You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2014/06/19 18:30:58 UTC
[1/4] [FEDIZ-7] - Largish refactor of Fediz code to accomadate other
protocols
Repository: cxf-fediz
Updated Branches:
refs/heads/master 9260c9ea3 -> 08af52b6f
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationLoginService.java
----------------------------------------------------------------------
diff --git a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationLoginService.java b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationLoginService.java
index cb70f30..c1ca4b4 100644
--- a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationLoginService.java
+++ b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationLoginService.java
@@ -25,12 +25,12 @@ import java.util.List;
import javax.security.auth.Subject;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.FederationRequest;
-import org.apache.cxf.fediz.core.FederationResponse;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.eclipse.jetty.security.IdentityService;
import org.eclipse.jetty.security.LoginService;
import org.eclipse.jetty.server.UserIdentity;
@@ -74,18 +74,18 @@ public class FederationLoginService extends AbstractLifeCycle implements LoginSe
/**
* username will be null since the credentials will contain all the relevant info
*/
- public UserIdentity login(String username, Object credentials, FederationContext config) {
+ public UserIdentity login(String username, Object credentials, FedizContext config) {
try {
- FederationResponse wfRes = null;
- FederationRequest wfReq = (FederationRequest)credentials;
+ FedizResponse wfRes = null;
+ FedizRequest wfReq = (FedizRequest)credentials;
if (LOG.isDebugEnabled()) {
LOG.debug("Process SignIn request");
LOG.debug("wresult=\n" + wfReq.getWresult());
}
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfRes = wfProc.processRequest(wfReq, config);
} catch (ProcessingException ex) {
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserIdentity.java
----------------------------------------------------------------------
diff --git a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserIdentity.java b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserIdentity.java
index 002b045..724d3a5 100644
--- a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserIdentity.java
+++ b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserIdentity.java
@@ -26,8 +26,7 @@ import java.util.Date;
import javax.security.auth.Subject;
import org.w3c.dom.Element;
-
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.eclipse.jetty.server.UserIdentity;
public class FederationUserIdentity implements UserIdentity {
@@ -35,10 +34,10 @@ public class FederationUserIdentity implements UserIdentity {
private Subject subject;
private Principal principal;
private String[] roles;
- private FederationResponse fedResponse;
+ private FedizResponse fedResponse;
public FederationUserIdentity(Subject subject, Principal principal,
- String[] roles, FederationResponse fedResponse) {
+ String[] roles, FedizResponse fedResponse) {
this.subject = subject;
this.principal = principal;
this.roles = roles;
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserPrincipal.java
----------------------------------------------------------------------
diff --git a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserPrincipal.java b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserPrincipal.java
index 89ea304..917f03d 100644
--- a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserPrincipal.java
+++ b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationUserPrincipal.java
@@ -20,17 +20,17 @@
package org.apache.cxf.fediz.jetty;
import org.w3c.dom.Element;
-
import org.apache.cxf.fediz.core.ClaimCollection;
import org.apache.cxf.fediz.core.FederationPrincipal;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
+@SuppressWarnings("deprecation")
public class FederationUserPrincipal implements FederationPrincipal {
private String name;
private ClaimCollection claims;
- private FederationResponse response;
+ private FedizResponse response;
- public FederationUserPrincipal(String name, FederationResponse response) {
+ public FederationUserPrincipal(String name, FedizResponse response) {
this.name = name;
this.response = response;
this.claims = new ClaimCollection(response.getClaims());
@@ -49,7 +49,7 @@ public class FederationUserPrincipal implements FederationPrincipal {
// not public available
//[TODO] maybe find better approach, custom UserIdentity
- FederationResponse getFederationResponse() {
+ FedizResponse getFedizResponse() {
return response;
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
index 255e8fb..9707536 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
@@ -20,13 +20,14 @@
package org.apache.cxf.fediz.spring;
import java.util.List;
-import org.apache.cxf.fediz.core.config.FederationContext;
+
+import org.apache.cxf.fediz.core.config.FedizContext;
public interface FederationConfig {
- List<FederationContext> getFederationContextList();
+ List<FedizContext> getFedizContextList();
- FederationContext getFederationContext(String contextName);
+ FedizContext getFedizContext(String contextName);
- FederationContext getFederationContext();
+ FedizContext getFedizContext();
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
index 4324103..0deaaca 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
@@ -23,12 +23,10 @@ import java.util.List;
import javax.servlet.ServletContext;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
-
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.beans.factory.BeanCreationException;
import org.springframework.core.io.Resource;
import org.springframework.util.Assert;
@@ -42,7 +40,7 @@ public class FederationConfigImpl implements FederationConfig, ServletContextAwa
private String contextName;
private ServletContext servletContext;
- private FederationConfigurator configurator = new FederationConfigurator();
+ private FedizConfigurator configurator = new FedizConfigurator();
public Resource getConfigFile() {
@@ -72,13 +70,13 @@ public class FederationConfigImpl implements FederationConfig, ServletContextAwa
}
@Override
- public List<FederationContext> getFederationContextList() {
- return configurator.getFederationContextList();
+ public List<FedizContext> getFedizContextList() {
+ return configurator.getFedizContextList();
}
@Override
- public FederationContext getFederationContext(String context) {
- FederationContext ctx = configurator.getFederationContext(context);
+ public FedizContext getFedizContext(String context) {
+ FedizContext ctx = configurator.getFedizContext(context);
if (ctx == null) {
LOG.error("Federation context '" + context + "' not found.");
throw new IllegalStateException("Federation context '" + context + "' not found.");
@@ -87,14 +85,14 @@ public class FederationConfigImpl implements FederationConfig, ServletContextAwa
}
@Override
- public FederationContext getFederationContext() {
+ public FedizContext getFedizContext() {
if (servletContext != null) {
LOG.debug("Reading federation configuration for context '{}'",
servletContext.getContextPath());
- return getFederationContext(servletContext.getContextPath());
+ return getFedizContext(servletContext.getContextPath());
} else {
Assert.notNull(contextName, "Property 'contextName' must be configured because ServletContext null");
- return getFederationContext(contextName);
+ return getFedizContext(contextName);
}
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
index d182268..82444c6 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
@@ -18,7 +18,7 @@
*/
package org.apache.cxf.fediz.spring.authentication;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
import org.springframework.security.core.userdetails.UserDetails;
@@ -34,9 +34,9 @@ public abstract class AbstractFederationUserDetailsService
/**
* Protected template method for construct a {@link org.springframework.security.core.userdetails.UserDetails}
- * via the supplied FederationResponse
+ * via the supplied FedizResponse
*
* @return the newly created UserDetails object.
*/
- protected abstract UserDetails loadUserDetails(FederationResponse response);
+ protected abstract UserDetails loadUserDetails(FedizResponse response);
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
index 778348b..a5a1390 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
@@ -19,16 +19,14 @@
package org.apache.cxf.fediz.spring.authentication;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.FederationRequest;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.cxf.fediz.spring.FederationConfig;
import org.apache.cxf.fediz.spring.SpringFedizMessageSource;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.MessageSource;
import org.springframework.context.MessageSourceAware;
@@ -116,9 +114,9 @@ public class FederationAuthenticationProvider implements AuthenticationProvider,
private FederationAuthenticationToken authenticateNow(final Authentication authentication)
throws AuthenticationException {
try {
- FederationRequest wfReq = (FederationRequest)authentication.getCredentials();
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, federationConfig.getFederationContext());
+ FedizRequest wfReq = (FedizRequest)authentication.getCredentials();
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, federationConfig.getFedizContext());
final UserDetails userDetails = loadUserByFederationResponse(wfRes);
userDetailsChecker.check(userDetails);
@@ -136,7 +134,7 @@ public class FederationAuthenticationProvider implements AuthenticationProvider,
* @param response The WS Federation response
* @return the UserDetails.
*/
- protected UserDetails loadUserByFederationResponse(final FederationResponse response) {
+ protected UserDetails loadUserByFederationResponse(final FedizResponse response) {
final FederationResponseAuthenticationToken token = new FederationResponseAuthenticationToken(response);
return this.authenticationUserDetailsService.loadUserDetails(token);
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
index c996131..77983ea 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
@@ -23,10 +23,9 @@ import java.io.Serializable;
import java.util.Collection;
import org.w3c.dom.Element;
-
import org.apache.cxf.fediz.core.ClaimCollection;
import org.apache.cxf.fediz.core.FederationPrincipal;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.SpringSecurityCoreVersion;
@@ -35,6 +34,7 @@ import org.springframework.security.core.userdetails.UserDetails;
/**
* Represents a successful WS-Federation based authentication.
*/
+@SuppressWarnings("deprecation")
public class FederationAuthenticationToken extends AbstractAuthenticationToken
implements Serializable, FederationPrincipal {
@@ -43,12 +43,12 @@ public class FederationAuthenticationToken extends AbstractAuthenticationToken
private final Object credentials;
private final Object principal;
private final UserDetails userDetails;
- private final FederationResponse response;
+ private final FedizResponse response;
public FederationAuthenticationToken(final Object principal, final Object credentials,
final Collection<? extends GrantedAuthority> authorities, final UserDetails userDetails,
- final FederationResponse response) {
+ final FedizResponse response) {
super(authorities);
if ((principal == null) || "".equals(principal) || (credentials == null)
@@ -71,7 +71,7 @@ public class FederationAuthenticationToken extends AbstractAuthenticationToken
return this.principal;
}
- public FederationResponse getResponse() {
+ public FedizResponse getResponse() {
return this.response;
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
index 307665b..138a9ed 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.authentication;
import java.util.ArrayList;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.SpringSecurityCoreVersion;
@@ -30,10 +30,10 @@ public final class FederationResponseAuthenticationToken extends AbstractAuthent
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
- private final FederationResponse response;
+ private final FedizResponse response;
- public FederationResponseAuthenticationToken(final FederationResponse response) {
+ public FederationResponseAuthenticationToken(final FedizResponse response) {
super(new ArrayList<GrantedAuthority>());
this.response = response;
@@ -47,7 +47,7 @@ public final class FederationResponseAuthenticationToken extends AbstractAuthent
return this.response;
}
- public FederationResponse getResponse() {
+ public FedizResponse getResponse() {
return this.response;
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
index 9d52c01..cbe270e 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.authentication;
import java.util.*;
import org.apache.cxf.fediz.core.ClaimCollection;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.cxf.fediz.spring.FederationUser;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -37,7 +37,7 @@ public class GrantedAuthoritiesUserDetailsFederationService
private boolean convertToUpperCase = true;
@Override
- protected UserDetails loadUserDetails(FederationResponse response) {
+ protected UserDetails loadUserDetails(FedizResponse response) {
final List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
index 9f6a482..ddd0d83 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.preauth;
import javax.servlet.http.HttpServletRequest;
-import org.apache.cxf.fediz.core.FederationPrincipal;
+import org.apache.cxf.fediz.core.FedizPrincipal;
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
/**
@@ -53,7 +53,7 @@ public class FederationPreAuthenticatedProcessingFilter extends AbstractPreAuthe
*/
protected Object getPreAuthenticatedCredentials(HttpServletRequest httpRequest) {
Object principal = httpRequest.getUserPrincipal() == null ? null : httpRequest.getUserPrincipal();
- if (principal instanceof FederationPrincipal) {
+ if (principal instanceof FedizPrincipal) {
Object obj = httpRequest.getSession(false).getAttribute(SECURITY_TOKEN_ATTR);
if (obj != null) {
return obj;
@@ -62,8 +62,8 @@ public class FederationPreAuthenticatedProcessingFilter extends AbstractPreAuthe
throw new IllegalStateException("Session must contain Federation response");
}
} else {
- logger.error("Principal must be instance of FederationPrincipal: " + principal.toString());
- throw new IllegalStateException("Principal must be instance of FederationPrincipal");
+ logger.error("Principal must be instance of FedizPrincipal: " + principal.toString());
+ throw new IllegalStateException("Principal must be instance of FedizPrincipal");
}
//return "N/A";
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
index 23617b4..f74bc28 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.preauth;
import java.util.*;
import org.apache.cxf.fediz.core.ClaimCollection;
-import org.apache.cxf.fediz.core.FederationPrincipal;
+import org.apache.cxf.fediz.core.FedizPrincipal;
import org.apache.cxf.fediz.spring.FederationUser;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
@@ -60,11 +60,11 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService
public final UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token) throws AuthenticationException {
Assert.notNull(token.getDetails());
Assert.isInstanceOf(GrantedAuthoritiesContainer.class, token.getDetails());
- Assert.isInstanceOf(FederationPrincipal.class, token.getPrincipal());
+ Assert.isInstanceOf(FedizPrincipal.class, token.getPrincipal());
Collection<? extends GrantedAuthority> authorities =
((GrantedAuthoritiesContainer) token.getDetails()).getGrantedAuthorities();
- return createuserDetails(token, authorities, ((FederationPrincipal)token.getPrincipal()).getClaims());
+ return createuserDetails(token, authorities, ((FedizPrincipal)token.getPrincipal()).getClaims());
}
/**
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
index 2696845..096ec5a 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
@@ -25,15 +25,13 @@ import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
import org.apache.cxf.fediz.spring.FederationConfig;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.beans.BeansException;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.ApplicationContext;
@@ -75,10 +73,10 @@ public class FederationAuthenticationEntryPoint implements AuthenticationEntryPo
final AuthenticationException authenticationException) throws IOException, ServletException {
String redirectUrl = null;
- FederationContext fedContext = federationConfig.getFederationContext();
+ FedizContext fedContext = federationConfig.getFedizContext();
LOG.debug("Federation context: {}", fedContext);
try {
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
redirectUrl = wfProc.createSignInRequest(servletRequest, fedContext);
if (redirectUrl == null) {
LOG.warn("Failed to create SignInRequest. Redirect URL null");
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
index 59bcb87..c47377a 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
@@ -25,7 +25,7 @@ import java.security.cert.X509Certificate;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.cxf.fediz.core.FederationRequest;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
@@ -47,7 +47,7 @@ public class FederationAuthenticationFilter extends AbstractAuthenticationProces
String wa = request.getParameter("wa");
String wresult = request.getParameter("wresult");
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(wa);
wfReq.setWresult(wresult);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutFilter.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutFilter.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutFilter.java
index 63c9a2d..2e02460 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutFilter.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutFilter.java
@@ -48,7 +48,7 @@ public class FederationLogoutFilter extends LogoutFilter {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- this.logoutUrl = federationConfig.getFederationContext(contextName).getLogoutURL();
+ this.logoutUrl = federationConfig.getFedizContext(contextName).getLogoutURL();
}
if (this.logoutUrl != null && !this.logoutUrl.isEmpty()) {
super.setFilterProcessesUrl(this.logoutUrl);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutSuccessHandler.java
----------------------------------------------------------------------
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutSuccessHandler.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutSuccessHandler.java
index 180a436..5ef4b6d 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutSuccessHandler.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationLogoutSuccessHandler.java
@@ -19,14 +19,15 @@
package org.apache.cxf.fediz.spring.web;
import java.io.IOException;
+
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
import org.apache.cxf.fediz.spring.FederationConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -48,12 +49,12 @@ public class FederationLogoutSuccessHandler implements LogoutSuccessHandler {
@Override
public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response,
Authentication authentication) throws IOException, ServletException {
- FederationProcessor processor = new FederationProcessorImpl();
+ FedizProcessor processor = new FederationProcessorImpl();
String contextName = request.getContextPath();
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedCtx = federationConfig.getFederationContext(contextName);
+ FedizContext fedCtx = federationConfig.getFedizContext(contextName);
String redirectURL;
try {
redirectURL = processor.createSignOutRequest(request, fedCtx);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
index 255e8fb..9707536 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfig.java
@@ -20,13 +20,14 @@
package org.apache.cxf.fediz.spring;
import java.util.List;
-import org.apache.cxf.fediz.core.config.FederationContext;
+
+import org.apache.cxf.fediz.core.config.FedizContext;
public interface FederationConfig {
- List<FederationContext> getFederationContextList();
+ List<FedizContext> getFedizContextList();
- FederationContext getFederationContext(String contextName);
+ FedizContext getFedizContext(String contextName);
- FederationContext getFederationContext();
+ FedizContext getFedizContext();
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
index 95b8998..80b27e9 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/FederationConfigImpl.java
@@ -21,12 +21,10 @@ package org.apache.cxf.fediz.spring;
import java.util.List;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
-
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.beans.factory.BeanCreationException;
import org.springframework.core.io.Resource;
import org.springframework.util.Assert;
@@ -41,7 +39,7 @@ public class FederationConfigImpl implements FederationConfig {
private String contextName;
//private ServletContext servletContext;
- private FederationConfigurator configurator = new FederationConfigurator();
+ private FedizConfigurator configurator = new FedizConfigurator();
public Resource getConfigFile() {
@@ -71,13 +69,13 @@ public class FederationConfigImpl implements FederationConfig {
}
@Override
- public List<FederationContext> getFederationContextList() {
- return configurator.getFederationContextList();
+ public List<FedizContext> getFedizContextList() {
+ return configurator.getFedizContextList();
}
@Override
- public FederationContext getFederationContext(String context) {
- FederationContext ctx = configurator.getFederationContext(context);
+ public FedizContext getFedizContext(String context) {
+ FedizContext ctx = configurator.getFedizContext(context);
if (ctx == null) {
LOG.error("Federation context '" + context + "' not found.");
throw new IllegalStateException("Federation context '" + context + "' not found.");
@@ -87,13 +85,13 @@ public class FederationConfigImpl implements FederationConfig {
@Override
- public FederationContext getFederationContext() {
+ public FedizContext getFedizContext() {
if (contextName != null) {
LOG.debug("Reading federation configuration for context '{}'", contextName);
- return getFederationContext(contextName);
+ return getFedizContext(contextName);
} else {
Assert.notNull(contextName, "Property 'contextName' must be configured because ServletContext null");
- return getFederationContext(contextName);
+ return getFedizContext(contextName);
}
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
index 9ef97eb..c34de45 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/AbstractFederationUserDetailsService.java
@@ -18,7 +18,7 @@
*/
package org.apache.cxf.fediz.spring.authentication;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.springframework.security.Authentication;
import org.springframework.security.userdetails.AuthenticationUserDetailsService;
import org.springframework.security.userdetails.UserDetails;
@@ -45,11 +45,11 @@ public abstract class AbstractFederationUserDetailsService
/**
* Protected template method for construct a {@link org.springframework.security.core.userdetails.UserDetails}
- * via the supplied FederationResponse
+ * via the supplied FedizResponse
*
* @return the newly created UserDetails object.
*/
- protected abstract UserDetails loadUserDetails(FederationResponse response);
+ protected abstract UserDetails loadUserDetails(FedizResponse response);
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
index 828c6d0..d58e210 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationProvider.java
@@ -19,22 +19,18 @@
package org.apache.cxf.fediz.spring.authentication;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.FederationRequest;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.cxf.fediz.spring.FederationConfig;
import org.apache.cxf.fediz.spring.SpringFedizMessageSource;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.MessageSource;
import org.springframework.context.MessageSourceAware;
import org.springframework.context.support.MessageSourceAccessor;
-
-
import org.springframework.security.Authentication;
import org.springframework.security.AuthenticationException;
import org.springframework.security.BadCredentialsException;
@@ -117,9 +113,9 @@ public class FederationAuthenticationProvider implements AuthenticationProvider,
private FederationAuthenticationToken authenticateNow(final Authentication authentication)
throws AuthenticationException {
try {
- FederationRequest wfReq = (FederationRequest)authentication.getCredentials();
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, federationConfig.getFederationContext());
+ FedizRequest wfReq = (FedizRequest)authentication.getCredentials();
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, federationConfig.getFedizContext());
final UserDetails userDetails = loadUserByFederationResponse(wfRes);
userDetailsChecker.check(userDetails);
@@ -137,7 +133,7 @@ public class FederationAuthenticationProvider implements AuthenticationProvider,
* @param response The WS Federation response
* @return the UserDetails.
