/ws/saml/DoubleItSaml.wsdl | 3 + .../org/apache/cxf/systest/ws/saml/server.xml | 19 ++-- .../apache/cxf/systest/ws/saml/stax-server.xml | 20 ++-- 9 files changed, 168 insertions(+), 196 deletions(-) -- http://git-wip-us.apache.org/repos/asf/cxf/blob/abafca6d/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java -- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java index b5b32b3..daedbb0 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java @@ -229,6 +229,13 @@ public final class SecurityConstants { */ public static final String SC_FROM_JAAS_SUBJECT = "ws-security.sc.jaas-subject"; +/** + * Enable SAML AudienceRestriction validation. If this is set to "true", then IF the + * SAML Token contains Audience Restriction URIs, one of them must match either the + * request URL or the Service QName. The default is "true". + */ +public static final String AUDIENCE_RESTRICTION_VALIDATION = "ws-security.validate.audience-restriction"; + // // Non-boolean WS-Security Configuration parameters // @@ -633,7 +640,8 @@ public final class SecurityConstants { CACHE_IDENTIFIER, CACHE_ISSUED_TOKEN_IN_ENDPOINT, PREFER_WSMEX_OVER_STS_CLIENT_CONFIG, DELEGATED_CREDENTIAL, KERBEROS_USE_CREDENTIAL_DELEGATION, KERBEROS_IS_USERNAME_IN_SERVICENAME_FORM, STS_TOKEN_IMMINENT_EXPIRY_VALUE, -KERBEROS_REQUEST_CREDENTIAL_DELEGATION, ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL +KERBEROS_REQUEST_CREDENTIAL_DELEGATION, ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL, +AUDIENCE_RESTRICTION_VALIDATION })); ALL_PROPERTIES = Collections.unmodifiableSet(s); } http://git-wip-us.apache.org/repos/asf/cxf/blob/abafca6d/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java -- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java index 4fec350..2ab48ea 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java @@ -216,6 +216,8 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { } reqData.setWssConfig(config); +// Add Audience Restrictions for SAML +configureAudienceRestriction(msg, reqData); SOAPMessage doc = getSOAPMessage(msg); @@ -339,6 +341,24 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { reqData = null; } } + +private void configureAudienceRestriction(SoapMessage msg, RequestData reqData) { +// Add Audience Restrictions for SAML +boolean enableAudienceRestriction = +MessageUtils.getContextualBoolean(msg, + SecurityConstants.AUDIENCE_RESTRICTION_VALIDATION, + true); +if (enableAudienceRestriction) { +List audiences = new ArrayList(); +if (msg.getContextualProperty(org.apache.cxf.message.Message.REQUEST_URL) != null) { + audiences.add((String)msg.getContextualProperty(org.apache.cxf.message.Message.REQUEST_URL)); +} +if (msg.getContextualProperty(
[2/3] cxf git commit: [CXF-5674] - CXF Support in "Audience Restriction" of SAML 2 (SOAP)
[CXF-5674] - CXF Support in "Audience Restriction" of SAML 2 (SOAP) Conflicts: rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JStaxInInterceptor.java systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/Saml2AudienceRestrictionValidator.java systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/SamlTokenTest.java systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server.xml systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/stax-server.xml Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/737a1b13 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/737a1b13 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/737a1b13 Branch: refs/heads/2.7.x-fixes Commit: 737a1b13a3182855ce07a6e1257f81608c24cbb7 Parents: d9ecc37 Author: Colm O hEigeartaigh Authored: Fri Jan 16 14:58:30 2015 + Committer: Colm O hEigeartaigh Committed: Fri Jan 16 16:23:18 2015 + -- .../cxf/ws/security/SecurityConstants.java | 10 +- .../ws/security/wss4j/WSS4JInInterceptor.java | 20 + .../security/wss4j/WSS4JStaxInInterceptor.java | 480 +++ .../cxf/systest/ws/saml/SamlTokenTest.java | 103 .../cxf/systest/ws/saml/DoubleItSaml.wsdl | 3 + .../org/apache/cxf/systest/ws/saml/server.xml | 270 +++ .../apache/cxf/systest/ws/saml/stax-server.xml | 298 7 files changed, 1183 insertions(+), 1 deletion(-) -- http://git-wip-us.apache.org/repos/asf/cxf/blob/737a1b13/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java -- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java index f2f2201..61691a1 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/SecurityConstants.java @@ -230,6 +230,13 @@ public final class SecurityConstants { public static final String KERBEROS_IS_USERNAME_IN_SERVICENAME_FORM = "ws-security.kerberos.is.username.in.servicename.form"; +/** + * Enable SAML AudienceRestriction validation. If this is set to "true", then IF the + * SAML Token contains Audience Restriction URIs, one of them must match either the + * request URL or the Service QName. The default is "true". + */ +public static final String AUDIENCE_RESTRICTION_VALIDATION = "ws-security.validate.audience-restriction"; + // // Non-boolean WS-Security Configuration parameters // @@ -608,7 +615,8 @@ public final class SecurityConstants { CACHE_IDENTIFIER, CACHE_ISSUED_TOKEN_IN_ENDPOINT, PREFER_WSMEX_OVER_STS_CLIENT_CONFIG, DELEGATED_CREDENTIAL, KERBEROS_USE_CREDENTIAL_DELEGATION, KERBEROS_IS_USERNAME_IN_SERVICENAME_FORM, STS_TOKEN_IMMINENT_EXPIRY_VALUE, -KERBEROS_REQUEST_CREDENTIAL_DELEGATION, ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL +KERBEROS_REQUEST_CREDENTIAL_DELEGATION, ENABLE_UNSIGNED_SAML_ASSERTION_PRINCIPAL, +AUDIENCE_RESTRICTION_VALIDATION })); ALL_PROPERTIES = Collections.unmodifiableSet(s); } http://git-wip-us.apache.org/repos/asf/cxf/blob/737a1b13/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java -- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java index c8318f1..860a09f 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java @@ -215,6 +215,8 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { } reqData.setWssConfig(config); +// Add Audience Restrictions for SAML +configureAudienceRestriction(msg, reqData); SOAPMessage doc = getSOAPMessage(msg); @@ -337,6 +339,24 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { reqData = null; } } + +private void configureAudienceRestriction(SoapMessage msg, RequestData reqData) { +// Add Audience Restrictions for SAML +boolean enableAudienceRestriction = +MessageUtils.getContextualBoolean(msg, + SecurityConstants.AUDIENCE_RESTRICTION_V