You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by ff...@apache.org on 2024/05/16 17:35:56 UTC
(cxf) branch CXF-9008 updated (bdf7b02c2b -> ce34603c27)
This is an automated email from the ASF dual-hosted git repository.
ffang pushed a change to branch CXF-9008
in repository https://gitbox.apache.org/repos/asf/cxf.git
discard bdf7b02c2b fips support
add f383915d51 CXF-9013: Move performance benchmark to distribution samples folder (#1867)
add cc06da466d Bump io.swagger.core.v3:swagger-jaxrs2-jakarta from 2.2.21 to 2.2.22 (#1877)
add e864b59e95 Bump org.owasp:dependency-check-maven from 9.1.0 to 9.2.0 (#1876)
add 62495cd141 [CXF-9014]1024-bit RSA key (weak) and isn't allowed in modern JDK versions(SignatureWhitespaceTest failure) (#1875)
new ce34603c27 fips support
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (bdf7b02c2b)
\
N -- N -- N refs/heads/CXF-9008 (ce34603c27)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../main/release/samples}/performance/README.txt | 0
.../release/samples}/performance/base/build.xml | 0
.../main/release/samples}/performance/base/pom.xml | 21 +-
.../org/apache/cxf/pat/internal/TestCaseBase.java | 35 ++-
.../org/apache/cxf/pat/internal/TestResult.java | 0
.../org/apache/cxf/pat/internal/TestRunner.java | 0
.../samples}/performance/basic_type/bin/run_client | 0
.../performance/basic_type/bin/run_client.bat | 0
.../samples}/performance/basic_type/bin/run_server | 0
.../performance/basic_type/bin/run_server.bat | 0
.../samples}/performance/basic_type/build.xml | 0
.../cxf/performance/basic_type/client/Client.java | 0
.../cxf/performance/basic_type/server/Server.java | 0
.../performance/basic_type/server/ServerImpl.java | 0
.../performance/basic_type/wsdl/basic_type.wsdl | 0
.../performance/basic_type/wsdl/cxf-servlet.xml | 0
.../performance/complex_type/bin/run_client | 0
.../performance/complex_type/bin/run_client.bat | 0
.../performance/complex_type/bin/run_server | 0
.../performance/complex_type/bin/run_server.bat | 0
.../samples}/performance/complex_type/build.xml | 0
.../performance/complex_type/client/Client.java | 0
.../performance/complex_type/server/Server.java | 0
.../complex_type/server/ServerImpl.java | 0
.../complex_type/wsdl/complex_type.wsdl | 0
.../performance/complex_type/wsdl/cxf-servlet.xml | 0
.../samples}/performance/etc/common_build.xml | 0
.../release/samples/performance/jaxrs/README.txt | 67 +++++
.../main/release/samples/performance/jaxrs/pom.xml | 168 +++++++++++++
.../jaxrs}/src/main/config/KeyREADME.txt | 0
.../jaxrs}/src/main/config/clientKeystore.jks | Bin
.../jaxrs}/src/main/config/serviceKeystore.jks | Bin
.../cxf/performance/https/client/Client.java | 224 +++++++++++++++++
.../cxf/performance/https/common/Customer.java | 43 +---
.../performance/https/common/CustomerService.java | 52 ++++
.../https/server/CustomerServiceImpl.java | 88 +++++++
.../cxf/performance/https}/server/Server.java | 58 ++---
.../jaxrs}/src/main/resources/ClientConfig.xml | 0
.../jaxrs}/src/main/resources/ServerConfig.xml | 0
.../soap_http_doc_lit/bin/run_java_client | 0
.../performance/soap_http_doc_lit/bin/run_server | 0
.../soap_http_doc_lit/bin/run_server.bat | 0
.../performance/soap_http_doc_lit/build.xml | 0
.../performance/soap_http_doc_lit/build_axis.xml | 0
.../performance/soap_http_doc_lit/build_ri.xml | 0
.../samples}/performance/soap_http_doc_lit/pom.xml | 36 ++-
.../performance/complex_type/client/Client.java | 0
.../common/KeystorePasswordCallback.java | 0
.../performance/complex_type/server/Server.java | 0
.../complex_type/server/ServerImpl.java | 0
.../src/main/resources/etc/clientKeystore.jks | Bin
.../main/resources/etc/clientKeystore.properties | 0
.../src/main/resources/etc/https-cfg-client.xml | 0
.../src/main/resources/etc/https-cfg-service.xml | 0
.../src/main/resources/etc/policy-asym.xml | 0
.../src/main/resources/etc/policy-sym.xml | 0
.../src/main/resources/etc/policy-symsc.xml | 0
.../src/main/resources/etc/serviceKeystore.jks | Bin
.../main/resources/etc/serviceKeystore.properties | 0
.../src/main/resources/logging.properties | 0
.../src/main/resources/wsdl/perf.wsdl | 0
.../src/main/resources/wsdl/perf_policy.wsdl | 0
.../src/main/webapp/WEB-INF/cxf-servlet.xml | 0
.../src/main/webapp/WEB-INF/web.xml | 0
distribution/src/main/release/samples/pom.xml | 9 +-
parent/pom.xml | 2 +-
pom.xml | 2 +-
.../cxf/sts/operation/IssueSamlRealmUnitTest.java | 5 +-
.../token/provider/SAMLProviderKeyTypeTest.java | 4 +-
.../src/test/resources/{x509.p12 => x509-fips.p12} | Bin
services/sts/sts-core/src/test/resources/x509.p12 | Bin 1600 -> 1264 bytes
.../cxf/systest/https/conduit/HTTPSClientTest.java | 13 +-
.../https/conduit/{pkcs12.xml => pkcs12-fips.xml} | 8 +-
.../apache/cxf/systest/https/conduit/pkcs12.xml | 6 +-
.../{pkcs12.xml => resource-key-spec-fips.xml} | 26 +-
.../{pkcs12.xml => resource-key-spec-url-fips.xml} | 35 +--
systests/ws-security/pom.xml | 57 +++++
.../org/apache/cxf/systest/ws/wssc/Server.java | 272 ++++++++++++++++++--
.../org/apache/cxf/systest/ws/wssc/StaxServer.java | 274 +++++++++++++++++++--
.../server/MutualCertificate10SignEncryptFips.java | 30 +++
...tualCertificate10SignEncryptRestrictedFips.java | 30 +++
...Certificate10SignEncryptRsa15TripleDesFips.java | 30 +++
...e10SignEncryptRsa15TripleDesRestrictedFips.java | 30 +++
.../cxf/systest/ws/wssec10/server/Server.java | 9 +-
.../cxf/systest/ws/wssec10/server/StaxServer.java | 9 +-
.../wssec10/server/UserNameOverTransportFips.java | 30 +++
.../UserNameOverTransportRestrictedFips.java | 30 +++
.../systest/ws/wssec11/server/AbstractServer.java | 210 ++++++++++++++--
.../wssec11/server/AbstractServerRestricted.java | 202 +++++++++++++--
.../apache/cxf/systest/ws/wssec10/server-fips.xml | 95 +++++++
.../systest/ws/wssec10/server_restricted-fips.xml | 95 +++++++
.../cxf/systest/ws/wssec10/stax-server-fips.xml | 99 ++++++++
.../ws/wssec10/stax-server_restricted-fips.xml | 99 ++++++++
.../wssc/WSSecureConversation-fips.wsdl | 127 ++++++++++
....wsdl => WSSecureConversation_policy-fips.wsdl} | 2 +-
.../wssc/WSSecureConversation_policy.wsdl | 92 +++----
.../wssec10/WsSecurity10-fips.wsdl | 66 +++++
...ecurity10_12_policy_restricted_hashed-fips.wsdl | 79 ++++++
.../WsSecurity10_12_restricted_hashed-fips.wsdl | 60 +++++
...0_policy.wsdl => WsSecurity10_policy-fips.wsdl} | 2 +-
.../wssec10/WsSecurity10_policy.wsdl | 4 +-
...dl => WsSecurity10_policy_restricted-fips.wsdl} | 2 +-
.../wssec10/WsSecurity10_policy_restricted.wsdl | 4 +-
.../wssec10/WsSecurity10_restricted-fips.wsdl | 66 +++++
.../wssec11/WsSecurity11-fips.wsdl | 139 +++++++++++
...1_policy.wsdl => WsSecurity11_policy-fips.wsdl} | 2 +-
.../wssec11/WsSecurity11_policy.wsdl | 34 +--
...dl => WsSecurity11_policy_restricted-fips.wsdl} | 2 +-
.../wssec11/WsSecurity11_policy_restricted.wsdl | 36 +--
.../wssec11/WsSecurity11_restricted-fips.wsdl | 139 +++++++++++
.../resources/keys/{Bethal.p12 => Bethal-fips.p12} | Bin
testutils/src/test/resources/keys/Bethal.p12 | Bin 5581 -> 2540 bytes
.../resources/keys/{Morpit.p12 => Morpit-fips.p12} | Bin
testutils/src/test/resources/keys/Morpit.p12 | Bin 5581 -> 2564 bytes
114 files changed, 3037 insertions(+), 322 deletions(-)
rename {benchmark => distribution/src/main/release/samples}/performance/README.txt (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/base/build.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/base/pom.xml (81%)
rename {benchmark => distribution/src/main/release/samples}/performance/base/src/main/java/org/apache/cxf/pat/internal/TestCaseBase.java (92%)
rename {benchmark => distribution/src/main/release/samples}/performance/base/src/main/java/org/apache/cxf/pat/internal/TestResult.java (100%)
copy {benchmark => distribution/src/main/release/samples}/performance/base/src/main/java/org/apache/cxf/pat/internal/TestRunner.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/bin/run_client (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/bin/run_client.bat (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/bin/run_server (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/bin/run_server.bat (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/build.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/src/org/apache/cxf/performance/basic_type/client/Client.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/src/org/apache/cxf/performance/basic_type/server/Server.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/src/org/apache/cxf/performance/basic_type/server/ServerImpl.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/wsdl/basic_type.wsdl (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/basic_type/wsdl/cxf-servlet.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/bin/run_client (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/bin/run_client.bat (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/bin/run_server (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/bin/run_server.bat (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/build.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/src/org/apache/cxf/performance/complex_type/client/Client.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/src/org/apache/cxf/performance/complex_type/server/Server.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/src/org/apache/cxf/performance/complex_type/server/ServerImpl.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/wsdl/complex_type.wsdl (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/complex_type/wsdl/cxf-servlet.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/etc/common_build.xml (100%)
create mode 100644 distribution/src/main/release/samples/performance/jaxrs/README.txt
create mode 100644 distribution/src/main/release/samples/performance/jaxrs/pom.xml
copy distribution/src/main/release/samples/{jax_rs/basic_https => performance/jaxrs}/src/main/config/KeyREADME.txt (100%)
copy distribution/src/main/release/samples/{jax_rs/basic_https => performance/jaxrs}/src/main/config/clientKeystore.jks (100%)
copy distribution/src/main/release/samples/{jax_rs/basic_https => performance/jaxrs}/src/main/config/serviceKeystore.jks (100%)
create mode 100644 distribution/src/main/release/samples/performance/jaxrs/src/main/java/org/apache/cxf/performance/https/client/Client.java
rename benchmark/performance/base/src/main/java/org/apache/cxf/pat/internal/TestRunner.java => distribution/src/main/release/samples/performance/jaxrs/src/main/java/org/apache/cxf/performance/https/common/Customer.java (52%)
create mode 100644 distribution/src/main/release/samples/performance/jaxrs/src/main/java/org/apache/cxf/performance/https/common/CustomerService.java
create mode 100644 distribution/src/main/release/samples/performance/jaxrs/src/main/java/org/apache/cxf/performance/https/server/CustomerServiceImpl.java
copy {benchmark/performance/soap_http_doc_lit/src/main/java/org/apache/cxf/performance/complex_type => distribution/src/main/release/samples/performance/jaxrs/src/main/java/org/apache/cxf/performance/https}/server/Server.java (51%)
copy distribution/src/main/release/samples/{jax_rs/basic_https => performance/jaxrs}/src/main/resources/ClientConfig.xml (100%)
copy distribution/src/main/release/samples/{jax_rs/basic_https => performance/jaxrs}/src/main/resources/ServerConfig.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/bin/run_java_client (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/bin/run_server (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/bin/run_server.bat (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/build.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/build_axis.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/build_ri.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/pom.xml (93%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/java/org/apache/cxf/performance/complex_type/client/Client.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/java/org/apache/cxf/performance/complex_type/common/KeystorePasswordCallback.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/java/org/apache/cxf/performance/complex_type/server/Server.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/java/org/apache/cxf/performance/complex_type/server/ServerImpl.java (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/clientKeystore.jks (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/clientKeystore.properties (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/https-cfg-client.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/https-cfg-service.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/policy-asym.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/policy-sym.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/policy-symsc.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/serviceKeystore.jks (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/etc/serviceKeystore.properties (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/logging.properties (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/wsdl/perf.wsdl (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/resources/wsdl/perf_policy.wsdl (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/webapp/WEB-INF/cxf-servlet.xml (100%)
rename {benchmark => distribution/src/main/release/samples}/performance/soap_http_doc_lit/src/main/webapp/WEB-INF/web.xml (100%)
copy services/sts/sts-core/src/test/resources/{x509.p12 => x509-fips.p12} (100%)
copy systests/transports/src/test/resources/org/apache/cxf/systest/https/conduit/{pkcs12.xml => pkcs12-fips.xml} (96%)
copy systests/transports/src/test/resources/org/apache/cxf/systest/https/conduit/{pkcs12.xml => resource-key-spec-fips.xml} (75%)
copy systests/transports/src/test/resources/org/apache/cxf/systest/https/conduit/{pkcs12.xml => resource-key-spec-url-fips.xml} (61%)
create mode 100644 systests/ws-security/src/test/java/org/apache/cxf/systest/ws/wssec10/server/MutualCertificate10SignEncryptFips.java
create mode 100644 systests/ws-security/src/test/java/org/apache/cxf/systest/ws/wssec10/server/MutualCertificate10SignEncryptRestrictedFips.java
create mode 100644 systests/ws-security/src/test/java/org/apache/cxf/systest/ws/wssec10/server/MutualCertificate10SignEncryptRsa15TripleDesFips.java
create mode 100644 systests/ws-security/src/test/java/org/apache/cxf/systest/ws/wssec10/server/MutualCertificate10SignEncryptRsa15TripleDesRestrictedFips.java
create mode 100644 systests/ws-security/src/test/java/org/apache/cxf/systest/ws/wssec10/server/UserNameOverTransportFips.java
create mode 100644 systests/ws-security/src/test/java/org/apache/cxf/systest/ws/wssec10/server/UserNameOverTransportRestrictedFips.java
create mode 100644 systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/wssec10/server-fips.xml
create mode 100644 systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/wssec10/server_restricted-fips.xml
create mode 100644 systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/wssec10/stax-server-fips.xml
create mode 100644 systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/wssec10/stax-server_restricted-fips.xml
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssc/WSSecureConversation-fips.wsdl
copy systests/ws-security/src/test/resources/wsdl_systest_wssec/wssc/{WSSecureConversation_policy.wsdl => WSSecureConversation_policy-fips.wsdl} (99%)
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec10/WsSecurity10-fips.wsdl
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec10/WsSecurity10_12_policy_restricted_hashed-fips.wsdl
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec10/WsSecurity10_12_restricted_hashed-fips.wsdl
copy systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec10/{WsSecurity10_policy.wsdl => WsSecurity10_policy-fips.wsdl} (99%)
copy systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec10/{WsSecurity10_policy_restricted.wsdl => WsSecurity10_policy_restricted-fips.wsdl} (99%)
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec10/WsSecurity10_restricted-fips.wsdl
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec11/WsSecurity11-fips.wsdl
copy systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec11/{WsSecurity11_policy.wsdl => WsSecurity11_policy-fips.wsdl} (99%)
copy systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec11/{WsSecurity11_policy_restricted.wsdl => WsSecurity11_policy_restricted-fips.wsdl} (99%)
create mode 100644 systests/ws-security/src/test/resources/wsdl_systest_wssec/wssec11/WsSecurity11_restricted-fips.wsdl
copy testutils/src/test/resources/keys/{Bethal.p12 => Bethal-fips.p12} (100%)
copy testutils/src/test/resources/keys/{Morpit.p12 => Morpit-fips.p12} (100%)
(cxf) 01/01: fips support
Posted by ff...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ffang pushed a commit to branch CXF-9008
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit ce34603c278927de95d8fc2be1cbbd833b1bcfb4
Author: Freeman(Yue) Fang <fr...@gmail.com>
AuthorDate: Tue Jan 23 23:28:16 2024 +0000
fips support
---
.../java/org/apache/cxf/helpers/JavaUtils.java | 7 +
parent/pom.xml | 40 +-
.../utils/DefaultSignatureConstants.java | 5 +-
.../cxf/rs/security/jose/common/JoseConstants.java | 5 +-
.../apache/cxf/rs/security/jose/jwe/JweUtils.java | 7 +-
.../jose/jwe/RSAKeyDecryptionAlgorithm.java | 4 +-
.../jose/jwa/JwaDecryptRfcConformanceTest.java | 9 +
.../jose/jwa/JwaEncryptRfcConformanceTest.java | 8 +
.../jose/jwe/JweCompactReaderWriterTest.java | 108 +-
.../jose/jws/JwsCompactReaderWriterTest.java | 104 +-
.../provider/OAuthServerJoseJwtProducer.java | 5 +-
.../rs/security/xml/AbstractXmlEncInHandler.java | 7 +-
.../cxf/rs/security/xml/EncryptionProperties.java | 4 +-
.../cxf/rs/security/xml/XmlEncOutInterceptor.java | 7 +-
.../cxf/rs/security/xml/XmlSecOutInterceptor.java | 4 +-
.../policy/custom/DefaultAlgorithmSuiteLoader.java | 94 +
.../security/wss4j/CryptoCoverageCheckerTest.java | 12 +
.../ws/security/wss4j/DOMToStaxRoundTripTest.java | 11 +-
.../wss4j/PluggablePolicyValidatorTest.java | 4 +
.../security/wss4j/PolicyBasedWss4JInOutTest.java | 21 +
.../wss4j/StaxCryptoCoverageCheckerTest.java | 14 +-
.../ws/security/wss4j/StaxRoundTripActionTest.java | 25 +-
.../cxf/ws/security/wss4j/StaxRoundTripTest.java | 25 +-
.../wss4j/StaxToDOMEncryptionIdentifierTest.java | 21 +-
.../ws/security/wss4j/StaxToDOMRoundTripTest.java | 43 +-
.../cxf/ws/security/wss4j/WSS4JFaultCodeTest.java | 5 +
.../cxf/ws/security/wss4j/WSS4JInOutTest.java | 12 +-
.../wss4j/WSS4JInOutWithAttachmentsTest.java | 3 +
.../cxf/sts/service/EncryptionProperties.java | 21 +-
.../sts/token/provider/jwt/JWTTokenProvider.java | 4 +-
.../cxf/sts/operation/IssueEncryptedUnitTest.java | 43 +-
.../apache/cxf/sts/operation/IssueSCTUnitTest.java | 5 +-
.../cxf/sts/operation/IssueSamlRealmUnitTest.java | 5 +-
.../cxf/sts/operation/IssueSamlUnitTest.java | 16 +-
.../token/provider/SAMLProviderKeyTypeTest.java | 13 +-
.../sts/sts-core/src/test/resources/x509-fips.p12 | Bin 0 -> 1600 bytes
.../asymmetric_encr/AsymmetricEncryptionTest.java | 9 +-
.../BinarySecurityTokenTest.java | 17 +-
.../cxf/systest/sts/caching/CachingTest.java | 17 +-
.../cxf/systest/sts/caching/ServerCachingTest.java | 21 +-
.../sts/secure_conv/SecureConversationTest.java | 17 +-
.../SecurityContextTokenCancelTest.java | 5 +-
.../secure_conv/SecurityContextTokenUnitTest.java | 9 +-
.../sts_sender_vouches/STSSenderVouchesTest.java | 17 +-
.../systest/sts/asymmetric_encr/cxf-sts-fips.xml | 70 +
.../sts/asymmetric_encr/stax-cxf-sts-fips.xml | 71 +
.../sts/binarysecuritytoken/DoubleIt-fips.wsdl | 146 +
.../sts/binarysecuritytoken/cxf-service-fips.xml | 70 +
.../binarysecuritytoken/stax-cxf-service-fips.xml | 72 +
.../cxf/systest/sts/caching/DoubleIt-fips.wsdl | 308 ++
.../sts/caching/cxf-caching-service-fips.xml | 110 +
.../cxf/systest/sts/caching/cxf-service-fips.xml | 70 +
.../cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl | 336 ++
.../systest/sts/secure_conv/cxf-service-fips.xml | 112 +
.../cxf/systest/sts/secure_conv/cxf-sts-fips.xml | 162 +
.../systest/sts/secure_conv/stax-cxf-sts-fips.xml | 169 +
.../sts/secure_conv/ws-trust-1.4-service-fips.wsdl | 354 ++
.../sts/sts_sender_vouches/DoubleIt-fips.wsdl | 171 +
.../sts/sts_sender_vouches/cxf-service-fips.xml | 37 +
.../sts/sts_sender_vouches/cxf-sts-fips.xml | 68 +
.../sts/sts_sender_vouches/stax-cxf-sts-fips.xml | 69 +
.../ws-trust-1.4-service-fips.wsdl | 248 ++
.../sts/asymmetric/AsymmetricBindingTest.java | 28 +-
.../apache/cxf/systest/sts/issuer/IssuerTest.java | 13 +-
.../cxf/systest/sts/issueunit/IssueUnitTest.java | 6 +-
.../sts/stsclient/AbstractSTSTokenTest.java | 9 +-
.../sts/symmetric/SymmetricBindingTest.java | 36 +-
.../sts/transport/TransportBindingTest.java | 49 +-
.../username_actas/UsernameActAsCachingTest.java | 24 +-
.../sts/username_actas/UsernameActAsTest.java | 15 +-
.../UsernameOnBehalfOfCachingTest.java | 24 +-
.../UsernameOnBehalfOfTest.java | 15 +-
.../sts/x509/X509AsymmetricBindingTest.java | 12 +-
.../systest/sts/x509/X509SymmetricBindingTest.java | 26 +-
.../cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl | 264 ++
.../systest/sts/asymmetric/cxf-service-fips.xml | 59 +
.../sts/asymmetric/cxf-stax-service-fips.xml | 63 +
.../sts/delegation/ws-trust-1.4-service-fips.wsdl | 348 ++
.../systest/sts/deployment/cxf-transport-fips.xml | 56 +
.../sts/deployment/cxf-ut-encrypted-fips.xml | 47 +
.../cxf/systest/sts/deployment/cxf-ut-fips.xml | 36 +
.../cxf/systest/sts/deployment/cxf-x509-fips.xml | 49 +
.../sts/deployment/stax-cxf-transport-fips.xml | 58 +
.../sts/deployment/stax-cxf-ut-encrypted-fips.xml | 48 +
.../systest/sts/deployment/stax-cxf-ut-fips.xml | 37 +
.../systest/sts/deployment/stax-cxf-x509-fips.xml | 50 +
.../systest/sts/deployment/sts/cxf-sts-fips.xml | 105 +
.../sts/deployment/ws-trust-1.4-service-fips.wsdl | 772 ++++
.../cxf/systest/sts/issuer/cxf-client-fips.xml | 81 +
.../sts/issuer/sts-transport-policy-fips.xml | 69 +
.../sts/issuer/ws-trust-1.4-service-fips.wsdl | 326 ++
.../cxf/systest/sts/symmetric/DoubleIt-fips.wsdl | 435 +++
.../cxf/systest/sts/symmetric/cxf-service-fips.xml | 69 +
.../sts/symmetric/cxf-stax-service-fips.xml | 74 +
.../cxf/systest/sts/transport/DoubleIt-fips.wsdl | 605 ++++
.../cxf/systest/sts/transport/cxf-service-fips.xml | 89 +
.../sts/transport/cxf-stax-service-fips.xml | 98 +
.../systest/sts/username_actas/DoubleIt-fips.wsdl | 245 ++
.../sts/username_actas/cxf-service-fips.xml | 90 +
.../sts/username_actas/cxf-service2-fips.xml | 89 +
.../sts/username_onbehalfof/DoubleIt-fips.wsdl | 245 ++
.../sts/username_onbehalfof/cxf-service-fips.xml | 90 +
.../sts/username_onbehalfof/cxf-service2-fips.xml | 89 +
.../apache/cxf/systest/sts/x509/DoubleIt-fips.wsdl | 430 +++
.../systest/sts/x509/DoubleItAsymmetric-fips.wsdl | 159 +
.../sts/x509/cxf-asymmetric-service-fips.xml | 61 +
.../cxf/systest/sts/x509/cxf-service-fips.xml | 92 +
.../cxf/systest/sts/x509/cxf-stax-service-fips.xml | 96 +
.../cxf/systest/jaxrs/security/jose/BookStore.java | 9 +-
.../security/jose/jwejws/BookServerAlgorithms.java | 5 +-
.../jose/jwejws/BookServerHTTPHeaders.java | 5 +-
.../security/jose/jwejws/BookServerJweJson.java | 5 +-
.../security/jose/jwejws/BookServerJwsJson.java | 5 +-
.../jose/jwejws/BookServerJwsMultipart.java | 5 +-
.../jaxrs/security/jose/jwejws/BookServerJwt.java | 5 +-
.../security/jose/jwejws/BookServerReference.java | 5 +-
.../security/jose/jwejws/JAXRSJweJsonTest.java | 9 +-
.../security/jose/jwejws/JAXRSJweJwsTest.java | 63 +-
.../security/jose/jwejws/JAXRSJwsJsonTest.java | 9 +-
.../jose/jwejws/JAXRSJwsMultipartTest.java | 5 +-
.../security/jose/jwejws/JweJwsAlgorithmTest.java | 120 +-
.../security/jose/jwejws/JweJwsReferenceTest.java | 35 +-
.../security/jose/jwejws/JwsHTTPHeaderTest.java | 22 +-
.../security/jose/jwt/BookServerJwtAlgorithms.java | 5 +-
.../security/jose/jwt/BookServerJwtAuthnAuthz.java | 5 +-
.../jaxrs/security/jose/jwt/JWTAlgorithmTest.java | 81 +-
.../jaxrs/security/jose/jwt/JWTAuthnAuthzTest.java | 62 +-
.../oauth2/filters/OAuth2JwtFiltersTest.java | 13 +-
.../oauth2/grants/AuthorizationGrantTest.java | 5 +-
.../security/oauth2/grants/PublicClientTest.java | 5 +-
.../security/oauth2/tls/BookServerOAuth2Tls.java | 5 +-
.../jaxrs/security/oidc/OIDCKeysServiceTest.java | 5 +-
.../jaxrs/security/xml/BookServerXmlSec.java | 5 +-
.../jaxrs/security/xml/JAXRSXmlSecTest.java | 18 +-
.../jaxrs/security/xml/StaxBookServerXmlSec.java | 5 +-
.../jaxrs/security/alice.jwk-fips.properties | 22 +
.../jaxrs/security/alice.jwk.oaep.properties | 22 +
.../jaxrs/security/alice.rs-fips.properties | 23 +
.../systest/jaxrs/security/bob.jwk-fips.properties | 24 +
.../systest/jaxrs/security/bob.rs-fips.properties | 25 +
.../jaxrs/security/certs/jwkPrivateSet-fips.txt | 48 +
.../jaxrs/security/certs/jwkPrivateSet-oaep.txt | 43 +
.../jaxrs/security/certs/jwkPublicSet-fips.txt | 32 +
.../jose/jwejws/algorithms-server-fips.xml | 152 +