*/
- protected UserDetails loadUserByFederationResponse(final FederationResponse response) {
+ protected UserDetails loadUserByFederationResponse(final FedizResponse response) {
final FederationResponseAuthenticationToken token = new FederationResponseAuthenticationToken(response);
return this.authenticationUserDetailsService.loadUserDetails(token);
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
index 63bc962..8179167 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationAuthenticationToken.java
@@ -22,10 +22,9 @@ package org.apache.cxf.fediz.spring.authentication;
import java.io.Serializable;
import org.w3c.dom.Element;
-
import org.apache.cxf.fediz.core.ClaimCollection;
import org.apache.cxf.fediz.core.FederationPrincipal;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.providers.AbstractAuthenticationToken;
import org.springframework.security.userdetails.UserDetails;
@@ -33,6 +32,7 @@ import org.springframework.security.userdetails.UserDetails;
/**
* Represents a successful WS-Federation based authentication.
*/
+@SuppressWarnings("deprecation")
public class FederationAuthenticationToken extends AbstractAuthenticationToken
implements Serializable, FederationPrincipal {
@@ -41,12 +41,12 @@ public class FederationAuthenticationToken extends AbstractAuthenticationToken
private final Object credentials;
private final Object principal;
private final UserDetails userDetails;
- private final FederationResponse response;
+ private final FedizResponse response;
public FederationAuthenticationToken(final Object principal, final Object credentials,
final GrantedAuthority[] authorities, final UserDetails userDetails,
- final FederationResponse response) {
+ final FedizResponse response) {
super(authorities);
if ((principal == null) || "".equals(principal) || (credentials == null)
@@ -69,7 +69,7 @@ public class FederationAuthenticationToken extends AbstractAuthenticationToken
return this.principal;
}
- public FederationResponse getResponse() {
+ public FedizResponse getResponse() {
return this.response;
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
index d3eb155..55d7a33 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/FederationResponseAuthenticationToken.java
@@ -19,17 +19,17 @@
package org.apache.cxf.fediz.spring.authentication;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.springframework.security.providers.AbstractAuthenticationToken;
public final class FederationResponseAuthenticationToken extends AbstractAuthenticationToken {
private static final long serialVersionUID = 1L;
- private final FederationResponse response;
+ private final FedizResponse response;
- public FederationResponseAuthenticationToken(final FederationResponse response) {
+ public FederationResponseAuthenticationToken(final FedizResponse response) {
super(null);
this.response = response;
@@ -43,7 +43,7 @@ public final class FederationResponseAuthenticationToken extends AbstractAuthent
return this.response;
}
- public FederationResponse getResponse() {
+ public FedizResponse getResponse() {
return this.response;
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
index 1864f10..15df380 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/authentication/GrantedAuthoritiesUserDetailsFederationService.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.authentication;
import java.util.*;
import org.apache.cxf.fediz.core.ClaimCollection;
-import org.apache.cxf.fediz.core.FederationResponse;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.cxf.fediz.spring.FederationUser;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
@@ -37,7 +37,7 @@ public class GrantedAuthoritiesUserDetailsFederationService
private boolean convertToUpperCase = true;
@Override
- protected UserDetails loadUserDetails(FederationResponse response) {
+ protected UserDetails loadUserDetails(FedizResponse response) {
List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
index d4f0b7d..7aae276 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/FederationPreAuthenticatedProcessingFilter.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.preauth;
import javax.servlet.http.HttpServletRequest;
-import org.apache.cxf.fediz.core.FederationPrincipal;
+import org.apache.cxf.fediz.core.FedizPrincipal;
import org.springframework.security.ui.FilterChainOrder;
import org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter;
@@ -54,7 +54,7 @@ public class FederationPreAuthenticatedProcessingFilter extends AbstractPreAuthe
*/
protected Object getPreAuthenticatedCredentials(HttpServletRequest httpRequest) {
Object principal = httpRequest.getUserPrincipal() == null ? null : httpRequest.getUserPrincipal();
- if (principal instanceof FederationPrincipal) {
+ if (principal instanceof FedizPrincipal) {
Object obj = httpRequest.getSession(false).getAttribute(SECURITY_TOKEN_ATTR);
if (obj != null) {
return obj;
@@ -63,8 +63,8 @@ public class FederationPreAuthenticatedProcessingFilter extends AbstractPreAuthe
throw new IllegalStateException("Session must contain Federation response");
}
} else {
- logger.error("Principal must be instance of FederationPrincipal: " + principal.toString());
- throw new IllegalStateException("Principal must be instance of FederationPrincipal");
+ logger.error("Principal must be instance of FedizPrincipal: " + principal.toString());
+ throw new IllegalStateException("Principal must be instance of FedizPrincipal");
}
//return "N/A";
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
index 97224b0..e10831b 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService.java
@@ -18,10 +18,8 @@
*/
package org.apache.cxf.fediz.spring.preauth;
-import java.util.*;
-
import org.apache.cxf.fediz.core.ClaimCollection;
-import org.apache.cxf.fediz.core.FederationPrincipal;
+import org.apache.cxf.fediz.core.FedizPrincipal;
import org.apache.cxf.fediz.spring.FederationUser;
import org.springframework.security.Authentication;
import org.springframework.security.AuthenticationException;
@@ -61,11 +59,11 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService
public final UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token) throws AuthenticationException {
Assert.notNull(token.getDetails());
Assert.isInstanceOf(GrantedAuthoritiesContainer.class, token.getDetails());
- Assert.isInstanceOf(FederationPrincipal.class, token.getPrincipal());
+ Assert.isInstanceOf(FedizPrincipal.class, token.getPrincipal());
GrantedAuthority[] authorities =
((GrantedAuthoritiesContainer) token.getDetails()).getGrantedAuthorities();
- return createuserDetails(token, authorities, ((FederationPrincipal)token.getPrincipal()).getClaims());
+ return createuserDetails(token, authorities, ((FedizPrincipal)token.getPrincipal()).getClaims());
}
/**
@@ -84,10 +82,10 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsFederationService
Assert.notNull(token.getDetails());
Assert.isInstanceOf(PreAuthenticatedAuthenticationToken.class, token);
Assert.isInstanceOf(GrantedAuthoritiesContainer.class, token.getDetails());
- Assert.isInstanceOf(FederationPrincipal.class, token.getPrincipal());
+ Assert.isInstanceOf(FedizPrincipal.class, token.getPrincipal());
GrantedAuthority[] authorities =
((GrantedAuthoritiesContainer) token.getDetails()).getGrantedAuthorities();
- return createuserDetails(token, authorities, ((FederationPrincipal)token.getPrincipal()).getClaims());
+ return createuserDetails(token, authorities, ((FedizPrincipal)token.getPrincipal()).getClaims());
}
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
index a8a6184..c6e2a02 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationEntryPoint.java
@@ -27,15 +27,13 @@ import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
import org.apache.cxf.fediz.spring.FederationConfig;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.beans.BeansException;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.ApplicationContext;
@@ -78,10 +76,10 @@ public class FederationAuthenticationEntryPoint implements AuthenticationEntryPo
final AuthenticationException authenticationException) throws IOException, ServletException {
String redirectUrl = null;
- FederationContext fedContext = federationConfig.getFederationContext();
+ FedizContext fedContext = federationConfig.getFedizContext();
LOG.debug("Federation context: {}", fedContext);
try {
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
redirectUrl = wfProc.createSignInRequest(servletRequest, fedContext);
if (redirectUrl == null) {
LOG.warn("Failed to create SignInRequest. Redirect URL null");
@@ -122,10 +120,10 @@ public class FederationAuthenticationEntryPoint implements AuthenticationEntryPo
HttpServletRequest hrequest = (HttpServletRequest)request;
HttpServletResponse hresponse = (HttpServletResponse)response;
String redirectUrl = null;
- FederationContext fedContext = federationConfig.getFederationContext();
+ FedizContext fedContext = federationConfig.getFedizContext();
LOG.debug("Federation context: {}", fedContext);
try {
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
redirectUrl = wfProc.createSignInRequest(hrequest, fedContext);
if (redirectUrl == null) {
LOG.warn("Failed to create SignInRequest.");
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
index ef1bbf8..c46cac3 100644
--- a/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
+++ b/plugins/spring2/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
@@ -24,8 +24,7 @@ import java.security.cert.X509Certificate;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.apache.cxf.fediz.core.FederationRequest;
-
+import org.apache.cxf.fediz.core.processor.FedizRequest;
import org.springframework.security.Authentication;
import org.springframework.security.AuthenticationException;
import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
@@ -61,7 +60,7 @@ public class FederationAuthenticationFilter extends AbstractProcessingFilter {
public Authentication attemptAuthentication(HttpServletRequest request) throws AuthenticationException {
String wa = request.getParameter("wa");
String wresult = request.getParameter("wresult");
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(wa);
wfReq.setWresult(wresult);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationAuthenticator.java
----------------------------------------------------------------------
diff --git a/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationAuthenticator.java b/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationAuthenticator.java
index d9d2ece..83a4630 100644
--- a/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationAuthenticator.java
+++ b/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationAuthenticator.java
@@ -36,7 +36,6 @@ import javax.servlet.http.HttpSession;
import javax.xml.bind.JAXBException;
import org.w3c.dom.Document;
-
import org.apache.catalina.LifecycleException;
import org.apache.catalina.Session;
import org.apache.catalina.authenticator.Constants;
@@ -46,13 +45,13 @@ import org.apache.catalina.connector.Request;
import org.apache.catalina.connector.Response;
import org.apache.catalina.deploy.LoginConfig;
import org.apache.cxf.fediz.core.FederationConstants;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.FederationRequest;
-import org.apache.cxf.fediz.core.FederationResponse;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizProcessorFactory;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
import org.apache.wss4j.common.util.DOM2Writer;
@@ -78,7 +77,7 @@ public class FederationAuthenticator extends FormAuthenticator {
protected boolean tokenExpirationValidation = true;
protected String encoding = "UTF-8";
- private FederationConfigurator configurator;
+ private FedizConfigurator configurator;
public FederationAuthenticator() {
LOG.debug("WsFedAuthenticator()");
@@ -127,7 +126,7 @@ public class FederationAuthenticator extends FormAuthenticator {
f = new File(catalinaBase.concat(File.separator + getConfigFile()));
}
}
- configurator = new FederationConfigurator();
+ configurator = new FedizConfigurator();
configurator.loadConfig(f);
LOG.debug("Fediz configuration read from " + f.getAbsolutePath());
} catch (JAXBException e) {
@@ -141,9 +140,9 @@ public class FederationAuthenticator extends FormAuthenticator {
@Override
protected synchronized void stopInternal() throws LifecycleException {
if (configurator != null) {
- List<FederationContext> fedContextList = configurator.getFederationContextList();
+ List<FedizContext> fedContextList = configurator.getFedizContextList();
if (fedContextList != null) {
- for (FederationContext fedContext : fedContextList) {
+ for (FedizContext fedContext : fedContextList) {
try {
fedContext.close();
} catch (IOException ex) {
@@ -155,11 +154,11 @@ public class FederationAuthenticator extends FormAuthenticator {
super.stopInternal();
}
- protected FederationContext getContextConfiguration(String contextName) {
+ protected FedizContext getContextConfiguration(String contextName) {
if (configurator == null) {
throw new IllegalStateException("No Fediz configuration available");
}
- FederationContext config = configurator.getFederationContext(contextName);
+ FedizContext config = configurator.getFedizContext(contextName);
if (config == null) {
throw new IllegalStateException("No Fediz configuration for context :" + contextName);
}
@@ -188,8 +187,9 @@ public class FederationAuthenticator extends FormAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedConfig = getContextConfiguration(contextName);
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizContext fedConfig = getContextConfiguration(contextName);
+ FedizProcessor wfProc =
+ FedizProcessorFactory.newFedizProcessor(fedConfig.getProtocol());
try {
Document metadata = wfProc.getMetaData(fedConfig);
out.write(DOM2Writer.nodeToString(metadata));
@@ -206,7 +206,7 @@ public class FederationAuthenticator extends FormAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedConfig = getContextConfiguration(contextName);
+ FedizContext fedConfig = getContextConfiguration(contextName);
String logoutUrl = fedConfig.getLogoutURL();
if (logoutUrl != null && !logoutUrl.isEmpty()) {
@@ -215,7 +215,8 @@ public class FederationAuthenticator extends FormAuthenticator {
if (httpSession != null && uri.equals(contextName + logoutUrl)) {
httpSession.invalidate();
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc =
+ FedizProcessorFactory.newFedizProcessor(fedConfig.getProtocol());
signOutRedirectToIssuer(request, response, wfProc);
return;
@@ -279,7 +280,7 @@ public class FederationAuthenticator extends FormAuthenticator {
if (session == null) {
LOG.debug("Session should not be null after authentication");
} else {
- FederationResponse wfRes = (FederationResponse)session.getNote(FEDERATION_NOTE);
+ FedizResponse wfRes = (FedizResponse)session.getNote(FEDERATION_NOTE);
Date tokenExpires = wfRes.getTokenExpires();
if (tokenExpires == null) {
@@ -312,7 +313,14 @@ public class FederationAuthenticator extends FormAuthenticator {
sm.getString("authenticator.requestBodyTooBig"));
return false;
}
- FederationProcessor wfProc = new FederationProcessorImpl();
+ String contextName = request.getServletContext().getContextPath();
+ if (contextName == null || contextName.isEmpty()) {
+ contextName = "/";
+ }
+ FedizContext fedConfig = getContextConfiguration(contextName);
+
+ FedizProcessor wfProc =
+ FedizProcessorFactory.newFedizProcessor(fedConfig.getProtocol());
signInRedirectToIssuer(request, response, wfProc);
return false;
@@ -371,7 +379,14 @@ public class FederationAuthenticator extends FormAuthenticator {
sm.getString("authenticator.requestBodyTooBig"));
return false;
}
- FederationProcessor wfProc = new FederationProcessorImpl();
+ String contextName = request.getServletContext().getContextPath();
+ if (contextName == null || contextName.isEmpty()) {
+ contextName = "/";
+ }
+ FedizContext fedConfig = getContextConfiguration(contextName);
+
+ FedizProcessor wfProc =
+ FedizProcessorFactory.newFedizProcessor(fedConfig.getProtocol());
signInRedirectToIssuer(request, response, wfProc);
return false;
}
@@ -379,7 +394,7 @@ public class FederationAuthenticator extends FormAuthenticator {
// Check whether it is the signin request, validate the token.
