You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2012/08/21 12:37:19 UTC
svn commit: r1375465 - in /webservices/wss4j/trunk:
streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/ext/
streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/impl/processor/input/
streaming-ws-security/src/test/java/o...
Author: coheigea
Date: Tue Aug 21 10:37:18 2012
New Revision: 1375465
URL: http://svn.apache.org/viewvc?rev=1375465&view=rev
Log:
[WSS-361] - Update code to use correct WSPasswordCallback code as per the DOM code.
- The logic in the UsernameTokenHandler needs to be replaced with a Validator eventually
Modified:
webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/ext/WSSSecurityProperties.java
webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/impl/processor/input/UsernameTokenInputHandler.java
webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/CallbackHandlerImpl.java
webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/UsernameTokenTest.java
webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/ws/security/common/ext/WSPasswordCallback.java
Modified: webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/ext/WSSSecurityProperties.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/ext/WSSSecurityProperties.java?rev=1375465&r1=1375464&r2=1375465&view=diff
==============================================================================
--- webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/ext/WSSSecurityProperties.java (original)
+++ webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/ext/WSSSecurityProperties.java Tue Aug 21 10:37:18 2012
@@ -80,6 +80,31 @@ public class WSSSecurityProperties exten
public void setStrictTimestampCheck(boolean strictTimestampCheck) {
this.strictTimestampCheck = strictTimestampCheck;
}
+
+
+ /**
+ * This variable controls whether types other than PasswordDigest or PasswordText
+ * are allowed when processing UsernameTokens.
+ *
+ * By default this is set to false so that the user doesn't have to explicitly
+ * reject custom token types in the callback handler.
+ */
+ private boolean handleCustomPasswordTypes = false;
+
+ /**
+ * @param handleCustomTypes
+ * whether to handle custom UsernameToken password types or not
+ */
+ public void setHandleCustomPasswordTypes(boolean handleCustomTypes) {
+ this.handleCustomPasswordTypes = handleCustomTypes;
+ }
+
+ /**
+ * @return whether custom UsernameToken password types are allowed or not
+ */
+ public boolean getHandleCustomPasswordTypes() {
+ return handleCustomPasswordTypes;
+ }
private String tokenUser;
private WSSConstants.UsernameTokenPasswordType usernameTokenPasswordType;
Modified: webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/impl/processor/input/UsernameTokenInputHandler.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/impl/processor/input/UsernameTokenInputHandler.java?rev=1375465&r1=1375464&r2=1375465&view=diff
==============================================================================
--- webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/impl/processor/input/UsernameTokenInputHandler.java (original)
+++ webservices/wss4j/trunk/streaming-ws-security/src/main/java/org/apache/ws/security/stax/wss/impl/processor/input/UsernameTokenInputHandler.java Tue Aug 21 10:37:18 2012
@@ -84,7 +84,10 @@ public class UsernameTokenInputHandler e
if (salt != null && (passwordType != null || iteration == null)) {
throw new WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY_TOKEN, "badTokenType01");
}
-
+
+ boolean handleCustomPasswordTypes = false;
+ handleCustomPasswordTypes = ((WSSSecurityProperties)securityProperties).getHandleCustomPasswordTypes();
+
final byte[] nonceVal;
final String created;
@@ -100,6 +103,7 @@ public class UsernameTokenInputHandler e
final EncodedString encodedNonce = XMLSecurityUtils.getQNameType(usernameTokenType.getAny(), WSSConstants.TAG_wsse_Nonce);
final AttributedDateTime attributedDateTimeCreated = XMLSecurityUtils.getQNameType(usernameTokenType.getAny(), WSSConstants.TAG_wsu_Created);
+ // TODO revisit this once we add in Validators
if (usernameTokenPasswordType == WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST) {
if (encodedNonce == null || attributedDateTimeCreated == null) {
throw new WSSecurityException(WSSecurityException.ErrorCode.INVALID_SECURITY_TOKEN, "badTokenType01");