.../jose/jwejws/http-headers-server-fips.xml | 79 +
.../security/jose/jwejws/reference-server-fips.xml | 105 +
.../jaxrs/security/jose/jwejws/server-fips.xml | 304 ++
.../security/jose/jwejws/serverJweJson-fips.xml | 88 +
.../security/jose/jwejws/serverJwsJson-fips.xml | 99 +
.../security/jose/jwejws/serverMultipart-fips.xml | 136 +
.../security/jose/jwt/algorithms-server-fips.xml | 179 +
.../security/jose/jwt/authn-authz-server-fips.xml | 127 +
.../jaxrs/security/jwe.direct-fips.properties | 21 +
.../jaxrs/security/jwejson1-fips.properties | 22 +
.../jaxrs/security/jwejson2-fips.properties | 22 +
.../jaxrs/security/jws.ec.private-fips.properties | 20 +
.../jaxrs/security/jws.ec.public-fips.properties | 20 +
.../oauth2/filters/filters-serverJwt-fips.xml | 198 +
.../oauth2/filters/oauth20-serverJwt-fips.xml | 136 +
.../grants/grants-server-jcache-session-fips.xml | 150 +
.../grants/grants-server-public-session-fips.xml | 175 +
.../jaxrs/security/oauth2/tls/serverTls-fips.xml | 245 ++
.../jaxrs/security/oidc/oidc-keys-jcache-fips.xml | 178 +
.../security/secret.aescbchmac-fips.properties | 20 +
.../secret.aescbchmac.inlinejwk-fips.properties | 20 +
.../secret.aescbchmac.inlineset-fips.properties | 20 +
.../jaxrs/security/secret.jwk.hmac-fips.properties | 19 +
.../cxf/systest/jaxrs/security/xml/server-fips.xml | 251 ++
.../jaxrs/security/xml/stax-server-fips.xml | 278 ++
.../cxf/systest/https/conduit/HTTPSClientTest.java | 13 +-
.../cxf/systest/https/conduit/pkcs12-fips.xml | 76 +
.../https/conduit/resource-key-spec-fips.xml | 74 +
.../https/conduit/resource-key-spec-url-fips.xml | 79 +
.../systest/wssec/examples/saml/SamlTokenTest.java | 101 +-
.../cxf/systest/wssec/examples/saml/Server.java | 5 +-
.../systest/wssec/examples/saml/StaxServer.java | 5 +-
.../examples/secconv/SecureConversationTest.java | 5 +-
.../cxf/systest/wssec/examples/secconv/Server.java | 5 +-
.../systest/wssec/examples/secconv/StaxServer.java | 5 +-
.../cxf/systest/wssec/examples/sts/STSServer.java | 5 +-
.../cxf/systest/wssec/examples/ut/Server.java | 5 +-
.../cxf/systest/wssec/examples/ut/StaxServer.java | 5 +-
.../wssec/examples/ut/UsernameTokenTest.java | 29 +-
.../cxf/systest/wssec/examples/x509/Server.java | 5 +-
.../systest/wssec/examples/x509/StaxServer.java | 5 +-
.../systest/wssec/examples/x509/X509TokenTest.java | 17 +-
.../wssec/examples/saml/DoubleItSaml-fips.wsdl | 714 ++++
.../systest/wssec/examples/saml/server-fips.xml | 130 +
.../wssec/examples/saml/stax-server-fips.xml | 140 +
.../examples/secconv/DoubleItSecConv-fips.wsdl | 161 +
.../systest/wssec/examples/secconv/server-fips.xml | 49 +
.../wssec/examples/secconv/stax-server-fips.xml | 50 +
.../wssec/examples/sts/cxf-symmetric-fips.xml | 63 +
.../examples/sts/ws-trust-1.4-service-fips.wsdl | 248 ++
.../systest/wssec/examples/ut/DoubleItUt-fips.wsdl | 431 +++
.../cxf/systest/wssec/examples/ut/server-fips.xml | 95 +
.../systest/wssec/examples/ut/stax-server-fips.xml | 102 +
.../wssec/examples/x509/DoubleItX509-fips.wsdl | 321 ++
.../systest/wssec/examples/x509/server-fips.xml | 76 +
.../wssec/examples/x509/stax-server-fips.xml | 80 +
systests/ws-security/pom.xml | 57 +
.../apache/cxf/systest/ws/action/ActionTest.java | 94 +-
.../org/apache/cxf/systest/ws/action/Server.java | 5 +-
.../systest/ws/algsuite/AlgorithmSuiteTest.java | 25 +-
.../org/apache/cxf/systest/ws/algsuite/Server.java | 5 +-
.../ws/algsuite/StaxAlgorithmSuiteTest.java | 18 +-
.../apache/cxf/systest/ws/algsuite/StaxServer.java | 5 +-
.../systest/ws/basicauth/BasicAuthJAASTest.java | 6 +-
.../cxf/systest/ws/basicauth/BasicAuthTest.java | 13 +-
.../cxf/systest/ws/basicauth/JAASServer.java | 5 +-
.../apache/cxf/systest/ws/basicauth/Server.java | 5 +-
.../systest/ws/bindings/BindingPropertiesTest.java | 45 +-
.../org/apache/cxf/systest/ws/bindings/Server.java | 5 +-
.../apache/cxf/systest/ws/bindings/StaxServer.java | 5 +-
.../apache/cxf/systest/ws/cache/CachingTest.java | 13 +-
.../org/apache/cxf/systest/ws/cache/Server.java | 5 +-
.../DoubleItPortTypeImplJavaFirstFips.java} | 50 +-
.../org/apache/cxf/systest/ws/fault/FaultTest.java | 54 +-
.../systest/ws/fault/ModifiedRequestServer.java | 6 +-
.../cxf/systest/ws/fault/ModifiedRequestTest.java | 44 +-
.../org/apache/cxf/systest/ws/fault/Server.java | 5 +-
.../org/apache/cxf/systest/ws/gcm/GCMTest.java | 17 +-
.../systest/ws/gcm/MGF256AlgorithmSuiteLoader.java | 9 +-
.../org/apache/cxf/systest/ws/gcm/MGFServer.java | 5 +-
.../apache/cxf/systest/ws/gcm/MGFStaxServer.java | 5 +-
.../java/org/apache/cxf/systest/ws/gcm/Server.java | 5 +-
.../org/apache/cxf/systest/ws/gcm/StaxServer.java | 5 +-
.../apache/cxf/systest/ws/httpget/HTTPGetTest.java | 9 +-
.../org/apache/cxf/systest/ws/httpget/Server.java | 5 +-
.../cxf/systest/ws/https/HttpsTokenTest.java | 17 +-
.../org/apache/cxf/systest/ws/https/Server.java | 5 +-
.../apache/cxf/systest/ws/https/StaxServer.java | 6 +-
.../cxf/systest/ws/mtom/MTOMSecurityTest.java | 41 +-
.../org/apache/cxf/systest/ws/mtom/Server.java | 5 +-
.../org/apache/cxf/systest/ws/mtom/StaxServer.java | 5 +-
.../org/apache/cxf/systest/ws/parts/PartsTest.java | 45 +-
.../org/apache/cxf/systest/ws/parts/Server.java | 5 +-
.../apache/cxf/systest/ws/parts/StaxServer.java | 5 +-
.../ws/password/PasswordPropertiesTest.java | 13 +-
.../org/apache/cxf/systest/ws/password/Server.java | 5 +-
.../systest/ws/policy/JavaFirstPolicyServer.java | 6 +-
.../systest/ws/policy/PolicyAlternativeTest.java | 29 +-
.../org/apache/cxf/systest/ws/policy/Server.java | 5 +-
.../ws/policy/operation/PolicyOperationTest.java | 9 +-
.../cxf/systest/ws/policy/operation/Server.java | 5 +-
.../apache/cxf/systest/ws/saml/SamlTokenTest.java | 217 +-
.../org/apache/cxf/systest/ws/saml/Server.java | 5 +-
.../org/apache/cxf/systest/ws/saml/StaxServer.java | 5 +-
.../systest/ws/security/SecurityPolicyTest.java | 112 +-
.../org/apache/cxf/systest/ws/security/Server.java | 6 +-
.../apache/cxf/systest/ws/security/StaxServer.java | 6 +-
.../systest/ws/security/WSSecurityClientTest.java | 5 +-
.../apache/cxf/systest/ws/swa/PolicyServer.java | 5 +-
.../apache/cxf/systest/ws/swa/SWAActionTest.java | 21 +-
.../apache/cxf/systest/ws/swa/SWAPolicyTest.java | 29 +-
.../java/org/apache/cxf/systest/ws/swa/Server.java | 5 +-
.../cxf/systest/ws/swa/StaxPolicyServer.java | 6 +-
.../apache/cxf/systest/ws/tokens/BSTServer.java | 5 +-
.../systest/ws/tokens/BinarySecurityTokenTest.java | 5 +-
.../cxf/systest/ws/tokens/EndorsingServer.java | 5 +-
.../ws/tokens/EndorsingSupportingTokenTest.java | 9 +-
.../org/apache/cxf/systest/ws/tokens/Server.java | 5 +-
.../cxf/systest/ws/tokens/StaxEndorsingServer.java | 5 +-
.../apache/cxf/systest/ws/tokens/StaxServer.java | 5 +-
.../cxf/systest/ws/tokens/SupportingTokenTest.java | 17 +-
.../apache/cxf/systest/ws/tokens/TLSServer.java | 5 +-
.../cxf/systest/ws/tokens/TLSStaxServer.java | 5 +-
.../org/apache/cxf/systest/ws/ut/PolicyServer.java | 5 +-
.../java/org/apache/cxf/systest/ws/ut/Server.java | 5 +-
.../apache/cxf/systest/ws/ut/ServerDerived.java | 5 +-
.../apache/cxf/systest/ws/ut/StaxPolicyServer.java | 5 +-
.../org/apache/cxf/systest/ws/ut/StaxServer.java | 5 +-
.../systest/ws/ut/UsernameTokenDerivedTest.java | 29 +-
.../cxf/systest/ws/ut/UsernameTokenPolicyTest.java | 21 +-
.../cxf/systest/ws/ut/UsernameTokenTest.java | 122 +-
.../org/apache/cxf/systest/ws/wssc/Server.java | 272 +-
.../org/apache/cxf/systest/ws/wssc/StaxServer.java | 274 +-
.../org/apache/cxf/systest/ws/wssc/UnitServer.java | 5 +-
.../apache/cxf/systest/ws/wssc/WSSCUnitTest.java | 17 +-
.../WSSecurity10CustomAlgorithmSuiteTest.java | 5 +-
.../cxf/systest/ws/wssec10/WSSecurity10Test.java | 57 +-
.../server/MutualCertificate10SignEncryptFips.java | 18 +-
...tualCertificate10SignEncryptRestrictedFips.java | 18 +-
...Certificate10SignEncryptRsa15TripleDesFips.java | 18 +-
...e10SignEncryptRsa15TripleDesRestrictedFips.java | 18 +-
.../cxf/systest/ws/wssec10/server/Server.java | 9 +-
.../wssec10/server/ServerCustomAlgorithmSuite.java | 5 +-
.../cxf/systest/ws/wssec10/server/StaxServer.java | 9 +-
.../server/StaxServerCustomAlgorithmSuite.java | 6 +-
.../wssec10/server/UserNameOverTransportFips.java | 18 +-
.../UserNameOverTransportRestrictedFips.java | 18 +-
.../cxf/systest/ws/wssec11/WSSecurity112Test.java | 101 +-
.../systest/ws/wssec11/server/AbstractServer.java | 210 +-
.../wssec11/server/AbstractServerRestricted.java | 202 +-
.../systest/ws/x509/DoubleItIntermediaryImpl.java | 5 +-
.../apache/cxf/systest/ws/x509/Intermediary.java | 5 +-
.../cxf/systest/ws/x509/SHA512PolicyLoader.java | 100 +-
.../org/apache/cxf/systest/ws/x509/Server.java | 5 +-
.../org/apache/cxf/systest/ws/x509/StaxServer.java | 5 +-
.../apache/cxf/systest/ws/x509/X509TokenTest.java | 422 ++-
.../org/apache/cxf/systest/ws/xkms/Server.java | 5 +-
.../org/apache/cxf/systest/ws/xkms/StaxServer.java | 5 +-
.../org/apache/cxf/systest/ws/xkms/XKMSTest.java | 9 +-
.../src/test/resources/alice-enc-fips.properties | 21 +
.../src/test/resources/bob-enc-fips.properties | 21 +
.../ws/action/DoubleItActionPolicy-fips.wsdl | 177 +
.../apache/cxf/systest/ws/action/client-fips.xml | 396 ++
.../apache/cxf/systest/ws/action/server-fips.xml | 342 ++
.../apache/cxf/systest/ws/algsuite/client-fips.xml | 361 ++
.../apache/cxf/systest/ws/algsuite/server-fips.xml | 384 ++
.../cxf/systest/ws/algsuite/stax-server-fips.xml | 185 +
.../ws/basicauth/DoubleItBasicAuth-fips.wsdl | 75 +
.../ws/basicauth/server-continuation-fips.xml | 60 +
.../cxf/systest/ws/basicauth/server-fips.xml | 65 +
.../cxf/systest/ws/bindings/clean-policy-fips.xml | 40 +
.../apache/cxf/systest/ws/bindings/client-fips.xml | 350 ++
.../encrypt-before-signing-policy-fips.xml | 41 +
.../ws/bindings/encrypt-sig-policy-fips.xml | 41 +
.../ws/bindings/include-timestamp-policy-fips.xml | 41 +
.../systest/ws/bindings/only-sign-policy-fips.xml | 41 +
.../ws/bindings/protect-tokens-policy-fips.xml | 41 +
.../apache/cxf/systest/ws/bindings/server-fips.xml | 315 ++
.../sig-conf-enc-before-signing-policy-fips.xml | 46 +
.../systest/ws/bindings/sig-conf-policy-fips.xml | 45 +
.../sign-before-encrypting-policy-fips.xml | 41 +
.../cxf/systest/ws/bindings/stax-server-fips.xml | 336 ++
.../cxf/systest/ws/bindings/strict-policy-fips.xml | 41 +
.../systest/ws/bindings/ts-first-policy-fips.xml | 41 +
.../systest/ws/bindings/ts-last-policy-fips.xml | 41 +
.../cxf/systest/ws/cache/DoubleItCache-fips.wsdl | 108 +
.../apache/cxf/systest/ws/cache/server-fips.xml | 56 +
.../cxf/systest/ws/fault/DoubleItFault-fips.wsdl | 295 ++
.../systest/ws/fault/SymmetricUTPolicy-fips.xml | 42 +
.../apache/cxf/systest/ws/fault/client-fips.xml | 182 +
.../cxf/systest/ws/fault/client-untrusted-fips.xml | 44 +
.../cxf/systest/ws/fault/modified-server-fips.xml | 60 +
.../apache/cxf/systest/ws/fault/server-fips.xml | 123 +
.../cxf/systest/ws/gcm/DoubleItGCM-fips.wsdl | 353 ++
.../apache/cxf/systest/ws/gcm/mgf-server-fips.xml | 61 +
.../cxf/systest/ws/gcm/mgf-stax-server-fips.xml | 64 +
.../org/apache/cxf/systest/ws/gcm/server-fips.xml | 66 +
.../apache/cxf/systest/ws/gcm/stax-server-fips.xml | 69 +
.../systest/ws/httpget/DoubleItHTTPGet-fips.wsdl | 119 +
.../apache/cxf/systest/ws/httpget/server-fips.xml | 61 +
.../systest/ws/https/basic-auth-policy-fips.xml | 31 +
.../cxf/systest/ws/https/clean-policy-fips.xml | 29 +
.../apache/cxf/systest/ws/https/client-fips.xml | 148 +
.../systest/ws/https/digest-auth-policy-fips.xml | 31 +
.../cxf/systest/ws/https/nochild-policy-fips.xml | 27 +
.../ws/https/req-client-cert-policy-fips.xml | 31 +
.../apache/cxf/systest/ws/https/server-fips.xml | 107 +
.../cxf/systest/ws/https/stax-server-fips.xml | 128 +
.../cxf/systest/ws/mtom/DoubleItMtom-fips.wsdl | 312 ++
.../org/apache/cxf/systest/ws/mtom/server-fips.xml | 184 +
.../cxf/systest/ws/mtom/stax-server-fips.xml | 69 +
.../cxf/systest/ws/parts/addr-policy-fips.xml | 44 +
.../ws/parts/bad-req-elements-policy-fips.xml | 47 +
.../systest/ws/parts/bad-req-parts-policy-fips.xml | 47 +
.../apache/cxf/systest/ws/parts/client-fips.xml | 355 ++
.../content-encrypted-elements-policy-fips.xml | 47 +
.../ws/parts/encrypted-addr-policy-fips.xml | 47 +
.../ws/parts/encrypted-attachments-policy-fips.xml | 48 +
.../ws/parts/encrypted-body-policy-fips.xml | 47 +
.../ws/parts/encrypted-elements-policy-fips.xml | 47 +
.../ws/parts/encrypted-parts-policy-fips.xml | 48 +
.../multiple-encrypted-elements-policy-fips.xml | 48 +
.../systest/ws/parts/req-elements-policy-fips.xml | 47 +
.../cxf/systest/ws/parts/req-parts-policy-fips.xml | 47 +
.../apache/cxf/systest/ws/parts/server-fips.xml | 344 ++
.../systest/ws/parts/signed-addr-policy-fips.xml | 44 +
.../ws/parts/signed-attachments-policy-fips.xml | 45 +
.../systest/ws/parts/signed-body-policy-fips.xml | 44 +
.../ws/parts/signed-elements-policy-fips.xml | 44 +
.../systest/ws/parts/signed-parts-policy-fips.xml | 45 +
.../cxf/systest/ws/parts/stax-server-fips.xml | 349 ++
.../systest/ws/password/DoubleItPassword-fips.wsdl | 194 +
.../apache/cxf/systest/ws/password/server-fips.xml | 75 +
.../cxf/systest/ws/policy/client-bus-fips.xml | 95 +
.../apache/cxf/systest/ws/policy/client-fips.xml | 265 ++
.../cxf/systest/ws/policy/javafirstserver-fips.xml | 235 ++
.../operation/DoubleItPolicyOperation-fips.wsdl | 101 +
.../systest/ws/policy/operation/server-fips.xml | 45 +
.../apache/cxf/systest/ws/policy/server-fips.xml | 260 ++
.../cxf/systest/ws/saml/DoubleItSaml-fips.wsdl | 1210 +++++++
.../cxf/systest/ws/saml/clean-asym-policy-fips.xml | 55 +
.../cxf/systest/ws/saml/clean-tls-policy-fips.xml | 29 +
.../org/apache/cxf/systest/ws/saml/client-fips.xml | 242 ++
.../cxf/systest/ws/saml/saml1-tls-policy-fips.xml | 38 +
.../cxf/systest/ws/saml/saml2-asym-policy-fips.xml | 58 +
.../org/apache/cxf/systest/ws/saml/server-fips.xml | 310 ++
.../cxf/systest/ws/saml/stax-server-fips.xml | 338 ++
.../subjectconf/DoubleItSamlSubjectConf-fips.wsdl | 109 +
.../systest/ws/saml/subjectconf/server-fips.xml | 68 +
.../ws/saml/subjectconf/stax-server-fips.xml | 70 +
.../cxf/systest/ws/security/DoubleIt-fips.wsdl | 922 +++++
.../apache/cxf/systest/ws/security/client-fips.xml | 78 +
.../apache/cxf/systest/ws/security/server-fips.xml | 114 +
.../cxf/systest/ws/security/stax-server-fips.xml | 114 +
.../cxf/systest/ws/swa/DoubleItSwa-fips.wsdl | 392 ++
.../cxf/systest/ws/swa/policy-server-fips.xml | 117 +
.../org/apache/cxf/systest/ws/swa/server-fips.xml | 192 +
.../cxf/systest/ws/swa/stax-policy-server-fips.xml | 124 +
.../cxf/systest/ws/tokens/bst-server-fips.xml | 44 +
.../apache/cxf/systest/ws/tokens/client-fips.xml | 184 +
.../ws/tokens/encrypted-supp-token-policy-fips.xml | 40 +
.../systest/ws/tokens/endorsing-client-fips.xml | 124 +
.../systest/ws/tokens/endorsing-server-fips.xml | 119 +
.../endorsing-x509-supp-token-policy-fips.xml | 40 +
.../apache/cxf/systest/ws/tokens/server-fips.xml | 158 +
.../signed-encrypted-supp-token-policy-fips.xml | 40 +
...igned-endorsing-x509-supp-token-policy-fips.xml | 40 +
.../ws/tokens/signed-supp-token-policy-fips.xml | 40 +
.../tokens/signed-x509-supp-token-policy-fips.xml | 40 +
.../ws/tokens/stax-endorsing-server-fips.xml | 125 +
.../cxf/systest/ws/tokens/stax-server-fips.xml | 167 +
.../systest/ws/tokens/supp-token-policy-fips.xml | 40 +
.../cxf/systest/ws/tokens/tls-client-fips.xml | 73 +
.../cxf/systest/ws/tokens/tls-server-fips.xml | 80 +
.../cxf/systest/ws/tokens/tls-stax-server-fips.xml | 82 +
.../ws/tokens/x509-supp-token-policy-fips.xml | 40 +
.../apache/cxf/systest/ws/ut/DoubleItUt-fips.wsdl | 579 +++
.../cxf/systest/ws/ut/DoubleItUtDerived-fips.wsdl | 462 +++
.../apache/cxf/systest/ws/ut/clean-policy-fips.xml | 28 +
.../org/apache/cxf/systest/ws/ut/client-fips.xml | 215 ++
.../cxf/systest/ws/ut/created-policy-fips.xml | 38 +
.../cxf/systest/ws/ut/hash-pass-policy-fips.xml | 37 +
.../cxf/systest/ws/ut/no-pass-policy-fips.xml | 37 +
.../apache/cxf/systest/ws/ut/nonce-policy-fips.xml | 38 +
.../systest/ws/ut/plaintext-pass-policy-fips.xml | 37 +
.../ws/ut/plaintext-pass-timestamp-policy-fips.xml | 38 +
.../cxf/systest/ws/ut/policy-client-fips.xml | 184 +
.../cxf/systest/ws/ut/policy-server-fips.xml | 183 +
.../cxf/systest/ws/ut/server-derived-fips.xml | 98 +
.../org/apache/cxf/systest/ws/ut/server-fips.xml | 220 ++
.../cxf/systest/ws/ut/stax-policy-server-fips.xml | 196 +
.../apache/cxf/systest/ws/ut/stax-server-fips.xml | 233 ++
.../cxf/systest/ws/ut/supp-token-policy-fips.xml | 37 +
.../cxf/systest/ws/wssc/DoubleItWSSC-fips.wsdl | 369 ++
.../cxf/systest/ws/wssc/unit-server-fips.xml | 68 +
.../wssec10/client_customAlgorithmSuite-fips.xml | 89 +
.../apache/cxf/systest/ws/wssec10/server-fips.xml | 95 +
.../wssec10/server_customAlgorithmSuite-fips.xml | 112 +
.../systest/ws/wssec10/server_restricted-fips.xml | 95 +
.../cxf/systest/ws/wssec10/stax-server-fips.xml | 99 +
.../stax-server_customAlgorithmSuite-fips.xml | 116 +
.../ws/wssec10/stax-server_restricted-fips.xml | 99 +
.../systest/ws/x509/DoubleItOperations-fips.wsdl | 116 +
.../cxf/systest/ws/x509/DoubleItX509-fips.wsdl | 2099 +++++++++++
.../ws/x509/DoubleItX509Addressing-fips.wsdl | 103 +
.../ws/x509/DoubleItX509Signature-fips.wsdl | 388 ++
.../cxf/systest/ws/x509/clean-policy-fips.xml | 29 +
.../org/apache/cxf/systest/ws/x509/client-fips.xml | 471 +++
.../systest/ws/x509/end-supp-token-policy-fips.xml | 36 +
.../cxf/systest/ws/x509/intermediary-fips.xml | 53 +
.../cxf/systest/ws/x509/jaxws-client-fips.xml | 48 +
.../org/apache/cxf/systest/ws/x509/server-fips.xml | 433 +++
.../cxf/systest/ws/x509/stax-server-fips.xml | 484 +++
.../systest/ws/x509/supp-token-pki-policy-fips.xml | 38 +
.../cxf/systest/ws/x509/supp-token-policy-fips.xml | 36 +
.../cxf/systest/ws/xkms/DoubleItXKMS-fips.wsdl | 187 +
.../org/apache/cxf/systest/ws/xkms/server-fips.xml | 55 +
.../cxf/systest/ws/xkms/stax-server-fips.xml | 57 +
.../wssc/WSSecureConversation-fips.wsdl | 127 +
.../wssc/WSSecureConversation_policy-fips.wsdl | 3811 ++++++++++++++++++++
.../wssec10/WsSecurity10-fips.wsdl | 66 +
...ecurity10_12_policy_restricted_hashed-fips.wsdl | 79 +
.../WsSecurity10_12_restricted_hashed-fips.wsdl | 60 +
.../wssec10/WsSecurity10_policy-fips.wsdl | 326 ++
.../WsSecurity10_policy_restricted-fips.wsdl | 325 ++
.../wssec10/WsSecurity10_restricted-fips.wsdl | 66 +
.../wssec11/WsSecurity11-fips.wsdl | 139 +
.../wssec11/WsSecurity11_policy-fips.wsdl | 2052 +++++++++++
.../WsSecurity11_policy_restricted-fips.wsdl | 2052 +++++++++++
.../wssec11/WsSecurity11_restricted-fips.wsdl | 139 +
testutils/src/test/resources/keys/Bethal-fips.p12 | Bin 0 -> 5581 bytes
testutils/src/test/resources/keys/Morpit-fips.p12 | Bin 0 -> 5581 bytes
476 files changed, 51612 insertions(+), 1055 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/helpers/JavaUtils.java b/core/src/main/java/org/apache/cxf/helpers/JavaUtils.java
index 04462d0714..6ec3b8a92b 100644
--- a/core/src/main/java/org/apache/cxf/helpers/JavaUtils.java
+++ b/core/src/main/java/org/apache/cxf/helpers/JavaUtils.java
@@ -51,10 +51,13 @@ public final class JavaUtils {
private static boolean isJava11Compatible;
private static boolean isJava9Compatible;
private static boolean isJava8Before161;
+ private static boolean isFIPSEnabled;
private static Integer javaMajorVersion;
+ private static final String FIPS_ENABLED = "fips.enabled";
static {
String version = SystemPropertyAction.getProperty("java.version");
+ isFIPSEnabled = Boolean.valueOf(SystemPropertyAction.getProperty(FIPS_ENABLED));
try {
isJava8Before161 = version.startsWith("1.8.0_")
&& Integer.parseInt(version.substring(6)) < 161;
@@ -114,6 +117,10 @@ public final class JavaUtils {
public static boolean isJava8Before161() {
return isJava8Before161;
}
+
+ public static boolean isFIPSEnabled() {
+ return isFIPSEnabled;
+ }
public static void setJavaMajorVersion(Integer javaMajorVersion) {
JavaUtils.javaMajorVersion = javaMajorVersion;
diff --git a/parent/pom.xml b/parent/pom.xml
index eb03474f7b..80311d21e1 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -236,7 +236,7 @@
<cxf.woodstox.core.version>6.6.2</cxf.woodstox.core.version>
<cxf.woodstox.stax2-api.version>4.2.1</cxf.woodstox.stax2-api.version>
<cxf.wsdl4j.version>1.6.3</cxf.wsdl4j.version>
- <cxf.jakarta.wss4j.version>3.0.3</cxf.jakarta.wss4j.version>
+ <cxf.jakarta.wss4j.version>3.0.4-SNAPSHOT</cxf.jakarta.wss4j.version>
<cxf.xmlschema.version>2.3.1</cxf.xmlschema.version>
<cxf.xnio.version>3.8.14.Final</cxf.xnio.version>
<cxf.zest.version>2.1</cxf.zest.version>
@@ -487,7 +487,7 @@
<parallel>${cxf.surefire.parallel.mode}</parallel>
<forkNode implementation="org.apache.maven.plugin.surefire.extensions.SurefireForkNodeFactory" />
<rerunFailingTestsCount>${cxf.surefire.rerun.count}</rerunFailingTestsCount>
- <systemPropertyVariables>
+ <systemPropertyVariables>
<java.io.tmpdir>${basedir}/target</java.io.tmpdir>
<cxf.useRandomFirstPort>true</cxf.useRandomFirstPort>
<org.apache.cxf.JDKBugHacks.all>true</org.apache.cxf.JDKBugHacks.all>
@@ -501,7 +501,6 @@
<server.launcher.vmargs>${cxf.server.launcher.vmargs}</server.launcher.vmargs>
<org.apache.cxf.transport.http.async.usePolicy>ASYNC_ONLY</org.apache.cxf.transport.http.async.usePolicy>
<org.apache.cxf.transport.websocket.atmosphere.disabled>${org.apache.cxf.transport.websocket.atmosphere.disabled}</org.apache.cxf.transport.websocket.atmosphere.disabled>
- <org.apache.xml.security.securerandom.algorithm>SHA1PRNG</org.apache.xml.security.securerandom.algorithm>
</systemPropertyVariables>
</configuration>
</plugin>
@@ -2267,7 +2266,7 @@
<configuration>
<systemPropertyVariables>
<!-- https://github.com/bcgit/bc-java/issues/589 -->
- <jdk.tls.namedGroups>secp256r1,secp384r1,secp521r1,sect283k1,sect283r1,sect409k1,sect409r1,sect571k1,sect571r1,secp256k1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192</jdk.tls.namedGroups>
+ <jdk.tls.namedGroups>secp256r1,secp384r1,secp521r1,sect283k1,sect283r1,sect409k1,sect409r1,sect571k1,sect571r1,secp256k1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192</jdk.tls.namedGroups>
</systemPropertyVariables>
</configuration>
</plugin>
@@ -2284,5 +2283,38 @@
<cxf.surefire.fork.vmargs>-ea --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.net=ALL-UNNAMED --add-opens java.base/sun.net.www.protocol.https=ALL-UNNAMED</cxf.surefire.fork.vmargs>
</properties>
</profile>
+ <profile>
+ <id>fips</id>
+ <activation>
+ <property>
+ <name>fips.enabled</name>
+ </property>
+ </activation>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-surefire-plugin</artifactId>
+ <configuration>
+ <systemPropertyVariables>
+ <org.apache.xml.security.securerandom.algorithm>PKCS11</org.apache.xml.security.securerandom.algorithm>
+ <fips.enabled>true</fips.enabled>
+ </systemPropertyVariables>
+ <excludes>
+ <!--fips: need to regenerate keys for systests/microprofile/client/weld tests which are out of CXF codebase-->
+ <exclude>**/SslContextTest.java</exclude>
+ <exclude>**/SslHostnameVerifierTest.java</exclude>
+ <exclude>**/SslMutualTest.java</exclude>
+ <exclude>**/SslTrustStoreTest.java</exclude>
+ <!--fips: Kerberos are not supported on fips mode -->
+ <exclude>**/JAXRSKerberosBookTest.java</exclude>
+ <exclude>**/KerberosTokenTest.java</exclude>
+ <exclude>**/SpnegoTokenTest.java</exclude>
+ </excludes>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+ </profile>
</profiles>
</project>
diff --git a/rt/rs/security/http-signature/src/main/java/org/apache/cxf/rs/security/httpsignature/utils/DefaultSignatureConstants.java b/rt/rs/security/http-signature/src/main/java/org/apache/cxf/rs/security/httpsignature/utils/DefaultSignatureConstants.java
index ac1bf39b3a..44d84b5900 100644
--- a/rt/rs/security/http-signature/src/main/java/org/apache/cxf/rs/security/httpsignature/utils/DefaultSignatureConstants.java
+++ b/rt/rs/security/http-signature/src/main/java/org/apache/cxf/rs/security/httpsignature/utils/DefaultSignatureConstants.java
@@ -18,10 +18,13 @@
*/
package org.apache.cxf.rs.security.httpsignature.utils;
+import org.apache.cxf.helpers.JavaUtils;
+
public final class DefaultSignatureConstants {
public static final String SIGNING_ALGORITHM = "rsa-sha256";
public static final String DIGEST_ALGORITHM = "SHA-256";
- public static final String SECURITY_PROVIDER = "SunRsaSign";
+ public static final String SECURITY_PROVIDER
+ = JavaUtils.isFIPSEnabled() ? "SunPKCS11-NSS-FIPS" : "SunRsaSign";
private DefaultSignatureConstants() { }
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
index 092581d3fd..42e375b4b2 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/common/JoseConstants.java
@@ -135,8 +135,9 @@ public final class JoseConstants extends RSSecurityConstants {
public static final String RSSEC_ENCRYPTION_CONTENT_ALGORITHM = "rs.security.encryption.content.algorithm";
/**
- * The encryption key algorithm to use. The default algorithm if not specified is 'RSA-OAEP' if the key is an
- * RSA key, and 'A128GCMKW' if it is an octet sequence.