// If failed, redirect to the error page if they are not correct
String wresult = request.getParameter("wresult");
- FederationResponse wfRes = null;
+ FedizResponse wfRes = null;
if (wa.equals(FederationConstants.ACTION_SIGNIN)) {
if (LOG.isDebugEnabled()) {
LOG.debug("SignIn request found");
@@ -400,7 +415,7 @@ public class FederationAuthenticator extends FormAuthenticator {
LOG.debug("wresult=\n" + wresult);
}
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(wa);
wfReq.setWresult(wresult);
@@ -412,9 +427,10 @@ public class FederationAuthenticator extends FormAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedConfig = getContextConfiguration(contextName);
+ FedizContext fedConfig = getContextConfiguration(contextName);
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc =
+ FedizProcessorFactory.newFedizProcessor(fedConfig.getProtocol());
try {
wfRes = wfProc.processRequest(wfReq, fedConfig);
} catch (ProcessingException ex) {
@@ -569,14 +585,14 @@ public class FederationAuthenticator extends FormAuthenticator {
* {@link HttpServletResponse#sendError(int, String)} throws an
* {@link IOException}
*/
- protected void signInRedirectToIssuer(Request request, HttpServletResponse response, FederationProcessor processor)
+ protected void signInRedirectToIssuer(Request request, HttpServletResponse response, FedizProcessor processor)
throws IOException {
String contextName = request.getServletContext().getContextPath();
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedCtx = this.configurator.getFederationContext(contextName);
+ FedizContext fedCtx = this.configurator.getFedizContext(contextName);
String redirectURL = null;
try {
redirectURL = processor.createSignInRequest(request, fedCtx);
@@ -595,14 +611,14 @@ public class FederationAuthenticator extends FormAuthenticator {
}
- protected void signOutRedirectToIssuer(Request request, HttpServletResponse response, FederationProcessor processor)
+ protected void signOutRedirectToIssuer(Request request, HttpServletResponse response, FedizProcessor processor)
throws IOException {
String contextName = request.getServletContext().getContextPath();
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedCtx = this.configurator.getFederationContext(contextName);
+ FedizContext fedCtx = this.configurator.getFedizContext(contextName);
String redirectURL = null;
try {
redirectURL = processor.createSignOutRequest(request, fedCtx);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationPrincipalImpl.java
----------------------------------------------------------------------
diff --git a/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationPrincipalImpl.java b/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationPrincipalImpl.java
index ffafcbb..5739b19 100644
--- a/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationPrincipalImpl.java
+++ b/plugins/tomcat/src/main/java/org/apache/cxf/fediz/tomcat/FederationPrincipalImpl.java
@@ -22,12 +22,12 @@ package org.apache.cxf.fediz.tomcat;
import java.util.List;
import org.w3c.dom.Element;
-
import org.apache.catalina.realm.GenericPrincipal;
import org.apache.cxf.fediz.core.Claim;
import org.apache.cxf.fediz.core.ClaimCollection;
import org.apache.cxf.fediz.core.FederationPrincipal;
+@SuppressWarnings("deprecation")
public class FederationPrincipalImpl extends GenericPrincipal implements FederationPrincipal {
protected ClaimCollection claims;
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java
----------------------------------------------------------------------
diff --git a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java
index 3b909a8..43ebde0 100644
--- a/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java
+++ b/services/idp/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpWSFedProtocolHandler.java
@@ -32,13 +32,8 @@ import java.util.Collections;
import javax.servlet.http.HttpServletRequest;
import org.w3c.dom.Element;
-
import org.apache.cxf.fediz.core.FederationConstants;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.FederationRequest;
-import org.apache.cxf.fediz.core.FederationResponse;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.config.TrustManager;
import org.apache.cxf.fediz.core.config.jaxb.AudienceUris;
import org.apache.cxf.fediz.core.config.jaxb.CertificateStores;
@@ -50,6 +45,10 @@ import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuerType;
import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuers;
import org.apache.cxf.fediz.core.config.jaxb.ValidationType;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.cxf.fediz.service.idp.domain.Idp;
import org.apache.cxf.fediz.service.idp.domain.TrustedIdp;
import org.apache.cxf.fediz.service.idp.spi.TrustedIdpProtocolHandler;
@@ -59,10 +58,8 @@ import org.apache.wss4j.common.crypto.CertificateStore;
import org.apache.xml.security.exceptions.Base64DecodingException;
import org.apache.xml.security.stax.impl.util.IDGenerator;
import org.apache.xml.security.utils.Base64;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-
import org.springframework.stereotype.Component;
import org.springframework.webflow.execution.RequestContext;
@@ -138,14 +135,14 @@ public class TrustedIdpWSFedProtocolHandler implements TrustedIdpProtocolHandler
throw new IllegalStateException("No security token issued");
}
- FederationContext fedContext = getFederationContext(idp, trustedIdp);
+ FedizContext fedContext = getFedizContext(idp, trustedIdp);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(wresult);
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfResp = wfProc.processRequest(wfReq, fedContext);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfResp = wfProc.processRequest(wfReq, fedContext);
fedContext.close();
@@ -176,7 +173,7 @@ public class TrustedIdpWSFedProtocolHandler implements TrustedIdpProtocolHandler
}
- private FederationContext getFederationContext(Idp idpConfig,
+ private FedizContext getFedizContext(Idp idpConfig,
TrustedIdp trustedIdpConfig) throws ProcessingException {
ContextConfig config = new ContextConfig();
@@ -215,7 +212,7 @@ public class TrustedIdpWSFedProtocolHandler implements TrustedIdpProtocolHandler
audienceUris.getAudienceItem().add(idpConfig.getRealm());
config.setAudienceUris(audienceUris);
- FederationContext fedContext = new FederationContext(config);
+ FedizContext fedContext = new FedizContext(config);
if (!isCertificateLocation) {
CertificateStore cs = null;
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/systests/simpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
----------------------------------------------------------------------
diff --git a/systests/simpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java b/systests/simpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
index 92f0f16..982dac4 100644
--- a/systests/simpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
+++ b/systests/simpleWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
@@ -34,7 +34,7 @@ import org.w3c.dom.Element;
import org.apache.cxf.fediz.core.Claim;
import org.apache.cxf.fediz.core.ClaimCollection;
-import org.apache.cxf.fediz.core.FederationPrincipal;
+import org.apache.cxf.fediz.core.FedizPrincipal;
import org.apache.cxf.fediz.core.SecurityTokenThreadLocal;
@@ -68,8 +68,8 @@ public class FederationServlet extends HttpServlet {
out.println("<p>role:" + item + "=" + ((request.isUserInRole(item)) ? "true" : "false") + "</p>");
}
- if (p instanceof FederationPrincipal) {
- FederationPrincipal fp = (FederationPrincipal)p;
+ if (p instanceof FedizPrincipal) {
+ FedizPrincipal fp = (FedizPrincipal)p;
ClaimCollection claims = fp.getClaims();
for (Claim c: claims) {
@@ -78,7 +78,7 @@ public class FederationServlet extends HttpServlet {
Element el = fp.getLoginToken();
if (el != null) {
- out.println("loginToken=FOUND{FederationPrincipal}<p>");
+ out.println("loginToken=FOUND{FedizPrincipal}<p>");
}
el = SecurityTokenThreadLocal.getToken();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/systests/spring2Webapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
----------------------------------------------------------------------
diff --git a/systests/spring2Webapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java b/systests/spring2Webapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
index bb48236..5d90f9c 100644
--- a/systests/spring2Webapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
+++ b/systests/spring2Webapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
@@ -91,7 +91,7 @@ public class FederationServlet extends HttpServlet {
Element el = fedToken.getLoginToken();
if (el != null) {
- out.println("loginToken=FOUND{FederationPrincipal}<p>");
+ out.println("loginToken=FOUND{FedizPrincipal}<p>");
}
el = SecurityTokenThreadLocal.getToken();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/systests/springPreauthWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
----------------------------------------------------------------------
diff --git a/systests/springPreauthWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java b/systests/springPreauthWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
index dd25100..d23281c 100644
--- a/systests/springPreauthWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
+++ b/systests/springPreauthWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
@@ -34,7 +34,7 @@ import org.w3c.dom.Element;
import org.apache.cxf.fediz.core.Claim;
import org.apache.cxf.fediz.core.ClaimCollection;
-import org.apache.cxf.fediz.core.FederationPrincipal;
+import org.apache.cxf.fediz.core.FedizPrincipal;
import org.apache.cxf.fediz.core.SecurityTokenThreadLocal;
import org.springframework.security.core.Authentication;
@@ -71,8 +71,8 @@ public class FederationServlet extends HttpServlet {
out.println("<p>role:" + item + "=" + ((request.isUserInRole(item)) ? "true" : "false") + "</p>");
}
- if (p instanceof FederationPrincipal) {
- FederationPrincipal fp = (FederationPrincipal)p;
+ if (p instanceof FedizPrincipal) {
+ FedizPrincipal fp = (FedizPrincipal)p;
ClaimCollection claims = fp.getClaims();
for (Claim c : claims) {
@@ -81,7 +81,7 @@ public class FederationServlet extends HttpServlet {
Element el = fp.getLoginToken();
if (el != null) {
- out.println("loginToken=FOUND{FederationPrincipal}<p>");
+ out.println("loginToken=FOUND{FedizPrincipal}<p>");
}
el = SecurityTokenThreadLocal.getToken();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/systests/springWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
----------------------------------------------------------------------
diff --git a/systests/springWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java b/systests/springWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
index 740e14c..df0ce26 100644
--- a/systests/springWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
+++ b/systests/springWebapp/src/main/java/org/apache/cxf/fediz/example/FederationServlet.java
@@ -91,7 +91,7 @@ public class FederationServlet extends HttpServlet {
Element el = fedToken.getLoginToken();
if (el != null) {
- out.println("loginToken=FOUND{FederationPrincipal}<p>");
+ out.println("loginToken=FOUND{FedizPrincipal}<p>");
}
el = SecurityTokenThreadLocal.getToken();
[4/4] git commit: [FEDIZ-7] - Largish refactor of Fediz code to
accomadate other protocols
Posted by co...@apache.org.
[FEDIZ-7] - Largish refactor of Fediz code to accomadate other protocols
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/08af52b6
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/08af52b6
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/08af52b6
Branch: refs/heads/master
Commit: 08af52b6f97621e96a44497345b7cd86c58bf14c
Parents: 9260c9e
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Thu Jun 19 17:30:19 2014 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Thu Jun 19 17:30:19 2014 +0100
----------------------------------------------------------------------
.../cxf/fediz/core/FederationPrincipal.java | 11 +-
.../cxf/fediz/core/FederationProcessor.java | 38 --
.../cxf/fediz/core/FederationProcessorImpl.java | 677 ------------------
.../cxf/fediz/core/FederationRequest.java | 62 --
.../cxf/fediz/core/FederationResponse.java | 107 ---
.../apache/cxf/fediz/core/FedizPrincipal.java | 32 +
.../apache/cxf/fediz/core/TokenValidator.java | 4 +-
.../core/config/FederationConfigurator.java | 115 ----
.../fediz/core/config/FederationContext.java | 391 -----------
.../fediz/core/config/FederationProtocol.java | 84 +--
.../fediz/core/config/FedizConfigurator.java | 115 ++++
.../cxf/fediz/core/config/FedizContext.java | 397 +++++++++++
.../apache/cxf/fediz/core/config/Protocol.java | 77 +++
.../cxf/fediz/core/config/SAMLProtocol.java | 61 ++
.../cxf/fediz/core/metadata/MetadataWriter.java | 4 +-
.../core/processor/FederationProcessorImpl.java | 681 +++++++++++++++++++
.../fediz/core/processor/FedizProcessor.java | 38 ++
.../core/processor/FedizProcessorFactory.java | 44 ++
.../cxf/fediz/core/processor/FedizRequest.java | 62 ++
.../cxf/fediz/core/processor/FedizResponse.java | 109 +++
.../fediz/core/processor/SAMLProcessorImpl.java | 648 ++++++++++++++++++
.../cxf/fediz/core/saml/SAMLTokenValidator.java | 17 +-
.../src/main/resources/schemas/FedizConfig.xsd | 23 +-
.../apache/cxf/fediz/core/CustomValidator.java | 4 +-
.../cxf/fediz/core/FederationMetaDataTest.java | 26 +-
.../cxf/fediz/core/FederationProcessorTest.java | 205 +++---
.../fediz/core/SAMLTokenValidatorOldTest.java | 46 +-
.../fediz/core/config/CallbackHandlerTest.java | 8 +-
.../core/config/FedizConfigurationTest.java | 10 +-
.../config/FedizConfigurationWriterTest.java | 8 +-
.../fediz/jetty/FederationAuthenticator.java | 40 +-
.../fediz/jetty/FederationIdentityService.java | 2 +-
.../cxf/fediz/jetty/FederationLoginService.java | 18 +-
.../cxf/fediz/jetty/FederationUserIdentity.java | 7 +-
.../fediz/jetty/FederationUserPrincipal.java | 10 +-
.../cxf/fediz/spring/FederationConfig.java | 9 +-
.../cxf/fediz/spring/FederationConfigImpl.java | 22 +-
.../AbstractFederationUserDetailsService.java | 6 +-
.../FederationAuthenticationProvider.java | 18 +-
.../FederationAuthenticationToken.java | 10 +-
.../FederationResponseAuthenticationToken.java | 8 +-
...AuthoritiesUserDetailsFederationService.java | 4 +-
...erationPreAuthenticatedProcessingFilter.java | 8 +-
...AuthoritiesUserDetailsFederationService.java | 6 +-
.../web/FederationAuthenticationEntryPoint.java | 12 +-
.../web/FederationAuthenticationFilter.java | 4 +-
.../spring/web/FederationLogoutFilter.java | 2 +-
.../web/FederationLogoutSuccessHandler.java | 11 +-
.../cxf/fediz/spring/FederationConfig.java | 9 +-
.../cxf/fediz/spring/FederationConfigImpl.java | 22 +-
.../AbstractFederationUserDetailsService.java | 6 +-
.../FederationAuthenticationProvider.java | 20 +-
.../FederationAuthenticationToken.java | 10 +-
.../FederationResponseAuthenticationToken.java | 8 +-
...AuthoritiesUserDetailsFederationService.java | 4 +-
...erationPreAuthenticatedProcessingFilter.java | 8 +-
...AuthoritiesUserDetailsFederationService.java | 12 +-
.../web/FederationAuthenticationEntryPoint.java | 16 +-
.../web/FederationAuthenticationFilter.java | 5 +-
.../fediz/tomcat/FederationAuthenticator.java | 72 +-
.../fediz/tomcat/FederationPrincipalImpl.java | 2 +-
.../TrustedIdpWSFedProtocolHandler.java | 25 +-
.../cxf/fediz/example/FederationServlet.java | 8 +-
.../cxf/fediz/example/FederationServlet.java | 2 +-
.../cxf/fediz/example/FederationServlet.java | 8 +-
.../cxf/fediz/example/FederationServlet.java | 2 +-
66 files changed, 2672 insertions(+), 1868 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationPrincipal.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationPrincipal.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationPrincipal.java
index 74cd953..e996bc5 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationPrincipal.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationPrincipal.java
@@ -19,14 +19,7 @@
package org.apache.cxf.fediz.core;
-import java.security.Principal;
-
-import org.w3c.dom.Element;
-
-public interface FederationPrincipal extends Principal {
-
- ClaimCollection getClaims();
-
- Element getLoginToken();
+@Deprecated
+public interface FederationPrincipal extends FedizPrincipal {
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessor.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessor.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessor.java
deleted file mode 100644
index 5948452..0000000
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessor.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.core;
-
-import javax.servlet.http.HttpServletRequest;
-import org.w3c.dom.Document;
-import org.apache.cxf.fediz.core.config.FederationContext;
-import org.apache.cxf.fediz.core.exception.ProcessingException;
-
-
-public interface FederationProcessor {
-
- FederationResponse processRequest(FederationRequest request, FederationContext config) throws ProcessingException;
-
- String createSignInRequest(HttpServletRequest request, FederationContext config) throws ProcessingException;
-
- String createSignOutRequest(HttpServletRequest request, FederationContext config) throws ProcessingException;
-
- Document getMetaData(FederationContext config) throws ProcessingException;
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessorImpl.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessorImpl.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessorImpl.java
deleted file mode 100644
index d181b2f..0000000
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationProcessorImpl.java
+++ /dev/null
@@ -1,677 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.core;
-
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.net.URLEncoder;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-
-import javax.security.auth.callback.Callback;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import javax.servlet.http.HttpServletRequest;
-
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.apache.cxf.fediz.core.config.FederationContext;
-import org.apache.cxf.fediz.core.config.FederationProtocol;
-import org.apache.cxf.fediz.core.config.KeyManager;
-import org.apache.cxf.fediz.core.exception.ProcessingException;
-import org.apache.cxf.fediz.core.exception.ProcessingException.TYPE;
-import org.apache.cxf.fediz.core.metadata.MetadataWriter;
-import org.apache.cxf.fediz.core.spi.FreshnessCallback;
-import org.apache.cxf.fediz.core.spi.HomeRealmCallback;
-import org.apache.cxf.fediz.core.spi.IDPCallback;
-import org.apache.cxf.fediz.core.spi.RealmCallback;
-import org.apache.cxf.fediz.core.spi.SignInQueryCallback;
-import org.apache.cxf.fediz.core.spi.WAuthCallback;
-import org.apache.cxf.fediz.core.spi.WReqCallback;
-import org.apache.cxf.fediz.core.util.DOMUtils;
-import org.apache.wss4j.common.ext.WSPasswordCallback;
-import org.apache.wss4j.common.ext.WSSecurityException;
-import org.apache.wss4j.dom.WSConstants;
-import org.apache.wss4j.dom.WSDataRef;
-import org.apache.wss4j.dom.WSDocInfo;
-import org.apache.wss4j.dom.WSSConfig;
-import org.apache.wss4j.dom.WSSecurityEngine;
-import org.apache.wss4j.dom.WSSecurityEngineResult;
-import org.apache.wss4j.dom.handler.RequestData;
-import org.apache.wss4j.dom.processor.EncryptedDataProcessor;
-import org.apache.wss4j.dom.processor.Processor;
-import org.apache.wss4j.dom.util.XmlSchemaDateFormat;
-import org.joda.time.DateTime;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class FederationProcessorImpl implements FederationProcessor {
-
- private static final Logger LOG = LoggerFactory.getLogger(FederationProcessorImpl.class);
-
- /**
- * Default constructor
- */
- public FederationProcessorImpl() {
- super();
- }
-
- @Override
- public FederationResponse processRequest(FederationRequest request,
- FederationContext config)
- throws ProcessingException {
-
- if (!(config.getProtocol() instanceof FederationProtocol)) {
- LOG.error("Unsupported protocol");
- throw new IllegalStateException("Unsupported protocol");
- }
- FederationResponse response = null;
- if (FederationConstants.ACTION_SIGNIN.equals(request.getWa())) {
- response = this.processSignInRequest(request, config);
- } else {
- LOG.error("Invalid action '" + request.getWa() + "'");
- throw new ProcessingException(TYPE.INVALID_REQUEST);
- }
- return response;
- }
-
-
- public Document getMetaData(FederationContext config) throws ProcessingException {
- return new MetadataWriter().getMetaData(config);
- }
-
- protected FederationResponse processSignInRequest(
- FederationRequest request, FederationContext config)
- throws ProcessingException {
-
- byte[] wresult = request.getWresult().getBytes();
-
- Document doc = null;
- Element el = null;
- try {
- doc = DOMUtils.readXml(new ByteArrayInputStream(wresult));
- el = doc.getDocumentElement();
-
- } catch (Exception e) {
- LOG.warn("Failed to parse wresult: " + e.getMessage());
- throw new ProcessingException(TYPE.INVALID_REQUEST);
- }
-
- if ("RequestSecurityTokenResponseCollection".equals(el.getLocalName())) {
- el = DOMUtils.getFirstElement(el);
- }
- if (!"RequestSecurityTokenResponse".equals(el.getLocalName())) {
- LOG.warn("Unexpected root element of wresult: '" + el.getLocalName() + "'");
- throw new ProcessingException(TYPE.INVALID_REQUEST);
- }
- el = DOMUtils.getFirstElement(el);
- Element rst = null;
- Element lifetimeElem = null;
- String tt = null;
-
- while (el != null) {
- String ln = el.getLocalName();
- if (FederationConstants.WS_TRUST_13_NS.equals(el.getNamespaceURI())
- || FederationConstants.WS_TRUST_2005_02_NS.equals(el.getNamespaceURI())) {
- if ("Lifetime".equals(ln)) {
- lifetimeElem = el;
- } else if ("RequestedSecurityToken".equals(ln)) {
- rst = DOMUtils.getFirstElement(el);
- } else if ("TokenType".equals(ln)) {
- tt = DOMUtils.getContent(el);
- }
- }
- el = DOMUtils.getNextElement(el);
- }
- if (LOG.isDebugEnabled()) {
- LOG.debug("RST: " + ((rst != null) ? rst.toString() : "null"));
- LOG.debug("Lifetime: "
- + ((lifetimeElem != null) ? lifetimeElem.toString()
- : "null"));
- LOG.debug("Tokentype: " + ((tt != null) ? tt.toString() : "null"));
- }
- if (rst == null) {
- LOG.warn("RequestedSecurityToken element not found in wresult");
- throw new ProcessingException(TYPE.BAD_REQUEST);
- }
- LifeTime lifeTime = null;
- if (lifetimeElem != null) {
