You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by ychawla <pr...@yahoo.com> on 2012/12/20 21:04:15 UTC
WS-Security Policy with Existing SAML Token
Hello All,
I have been following along with this blog to include a SAML token in a wsse
security header from my web service client to the web service:
http://coheigea.blogspot.com/2011/06/ws-securitypolicysaml-sample-in-talend.html
I have implemented a SAML callback handler on the client (and a custom
validator on the service):
<entry key="ws-security.saml-callback-handler"
value-ref="mySamlCallbackHandler"/>
and it reads a SAML token that I received from an STS and intends to pass
this SAML token along to the Web Service.
The SAML callback handler is resigning the SAML token so when the Web
Service receives the token, it is signed by the web service client. My
requirements state that the SAML token should be signed by the STS and not
the web service client.
Is there a way to take my existing SAML token unaltered from the STS reply
message and then use that in the SAML callback handler in the client when
calling the web service?
I did find this post in the discussion list:
http://cxf.547215.n5.nabble.com/Insert-existing-SAML-assertion-td696489.html
But it seems like the SAML Callback Handler mechanism might provide a more
straight forward way to do this.
Thanks,
Yogesh
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Policy-with-Existing-SAML-Token-tp5720608.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Policy with Existing SAML Token
Posted by ychawla <pr...@yahoo.com>.
Hello All,
In your SAML Callback Handler, you can access the CXF message like this:
Message message = PhaseInterceptorChain.getCurrentMessage();
Camel will copy Camel headers to CXF headers. You can set then retrieve any
Camel Header properties from the CXF message inside the callback handler.
Thanks,
Yogesh
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Policy-with-Existing-SAML-Token-tp5720608p5720757.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Policy with Existing SAML Token
Posted by ychawla <pr...@yahoo.com>.
Hi Colm,
Thanks for the response. I am using the SAML Callback Handler to set the
SAML token and it looks like I ran into two specific bugs. The first one is
with the AssertionWrapper trying to remarshall the DOM and then trying to
resign it:
https://issues.apache.org/jira/browse/WSS-390?page=com.atlassian.jirafisheyeplugin:fisheye-issuepanel
and also with a DOM import issue:
https://issues.apache.org/jira/browse/CXF-4612?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel
I have upgraded and that took care of both issues.
I have two other challenges which might be best asked on other lists. My
web service client is Camel based and I am trying to figure out how to
inject camel properties into the SAML Callback Handler so I can retrieve my
token from the message exchange. I will ask this over on the Camel list,
but maybe someone over here has some ideas.
Also, I use ServiceMix 4.4.1 and that version doesn't support the CXF or
WSS4J versions with the bug fixes. Hopefully there will be a new servicemix
release soon.
Thanks again for the help!
-Yogesh
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Policy-with-Existing-SAML-Token-tp5720608p5720725.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Policy with Existing SAML Token
Posted by Colm O hEigeartaigh <co...@apache.org>.
You can call SAMLCallback.setAssertionElement(Element) in your
CallbackHandler implementation with more recent versions of CXF:
http://svn.apache.org/viewvc/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/saml/ext/SAMLCallback.java?view=markup
Colm.
On Wed, Jun 5, 2013 at 12:28 PM, patch_78 <pa...@hotmail.com> wrote:
> Hi,
>
> I am a newbie. I also followed this example
>
>
> http://coheigea.blogspot.com/2011/06/ws-securitypolicysaml-sample-in-talend.html
>
> Can someone please show me source code how to add an existing 'SAML' token
> into the SAML callback ?
>
> (My web application gets an SAML token from an service identity provider
> when a user logins on the web application, and the web application uses
> this
> SAML token in a request to other web services)
>
> patch
>
>
>
>
>
> --
> View this message in context:
> http://cxf.547215.n5.nabble.com/WS-Security-Policy-with-Existing-SAML-Token-tp5720608p5728780.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: WS-Security Policy with Existing SAML Token
Posted by patch_78 <pa...@hotmail.com>.
Hi,
I am a newbie. I also followed this example
http://coheigea.blogspot.com/2011/06/ws-securitypolicysaml-sample-in-talend.html
Can someone please show me source code how to add an existing 'SAML' token
into the SAML callback ?
(My web application gets an SAML token from an service identity provider
when a user logins on the web application, and the web application uses this
SAML token in a request to other web services)
patch
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Policy-with-Existing-SAML-Token-tp5720608p5728780.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Policy with Existing SAML Token
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Yogesh,
Why aren't you just using an IssuedToken policy to get the SAML Token from
the STS? That'll insert the received token automatically in the security
header of the service request.
> Is there a way to take my existing SAML token unaltered from the STS reply
> message and then use that in the SAML callback handler in the client when
> calling the web service?
You could get the received token in your CallbackHandler via the
SecurityConstants.TOKEN tag on the message exchange. Then set the DOM
Element directly on the SAMLCallback object.
Colm.
On Thu, Dec 20, 2012 at 8:04 PM, ychawla <pr...@yahoo.com>wrote:
> Hello All,
> I have been following along with this blog to include a SAML token in a
> wsse
> security header from my web service client to the web service:
>
>
> http://coheigea.blogspot.com/2011/06/ws-securitypolicysaml-sample-in-talend.html
>
> I have implemented a SAML callback handler on the client (and a custom
> validator on the service):
>
> <entry key="ws-security.saml-callback-handler"
> value-ref="mySamlCallbackHandler"/>
>
> and it reads a SAML token that I received from an STS and intends to pass
> this SAML token along to the Web Service.
>
> The SAML callback handler is resigning the SAML token so when the Web
> Service receives the token, it is signed by the web service client. My
> requirements state that the SAML token should be signed by the STS and not
> the web service client.
>
> Is there a way to take my existing SAML token unaltered from the STS reply
> message and then use that in the SAML callback handler in the client when
> calling the web service?
>
> I did find this post in the discussion list:
>
>
> http://cxf.547215.n5.nabble.com/Insert-existing-SAML-assertion-td696489.html
>
> But it seems like the SAML Callback Handler mechanism might provide a more
> straight forward way to do this.
>
> Thanks,
> Yogesh
>
>
>
> --
> View this message in context:
> http://cxf.547215.n5.nabble.com/WS-Security-Policy-with-Existing-SAML-Token-tp5720608.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com