+ * The encryption key algorithm to use. The default algorithm if not specified is 'RSA-OAEP'
+ * (or RSA1_5 in FIPS mode)
+ * if the key is an RSA key, and 'A128GCMKW' if it is an octet sequence.
*/
public static final String RSSEC_ENCRYPTION_KEY_ALGORITHM = "rs.security.encryption.key.algorithm";
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
index 67d6cb6af3..e4815ecd2d 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/JweUtils.java
@@ -43,6 +43,7 @@ import javax.crypto.SecretKey;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.message.MessageUtils;
import org.apache.cxf.phase.PhaseInterceptorChain;
@@ -186,7 +187,7 @@ public final class JweUtils {
}
private static KeyAlgorithm getDefaultPublicKeyAlgorithm(PublicKey key) {
if (key instanceof RSAPublicKey) {
- return KeyAlgorithm.RSA_OAEP;
+ return JavaUtils.isFIPSEnabled() ? KeyAlgorithm.RSA1_5 : KeyAlgorithm.RSA_OAEP;
} else if (key instanceof ECPublicKey) {
return KeyAlgorithm.ECDH_ES_A128KW;
} else {
@@ -195,7 +196,7 @@ public final class JweUtils {
}
private static KeyAlgorithm getDefaultPrivateKeyAlgorithm(PrivateKey key) {
if (key instanceof RSAPrivateKey) {
- return KeyAlgorithm.RSA_OAEP;
+ return JavaUtils.isFIPSEnabled() ? KeyAlgorithm.RSA1_5 : KeyAlgorithm.RSA_OAEP;
} else if (key instanceof ECPrivateKey) {
return KeyAlgorithm.ECDH_ES_A128KW;
} else {
@@ -937,7 +938,7 @@ public final class JweUtils {
if (KeyType.OCTET == keyType) {
return KeyAlgorithm.A128GCMKW;
} else if (KeyType.RSA == keyType) {
- return KeyAlgorithm.RSA_OAEP;
+ return JavaUtils.isFIPSEnabled() ? KeyAlgorithm.RSA1_5 : KeyAlgorithm.RSA_OAEP;
} else {
return KeyAlgorithm.ECDH_ES_A128KW;
}
diff --git a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/RSAKeyDecryptionAlgorithm.java b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/RSAKeyDecryptionAlgorithm.java
index db0bc6b29f..b6bac17429 100644
--- a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/RSAKeyDecryptionAlgorithm.java
+++ b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/RSAKeyDecryptionAlgorithm.java
@@ -20,12 +20,14 @@ package org.apache.cxf.rs.security.jose.jwe;
import java.security.interfaces.RSAPrivateKey;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rs.security.jose.jwa.AlgorithmUtils;
import org.apache.cxf.rs.security.jose.jwa.KeyAlgorithm;
public class RSAKeyDecryptionAlgorithm extends WrappedKeyDecryptionAlgorithm {
public RSAKeyDecryptionAlgorithm(RSAPrivateKey privateKey) {
- this(privateKey, KeyAlgorithm.RSA_OAEP);
+ this(privateKey, JavaUtils.isFIPSEnabled()
+ ? KeyAlgorithm.RSA1_5 : KeyAlgorithm.RSA_OAEP);
}
public RSAKeyDecryptionAlgorithm(RSAPrivateKey privateKey, KeyAlgorithm supportedAlgo) {
this(privateKey, supportedAlgo, true);
diff --git a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
index 49a150a9d3..8bb9f93011 100644
--- a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
+++ b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
@@ -18,6 +18,9 @@
*/
package org.apache.cxf.rs.security.jose.jwa;
+import org.apache.cxf.helpers.JavaUtils;
+
+import org.junit.Assume;
import org.junit.Test;
public abstract class JwaDecryptRfcConformanceTest extends AbstractDecryptTest {
@@ -39,16 +42,22 @@ public abstract class JwaDecryptRfcConformanceTest extends AbstractDecryptTest {
@Test
public void testRsaOaepA128GcmJweCompact() throws Exception {
+ //fips: no RSA-OAEP support
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
test("/jwe/rsa.2048.rsa-oaep.a128gcm.compact.jwe");
}
@Test
public void testRsaOaepA128GcmJweJsonFlattened() throws Exception {
+ //fips: no RSA-OAEP support
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
test("/jwe/rsa.2048.rsa-oaep.a128gcm.json.flattened.jwe");
}
@Test
public void testRsaOaepA128GcmJweJson() throws Exception {
+ //fips: no RSA-OAEP support
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
test("/jwe/rsa.2048.rsa-oaep.a128gcm.json.jwe");
}
diff --git a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaEncryptRfcConformanceTest.java b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaEncryptRfcConformanceTest.java
index 92f32199b7..8387ce1d5e 100644
--- a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaEncryptRfcConformanceTest.java
+++ b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaEncryptRfcConformanceTest.java
@@ -18,8 +18,10 @@
*/
package org.apache.cxf.rs.security.jose.jwa;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rs.security.jose.support.Serialization;
+import org.junit.Assume;
import org.junit.Test;
public abstract class JwaEncryptRfcConformanceTest extends AbstractEncryptTest {
@@ -41,16 +43,22 @@ public abstract class JwaEncryptRfcConformanceTest extends AbstractEncryptTest {
@Test
public void testRsaOaepA128GcmJweCompact() throws Exception {
+ //fips: no RSA-OAEP support
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
test("RSA", "RSA-OAEP", "A128GCM", Serialization.COMPACT);
}
@Test
public void testRsaOaepA128GcmJweJsonFlattened() throws Exception {
+ //fips: no RSA-OAEP support
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
test("RSA", "RSA-OAEP", "A128GCM", Serialization.FLATTENED);
}
@Test
public void testRsaOaepA128GcmJweJson() throws Exception {
+ //fips: no RSA-OAEP support
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
test("RSA", "RSA-OAEP", "A128GCM", Serialization.JSON);
}
diff --git a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwe/JweCompactReaderWriterTest.java b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwe/JweCompactReaderWriterTest.java
index 094af892d2..b2e8e15a28 100644
--- a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwe/JweCompactReaderWriterTest.java
+++ b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwe/JweCompactReaderWriterTest.java
@@ -28,6 +28,7 @@ import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import org.apache.cxf.common.util.Base64UrlUtility;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rs.security.jose.jwa.AlgorithmUtils;
import org.apache.cxf.rs.security.jose.jwa.ContentAlgorithm;
import org.apache.cxf.rs.security.jose.jwa.KeyAlgorithm;
@@ -36,6 +37,7 @@ import org.apache.cxf.rs.security.jose.jwk.JwkUtils;
import org.apache.cxf.rs.security.jose.jws.JwsCompactReaderWriterTest;
import org.apache.cxf.rt.security.crypto.CryptoUtils;
+import org.junit.Assume;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
@@ -48,12 +50,13 @@ public class JweCompactReaderWriterTest {
115, 63, (byte)180, 3, (byte)255, 107, (byte)154, (byte)212, (byte)246,
(byte)138, 7, 110, 91, 112, 46, 34, 105, 47,
(byte)130, (byte)203, 46, 122, (byte)234, 64, (byte)252};
+
static final String RSA_MODULUS_ENCODED_A1 = "oahUIoWw0K0usKNuOR6H4wkf4oBUXHTxRvgb48E-BVvxkeDNjbC4he8rUW"
- + "cJoZmds2h7M70imEVhRU5djINXtqllXI4DFqcI1DgjT9LewND8MW2Krf3S"
- + "psk_ZkoFnilakGygTwpZ3uesH-PFABNIUYpOiN15dsQRkgr0vEhxN92i2a"
- + "sbOenSZeyaxziK72UwxrrKoExv6kc5twXTq4h-QChLOln0_mtUZwfsRaMS"
- + "tPs6mS6XrgxnxbWhojf663tuEQueGC-FCMfra36C9knDFGzKsNa7LZK2dj"
- + "YgyD3JR_MB_4NUJW_TqOQtwHYbxevoJArm-L5StowjzGy-_bq6Gw";
+ + "cJoZmds2h7M70imEVhRU5djINXtqllXI4DFqcI1DgjT9LewND8MW2Krf3S"
+ + "psk_ZkoFnilakGygTwpZ3uesH-PFABNIUYpOiN15dsQRkgr0vEhxN92i2a"
+ + "sbOenSZeyaxziK72UwxrrKoExv6kc5twXTq4h-QChLOln0_mtUZwfsRaMS"
+ + "tPs6mS6XrgxnxbWhojf663tuEQueGC-FCMfra36C9knDFGzKsNa7LZK2dj"
+ + "YgyD3JR_MB_4NUJW_TqOQtwHYbxevoJArm-L5StowjzGy-_bq6Gw";
static final String RSA_PUBLIC_EXPONENT_ENCODED_A1 = "AQAB";
static final String RSA_PRIVATE_EXPONENT_ENCODED_A1 =
"kLdtIj6GbDks_ApCSTYQtelcNttlKiOyPzMrXHeI-yk1F7-kpDxY4-WY5N"
@@ -62,7 +65,43 @@ public class JweCompactReaderWriterTest {
+ "qDp0Vqj3kbSCz1XyfCs6_LehBwtxHIyh8Ripy40p24moOAbgxVw3rxT_vl"
+ "t3UVe4WO3JkJOzlpUf-KTVI2Ptgm-dARxTEtE-id-4OJr0h-K-VFs3VSnd"
+ "VTIznSxfyrj8ILL6MG_Uv8YAu7VILSB3lOW085-4qE3DzgrTjgyQ";
-
+
+ static final String RSA_MODULUS_ENCODED_A1_FIPS =
+ "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtV"
+ + "T86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn6"
+ + "4tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_F"
+ + "DW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1"
+ + "n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPks"
+ + "INHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw";
+ static final String RSA_PUBLIC_EXPONENT_ENCODED_A1_FIPS = "AQAB";
+ static final String RSA_PRIVATE_EXPONENT_ENCODED_A1_FIPS =
+ "X4cTteJY_gn4FYPsXB8rdXix5vwsg1FLN5E3EaG6RJoVH-HLLKD9M7dx5oo"
+ + "7GURknchnrRweUkC7hT5fJLM0WbFAKNLWY2vv7B6NqXSzUvxT0_YSfqij"
+ + "wp3RTzlBaCxWp4doFk5N2o8Gy_nHNKroADIkJ46pRUohsXywbReAdYaMw"
+ + "Fs9tv8d_cPVY3i07a3t8MN6TNwm0dSawm9v47UiCl3Sk5ZiG7xojPLu4s"
+ + "bg1U2jx4IBTNBznbJSzFHK66jT8bgkuqsk0GjskDJk19Z4qwjwbsnn4j2"
+ + "WBii3RL-Us2lGVkY8fkFzme1z0HbIkfz0Y6mqnOYtqc0X4jfcKoAC8Q";
+ static final String RSA_PRIVATE_FIRST_PRIME_FACTOR_A1_FIPS =
+ "83i-7IvMGXoMXCskv73TKr8637FiO7Z27zv8oj6pbWUQyLPQBQxtPVnwD"
+ + "20R-60eTDmD2ujnMt5PoqMrm8RfmNhVWDtjjMmCMjOpSXicFHj7XOuV"
+ + "IYQyqVWlWEh6dN36GVZYk93N8Bc9vY41xy8B9RzzOGVQzXvNEvn7O0nVbfs";
+ static final String RSA_PRIVATE_SECOND_PRIME_FACTOR_A1_FIPS =
+ "3dfOR9cuYq-0S-mkFLzgItgMEfFzB2q3hWehMuG0oCuqnb3vobLyumqjVZQO1"
+ + "dIrdwgTnCdpYzBcOfW5r370AFXjiWft_NGEiovonizhKpo9VVS78TzFgxkI"
+ + "drecRezsZ-1kYd_s1qDbxtkDEgfAITAG9LUnADun4vIcb6yelxk";
+ static final String RSA_PRIVATE_FIRST_PRIME_CRT_A1_FIPS =
+ "G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2em"
+ + "TAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc"
+ + "3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0";
+ static final String RSA_PRIVATE_SECOND_PRIME_CRT_A1_FIPS =
+ "s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn"
+ + "8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4"
+ + "Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk";
+ static final String RSA_PRIVATE_FIRST_CRT_COEFFICIENT_A1_FIPS =
+ "GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEc"
+ + "OqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8"
+ + "O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU";
+
static final byte[] INIT_VECTOR_A1 = {(byte)227, (byte)197, 117, (byte)252, 2, (byte)219,
(byte)233, 68, (byte)180, (byte)225, 77, (byte)219};
@@ -186,8 +225,12 @@ public class JweCompactReaderWriterTest {
public void testEncryptDecryptRSA15WrapA128CBCHS256() throws Exception {
final String specPlainText = "Live long and prosper.";
- RSAPublicKey publicKey = CryptoUtils.getRSAPublicKey(RSA_MODULUS_ENCODED_A1,
- RSA_PUBLIC_EXPONENT_ENCODED_A1);
+ RSAPublicKey publicKey = CryptoUtils.getRSAPublicKey(JavaUtils.isFIPSEnabled()
+ ? RSA_MODULUS_ENCODED_A1_FIPS
+ : RSA_MODULUS_ENCODED_A1,
+ JavaUtils.isFIPSEnabled()
+ ? RSA_PUBLIC_EXPONENT_ENCODED_A1_FIPS
+ : RSA_PUBLIC_EXPONENT_ENCODED_A1);
KeyEncryptionProvider keyEncryption = new RSAKeyEncryptionAlgorithm(publicKey,
KeyAlgorithm.RSA1_5);
@@ -198,8 +241,20 @@ public class JweCompactReaderWriterTest {
keyEncryption);
String jweContent = encryption.encrypt(specPlainText.getBytes(StandardCharsets.UTF_8), null);
- RSAPrivateKey privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_A1,
- RSA_PRIVATE_EXPONENT_ENCODED_A1);
+ RSAPrivateKey privateKey = null;
+ if (JavaUtils.isFIPSEnabled()) {
+ privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_A1_FIPS,
+ RSA_PUBLIC_EXPONENT_ENCODED_A1_FIPS,
+ RSA_PRIVATE_EXPONENT_ENCODED_A1_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_FACTOR_A1_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_FACTOR_A1_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_CRT_A1_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_CRT_A1_FIPS,
+ RSA_PRIVATE_FIRST_CRT_COEFFICIENT_A1_FIPS);
+ } else {
+ privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_A1,
+ RSA_PRIVATE_EXPONENT_ENCODED_A1);
+ }
KeyDecryptionProvider keyDecryption = new RSAKeyDecryptionAlgorithm(privateKey,
KeyAlgorithm.RSA1_5);
JweDecryptionProvider decryption = new AesCbcHmacJweDecryption(keyDecryption);
@@ -208,6 +263,8 @@ public class JweCompactReaderWriterTest {
}
@Test
public void testEncryptDecryptAesGcmWrapA128CBCHS256() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
//
// This test fails with the IBM JDK
//
@@ -231,7 +288,7 @@ public class JweCompactReaderWriterTest {
String decryptedText = decryption.decrypt(jweContent).getContentText();
assertEquals(specPlainText, decryptedText);
}
-
+
@Test
public void testEncryptDecryptSpecExample() throws Exception {
final String specPlainText = "The true sign of intelligence is not knowledge but imagination.";
@@ -256,8 +313,13 @@ public class JweCompactReaderWriterTest {
}
private String encryptContent(String content, boolean createIfException) throws Exception {
- RSAPublicKey publicKey = CryptoUtils.getRSAPublicKey(RSA_MODULUS_ENCODED_A1,
- RSA_PUBLIC_EXPONENT_ENCODED_A1);
+ RSAPublicKey publicKey = CryptoUtils.getRSAPublicKey(JavaUtils.isFIPSEnabled()
+ ? RSA_MODULUS_ENCODED_A1_FIPS
+ : RSA_MODULUS_ENCODED_A1,
+ JavaUtils.isFIPSEnabled()
+ ? RSA_PUBLIC_EXPONENT_ENCODED_A1_FIPS
+ : RSA_PUBLIC_EXPONENT_ENCODED_A1);
+
SecretKey key = createSecretKey(createIfException);
final String jwtKeyName;
if (key == null) {
@@ -267,7 +329,9 @@ public class JweCompactReaderWriterTest {
jwtKeyName = AlgorithmUtils.toJwaName(key.getAlgorithm(), key.getEncoded().length * 8);
}
KeyEncryptionProvider keyEncryptionAlgo = new RSAKeyEncryptionAlgorithm(publicKey,
- KeyAlgorithm.RSA_OAEP);
+ JavaUtils.isFIPSEnabled()
+ ? KeyAlgorithm.RSA1_5
+ : KeyAlgorithm.RSA_OAEP);
ContentEncryptionProvider contentEncryptionAlgo =
new AesGcmContentEncryptionAlgorithm(key == null ? null : key.getEncoded(), INIT_VECTOR_A1,
ContentAlgorithm.getAlgorithm(jwtKeyName));
@@ -280,8 +344,20 @@ public class JweCompactReaderWriterTest {
return encryptor.encrypt(content.getBytes(StandardCharsets.UTF_8), null);
}
private void decrypt(String jweContent, String plainContent, boolean unwrap) throws Exception {
- RSAPrivateKey privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_A1,
- RSA_PRIVATE_EXPONENT_ENCODED_A1);
+ RSAPrivateKey privateKey = null;
+ if (JavaUtils.isFIPSEnabled()) {
+ privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_A1_FIPS,
+ RSA_PUBLIC_EXPONENT_ENCODED_A1_FIPS,
+ RSA_PRIVATE_EXPONENT_ENCODED_A1_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_FACTOR_A1_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_FACTOR_A1_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_CRT_A1_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_CRT_A1_FIPS,
+ RSA_PRIVATE_FIRST_CRT_COEFFICIENT_A1_FIPS);
+ } else {
+ privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_A1,
+ RSA_PRIVATE_EXPONENT_ENCODED_A1);
+ }
ContentAlgorithm algo = Cipher.getMaxAllowedKeyLength("AES") > 128
? ContentAlgorithm.A256GCM : ContentAlgorithm.A128GCM;
JweDecryptionProvider decryptor = new JweDecryption(new RSAKeyDecryptionAlgorithm(privateKey),
diff --git a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java
index 6189e7dfb4..9be532c674 100644
--- a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java
+++ b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jws/JwsCompactReaderWriterTest.java
@@ -18,9 +18,10 @@
*/
package org.apache.cxf.rs.security.jose.jws;
-import java.security.PrivateKey;
+
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.time.Clock;
import java.util.Arrays;
@@ -30,6 +31,7 @@ import java.util.List;
import java.util.Map;
import java.util.concurrent.TimeUnit;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxrs.json.basic.JsonMapObjectReaderWriter;
import org.apache.cxf.rs.security.jose.common.JoseConstants;
import org.apache.cxf.rs.security.jose.common.JoseType;
@@ -66,7 +68,7 @@ public class JwsCompactReaderWriterTest {
+ "zI1NiIsDQogImp3ayI6eyJrdHkiOiJvY3QiLA0KICJrZXlfb3BzIjpbDQogInNpZ24iLA0KICJ2ZXJpZnkiDQogXX19"
+ ".eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ"
+ ".8cFZqb15gEDYRZqSzUu23nQnKNynru1ADByRPvmmOq8";
-
+
private static final String RSA_MODULUS_ENCODED = "ofgWCuLjybRlzo0tZWJjNiuSfb4p4fAkd_wWJcyQoTbji9k0l8W26mPddx"
+ "HmfHQp-Vaw-4qPCJrcS2mJPMEzP1Pt0Bm4d4QlL-yRT-SFd2lZS-pCgNMs"
+ "D1W_YpRPEwOWvG6b32690r2jZ47soMZo9wGzjb_7OMg0LOL-bSf63kpaSH"
@@ -94,6 +96,51 @@ public class JwsCompactReaderWriterTest {
+ "hJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AXLIhWkWywlVmtVrB"
+ "p0igcN_IoypGlUPQGe77Rw";
+ private static final String RSA_MODULUS_ENCODED_FIPS =
+ "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtV"
+ + "T86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn6"
+ + "4tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_F"
+ + "DW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1"
+ + "n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPks"
+ + "INHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw";
+ private static final String RSA_PUBLIC_EXPONENT_ENCODED_FIPS = "AQAB";
+ private static final String RSA_PRIVATE_EXPONENT_ENCODED_FIPS =
+ "X4cTteJY_gn4FYPsXB8rdXix5vwsg1FLN5E3EaG6RJoVH-HLLKD9M7dx5oo"
+ + "7GURknchnrRweUkC7hT5fJLM0WbFAKNLWY2vv7B6NqXSzUvxT0_YSfqij"
+ + "wp3RTzlBaCxWp4doFk5N2o8Gy_nHNKroADIkJ46pRUohsXywbReAdYaMw"
+ + "Fs9tv8d_cPVY3i07a3t8MN6TNwm0dSawm9v47UiCl3Sk5ZiG7xojPLu4s"
+ + "bg1U2jx4IBTNBznbJSzFHK66jT8bgkuqsk0GjskDJk19Z4qwjwbsnn4j2"
+ + "WBii3RL-Us2lGVkY8fkFzme1z0HbIkfz0Y6mqnOYtqc0X4jfcKoAC8Q";
+ private static final String RSA_PRIVATE_FIRST_PRIME_FACTOR_FIPS =
+ "83i-7IvMGXoMXCskv73TKr8637FiO7Z27zv8oj6pbWUQyLPQBQxtPVnwD"
+ + "20R-60eTDmD2ujnMt5PoqMrm8RfmNhVWDtjjMmCMjOpSXicFHj7XOuV"
+ + "IYQyqVWlWEh6dN36GVZYk93N8Bc9vY41xy8B9RzzOGVQzXvNEvn7O0nVbfs";
+ private static final String RSA_PRIVATE_SECOND_PRIME_FACTOR_FIPS =
+ "3dfOR9cuYq-0S-mkFLzgItgMEfFzB2q3hWehMuG0oCuqnb3vobLyumqjVZQO1"
+ + "dIrdwgTnCdpYzBcOfW5r370AFXjiWft_NGEiovonizhKpo9VVS78TzFgxkI"
+ + "drecRezsZ-1kYd_s1qDbxtkDEgfAITAG9LUnADun4vIcb6yelxk";
+ private static final String RSA_PRIVATE_FIRST_PRIME_CRT_FIPS =
+ "G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2em"
+ + "TAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc"
+ + "3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0";
+ private static final String RSA_PRIVATE_SECOND_PRIME_CRT_FIPS =
+ "s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn"
+ + "8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4"
+ + "Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk";
+ private static final String RSA_PRIVATE_FIRST_CRT_COEFFICIENT_FIPS =
+ "GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEc"
+ + "OqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8"
+ + "O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU";
+ private static final String ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY_FIPS =
+ "eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkz"
+ + "ODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.DS0k"
+ + "cM3KbMwJWyxmJ2NWC21HGx93MXy9sSgsVygnx4U7XKayfNACjigqZL9jH-U"
+ + "L1MjIIXVUmaVc5ljgt84fjhlfcMdJ67Q2_tyyUdbOjPrVfcDnpwpxKQQ2tA"
+ + "9fpHFQL_JENgraWFJQ1O27WKDvYfsRmj-Z2xIJzYETdZykNKS4lcN-B-eus"
+ + "A2zw9iUnl3TdAdSIKr7QrTZrd3Osema_hCSCfD1faLWGUhRMHnx5eSxbDog"
+ + "V0-7P0OUHDP0IoxWGNcrAQ7vTBlEAg92LhGN8JGW2k-bludnJb5gBJrauMY"
+ + "xqi9d4ajKYka0GSaky4CpjMOpexkkGORk2VC8wiNMFg";
+
private static final String EC_PRIVATE_KEY_ENCODED =
"jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI";
private static final String EC_X_POINT_ENCODED =
@@ -255,22 +302,56 @@ public class JwsCompactReaderWriterTest {
JwsHeaders headers = new JwsHeaders();
headers.setSignatureAlgorithm(SignatureAlgorithm.RS256);
JwsCompactProducer jws = initSpecJwtTokenWriter(headers);
- PrivateKey key = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED, RSA_PRIVATE_EXPONENT_ENCODED);
+ RSAPrivateKey key = null;
+ if (JavaUtils.isFIPSEnabled()) {
+ key = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_FIPS,
+ RSA_PUBLIC_EXPONENT_ENCODED_FIPS,
+ RSA_PRIVATE_EXPONENT_ENCODED_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_FACTOR_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_FACTOR_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_CRT_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_CRT_FIPS,
+ RSA_PRIVATE_FIRST_CRT_COEFFICIENT_FIPS);
+ } else {
+ key = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED,
+ RSA_PRIVATE_EXPONENT_ENCODED);
+ }
jws.signWith(new PrivateKeyJwsSignatureProvider(key, SignatureAlgorithm.RS256));
- assertEquals(ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY, jws.getSignedEncodedJws());
+
+ assertEquals(JavaUtils.isFIPSEnabled()
+ ? ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY_FIPS
+ : ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY, jws.getSignedEncodedJws());
}
@Test
public void testJwsPsSha() throws Exception {
JwsHeaders outHeaders = new JwsHeaders();
outHeaders.setSignatureAlgorithm(SignatureAlgorithm.PS256);
JwsCompactProducer producer = initSpecJwtTokenWriter(outHeaders);
- PrivateKey privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED, RSA_PRIVATE_EXPONENT_ENCODED);
+ RSAPrivateKey privateKey = null;
+ if (JavaUtils.isFIPSEnabled()) {
+ privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED_FIPS,
+ RSA_PUBLIC_EXPONENT_ENCODED_FIPS,
+ RSA_PRIVATE_EXPONENT_ENCODED_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_FACTOR_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_FACTOR_FIPS,
+ RSA_PRIVATE_FIRST_PRIME_CRT_FIPS,
+ RSA_PRIVATE_SECOND_PRIME_CRT_FIPS,
+ RSA_PRIVATE_FIRST_CRT_COEFFICIENT_FIPS);
+ } else {
+ privateKey = CryptoUtils.getRSAPrivateKey(RSA_MODULUS_ENCODED,
+ RSA_PRIVATE_EXPONENT_ENCODED);
+ }
String signed = producer.signWith(
new PrivateKeyJwsSignatureProvider(privateKey, SignatureAlgorithm.PS256));
JwsJwtCompactConsumer jws = new JwsJwtCompactConsumer(signed);
- RSAPublicKey key = CryptoUtils.getRSAPublicKey(RSA_MODULUS_ENCODED, RSA_PUBLIC_EXPONENT_ENCODED);
+ RSAPublicKey key = CryptoUtils.getRSAPublicKey(JavaUtils.isFIPSEnabled()
+ ? RSA_MODULUS_ENCODED_FIPS
+ : RSA_MODULUS_ENCODED,
+ JavaUtils.isFIPSEnabled()
+ ? RSA_PUBLIC_EXPONENT_ENCODED_FIPS
+ : RSA_PUBLIC_EXPONENT_ENCODED);
assertTrue(jws.verifySignatureWith(new PublicKeyJwsSignatureVerifier(key, SignatureAlgorithm.PS256)));
JwtToken token = jws.getJwtToken();
JwsHeaders inHeaders = new JwsHeaders(token.getJwsHeaders());
@@ -303,8 +384,15 @@ public class JwsCompactReaderWriterTest {
@Test
public void testReadJwsSignedByPrivateKey() throws Exception {
- JwsJwtCompactConsumer jws = new JwsJwtCompactConsumer(ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY);
- RSAPublicKey key = CryptoUtils.getRSAPublicKey(RSA_MODULUS_ENCODED, RSA_PUBLIC_EXPONENT_ENCODED);
+ JwsJwtCompactConsumer jws = new JwsJwtCompactConsumer(JavaUtils.isFIPSEnabled()
+ ? ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY_FIPS
+ : ENCODED_TOKEN_SIGNED_BY_PRIVATE_KEY);
+ RSAPublicKey key = CryptoUtils.getRSAPublicKey(JavaUtils.isFIPSEnabled()
+ ? RSA_MODULUS_ENCODED_FIPS
+ : RSA_MODULUS_ENCODED,
+ JavaUtils.isFIPSEnabled()
+ ? RSA_PUBLIC_EXPONENT_ENCODED_FIPS
+ : RSA_PUBLIC_EXPONENT_ENCODED);
assertTrue(jws.verifySignatureWith(new PublicKeyJwsSignatureVerifier(key, SignatureAlgorithm.RS256)));
JwtToken token = jws.getJwtToken();
JwsHeaders headers = new JwsHeaders(token.getJwsHeaders());
diff --git a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/OAuthServerJoseJwtProducer.java b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/OAuthServerJoseJwtProducer.java
index a0bfaf15e5..3d173d655f 100644
--- a/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/OAuthServerJoseJwtProducer.java
+++ b/rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/provider/OAuthServerJoseJwtProducer.java
@@ -20,6 +20,7 @@ package org.apache.cxf.rs.security.oauth2.provider;
import java.security.cert.X509Certificate;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rs.security.jose.jwa.ContentAlgorithm;
import org.apache.cxf.rs.security.jose.jwa.KeyAlgorithm;
import org.apache.cxf.rs.security.jose.jwe.JweEncryptionProvider;
@@ -44,7 +45,9 @@ public class OAuthServerJoseJwtProducer extends OAuthJoseJwtProducer {
X509Certificate cert =
(X509Certificate)CryptoUtils.decodeCertificate(c.getApplicationCertificates().get(0));
theEncryptionProvider = JweUtils.createJweEncryptionProvider(cert.getPublicKey(),
- KeyAlgorithm.RSA_OAEP,
+ JavaUtils.isFIPSEnabled()
+ ? KeyAlgorithm.RSA1_5
+ : KeyAlgorithm.RSA_OAEP,
ContentAlgorithm.A128GCM,
null);
}
diff --git a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/AbstractXmlEncInHandler.java b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/AbstractXmlEncInHandler.java
index 608b2cabbe..7fd16fe0a7 100644
--- a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/AbstractXmlEncInHandler.java
+++ b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/AbstractXmlEncInHandler.java
@@ -38,6 +38,7 @@ import org.w3c.dom.Element;
import org.apache.cxf.common.util.Base64Exception;
import org.apache.cxf.common.util.Base64Utility;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.rs.security.common.CryptoLoader;
import org.apache.cxf.rs.security.common.RSSecurityUtils;
@@ -145,8 +146,10 @@ public abstract class AbstractXmlEncInHandler extends AbstractXmlSecInHandler {
&& (digestAlgo == null || !encProps.getEncryptionDigestAlgo().equals(digestAlgo))) {
throwFault("Digest Algorithm is not supported", null);
}
- } else if (!XMLCipher.RSA_OAEP.equals(keyEncAlgo)) {
- // RSA OAEP is the required default Key Transport Algorithm
+ } else if ((JavaUtils.isFIPSEnabled() && !XMLCipher.RSA_v1dot5 .equals(keyEncAlgo))
+ || (!JavaUtils.isFIPSEnabled() && !XMLCipher.RSA_OAEP .equals(keyEncAlgo))) {
+ // RSA OAEP (while it's RSA1_5 in FIPS mode) is the
+ // required default Key Transport Algorithm
throwFault("Key Transport Algorithm is not supported", null);
}
diff --git a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/EncryptionProperties.java b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/EncryptionProperties.java
index 4de9e8e2a0..92003f1791 100644
--- a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/EncryptionProperties.java
+++ b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/EncryptionProperties.java
@@ -18,10 +18,12 @@
*/
package org.apache.cxf.rs.security.xml;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.xml.security.encryption.XMLCipher;
public class EncryptionProperties {
- private String encryptionKeyTransportAlgo = XMLCipher.RSA_OAEP;
+ private String encryptionKeyTransportAlgo =
+ JavaUtils.isFIPSEnabled() ? XMLCipher.RSA_v1dot5 : XMLCipher.RSA_OAEP;
private String encryptionSymmetricKeyAlgo;
private String encryptionDigestAlgo;
private String encryptionKeyIdType;
diff --git a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlEncOutInterceptor.java b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlEncOutInterceptor.java
index 787ea36404..7939729461 100644
--- a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlEncOutInterceptor.java
+++ b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlEncOutInterceptor.java
@@ -37,6 +37,7 @@ import org.w3c.dom.Text;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.util.StringUtils;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.message.Message;