- lifeTime = processLifeTime(lifetimeElem);
- }
-
- if (config.isDetectExpiredTokens() && lifeTime != null) {
- Date currentDate = new Date();
- if (currentDate.after(lifeTime.getExpires())) {
- LOG.warn("RSTR Lifetime expired");
- throw new ProcessingException(TYPE.TOKEN_EXPIRED);
- }
- DateTime currentTime = new DateTime();
- DateTime validFrom = new DateTime(lifeTime.created);
- currentTime = currentTime.plusSeconds(config.getMaximumClockSkew().intValue());
- if (validFrom.isAfter(currentTime)) {
- LOG.debug("RSTR Lifetime not yet valid");
- throw new ProcessingException(TYPE.TOKEN_INVALID);
- }
- }
-
- // Check to see if RST is encrypted
- if ("EncryptedData".equals(rst.getLocalName())
- && WSConstants.ENC_NS.equals(rst.getNamespaceURI())) {
- Element decryptedRST = decryptEncryptedRST(rst, config);
- if (decryptedRST != null) {
- rst = decryptedRST;
- }
- }
-
- TokenValidatorResponse validatorResponse = null;
- List<TokenValidator> validators = ((FederationProtocol)config.getProtocol()).getTokenValidators();
- for (TokenValidator validator : validators) {
- boolean canHandle = false;
- if (tt != null) {
- canHandle = validator.canHandleTokenType(tt);
- } else {
- canHandle = validator.canHandleToken(rst);
- }
- if (canHandle) {
- try {
- TokenValidatorRequest validatorRequest =
- new TokenValidatorRequest(rst, request.getCerts());
- validatorResponse = validator.validateAndProcessToken(validatorRequest, config);
- } catch (ProcessingException ex) {
- throw ex;
- } catch (Exception ex) {
- LOG.warn("Failed to validate token", ex);
- throw new ProcessingException(TYPE.TOKEN_INVALID);
- }
- break;
- } else {
- LOG.warn("No security token validator found for '" + tt + "'");
- throw new ProcessingException(TYPE.BAD_REQUEST);
- }
- }
-
- // Check whether token already used for signin
- if (validatorResponse.getUniqueTokenId() != null
- && config.isDetectReplayedTokens()) {
- // Check whether token has already been processed once, prevent
- // replay attack
- if (!config.getTokenReplayCache().contains(validatorResponse.getUniqueTokenId())) {
- // not cached
- Date expires = null;
- if (lifeTime != null && lifeTime.getExpires() != null) {
- expires = lifeTime.getExpires();
- } else {
- expires = validatorResponse.getExpires();
- }
- if (expires != null) {
- Date currentTime = new Date();
- long ttl = expires.getTime() - currentTime.getTime();
- config.getTokenReplayCache().add(validatorResponse.getUniqueTokenId(), ttl / 1000L);
- } else {
- config.getTokenReplayCache().add(validatorResponse.getUniqueTokenId());
- }
- } else {
- LOG.error("Replay attack with token id: " + validatorResponse.getUniqueTokenId());
- throw new ProcessingException("Replay attack with token id: "
- + validatorResponse.getUniqueTokenId(), TYPE.TOKEN_REPLAY);
- }
- }
-
- FederationResponse fedResponse = new FederationResponse(
- validatorResponse.getUsername(), validatorResponse.getIssuer(),
- validatorResponse.getRoles(), validatorResponse.getClaims(),
- validatorResponse.getAudience(),
- (lifeTime != null) ? lifeTime.getCreated() : null,
- (lifeTime != null) ? lifeTime.getExpires() : null, rst,
- validatorResponse.getUniqueTokenId());
-
- return fedResponse;
- }
-
- private Element decryptEncryptedRST(
- Element encryptedRST,
- FederationContext config
- ) throws ProcessingException {
-
- KeyManager decryptionKeyManager = config.getDecryptionKey();
- if (decryptionKeyManager == null || decryptionKeyManager.getCrypto() == null) {
- LOG.debug(
- "We must have a decryption Crypto instance configured to decrypt encrypted tokens"
- );
- throw new ProcessingException(TYPE.BAD_REQUEST);
- }
- String keyPassword = decryptionKeyManager.getKeyPassword();
- if (keyPassword == null) {
- LOG.debug(
- "We must have a decryption key password to decrypt encrypted tokens"
- );
- throw new ProcessingException(TYPE.BAD_REQUEST);
- }
-
- EncryptedDataProcessor proc = new EncryptedDataProcessor();
- WSDocInfo docInfo = new WSDocInfo(encryptedRST.getOwnerDocument());
- RequestData data = new RequestData();
-
- // Disable WSS4J processing of the (decrypted) SAML Token
- WSSConfig wssConfig = WSSConfig.getNewInstance();
- wssConfig.setProcessor(WSSecurityEngine.SAML_TOKEN, new NOOpProcessor());
- wssConfig.setProcessor(WSSecurityEngine.SAML2_TOKEN, new NOOpProcessor());
- data.setWssConfig(wssConfig);
-
- data.setDecCrypto(decryptionKeyManager.getCrypto());
- data.setCallbackHandler(new DecryptionCallbackHandler(keyPassword));
- try {
- List<WSSecurityEngineResult> result =
- proc.handleToken(encryptedRST, data, docInfo);
- if (result.size() > 0) {
- @SuppressWarnings("unchecked")
- List<WSDataRef> dataRefs =
- (List<WSDataRef>)result.get(result.size() - 1).get(WSSecurityEngineResult.TAG_DATA_REF_URIS);
- if (dataRefs != null && dataRefs.size() > 0) {
- return dataRefs.get(0).getProtectedElement();
- }
- }
- } catch (WSSecurityException e) {
- LOG.debug(e.getMessage(), e);
- throw new ProcessingException(TYPE.TOKEN_INVALID);
- }
- return null;
- }
-
- private LifeTime processLifeTime(Element lifetimeElem) throws ProcessingException {
- try {
- Element createdElem = DOMUtils.getFirstChildWithName(lifetimeElem,
- WSConstants.WSU_NS, WSConstants.CREATED_LN);
- DateFormat zulu = new XmlSchemaDateFormat();
-
- Date created = zulu.parse(DOMUtils.getContent(createdElem));
-
- Element expiresElem = DOMUtils.getFirstChildWithName(lifetimeElem,
- WSConstants.WSU_NS, WSConstants.EXPIRES_LN);
- Date expires = zulu.parse(DOMUtils.getContent(expiresElem));
-
- return new LifeTime(created, expires);
-
- } catch (ParseException e) {
- LOG.error("Failed to parse lifetime element in wresult: " + e.getMessage());
- throw new ProcessingException(TYPE.BAD_REQUEST);
- }
- }
-
- public class LifeTime {
-
- private Date created;
- private Date expires;
-
- public LifeTime(Date created, Date expires) {
- this.created = created;
- this.expires = expires;
- }
-
- public Date getCreated() {
- return created;
- }
-
- public Date getExpires() {
- return expires;
- }
-
- }
-
- @Override
- public String createSignInRequest(HttpServletRequest request, FederationContext config)
- throws ProcessingException {
-
- String redirectURL = null;
- try {
- if (!(config.getProtocol() instanceof FederationProtocol)) {
- LOG.error("Unsupported protocol");
- throw new IllegalStateException("Unsupported protocol");
- }
-
- String issuerURL = resolveIssuer(request, config);
- LOG.info("Issuer url: " + issuerURL);
- if (issuerURL != null && issuerURL.length() > 0) {
- redirectURL = issuerURL;
- }
-
- String wAuth = resolveAuthenticationType(request, config);
- LOG.info("WAuth: " + wAuth);
-
- String wReq = resolveRequest(request, config);
- LOG.info("WReq: " + wReq);
-
- String homeRealm = resolveHomeRealm(request, config);
- LOG.info("HomeRealm: " + homeRealm);
-
- String freshness = resolveFreshness(request, config);
- LOG.info("Freshness: " + freshness);
-
- String signInQuery = resolveSignInQuery(request, config);
- LOG.info("SignIn Query: " + signInQuery);
-
-
- StringBuilder sb = new StringBuilder();
- sb.append(FederationConstants.PARAM_ACTION).append('=').append(FederationConstants.ACTION_SIGNIN);
-
- String reply = ((FederationProtocol)config.getProtocol()).getReply();
- if (reply == null || reply.length() == 0) {
- reply = request.getRequestURL().toString();
- } else {
- try {
- new URL(reply);
- } catch (MalformedURLException ex) {
- if (reply.startsWith("/")) {
- reply = extractFullContextPath(request).concat(reply.substring(1));
- } else {
- reply = extractFullContextPath(request).concat(reply);
- }
- }
- }
-
- LOG.debug("wreply=" + reply);
- sb.append('&').append(FederationConstants.PARAM_REPLY).append('=');
- sb.append(URLEncoder.encode(reply, "UTF-8"));
-
- String realm = resolveWTRealm(request, config);
- LOG.debug("wtrealm=" + realm);
-
- //add wtrealm parameter
- sb.append('&').append(FederationConstants.PARAM_TREALM).append('=')
- .append(URLEncoder.encode(realm, "UTF-8"));
-
- // add authentication type parameter wauth if set
- if (wAuth != null && wAuth.length() > 0) {
- sb.append('&').append(FederationConstants.PARAM_AUTH_TYPE).append('=')
- .append(URLEncoder.encode(wAuth, "UTF-8"));
- }
-
- // add tokenRequest parameter wreq if set
- if (wReq != null && wReq.length() > 0) {
- sb.append('&').append(FederationConstants.PARAM_REQUEST).append('=')
- .append(URLEncoder.encode(wReq, "UTF-8"));
- }
-
- // add home realm parameter whr if set
- if (homeRealm != null && homeRealm.length() > 0) {
- sb.append('&').append(FederationConstants.PARAM_HOME_REALM).append('=')
- .append(URLEncoder.encode(homeRealm, "UTF-8"));
- }
-
- // add freshness parameter wfresh if set
- if (freshness != null && freshness.length() > 0) {
- sb.append('&').append(FederationConstants.PARAM_FRESHNESS).append('=')
- .append(URLEncoder.encode(freshness, "UTF-8"));
- }
-
- // add current time parameter wct
- Date creationTime = new Date();
- XmlSchemaDateFormat fmt = new XmlSchemaDateFormat();
- String wct = fmt.format(creationTime);
- sb.append('&').append(FederationConstants.PARAM_CURRENT_TIME).append('=')
- .append(URLEncoder.encode(wct, "UTF-8"));
-
- // add signin query extensions
- if (signInQuery != null && signInQuery.length() > 0) {
- sb.append('&').append(signInQuery);
- }
-
- redirectURL = redirectURL + "?" + sb.toString();
- } catch (Exception ex) {
- LOG.error("Failed to create SignInRequest", ex);
- throw new ProcessingException("Failed to create SignInRequest");
- }
- return redirectURL;
- }
-
- @Override
- public String createSignOutRequest(HttpServletRequest request, FederationContext config)
- throws ProcessingException {
-
- String redirectURL = null;
- try {
- if (!(config.getProtocol() instanceof FederationProtocol)) {
- LOG.error("Unsupported protocol");
- throw new IllegalStateException("Unsupported protocol");
- }
-
- String issuerURL = resolveIssuer(request, config);
- LOG.info("Issuer url: " + issuerURL);
- if (issuerURL != null && issuerURL.length() > 0) {
- redirectURL = issuerURL;
- }
-
- StringBuilder sb = new StringBuilder();
- sb.append(FederationConstants.PARAM_ACTION).append('=').append(FederationConstants.ACTION_SIGNOUT);
-
- String logoutRedirectTo = config.getLogoutRedirectTo();
- if (logoutRedirectTo != null && !logoutRedirectTo.isEmpty()) {
-
- if (logoutRedirectTo.startsWith("/")) {
- logoutRedirectTo = extractFullContextPath(request).concat(logoutRedirectTo.substring(1));
- } else {
- logoutRedirectTo = extractFullContextPath(request).concat(logoutRedirectTo);
- }
-
- LOG.debug("wreply=" + logoutRedirectTo);
-
- sb.append('&').append(FederationConstants.PARAM_REPLY).append('=');
- sb.append(URLEncoder.encode(logoutRedirectTo, "UTF-8"));
- }
-
- redirectURL = redirectURL + "?" + sb.toString();
- } catch (Exception ex) {
- LOG.error("Failed to create SignInRequest", ex);
- throw new ProcessingException("Failed to create SignInRequest");
- }
- return redirectURL;
- }
-
- private String resolveSignInQuery(HttpServletRequest request, FederationContext config)
- throws IOException, UnsupportedCallbackException, UnsupportedEncodingException {
- Object signInQueryObj = ((FederationProtocol)config.getProtocol()).getSignInQuery();
- String signInQuery = null;
- if (signInQueryObj != null) {
- if (signInQueryObj instanceof String) {
- signInQuery = (String)signInQueryObj;
- } else if (signInQueryObj instanceof CallbackHandler) {
- CallbackHandler frCB = (CallbackHandler)signInQueryObj;
- SignInQueryCallback callback = new SignInQueryCallback(request);
- frCB.handle(new Callback[] {callback});
- Map<String, String> signInQueryMap = callback.getSignInQueryParamMap();
- StringBuilder sbQuery = new StringBuilder();
- for (String key : signInQueryMap.keySet()) {
- if (sbQuery.length() > 0) {
- sbQuery.append("&");
- }
- sbQuery.append(key).append('=').
- append(URLEncoder.encode(signInQueryMap.get(key), "UTF-8"));
- }
- signInQuery = sbQuery.toString();
-
- }
- }
- return signInQuery;
- }
-
- private String resolveFreshness(HttpServletRequest request, FederationContext config) throws IOException,
- UnsupportedCallbackException {
- Object freshnessObj = ((FederationProtocol)config.getProtocol()).getFreshness();
- String freshness = null;
- if (freshnessObj != null) {
- if (freshnessObj instanceof String) {
- freshness = (String)freshnessObj;
- } else if (freshnessObj instanceof CallbackHandler) {
- CallbackHandler frCB = (CallbackHandler)freshnessObj;
- FreshnessCallback callback = new FreshnessCallback(request);
- frCB.handle(new Callback[] {callback});
- freshness = callback.getFreshness();
- }
- }
- return freshness;
- }
-
- private String resolveHomeRealm(HttpServletRequest request, FederationContext config) throws IOException,
- UnsupportedCallbackException {
- Object homeRealmObj = ((FederationProtocol)config.getProtocol()).getHomeRealm();
- String homeRealm = null;
- if (homeRealmObj != null) {
- if (homeRealmObj instanceof String) {
- homeRealm = (String)homeRealmObj;
- } else if (homeRealmObj instanceof CallbackHandler) {
- CallbackHandler hrCB = (CallbackHandler)homeRealmObj;
- HomeRealmCallback callback = new HomeRealmCallback(request);
- hrCB.handle(new Callback[] {callback});
- homeRealm = callback.getHomeRealm();
- }
- }
- return homeRealm;
- }
-
- private String resolveAuthenticationType(HttpServletRequest request, FederationContext config)
- throws IOException, UnsupportedCallbackException {
- Object wAuthObj = ((FederationProtocol)config.getProtocol()).getAuthenticationType();
- String wAuth = null;
- if (wAuthObj != null) {
- if (wAuthObj instanceof String) {
- wAuth = (String)wAuthObj;
- } else if (wAuthObj instanceof CallbackHandler) {
- CallbackHandler wauthCB = (CallbackHandler)wAuthObj;
- WAuthCallback callback = new WAuthCallback(request);
- wauthCB.handle(new Callback[] {callback});
- wAuth = callback.getWauth();
- }
- }
- return wAuth;
- }
-
- private String resolveRequest(HttpServletRequest request, FederationContext config)
- throws IOException, UnsupportedCallbackException {
- Object wReqObj = ((FederationProtocol)config.getProtocol()).getRequest();
- String wReq = null;
- if (wReqObj != null) {
- if (wReqObj instanceof String) {
- wReq = (String)wReqObj;
- } else if (wReqObj instanceof CallbackHandler) {
- CallbackHandler wauthCB = (CallbackHandler)wReqObj;
- WReqCallback callback = new WReqCallback(request);
- wauthCB.handle(new Callback[] {callback});
- wReq = callback.getWreq();
- }
- }
- return wReq;
- }
-
- private String resolveIssuer(HttpServletRequest request, FederationContext config) throws IOException,
- UnsupportedCallbackException {
- Object issuerObj = ((FederationProtocol)config.getProtocol()).getIssuer();
- String issuerURL = null;
- if (issuerObj instanceof String) {
- issuerURL = (String)issuerObj;
- } else if (issuerObj instanceof CallbackHandler) {
- CallbackHandler issuerCB = (CallbackHandler)issuerObj;
- IDPCallback callback = new IDPCallback(request);
- issuerCB.handle(new Callback[] {callback});
- issuerURL = callback.getIssuerUrl().toString();
- }
- return issuerURL;
- }
-
- private String resolveWTRealm(HttpServletRequest request, FederationContext config) throws IOException,
- UnsupportedCallbackException {
- Object wtRealmObj = ((FederationProtocol)config.getProtocol()).getRealm();
- String wtRealm = null;
- if (wtRealmObj != null) {
- if (wtRealmObj instanceof String) {
- wtRealm = (String)wtRealmObj;
- } else if (wtRealmObj instanceof CallbackHandler) {
- CallbackHandler hrCB = (CallbackHandler)wtRealmObj;
- RealmCallback callback = new RealmCallback(request);
- hrCB.handle(new Callback[] {callback});
- wtRealm = callback.getRealm();
- }
- } else {
- wtRealm = extractFullContextPath(request); //default value
- }
- return wtRealm;
- }
-
-
- private String extractFullContextPath(HttpServletRequest request) throws MalformedURLException {
- String result = null;
- String contextPath = request.getContextPath();
- String requestUrl = request.getRequestURL().toString();
- String requestPath = new URL(requestUrl).getPath();
- // Cut request path of request url and add context path if not ROOT
- if (requestPath != null && requestPath.length() > 0) {
- int lastIndex = requestUrl.lastIndexOf(requestPath);
- result = requestUrl.substring(0, lastIndex);
- } else {
- result = requestUrl;
- }
- if (contextPath != null && contextPath.length() > 0) {
- // contextPath contains starting slash
- result = result + contextPath + "/";
- } else {
- result = result + "/";
- }
- return result;
- }
-
- private static class DecryptionCallbackHandler implements CallbackHandler {
-
- private final String password;
-
- public DecryptionCallbackHandler(String password) {
- this.password = password;
- }
-
- @Override
- public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
- for (int i = 0; i < callbacks.length; i++) {
- if (callbacks[i] instanceof WSPasswordCallback) {
- WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
- pc.setPassword(password);
- } else {
- throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback");
- }
- }
- }
-
- }
-
- private static class NOOpProcessor implements Processor {
-
- @Override
- public List<WSSecurityEngineResult> handleToken(Element arg0, RequestData arg1, WSDocInfo arg2)
- throws WSSecurityException {
- return new ArrayList<WSSecurityEngineResult>();
- }
-
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationRequest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationRequest.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationRequest.java
deleted file mode 100644
index 0b2d4d5..0000000
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationRequest.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.core;
-
-import java.io.Serializable;
-import java.security.cert.Certificate;
-
-public class FederationRequest implements Serializable {
-
- private static final long serialVersionUID = 1L;
-
- private String wa;
- private String wresult;
- private String wct;
- private Certificate[] certs;
-
-
- public String getWct() {
- return wct;
- }
- public void setWct(String wct) {
- this.wct = wct;
- }
-
- public String getWa() {
- return wa;
- }
- public void setWa(String wa) {
- this.wa = wa;
- }
- public String getWresult() {
- return wresult;
- }
- public void setWresult(String wresult) {
- this.wresult = wresult;
- }
- public Certificate[] getCerts() {
- return certs;
- }
- public void setCerts(Certificate[] certs) {
- this.certs = certs;
- }
-
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationResponse.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationResponse.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationResponse.java
deleted file mode 100644
index 758fbab..0000000
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FederationResponse.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.core;
-
-import java.io.Serializable;
-import java.util.Collections;
-import java.util.Date;
-import java.util.List;
-
-import org.w3c.dom.Element;
-
-public class FederationResponse implements Serializable {
-
- private static final long serialVersionUID = 1L;
-
- private String audience;
- private String username;
- private List<String> roles;
- private String issuer;
- private List<Claim> claims;
- private Element token;
- private String uniqueTokenId;
-
- /**
- * Created time
- */
- private Date tokenCreated;
-
- /**
- * Expiration time
- */
- private Date tokenExpires;
-
- //CHECKSTYLE:OFF
- public FederationResponse(String username, String issuer, List<String> roles, List<Claim> claims, String audience, Date created, Date expires, Element token, String uniqueTokenId) {
- this.username = username;
- this.issuer = issuer;
- this.roles = roles;
- this.claims = claims;
- this.audience = audience;
- this.tokenCreated = created;
- this.tokenExpires = expires;
- this.token = token;
- this.uniqueTokenId = uniqueTokenId;
- }
-
- public String getUniqueTokenId() {
- return uniqueTokenId;
- }
-
- public String getAudience() {
- return audience;
- }
-
- public String getUsername() {
- return username;
- }
-
- public List<String> getRoles() {
- if (roles == null) {
- return null;
- }
- return Collections.unmodifiableList(roles);
- }
-
- public String getIssuer() {
- return issuer;
- }
-
- public List<Claim> getClaims() {
- if (claims == null) {
- return null;
- }
- return Collections.unmodifiableList(claims);
- }
-
- public Date getTokenCreated() {
- return tokenCreated;
- }
-
- public Date getTokenExpires() {
- return tokenExpires;
- }
-
- public Element getToken() {
- return token;
- }
-
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/FedizPrincipal.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/FedizPrincipal.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FedizPrincipal.java
new file mode 100644
index 0000000..4a2c63e
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/FedizPrincipal.java
@@ -0,0 +1,32 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core;
+
+import java.security.Principal;
+
+import org.w3c.dom.Element;
+
+public interface FedizPrincipal extends Principal {
+
+ ClaimCollection getClaims();
+
+ Element getLoginToken();
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidator.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidator.java
index 7280029..f05a45b 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidator.java
@@ -20,7 +20,7 @@
package org.apache.cxf.fediz.core;
import org.w3c.dom.Element;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
public interface TokenValidator {
@@ -45,6 +45,6 @@ public interface TokenValidator {
*/
TokenValidatorResponse validateAndProcessToken(
TokenValidatorRequest request,
- FederationContext config
+ FedizContext config
) throws ProcessingException;
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationConfigurator.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationConfigurator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationConfigurator.java
deleted file mode 100644
index b03fdc1..0000000
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationConfigurator.java
+++ /dev/null
@@ -1,115 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.core.config;
-
-import java.io.File;
-import java.io.Reader;
-import java.io.Writer;
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBException;
-
-import org.apache.cxf.fediz.core.config.jaxb.ContextConfig;