@@ -163,31 +167,64 @@ public class UsernameTokenInputHandler e
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
}
passwordType.setValue(pwCb.getPassword());
- } else {
+ } else if ((usernameTokenPasswordType == WSSConstants.UsernameTokenPasswordType.PASSWORD_TEXT)
+ || (passwordType != null && passwordType.getValue() != null
+ && usernameTokenPasswordType == WSSConstants.UsernameTokenPasswordType.PASSWORD_NONE)) {
nonceVal = null;
created = null;
- WSPasswordCallback pwCb;
- if (passwordType == null) {
- passwordType = new PasswordString();
- pwCb = new WSPasswordCallback(username.getValue(),
- null,
- null,
- WSPasswordCallback.Usage.USERNAME_TOKEN_UNKNOWN);
- } else {
- pwCb = new WSPasswordCallback(username.getValue(),
- passwordType.getValue(),
- passwordType.getType(),
- WSPasswordCallback.Usage.USERNAME_TOKEN_UNKNOWN);
+ WSPasswordCallback pwCb = new WSPasswordCallback(username.getValue(),
+ null,
+ passwordType.getType(),
+ WSPasswordCallback.Usage.USERNAME_TOKEN);
+ try {
+ WSSUtils.doPasswordCallback(securityProperties.getCallbackHandler(), pwCb);
+ } catch (WSSecurityException e) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION, e);
+ }
+
+ if (pwCb.getPassword() == null) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
+ }
+
+ if (!passwordType.getValue().equals(pwCb.getPassword())) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
+ }
+ passwordType.setValue(pwCb.getPassword());
+ } else if (passwordType != null && passwordType.getValue() != null && usernameTokenPasswordType == null) {
+ if (!handleCustomPasswordTypes) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
}
+ nonceVal = null;
+ created = null;
+ WSPasswordCallback pwCb = new WSPasswordCallback(username.getValue(),
+ null,
+ passwordType.getType(),
+ WSPasswordCallback.Usage.USERNAME_TOKEN);
try {
WSSUtils.doPasswordCallback(securityProperties.getCallbackHandler(), pwCb);
} catch (WSSecurityException e) {
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION, e);
}
+
+ if (pwCb.getPassword() == null) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
+ }
+
+ if (!passwordType.getValue().equals(pwCb.getPassword())) {
+ throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
+ }
passwordType.setValue(pwCb.getPassword());
+ } else {
+ nonceVal = null;
+ created = null;
}
- final String password = passwordType.getValue();
+ final String password;
+ if (passwordType != null) {
+ password = passwordType.getValue();
+ } else {
+ password = null;
+ }
final List<QName> elementPath = getElementPath(eventQueue);
final XMLSecEvent responsibleStartXMLEvent = getResponsibleStartXMLEvent(eventQueue, index);
Modified: webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/CallbackHandlerImpl.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/CallbackHandlerImpl.java?rev=1375465&r1=1375464&r2=1375465&view=diff
==============================================================================
--- webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/CallbackHandlerImpl.java (original)
+++ webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/CallbackHandlerImpl.java Tue Aug 21 10:37:18 2012
@@ -101,7 +101,6 @@ public class CallbackHandlerImpl impleme
if (pc.getUsage() == WSPasswordCallback.Usage.DECRYPT
|| pc.getUsage() == WSPasswordCallback.Usage.SIGNATURE
|| pc.getUsage() == WSPasswordCallback.Usage.USERNAME_TOKEN
- || pc.getUsage() == WSPasswordCallback.Usage.USERNAME_TOKEN_UNKNOWN
) {
pc.setPassword(username);
} else if (pc.getUsage() == WSPasswordCallback.Usage.SECRET_KEY
Modified: webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/UsernameTokenTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/UsernameTokenTest.java?rev=1375465&r1=1375464&r2=1375465&view=diff
==============================================================================
--- webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/UsernameTokenTest.java (original)
+++ webservices/wss4j/trunk/streaming-ws-security/src/test/java/org/apache/ws/security/stax/wss/test/UsernameTokenTest.java Tue Aug 21 10:37:18 2012
@@ -173,7 +173,7 @@ public class UsernameTokenTest extends A
StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
Assert.fail("Expected XMLStreamException");
} catch (XMLStreamException e) {
- Assert.assertEquals(e.getMessage(), "org.apache.ws.security.common.ext.WSSecurityException: Wrong username");