import org.apache.cxf.message.MessageUtils;
import org.apache.cxf.rs.security.common.CryptoLoader;
@@ -102,7 +103,8 @@ public class XmlEncOutInterceptor extends AbstractXmlSecOutInterceptor {
throws Exception {
String symEncAlgo = encProps.getEncryptionSymmetricKeyAlgo() == null
- ? XMLCipher.AES_256 : encProps.getEncryptionSymmetricKeyAlgo();
+ ? JavaUtils.isFIPSEnabled() ? XMLCipher.AES_256_GCM : XMLCipher.AES_256
+ : encProps.getEncryptionSymmetricKeyAlgo();
byte[] secretKey = getSymmetricKey(symEncAlgo);
@@ -140,7 +142,8 @@ public class XmlEncOutInterceptor extends AbstractXmlSecOutInterceptor {
}
String keyEncAlgo = encProps.getEncryptionKeyTransportAlgo() == null
- ? XMLCipher.RSA_OAEP : encProps.getEncryptionKeyTransportAlgo();
+ ? JavaUtils.isFIPSEnabled() ? XMLCipher.RSA_v1dot5 : XMLCipher.RSA_OAEP
+ : encProps.getEncryptionKeyTransportAlgo();
String digestAlgo = encProps.getEncryptionDigestAlgo();
byte[] encryptedSecretKey = encryptSymmetricKey(secretKey, receiverCert,
diff --git a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlSecOutInterceptor.java b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlSecOutInterceptor.java
index f335e15380..ad13c20f8a 100644
--- a/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlSecOutInterceptor.java
+++ b/rt/rs/security/xml/src/main/java/org/apache/cxf/rs/security/xml/XmlSecOutInterceptor.java
@@ -35,6 +35,7 @@ import javax.xml.stream.XMLStreamWriter;
import jakarta.ws.rs.core.Response;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.interceptor.AbstractOutDatabindingInterceptor;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.interceptor.StaxOutInterceptor;
@@ -152,7 +153,8 @@ public class XmlSecOutInterceptor extends AbstractPhaseInterceptor<Message> {
private void configureEncryption(Message message, XMLSecurityProperties properties)
throws Exception {
String symEncAlgo = encryptionProperties.getEncryptionSymmetricKeyAlgo() == null
- ? XMLCipher.AES_256 : encryptionProperties.getEncryptionSymmetricKeyAlgo();
+ ? JavaUtils.isFIPSEnabled() ? XMLCipher.AES_256_GCM : XMLCipher.AES_256
+ : encryptionProperties.getEncryptionSymmetricKeyAlgo();
properties.setEncryptionSymAlgorithm(symEncAlgo);
properties.setEncryptionKey(getSymmetricKey(symEncAlgo));
if (encryptSymmetricKey) {
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/custom/DefaultAlgorithmSuiteLoader.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/custom/DefaultAlgorithmSuiteLoader.java
index 312d591e37..11279a0978 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/custom/DefaultAlgorithmSuiteLoader.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/custom/DefaultAlgorithmSuiteLoader.java
@@ -42,6 +42,7 @@ import org.apache.neethi.builders.xml.XMLPrimitiveAssertionBuilder;
import org.apache.wss4j.policy.SPConstants;
import org.apache.wss4j.policy.model.AbstractSecurityAssertion;
import org.apache.wss4j.policy.model.AlgorithmSuite;
+import org.apache.wss4j.policy.model.AlgorithmSuite.AlgorithmSuiteType;
/**
* This class retrieves the default AlgorithmSuites plus the CXF specific GCM AlgorithmSuites.
@@ -59,6 +60,18 @@ public class DefaultAlgorithmSuiteLoader implements AlgorithmSuiteLoader {
assertions.put(qName, new PrimitiveAssertion(qName));
qName = new QName(ns, "Basic256GCM");
assertions.put(qName, new PrimitiveAssertion(qName));
+ qName = new QName(ns, "Basic256GCMRsa15");
+ assertions.put(qName, new PrimitiveAssertion(qName));
+ qName = new QName(ns, "Basic192GCMRsa15");
+ assertions.put(qName, new PrimitiveAssertion(qName));
+ qName = new QName(ns, "Basic128GCMRsa15");
+ assertions.put(qName, new PrimitiveAssertion(qName));
+ qName = new QName(ns, "Basic256GCMSha256Rsa15");
+ assertions.put(qName, new PrimitiveAssertion(qName));
+ qName = new QName(ns, "Basic192GCMSha256Rsa15");
+ assertions.put(qName, new PrimitiveAssertion(qName));
+ qName = new QName(ns, "Basic128GCMSha256Rsa15");
+ assertions.put(qName, new PrimitiveAssertion(qName));
qName = new QName(ns, "CustomAlgorithmSuite");
assertions.put(qName, new PrimitiveAssertion(qName));
@@ -122,6 +135,69 @@ public class DefaultAlgorithmSuiteLoader implements AlgorithmSuiteLoader {
)
);
+ //fips compliant policies
+
+ ALGORITHM_SUITE_TYPES.put("Basic256GCMRsa15", new AlgorithmSuiteType(
+ "Basic256GCMRsa15",
+ SPConstants.SHA1,
+ "http://www.w3.org/2009/xmlenc11#aes256-gcm",
+ SPConstants.KW_AES256,
+ SPConstants.KW_RSA15,
+ SPConstants.P_SHA1_L256,
+ SPConstants.P_SHA1_L192,
+ 256, 192, 256,
+ 256, 1024, 4096));
+ ALGORITHM_SUITE_TYPES.put("Basic192GCMRsa15", new AlgorithmSuiteType(
+ "Basic192GCMRsa15",
+ SPConstants.SHA1,
+ "http://www.w3.org/2009/xmlenc11#aes192-gcm",
+ SPConstants.KW_AES192,
+ SPConstants.KW_RSA15,
+ SPConstants.P_SHA1_L192,
+ SPConstants.P_SHA1_L192,
+ 192, 192, 192,
+ 256, 1024, 4096));
+ ALGORITHM_SUITE_TYPES.put("Basic128GCMRsa15", new AlgorithmSuiteType(
+ "Basic128GCMRsa15",
+ SPConstants.SHA1,
+ "http://www.w3.org/2009/xmlenc11#aes128-gcm",
+ SPConstants.KW_AES128,
+ SPConstants.KW_RSA15,
+ SPConstants.P_SHA1_L128,
+ SPConstants.P_SHA1_L128,
+ 128, 128, 128,
+ 256, 1024, 4096));
+
+ ALGORITHM_SUITE_TYPES.put("Basic256GCMSha256Rsa15", new AlgorithmSuiteType(
+ "Basic256GCMSha256Rsa15",
+ SPConstants.SHA256,
+ "http://www.w3.org/2009/xmlenc11#aes256-gcm",
+ SPConstants.KW_AES256,
+ SPConstants.KW_RSA15,
+ SPConstants.P_SHA1_L256,
+ SPConstants.P_SHA1_L192,
+ 256, 192, 256,
+ 256, 1024, 4096));
+ ALGORITHM_SUITE_TYPES.put("Basic192GCMSha256Rsa15", new AlgorithmSuiteType(
+ "Basic192GCMSha256Rsa15",
+ SPConstants.SHA256,
+ "http://www.w3.org/2009/xmlenc11#aes192-gcm",
+ SPConstants.KW_AES192,
+ SPConstants.KW_RSA15,
+ SPConstants.P_SHA1_L192,
+ SPConstants.P_SHA1_L192,
+ 192, 192, 192,
+ 256, 1024, 4096));
+ ALGORITHM_SUITE_TYPES.put("Basic128GCMSha256Rsa15", new AlgorithmSuiteType(
+ "Basic128GCMSha256Rsa15",
+ SPConstants.SHA256,
+ "http://www.w3.org/2009/xmlenc11#aes128-gcm",
+ SPConstants.KW_AES128,
+ SPConstants.KW_RSA15,
+ SPConstants.P_SHA1_L128,
+ SPConstants.P_SHA1_L128,
+ 128, 128, 128,
+ 256, 1024, 4096));
ALGORITHM_SUITE_TYPES.put(
"CustomAlgorithmSuite",
@@ -164,6 +240,24 @@ public class DefaultAlgorithmSuiteLoader implements AlgorithmSuiteLoader {
} else if ("Basic256GCM".equals(assertionName)) {
setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic256GCM"));
getAlgorithmSuiteType().setNamespace(assertionNamespace);
+ } else if ("Basic256GCMRsa15".equals(assertionName)) {
+ setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic256GCMRsa15"));
+ getAlgorithmSuiteType().setNamespace(assertionNamespace);
+ } else if ("Basic192GCMRsa15".equals(assertionName)) {
+ setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic192GCMRsa15"));
+ getAlgorithmSuiteType().setNamespace(assertionNamespace);
+ } else if ("Basic128GCMRsa15".equals(assertionName)) {
+ setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic128GCMRsa15"));
+ getAlgorithmSuiteType().setNamespace(assertionNamespace);
+ } else if ("Basic256GCMSha256Rsa15".equals(assertionName)) {
+ setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic256GCMSha256Rsa15"));
+ getAlgorithmSuiteType().setNamespace(assertionNamespace);
+ } else if ("Basic192GCMSha256Rsa15".equals(assertionName)) {
+ setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic192GCMSha256Rsa15"));
+ getAlgorithmSuiteType().setNamespace(assertionNamespace);
+ } else if ("Basic128GCMSha256Rsa15".equals(assertionName)) {
+ setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("Basic128GCMSha256Rsa15"));
+ getAlgorithmSuiteType().setNamespace(assertionNamespace);
} else if ("CustomAlgorithmSuite".equals(assertionName)) {
setAlgorithmSuiteType(ALGORITHM_SUITE_TYPES.get("CustomAlgorithmSuite"));
getAlgorithmSuiteType().setNamespace(assertionNamespace);
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageCheckerTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageCheckerTest.java
index d045a02ac2..8e2d6df63f 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageCheckerTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageCheckerTest.java
@@ -32,6 +32,7 @@ import org.w3c.dom.Document;
import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.binding.soap.interceptor.MustUnderstandInterceptor;
import org.apache.cxf.binding.soap.saaj.SAAJInInterceptor;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.interceptor.Interceptor;
import org.apache.cxf.message.Message;
@@ -43,6 +44,8 @@ import org.apache.cxf.ws.security.wss4j.CryptoCoverageUtil.CoverageScope;
import org.apache.cxf.ws.security.wss4j.CryptoCoverageUtil.CoverageType;
import org.apache.wss4j.common.ConfigurationConstants;
+
+import org.junit.Assume;
import org.junit.Test;
import static org.junit.Assert.assertTrue;
@@ -111,6 +114,8 @@ public class CryptoCoverageCheckerTest extends AbstractSecurityTest {
@Test
public void testEncryptedWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInterceptorAndValidate(
"encrypted_missing_enc_header.xml",
this.getPrefixes(),
@@ -135,6 +140,8 @@ public class CryptoCoverageCheckerTest extends AbstractSecurityTest {
@Test
public void testEncryptedWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInterceptorAndValidate(
"encrypted_body_content.xml",
this.getPrefixes(),
@@ -159,6 +166,8 @@ public class CryptoCoverageCheckerTest extends AbstractSecurityTest {
@Test
public void testEncryptedSignedWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInterceptorAndValidate(
"encrypted_body_content_signed_missing_signed_header.xml",
this.getPrefixes(),
@@ -169,6 +178,8 @@ public class CryptoCoverageCheckerTest extends AbstractSecurityTest {
@Test
public void testEncryptedSignedWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInterceptorAndValidate(
"encrypted_body_content_signed.xml",
this.getPrefixes(),
@@ -250,5 +261,6 @@ public class CryptoCoverageCheckerTest extends AbstractSecurityTest {
inHandler.setProperty(ConfigurationConstants.ALLOW_RSA15_KEY_TRANSPORT_ALGORITHM, "true");
return inHandler;
+
}
}
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/DOMToStaxRoundTripTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/DOMToStaxRoundTripTest.java
index 5f2b01f5a4..35a3039166 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/DOMToStaxRoundTripTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/DOMToStaxRoundTripTest.java
@@ -29,6 +29,7 @@ import org.apache.cxf.endpoint.Server;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.service.Service;
@@ -205,14 +206,18 @@ public class DOMToStaxRoundTripTest extends AbstractSecurityTest {
properties.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
properties.put(ConfigurationConstants.USER, "myalias");
properties.put(ConfigurationConstants.ENC_KEY_TRANSPORT, WSS4JConstants.KEYTRANSPORT_RSA15);
- properties.put(ConfigurationConstants.ENC_SYM_ALGO, WSS4JConstants.TRIPLE_DES);
-
+ if (JavaUtils.isFIPSEnabled()) {
+ properties.put(ConfigurationConstants.ENC_SYM_ALGO, WSS4JConstants.AES_128_GCM);
+ inProperties.setAllowRSA15KeyTransportAlgorithm(false);
+ } else {
+ properties.put(ConfigurationConstants.ENC_SYM_ALGO, WSS4JConstants.TRIPLE_DES);
+ }
WSS4JOutInterceptor ohandler = new WSS4JOutInterceptor(properties);
client.getOutInterceptors().add(ohandler);
try {
echo.echo("test");
- fail("Failure expected as RSA v1.5 is not allowed by default");
+ fail("Failure expected as RSA v1.5 is not allowed by configuration");
} catch (jakarta.xml.ws.soap.SOAPFaultException ex) {
// expected
}
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PluggablePolicyValidatorTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PluggablePolicyValidatorTest.java
index 77733e40a8..783d2227a2 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PluggablePolicyValidatorTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PluggablePolicyValidatorTest.java
@@ -31,6 +31,7 @@ import org.w3c.dom.Element;
import org.apache.cxf.binding.soap.SoapHeader;
import org.apache.cxf.binding.soap.SoapMessage;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.ws.policy.AssertionInfo;
import org.apache.cxf.ws.policy.AssertionInfoMap;
import org.apache.cxf.ws.policy.PolicyException;
@@ -42,6 +43,7 @@ import org.apache.neethi.Policy;
import org.apache.wss4j.dom.util.WSSecurityUtil;
import org.apache.wss4j.policy.SP12Constants;
+import org.junit.Assume;
import org.junit.Test;
import static org.junit.Assert.assertNotNull;
@@ -54,6 +56,8 @@ public class PluggablePolicyValidatorTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedElementsPolicyValidator() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
// This should work (body content is encrypted)
this.runInInterceptorAndValidate(
"encrypted_body_content.xml",
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PolicyBasedWss4JInOutTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PolicyBasedWss4JInOutTest.java
index 81dedb4b46..1b05f793f1 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PolicyBasedWss4JInOutTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/PolicyBasedWss4JInOutTest.java
@@ -27,6 +27,7 @@ import org.apache.cxf.test.TestUtilities;
import org.apache.cxf.ws.security.wss4j.CryptoCoverageUtil.CoverageType;
import org.apache.wss4j.policy.SP12Constants;
+import org.junit.Assume;
import org.junit.Test;
import static org.junit.Assert.fail;
@@ -181,6 +182,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedElementsPolicyWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_missing_enc_header.xml",
"encrypted_elements_policy.xml",
@@ -198,6 +201,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedElementsPolicyWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_body_content.xml",
"encrypted_elements_policy.xml",
@@ -244,6 +249,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testContentEncryptedElementsPolicyWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_body_element.xml",
"content_encrypted_elements_policy.xml",
@@ -254,6 +261,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testContentEncryptedElementsPolicyWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_body_content.xml",
"content_encrypted_elements_policy.xml",
@@ -273,6 +282,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedPartsPolicyWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_missing_enc_body.xml",
"encrypted_parts_policy_body.xml",
@@ -304,6 +315,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedPartsPolicyWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_body_content.xml",
"encrypted_parts_policy_body.xml",
@@ -371,6 +384,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testSignedEncryptedPartsWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"signed_x509_issuer_serial_encrypted_missing_enc_header.xml",
"signed_parts_policy_header_and_body_encrypted.xml",
@@ -382,6 +397,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testSignedEncryptedPartsWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
if (!TestUtilities.checkUnrestrictedPoliciesInstalled()) {
return;
}
@@ -408,6 +425,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedSignedPartsWithIncompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_body_content_signed_missing_signed_header.xml",
"encrypted_parts_policy_header_and_body_signed.xml",
@@ -418,6 +437,8 @@ public class PolicyBasedWss4JInOutTest extends AbstractPolicySecurityTest {
@Test
public void testEncryptedSignedPartsWithCompleteCoverage() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
this.runInInterceptorAndValidate(
"encrypted_body_content_signed.xml",
"encrypted_parts_policy_header_and_body_signed.xml",
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxCryptoCoverageCheckerTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxCryptoCoverageCheckerTest.java
index 37434dbae4..b7b73eaf0a 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxCryptoCoverageCheckerTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxCryptoCoverageCheckerTest.java
@@ -29,6 +29,7 @@ import org.apache.cxf.endpoint.Server;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.service.Service;
@@ -77,7 +78,10 @@ public class StaxCryptoCoverageCheckerTest extends AbstractSecurityTest {
actions.add(XMLSecurityConstants.ENCRYPTION);
properties.setActions(actions);
properties.setEncryptionUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(
+ JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -178,7 +182,9 @@ public class StaxCryptoCoverageCheckerTest extends AbstractSecurityTest {
);
properties.setEncryptionUser("myalias");
properties.setTokenUser("username");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -424,7 +430,9 @@ public class StaxCryptoCoverageCheckerTest extends AbstractSecurityTest {
properties.setActions(actions);
properties.setEncryptionUser("myalias");
properties.setSignatureUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripActionTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripActionTest.java
index ab10d69701..7daa6d4e07 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripActionTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripActionTest.java
@@ -31,6 +31,7 @@ import org.apache.cxf.endpoint.Server;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.service.Service;
@@ -185,7 +186,9 @@ public class StaxRoundTripActionTest extends AbstractSecurityTest {
actions.add(XMLSecurityConstants.ENCRYPTION);
properties.setActions(actions);
properties.setEncryptionUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -235,7 +238,9 @@ public class StaxRoundTripActionTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.ENCRYPTION_USER, "myalias");
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
@@ -293,7 +298,9 @@ public class StaxRoundTripActionTest extends AbstractSecurityTest {
);
properties.setEncryptionUser("myalias");
properties.setTokenUser("username");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -341,7 +348,9 @@ public class StaxRoundTripActionTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.ENCRYPTION_USER, "myalias");
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
@@ -635,7 +644,9 @@ public class StaxRoundTripActionTest extends AbstractSecurityTest {
properties.setActions(actions);
properties.setEncryptionUser("myalias");
properties.setSignatureUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -682,7 +693,9 @@ public class StaxRoundTripActionTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.SIG_PROP_FILE, "outsecurity.properties");
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripTest.java
index a7464875b5..e516133bc1 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxRoundTripTest.java
@@ -35,6 +35,7 @@ import org.apache.cxf.endpoint.Server;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.service.Service;
@@ -445,7 +446,9 @@ public class StaxRoundTripTest extends AbstractSecurityTest {
List<WSSConstants.Action> actions = new ArrayList<>();
actions.add(XMLSecurityConstants.ENCRYPTION);
properties.setActions(actions);
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
properties.setEncryptionUser("myalias");
Properties outCryptoProperties =
@@ -479,7 +482,9 @@ public class StaxRoundTripTest extends AbstractSecurityTest {
Map<String, Object> outConfig = new HashMap<>();
outConfig.put(ConfigurationConstants.ACTION, ConfigurationConstants.ENCRYPTION);
outConfig.put(ConfigurationConstants.ENCRYPTION_USER, "myalias");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
@@ -519,7 +524,9 @@ public class StaxRoundTripTest extends AbstractSecurityTest {
);
properties.setEncryptionUser("myalias");
properties.setTokenUser("username");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -562,7 +569,9 @@ public class StaxRoundTripTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.ENCRYPTION_USER, "myalias");
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
@@ -973,7 +982,9 @@ public class StaxRoundTripTest extends AbstractSecurityTest {
properties.setActions(actions);
properties.setEncryptionUser("myalias");
properties.setSignatureUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties outCryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -1015,7 +1026,9 @@ public class StaxRoundTripTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.SIG_PROP_FILE, "outsecurity.properties");
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMEncryptionIdentifierTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMEncryptionIdentifierTest.java
index 960d268f13..be0b013cfc 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMEncryptionIdentifierTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMEncryptionIdentifierTest.java
@@ -29,6 +29,7 @@ import org.apache.cxf.endpoint.Server;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.service.Service;
@@ -77,7 +78,9 @@ public class StaxToDOMEncryptionIdentifierTest extends AbstractSecurityTest {
properties.setEncryptionKeyIdentifier(
WSSecurityTokenConstants.KEYIDENTIFIER_SECURITY_TOKEN_DIRECT_REFERENCE
);
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -116,7 +119,9 @@ public class StaxToDOMEncryptionIdentifierTest extends AbstractSecurityTest {
properties.setEncryptionKeyIdentifier(
WSSecurityTokenConstants.KeyIdentifier_IssuerSerial
);
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -155,7 +160,9 @@ public class StaxToDOMEncryptionIdentifierTest extends AbstractSecurityTest {
properties.setEncryptionKeyIdentifier(
WSSecurityTokenConstants.KEYIDENTIFIER_THUMBPRINT_IDENTIFIER
);
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -195,7 +202,9 @@ public class StaxToDOMEncryptionIdentifierTest extends AbstractSecurityTest {
properties.setEncryptionKeyIdentifier(
WSSecurityTokenConstants.KeyIdentifier_X509KeyIdentifier
);
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -234,7 +243,9 @@ public class StaxToDOMEncryptionIdentifierTest extends AbstractSecurityTest {
properties.setEncryptionKeyIdentifier(
WSSecurityTokenConstants.KEYIDENTIFIER_ENCRYPTED_KEY_SHA1_IDENTIFIER
);
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMRoundTripTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMRoundTripTest.java
index 4091869cd1..534ef91445 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMRoundTripTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/StaxToDOMRoundTripTest.java
@@ -31,6 +31,7 @@ import org.apache.cxf.endpoint.Server;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.JaxWsServerFactoryBean;
import org.apache.cxf.service.Service;
@@ -275,7 +276,9 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
actions.add(XMLSecurityConstants.ENCRYPTION);
properties.setActions(actions);
properties.setEncryptionUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -311,7 +314,9 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.ENCRYPTION_USER, "myalias");
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
@@ -349,13 +354,18 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
properties.setEncryptionCryptoProperties(cryptoProperties);
properties.setCallbackHandler(new TestPwdCallback());
properties.setEncryptionKeyTransportAlgorithm("http://www.w3.org/2001/04/xmlenc#rsa-1_5");
- properties.setEncryptionSymAlgorithm("http://www.w3.org/2001/04/xmlenc#tripledes-cbc");
+ if (JavaUtils.isFIPSEnabled()) {
+ properties.setEncryptionSymAlgorithm("http://www.w3.org/2009/xmlenc11#aes256-gcm");
+ inProperties.put(ConfigurationConstants.ALLOW_RSA15_KEY_TRANSPORT_ALGORITHM, "false");
+ } else {
+ properties.setEncryptionSymAlgorithm("http://www.w3.org/2001/04/xmlenc#tripledes-cbc");
+ }
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(properties);
client.getOutInterceptors().add(ohandler);
try {
echo.echo("test");
- fail("Failure expected as RSA v1.5 is not allowed by default");
+ fail("Failure expected as RSA v1.5 is not allowed by configuration");
} catch (jakarta.xml.ws.soap.SOAPFaultException ex) {
// expected
}
@@ -391,15 +401,20 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
ConfigurationConstants.ENC_KEY_TRANSPORT,
"http://www.w3.org/2001/04/xmlenc#rsa-1_5"
);
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
+ if (JavaUtils.isFIPSEnabled()) {
+ inProperties.put(ConfigurationConstants.ALLOW_RSA15_KEY_TRANSPORT_ALGORITHM, "false");
+ }
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
try {
echo.echo("test");
- fail("Failure expected as RSA v1.5 is not allowed by default");
+ fail("Failure expected as RSA v1.5 is not allowed by configuration");
} catch (jakarta.xml.ws.soap.SOAPFaultException ex) {
// expected
}
@@ -440,7 +455,9 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
);
properties.setEncryptionUser("myalias");
properties.setTokenUser("username");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -487,7 +504,9 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.ENCRYPTION_USER, "myalias");
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
@@ -979,7 +998,9 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
properties.setActions(actions);
properties.setEncryptionUser("myalias");
properties.setSignatureUser("myalias");
- properties.setEncryptionSymAlgorithm(XMLSecurityConstants.NS_XENC_AES128);
+ properties.setEncryptionSymAlgorithm(JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
Properties cryptoProperties =
CryptoFactory.getProperties("outsecurity.properties", this.getClass().getClassLoader());
@@ -1025,7 +1046,9 @@ public class StaxToDOMRoundTripTest extends AbstractSecurityTest {
outConfig.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
outConfig.put(ConfigurationConstants.SIG_PROP_FILE, "outsecurity.properties");
outConfig.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
- outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, XMLSecurityConstants.NS_XENC_AES128);
+ outConfig.put(ConfigurationConstants.ENC_SYM_ALGO, JavaUtils.isFIPSEnabled()
+ ? XMLSecurityConstants.NS_XENC11_AES128_GCM
+ : XMLSecurityConstants.NS_XENC_AES128);
WSS4JStaxOutInterceptor ohandler = new WSS4JStaxOutInterceptor(outConfig);
client.getOutInterceptors().add(ohandler);
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JFaultCodeTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JFaultCodeTest.java
index 885c3524bf..9601b160c4 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JFaultCodeTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JFaultCodeTest.java
@@ -28,6 +28,7 @@ import jakarta.xml.soap.SOAPConstants;
import jakarta.xml.soap.SOAPMessage;
import org.apache.cxf.binding.soap.SoapFault;
import org.apache.cxf.binding.soap.SoapMessage;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.message.Exchange;
import org.apache.cxf.message.ExchangeImpl;
import org.apache.cxf.message.MessageImpl;
@@ -37,6 +38,7 @@ import org.apache.cxf.ws.security.SecurityConstants;
import org.apache.wss4j.common.ConfigurationConstants;
import org.apache.wss4j.common.WSS4JConstants;
+import org.junit.Assume;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
@@ -190,6 +192,8 @@ public class WSS4JFaultCodeTest extends AbstractSecurityTest {
// See CXF-6900.