-import org.apache.cxf.fediz.core.config.jaxb.FedizConfig;
-
-public class FederationConfigurator {
-
- private FedizConfig rootConfig;
-
- private JAXBContext jaxbContext;
-
- private List<FederationContext> federationContextList;
-
- public FedizConfig loadConfig(File f) throws JAXBException {
- rootConfig = (FedizConfig) getJaxbContext().createUnmarshaller().unmarshal(f);
- parseFederationContextList();
- return rootConfig;
- }
-
- public FedizConfig loadConfig(Reader reader) throws JAXBException {
- rootConfig = (FedizConfig) getJaxbContext().createUnmarshaller().unmarshal(reader);
- parseFederationContextList();
- return rootConfig;
- }
-
- private void parseFederationContextList() {
- federationContextList = new ArrayList<FederationContext>();
- for (ContextConfig config : rootConfig.getContextConfig()) {
- federationContextList.add(new FederationContext(config));
- }
- }
-
- public void saveConfiguration(File f) throws JAXBException {
- if (f.canWrite()) {
- jaxbContext.createMarshaller().marshal(rootConfig, f);
- }
- }
-
- public void saveConfiguration(Writer writer) throws JAXBException {
- jaxbContext.createMarshaller().marshal(rootConfig, writer);
- }
-
- private JAXBContext getJaxbContext() throws JAXBException {
- if (jaxbContext == null) {
- jaxbContext = JAXBContext.newInstance(FedizConfig.class);
- }
- return jaxbContext;
- }
-
- public List<FederationContext> getFederationContextList() {
- return federationContextList;
- }
-
- public FederationContext getFederationContext(String contextName) {
- if (contextName == null || contextName.isEmpty()) {
- throw new IllegalArgumentException("Invalid Context Name '" + contextName + "'");
- }
- if (rootConfig == null) {
- throw new IllegalArgumentException("No configuration loaded");
- }
- for (FederationContext fedContext : federationContextList) {
- if (fedContext.getName().equals(contextName)) {
- fedContext.init();
- return fedContext;
- }
- }
-
- return null;
- }
-
- public ContextConfig getContextConfig(String contextName) throws IllegalArgumentException {
- if (contextName == null || contextName.isEmpty()) {
- throw new IllegalArgumentException("Invalid Context Name '" + contextName + "'");
- }
- if (rootConfig == null) {
- throw new IllegalArgumentException("No configuration loaded");
- }
-
- for (ContextConfig config : rootConfig.getContextConfig()) {
- if (contextName.equals(config.getName())) {
- return config;
- }
- }
- return null;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationContext.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationContext.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationContext.java
deleted file mode 100644
index b86d60e..0000000
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationContext.java
+++ /dev/null
@@ -1,391 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-package org.apache.cxf.fediz.core.config;
-
-import java.io.BufferedInputStream;
-import java.io.Closeable;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.math.BigInteger;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateFactory;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Properties;
-
-import org.apache.cxf.fediz.core.config.jaxb.CertificateStores;
-import org.apache.cxf.fediz.core.config.jaxb.ContextConfig;
-import org.apache.cxf.fediz.core.config.jaxb.FederationProtocolType;
-import org.apache.cxf.fediz.core.config.jaxb.KeyManagersType;
-import org.apache.cxf.fediz.core.config.jaxb.KeyStoreType;
-import org.apache.cxf.fediz.core.config.jaxb.ProtocolType;
-import org.apache.cxf.fediz.core.config.jaxb.TrustManagersType;
-import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuerType;
-import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuers;
-import org.apache.cxf.fediz.core.exception.IllegalConfigurationException;
-import org.apache.wss4j.common.cache.ReplayCache;
-import org.apache.wss4j.common.cache.ReplayCacheFactory;
-import org.apache.wss4j.common.crypto.CertificateStore;
-import org.apache.wss4j.common.crypto.Crypto;
-import org.apache.wss4j.common.crypto.CryptoFactory;
-import org.apache.wss4j.common.crypto.Merlin;
-import org.apache.wss4j.common.ext.WSSecurityException;
-import org.apache.wss4j.common.util.Loader;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class FederationContext implements Closeable {
-
- public static final String CACHE_KEY_PREFIX = "fediz.replay.cache";
-
- private static final Logger LOG = LoggerFactory.getLogger(FederationContext.class);
-
- private ContextConfig config;
-
- private boolean detectExpiredTokens = true;
- private boolean detectReplayedTokens = true;
- private String relativePath;
- private ReplayCache replayCache;
- private FederationProtocol protocol;
- private List<TrustManager> certificateStores;
- private KeyManager keyManager;
- private KeyManager decryptionKeyManager;
- private ClassLoader classloader;
-
-
- public FederationContext(ContextConfig config) {
- this.config = config;
-
- }
-
- public void init() {
- //get validators initialized
- getProtocol();
- }
-
- public List<String> getAudienceUris() {
- return config.getAudienceUris().getAudienceItem();
- }
-
- public List<TrustedIssuer> getTrustedIssuers() {
- TrustedIssuers issuers = config.getTrustedIssuers();
- List<TrustedIssuerType> trustManagers = issuers.getIssuer();
- List<TrustedIssuer> trustedIssuers = new ArrayList<TrustedIssuer>();
- for (TrustedIssuerType manager:trustManagers) {
- trustedIssuers.add(new TrustedIssuer(manager));
- }
- return trustedIssuers;
- }
-
- public List<TrustManager> getCertificateStores() {
- if (certificateStores != null) {
- return certificateStores;
- }
- certificateStores = new ArrayList<TrustManager>();
- CertificateStores certStores = config.getCertificateStores();
- List<TrustManagersType> trustManagers = certStores.getTrustManager();
- for (TrustManagersType manager:trustManagers) {
- TrustManager tm = new TrustManager(manager);
-
- Crypto crypto = null;
- try {
- if (manager.getKeyStore().getType().equalsIgnoreCase("PEM")) {
- X509Certificate[] certificates = new X509Certificate[1];
- certificates[0] = readX509Certificate(tm.getName());
- crypto = new CertificateStore(certificates);
- } else {
- Properties sigProperties = createCryptoProperties(manager);
- crypto = CryptoFactory.getInstance(sigProperties);
- }
- tm.setCrypto(crypto);
- certificateStores.add(tm);
- } catch (WSSecurityException e) {
- LOG.error("Failed to load keystore '" + tm.getName() + "'", e);
- throw new IllegalConfigurationException("Failed to load keystore '" + tm.getName() + "'");
- }
- }
- return certificateStores;
- }
-
- public BigInteger getMaximumClockSkew() {
- if (config.getMaximumClockSkew() == null) {
- return BigInteger.valueOf(5L);
- } else {
- return config.getMaximumClockSkew();
- }
- }
-
- public void setMaximumClockSkew(BigInteger maximumClockSkew) {
- config.setMaximumClockSkew(maximumClockSkew);
- }
-
- // public TrustManager getServiceCertificate() {
- // return new TrustManager(config.getServiceCertificate());
- // }
-
- public Protocol getProtocol() {
- if (protocol != null) {
- return protocol;
- }
- ProtocolType type = config.getProtocol();
- if (type instanceof FederationProtocolType) {
- protocol = new FederationProtocol(type);
- protocol.setClassloader(getClassloader());
- }
- return protocol;
- }
-
- public String getLogoutURL() {
- return config.getLogoutURL();
- }
-
- public String getLogoutRedirectTo() {
- return config.getLogoutRedirectTo();
- }
-
-
- public KeyManager getSigningKey() {
- //return new KeyManager(config.getSigningKey());
-
- if (keyManager != null) {
- return keyManager;
- }
- keyManager = new KeyManager(config.getSigningKey());
- Properties sigProperties = createCryptoProperties(config.getSigningKey());
- Crypto crypto;
- try {
- crypto = CryptoFactory.getInstance(sigProperties);
- keyManager.setCrypto(crypto);
- } catch (WSSecurityException e) {
- keyManager = null;
- LOG.error("Failed to load keystore '" + keyManager.getName() + "'", e);
- throw new IllegalConfigurationException("Failed to load keystore '" + keyManager.getName() + "'");
- }
-
- return keyManager;
-
- }
-
- public KeyManager getDecryptionKey() {
- if (decryptionKeyManager != null) {
- return decryptionKeyManager;
- }
- decryptionKeyManager = new KeyManager(config.getTokenDecryptionKey());
- Properties decProperties = createCryptoProperties(config.getTokenDecryptionKey());
- Crypto crypto;
- try {
- crypto = CryptoFactory.getInstance(decProperties);
- decryptionKeyManager.setCrypto(crypto);
- } catch (WSSecurityException e) {
- decryptionKeyManager = null;
- LOG.error("Failed to load keystore '" + decryptionKeyManager.getName() + "'", e);
- throw new IllegalConfigurationException("Failed to load keystore '" + decryptionKeyManager.getName() + "'");
- }
-
- return decryptionKeyManager;
-
- }
-
- public ReplayCache getTokenReplayCache() {
- if (replayCache != null) {
- return replayCache;
- }
- String replayCacheString = config.getTokenReplayCache();
- String cacheKey = CACHE_KEY_PREFIX + "-" + config.getName();
- ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
- if (replayCacheString == null || "".equals(replayCacheString)) {
- replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
- } else {
- try {
- Class<?> replayCacheClass = Loader.loadClass(replayCacheString);
- replayCache = (ReplayCache) replayCacheClass.newInstance();
- } catch (ClassNotFoundException e) {
- replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
- } catch (InstantiationException e) {
- replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
- } catch (IllegalAccessException e) {
- replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
- }
- }
- return replayCache;
- }
-
- public String getName() {
- return config.getName();
- }
-
-
- public boolean isDetectExpiredTokens() {
- return detectExpiredTokens;
- }
-
- public void setDetectExpiredTokens(boolean detectExpiredTokens) {
- this.detectExpiredTokens = detectExpiredTokens;
- }
-
-
- public boolean isDetectReplayedTokens() {
- return detectReplayedTokens;
- }
-
- public void setDetectReplayedTokens(boolean detectReplayedTokens) {
- this.detectReplayedTokens = detectReplayedTokens;
- }
-
- public void setRelativePath(String relativePath) {
- this.relativePath = relativePath;
- }
-
- public String getRelativePath() {
- return relativePath;
- }
-
- @Override
- public void close() throws IOException {
- if (replayCache != null) {
- replayCache.close();
- }
- }
-
- private Properties createCryptoProperties(TrustManagersType tm) {
- String trustStoreFile = null;
- String trustStorePw = null;
- KeyStoreType ks = tm.getKeyStore();
- if (ks.getFile() != null && !ks.getFile().isEmpty()) {
- trustStoreFile = ks.getFile();
- trustStorePw = ks.getPassword();
- } else {
- throw new IllegalStateException("No certificate store configured");
- }
- File f = new File(trustStoreFile);
- if (!f.exists() && getRelativePath() != null && !getRelativePath().isEmpty()) {
- trustStoreFile = getRelativePath().concat(File.separator + trustStoreFile);
- }
-
- if (trustStoreFile == null || trustStoreFile.isEmpty()) {
- throw new IllegalConfigurationException("truststoreFile not configured");
- }
- if (trustStorePw == null || trustStorePw.isEmpty()) {
- throw new IllegalConfigurationException("trustStorePw not configured");
- }
- Properties p = new Properties();
- p.put("org.apache.ws.security.crypto.provider",
- "org.apache.ws.security.components.crypto.Merlin");
- p.put("org.apache.ws.security.crypto.merlin.keystore.type", "jks");
- p.put("org.apache.ws.security.crypto.merlin.keystore.password",
- trustStorePw);
- p.put("org.apache.ws.security.crypto.merlin.keystore.file",
- trustStoreFile);
- return p;
- }
-
- private Properties createCryptoProperties(KeyManagersType km) {
- String keyStoreFile = null;
- String keyStorePw = null;
- String keyType = "jks";
- KeyStoreType ks = km.getKeyStore();
- if (ks.getFile() != null && !ks.getFile().isEmpty()) {
- keyStoreFile = ks.getFile();
- keyStorePw = ks.getPassword();
- } else {
- throw new IllegalStateException("No certificate store configured");
- }
- File f = new File(keyStoreFile);
- if (!f.exists() && getRelativePath() != null && !getRelativePath().isEmpty()) {
- keyStoreFile = getRelativePath().concat(File.separator + keyStoreFile);
- }
-
- if (keyStoreFile == null || keyStoreFile.isEmpty()) {
- throw new IllegalConfigurationException("truststoreFile not configured");
- }
- if (keyStorePw == null || keyStorePw.isEmpty()) {
- throw new IllegalConfigurationException("trustStorePw not configured");
- }
- if (ks.getType() != null) {
- keyType = ks.getType();
- }
-
- Properties p = new Properties();
- p.put("org.apache.ws.security.crypto.provider",
- "org.apache.ws.security.components.crypto.Merlin");
- p.put("org.apache.ws.security.crypto.merlin.keystore.type", keyType);
- p.put("org.apache.ws.security.crypto.merlin.keystore.password",
- keyStorePw);
- p.put("org.apache.ws.security.crypto.merlin.keystore.file",
- keyStoreFile);
- return p;
- }
-
- private X509Certificate readX509Certificate(String filename) {
- Certificate cert = null;
- BufferedInputStream bis = null;
- try {
- ClassLoader cl = getClassloader();
- if (cl == null) {
- cl = Thread.currentThread().getContextClassLoader();
- }
- InputStream is = Merlin.loadInputStream(cl, filename);
-
- bis = new BufferedInputStream(is);
-
- CertificateFactory cf = CertificateFactory.getInstance("X.509");
-
- if (bis.available() > 0) {
- cert = cf.generateCertificate(bis);
- if (!(cert instanceof X509Certificate)) {
- LOG.error("Certificate " + filename + " is not of type X509Certificate");
- throw new IllegalConfigurationException("Certificate "
- + filename + " is not of type X509Certificate");
- }
- if (bis.available() > 0) {
- LOG.warn("There are more certificates configured in " + filename + ". Only first is parsed");
- }
- return (X509Certificate)cert;
- } else {
- LOG.error("No bytes can be read in certificate file " + filename);
- throw new IllegalConfigurationException("No bytes can be read in certificate file " + filename);
- }
- } catch (IllegalConfigurationException ex) {
- throw ex;
- } catch (Exception ex) {
- LOG.error("Failed to read certificate file " + filename, ex);
- throw new IllegalConfigurationException("Failed to read certificate file " + filename, ex);
- } finally {
- try {
- bis.close();
- } catch (IOException ex) {
- LOG.error("Failed to close certificate file " + filename, ex);
- }
- }
- }
-
- public ClassLoader getClassloader() {
- return classloader;
- }
-
- public void setClassloader(ClassLoader classloader) {
- this.classloader = classloader;
- }
-
-
-
-}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationProtocol.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationProtocol.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationProtocol.java
index e63b5dc..c98bb7b 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationProtocol.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FederationProtocol.java
@@ -25,7 +25,6 @@ import java.util.List;
import javax.security.auth.callback.CallbackHandler;
import org.apache.cxf.fediz.core.TokenValidator;
-import org.apache.cxf.fediz.core.config.jaxb.ArgumentType;
import org.apache.cxf.fediz.core.config.jaxb.CallbackType;
import org.apache.cxf.fediz.core.config.jaxb.ClaimType;
import org.apache.cxf.fediz.core.config.jaxb.ClaimTypesRequested;
@@ -42,14 +41,11 @@ public class FederationProtocol extends Protocol {
private Object request;
private Object authenticationType;
- private Object issuer;
private Object homeRealm;
private Object freshness;
private Object signInQuery;
private Object realm;
private List<TokenValidator> validators = new ArrayList<TokenValidator>();
- private ClassLoader classloader;
-
public FederationProtocol(ProtocolType protocolType) {
super(protocolType);
@@ -59,10 +55,10 @@ public class FederationProtocol extends Protocol {
for (String validatorClassname : fp.getTokenValidators().getValidator()) {
Object obj = null;
try {
- if (this.classloader == null) {
+ if (super.getClassloader() == null) {
obj = ClassLoaderUtils.loadClass(validatorClassname, this.getClass()).newInstance();
} else {
- obj = this.classloader.loadClass(validatorClassname).newInstance();
+ obj = super.getClassloader().loadClass(validatorClassname).newInstance();
}
} catch (Exception ex) {
LOG.error("Failed to instantiate TokenValidator implementation class: '"
@@ -91,10 +87,6 @@ public class FederationProtocol extends Protocol {
super.setProtocolType(federationProtocol);
}
- public int hashCode() {
- return getFederationProtocol().hashCode();
- }
-
public Object getRealm() {
if (this.realm != null) {
return this.realm;
@@ -116,26 +108,6 @@ public class FederationProtocol extends Protocol {
}
}
- public boolean equals(Object obj) {
- return getFederationProtocol().equals(obj);
- }
-
- public String getRoleDelimiter() {
- return getFederationProtocol().getRoleDelimiter();
- }
-
- public void setRoleDelimiter(String value) {
- getFederationProtocol().setRoleDelimiter(value);
- }
-
- public String getRoleURI() {
- return getFederationProtocol().getRoleURI();
- }
-
- public void setRoleURI(String value) {
- getFederationProtocol().setRoleURI(value);
- }
-
public String getApplicationServiceURL() {
return getFederationProtocol().getApplicationServiceURL();
}
@@ -186,27 +158,6 @@ public class FederationProtocol extends Protocol {
}
}
- public Object getIssuer() {
- if (this.issuer != null) {
- return this.issuer;
- }
- CallbackType cbt = getFederationProtocol().getIssuer();
- this.issuer = loadCallbackType(cbt, "Issuer");
- return this.issuer;
- }
-
- public void setIssuer(Object value) {
- final boolean isString = value instanceof String;
- final boolean isCallbackHandler = value instanceof CallbackHandler;
- if (isString || isCallbackHandler) {
- this.issuer = value;
- } else {
- LOG.error("Unsupported 'Issuer' object");
- throw new IllegalArgumentException("Unsupported 'Issuer' object. Type must be "
- + "java.lang.String or javax.security.auth.callback.CallbackHandler.");
- }
- }
-
public Object getFreshness() {
if (this.freshness != null) {
return this.freshness;
@@ -307,35 +258,4 @@ public class FederationProtocol extends Protocol {
return getFederationProtocol().toString();
}
- public ClassLoader getClassloader() {
- return classloader;
- }
-
- public void setClassloader(ClassLoader classloader) {
- this.classloader = classloader;
- }
-
- private Object loadCallbackType(CallbackType cbt, String name) {
- if (cbt == null) {
- return null;
- }
- if (cbt.getType() == null || cbt.getType().equals(ArgumentType.STRING)) {
- return new String(cbt.getValue());
- } else if (cbt.getType().equals(ArgumentType.CLASS)) {
- try {
- if (this.classloader == null) {
- return ClassLoaderUtils.loadClass(cbt.getValue(), this.getClass()).newInstance();
- } else {
- return this.classloader.loadClass(cbt.getValue()).newInstance();
- }
- } catch (Exception e) {
- LOG.error("Failed to create instance of " + cbt.getValue(), e);
- throw new IllegalStateException("Failed to create instance of " + cbt.getValue());
- }
- } else {
- LOG.error("Only String and Class are supported for '" + name + "'");
- throw new IllegalStateException("Only String and Class are supported for '" + name + "'");
- }
- }
-
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizConfigurator.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizConfigurator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizConfigurator.java
new file mode 100644
index 0000000..f8b0844
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizConfigurator.java
@@ -0,0 +1,115 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.config;
+
+import java.io.File;
+import java.io.Reader;
+import java.io.Writer;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBException;
+
+import org.apache.cxf.fediz.core.config.jaxb.ContextConfig;
+import org.apache.cxf.fediz.core.config.jaxb.FedizConfig;
+
+public class FedizConfigurator {
+
+ private FedizConfig rootConfig;
+
+ private JAXBContext jaxbContext;
+
+ private List<FedizContext> fedizContextList;
+
+ public FedizConfig loadConfig(File f) throws JAXBException {
+ rootConfig = (FedizConfig) getJaxbContext().createUnmarshaller().unmarshal(f);
+ parseFedizContextList();
+ return rootConfig;
+ }
+
+ public FedizConfig loadConfig(Reader reader) throws JAXBException {
+ rootConfig = (FedizConfig) getJaxbContext().createUnmarshaller().unmarshal(reader);
+ parseFedizContextList();
+ return rootConfig;
+ }
+
+ private void parseFedizContextList() {
+ fedizContextList = new ArrayList<FedizContext>();
+ for (ContextConfig config : rootConfig.getContextConfig()) {
+ fedizContextList.add(new FedizContext(config));
+ }
+ }
+
+ public void saveConfiguration(File f) throws JAXBException {
+ if (f.canWrite()) {
+ jaxbContext.createMarshaller().marshal(rootConfig, f);
+ }
+ }
+
+ public void saveConfiguration(Writer writer) throws JAXBException {
+ jaxbContext.createMarshaller().marshal(rootConfig, writer);
+ }
+
+ private JAXBContext getJaxbContext() throws JAXBException {
+ if (jaxbContext == null) {
+ jaxbContext = JAXBContext.newInstance(FedizConfig.class);
+ }
+ return jaxbContext;
+ }
+
+ public List<FedizContext> getFedizContextList() {
+ return fedizContextList;
+ }
+
+ public FedizContext getFedizContext(String contextName) {
+ if (contextName == null || contextName.isEmpty()) {
+ throw new IllegalArgumentException("Invalid Context Name '" + contextName + "'");
+ }
+ if (rootConfig == null) {
+ throw new IllegalArgumentException("No configuration loaded");
+ }
+ for (FedizContext fedContext : fedizContextList) {
+ if (fedContext.getName().equals(contextName)) {
+ fedContext.init();
+ return fedContext;
+ }
+ }
+
+ return null;
+ }
+
+ public ContextConfig getContextConfig(String contextName) throws IllegalArgumentException {
+ if (contextName == null || contextName.isEmpty()) {
+ throw new IllegalArgumentException("Invalid Context Name '" + contextName + "'");
+ }
+ if (rootConfig == null) {
+ throw new IllegalArgumentException("No configuration loaded");
+ }
+
+ for (ContextConfig config : rootConfig.getContextConfig()) {
+ if (contextName.equals(config.getName())) {
+ return config;
+ }
+ }
+ return null;
+ }
+
+}
[2/4] [FEDIZ-7] - Largish refactor of Fediz code to accomadate other
protocols
Posted by co...@apache.org.