+ Assert.assertEquals(e.getMessage(), "org.apache.ws.security.common.ext.WSSecurityException: The security token could not be authenticated or authorized");
}
}
}
@@ -216,42 +216,6 @@ public class UsernameTokenTest extends A
*/
@Test
- public void testInboundUT_SIGN() throws Exception {
- ByteArrayOutputStream baos = new ByteArrayOutputStream();
- {
- InputStream sourceDocument = this.getClass().getClassLoader().getResourceAsStream("testdata/plain-soap-1.1.xml");
- String action = WSHandlerConstants.SIGN_WITH_UT_KEY;
- Properties properties = new Properties();
- Document securedDocument = doOutboundSecurityWithWSS4J(sourceDocument, action, properties);
-
- //some test that we can really sure we get what we want from WSS4J
- NodeList nodeList = securedDocument.getElementsByTagNameNS(WSSConstants.TAG_wsse_UsernameToken.getNamespaceURI(), WSSConstants.TAG_wsse_UsernameToken.getLocalPart());
- Assert.assertEquals(nodeList.item(0).getParentNode().getLocalName(), WSSConstants.TAG_wsse_Security.getLocalPart());
-
- javax.xml.transform.Transformer transformer = TRANSFORMER_FACTORY.newTransformer();
- transformer.transform(new DOMSource(securedDocument), new StreamResult(baos));
- }
-
- //done UsernameToken; now verification:
- {
- WSSSecurityProperties securityProperties = new WSSSecurityProperties();
- securityProperties.setCallbackHandler(new CallbackHandlerImpl());
- securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
- //we have to disable the schema validation until WSS4J-DOM is fixed. WSS4J generates an empty PrefixList which is not schema valid!
- securityProperties.setDisableSchemaValidation(true);
- InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
- XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
-
- Document document = StAX2DOM.readDoc(documentBuilderFactory.newDocumentBuilder(), xmlStreamReader);
-
- //header element must still be there
- NodeList nodeList = document.getElementsByTagNameNS(WSSConstants.TAG_wsse_UsernameToken.getNamespaceURI(), WSSConstants.TAG_wsse_UsernameToken.getLocalPart());
- Assert.assertEquals(nodeList.getLength(), 1);
- Assert.assertEquals(nodeList.item(0).getParentNode().getLocalName(), WSSConstants.TAG_wsse_Security.getLocalPart());
- }
- }
-
- @Test
public void testReusedNonce() throws Exception {
String req = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" +
"<env:Envelope xmlns:env=\"http://schemas.xmlsoap.org/soap/envelope/\">\n" +
Modified: webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/ws/security/common/ext/WSPasswordCallback.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/ws/security/common/ext/WSPasswordCallback.java?rev=1375465&r1=1375464&r2=1375465&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/ws/security/common/ext/WSPasswordCallback.java (original)
+++ webservices/wss4j/trunk/ws-security-common/src/main/java/org/apache/ws/security/common/ext/WSPasswordCallback.java Tue Aug 21 10:37:18 2012
@@ -48,17 +48,6 @@ import javax.security.auth.callback.Call
* this identifier (username) from the keystore. WSS4J uses this private
* key to produce a signature. The signature verification uses the public
* key to verify the signature.</li>
- * <li><code>KEY_NAME</code> - need the <i>key</i>, not the password,
- * associated with the identifier. WSS4J uses this key to encrypt or
- * decrypt parts of the SOAP request. Note, the key must match the
- * symmetric encryption/decryption algorithm specified (refer to
- * {@link org.apache.ws.security.handler.WSHandlerConstants#ENC_SYM_ALGO}).</li>
- * <li><code>USERNAME_TOKEN_UNKNOWN</code> - either an not specified
- * password type or a password type passwordText. In these both cases <b>only</b>
- * the password variable is <b>set</b>. The callback class now may check if
- * the username and password match. If they don't match the callback class must
- * throw an exception. The exception can be a UnsupportedCallbackException or
- * an IOException.</li>
* <li><code>SECURITY_CONTEXT_TOKEN</code> - need the key to to be associated
* with a <code>wsc:SecurityContextToken</code>.</li>
* </ul>
@@ -73,8 +62,6 @@ public class WSPasswordCallback implemen
DECRYPT,
USERNAME_TOKEN,
SIGNATURE,
- KEY_NAME,
- USERNAME_TOKEN_UNKNOWN,
SECURITY_CONTEXT_TOKEN,
CUSTOM_TOKEN,
ENCRYPTED_KEY_TOKEN,