@Test
public void testSignedEncryptedSOAP12Fault() throws Exception {
+ //fips: CBC mode not supported
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
Document doc = readDocument("wsse-response-fault.xml");
SoapMessage msg = getSoapMessageForDom(doc, SOAPConstants.SOAP_1_2_PROTOCOL);
@@ -211,6 +215,7 @@ public class WSS4JFaultCodeTest extends AbstractSecurityTest {
inHandler.setProperty(ConfigurationConstants.DEC_PROP_FILE, "insecurity.properties");
inHandler.setProperty(ConfigurationConstants.SIG_VER_PROP_FILE, "insecurity.properties");
inHandler.setProperty(ConfigurationConstants.PW_CALLBACK_CLASS, TestPwdCallback.class.getName());
+
inHandler.setProperty(
ConfigurationConstants.PW_CALLBACK_CLASS,
"org.apache.cxf.ws.security.wss4j.TestPwdCallback"
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutTest.java
index 9404bfd78f..9cfbcab99c 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutTest.java
@@ -37,6 +37,7 @@ import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.binding.soap.interceptor.MustUnderstandInterceptor;
import org.apache.cxf.binding.soap.saaj.SAAJInInterceptor;
import org.apache.cxf.helpers.CastUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.interceptor.Interceptor;
import org.apache.cxf.message.Exchange;
import org.apache.cxf.message.ExchangeImpl;
@@ -156,12 +157,12 @@ public class WSS4JInOutTest extends AbstractSecurityTest {
outProperties.put(ConfigurationConstants.ENC_PROP_FILE, "outsecurity.properties");
outProperties.put(ConfigurationConstants.USER, "myalias");
outProperties.put("password", "myAliasPassword");
-
+
Map<String, Object> inProperties = new HashMap<>();
inProperties.put(ConfigurationConstants.ACTION, ConfigurationConstants.ENCRYPTION);
inProperties.put(ConfigurationConstants.DEC_PROP_FILE, "insecurity.properties");
inProperties.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
-
+
List<String> xpaths = new ArrayList<>();
xpaths.add("//wsse:Security");
xpaths.add("//s:Body/xenc:EncryptedData");
@@ -199,12 +200,16 @@ public class WSS4JInOutTest extends AbstractSecurityTest {
@Test
public void testEncryptionWithAgreementMethodsX448() throws Exception {
+ //X448 isn't compliant in FIPS mode
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
Assume.assumeTrue(getJDKVersion() >= 16);
testEncryptionWithAgreementMethod("x448", "//dsig11:DEREncodedKeyValue");
}
@Test
public void testEncryptionWithAgreementMethodsX25519() throws Exception {
+ //X25519 isn't compliant in FIPS mode
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
Assume.assumeTrue(getJDKVersion() >= 16);
testEncryptionWithAgreementMethod("x25519", "//dsig11:DEREncodedKeyValue");
}
@@ -292,7 +297,7 @@ public class WSS4JInOutTest extends AbstractSecurityTest {
ConfigurationConstants.ENCRYPTION_PARTS,
"{Content}{" + WSS4JConstants.WSSE_NS + "}UsernameToken"
);
-
+
Map<String, Object> inProperties = new HashMap<>();
inProperties.put(
ConfigurationConstants.ACTION,
@@ -300,6 +305,7 @@ public class WSS4JInOutTest extends AbstractSecurityTest {
);
inProperties.put(ConfigurationConstants.DEC_PROP_FILE, "insecurity.properties");
inProperties.put(ConfigurationConstants.PW_CALLBACK_REF, new TestPwdCallback());
+
List<String> xpaths = new ArrayList<>();
xpaths.add("//wsse:Security");
diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutWithAttachmentsTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutWithAttachmentsTest.java
index 5511dfc295..895f3c122a 100644
--- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutWithAttachmentsTest.java
+++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/WSS4JInOutWithAttachmentsTest.java
@@ -42,6 +42,7 @@ import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.binding.soap.saaj.SAAJInInterceptor;
import org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor;
import org.apache.cxf.bus.managers.PhaseManagerImpl;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.interceptor.AttachmentInInterceptor;
import org.apache.cxf.interceptor.AttachmentOutInterceptor;
import org.apache.cxf.interceptor.Interceptor;
@@ -88,6 +89,8 @@ public class WSS4JInOutWithAttachmentsTest extends AbstractSecurityTest {
@Test
public void testEncryptWithAgreementMethodWithXECAndEDKeys() throws Exception {
Assume.assumeTrue(getJDKVersion() >= 16);
+ //ed25519 isn't compliant in FIPS mode
+ Assume.assumeFalse(JavaUtils.isFIPSEnabled());
testEncryptWithAgreementMethod("ed25519", "x25519");
}
diff --git a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/service/EncryptionProperties.java b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/service/EncryptionProperties.java
index b6e106c8b3..106fd13eb0 100644
--- a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/service/EncryptionProperties.java
+++ b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/service/EncryptionProperties.java
@@ -21,6 +21,7 @@ package org.apache.cxf.sts.service;
import java.util.ArrayList;
import java.util.List;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.wss4j.common.WSS4JConstants;
import org.apache.wss4j.dom.WSConstants;
@@ -30,8 +31,10 @@ import org.apache.wss4j.dom.WSConstants;
* certificate from a KeyStore) - everything else is optional.
*/
public class EncryptionProperties {
- private String encryptionAlgorithm = WSConstants.AES_256;
- private String keyWrapAlgorithm = WSConstants.KEYTRANSPORT_RSAOAEP;
+ private String encryptionAlgorithm =
+ JavaUtils.isFIPSEnabled() ? WSConstants.AES_256_GCM : WSConstants.AES_256;
+ private String keyWrapAlgorithm =
+ JavaUtils.isFIPSEnabled() ? WSConstants.KEYTRANSPORT_RSA15 : WSConstants.KEYTRANSPORT_RSAOAEP;
private int keyIdentifierType = WSConstants.ISSUER_SERIAL;
private List<String> acceptedEncryptionAlgorithms = new ArrayList<>();
private List<String> acceptedKeyWrapAlgorithms = new ArrayList<>();
@@ -39,17 +42,21 @@ public class EncryptionProperties {
public EncryptionProperties() {
// Default symmetric encryption algorithms
- acceptedEncryptionAlgorithms.add(WSS4JConstants.TRIPLE_DES);
- acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_128);
- acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_192);
- acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_256);
+ if (!JavaUtils.isFIPSEnabled()) {
+ acceptedEncryptionAlgorithms.add(WSS4JConstants.TRIPLE_DES);
+ acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_128);
+ acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_192);
+ acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_256);
+ }
acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_128_GCM);
acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_192_GCM);
acceptedEncryptionAlgorithms.add(WSS4JConstants.AES_256_GCM);
// Default key wrap algorithms
acceptedKeyWrapAlgorithms.add(WSS4JConstants.KEYTRANSPORT_RSA15);
- acceptedKeyWrapAlgorithms.add(WSS4JConstants.KEYTRANSPORT_RSAOAEP);
+ if (!JavaUtils.isFIPSEnabled()) {
+ acceptedKeyWrapAlgorithms.add(WSS4JConstants.KEYTRANSPORT_RSAOAEP);
+ }
}
/**
diff --git a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/jwt/JWTTokenProvider.java b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/jwt/JWTTokenProvider.java
index cc9ade1616..8306d7a2dc 100644
--- a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/jwt/JWTTokenProvider.java
+++ b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/provider/jwt/JWTTokenProvider.java
@@ -32,6 +32,7 @@ import javax.security.auth.callback.CallbackHandler;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.util.StringUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rs.security.jose.common.JoseConstants;
import org.apache.cxf.rs.security.jose.jwa.ContentAlgorithm;
import org.apache.cxf.rs.security.jose.jwa.KeyAlgorithm;
@@ -303,7 +304,8 @@ public class JWTTokenProvider implements TokenProvider {
try {
KeyAlgorithm.getAlgorithm(keyWrapAlgorithm);
} catch (IllegalArgumentException ex) {
- keyWrapAlgorithm = KeyAlgorithm.RSA_OAEP.name();
+ keyWrapAlgorithm = JavaUtils.isFIPSEnabled()
+ ? KeyAlgorithm.RSA1_5.name() : KeyAlgorithm.RSA_OAEP.name();
}
encProperties.put(JoseConstants.RSSEC_ENCRYPTION_KEY_ALGORITHM, keyWrapAlgorithm);
diff --git a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueEncryptedUnitTest.java b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueEncryptedUnitTest.java
index db80b7add6..235e42f083 100644
--- a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueEncryptedUnitTest.java
+++ b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueEncryptedUnitTest.java
@@ -27,6 +27,7 @@ import org.w3c.dom.Element;
import jakarta.xml.bind.JAXBElement;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
import org.apache.cxf.sts.QNameConstants;
@@ -77,7 +78,10 @@ public class IssueEncryptedUnitTest {
service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
EncryptionProperties encryptionProperties = new EncryptionProperties();
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(
+ JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
}
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
@@ -128,7 +132,9 @@ public class IssueEncryptedUnitTest {
service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
EncryptionProperties encryptionProperties = new EncryptionProperties();
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
}
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
@@ -187,7 +193,9 @@ public class IssueEncryptedUnitTest {
service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
EncryptionProperties encryptionProperties = new EncryptionProperties();
encryptionProperties.setEncryptionName("myservicekey");
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
@@ -219,6 +227,7 @@ public class IssueEncryptedUnitTest {
assertFalse(securityTokenResponse.isEmpty());
encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.KEYTRANSPORT_RSA15);
+
try {
issueOperation.issue(request, null, msgCtx);
fail("Failure expected on a bad encryption algorithm");
@@ -264,7 +273,9 @@ public class IssueEncryptedUnitTest {
request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));
JAXBElement<String> encryptionAlgorithmType =
new JAXBElement<String>(
- QNameConstants.ENCRYPTION_ALGORITHM, String.class, WSS4JConstants.AES_128
+ QNameConstants.ENCRYPTION_ALGORITHM, String.class, JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128
);
request.getAny().add(encryptionAlgorithmType);
@@ -323,9 +334,13 @@ public class IssueEncryptedUnitTest {
EncryptionProperties encryptionProperties = new EncryptionProperties();
encryptionProperties.setEncryptionName("myservicekey");
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
}
- encryptionProperties.setKeyWrapAlgorithm(WSS4JConstants.KEYTRANSPORT_RSAOAEP);
+ encryptionProperties.setKeyWrapAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.KEYTRANSPORT_RSA15
+ : WSS4JConstants.KEYTRANSPORT_RSAOAEP);
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
@@ -356,7 +371,9 @@ public class IssueEncryptedUnitTest {
response.getRequestSecurityTokenResponse();
assertFalse(securityTokenResponse.isEmpty());
- encryptionProperties.setKeyWrapAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setKeyWrapAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
try {
issueOperation.issue(request, null, msgCtx);
fail("Failure expected on a bad key-wrap algorithm");
@@ -391,7 +408,9 @@ public class IssueEncryptedUnitTest {
EncryptionProperties encryptionProperties = new EncryptionProperties();
encryptionProperties.setEncryptionName("myservicekey");
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
}
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
@@ -413,7 +432,9 @@ public class IssueEncryptedUnitTest {
request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));
JAXBElement<String> encryptionAlgorithmType =
new JAXBElement<String>(
- QNameConstants.KEYWRAP_ALGORITHM, String.class, WSS4JConstants.KEYTRANSPORT_RSAOAEP
+ QNameConstants.KEYWRAP_ALGORITHM, String.class, JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.KEYTRANSPORT_RSA15
+ : WSS4JConstants.KEYTRANSPORT_RSAOAEP
);
request.getAny().add(encryptionAlgorithmType);
@@ -464,7 +485,9 @@ public class IssueEncryptedUnitTest {
EncryptionProperties encryptionProperties = new EncryptionProperties();
encryptionProperties.setEncryptionName("myservicekey");
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
}
encryptionProperties.setKeyIdentifierType(WSConstants.SKI_KEY_IDENTIFIER);
service.setEncryptionProperties(encryptionProperties);
diff --git a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSCTUnitTest.java b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSCTUnitTest.java
index 4f7565dc28..2f1a069c52 100644
--- a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSCTUnitTest.java
+++ b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSCTUnitTest.java
@@ -30,6 +30,7 @@ import org.w3c.dom.Element;
import jakarta.xml.bind.JAXBElement;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
import org.apache.cxf.security.SecurityContext;
@@ -177,7 +178,9 @@ public class IssueSCTUnitTest {
service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
EncryptionProperties encryptionProperties = new EncryptionProperties();
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
}
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
diff --git a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlRealmUnitTest.java b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlRealmUnitTest.java
index e63da9afc5..df3402169f 100644
--- a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlRealmUnitTest.java
+++ b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlRealmUnitTest.java
@@ -32,6 +32,7 @@ import org.w3c.dom.Element;
import jakarta.xml.bind.JAXBElement;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
import org.apache.cxf.security.SecurityContext;
@@ -538,7 +539,9 @@ public class IssueSamlRealmUnitTest {
"org.apache.wss4j.crypto.provider", "org.apache.wss4j.common.crypto.Merlin"
);
properties.put("org.apache.wss4j.crypto.merlin.keystore.password", "security");
- properties.put("org.apache.wss4j.crypto.merlin.keystore.file", "x509.p12");
+ properties.put("org.apache.wss4j.crypto.merlin.keystore.file", JavaUtils.isFIPSEnabled()
+ ? "x509-fips.p12"
+ : "x509.p12");
properties.put("org.apache.wss4j.crypto.merlin.keystore.type", "pkcs12");
properties.put("org.apache.wss4j.crypto.merlin.keystore.private.password", "security");
diff --git a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlUnitTest.java b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlUnitTest.java
index b10fefa125..86462f11c5 100644
--- a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlUnitTest.java
+++ b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/operation/IssueSamlUnitTest.java
@@ -32,6 +32,7 @@ import org.w3c.dom.Text;
import jakarta.xml.bind.JAXBElement;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
import org.apache.cxf.security.SecurityContext;
@@ -432,7 +433,9 @@ public class IssueSamlUnitTest {
service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));
EncryptionProperties encryptionProperties = new EncryptionProperties();
if (!unrestrictedPoliciesInstalled) {
- encryptionProperties.setEncryptionAlgorithm(WSS4JConstants.AES_128);
+ encryptionProperties.setEncryptionAlgorithm(
+ JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM : WSS4JConstants.AES_128);
}
service.setEncryptionProperties(encryptionProperties);
issueOperation.setServices(Collections.singletonList(service));
@@ -833,9 +836,14 @@ public class IssueSamlUnitTest {
WSSecEncryptedKey builder = new WSSecEncryptedKey(doc);
builder.setUserInfo("mystskey");
builder.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);
- builder.setKeyEncAlgo(WSS4JConstants.KEYTRANSPORT_RSAOAEP);
-
- KeyGenerator keyGen = KeyUtils.getKeyGenerator(WSConstants.AES_128);
+ builder.setKeyEncAlgo(
+ JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.KEYTRANSPORT_RSA15
+ : WSS4JConstants.KEYTRANSPORT_RSAOAEP);
+
+ KeyGenerator keyGen = KeyUtils.getKeyGenerator(
+ JavaUtils.isFIPSEnabled()
+ ? WSConstants.AES_128_GCM : WSConstants.AES_128);
SecretKey symmetricKey = keyGen.generateKey();
builder.prepare(stsProperties.getSignatureCrypto(), symmetricKey);
diff --git a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/provider/SAMLProviderKeyTypeTest.java b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/provider/SAMLProviderKeyTypeTest.java
index 95938a8e9d..2cecbfbd72 100644
--- a/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/provider/SAMLProviderKeyTypeTest.java
+++ b/services/sts/sts-core/src/test/java/org/apache/cxf/sts/token/provider/SAMLProviderKeyTypeTest.java
@@ -25,6 +25,7 @@ import java.util.Random;
import org.w3c.dom.Element;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
import org.apache.cxf.sts.STSConstants;
@@ -602,14 +603,18 @@ public class SAMLProviderKeyTypeTest {
createProviderParameters(WSS4JConstants.WSS_SAML2_TOKEN_TYPE, STSConstants.SYMMETRIC_KEY_KEYTYPE);
KeyRequirements keyRequirements = providerParameters.getKeyRequirements();
- keyRequirements.setEncryptWith(WSS4JConstants.AES_128);
+ keyRequirements.setEncryptWith(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_128_GCM
+ : WSS4JConstants.AES_128);
keyRequirements.setKeySize(92);
TokenProviderResponse providerResponse = samlTokenProvider.createToken(providerParameters);
assertNotNull(providerResponse);
assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId() != null);
keyRequirements.setKeySize(128);
- keyRequirements.setEncryptWith(WSS4JConstants.AES_256);
+ keyRequirements.setEncryptWith(JavaUtils.isFIPSEnabled()
+ ? WSS4JConstants.AES_256_GCM
+ : WSS4JConstants.AES_256);
providerResponse = samlTokenProvider.createToken(providerParameters);
assertNotNull(providerResponse);
assertTrue(providerResponse.getToken() != null && providerResponse.getTokenId() != null);
@@ -706,7 +711,9 @@ public class SAMLProviderKeyTypeTest {
"org.apache.wss4j.crypto.provider", "org.apache.wss4j.common.crypto.Merlin"
);
properties.put("org.apache.wss4j.crypto.merlin.keystore.password", "security");
- properties.put("org.apache.wss4j.crypto.merlin.keystore.file", "x509.p12");
+ properties.put("org.apache.wss4j.crypto.merlin.keystore.file", JavaUtils.isFIPSEnabled()
+ ? "x509-fips.p12"
+ : "x509.p12");
properties.put("org.apache.wss4j.crypto.merlin.keystore.type", "pkcs12");
properties.put("org.apache.wss4j.crypto.merlin.keystore.private.password", "security");
diff --git a/services/sts/sts-core/src/test/resources/x509-fips.p12 b/services/sts/sts-core/src/test/resources/x509-fips.p12
new file mode 100644
index 0000000000..737cf5f2e7
Binary files /dev/null and b/services/sts/sts-core/src/test/resources/x509-fips.p12 differ
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/asymmetric_encr/AsymmetricEncryptionTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/asymmetric_encr/AsymmetricEncryptionTest.java
index dfe8cd86cc..6f9d52ce92 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/asymmetric_encr/AsymmetricEncryptionTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/asymmetric_encr/AsymmetricEncryptionTest.java
@@ -22,6 +22,7 @@ import java.util.HashMap;
import java.util.Map;
import org.apache.cxf.Bus;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.TestParam;
import org.apache.cxf.systest.sts.deployment.STSServer;
import org.apache.cxf.systest.sts.deployment.StaxSTSServer;
@@ -56,8 +57,12 @@ public class AsymmetricEncryptionTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new STSServer(
- AsymmetricEncryptionTest.class.getResource("cxf-sts.xml"),
- AsymmetricEncryptionTest.class.getResource("stax-cxf-sts.xml"))));
+ AsymmetricEncryptionTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-sts-fips.xml"
+ : "cxf-sts.xml"),
+ AsymmetricEncryptionTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "stax-cxf-sts-fips.xml"
+ : "stax-cxf-sts.xml"))));
}
@Parameters(name = "{0}")
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/binarysecuritytoken/BinarySecurityTokenTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/binarysecuritytoken/BinarySecurityTokenTest.java
index b6b24480cb..dc38115e5d 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/binarysecuritytoken/BinarySecurityTokenTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/binarysecuritytoken/BinarySecurityTokenTest.java
@@ -23,6 +23,7 @@ import java.net.URL;
import javax.xml.namespace.QName;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
@@ -66,8 +67,12 @@ public class BinarySecurityTokenTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- BinarySecurityTokenTest.class.getResource("cxf-service.xml"),
- BinarySecurityTokenTest.class.getResource("stax-cxf-service.xml")
+ BinarySecurityTokenTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml"),
+ BinarySecurityTokenTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "stax-cxf-service-fips.xml"
+ : "stax-cxf-service.xml")
)));
assertTrue(launchServer(new StaxSTSServer()));
}
@@ -85,7 +90,9 @@ public class BinarySecurityTokenTest extends AbstractBusClientServerTestBase {
public void testBinarySecurityToken() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = BinarySecurityTokenTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = BinarySecurityTokenTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricBSTPort");
DoubleItPortType asymmetricBSTPort =
@@ -105,7 +112,9 @@ public class BinarySecurityTokenTest extends AbstractBusClientServerTestBase {
public void testBadBinarySecurityToken() throws Exception {
createBus(getClass().getResource("cxf-bad-client.xml").toString());
- URL wsdl = BinarySecurityTokenTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = BinarySecurityTokenTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricBSTPort");
DoubleItPortType asymmetricBSTPort =
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/CachingTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/CachingTest.java
index e22910ae7f..0b3ee17648 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/CachingTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/CachingTest.java
@@ -30,6 +30,7 @@ import org.apache.cxf.Bus;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.endpoint.Endpoint;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.systest.sts.deployment.STSServer;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
@@ -61,7 +62,9 @@ public class CachingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- ServerCachingTest.class.getResource("cxf-service.xml")
+ ServerCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml")
)));
assertTrue(launchServer(new STSServer()));
}
@@ -70,7 +73,9 @@ public class CachingTest extends AbstractBusClientServerTestBase {
public void testSTSClientCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = CachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = CachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1Port");
DoubleItPortType port =
@@ -108,7 +113,9 @@ public class CachingTest extends AbstractBusClientServerTestBase {
public void testDisableProxyCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = CachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = CachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1Port2");
DoubleItPortType port =
@@ -143,7 +150,9 @@ public class CachingTest extends AbstractBusClientServerTestBase {
public void testImminentExpiry() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = CachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = CachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1Port");
DoubleItPortType port =
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/ServerCachingTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/ServerCachingTest.java
index bd5161e73c..0ea92f8291 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/ServerCachingTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/caching/ServerCachingTest.java
@@ -32,6 +32,7 @@ import org.apache.cxf.Bus;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.endpoint.Endpoint;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.systest.sts.deployment.STSServer;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
@@ -72,10 +73,14 @@ public class ServerCachingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- ServerCachingTest.class.getResource("cxf-service.xml")
+ ServerCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml")
)));
assertTrue(launchServer(new DoubleItServer(
- ServerCachingTest.class.getResource("cxf-caching-service.xml")
+ ServerCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-caching-service-fips.xml"
+ : "cxf-caching-service.xml")
)));
assertTrue(launchServer(new STSServer()));
@@ -85,7 +90,9 @@ public class ServerCachingTest extends AbstractBusClientServerTestBase {
public void testServerSideSAMLTokenCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = ServerCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = ServerCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1AlternativePort");
DoubleItPortType port =
@@ -130,7 +137,9 @@ public class ServerCachingTest extends AbstractBusClientServerTestBase {
public void testServerSideUsernameTokenCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = ServerCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = ServerCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportUTPort");
DoubleItPortType transportUTPort =
@@ -162,7 +171,9 @@ public class ServerCachingTest extends AbstractBusClientServerTestBase {
public void testServerSideBinarySecurityTokenCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = ServerCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = ServerCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricBSTPort");
DoubleItPortType bstPort =
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecureConversationTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecureConversationTest.java
index 13bc973ee6..9d6d10a4e3 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecureConversationTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecureConversationTest.java
@@ -23,6 +23,7 @@ import java.net.URL;
import javax.xml.namespace.QName;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.systest.sts.deployment.STSServer;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
@@ -50,17 +51,23 @@ public class SecureConversationTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- SecureConversationTest.class.getResource("cxf-service.xml")
+ SecureConversationTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml")
)));
assertTrue(launchServer(new STSServer(
- SecureConversationTest.class.getResource("cxf-sts.xml"))));
+ SecureConversationTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-sts-fips.xml"
+ : "cxf-sts.xml"))));
}
@org.junit.Test
public void testSecureConversation() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SecureConversationTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SecureConversationTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSecureConvPort");
DoubleItPortType transportPort =
@@ -74,7 +81,9 @@ public class SecureConversationTest extends AbstractBusClientServerTestBase {
public void testSecureConversationSymmetric() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SecureConversationTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SecureConversationTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSecureConvPort");
DoubleItPortType symmetricPort =
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenCancelTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenCancelTest.java
index 5e58be64a3..c7b1eb70db 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenCancelTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenCancelTest.java
@@ -22,6 +22,7 @@ import java.util.HashMap;
import java.util.Map;
import org.apache.cxf.Bus;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.deployment.STSServer;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.ws.security.SecurityConstants;
@@ -46,7 +47,9 @@ public class SecurityContextTokenCancelTest extends AbstractBusClientServerTestB
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new STSServer(
- SecurityContextTokenCancelTest.class.getResource("cxf-sts.xml"))));
+ SecurityContextTokenCancelTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-sts-fips.xml"
+ : "cxf-sts.xml"))));
}
@org.junit.Test
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenUnitTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenUnitTest.java
index a89402a023..7ca0a1737f 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenUnitTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/secure_conv/SecurityContextTokenUnitTest.java
@@ -22,6 +22,7 @@ import java.util.HashMap;
import java.util.Map;
import org.apache.cxf.Bus;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.TestParam;
import org.apache.cxf.systest.sts.deployment.STSServer;
import org.apache.cxf.systest.sts.deployment.StaxSTSServer;
@@ -54,8 +55,12 @@ public class SecurityContextTokenUnitTest extends AbstractBusClientServerTestBas
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new StaxSTSServer(
- SecurityContextTokenUnitTest.class.getResource("cxf-sts.xml"),
- SecurityContextTokenUnitTest.class.getResource("stax-cxf-sts.xml"))));
+ SecurityContextTokenUnitTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-sts-fips.xml"
+ : "cxf-sts.xml"),
+ SecurityContextTokenUnitTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "stax-cxf-sts-fips.xml"
+ : "stax-cxf-sts.xml"))));
}
@Parameters(name = "{0}")
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/sts_sender_vouches/STSSenderVouchesTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/sts_sender_vouches/STSSenderVouchesTest.java
index ecdda2893b..b6eb631a92 100644
--- a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/sts_sender_vouches/STSSenderVouchesTest.java
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/sts_sender_vouches/STSSenderVouchesTest.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
@@ -62,11 +63,17 @@ public class STSSenderVouchesTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- STSSenderVouchesTest.class.getResource("cxf-service.xml")
+ STSSenderVouchesTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml")
)));
assertTrue(launchServer(new StaxSTSServer(
- STSSenderVouchesTest.class.getResource("cxf-sts.xml"),
- STSSenderVouchesTest.class.getResource("stax-cxf-sts.xml")
+ STSSenderVouchesTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-sts-fips.xml"
+ : "cxf-sts.xml"),
+ STSSenderVouchesTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "stax-cxf-sts-fips.xml"
+ : "stax-cxf-sts.xml")
)));
}
@@ -81,7 +88,9 @@ public class STSSenderVouchesTest extends AbstractBusClientServerTestBase {
public void testSAML2SenderVouches() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = STSSenderVouchesTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = STSSenderVouchesTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2Port");
DoubleItPortType port =
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/cxf-sts-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/cxf-sts-fips.xml
new file mode 100644
index 0000000000..ec4753083d
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/cxf-sts-fips.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="x509STSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="x509IssueDelegate"/>
+ </bean>
+ <bean id="x509IssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="x509SamlTokenProvider"/>
+ <property name="services" ref="x509Service"/>
+ <property name="stsProperties" ref="x509STSProperties"/>
+ <property name="encryptIssuedToken" value="true"/>
+ </bean>
+ <bean id="x509SamlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
+ </bean>
+ <bean id="x509Service" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="x509Endpoints"/>
+ <property name="encryptionProperties" ref="encProperties"/>
+ </bean>
+ <util:list id="x509Endpoints">
+ <value>https://localhost:(\d)*/doubleit/services/doubleittransport.*
+ </value>
+ </util:list>
+ <bean id="encProperties" class="org.apache.cxf.sts.service.EncryptionProperties">
+ <property name="encryptionAlgorithm" value="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
+ </bean>
+ <bean id="x509STSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="stsKeystore.properties"/>
+ <property name="signatureUsername" value="mystskey"/>
+ <property name="callbackHandlerClass" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <property name="encryptionCryptoProperties" value="stsKeystore.properties"/>
+ <property name="issuer" value="DoubleItSTSIssuer"/>
+ <property name="encryptionUsername" value="useReqSigCert"/>
+ </bean>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#x509STSProviderBean" address="http://localhost:${testutil.ports.STSServer}/SecurityTokenService/X509" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/ws-trust-1.4-service.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:X509_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/stax-cxf-sts-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/stax-cxf-sts-fips.xml
new file mode 100644
index 0000000000..5366b549dd
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/stax-cxf-sts-fips.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="x509STSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="x509IssueDelegate"/>
+ </bean>
+ <bean id="x509IssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="x509SamlTokenProvider"/>
+ <property name="services" ref="x509Service"/>
+ <property name="stsProperties" ref="x509STSProperties"/>
+ <property name="encryptIssuedToken" value="true"/>
+ </bean>
+ <bean id="x509SamlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
+ </bean>
+ <bean id="x509Service" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="x509Endpoints"/>
+ <property name="encryptionProperties" ref="encProperties"/>
+ </bean>
+ <util:list id="x509Endpoints">
+ <value>https://localhost:(\d)*/doubleit/services/doubleittransport.*
+ </value>
+ </util:list>
+ <bean id="encProperties" class="org.apache.cxf.sts.service.EncryptionProperties">
+ <property name="encryptionAlgorithm" value="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
+ </bean>
+ <bean id="x509STSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="stsKeystore.properties"/>
+ <property name="signatureUsername" value="mystskey"/>
+ <property name="callbackHandlerClass" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <property name="encryptionCryptoProperties" value="stsKeystore.properties"/>
+ <property name="issuer" value="DoubleItSTSIssuer"/>
+ <property name="encryptionUsername" value="useReqSigCert"/>
+ </bean>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#x509STSProviderBean" address="http://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/X509" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/asymmetric_encr/ws-trust-1.4-service.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:X509_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/DoubleIt-fips.wsdl b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..7969877a22
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/DoubleIt-fips.wsdl
@@ -0,0 +1,146 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItAsymmetricBSTBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingAsymmetricBSTPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItAsymmetricBSTPort" binding="tns:DoubleItAsymmetricBSTBinding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricbst"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItBindingAsymmetricBSTPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:AsymmetricBinding>