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
new file mode 100644
index 0000000..6ebe954
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
@@ -0,0 +1,648 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.processor;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.UUID;
+
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.servlet.http.HttpServletRequest;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+import org.apache.cxf.fediz.core.FederationConstants;
+import org.apache.cxf.fediz.core.TokenValidator;
+import org.apache.cxf.fediz.core.TokenValidatorRequest;
+import org.apache.cxf.fediz.core.TokenValidatorResponse;
+import org.apache.cxf.fediz.core.config.FederationProtocol;
+import org.apache.cxf.fediz.core.config.FedizContext;
+import org.apache.cxf.fediz.core.config.KeyManager;
+import org.apache.cxf.fediz.core.config.SAMLProtocol;
+import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.exception.ProcessingException.TYPE;
+import org.apache.cxf.fediz.core.metadata.MetadataWriter;
+import org.apache.cxf.fediz.core.samlsso.AuthnRequestBuilder;
+import org.apache.cxf.fediz.core.samlsso.CompressionUtils;
+import org.apache.cxf.fediz.core.samlsso.DefaultAuthnRequestBuilder;
+import org.apache.cxf.fediz.core.spi.IDPCallback;
+import org.apache.cxf.fediz.core.util.DOMUtils;
+import org.apache.wss4j.common.ext.WSPasswordCallback;
+import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.common.saml.OpenSAMLUtil;
+import org.apache.wss4j.common.util.DOM2Writer;
+import org.apache.wss4j.dom.WSConstants;
+import org.apache.wss4j.dom.WSDataRef;
+import org.apache.wss4j.dom.WSDocInfo;
+import org.apache.wss4j.dom.WSSConfig;
+import org.apache.wss4j.dom.WSSecurityEngine;
+import org.apache.wss4j.dom.WSSecurityEngineResult;
+import org.apache.wss4j.dom.handler.RequestData;
+import org.apache.wss4j.dom.processor.EncryptedDataProcessor;
+import org.apache.wss4j.dom.processor.Processor;
+import org.apache.wss4j.dom.util.XmlSchemaDateFormat;
+import org.apache.xml.security.utils.Base64;
+import org.joda.time.DateTime;
+import org.opensaml.saml2.core.AuthnRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class SAMLProcessorImpl implements FedizProcessor {
+
+ private static final Logger LOG = LoggerFactory.getLogger(SAMLProcessorImpl.class);
+
+ /**
+ * Default constructor
+ */
+ public SAMLProcessorImpl() {
+ super();
+ }
+
+ @Override
+ public FedizResponse processRequest(FedizRequest request,
+ FedizContext config)
+ throws ProcessingException {
+
+ if (!(config.getProtocol() instanceof SAMLProtocol)) {
+ LOG.error("Unsupported protocol");
+ throw new IllegalStateException("Unsupported protocol");
+ }
+ FedizResponse response = null;
+ if (FederationConstants.ACTION_SIGNIN.equals(request.getWa())) {
+ response = this.processSignInRequest(request, config);
+ } else {
+ LOG.error("Invalid action '" + request.getWa() + "'");
+ throw new ProcessingException(TYPE.INVALID_REQUEST);
+ }
+ return response;
+ }
+
+
+ public Document getMetaData(FedizContext config) throws ProcessingException {
+ return new MetadataWriter().getMetaData(config);
+ }
+
+ protected FedizResponse processSignInRequest(
+ FedizRequest request, FedizContext config)
+ throws ProcessingException {
+
+ byte[] wresult = request.getWresult().getBytes();
+
+ Document doc = null;
+ Element el = null;
+ try {
+ doc = DOMUtils.readXml(new ByteArrayInputStream(wresult));
+ el = doc.getDocumentElement();
+
+ } catch (Exception e) {
+ LOG.warn("Failed to parse wresult: " + e.getMessage());
+ throw new ProcessingException(TYPE.INVALID_REQUEST);
+ }
+
+ if ("RequestSecurityTokenResponseCollection".equals(el.getLocalName())) {
+ el = DOMUtils.getFirstElement(el);
+ }
+ if (!"RequestSecurityTokenResponse".equals(el.getLocalName())) {
+ LOG.warn("Unexpected root element of wresult: '" + el.getLocalName() + "'");
+ throw new ProcessingException(TYPE.INVALID_REQUEST);
+ }
+ el = DOMUtils.getFirstElement(el);
+ Element rst = null;
+ Element lifetimeElem = null;
+ String tt = null;
+
+ while (el != null) {
+ String ln = el.getLocalName();
+ if (FederationConstants.WS_TRUST_13_NS.equals(el.getNamespaceURI())
+ || FederationConstants.WS_TRUST_2005_02_NS.equals(el.getNamespaceURI())) {
+ if ("Lifetime".equals(ln)) {
+ lifetimeElem = el;
+ } else if ("RequestedSecurityToken".equals(ln)) {
+ rst = DOMUtils.getFirstElement(el);
+ } else if ("TokenType".equals(ln)) {
+ tt = DOMUtils.getContent(el);
+ }
+ }
+ el = DOMUtils.getNextElement(el);
+ }
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("RST: " + ((rst != null) ? rst.toString() : "null"));
+ LOG.debug("Lifetime: "
+ + ((lifetimeElem != null) ? lifetimeElem.toString()
+ : "null"));
+ LOG.debug("Tokentype: " + ((tt != null) ? tt.toString() : "null"));
+ }
+ if (rst == null) {
+ LOG.warn("RequestedSecurityToken element not found in wresult");
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ LifeTime lifeTime = null;
+ if (lifetimeElem != null) {
+ lifeTime = processLifeTime(lifetimeElem);
+ }
+
+ if (config.isDetectExpiredTokens() && lifeTime != null) {
+ Date currentDate = new Date();
+ if (currentDate.after(lifeTime.getExpires())) {
+ LOG.warn("RSTR Lifetime expired");
+ throw new ProcessingException(TYPE.TOKEN_EXPIRED);
+ }
+ DateTime currentTime = new DateTime();
+ DateTime validFrom = new DateTime(lifeTime.created);
+ currentTime = currentTime.plusSeconds(config.getMaximumClockSkew().intValue());
+ if (validFrom.isAfter(currentTime)) {
+ LOG.debug("RSTR Lifetime not yet valid");
+ throw new ProcessingException(TYPE.TOKEN_INVALID);
+ }
+ }
+
+ // Check to see if RST is encrypted
+ if ("EncryptedData".equals(rst.getLocalName())
+ && WSConstants.ENC_NS.equals(rst.getNamespaceURI())) {
+ Element decryptedRST = decryptEncryptedRST(rst, config);
+ if (decryptedRST != null) {
+ rst = decryptedRST;
+ }
+ }
+
+ TokenValidatorResponse validatorResponse = null;
+ List<TokenValidator> validators = ((FederationProtocol)config.getProtocol()).getTokenValidators();
+ for (TokenValidator validator : validators) {
+ boolean canHandle = false;
+ if (tt != null) {
+ canHandle = validator.canHandleTokenType(tt);
+ } else {
+ canHandle = validator.canHandleToken(rst);
+ }
+ if (canHandle) {
+ try {
+ TokenValidatorRequest validatorRequest =
+ new TokenValidatorRequest(rst, request.getCerts());
+ validatorResponse = validator.validateAndProcessToken(validatorRequest, config);
+ } catch (ProcessingException ex) {
+ throw ex;
+ } catch (Exception ex) {
+ LOG.warn("Failed to validate token", ex);
+ throw new ProcessingException(TYPE.TOKEN_INVALID);
+ }
+ break;
+ } else {
+ LOG.warn("No security token validator found for '" + tt + "'");
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ }
+
+ // Check whether token already used for signin
+ if (validatorResponse.getUniqueTokenId() != null
+ && config.isDetectReplayedTokens()) {
+ // Check whether token has already been processed once, prevent
+ // replay attack
+ if (!config.getTokenReplayCache().contains(validatorResponse.getUniqueTokenId())) {
+ // not cached
+ Date expires = null;
+ if (lifeTime != null && lifeTime.getExpires() != null) {
+ expires = lifeTime.getExpires();
+ } else {
+ expires = validatorResponse.getExpires();
+ }
+ if (expires != null) {
+ Date currentTime = new Date();
+ long ttl = expires.getTime() - currentTime.getTime();
+ config.getTokenReplayCache().add(validatorResponse.getUniqueTokenId(), ttl / 1000L);
+ } else {
+ config.getTokenReplayCache().add(validatorResponse.getUniqueTokenId());
+ }
+ } else {
+ LOG.error("Replay attack with token id: " + validatorResponse.getUniqueTokenId());
+ throw new ProcessingException("Replay attack with token id: "
+ + validatorResponse.getUniqueTokenId(), TYPE.TOKEN_REPLAY);
+ }
+ }
+
+ FedizResponse fedResponse = new FedizResponse(
+ validatorResponse.getUsername(), validatorResponse.getIssuer(),
+ validatorResponse.getRoles(), validatorResponse.getClaims(),
+ validatorResponse.getAudience(),
+ (lifeTime != null) ? lifeTime.getCreated() : null,
+ (lifeTime != null) ? lifeTime.getExpires() : null, rst,
+ validatorResponse.getUniqueTokenId());
+
+ return fedResponse;
+ }
+
+ private Element decryptEncryptedRST(
+ Element encryptedRST,
+ FedizContext config
+ ) throws ProcessingException {
+
+ KeyManager decryptionKeyManager = config.getDecryptionKey();
+ if (decryptionKeyManager == null || decryptionKeyManager.getCrypto() == null) {
+ LOG.debug(
+ "We must have a decryption Crypto instance configured to decrypt encrypted tokens"
+ );
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ String keyPassword = decryptionKeyManager.getKeyPassword();
+ if (keyPassword == null) {
+ LOG.debug(
+ "We must have a decryption key password to decrypt encrypted tokens"
+ );
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+
+ EncryptedDataProcessor proc = new EncryptedDataProcessor();
+ WSDocInfo docInfo = new WSDocInfo(encryptedRST.getOwnerDocument());
+ RequestData data = new RequestData();
+
+ // Disable WSS4J processing of the (decrypted) SAML Token
+ WSSConfig wssConfig = WSSConfig.getNewInstance();
+ wssConfig.setProcessor(WSSecurityEngine.SAML_TOKEN, new NOOpProcessor());
+ wssConfig.setProcessor(WSSecurityEngine.SAML2_TOKEN, new NOOpProcessor());
+ data.setWssConfig(wssConfig);
+
+ data.setDecCrypto(decryptionKeyManager.getCrypto());
+ data.setCallbackHandler(new DecryptionCallbackHandler(keyPassword));
+ try {
+ List<WSSecurityEngineResult> result =
+ proc.handleToken(encryptedRST, data, docInfo);
+ if (result.size() > 0) {
+ @SuppressWarnings("unchecked")
+ List<WSDataRef> dataRefs =
+ (List<WSDataRef>)result.get(result.size() - 1).get(WSSecurityEngineResult.TAG_DATA_REF_URIS);
+ if (dataRefs != null && dataRefs.size() > 0) {
+ return dataRefs.get(0).getProtectedElement();
+ }
+ }
+ } catch (WSSecurityException e) {
+ LOG.debug(e.getMessage(), e);
+ throw new ProcessingException(TYPE.TOKEN_INVALID);
+ }
+ return null;
+ }
+
+ private LifeTime processLifeTime(Element lifetimeElem) throws ProcessingException {
+ try {
+ Element createdElem = DOMUtils.getFirstChildWithName(lifetimeElem,
+ WSConstants.WSU_NS, WSConstants.CREATED_LN);
+ DateFormat zulu = new XmlSchemaDateFormat();
+
+ Date created = zulu.parse(DOMUtils.getContent(createdElem));
+
+ Element expiresElem = DOMUtils.getFirstChildWithName(lifetimeElem,
+ WSConstants.WSU_NS, WSConstants.EXPIRES_LN);
+ Date expires = zulu.parse(DOMUtils.getContent(expiresElem));
+
+ return new LifeTime(created, expires);
+
+ } catch (ParseException e) {
+ LOG.error("Failed to parse lifetime element in wresult: " + e.getMessage());
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ }
+
+ public class LifeTime {
+
+ private Date created;
+ private Date expires;
+
+ public LifeTime(Date created, Date expires) {
+ this.created = created;
+ this.expires = expires;
+ }
+
+ public Date getCreated() {
+ return created;
+ }
+
+ public Date getExpires() {
+ return expires;
+ }
+
+ }
+
+ @Override
+ public String createSignInRequest(HttpServletRequest request, FedizContext config)
+ throws ProcessingException {
+
+ String redirectURL = null;
+ try {
+ if (!(config.getProtocol() instanceof SAMLProtocol)) {
+ LOG.error("Unsupported protocol");
+ throw new IllegalStateException("Unsupported protocol");
+ }
+
+ String issuerURL = resolveIssuer(request, config);
+ LOG.info("Issuer url: " + issuerURL);
+ if (issuerURL != null && issuerURL.length() > 0) {
+ redirectURL = issuerURL;
+ }
+
+ AuthnRequestBuilder authnRequestBuilder = new DefaultAuthnRequestBuilder();
+
+ Document doc = DOMUtils.createDocument();
+ doc.appendChild(doc.createElement("root"));
+
+ // Create the AuthnRequest
+ AuthnRequest authnRequest =
+ authnRequestBuilder.createAuthnRequest(
+ "http://issuer.com", "http://issuer2.com"
+ );
+ Element authnRequestElement = OpenSAMLUtil.toDom(authnRequest, doc);
+ String authnRequestEncoded = encodeAuthnRequest(authnRequestElement);
+
+ //SamlRequestInfo info = new SamlRequestInfo();
+ //info.setSamlRequest(authnRequestEncoded);
+
+ String relayState = URLEncoder.encode(UUID.randomUUID().toString(), "UTF-8");
+
+ String urlEncodedRequest =
+ URLEncoder.encode(authnRequestEncoded, "UTF-8");
+
+ StringBuilder sb = new StringBuilder();
+ sb.append("SAMLRequest").append('=').append(urlEncodedRequest);
+ sb.append("RelayState").append('=').append(relayState);
+
+ /*
+ String contextCookie = createCookie(SSOConstants.RELAY_STATE,
+ info.getRelayState(),
+ info.getWebAppContext(),
+ info.getWebAppDomain());
+
+ context.abortWith(Response.seeOther(ub.build())
+ .header(HttpHeaders.CACHE_CONTROL, "no-cache, no-store")
+ .header("Pragma", "no-cache")
+ .header(HttpHeaders.SET_COOKIE, contextCookie)
+ .build());
+ */
+
+ redirectURL = redirectURL + "?" + sb.toString();
+ } catch (Exception ex) {
+ LOG.error("Failed to create SignInRequest", ex);
+ throw new ProcessingException("Failed to create SignInRequest");
+ }
+ return redirectURL;
+ }
+
+ protected String encodeAuthnRequest(Element authnRequest) throws IOException {
+ String requestMessage = DOM2Writer.nodeToString(authnRequest);
+
+ byte[] deflatedBytes = CompressionUtils.deflate(requestMessage.getBytes("UTF-8"));
+
+ return Base64.encode(deflatedBytes);
+ }
+
+ @Override
+ public String createSignOutRequest(HttpServletRequest request, FedizContext config)
+ throws ProcessingException {
+
+ String redirectURL = null;
+ try {
+ if (!(config.getProtocol() instanceof FederationProtocol)) {
+ LOG.error("Unsupported protocol");
+ throw new IllegalStateException("Unsupported protocol");
+ }
+
+ String issuerURL = resolveIssuer(request, config);
+ LOG.info("Issuer url: " + issuerURL);
+ if (issuerURL != null && issuerURL.length() > 0) {
+ redirectURL = issuerURL;
+ }
+
+ StringBuilder sb = new StringBuilder();
+ sb.append(FederationConstants.PARAM_ACTION).append('=').append(FederationConstants.ACTION_SIGNOUT);
+
+ String logoutRedirectTo = config.getLogoutRedirectTo();
+ if (logoutRedirectTo != null && !logoutRedirectTo.isEmpty()) {
+
+ if (logoutRedirectTo.startsWith("/")) {
+ logoutRedirectTo = extractFullContextPath(request).concat(logoutRedirectTo.substring(1));
+ } else {
+ logoutRedirectTo = extractFullContextPath(request).concat(logoutRedirectTo);
+ }
+
+ LOG.debug("wreply=" + logoutRedirectTo);
+
+ sb.append('&').append(FederationConstants.PARAM_REPLY).append('=');
+ sb.append(URLEncoder.encode(logoutRedirectTo, "UTF-8"));
+ }
+
+ redirectURL = redirectURL + "?" + sb.toString();
+ } catch (Exception ex) {
+ LOG.error("Failed to create SignInRequest", ex);
+ throw new ProcessingException("Failed to create SignInRequest");
+ }
+ return redirectURL;
+ }
+/*
+ private String resolveSignInQuery(HttpServletRequest request, FedizContext config)
+ throws IOException, UnsupportedCallbackException, UnsupportedEncodingException {
+ Object signInQueryObj = ((FederationProtocol)config.getProtocol()).getSignInQuery();
+ String signInQuery = null;
+ if (signInQueryObj != null) {
+ if (signInQueryObj instanceof String) {
+ signInQuery = (String)signInQueryObj;
+ } else if (signInQueryObj instanceof CallbackHandler) {
+ CallbackHandler frCB = (CallbackHandler)signInQueryObj;
+ SignInQueryCallback callback = new SignInQueryCallback(request);
+ frCB.handle(new Callback[] {callback});
+ Map<String, String> signInQueryMap = callback.getSignInQueryParamMap();
+ StringBuilder sbQuery = new StringBuilder();
+ for (String key : signInQueryMap.keySet()) {
+ if (sbQuery.length() > 0) {
+ sbQuery.append("&");
+ }
+ sbQuery.append(key).append('=').