+ <wsp:Policy>
+ <sp:InitiatorToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:InitiatorToken>
+ <sp:RecipientToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ <sp:RequireIssuerSerialReference/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:RecipientToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:AsymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Output_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/cxf-service-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/cxf-service-fips.xml
new file mode 100644
index 0000000000..a9e1c12ee4
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/cxf-service-fips.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricBSTPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitasymmetricbst" wsdlLocation="org/apache/cxf/systest/sts/binarysecuritytoken/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="common.CommonCallbackHandler"/>
+ <entry key="ws-security.bst.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSTokenValidator"/>
+ </entry>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="security.encryption.username" value="useReqSigCert"/>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/Transport?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="properties">
+ <map>
+ <entry key="security.username" value="bob"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ </map>
+ </property>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <http:conduit name="https://localhost.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/stax-cxf-service-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/stax-cxf-service-fips.xml
new file mode 100644
index 0000000000..df9ab6c15b
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/binarysecuritytoken/stax-cxf-service-fips.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricBSTPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitasymmetricbst" wsdlLocation="org/apache/cxf/systest/sts/binarysecuritytoken/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="common.CommonCallbackHandler"/>
+ <entry key="ws-security.bst.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSStaxTokenValidator"/>
+ </entry>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="security.encryption.username" value="useReqSigCert"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/Transport?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="properties">
+ <map>
+ <entry key="security.username" value="bob"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </map>
+ </property>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <http:conduit name="https://localhost.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..761297e7d3
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl
@@ -0,0 +1,308 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItTransportUTBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportUTPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML1Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML1Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML1Binding2" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML1Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItAsymmetricBSTBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingAsymmetricBSTPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItTransportUTPort" binding="tns:DoubleItTransportUTBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportut"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML1Port" binding="tns:DoubleItTransportSAML1Binding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml1"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML1Port2" binding="tns:DoubleItTransportSAML1Binding2">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml12"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML1AlternativePort" binding="tns:DoubleItTransportSAML1Binding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml1alternative"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItAsymmetricBSTPort" binding="tns:DoubleItAsymmetricBSTBinding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricbst"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportUTPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp:TripleDes/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken11/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML1Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp:TripleDes/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingAsymmetricBSTPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:AsymmetricBinding>
+ <wsp:Policy>
+ <sp:InitiatorToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:InitiatorToken>
+ <sp:RecipientToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ <sp:RequireIssuerSerialReference/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:RecipientToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:AsymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Output_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/cxf-caching-service-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/cxf-caching-service-fips.xml
new file mode 100644
index 0000000000..87ee6c184e
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/cxf-caching-service-fips.xml
@@ -0,0 +1,110 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.caching.DoubleItPortTypeImpl" endpointName="s:DoubleItTransportSAML1AlternativePort" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleittransportsaml1alternative" wsdlLocation="org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.saml1.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSTokenValidator">
+ <constructor-arg value="true"/>
+ </bean>
+ </entry>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/Transport?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.caching.DoubleItPortTypeImpl" endpointName="s:DoubleItTransportUTPort" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleittransportut" wsdlLocation="org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="ws-security.ut.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSTokenValidator"/>
+ </entry>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/Transport?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.caching.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricBSTPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer.2}/doubleit/services/doubleitasymmetricbst" wsdlLocation="org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="ws-security.bst.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSTokenValidator"/>
+ </entry>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="security.encryption.properties" value="serviceKeystore.properties"/>
+ <entry key="security.encryption.username" value="useReqSigCert"/>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/Transport?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.DoubleItServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+ <http:conduit name="https://localhost.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/cxf-service-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/cxf-service-fips.xml
new file mode 100644
index 0000000000..bb5856966b
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/caching/cxf-service-fips.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItTransportSAML1Port" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleittransportsaml1" wsdlLocation="org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.saml1.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSTokenValidator"/>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItTransportSAML1Port2" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleittransportsaml12" wsdlLocation="org/apache/cxf/systest/sts/caching/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.saml1.validator">
+ <bean class="org.apache.cxf.ws.security.trust.STSTokenValidator"/>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.DoubleItServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+ <http:conduit name="https://localhost.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..74d35a5d8c
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl
@@ -0,0 +1,336 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItTransportSecureConvBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSecureConvPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItSymmetricSecureConvBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingSymmetricSecureConvPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSupportingBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSupportingPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItTransportSecureConvPort" binding="tns:DoubleItTransportSecureConvBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsecureconv"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItSymmetricSecureConvPort" binding="tns:DoubleItSymmetricSecureConvBinding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitsymmetricsecureconv"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSupportingPort"
+ binding="tns:DoubleItTransportSupportingBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsupporting"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSecureConvPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:SecureConversationToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:BootstrapPolicy>
+ <wsp:Policy>
+ <sp:TransportBinding>
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:Policy>
+ </sp:BootstrapPolicy>
+ </wsp:Policy>
+ </sp:SecureConversationToken>
+ </wsp:Policy>
+ </sp:EndorsingSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingSymmetricSecureConvPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:SymmetricBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:SecureConversationToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:RequireDerivedKeys/>
+ <sp:BootstrapPolicy>
+ <wsp:Policy>
+ <sp:TransportBinding>
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:Policy>
+ </sp:BootstrapPolicy>
+ </wsp:Policy>
+ </sp:SecureConversationToken>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSupportingPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:SupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:SecureConversationToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:BootstrapPolicy>
+ <wsp:Policy />
+ </sp:BootstrapPolicy>
+ </wsp:Policy>
+ </sp:SecureConversationToken>
+ </wsp:Policy>
+ </sp:SupportingTokens>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Output_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/cxf-service-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/cxf-service-fips.xml
new file mode 100644
index 0000000000..9cbeb10186
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/cxf-service-fips.xml
@@ -0,0 +1,112 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+
+ <bean id="doubleItNoSecurity" class="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl">
+ <property name="enforcePrincipal" value="false"/>
+ </bean>
+
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleittransportsecureconv" implementor="#doubleItNoSecurity" endpointName="s:DoubleItTransportSecureConvPort" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleittransportsecureconv" wsdlLocation="org/apache/cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.sct.validator">
+ <bean class="org.apache.cxf.systest.sts.secure_conv.SCTTokenValidator"/>
+ </entry>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/TransportSCT?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleitsymmetricsecureconv" implementor="#doubleItNoSecurity" endpointName="s:DoubleItSymmetricSecureConvPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer.2}/doubleit/services/doubleitsymmetricsecureconv" wsdlLocation="org/apache/cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.sct.validator">
+ <bean class="org.apache.cxf.systest.sts.secure_conv.SCTTokenValidator"/>
+ </entry>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/TransportSCT?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleittransportsupporting" implementor="#doubleItNoSecurity" endpointName="s:DoubleItTransportSupportingPort" serviceName="s:DoubleItService" depends-on="ClientAuthHttpsSettings" address="https://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleittransportsupporting" wsdlLocation="org/apache/cxf/systest/sts/secure_conv/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.sct.validator">
+ <bean class="org.apache.cxf.systest.sts.secure_conv.SCTTokenValidator"/>
+ </entry>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/TransportSCT?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port"/>
+ <property name="tokenType" value="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"/>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+ <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.DoubleItServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/cxf-sts-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/cxf-sts-fips.xml
new file mode 100644
index 0000000000..946efd34e1
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/cxf-sts-fips.xml
@@ -0,0 +1,162 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="transportSTSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="transportIssueDelegate"/>
+ <property name="validateOperation" ref="transportValidateDelegate"/>
+ <property name="cancelOperation" ref="transportCancelDelegate"/>
+ </bean>
+ <bean id="transportSTSEncryptedProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="transportEncryptedIssueDelegate"/>
+ <property name="validateOperation" ref="transportValidateDelegate"/>
+ </bean>
+ <bean id="transportIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="transportTokenProviders"/>
+ <property name="services" ref="transportService"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="transportEncryptedIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="transportTokenProviders"/>
+ <property name="services" ref="transportService"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="encryptIssuedToken" value="true"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="transportValidateDelegate" class="org.apache.cxf.sts.operation.TokenValidateOperation">
+ <property name="tokenProviders" ref="transportTokenProviders"/>
+ <property name="tokenValidators" ref="transportTokenValidators"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="transportCancelDelegate" class="org.apache.cxf.sts.operation.TokenCancelOperation">
+ <property name="tokenCancellers" ref="transportTokenCancellers"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="defaultTokenStore" class="org.apache.cxf.sts.cache.DefaultInMemoryTokenStore">
+ </bean>
+ <util:list id="transportTokenProviders">
+ <ref bean="transportSCTProvider"/>
+ <ref bean="transportSCTSamlTokenProvider"/>
+ </util:list>
+ <util:list id="transportTokenValidators">
+ <ref bean="transportSCTValidator"/>
+ </util:list>
+ <util:list id="transportTokenCancellers">
+ <ref bean="transportSCTCanceller"/>
+ </util:list>
+ <bean id="transportSCTProvider" class="org.apache.cxf.sts.token.provider.SCTProvider">
+ </bean>
+ <bean id="transportSCTSamlTokenProvider" class="org.apache.cxf.systest.sts.secure_conv.SCTSAMLTokenProvider">
+ </bean>
+ <bean id="transportSCTValidator" class="org.apache.cxf.sts.token.validator.SCTValidator">
+ </bean>
+ <bean id="transportSCTCanceller" class="org.apache.cxf.sts.token.canceller.SCTCanceller">
+ </bean>
+ <bean id="transportService" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="transportEndpoints"/>
+ </bean>
+ <util:list id="transportEndpoints">
+ <value>https://localhost:(\d)*/doubleit/services/doubleittransport.*
+ </value>
+ <value>http://localhost:(\d)*/doubleit/services/doubleitsymmetric.*
+ </value>
+ </util:list>
+ <bean id="encProperties" class="org.apache.cxf.sts.service.EncryptionProperties">
+ <property name="encryptionAlgorithm" value="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
+ </bean>
+ <bean id="transportSTSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="stsKeystore.properties"/>
+ <property name="signatureUsername" value="mystskey"/>
+ <property name="callbackHandlerClass" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <property name="encryptionCryptoProperties" value="stsKeystore.properties"/>
+ <property name="encryptionProperties" ref="encProperties"/>
+ <property name="issuer" value="DoubleItSTSIssuer"/>
+ <property name="encryptionUsername" value="myservicekey"/>
+ </bean>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#transportSTSProviderBean" address="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/TransportSCT" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl" depends-on="ClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port">
+ <jaxws:inInterceptors>
+ <ref bean="sctInterceptor"/>
+ </jaxws:inInterceptors>
+ <jaxws:outInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outInterceptors>
+ <jaxws:outFaultInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outFaultInterceptors>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#transportSTSEncryptedProviderBean" address="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/TransportSCTEncrypted" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl" depends-on="ClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port">
+ <jaxws:inInterceptors>
+ <ref bean="sctInterceptor"/>
+ </jaxws:inInterceptors>
+ <jaxws:outInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outInterceptors>
+ <jaxws:outFaultInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outFaultInterceptors>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#transportSTSProviderBean" address="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/TransportEndorsing" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl" depends-on="ClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Endorsing_Port">
+ <jaxws:inInterceptors>
+ <ref bean="sctInterceptor"/>
+ </jaxws:inInterceptors>
+ <jaxws:outInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outInterceptors>
+ <jaxws:outFaultInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outFaultInterceptors>
+ <jaxws:properties>
+ <entry key="org.apache.cxf.ws.security.tokenstore.TokenStore">
+ <ref bean="defaultTokenStore"/>
+ </entry>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <bean id="sctInterceptor" class="org.apache.cxf.sts.interceptor.SCTInInterceptor"/>
+ <bean id="sctOutInterceptor" class="org.apache.cxf.sts.interceptor.SCTOutInterceptor"/>
+ <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.STSServer}">
+ <httpj:tlsServerParameters>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="stskpass">
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/stax-cxf-sts-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/stax-cxf-sts-fips.xml
new file mode 100644
index 0000000000..9a5a4b1258
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/stax-cxf-sts-fips.xml
@@ -0,0 +1,169 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="transportSTSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="transportIssueDelegate"/>
+ <property name="validateOperation" ref="transportValidateDelegate"/>
+ <property name="cancelOperation" ref="transportCancelDelegate"/>
+ </bean>
+ <bean id="transportSTSEncryptedProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="transportEncryptedIssueDelegate"/>
+ <property name="validateOperation" ref="transportValidateDelegate"/>
+ </bean>
+ <bean id="transportIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="transportTokenProviders"/>
+ <property name="services" ref="transportService"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="transportEncryptedIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="transportTokenProviders"/>
+ <property name="services" ref="transportService"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="encryptIssuedToken" value="true"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="transportValidateDelegate" class="org.apache.cxf.sts.operation.TokenValidateOperation">
+ <property name="tokenProviders" ref="transportTokenProviders"/>
+ <property name="tokenValidators" ref="transportTokenValidators"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="transportCancelDelegate" class="org.apache.cxf.sts.operation.TokenCancelOperation">
+ <property name="tokenCancellers" ref="transportTokenCancellers"/>
+ <property name="stsProperties" ref="transportSTSProperties"/>
+ <property name="tokenStore" ref="defaultTokenStore"/>
+ </bean>
+ <bean id="defaultTokenStore" class="org.apache.cxf.sts.cache.DefaultInMemoryTokenStore">
+ </bean>
+ <util:list id="transportTokenProviders">
+ <ref bean="transportSCTProvider"/>
+ <ref bean="transportSCTSamlTokenProvider"/>
+ </util:list>
+ <util:list id="transportTokenValidators">
+ <ref bean="transportSCTValidator"/>
+ </util:list>
+ <util:list id="transportTokenCancellers">
+ <ref bean="transportSCTCanceller"/>
+ </util:list>
+ <bean id="transportSCTProvider" class="org.apache.cxf.sts.token.provider.SCTProvider">
+ </bean>
+ <bean id="transportSCTSamlTokenProvider" class="org.apache.cxf.systest.sts.secure_conv.SCTSAMLTokenProvider">
+ </bean>
+ <bean id="transportSCTValidator" class="org.apache.cxf.sts.token.validator.SCTValidator">
+ </bean>
+ <bean id="transportSCTCanceller" class="org.apache.cxf.sts.token.canceller.SCTCanceller">
+ </bean>
+ <bean id="transportService" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="transportEndpoints"/>
+ </bean>
+ <util:list id="transportEndpoints">
+ <value>https://localhost:(\d)*/doubleit/services/doubleittransport.*
+ </value>
+ <value>http://localhost:(\d)*/doubleit/services/doubleitsymmetric.*
+ </value>
+ </util:list>
+ <bean id="encProperties" class="org.apache.cxf.sts.service.EncryptionProperties">
+ <property name="encryptionAlgorithm" value="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
+ </bean>
+ <bean id="transportSTSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="stsKeystore.properties"/>
+ <property name="signatureUsername" value="mystskey"/>
+ <property name="callbackHandlerClass" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <property name="encryptionCryptoProperties" value="stsKeystore.properties"/>
+ <property name="encryptionProperties" ref="encProperties"/>
+ <property name="issuer" value="DoubleItSTSIssuer"/>
+ <property name="encryptionUsername" value="myservicekey"/>
+ </bean>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#transportSTSProviderBean" address="https://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/TransportSCT" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl" depends-on="StaxClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port">
+ <jaxws:inInterceptors>
+ <ref bean="sctInterceptor"/>
+ </jaxws:inInterceptors>
+ <jaxws:outInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outInterceptors>
+ <jaxws:outFaultInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outFaultInterceptors>
+ <jaxws:properties>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#transportSTSEncryptedProviderBean" address="https://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/TransportSCTEncrypted" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl" depends-on="StaxClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port">
+ <jaxws:inInterceptors>
+ <ref bean="sctInterceptor"/>
+ </jaxws:inInterceptors>
+ <jaxws:outInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outInterceptors>
+ <jaxws:outFaultInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outFaultInterceptors>
+ <jaxws:properties>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#transportSTSProviderBean" address="https://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/TransportEndorsing" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl" depends-on="StaxClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Endorsing_Port">
+ <jaxws:inInterceptors>
+ <ref bean="sctInterceptor"/>
+ </jaxws:inInterceptors>
+ <jaxws:outInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outInterceptors>
+ <jaxws:outFaultInterceptors>
+ <ref bean="sctOutInterceptor"/>
+ </jaxws:outFaultInterceptors>
+ <jaxws:properties>
+ <entry key="org.apache.cxf.ws.security.tokenstore.TokenStore">
+ <ref bean="defaultTokenStore"/>
+ </entry>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <bean id="sctInterceptor" class="org.apache.cxf.sts.interceptor.SCTInInterceptor"/>
+ <bean id="sctOutInterceptor" class="org.apache.cxf.sts.interceptor.SCTOutInterceptor"/>
+ <httpj:engine-factory id="StaxClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.StaxSTSServer}">
+ <httpj:tlsServerParameters>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="stskpass">
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl
new file mode 100644
index 0000000000..28c58808ea
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/secure_conv/ws-trust-1.4-service-fips.wsdl
@@ -0,0 +1,354 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<wsdl:definitions xmlns:tns="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wstrust="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsap10="http://www.w3.org/2006/05/addressing/wsdl" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" [...]
+ <wsdl:types>
+ <xs:schema elementFormDefault="qualified" targetNamespace="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:element name="RequestSecurityTokenResponse" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:complexType name="AbstractRequestSecurityTokenType">
+ <xs:sequence>
+ <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:attribute name="Context" type="xs:anyURI" use="optional"/>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenCollection" type="wst:RequestSecurityTokenCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenCollectionType">
+ <xs:sequence>
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType" minOccurs="2" maxOccurs="unbounded"/>
+ </xs:sequence>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenResponseCollection" type="wst:RequestSecurityTokenResponseCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenResponseCollectionType">
+ <xs:sequence>
+ <xs:element ref="wst:RequestSecurityTokenResponse" minOccurs="1" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ </xs:schema>
+ </wsdl:types>
+ <!-- WS-Trust defines the following GEDs -->
+ <wsdl:message name="RequestSecurityTokenMsg">
+ <wsdl:part name="request" element="wst:RequestSecurityToken"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseMsg">
+ <wsdl:part name="response" element="wst:RequestSecurityTokenResponse"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenCollectionMsg">
+ <wsdl:part name="requestCollection" element="wst:RequestSecurityTokenCollection"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseCollectionMsg">
+ <wsdl:part name="responseCollection" element="wst:RequestSecurityTokenResponseCollection"/>
+ </wsdl:message>
+ <!-- This portType an example of a Requestor (or other) endpoint that
+ Accepts SOAP-based challenges from a Security Token Service -->
+ <wsdl:portType name="WSSecurityRequestor">
+ <wsdl:operation name="Challenge">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an STS supporting full protocol -->
+ <wsdl:portType name="STS">
+ <wsdl:operation name="Cancel">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Issue">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal" message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KET" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/KETFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <wsdl:input message="tns:RequestSecurityTokenCollectionMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an endpoint that accepts
+ Unsolicited RequestSecurityTokenResponse messages -->
+ <wsdl:portType name="SecurityTokenResponseService">
+ <wsdl:operation name="RequestSecurityTokenResponse">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <wsdl:binding name="Transport_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="Transport_Endorsing_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_Endorsing_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="SecurityTokenService">
+ <wsdl:port name="Transport_Port" binding="tns:Transport_Binding">
+ <soap:address location="https://localhost:8084/SecurityTokenService/Transport"/>
+ </wsdl:port>
+ <wsdl:port name="Transport_Endorsing_Port" binding="tns:Transport_Endorsing_Binding">
+ <soap:address location="https://localhost:8084/SecurityTokenService/TransportEndorsing"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="Transport_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy>
+ <sp:RequireClientCertificate/>
+ </wsp:Policy>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Transport_Endorsing_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy>
+ <sp:RequireClientCertificate/>
+ </wsp:Policy>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:SecurityContextToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ </wsp:Policy>
+ </sp:SecurityContextToken>
+ </wsp:Policy>
+ </sp:EndorsingSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Input_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Output_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/DoubleIt-fips.wsdl b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..065aeac521
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/DoubleIt-fips.wsdl
@@ -0,0 +1,171 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItAsymmetricSAML2Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingAsymmetricSAML2Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItAsymmetricSAML2Port" binding="tns:DoubleItAsymmetricSAML2Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml2"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItBindingAsymmetricSAML2Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:AsymmetricBinding>
+ <wsp:Policy>
+ <sp:InitiatorToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:InitiatorToken>
+ <sp:RecipientToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ <sp:RequireIssuerSerialReference/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:RecipientToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:AsymmetricBinding>
+ <sp:SignedSupportingTokens>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/</wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex</wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Output_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/cxf-service-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/cxf-service-fips.xml
new file mode 100644
index 0000000000..bd758343ba
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/cxf-service-fips.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleitasymmetricsaml2" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitasymmetricsaml2" wsdlLocation="org/apache/cxf/systest/sts/sts_sender_vouches/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="security.encryption.properties" value="clientKeystore.properties"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/cxf-sts-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/cxf-sts-fips.xml
new file mode 100644
index 0000000000..9220dc487a
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/cxf-sts-fips.xml
@@ -0,0 +1,68 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="utSTSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="utIssueDelegate"/>
+ </bean>
+ <bean id="utIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="utSamlTokenProvider"/>
+ <property name="services" ref="utService"/>
+ <property name="stsProperties" ref="utSTSProperties"/>
+ </bean>
+ <bean id="subjectProviderBean" class="org.apache.cxf.systest.sts.sts_sender_vouches.SVSubjectProvider">
+ </bean>
+ <bean id="utSamlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
+ <property name="subjectProvider" ref="subjectProviderBean" />
+ </bean>
+ <bean id="utService" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="utEndpoints"/>
+ </bean>
+ <util:list id="utEndpoints">
+ <value>http://localhost:(\d)*/(doubleit|metrowsp)/services/doubleit(UT|.*symmetric.*|.*)
+ </value>
+ </util:list>
+ <bean id="utSTSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="stsKeystore.properties"/>
+ <property name="signatureUsername" value="mystskey"/>
+ <property name="callbackHandlerClass" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <property name="encryptionCryptoProperties" value="stsKeystore.properties"/>
+ <property name="issuer" value="DoubleItSTSIssuer"/>
+ <property name="encryptionUsername" value="myservicekey"/>
+ </bean>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#utSTSProviderBean" address="http://localhost:${testutil.ports.STSServer}/SecurityTokenService/UT" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:UT_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/stax-cxf-sts-fips.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/stax-cxf-sts-fips.xml
new file mode 100644
index 0000000000..8281036b85
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/stax-cxf-sts-fips.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="utSTSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="utIssueDelegate"/>
+ </bean>
+ <bean id="utIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="utSamlTokenProvider"/>
+ <property name="services" ref="utService"/>
+ <property name="stsProperties" ref="utSTSProperties"/>
+ </bean>
+ <bean id="subjectProviderBean" class="org.apache.cxf.systest.sts.sts_sender_vouches.SVSubjectProvider">
+ </bean>
+ <bean id="utSamlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
+ <property name="subjectProvider" ref="subjectProviderBean" />
+ </bean>
+ <bean id="utService" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="utEndpoints"/>
+ </bean>
+ <util:list id="utEndpoints">
+ <value>http://localhost:(\d)*/(doubleit|metrowsp)/services/doubleit(UT|.*symmetric.*|.*)
+ </value>
+ </util:list>
+ <bean id="utSTSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="stsKeystore.properties"/>
+ <property name="signatureUsername" value="mystskey"/>
+ <property name="callbackHandlerClass" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <property name="encryptionCryptoProperties" value="stsKeystore.properties"/>
+ <property name="issuer" value="DoubleItSTSIssuer"/>
+ <property name="encryptionUsername" value="myservicekey"/>
+ </bean>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#utSTSProviderBean" address="http://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/UT" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:UT_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/ws-trust-1.4-service-fips.wsdl b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/ws-trust-1.4-service-fips.wsdl
new file mode 100644
index 0000000000..f35ea0658d
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/sts_sender_vouches/ws-trust-1.4-service-fips.wsdl
@@ -0,0 +1,248 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<wsdl:definitions xmlns:tns="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wstrust="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsap10="http://www.w3.org/2006/05/addressing/wsdl" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/2 [...]
+ <wsdl:types>
+ <xs:schema elementFormDefault="qualified" targetNamespace="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:element name="RequestSecurityTokenResponse" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:complexType name="AbstractRequestSecurityTokenType">
+ <xs:sequence>
+ <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:attribute name="Context" type="xs:anyURI" use="optional"/>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenCollection" type="wst:RequestSecurityTokenCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenCollectionType">
+ <xs:sequence>
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType" minOccurs="2" maxOccurs="unbounded"/>
+ </xs:sequence>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenResponseCollection" type="wst:RequestSecurityTokenResponseCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenResponseCollectionType">
+ <xs:sequence>
+ <xs:element ref="wst:RequestSecurityTokenResponse" minOccurs="1" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ </xs:schema>
+ </wsdl:types>
+ <!-- WS-Trust defines the following GEDs -->
+ <wsdl:message name="RequestSecurityTokenMsg">
+ <wsdl:part name="request" element="wst:RequestSecurityToken"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseMsg">
+ <wsdl:part name="response" element="wst:RequestSecurityTokenResponse"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenCollectionMsg">
+ <wsdl:part name="requestCollection" element="wst:RequestSecurityTokenCollection"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseCollectionMsg">
+ <wsdl:part name="responseCollection" element="wst:RequestSecurityTokenResponseCollection"/>
+ </wsdl:message>
+ <!-- This portType an example of a Requestor (or other) endpoint that
+ Accepts SOAP-based challenges from a Security Token Service -->
+ <wsdl:portType name="WSSecurityRequestor">
+ <wsdl:operation name="Challenge">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an STS supporting full protocol -->
+ <wsdl:portType name="STS">
+ <wsdl:operation name="Cancel">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Issue">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal" message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KET" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/KETFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <wsdl:input message="tns:RequestSecurityTokenCollectionMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an endpoint that accepts
+ Unsolicited RequestSecurityTokenResponse messages -->
+ <wsdl:portType name="SecurityTokenResponseService">
+ <wsdl:operation name="RequestSecurityTokenResponse">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <wsdl:binding name="UT_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#UT_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="SecurityTokenService">
+ <wsdl:port name="UT_Port" binding="tns:UT_Binding">
+ <soap:address location="http://localhost:8080/SecurityTokenService/UT"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="UT_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:SymmetricBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:RequireDerivedKeys/>
+ <sp:RequireThumbprintReference/>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:EncryptSignature/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Input_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Output_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
index 06a0ee865d..c3b557ae28 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
@@ -25,6 +25,7 @@ import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
import org.apache.cxf.systest.sts.common.TokenTestUtils;
@@ -75,16 +76,19 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- AsymmetricBindingTest.class.getResource("cxf-service.xml"),
- AsymmetricBindingTest.class.getResource("cxf-stax-service.xml")))
+ AsymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-service-fips.xml" : "cxf-service.xml"),
+ AsymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-stax-service-fips.xml" : "cxf-stax-service.xml")))
);
assertTrue(launchServer(new STSServer(
- "cxf-ut.xml",
- "stax-cxf-ut.xml")));
+ JavaUtils.isFIPSEnabled() ? "cxf-ut-fips.xml" : "cxf-ut.xml",
+ JavaUtils.isFIPSEnabled() ? "stax-cxf-ut-fips.xml" : "stax-cxf-ut.xml")));
assertTrue(launchServer(new STSServer(
- "cxf-ut-encrypted.xml",
- "stax-cxf-ut-encrypted.xml")));
+ JavaUtils.isFIPSEnabled() ? "cxf-ut-encrypted-fips.xml" : "cxf-ut-encrypted.xml",
+ JavaUtils.isFIPSEnabled() ? "stax-cxf-ut-encrypted-fips.xml" : "stax-cxf-ut-encrypted.xml")));
+
}
@Parameters(name = "{0}")
@@ -105,7 +109,8 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML1() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = AsymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = AsymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML1Port");
DoubleItPortType asymmetricSaml1Port =
@@ -127,7 +132,8 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML2() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = AsymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = AsymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2Port");
DoubleItPortType asymmetricSaml2Port =
@@ -150,7 +156,8 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML2KeyValue() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = AsymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = AsymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2KeyValuePort");
DoubleItPortType asymmetricSaml2Port =
@@ -173,7 +180,8 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML1Encrypted() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = AsymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = AsymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML1EncryptedPort");
DoubleItPortType asymmetricSaml1EncryptedPort =
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issuer/IssuerTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issuer/IssuerTest.java
index 9c0faf3720..d320c205e8 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issuer/IssuerTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issuer/IssuerTest.java
@@ -29,6 +29,7 @@ import java.nio.file.Paths;
import javax.xml.namespace.QName;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.example.contract.doubleit.DoubleItPortType;
@@ -78,7 +79,9 @@ public class IssuerTest extends AbstractBusClientServerTestBase {
// Policy. Useful if you want a simple way to avoid hardcoding the STS host/port in the client.
@org.junit.Test
public void testSAML1Issuer() throws Exception {
- createBus(getClass().getResource("cxf-client.xml").toString());
+ createBus(getClass().getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-client-fips.xml"
+ : "cxf-client.xml").toString());
URL wsdl = IssuerTest.class.getResource(WSDL_FILTERED);
Service service = Service.create(wsdl, SERVICE_QNAME);
@@ -95,7 +98,9 @@ public class IssuerTest extends AbstractBusClientServerTestBase {
// Test getting the STS details via WS-MEX
@org.junit.Test
public void testSAML2MEX() throws Exception {
- createBus(getClass().getResource("cxf-client.xml").toString());
+ createBus(getClass().getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-client-fips.xml"
+ : "cxf-client.xml").toString());
URL wsdl = IssuerTest.class.getResource(WSDL_FILTERED);
Service service = Service.create(wsdl, SERVICE_QNAME);
@@ -112,7 +117,9 @@ public class IssuerTest extends AbstractBusClientServerTestBase {
// Test getting the STS details via WS-MEX + SOAP 1.2
@org.junit.Test
public void testSAML2MEXSoap12() throws Exception {
- createBus(getClass().getResource("cxf-client.xml").toString());
+ createBus(getClass().getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-client-fips.xml"
+ : "cxf-client.xml").toString());
URL wsdl = IssuerTest.class.getResource(WSDL_FILTERED);
Service service = Service.create(wsdl, SERVICE_QNAME);
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issueunit/IssueUnitTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issueunit/IssueUnitTest.java
index 0540a109f5..d3dc051fe1 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issueunit/IssueUnitTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/issueunit/IssueUnitTest.java
@@ -32,6 +32,7 @@ import org.w3c.dom.Element;
import org.apache.cxf.Bus;
import org.apache.cxf.binding.soap.SoapBindingConstants;
import org.apache.cxf.helpers.DOMUtils;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.jaxws.context.WrappedMessageContext;
import org.apache.cxf.message.MessageImpl;
@@ -97,7 +98,10 @@ public class IssueUnitTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
- assertTrue(launchServer(new STSServer("cxf-transport.xml")));
+ assertTrue(launchServer(new STSServer(
+ JavaUtils.isFIPSEnabled()
+ ? "cxf-transport-fips.xml"
+ : "cxf-transport.xml")));
}
@org.junit.Test
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/stsclient/AbstractSTSTokenTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/stsclient/AbstractSTSTokenTest.java
index fe7be5863c..4424a51301 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/stsclient/AbstractSTSTokenTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/stsclient/AbstractSTSTokenTest.java
@@ -34,6 +34,7 @@ import org.apache.cxf.endpoint.EndpointException;
import org.apache.cxf.endpoint.EndpointImpl;
import org.apache.cxf.ext.logging.LoggingInInterceptor;
import org.apache.cxf.ext.logging.LoggingOutInterceptor;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.message.Exchange;
import org.apache.cxf.message.ExchangeImpl;
import org.apache.cxf.message.Message;
@@ -80,10 +81,10 @@ public abstract class AbstractSTSTokenTest extends AbstractClientServerTestBase
@BeforeClass
public static void startServers() throws Exception {
- assertTrue(launchServer(new STSServer(
- "cxf-transport.xml",
- "cxf-x509.xml"
- )));
+ assertTrue(launchServer(new STSServer(JavaUtils.isFIPSEnabled()
+ ? "cxf-transport-fips.xml" : "cxf-transport.xml",
+ JavaUtils.isFIPSEnabled()
+ ? "cxf-x509-fips.xml" : "cxf-x509.xml")));
}
static STSClient initStsClientAsymmeticBinding(Bus bus) {
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/symmetric/SymmetricBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/symmetric/SymmetricBindingTest.java
index 61aa6d21cb..8dc445eeac 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/symmetric/SymmetricBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/symmetric/SymmetricBindingTest.java
@@ -37,6 +37,7 @@ import jakarta.xml.ws.Service;
import jakarta.xml.ws.soap.AddressingFeature;
import org.apache.cxf.Bus;
import org.apache.cxf.endpoint.Client;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.DispatchImpl;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
@@ -87,16 +88,18 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- SymmetricBindingTest.class.getResource("cxf-service.xml"),
- SymmetricBindingTest.class.getResource("cxf-stax-service.xml")))
+ SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-service-fips.xml" : "cxf-service.xml"),
+ SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-stax-service-fips.xml" : "cxf-stax-service.xml")))
);
assertTrue(launchServer(new STSServer(
- "cxf-ut.xml",
- "stax-cxf-ut.xml")));
+ JavaUtils.isFIPSEnabled() ? "cxf-ut-fips.xml" : "cxf-ut.xml",
+ JavaUtils.isFIPSEnabled() ? "stax-cxf-ut-fips.xml" : "stax-cxf-ut.xml")));
assertTrue(launchServer(new STSServer(
- "cxf-ut-encrypted.xml",
- "stax-cxf-ut-encrypted.xml")));
+ JavaUtils.isFIPSEnabled() ? "cxf-ut-encrypted-fips.xml" : "cxf-ut-encrypted.xml",
+ JavaUtils.isFIPSEnabled() ? "stax-cxf-ut-encrypted-fips.xml" : "stax-cxf-ut-encrypted.xml")));
}
@Parameters(name = "{0}")
@@ -117,7 +120,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML1() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML1Port");
DoubleItPortType symmetricSaml1Port =
@@ -140,7 +144,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML2() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2Port");
DoubleItPortType symmetricSaml2Port =
@@ -168,7 +173,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
}
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2ProtectTokensPort");
DoubleItPortType symmetricSaml2Port =
@@ -191,7 +197,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML1Encrypted() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML1EncryptedPort");
DoubleItPortType symmetricSaml1Port =
@@ -213,7 +220,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML2SecureConversation() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2SecureConversationPort");
DoubleItPortType symmetricSaml2Port =
@@ -235,7 +243,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML2Dispatch() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2Port");
@@ -268,7 +277,8 @@ public class SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testUsernameTokenSAML1Dispatch() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML1Port");
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java
index 26c89f2048..6a6d2db71a 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/transport/TransportBindingTest.java
@@ -39,6 +39,7 @@ import org.apache.cxf.BusFactory;
import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.jaxws.DispatchImpl;
import org.apache.cxf.systest.sts.TLSClientParametersUtils;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
@@ -91,12 +92,14 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- TransportBindingTest.class.getResource("cxf-service.xml"),
- TransportBindingTest.class.getResource("cxf-stax-service.xml")))
+ TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-service-fips.xml" : "cxf-service.xml"),
+ TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-stax-service-fips.xml" : "cxf-stax-service.xml")))
);
assertTrue(launchServer(new STSServer(
- "cxf-transport.xml",
- "stax-cxf-transport.xml"
+ JavaUtils.isFIPSEnabled() ? "cxf-transport-fips.xml" : "cxf-transport.xml",
+ JavaUtils.isFIPSEnabled() ? "stax-cxf-transport-fips.xml" : "stax-cxf-transport.xml"
)));
}
@@ -118,7 +121,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
public void testSAML1() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1Port");
DoubleItPortType transportSaml1Port =
@@ -140,7 +144,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
public void testSAML2() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2Port");
DoubleItPortType transportSaml2Port =
@@ -161,7 +166,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
@org.junit.Test
public void testSAML2ViaCode() throws Exception {
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2Port");
DoubleItPortType transportSaml2Port =
@@ -222,7 +228,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
public void testUnknownClient() throws Exception {
createBus(getClass().getResource("cxf-bad-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1Port");
DoubleItPortType transportSaml1Port =
@@ -249,7 +256,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
public void testSAML1Endorsing() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1EndorsingPort");
DoubleItPortType transportSaml1Port =
@@ -276,7 +284,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
public void testUnknownAddress() throws Exception {
createBus(getClass().getResource("cxf-bad-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML1EndorsingPort");
DoubleItPortType transportSaml1Port =
@@ -304,7 +313,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2Port");
@@ -339,7 +349,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2Port");
@@ -351,7 +362,10 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
STSClient stsClient = createDispatchSTSClient(bus);
String location = "https://localhost:" + test.getStsPort() + "/SecurityTokenService/Transport";
stsClient.setLocation(location);
- stsClient.setPolicy("classpath:/org/apache/cxf/systest/sts/issuer/sts-transport-policy.xml");
+
+ stsClient.setPolicy(JavaUtils.isFIPSEnabled()
+ ? "classpath:/org/apache/cxf/systest/sts/issuer/sts-transport-policy-fips.xml"
+ : "classpath:/org/apache/cxf/systest/sts/issuer/sts-transport-policy.xml");
// Creating a DOMSource Object for the request
DOMSource request = createDOMRequest();
@@ -380,7 +394,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2X509EndorsingPort");
DoubleItPortType transportSaml1Port =
@@ -402,7 +417,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
public void testSAML2SymmetricEndorsing() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2SymmetricEndorsingPort");
DoubleItPortType transportSaml1Port =
@@ -430,7 +446,8 @@ public class TransportBindingTest extends AbstractBusClientServerTestBase {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = TransportBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = TransportBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItTransportSAML2SymmetricEndorsingDerivedPort");
DoubleItPortType transportSaml1Port =
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsCachingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsCachingTest.java
index 11f1ccc85c..8f7904d55b 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsCachingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsCachingTest.java
@@ -26,6 +26,7 @@ import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
import org.apache.cxf.BusException;
import org.apache.cxf.endpoint.EndpointException;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.TokenTestUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.systest.sts.deployment.STSServer;
@@ -63,9 +64,12 @@ public class UsernameActAsCachingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- UsernameActAsCachingTest.class.getResource("cxf-service.xml")
+ UsernameActAsCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml")
)));
- assertTrue(launchServer(new STSServer("cxf-x509.xml")));
+ assertTrue(launchServer(new STSServer(JavaUtils.isFIPSEnabled()
+ ? "cxf-x509-fips.xml" : "cxf-x509.xml")));
}
/**
@@ -75,7 +79,9 @@ public class UsernameActAsCachingTest extends AbstractBusClientServerTestBase {
public void testUsernameActAsCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameActAsCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameActAsCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2BearerPort2");
@@ -154,7 +160,9 @@ public class UsernameActAsCachingTest extends AbstractBusClientServerTestBase {
public void testDifferentUsersCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameActAsCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameActAsCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2BearerPort3");
@@ -237,7 +245,9 @@ public class UsernameActAsCachingTest extends AbstractBusClientServerTestBase {
public void testAppliesToCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameActAsCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameActAsCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2BearerPort4");
@@ -321,7 +331,9 @@ public class UsernameActAsCachingTest extends AbstractBusClientServerTestBase {
public void testNoAppliesToCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameActAsCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameActAsCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2BearerPort5");
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsTest.java
index f895f35e25..0c0eaf1b2b 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_actas/UsernameActAsTest.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rt.security.SecurityConstants;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
@@ -71,11 +72,15 @@ public class UsernameActAsTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- UsernameActAsTest.class.getResource("cxf-service2.xml")
+ UsernameActAsTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service2-fips.xml"
+ : "cxf-service2.xml")
)));
assertTrue(launchServer(new STSServer(
- "cxf-x509.xml",
- "stax-cxf-x509.xml"
+ JavaUtils.isFIPSEnabled()
+ ? "cxf-x509-fips.xml" : "cxf-x509.xml",
+ JavaUtils.isFIPSEnabled()
+ ? "stax-cxf-x509-fips.xml" : "stax-cxf-x509.xml"
)));
}
@@ -92,7 +97,9 @@ public class UsernameActAsTest extends AbstractBusClientServerTestBase {
public void testUsernameActAs() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameActAsTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameActAsTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2BearerPort");
DoubleItPortType port =
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfCachingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfCachingTest.java
index 0cd4db1e71..31e49cf8fd 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfCachingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfCachingTest.java
@@ -26,6 +26,7 @@ import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
import org.apache.cxf.BusException;
import org.apache.cxf.endpoint.EndpointException;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.TokenTestUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.systest.sts.deployment.STSServer;
@@ -62,10 +63,13 @@ public class UsernameOnBehalfOfCachingTest extends AbstractBusClientServerTestBa
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- UsernameOnBehalfOfCachingTest.class.getResource("cxf-service.xml")
+ UsernameOnBehalfOfCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service-fips.xml"
+ : "cxf-service.xml")
)));
assertTrue(launchServer(new STSServer(
- "cxf-x509.xml"
+ JavaUtils.isFIPSEnabled()
+ ? "cxf-x509-fips.xml" : "cxf-x509.xml"
)));
}
@@ -76,7 +80,9 @@ public class UsernameOnBehalfOfCachingTest extends AbstractBusClientServerTestBa
public void testUsernameOnBehalfOfCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItOBOAsymmetricSAML2BearerPort2");
@@ -156,7 +162,9 @@ public class UsernameOnBehalfOfCachingTest extends AbstractBusClientServerTestBa
public void testDifferentUsersCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItOBOAsymmetricSAML2BearerPort3");
@@ -239,7 +247,9 @@ public class UsernameOnBehalfOfCachingTest extends AbstractBusClientServerTestBa
public void testAppliesToCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItOBOAsymmetricSAML2BearerPort4");
@@ -323,7 +333,9 @@ public class UsernameOnBehalfOfCachingTest extends AbstractBusClientServerTestBa
public void testNoAppliesToCaching() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameOnBehalfOfCachingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItOBOAsymmetricSAML2BearerPort5");
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfTest.java
index 19f32a018f..b277a0c331 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/username_onbehalfof/UsernameOnBehalfOfTest.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.rt.security.SecurityConstants;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
@@ -70,11 +71,15 @@ public class UsernameOnBehalfOfTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- UsernameOnBehalfOfTest.class.getResource("cxf-service2.xml")
+ UsernameOnBehalfOfTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-service2-fips.xml"
+ : "cxf-service2.xml")
)));
assertTrue(launchServer(new STSServer(
- "cxf-x509.xml",
- "stax-cxf-x509.xml"
+ JavaUtils.isFIPSEnabled()
+ ? "cxf-x509-fips.xml" : "cxf-x509.xml",
+ JavaUtils.isFIPSEnabled()
+ ? "stax-cxf-x509-fips.xml" : "stax-cxf-x509.xml"
)));
}
@@ -92,7 +97,9 @@ public class UsernameOnBehalfOfTest extends AbstractBusClientServerTestBase {
public void testUsernameOnBehalfOf() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = UsernameOnBehalfOfTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = UsernameOnBehalfOfTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleIt-fips.wsdl"
+ : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItOBOAsymmetricSAML2BearerPort");
DoubleItPortType port =
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509AsymmetricBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509AsymmetricBindingTest.java
index 8a0f5fef3c..7352765b51 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509AsymmetricBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509AsymmetricBindingTest.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.TokenTestUtils;
import org.apache.cxf.systest.sts.deployment.DoubleItServer;
import org.apache.cxf.systest.sts.deployment.STSServer;
@@ -54,10 +55,13 @@ public class X509AsymmetricBindingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- X509AsymmetricBindingTest.class.getResource("cxf-asymmetric-service.xml")
+ X509AsymmetricBindingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "cxf-asymmetric-service-fips.xml"
+ : "cxf-asymmetric-service.xml")
)));
assertTrue(launchServer(new STSServer(
- "cxf-x509.xml"
+ JavaUtils.isFIPSEnabled()
+ ? "cxf-x509-fips.xml" : "cxf-x509.xml"
)));
}
@@ -65,7 +69,9 @@ public class X509AsymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testX509SAML2() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = X509AsymmetricBindingTest.class.getResource("DoubleItAsymmetric.wsdl");
+ URL wsdl = X509AsymmetricBindingTest.class.getResource(JavaUtils.isFIPSEnabled()
+ ? "DoubleItAsymmetric-fips.wsdl"
+ : "DoubleItAsymmetric.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2Port");
DoubleItPortType port =
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509SymmetricBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509SymmetricBindingTest.java
index 1c5db02422..69e0583584 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509SymmetricBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/x509/X509SymmetricBindingTest.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
+import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.systest.sts.common.SecurityTestUtil;
import org.apache.cxf.systest.sts.common.TestParam;
import org.apache.cxf.systest.sts.common.TokenTestUtils;
@@ -69,12 +70,14 @@ public class X509SymmetricBindingTest extends AbstractBusClientServerTestBase {
@BeforeClass
public static void startServers() throws Exception {
assertTrue(launchServer(new DoubleItServer(
- X509SymmetricBindingTest.class.getResource("cxf-service.xml"),
- X509SymmetricBindingTest.class.getResource("cxf-stax-service.xml")
+ X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-service-fips.xml" : "cxf-service.xml"),
+ X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "cxf-stax-service-fips.xml" : "cxf-stax-service.xml")
)));
assertTrue(launchServer(new STSServer(
- "cxf-x509.xml",
- "stax-cxf-x509.xml"
+ JavaUtils.isFIPSEnabled() ? "cxf-x509-fips.xml" : "cxf-x509.xml",
+ JavaUtils.isFIPSEnabled() ? "stax-cxf-x509-fips.xml" : "stax-cxf-x509.xml"
)));
}
@@ -96,7 +99,8 @@ public class X509SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testX509SAML1() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = X509SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML1Port");
DoubleItPortType symmetricSaml1Port =
@@ -118,7 +122,8 @@ public class X509SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testX509SAML2() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = X509SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2Port");
DoubleItPortType symmetricSaml2Port =
@@ -141,7 +146,8 @@ public class X509SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testX509SAML2Endorsing() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = X509SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2EndorsingPort");
DoubleItPortType symmetricSaml2Port =
@@ -166,7 +172,8 @@ public class X509SymmetricBindingTest extends AbstractBusClientServerTestBase {
public void testX509SAML2Supporting() throws Exception {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = X509SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2SupportingPort");
DoubleItPortType symmetricSaml2Port =
@@ -196,7 +203,8 @@ public class X509SymmetricBindingTest extends AbstractBusClientServerTestBase {
createBus(getClass().getResource("cxf-client.xml").toString());
- URL wsdl = X509SymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ URL wsdl = X509SymmetricBindingTest.class.getResource(
+ JavaUtils.isFIPSEnabled() ? "DoubleIt-fips.wsdl" : "DoubleIt.wsdl");
Service service = Service.create(wsdl, SERVICE_QNAME);
QName portQName = new QName(NAMESPACE, "DoubleItSymmetricSAML2SupportingPort");
DoubleItPortType symmetricSaml2Port =
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..32f8147684
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl
@@ -0,0 +1,264 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItAsymmetricSAML1Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingAsymmetricSAML1Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItAsymmetricSAML2Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingAsymmetricSAML2Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItAsymmetricSAML1Port" binding="tns:DoubleItAsymmetricSAML1Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml1"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItAsymmetricSAML2Port" binding="tns:DoubleItAsymmetricSAML2Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml2"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItAsymmetricSAML2KeyValuePort" binding="tns:DoubleItAsymmetricSAML2Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml2keyvalue"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItAsymmetricSAML1EncryptedPort" binding="tns:DoubleItAsymmetricSAML1Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml1encrypted"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItBindingAsymmetricSAML1Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:AsymmetricBinding>
+ <wsp:Policy>
+ <sp:InitiatorToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:InitiatorToken>
+ <sp:RecipientToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ <sp:RequireIssuerSerialReference/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:RecipientToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:AsymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingAsymmetricSAML2Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:AsymmetricBinding>
+ <wsp:Policy>
+ <sp:InitiatorToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:InitiatorToken>
+ <sp:RecipientToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ <sp:RequireIssuerSerialReference/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:RecipientToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:AsymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Output_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service-fips.xml
new file mode 100644
index 0000000000..a7e93c64a4
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service-fips.xml
@@ -0,0 +1,59 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML1Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitasymmetricsaml1" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitasymmetricsaml2" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2KeyValuePort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitasymmetricsaml2keyvalue" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML1EncryptedPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitasymmetricsaml1encrypted" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
\ No newline at end of file
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service-fips.xml
new file mode 100644
index 0000000000..e667aa3480
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service-fips.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML1Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitasymmetricsaml1" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitasymmetricsaml2" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2KeyValuePort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitasymmetricsaml2keyvalue" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML1EncryptedPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitasymmetricsaml1encrypted" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
\ No newline at end of file
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/delegation/ws-trust-1.4-service-fips.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/delegation/ws-trust-1.4-service-fips.wsdl
new file mode 100644
index 0000000000..31ec3da916
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/delegation/ws-trust-1.4-service-fips.wsdl
@@ -0,0 +1,348 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<wsdl:definitions xmlns:tns="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wstrust="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsap10="http://www.w3.org/2006/05/addressing/wsdl" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/2 [...]
+ <wsdl:types>
+ <xs:schema elementFormDefault="qualified" targetNamespace="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:element name="RequestSecurityTokenResponse" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:complexType name="AbstractRequestSecurityTokenType">
+ <xs:sequence>
+ <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:attribute name="Context" type="xs:anyURI" use="optional"/>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenCollection" type="wst:RequestSecurityTokenCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenCollectionType">
+ <xs:sequence>
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType" minOccurs="2" maxOccurs="unbounded"/>
+ </xs:sequence>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenResponseCollection" type="wst:RequestSecurityTokenResponseCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenResponseCollectionType">
+ <xs:sequence>
+ <xs:element ref="wst:RequestSecurityTokenResponse" minOccurs="1" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ </xs:schema>
+ </wsdl:types>
+ <!-- WS-Trust defines the following GEDs -->
+ <wsdl:message name="RequestSecurityTokenMsg">
+ <wsdl:part name="request" element="wst:RequestSecurityToken"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseMsg">
+ <wsdl:part name="response" element="wst:RequestSecurityTokenResponse"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenCollectionMsg">
+ <wsdl:part name="requestCollection" element="wst:RequestSecurityTokenCollection"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseCollectionMsg">
+ <wsdl:part name="responseCollection" element="wst:RequestSecurityTokenResponseCollection"/>
+ </wsdl:message>
+ <!-- This portType an example of a Requestor (or other) endpoint that
+ Accepts SOAP-based challenges from a Security Token Service -->
+ <wsdl:portType name="WSSecurityRequestor">
+ <wsdl:operation name="Challenge">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an STS supporting full protocol -->
+ <wsdl:portType name="STS">
+ <wsdl:operation name="Cancel">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Issue">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal" message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KET" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/KETFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <wsdl:input message="tns:RequestSecurityTokenCollectionMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an endpoint that accepts
+ Unsolicited RequestSecurityTokenResponse messages -->
+ <wsdl:portType name="SecurityTokenResponseService">
+ <wsdl:operation name="RequestSecurityTokenResponse">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <wsdl:binding name="Transport_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="Transport_UT_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_UT_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="SecurityTokenService">
+ <wsdl:port name="Transport_Port" binding="tns:Transport_Binding">
+ <soap:address location="https://localhost:8443/SecurityTokenService/Transport"/>
+ </wsdl:port>
+ <wsdl:port name="Transport_UT_Port" binding="tns:Transport_UT_Binding">
+ <soap:address location="https://localhost:8443/SecurityTokenService/TransportUT"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="Transport_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Transport_UT_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Input_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Output_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-transport-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-transport-fips.xml
new file mode 100644
index 0000000000..29d2f5aec0
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-transport-fips.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http://www.springframework.org/schema/util http://www.springframework.org/sc [...]
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" id="transportSTS" implementor="#stsProviderBean" address="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/Transport" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port" depends-on="ClientAuthHttpsSettings">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="https://localhost:${testutil.ports.STSServer}/SecurityTokenService/b-issuer/Transport" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_SAML_Port" depends-on="ClientAuthHttpsSettings">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+ <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.STSServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-ut-encrypted-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-ut-encrypted-fips.xml
new file mode 100644
index 0000000000..bfe0d9d90d
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-ut-encrypted-fips.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <!-- Override org.apache.cxf.sts.operation.TokenIssueOperation -->
+ <bean id="issueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="tokenProviders"/>
+ <property name="tokenValidators" ref="tokenValidators"/>
+ <property name="services" ref="service"/>
+ <property name="stsProperties" ref="stsProperties"/>
+ <property name="delegationHandlers" ref="delegationHandlers"/>
+ <property name="claimsManager" ref="claimsManager"/>
+ <property name="encryptIssuedToken" value="true"/>
+ </bean>
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="http://localhost:${testutil.ports.STSServer.2}/SecurityTokenService/UTEncrypted" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:UTEncrypted_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-ut-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-ut-fips.xml
new file mode 100644
index 0000000000..fd8ce62d12
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-ut-fips.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="http://localhost:${testutil.ports.STSServer.2}/SecurityTokenService/UT" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:UT_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-x509-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-x509-fips.xml
new file mode 100644
index 0000000000..cb99906248
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/cxf-x509-fips.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <!-- Override UsernameTokenValidator -->
+ <util:list id="tokenValidators">
+ <bean class="org.apache.cxf.sts.token.validator.SAMLTokenValidator" />
+ <bean class="org.apache.cxf.systest.sts.username_onbehalfof.UsernameTokenValidator"/>
+ </util:list>
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="http://localhost:${testutil.ports.STSServer.2}/SecurityTokenService/X509" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:X509_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ <entry key="security.encryption.username" value="useReqSigCert"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-transport-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-transport-fips.xml
new file mode 100644
index 0000000000..752153ad1b
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-transport-fips.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http://www.springframework.org/schema/util http://www.springframework.org/sc [...]