+ append(URLEncoder.encode(signInQueryMap.get(key), "UTF-8"));
+ }
+ signInQuery = sbQuery.toString();
+
+ }
+ }
+ return signInQuery;
+ }
+
+ private String resolveFreshness(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object freshnessObj = ((FederationProtocol)config.getProtocol()).getFreshness();
+ String freshness = null;
+ if (freshnessObj != null) {
+ if (freshnessObj instanceof String) {
+ freshness = (String)freshnessObj;
+ } else if (freshnessObj instanceof CallbackHandler) {
+ CallbackHandler frCB = (CallbackHandler)freshnessObj;
+ FreshnessCallback callback = new FreshnessCallback(request);
+ frCB.handle(new Callback[] {callback});
+ freshness = callback.getFreshness();
+ }
+ }
+ return freshness;
+ }
+
+ private String resolveHomeRealm(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object homeRealmObj = ((FederationProtocol)config.getProtocol()).getHomeRealm();
+ String homeRealm = null;
+ if (homeRealmObj != null) {
+ if (homeRealmObj instanceof String) {
+ homeRealm = (String)homeRealmObj;
+ } else if (homeRealmObj instanceof CallbackHandler) {
+ CallbackHandler hrCB = (CallbackHandler)homeRealmObj;
+ HomeRealmCallback callback = new HomeRealmCallback(request);
+ hrCB.handle(new Callback[] {callback});
+ homeRealm = callback.getHomeRealm();
+ }
+ }
+ return homeRealm;
+ }
+
+ private String resolveAuthenticationType(HttpServletRequest request, FedizContext config)
+ throws IOException, UnsupportedCallbackException {
+ Object wAuthObj = ((FederationProtocol)config.getProtocol()).getAuthenticationType();
+ String wAuth = null;
+ if (wAuthObj != null) {
+ if (wAuthObj instanceof String) {
+ wAuth = (String)wAuthObj;
+ } else if (wAuthObj instanceof CallbackHandler) {
+ CallbackHandler wauthCB = (CallbackHandler)wAuthObj;
+ WAuthCallback callback = new WAuthCallback(request);
+ wauthCB.handle(new Callback[] {callback});
+ wAuth = callback.getWauth();
+ }
+ }
+ return wAuth;
+ }
+
+ private String resolveRequest(HttpServletRequest request, FedizContext config)
+ throws IOException, UnsupportedCallbackException {
+ Object wReqObj = ((FederationProtocol)config.getProtocol()).getRequest();
+ String wReq = null;
+ if (wReqObj != null) {
+ if (wReqObj instanceof String) {
+ wReq = (String)wReqObj;
+ } else if (wReqObj instanceof CallbackHandler) {
+ CallbackHandler wauthCB = (CallbackHandler)wReqObj;
+ WReqCallback callback = new WReqCallback(request);
+ wauthCB.handle(new Callback[] {callback});
+ wReq = callback.getWreq();
+ }
+ }
+ return wReq;
+ }
+*/
+ private String resolveIssuer(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object issuerObj = config.getProtocol().getIssuer();
+ String issuerURL = null;
+ if (issuerObj instanceof String) {
+ issuerURL = (String)issuerObj;
+ } else if (issuerObj instanceof CallbackHandler) {
+ CallbackHandler issuerCB = (CallbackHandler)issuerObj;
+ IDPCallback callback = new IDPCallback(request);
+ issuerCB.handle(new Callback[] {callback});
+ issuerURL = callback.getIssuerUrl().toString();
+ }
+ return issuerURL;
+ }
+/*
+ private String resolveWTRealm(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object wtRealmObj = ((FederationProtocol)config.getProtocol()).getRealm();
+ String wtRealm = null;
+ if (wtRealmObj != null) {
+ if (wtRealmObj instanceof String) {
+ wtRealm = (String)wtRealmObj;
+ } else if (wtRealmObj instanceof CallbackHandler) {
+ CallbackHandler hrCB = (CallbackHandler)wtRealmObj;
+ RealmCallback callback = new RealmCallback(request);
+ hrCB.handle(new Callback[] {callback});
+ wtRealm = callback.getRealm();
+ }
+ } else {
+ wtRealm = extractFullContextPath(request); //default value
+ }
+ return wtRealm;
+ }
+
+*/
+ private String extractFullContextPath(HttpServletRequest request) throws MalformedURLException {
+ String result = null;
+ String contextPath = request.getContextPath();
+ String requestUrl = request.getRequestURL().toString();
+ String requestPath = new URL(requestUrl).getPath();
+ // Cut request path of request url and add context path if not ROOT
+ if (requestPath != null && requestPath.length() > 0) {
+ int lastIndex = requestUrl.lastIndexOf(requestPath);
+ result = requestUrl.substring(0, lastIndex);
+ } else {
+ result = requestUrl;
+ }
+ if (contextPath != null && contextPath.length() > 0) {
+ // contextPath contains starting slash
+ result = result + contextPath + "/";
+ } else {
+ result = result + "/";
+ }
+ return result;
+ }
+
+ private static class DecryptionCallbackHandler implements CallbackHandler {
+
+ private final String password;
+
+ public DecryptionCallbackHandler(String password) {
+ this.password = password;
+ }
+
+ @Override
+ public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
+ for (int i = 0; i < callbacks.length; i++) {
+ if (callbacks[i] instanceof WSPasswordCallback) {
+ WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
+ pc.setPassword(password);
+ } else {
+ throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback");
+ }
+ }
+ }
+
+ }
+
+ private static class NOOpProcessor implements Processor {
+
+ @Override
+ public List<WSSecurityEngineResult> handleToken(Element arg0, RequestData arg1, WSDocInfo arg2)
+ throws WSSecurityException {
+ return new ArrayList<WSSecurityEngineResult>();
+ }
+
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
index 30dcf53..b643a4e 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
@@ -29,7 +29,6 @@ import java.util.Map;
import java.util.StringTokenizer;
import org.w3c.dom.Element;
-
import org.apache.cxf.fediz.core.Claim;
import org.apache.cxf.fediz.core.ClaimCollection;
import org.apache.cxf.fediz.core.ClaimTypes;
@@ -37,8 +36,8 @@ import org.apache.cxf.fediz.core.TokenValidator;
import org.apache.cxf.fediz.core.TokenValidatorRequest;
import org.apache.cxf.fediz.core.TokenValidatorResponse;
import org.apache.cxf.fediz.core.config.CertificateValidationMethod;
-import org.apache.cxf.fediz.core.config.FederationContext;
-import org.apache.cxf.fediz.core.config.FederationProtocol;
+import org.apache.cxf.fediz.core.config.FedizContext;
+import org.apache.cxf.fediz.core.config.Protocol;
import org.apache.cxf.fediz.core.config.TrustManager;
import org.apache.cxf.fediz.core.config.TrustedIssuer;
import org.apache.cxf.fediz.core.exception.ProcessingException;
@@ -88,7 +87,7 @@ public class SAMLTokenValidator implements TokenValidator {
}
public TokenValidatorResponse validateAndProcessToken(TokenValidatorRequest request,
- FederationContext config) throws ProcessingException {
+ FedizContext config) throws ProcessingException {
Element token = request.getToken();
try {
@@ -215,12 +214,12 @@ public class SAMLTokenValidator implements TokenValidator {
}
}
- protected List<String> parseRoles(FederationContext config, List<Claim> claims) {
+ protected List<String> parseRoles(FedizContext config, List<Claim> claims) {
List<String> roles = null;
- FederationProtocol fp = (FederationProtocol)config.getProtocol();
- if (fp.getRoleURI() != null) {
- URI roleURI = URI.create(fp.getRoleURI());
- String delim = fp.getRoleDelimiter();
+ Protocol protocol = config.getProtocol();
+ if (protocol.getRoleURI() != null) {
+ URI roleURI = URI.create(protocol.getRoleURI());
+ String delim = protocol.getRoleDelimiter();
for (Claim c : claims) {
if (roleURI.equals(c.getClaimType())) {
Object oValue = c.getValue();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/resources/schemas/FedizConfig.xsd
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/resources/schemas/FedizConfig.xsd b/plugins/core/src/main/resources/schemas/FedizConfig.xsd
index c9e670c..72f19f2 100644
--- a/plugins/core/src/main/resources/schemas/FedizConfig.xsd
+++ b/plugins/core/src/main/resources/schemas/FedizConfig.xsd
@@ -94,9 +94,6 @@
<xs:extension base="protocolType">
<xs:sequence>
<xs:element ref="realm" />
- <xs:element ref="issuer" />
- <xs:element ref="roleDelimiter" />
- <xs:element ref="roleURI" />
<xs:element ref="authenticationType" />
<xs:element ref="homeRealm" />
<xs:element ref="freshness" />
@@ -111,6 +108,17 @@
</xs:extension>
</xs:complexContent>
</xs:complexType>
+
+ <xs:complexType name="samlProtocolType">
+ <xs:complexContent>
+ <xs:extension base="protocolType">
+ <xs:sequence>
+ <xs:element ref="realm" />
+ </xs:sequence>
+ <xs:attribute name="version" use="required" type="xs:string" />
+ </xs:extension>
+ </xs:complexContent>
+ </xs:complexType>
<xs:element name="roleDelimiter" type="xs:string" />
<xs:element name="roleURI" type="xs:string" />
@@ -118,8 +126,13 @@
<xs:element name="applicationServiceURL" type="xs:string" />
-
- <xs:complexType name="protocolType" abstract="true" />
+ <xs:complexType name="protocolType" abstract="true">
+ <xs:sequence>
+ <xs:element ref="roleDelimiter" />
+ <xs:element ref="roleURI" />
+ <xs:element ref="issuer" />
+ </xs:sequence>
+ </xs:complexType>
<xs:complexType name="CallbackType">
<xs:simpleContent>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/CustomValidator.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/CustomValidator.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/CustomValidator.java
index 72ac643..f67edae 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/CustomValidator.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/CustomValidator.java
@@ -20,7 +20,7 @@
package org.apache.cxf.fediz.core;
import org.w3c.dom.Element;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizContext;
public class CustomValidator implements TokenValidator {
@@ -38,7 +38,7 @@ public class CustomValidator implements TokenValidator {
@Override
public TokenValidatorResponse validateAndProcessToken(
TokenValidatorRequest request,
- FederationContext config
+ FedizContext config
) {
return new TokenValidatorResponse(null,
FederationProcessorTest.TEST_USER,
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationMetaDataTest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationMetaDataTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationMetaDataTest.java
index dd29b80..150eb08 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationMetaDataTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationMetaDataTest.java
@@ -25,13 +25,13 @@ import java.net.URL;
import javax.xml.transform.TransformerException;
import org.w3c.dom.Document;
-
import org.apache.cxf.fediz.common.SecurityTestUtil;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
import org.apache.cxf.fediz.core.util.DOMUtils;
-
import org.junit.AfterClass;
import org.junit.Assert;
@@ -46,14 +46,14 @@ public class FederationMetaDataTest {
}
- private FederationContext loadConfig(String context) {
+ private FedizContext loadConfig(String context) {
try {
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
final URL resource = Thread.currentThread().getContextClassLoader()
.getResource(CONFIG_FILE);
File f = new File(resource.toURI());
configurator.loadConfig(f);
- return configurator.getFederationContext(context);
+ return configurator.getFedizContext(context);
} catch (Exception e) {
e.printStackTrace();
return null;
@@ -64,9 +64,9 @@ public class FederationMetaDataTest {
@org.junit.Test
public void validateMetaDataWithAlias() throws ProcessingException {
- FederationContext config = loadConfig("ROOT");
+ FedizContext config = loadConfig("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
Document doc = wfProc.getMetaData(config);
Assert.assertNotNull(doc);
@@ -82,9 +82,9 @@ public class FederationMetaDataTest {
public void validateMetaDataNoAlias() throws ProcessingException {
try {
- FederationContext config = loadConfig("ROOT_NO_KEY");
+ FedizContext config = loadConfig("ROOT_NO_KEY");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
Document doc;
doc = wfProc.getMetaData(config);
@@ -99,9 +99,9 @@ public class FederationMetaDataTest {
@org.junit.Test
public void validateMetaDataNoSigningKey() throws ProcessingException {
- FederationContext config = loadConfig("ROOT_NO_SIGNINGKEY");
+ FedizContext config = loadConfig("ROOT_NO_SIGNINGKEY");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
Document doc = wfProc.getMetaData(config);
Assert.assertNotNull(doc);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationProcessorTest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationProcessorTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationProcessorTest.java
index d4b7061..80c17e6 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationProcessorTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/FederationProcessorTest.java
@@ -33,13 +33,12 @@ import javax.security.auth.callback.UnsupportedCallbackException;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
-
import org.apache.cxf.fediz.common.STSUtil;
import org.apache.cxf.fediz.common.SecurityTestUtil;
import org.apache.cxf.fediz.core.AbstractSAMLCallbackHandler.MultiValue;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
import org.apache.cxf.fediz.core.config.FederationProtocol;
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.config.jaxb.AudienceUris;
import org.apache.cxf.fediz.core.config.jaxb.CertificateStores;
import org.apache.cxf.fediz.core.config.jaxb.ContextConfig;
@@ -51,6 +50,10 @@ import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuers;
import org.apache.cxf.fediz.core.config.jaxb.ValidationType;
import org.apache.cxf.fediz.core.exception.ProcessingException;
import org.apache.cxf.fediz.core.exception.ProcessingException.TYPE;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.wss4j.common.WSEncryptionPart;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
@@ -83,7 +86,7 @@ public class FederationProcessorTest {
private static Crypto crypto;
private static CallbackHandler cbPasswordHandler;
- private static FederationConfigurator configurator;
+ private static FedizConfigurator configurator;
@BeforeClass
@@ -105,12 +108,12 @@ public class FederationProcessorTest {
}
- private static FederationConfigurator getFederationConfigurator() {
+ private static FedizConfigurator getFederationConfigurator() {
if (configurator != null) {
return configurator;
}
try {
- configurator = new FederationConfigurator();
+ configurator = new FedizConfigurator();
final URL resource = Thread.currentThread().getContextClassLoader()
.getResource(CONFIG_FILE);
File f = new File(resource.toURI());
@@ -130,14 +133,14 @@ public class FederationProcessorTest {
public void validateRSTRWithoutToken() throws Exception {
Document doc = STSUtil.toSOAPPart(STSUtil.SAMPLE_RSTR_COLL_MSG);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(DOM2Writer.nodeToString(doc));
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
fail("Failure expected on missing security token in RSTR");
@@ -155,14 +158,14 @@ public class FederationProcessorTest {
public void validateRequestUnknownAction() throws Exception {
Document doc = STSUtil.toSOAPPart(STSUtil.SAMPLE_RSTR_COLL_MSG);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa("gugus");
wfReq.setWresult(DOM2Writer.nodeToString(doc));
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
fail("Failure expected due to invalid action");
@@ -178,14 +181,14 @@ public class FederationProcessorTest {
*/
@org.junit.Test
public void validateSignInInvalidWResult() throws Exception {
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult("gugus");
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
fail("Failure expected due to invalid wresult");
@@ -225,15 +228,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -268,15 +271,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true, STSUtil.SAMPLE_RSTR_MSG);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -308,15 +311,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -348,15 +351,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("CUSTOMROLEURI");
+ FedizContext config = getFederationConfigurator().getFedizContext("CUSTOMROLEURI");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER, wfRes.getUsername());
Assert.assertEquals("Issuer wrong", TEST_RSTR_ISSUER, wfRes.getIssuer());
@@ -388,15 +391,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("CUSTOMROLEURI");
+ FedizContext config = getFederationConfigurator().getFedizContext("CUSTOMROLEURI");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER, wfRes.getUsername());
Assert.assertEquals("Issuer wrong", TEST_RSTR_ISSUER, wfRes.getIssuer());
@@ -427,16 +430,16 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
((FederationProtocol)config.getProtocol()).setRoleURI(null);
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -467,15 +470,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -508,15 +511,15 @@ public class FederationProcessorTest {
SAMLUtil.doSAMLCallback(callbackHandler, samlCallback);
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true, STSUtil.SAMPLE_RSTR_2005_02_MSG);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -549,15 +552,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -590,17 +593,17 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
FederationProtocol fp = (FederationProtocol)config.getProtocol();
fp.setRoleDelimiter(",");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -636,16 +639,16 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
// Load and update the config to enforce an error
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
config.getTrustedIssuers().get(0).setSubject("wrong-issuer-name");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
Assert.fail("Processing must fail because of untrusted issuer configured");
@@ -679,15 +682,15 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", false);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
// Load and update the config to enforce an error
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
Assert.fail("Processing must fail because of missing signature");
@@ -721,15 +724,15 @@ public class FederationProcessorTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
Assert.assertEquals("Issuer wrong", TEST_RSTR_ISSUER, wfRes.getIssuer());
@@ -769,16 +772,16 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
// Load and update the config to enforce an error
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT2");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT2");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -810,16 +813,16 @@ public class FederationProcessorTest {
SamlAssertionWrapper assertion = new SamlAssertionWrapper(samlCallback);
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
// Load and update the config to enforce an error
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT3");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT3");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -856,14 +859,14 @@ public class FederationProcessorTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
fail("Failure expected on expired SAML token");
@@ -903,16 +906,16 @@ public class FederationProcessorTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
config.setMaximumClockSkew(BigInteger.valueOf(60));
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -944,20 +947,20 @@ public class FederationProcessorTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("CUSTTOK");
+ FedizContext config = getFederationConfigurator().getFedizContext("CUSTTOK");
FederationProtocol fp = (FederationProtocol)config.getProtocol();
List<TokenValidator> validators = fp.getTokenValidators();
Assert.assertEquals("Two validators must be found", 2, validators.size());
Assert.assertEquals("First validator must be custom validator",
CustomValidator.class.getName(), validators.get(0).getClass().getName());
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -987,15 +990,15 @@ public class FederationProcessorTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("NOCLOCKSKEW");
+ FedizContext config = getFederationConfigurator().getFedizContext("NOCLOCKSKEW");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -1028,16 +1031,16 @@ public class FederationProcessorTest {
String rstr = encryptAndSignToken(assertion);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config =
- getFederationConfigurator().getFederationContext("ROOT_DECRYPTION");
+ FedizContext config =
+ getFederationConfigurator().getFedizContext("ROOT_DECRYPTION");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -1095,15 +1098,15 @@ public class FederationProcessorTest {
String rstr = DOM2Writer.nodeToString(doc);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config =
- getFederationConfigurator().getFederationContext("ROOT_DECRYPTION");
+ FedizContext config =
+ getFederationConfigurator().getFedizContext("ROOT_DECRYPTION");
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
try {
wfProc.processRequest(wfReq, config);