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="https://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/Transport" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port" depends-on="StaxClientAuthHttpsSettings">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="https://localhost:${testutil.ports.StaxSTSServer}/SecurityTokenService/b-issuer/Transport" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_SAML_Port" depends-on="StaxClientAuthHttpsSettings">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+ <httpj:engine-factory id="StaxClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.StaxSTSServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="skpass">
+ <sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-ut-encrypted-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-ut-encrypted-fips.xml
new file mode 100644
index 0000000000..417ec3a512
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-ut-encrypted-fips.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <!-- Override org.apache.cxf.sts.operation.TokenIssueOperation -->
+ <bean id="issueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="tokenProviders"/>
+ <property name="tokenValidators" ref="tokenValidators"/>
+ <property name="services" ref="service"/>
+ <property name="stsProperties" ref="stsProperties"/>
+ <property name="delegationHandlers" ref="delegationHandlers"/>
+ <property name="claimsManager" ref="claimsManager"/>
+ <property name="encryptIssuedToken" value="true"/>
+ </bean>
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="http://localhost:${testutil.ports.StaxSTSServer.2}/SecurityTokenService/UTEncrypted" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:UTEncrypted_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-ut-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-ut-fips.xml
new file mode 100644
index 0000000000..7160083d5e
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-ut-fips.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="http://localhost:${testutil.ports.StaxSTSServer.2}/SecurityTokenService/UT" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:UT_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-x509-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-x509-fips.xml
new file mode 100644
index 0000000000..8e8f0ee73e
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/stax-cxf-x509-fips.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.2.xsd">
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <import resource="sts/cxf-sts-fips.xml" />
+
+ <!-- Override UsernameTokenValidator -->
+ <util:list id="tokenValidators">
+ <bean class="org.apache.cxf.sts.token.validator.SAMLTokenValidator" />
+ <bean class="org.apache.cxf.systest.sts.username_onbehalfof.UsernameTokenValidator"/>
+ </util:list>
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" implementor="#stsProviderBean" address="http://localhost:${testutil.ports.StaxSTSServer.2}/SecurityTokenService/X509" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl" serviceName="ns1:SecurityTokenService" endpointName="ns1:X509_Port">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="stsKeystore.properties"/>
+ <entry key="security.signature.username" value="mystskey"/>
+ <entry key="security.encryption.username" value="useReqSigCert"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/sts/cxf-sts-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/sts/cxf-sts-fips.xml
new file mode 100644
index 0000000000..ff1eb6b730
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/sts/cxf-sts-fips.xml
@@ -0,0 +1,105 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:test="http://apache.org/hello_world_soap_http"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http://www [...]
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer">
+ <property name="location" value="classpath:org/apache/cxf/systest/sts/deployment/sts/sts.properties"/>
+ </bean>
+
+ <import resource="realms.xml" />
+
+ <util:list id="delegationHandlers">
+ <bean class="org.apache.cxf.sts.token.delegation.HOKDelegationHandler" />
+ <bean class="org.apache.cxf.sts.token.delegation.UsernameTokenDelegationHandler" />
+ </util:list>
+
+ <bean id="issueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation">
+ <property name="tokenProviders" ref="tokenProviders"/>
+ <property name="tokenValidators" ref="tokenValidators"/>
+ <property name="services" ref="service"/>
+ <property name="stsProperties" ref="stsProperties"/>
+ <property name="delegationHandlers" ref="delegationHandlers"/>
+ <property name="claimsManager" ref="claimsManager"/>
+ </bean>
+ <bean id="validateDelegate" class="org.apache.cxf.sts.operation.TokenValidateOperation">
+ <property name="tokenValidators" ref="tokenValidators"/>
+ <property name="stsProperties" ref="stsProperties"/>
+ </bean>
+ <util:list id="tokenValidators">
+ <bean class="org.apache.cxf.sts.token.validator.SAMLTokenValidator" />
+ <bean class="org.apache.cxf.sts.token.validator.UsernameTokenValidator" />
+ </util:list>
+ <util:list id="tokenProviders">
+ <ref bean="samlTokenProvider"/>
+ </util:list>
+ <bean id="samlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
+ <property name="realmMap" ref="realms"/>
+ </bean>
+ <bean id="stsProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider">
+ <property name="issueOperation" ref="issueDelegate"/>
+ <property name="validateOperation" ref="validateDelegate"/>
+ </bean>
+ <bean id="service" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="endpoints"/>
+ </bean>
+ <util:list id="endpoints">
+ <value>http(s)?://localhost:(\d)*/doubleit/services/doubleit.*</value>
+ </util:list>
+
+ <bean id="claimsManager" class="org.apache.cxf.sts.claims.ClaimsManager">
+ <property name="claimHandlers" ref="customClaimsHandler"/>
+ </bean>
+ <bean id="customClaimsHandler" class="org.apache.cxf.systest.sts.deployment.CustomClaimsHandler">
+ </bean>
+
+ <bean id="encProperties" class="org.apache.cxf.sts.service.EncryptionProperties">
+ <property name="encryptionAlgorithm" value="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
+ </bean>
+
+ <bean id="samlRealmCodec" class="org.apache.cxf.systest.sts.common.SAMLRealmCNCodec"/>
+ <bean id="customRealmParser" class="org.apache.cxf.systest.sts.common.UriRealmParser"/>
+
+ <bean id="stsProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signatureCryptoProperties" value="${signature.properties}"/>
+ <property name="signatureUsername" value="${signature.username}"/>
+ <property name="callbackHandlerClass" value="${callback.handler}"/>
+ <property name="encryptionCryptoProperties" value="${encryption.properties}"/>
+ <property name="issuer" value="${issuer}"/>
+ <property name="encryptionUsername" value="${encryption.username}"/>
+ <property name="encryptionProperties" ref="encProperties"/>
+ <property name="realmParser" ref="customRealmParser"/>
+ <property name="relationships" ref="relationships"/>
+ <property name="samlRealmCodec" ref="samlRealmCodec"/>
+ </bean>
+
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl
new file mode 100644
index 0000000000..5565e92406
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service-fips.wsdl
@@ -0,0 +1,772 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<wsdl:definitions xmlns:tns="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wstrust="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsap10="http://www.w3.org/2006/05/addressing/wsdl" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/2 [...]
+ <wsdl:types>
+ <xs:schema elementFormDefault="qualified" targetNamespace="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:element name="RequestSecurityTokenResponse" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:complexType name="AbstractRequestSecurityTokenType">
+ <xs:sequence>
+ <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:attribute name="Context" type="xs:anyURI" use="optional"/>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenCollection" type="wst:RequestSecurityTokenCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenCollectionType">
+ <xs:sequence>
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType" minOccurs="2" maxOccurs="unbounded"/>
+ </xs:sequence>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenResponseCollection" type="wst:RequestSecurityTokenResponseCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenResponseCollectionType">
+ <xs:sequence>
+ <xs:element ref="wst:RequestSecurityTokenResponse" minOccurs="1" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ </xs:schema>
+ </wsdl:types>
+ <!-- WS-Trust defines the following GEDs -->
+ <wsdl:message name="RequestSecurityTokenMsg">
+ <wsdl:part name="request" element="wst:RequestSecurityToken"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseMsg">
+ <wsdl:part name="response" element="wst:RequestSecurityTokenResponse"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenCollectionMsg">
+ <wsdl:part name="requestCollection" element="wst:RequestSecurityTokenCollection"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseCollectionMsg">
+ <wsdl:part name="responseCollection" element="wst:RequestSecurityTokenResponseCollection"/>
+ </wsdl:message>
+ <!-- This portType an example of a Requestor (or other) endpoint that
+ Accepts SOAP-based challenges from a Security Token Service -->
+ <wsdl:portType name="WSSecurityRequestor">
+ <wsdl:operation name="Challenge">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an STS supporting full protocol -->
+ <wsdl:portType name="STS">
+ <wsdl:operation name="Cancel">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Issue">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal" message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KET" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/KETFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <wsdl:input message="tns:RequestSecurityTokenCollectionMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an endpoint that accepts
+ Unsolicited RequestSecurityTokenResponse messages -->
+ <wsdl:portType name="SecurityTokenResponseService">
+ <wsdl:operation name="RequestSecurityTokenResponse">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <wsdl:binding name="UT_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#UT_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="UTEncrypted_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#UTEncrypted_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="X509_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#X509_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="Transport_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="Transport_SAML_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_SAML_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="SecurityTokenService">
+ <wsdl:port name="UT_Port" binding="tns:UT_Binding">
+ <soap:address location="http://localhost:8080/SecurityTokenService/UT"/>
+ </wsdl:port>
+ <wsdl:port name="X509_Port" binding="tns:X509_Binding">
+ <soap:address location="http://localhost:8080/SecurityTokenService/X509"/>
+ </wsdl:port>
+ <wsdl:port name="Transport_Port" binding="tns:Transport_Binding">
+ <soap:address location="https://localhost:8443/SecurityTokenService/Transport"/>
+ </wsdl:port>
+ <wsdl:port name="Transport_SAML_Port" binding="tns:Transport_SAML_Binding">
+ <soap:address location="https://localhost:8443/SecurityTokenService/Transport"/>
+ </wsdl:port>
+ <wsdl:port name="UTEncrypted_Port" binding="tns:UTEncrypted_Binding">
+ <soap:address location="http://localhost:8080/SecurityTokenService/UTEncrypted"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="UT_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:SymmetricBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:RequireDerivedKeys/>
+ <sp:RequireThumbprintReference/>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:EncryptSignature/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="UTEncrypted_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:SymmetricBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:RequireDerivedKeys/>
+ <sp:RequireThumbprintReference/>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:EncryptSignature/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="X509_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:AsymmetricBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:InitiatorToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:InitiatorToken>
+ <sp:RecipientToken>
+ <wsp:Policy>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ <sp:RequireIssuerSerialReference/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:RecipientToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:EncryptSignature/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ </wsp:Policy>
+ </sp:AsymmetricBinding>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Transport_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <!-- <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy> <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy> <sp:WssUsernameToken10 /> </wsp:Policy> </sp:UsernameToken>
+ </wsp:Policy> </sp:SignedSupportingTokens> -->
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </wsp:All>
+ <wsp:All>
+ <wsp:Policy>
+ <sp:SamlToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssSamlV20Token11/>
+ </wsp:Policy>
+ </sp:SamlToken>
+ </wsp:Policy>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Transport_SAML_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <!-- <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy> <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy> <sp:WssUsernameToken10 /> </wsp:Policy> </sp:UsernameToken>
+ </wsp:Policy> </sp:SignedSupportingTokens> -->
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <wsp:ExactlyOne>
+ <!--
+ <wsp:All>
+ <wsp:Policy>
+ <sp:UsernameToken
+ sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10 />
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </wsp:All>
+ -->
+ <wsp:All>
+ <wsp:Policy>
+ <sp:SamlToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssSamlV20Token11/>
+ </wsp:Policy>
+ </sp:SamlToken>
+ </wsp:Policy>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Input_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Output_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/cxf-client-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/cxf-client-fips.xml
new file mode 100644
index 0000000000..079dcd1711
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/cxf-client-fips.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd">
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItTransportSAML1Port" createdFromAPI="true">
+ <jaxws:properties>
+ <entry key="security.username" value="alice"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.sts.disable-wsmex-call-using-epr-address" value="true"/>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="policy" value="classpath:/org/apache/cxf/systest/sts/issuer/sts-transport-policy-fips.xml"/>
+ <property name="properties">
+ <map>
+ <entry key="security.sts.token.username" value="myclientkey"/>
+ <entry key="security.sts.token.properties" value="clientKeystore.properties"/>
+ <entry key="security.sts.token.usecert" value="true"/>
+ </map>
+ </property>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:client>
+ <jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItTransportSAML2Port" createdFromAPI="true">
+ <jaxws:properties>
+ <entry key="security.username" value="alice"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.sts.token.username" value="myclientkey"/>
+ <entry key="security.sts.token.properties" value="clientKeystore.properties"/>
+ <entry key="security.sts.token.usecert" value="true"/>
+ </jaxws:properties>
+ </jaxws:client>
+ <jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItTransportSAML2Soap12Port" createdFromAPI="true">
+ <jaxws:properties>
+ <entry key="security.username" value="alice"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.sts.token.username" value="myclientkey"/>
+ <entry key="security.sts.token.properties" value="clientKeystore.properties"/>
+ <entry key="security.sts.token.usecert" value="true"/>
+ <entry key="security.sts.client-soap12-binding" value="true"/>
+ </jaxws:properties>
+ </jaxws:client>
+ <http:conduit name="https://localhost.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:keyManagers keyPassword="ckpass">
+ <sec:keyStore type="jks" password="cspass" resource="keys/clientstore.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="cspass" resource="keys/clientstore.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/sts-transport-policy-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/sts-transport-policy-fips.xml
new file mode 100644
index 0000000000..95fa9ba896
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/sts-transport-policy-fips.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<wsp:Policy xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsap10="http://www.w3.org/2006/05/addressing/wsdl" wsu:Id="Transport_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </wsp:All>
+ <wsp:All>
+ <wsp:Policy>
+ <sp:SamlToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssSamlV20Token11/>
+ </wsp:Policy>
+ </sp:SamlToken>
+ </wsp:Policy>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+</wsp:Policy>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/ws-trust-1.4-service-fips.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/ws-trust-1.4-service-fips.wsdl
new file mode 100644
index 0000000000..99d6703c80
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/issuer/ws-trust-1.4-service-fips.wsdl
@@ -0,0 +1,326 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<wsdl:definitions xmlns:tns="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wstrust="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsap10="http://www.w3.org/2006/05/addressing/wsdl" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/2 [...]
+ <wsdl:types>
+ <xs:schema elementFormDefault="qualified" targetNamespace="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:element name="RequestSecurityTokenResponse" type="wst:AbstractRequestSecurityTokenType"/>
+ <xs:complexType name="AbstractRequestSecurityTokenType">
+ <xs:sequence>
+ <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:attribute name="Context" type="xs:anyURI" use="optional"/>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenCollection" type="wst:RequestSecurityTokenCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenCollectionType">
+ <xs:sequence>
+ <xs:element name="RequestSecurityToken" type="wst:AbstractRequestSecurityTokenType" minOccurs="2" maxOccurs="unbounded"/>
+ </xs:sequence>
+ </xs:complexType>
+ <xs:element name="RequestSecurityTokenResponseCollection" type="wst:RequestSecurityTokenResponseCollectionType"/>
+ <xs:complexType name="RequestSecurityTokenResponseCollectionType">
+ <xs:sequence>
+ <xs:element ref="wst:RequestSecurityTokenResponse" minOccurs="1" maxOccurs="unbounded"/>
+ </xs:sequence>
+ <xs:anyAttribute namespace="##other" processContents="lax"/>
+ </xs:complexType>
+ </xs:schema>
+ </wsdl:types>
+ <!-- WS-Trust defines the following GEDs -->
+ <wsdl:message name="RequestSecurityTokenMsg">
+ <wsdl:part name="request" element="wst:RequestSecurityToken"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseMsg">
+ <wsdl:part name="response" element="wst:RequestSecurityTokenResponse"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenCollectionMsg">
+ <wsdl:part name="requestCollection" element="wst:RequestSecurityTokenCollection"/>
+ </wsdl:message>
+ <wsdl:message name="RequestSecurityTokenResponseCollectionMsg">
+ <wsdl:part name="responseCollection" element="wst:RequestSecurityTokenResponseCollection"/>
+ </wsdl:message>
+ <!-- This portType an example of a Requestor (or other) endpoint that
+ Accepts SOAP-based challenges from a Security Token Service -->
+ <wsdl:portType name="WSSecurityRequestor">
+ <wsdl:operation name="Challenge">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an STS supporting full protocol -->
+ <wsdl:portType name="STS">
+ <wsdl:operation name="Cancel">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Issue">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal" message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <wsdl:input wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KET" message="tns:RequestSecurityTokenMsg"/>
+ <wsdl:output wsam:Action="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/KETFinal" message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <wsdl:input message="tns:RequestSecurityTokenCollectionMsg"/>
+ <wsdl:output message="tns:RequestSecurityTokenResponseCollectionMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <!-- This portType is an example of an endpoint that accepts
+ Unsolicited RequestSecurityTokenResponse messages -->
+ <wsdl:portType name="SecurityTokenResponseService">
+ <wsdl:operation name="RequestSecurityTokenResponse">
+ <wsdl:input message="tns:RequestSecurityTokenResponseMsg"/>
+ </wsdl:operation>
+ </wsdl:portType>
+ <wsdl:binding name="Transport_Soap12_Binding" type="wstrust:STS" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" >
+ <wsp:PolicyReference URI="#Transport_policy"/>
+ <soap12:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap12:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap12:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap12:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap12:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap12:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap12:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap12:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap12:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap12:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap12:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap12:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap12:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap12:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap12:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap12:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap12:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap12:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap12:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="Transport_Binding" type="wstrust:STS">
+ <wsp:PolicyReference URI="#Transport_policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="Issue">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Validate">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate"/>
+ <wsdl:input>
+ <wsp:PolicyReference URI="#Input_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <wsp:PolicyReference URI="#Output_policy"/>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Cancel">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="Renew">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="KeyExchangeToken">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ <wsdl:operation name="RequestCollection">
+ <soap:operation soapAction="http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection"/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="SecurityTokenService">
+ <wsdl:port name="Transport_Port" binding="tns:Transport_Binding">
+ <soap:address location="https://localhost:8443/SecurityTokenService/Transport"/>
+ </wsdl:port>
+ <wsdl:port name="Transport_Soap12_Port" binding="tns:Transport_Soap12_Binding">
+ <soap:address location="https://localhost:8443/SecurityTokenService/TransportSoap12"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="Transport_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsap10:UsingAddressing/>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <!-- <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy> <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy> <sp:WssUsernameToken10 /> </wsp:Policy> </sp:UsernameToken>
+ </wsp:Policy> </sp:SignedSupportingTokens> -->
+ <sp:SignedSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsp:Policy>
+ <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssUsernameToken10/>
+ </wsp:Policy>
+ </sp:UsernameToken>
+ </wsp:Policy>
+ </wsp:All>
+ <wsp:All>
+ <wsp:Policy>
+ <sp:SamlToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssSamlV20Token11/>
+ </wsp:Policy>
+ </sp:SamlToken>
+ </wsp:Policy>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ </sp:SignedSupportingTokens>
+ <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportRefKeyIdentifier/>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Input_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="Output_policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:SignedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <sp:Body/>
+ </sp:EncryptedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..809c5f06de
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl
@@ -0,0 +1,435 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItSymmetricSAML1Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItSymmetricBindingSAML1Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItSymmetricSAML2Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItSymmetricBindingSAML2Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItSymmetricSAML2ProtectTokensBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItSymmetricBindingSAML2ProtectTokensPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItSymmetricSAML2SecureConversationBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItSymmetricBindingSecureConversationSAML2Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItSymmetricSAML1Port" binding="tns:DoubleItSymmetricSAML1Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitsymmetricsaml1"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItSymmetricSAML2Port" binding="tns:DoubleItSymmetricSAML2Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitsymmetricsaml2"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItSymmetricSAML2ProtectTokensPort" binding="tns:DoubleItSymmetricSAML2ProtectTokensBinding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitsymmetricsaml2protecttokens"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItSymmetricSAML2SecureConversationPort" binding="tns:DoubleItSymmetricSAML2SecureConversationBinding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitsymmetricsaml2SecureConversation"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItSymmetricSAML1EncryptedPort" binding="tns:DoubleItSymmetricSAML1Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitsymmetricsaml1encrypted"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItSymmetricBindingSAML1Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:SymmetricBinding>
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
+ <t:KeySize>128</t:KeySize>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItSymmetricBindingSAML2Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ <sp:SymmetricBinding>
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
+ <t:KeySize>128</t:KeySize>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItSymmetricBindingSAML2ProtectTokensPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ <sp:SymmetricBinding>
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
+ <t:KeySize>128</t:KeySize>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:ProtectTokens/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItSymmetricBindingSecureConversationSAML2Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:SymmetricBinding>
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:SecureConversationToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:BootstrapPolicy>
+ <wsp:Policy>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ </sp:SignedParts>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SymmetricBinding>
+ <wsp:Policy>
+ <sp:ProtectionToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
+ <t:KeySize>128</t:KeySize>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT</wsaw:Address>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ </wsp:Policy>
+ </sp:BootstrapPolicy>
+ </wsp:Policy>
+ </sp:SecureConversationToken>
+ </wsp:Policy>
+ </sp:ProtectionToken>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ <sp:OnlySignEntireHeadersAndBody/>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ </wsp:Policy>
+ </sp:SymmetricBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Output_Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <sp:EncryptedParts>
+ <sp:Body/>
+ </sp:EncryptedParts>
+ <sp:SignedParts>
+ <sp:Body/>
+ <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
+ <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/>
+ </sp:SignedParts>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+</wsdl:definitions>
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/cxf-service-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/cxf-service-fips.xml
new file mode 100644
index 0000000000..dd1bdc7116
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/cxf-service-fips.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+
+ <bean id="doubleItNoSecurity" class="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl">
+ <property name="enforcePrincipal" value="false"/>
+ </bean>
+
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML1Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitsymmetricsaml1" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML2Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitsymmetricsaml2" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML2ProtectTokensPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitsymmetricsaml2protecttokens" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML1EncryptedPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitsymmetricsaml1encrypted" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="#doubleItNoSecurity" endpointName="s:DoubleItSymmetricSAML2SecureConversationPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.DoubleItServer}/doubleit/services/doubleitsymmetricsaml2SecureConversation" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
\ No newline at end of file
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/cxf-stax-service-fips.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/cxf-stax-service-fips.xml
new file mode 100644
index 0000000000..02d8ffd86c
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/symmetric/cxf-stax-service-fips.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http: [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+
+ <bean id="doubleItNoSecurity" class="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl">
+ <property name="enforcePrincipal" value="false"/>
+ </bean>
+
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML1Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitsymmetricsaml1" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML2Port" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitsymmetricsaml2" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML2ProtectTokensPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitsymmetricsaml2protecttokens" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItSymmetricSAML1EncryptedPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitsymmetricsaml1encrypted" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" implementor="#doubleItNoSecurity" endpointName="s:DoubleItSymmetricSAML2SecureConversationPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.StaxDoubleItServer}/doubleit/services/doubleitsymmetricsaml2SecureConversation" wsdlLocation="org/apache/cxf/systest/sts/symmetric/DoubleIt-fips.wsdl">
+ <jaxws:properties>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
+</beans>
\ No newline at end of file
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt-fips.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt-fips.wsdl
new file mode 100644
index 0000000000..8b9830ba35
--- /dev/null
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/transport/DoubleIt-fips.wsdl
@@ -0,0 +1,605 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:di="http://www.example.org/schema/DoubleIt" xmlns:tns="http://www.example.org/contract/DoubleIt" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open [...]
+ <wsdl:import location="src/test/resources/DoubleItLogical.wsdl" namespace="http://www.example.org/contract/DoubleIt"/>
+ <wsdl:binding name="DoubleItTransportSAML1Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML1Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML2Binding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML2Policy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML1EndorsingBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML1EndorsingPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML2X509EndorsingBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML2X509EndorsingPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML2SymmetricEndorsingBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML2SymmetricEndorsingPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:binding name="DoubleItTransportSAML2SymmetricEndorsingDerivedBinding" type="tns:DoubleItPortType">
+ <wsp:PolicyReference URI="#DoubleItBindingTransportSAML2SymmetricEndorsingDerivedPolicy"/>
+ <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
+ <wsdl:operation name="DoubleIt">
+ <soap:operation soapAction=""/>
+ <wsdl:input>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy"/>
+ </wsdl:input>
+ <wsdl:output>
+ <soap:body use="literal"/>
+ <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Output_Policy"/>
+ </wsdl:output>
+ </wsdl:operation>
+ </wsdl:binding>
+ <wsdl:service name="DoubleItService">
+ <wsdl:port name="DoubleItTransportSAML1Port" binding="tns:DoubleItTransportSAML1Binding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml1"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML2Port" binding="tns:DoubleItTransportSAML2Binding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml2"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML1EndorsingPort" binding="tns:DoubleItTransportSAML1EndorsingBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml1endorsing"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML2X509EndorsingPort"
+ binding="tns:DoubleItTransportSAML2X509EndorsingBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml2x509endorsing"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML2SymmetricEndorsingPort"
+ binding="tns:DoubleItTransportSAML2SymmetricEndorsingBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml2symmetricendorsing"/>
+ </wsdl:port>
+ <wsdl:port name="DoubleItTransportSAML2SymmetricEndorsingDerivedPort"
+ binding="tns:DoubleItTransportSAML2SymmetricEndorsingDerivedBinding">
+ <soap:address location="https://localhost:8081/doubleit/services/doubleittransportsaml2symmetricendorsingderived"/>
+ </wsdl:port>
+ </wsdl:service>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML1Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/STS/STSUT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp:TripleDes/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML2Policy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp:TripleDes/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML1EndorsingPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp:TripleDes/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/STS/STSUT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:EndorsingSupportingTokens>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML2X509EndorsingPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp:TripleDes/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/STS/STSUT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <wsp:Policy>
+ <sp:WssX509V3Token10/>
+ </wsp:Policy>
+ </sp:X509Token>
+ </wsp:Policy>
+ </sp:EndorsingSupportingTokens>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML2SymmetricEndorsingPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
+ </sp:RequestSecurityTokenTemplate>
+ <wsp:Policy>
+ <sp:RequireInternalReference/>
+ </wsp:Policy>
+ <sp:Issuer>
+ <wsaw:Address>http://localhost:8080/STS/STSUT
+ </wsaw:Address>
+ <wsaw:Metadata>
+ <wsx:Metadata>
+ <wsx:MetadataSection>
+ <wsx:MetadataReference>
+ <wsaw:Address>http://localhost:8080/SecurityTokenService/UT/mex
+ </wsaw:Address>
+ </wsx:MetadataReference>
+ </wsx:MetadataSection>
+ </wsx:Metadata>
+ </wsaw:Metadata>
+ </sp:Issuer>
+ </sp:IssuedToken>
+ </wsp:Policy>
+ </sp:EndorsingSupportingTokens>
+ <sp:Wss11>
+ <wsp:Policy>
+ <sp:MustSupportRefIssuerSerial/>
+ <sp:MustSupportRefThumbprint/>
+ <sp:MustSupportRefEncryptedKey/>
+ </wsp:Policy>
+ </sp:Wss11>
+ <sp:Trust13>
+ <wsp:Policy>
+ <sp:MustSupportIssuedTokens/>
+ <sp:RequireClientEntropy/>
+ <sp:RequireServerEntropy/>
+ </wsp:Policy>
+ </sp:Trust13>
+ </wsp:All>
+ </wsp:ExactlyOne>
+ </wsp:Policy>
+ <wsp:Policy wsu:Id="DoubleItBindingTransportSAML2SymmetricEndorsingDerivedPolicy">
+ <wsp:ExactlyOne>
+ <wsp:All>
+ <wsam:Addressing wsp:Optional="false">
+ <wsp:Policy/>
+ </wsam:Addressing>
+ <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:TransportToken>
+ <wsp:Policy>
+ <sp:HttpsToken>
+ <wsp:Policy/>
+ </sp:HttpsToken>
+ </wsp:Policy>
+ </sp:TransportToken>
+ <sp:AlgorithmSuite>
+ <wsp:Policy>
+ <sp-cxf:Basic128GCMRsa15 xmlns:sp-cxf="http://cxf.apache.org/custom/security-policy"/>
+ </wsp:Policy>
+ </sp:AlgorithmSuite>
+ <sp:Layout>
+ <wsp:Policy>
+ <sp:Lax/>
+ </wsp:Policy>
+ </sp:Layout>
+ <sp:IncludeTimestamp/>
+ </wsp:Policy>
+ </sp:TransportBinding>
+ <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
+ <wsp:Policy>
+ <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
+ <sp:RequestSecurityTokenTemplate>
+ <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>
+ <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
... 52338 lines suppressed ...