fail("Failure expected on missing client certs");
@@ -1152,7 +1155,7 @@ public class FederationProcessorTest {
protocol.setRoleURI("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role");
- FederationContext fedContext = new FederationContext(config);
+ FedizContext fedContext = new FedizContext(config);
fedContext.init();
SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler();
@@ -1172,12 +1175,12 @@ public class FederationProcessorTest {
String rstr = createSamlToken(assertion, "mystskey", true, STSUtil.SAMPLE_RSTR_MSG);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, fedContext);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, fedContext);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/SAMLTokenValidatorOldTest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/SAMLTokenValidatorOldTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/SAMLTokenValidatorOldTest.java
index 9349057..8c6d8e5 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/SAMLTokenValidatorOldTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/SAMLTokenValidatorOldTest.java
@@ -33,8 +33,12 @@ import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.apache.cxf.fediz.common.STSUtil;
import org.apache.cxf.fediz.common.SecurityTestUtil;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.ext.WSPasswordCallback;
@@ -62,7 +66,7 @@ public class SAMLTokenValidatorOldTest {
private static Crypto crypto;
private static CallbackHandler cbPasswordHandler;
- private static FederationConfigurator configurator;
+ private static FedizConfigurator configurator;
@BeforeClass
@@ -84,12 +88,12 @@ public class SAMLTokenValidatorOldTest {
}
- private static FederationConfigurator getFederationConfigurator() {
+ private static FedizConfigurator getFederationConfigurator() {
if (configurator != null) {
return configurator;
}
try {
- configurator = new FederationConfigurator();
+ configurator = new FedizConfigurator();
final URL resource = Thread.currentThread().getContextClassLoader()
.getResource(CONFIG_FILE);
File f = new File(resource.toURI());
@@ -128,15 +132,15 @@ public class SAMLTokenValidatorOldTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
@@ -175,15 +179,15 @@ public class SAMLTokenValidatorOldTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("CUSTOMROLEURI");
+ FedizContext config = getFederationConfigurator().getFedizContext("CUSTOMROLEURI");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER, wfRes.getUsername());
Assert.assertEquals("Issuer wrong", TEST_RSTR_ISSUER, wfRes.getIssuer());
@@ -218,15 +222,15 @@ public class SAMLTokenValidatorOldTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("CUSTOMROLEURI");
+ FedizContext config = getFederationConfigurator().getFedizContext("CUSTOMROLEURI");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER, wfRes.getUsername());
Assert.assertEquals("Issuer wrong", TEST_RSTR_ISSUER, wfRes.getIssuer());
@@ -262,15 +266,15 @@ public class SAMLTokenValidatorOldTest {
String rstr = createSamlToken(assertion, "mystskey", true);
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(FederationConstants.ACTION_SIGNIN);
wfReq.setWresult(rstr);
configurator = null;
- FederationContext config = getFederationConfigurator().getFederationContext("ROOT");
+ FedizContext config = getFederationConfigurator().getFedizContext("ROOT");
- FederationProcessor wfProc = new FederationProcessorImpl();
- FederationResponse wfRes = wfProc.processRequest(wfReq, config);
+ FedizProcessor wfProc = new FederationProcessorImpl();
+ FedizResponse wfRes = wfProc.processRequest(wfReq, config);
Assert.assertEquals("Principal name wrong", TEST_USER,
wfRes.getUsername());
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/CallbackHandlerTest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/CallbackHandlerTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/CallbackHandlerTest.java
index 05b6e0e..382c953 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/CallbackHandlerTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/CallbackHandlerTest.java
@@ -217,10 +217,10 @@ public class CallbackHandlerTest {
jaxbContext.createMarshaller().marshal(configOut, writer);
StringReader reader = new StringReader(writer.toString());
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
configurator.loadConfig(reader);
- FederationContext ctx = configurator.getFederationContext(CONFIG_NAME);
+ FedizContext ctx = configurator.getFedizContext(CONFIG_NAME);
FederationProtocol fp = (FederationProtocol)ctx.getProtocol();
@@ -285,10 +285,10 @@ public class CallbackHandlerTest {
jaxbContext.createMarshaller().marshal(configOut, writer);
StringReader reader = new StringReader(writer.toString());
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
configurator.loadConfig(reader);
- FederationContext ctx = configurator.getFederationContext(CONFIG_NAME);
+ FedizContext ctx = configurator.getFedizContext(CONFIG_NAME);
FederationProtocol fp = (FederationProtocol)ctx.getProtocol();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationTest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationTest.java
index eb0bb7e..6e4fc61 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationTest.java
@@ -231,7 +231,7 @@ public class FedizConfigurationTest {
jaxbContext.createMarshaller().marshal(configOut, writer);
StringReader reader = new StringReader(writer.toString());
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
configurator.loadConfig(reader);
File f = new File(CONFIG_FILE);
@@ -239,7 +239,7 @@ public class FedizConfigurationTest {
configurator.saveConfiguration(f);
- configurator = new FederationConfigurator();
+ configurator = new FedizConfigurator();
f = new File(CONFIG_FILE);
configurator.loadConfig(f);
}
@@ -250,7 +250,7 @@ public class FedizConfigurationTest {
final JAXBContext jaxbContext = JAXBContext
.newInstance(FedizConfig.class);
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
FedizConfig configOut = createConfiguration();
StringWriter writer = new StringWriter();
jaxbContext.createMarshaller().marshal(configOut, writer);
@@ -302,10 +302,10 @@ public class FedizConfigurationTest {
jaxbContext.createMarshaller().marshal(config, writer);
StringReader reader = new StringReader(writer.toString());
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
configurator.loadConfig(reader);
- FederationContext fedContext = configurator.getFederationContext(CONFIG_NAME);
+ FedizContext fedContext = configurator.getFedizContext(CONFIG_NAME);
Assert.assertNotNull(fedContext);
return fedContext.getTokenReplayCache();
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationWriterTest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationWriterTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationWriterTest.java
index e68c0e9..7a7f604 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationWriterTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/config/FedizConfigurationWriterTest.java
@@ -216,7 +216,7 @@ public class FedizConfigurationWriterTest {
final JAXBContext jaxbContext = JAXBContext
.newInstance(FedizConfig.class);
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
FedizConfig configOut = createConfiguration();
StringWriter writer = new StringWriter();
jaxbContext.createMarshaller().marshal(configOut, writer);
@@ -228,7 +228,7 @@ public class FedizConfigurationWriterTest {
configurator.saveConfiguration(f);
- configurator = new FederationConfigurator();
+ configurator = new FedizConfigurator();
f = new File(CONFIG_FILE);
configurator.loadConfig(f);
}
@@ -243,7 +243,7 @@ public class FedizConfigurationWriterTest {
* Test JAXB part
*/
- FederationConfigurator configurator = new FederationConfigurator();
+ FedizConfigurator configurator = new FedizConfigurator();
FedizConfig configOut = createConfiguration();
StringWriter writer = new StringWriter();
jaxbContext.createMarshaller().marshal(configOut, writer);
@@ -263,7 +263,7 @@ public class FedizConfigurationWriterTest {
/**
* Check Runtime configuration
*/
- FederationContext fedContext = configurator.getFederationContext(CONFIG_NAME);
+ FedizContext fedContext = configurator.getFedizContext(CONFIG_NAME);
Protocol protocol = fedContext.getProtocol();
Assert.assertTrue(protocol instanceof FederationProtocol);
FederationProtocol fedProtocol = (FederationProtocol) protocol;
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationAuthenticator.java
----------------------------------------------------------------------
diff --git a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationAuthenticator.java b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationAuthenticator.java
index 24bdddb..635d375 100644
--- a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationAuthenticator.java
+++ b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationAuthenticator.java
@@ -34,13 +34,13 @@ import javax.servlet.http.HttpSession;
import javax.xml.bind.JAXBException;
import org.apache.cxf.fediz.core.FederationConstants;
-import org.apache.cxf.fediz.core.FederationProcessor;
-import org.apache.cxf.fediz.core.FederationProcessorImpl;
-import org.apache.cxf.fediz.core.FederationRequest;
-import org.apache.cxf.fediz.core.FederationResponse;
-import org.apache.cxf.fediz.core.config.FederationConfigurator;
-import org.apache.cxf.fediz.core.config.FederationContext;
+import org.apache.cxf.fediz.core.config.FedizConfigurator;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.processor.FederationProcessorImpl;
+import org.apache.cxf.fediz.core.processor.FedizProcessor;
+import org.apache.cxf.fediz.core.processor.FedizRequest;
+import org.apache.cxf.fediz.core.processor.FedizResponse;
import org.eclipse.jetty.http.HttpMethods;
import org.eclipse.jetty.http.MimeTypes;
import org.eclipse.jetty.security.ServerAuthException;
@@ -83,7 +83,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
private static final String SECURITY_TOKEN_ATTR = "org.apache.fediz.SECURITY_TOKEN";
private String configFile;
- private FederationConfigurator configurator;
+ private FedizConfigurator configurator;
private String encoding = "UTF-8";
public FederationAuthenticator() {
@@ -106,7 +106,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
f = new File(jettyHome.concat(File.separator + getConfigFile()));
}
}
- configurator = new FederationConfigurator();
+ configurator = new FedizConfigurator();
configurator.loadConfig(f);
LOG.debug("Fediz configuration read from " + f.getAbsolutePath());
} catch (JAXBException e) {
@@ -170,7 +170,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
// Handle a request for authentication.
if (wa != null) {
- FederationResponse wfRes = null;
+ FedizResponse wfRes = null;
if (wa.equals(FederationConstants.ACTION_SIGNIN)) {
if (LOG.isDebugEnabled()) {
LOG.debug("SignIn request found");
@@ -184,7 +184,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
return Authentication.SEND_FAILURE;
} else {
- FederationRequest wfReq = new FederationRequest();
+ FedizRequest wfReq = new FedizRequest();
wfReq.setWa(wa);
wfReq.setWresult(wresult);
@@ -198,7 +198,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedConfig = getContextConfiguration(contextName);
+ FedizContext fedConfig = getContextConfiguration(contextName);
FederationLoginService fedLoginService = (FederationLoginService)this._loginService;
UserIdentity user = fedLoginService.login(null, wfReq, fedConfig);
@@ -287,13 +287,13 @@ public class FederationAuthenticator extends LoginAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedConfig = getContextConfiguration(contextName);
+ FedizContext fedConfig = getContextConfiguration(contextName);
String logoutUrl = fedConfig.getLogoutURL();
if (logoutUrl != null && !logoutUrl.isEmpty() && uri.equals(contextName + logoutUrl)) {
session.invalidate();
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
signOutRedirectToIssuer(request, response, wfProc);
return Authentication.SEND_CONTINUE;
@@ -359,7 +359,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
}
}
- FederationProcessor wfProc = new FederationProcessorImpl();
+ FedizProcessor wfProc = new FederationProcessorImpl();
signInRedirectToIssuer(request, response, wfProc);
return Authentication.SEND_CONTINUE;
@@ -394,7 +394,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
* {@link HttpServletResponse#sendError(int, String)} throws an
* {@link IOException}
*/
- protected void signInRedirectToIssuer(HttpServletRequest request, HttpServletResponse response, FederationProcessor processor)
+ protected void signInRedirectToIssuer(HttpServletRequest request, HttpServletResponse response, FedizProcessor processor)
throws IOException {
//Not supported in jetty 7.6
@@ -403,7 +403,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedCtx = this.configurator.getFederationContext(contextName);
+ FedizContext fedCtx = this.configurator.getFedizContext(contextName);
String redirectURL = null;
try {
redirectURL = processor.createSignInRequest(request, fedCtx);
@@ -422,7 +422,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
}
- protected void signOutRedirectToIssuer(HttpServletRequest request, HttpServletResponse response, FederationProcessor processor)
+ protected void signOutRedirectToIssuer(HttpServletRequest request, HttpServletResponse response, FedizProcessor processor)
throws IOException {
//Not supported in jetty 7.6
@@ -431,7 +431,7 @@ public class FederationAuthenticator extends LoginAuthenticator {
if (contextName == null || contextName.isEmpty()) {
contextName = "/";
}
- FederationContext fedCtx = this.configurator.getFederationContext(contextName);
+ FedizContext fedCtx = this.configurator.getFedizContext(contextName);
String redirectURL = null;
try {
redirectURL = processor.createSignOutRequest(request, fedCtx);
@@ -449,11 +449,11 @@ public class FederationAuthenticator extends LoginAuthenticator {
}
}
- private FederationContext getContextConfiguration(String contextName) {
+ private FedizContext getContextConfiguration(String contextName) {
if (configurator == null) {
throw new IllegalStateException("No Fediz configuration available");
}
- FederationContext config = configurator.getFederationContext(contextName);
+ FedizContext config = configurator.getFedizContext(contextName);
if (config == null) {
throw new IllegalStateException("No Fediz configuration for context :" + contextName);
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationIdentityService.java
----------------------------------------------------------------------
diff --git a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationIdentityService.java b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationIdentityService.java
index 18110cf..c1c53c8 100644
--- a/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationIdentityService.java
+++ b/plugins/jetty/src/main/java/org/apache/cxf/fediz/jetty/FederationIdentityService.java
@@ -80,7 +80,7 @@ public class FederationIdentityService implements IdentityService {
try {
FederationUserPrincipal fup = (FederationUserPrincipal)userPrincipal;
- return new FederationUserIdentity(subject, userPrincipal, roles, fup.getFederationResponse());
+ return new FederationUserIdentity(subject, userPrincipal, roles, fup.getFedizResponse());
} catch (ClassCastException ex) {
LOG.warn("Principal must be instance of FederationUserPrincipal");
throw new IllegalStateException("Principal must be instance of FederationUserPrincipal");
[3/4] [FEDIZ-7] - Largish refactor of Fediz code to accomadate other
protocols
Posted by co...@apache.org.
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizContext.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizContext.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizContext.java
new file mode 100644
index 0000000..2eae858
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/FedizContext.java
@@ -0,0 +1,397 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.config;
+
+import java.io.BufferedInputStream;
+import java.io.Closeable;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.math.BigInteger;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Properties;
+
+import org.apache.cxf.fediz.core.config.jaxb.CertificateStores;
+import org.apache.cxf.fediz.core.config.jaxb.ContextConfig;
+import org.apache.cxf.fediz.core.config.jaxb.FederationProtocolType;
+import org.apache.cxf.fediz.core.config.jaxb.KeyManagersType;
+import org.apache.cxf.fediz.core.config.jaxb.KeyStoreType;
+import org.apache.cxf.fediz.core.config.jaxb.ProtocolType;
+import org.apache.cxf.fediz.core.config.jaxb.SamlProtocolType;
+import org.apache.cxf.fediz.core.config.jaxb.TrustManagersType;
+import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuerType;
+import org.apache.cxf.fediz.core.config.jaxb.TrustedIssuers;
+import org.apache.cxf.fediz.core.exception.IllegalConfigurationException;
+import org.apache.wss4j.common.cache.ReplayCache;
+import org.apache.wss4j.common.cache.ReplayCacheFactory;
+import org.apache.wss4j.common.crypto.CertificateStore;
+import org.apache.wss4j.common.crypto.Crypto;
+import org.apache.wss4j.common.crypto.CryptoFactory;
+import org.apache.wss4j.common.crypto.Merlin;
+import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.common.util.Loader;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class FedizContext implements Closeable {
+
+ public static final String CACHE_KEY_PREFIX = "fediz.replay.cache";
+
+ private static final Logger LOG = LoggerFactory.getLogger(FedizContext.class);
+
+ private ContextConfig config;
+
+ private boolean detectExpiredTokens = true;
+ private boolean detectReplayedTokens = true;
+ private String relativePath;
+ private ReplayCache replayCache;
+ private Protocol protocol;
+ private List<TrustManager> certificateStores;
+ private KeyManager keyManager;
+ private KeyManager decryptionKeyManager;
+ private ClassLoader classloader;
+
+
+ public FedizContext(ContextConfig config) {
+ this.config = config;
+
+ }
+
+ public void init() {
+ //get validators initialized
+ getProtocol();
+ }
+
+ public List<String> getAudienceUris() {
+ return config.getAudienceUris().getAudienceItem();
+ }
+
+ public List<TrustedIssuer> getTrustedIssuers() {
+ TrustedIssuers issuers = config.getTrustedIssuers();
+ List<TrustedIssuerType> trustManagers = issuers.getIssuer();
+ List<TrustedIssuer> trustedIssuers = new ArrayList<TrustedIssuer>();
+ for (TrustedIssuerType manager:trustManagers) {
+ trustedIssuers.add(new TrustedIssuer(manager));
+ }
+ return trustedIssuers;
+ }
+
+ public List<TrustManager> getCertificateStores() {
+ if (certificateStores != null) {
+ return certificateStores;
+ }
+ certificateStores = new ArrayList<TrustManager>();
+ CertificateStores certStores = config.getCertificateStores();
+ List<TrustManagersType> trustManagers = certStores.getTrustManager();
+ for (TrustManagersType manager:trustManagers) {
+ TrustManager tm = new TrustManager(manager);
+
+ Crypto crypto = null;
+ try {
+ if (manager.getKeyStore().getType().equalsIgnoreCase("PEM")) {
+ X509Certificate[] certificates = new X509Certificate[1];
+ certificates[0] = readX509Certificate(tm.getName());
+ crypto = new CertificateStore(certificates);
+ } else {
+ Properties sigProperties = createCryptoProperties(manager);
+ crypto = CryptoFactory.getInstance(sigProperties);
+ }
+ tm.setCrypto(crypto);
+ certificateStores.add(tm);
+ } catch (WSSecurityException e) {
+ LOG.error("Failed to load keystore '" + tm.getName() + "'", e);
+ throw new IllegalConfigurationException("Failed to load keystore '" + tm.getName() + "'");
+ }
+ }
+ return certificateStores;
+ }
+
+ public BigInteger getMaximumClockSkew() {
+ if (config.getMaximumClockSkew() == null) {
+ return BigInteger.valueOf(5L);
+ } else {
+ return config.getMaximumClockSkew();
+ }
+ }
+
+ public void setMaximumClockSkew(BigInteger maximumClockSkew) {
+ config.setMaximumClockSkew(maximumClockSkew);
+ }
+
+ // public TrustManager getServiceCertificate() {
+ // return new TrustManager(config.getServiceCertificate());
+ // }
+
+ public Protocol getProtocol() {
+ if (protocol != null) {
+ return protocol;
+ }
+ ProtocolType type = config.getProtocol();
+ if (type instanceof FederationProtocolType) {
+ protocol = new FederationProtocol(type);
+ } else if (type instanceof SamlProtocolType) {
+ protocol = new SAMLProtocol(type);
+ }
+
+ if (protocol != null) {
+ protocol.setClassloader(getClassloader());
+ }
+ return protocol;
+ }
+
+ public String getLogoutURL() {
+ return config.getLogoutURL();
+ }
+
+ public String getLogoutRedirectTo() {
+ return config.getLogoutRedirectTo();
+ }
+
+
+ public KeyManager getSigningKey() {
+ //return new KeyManager(config.getSigningKey());
+
+ if (keyManager != null) {
+ return keyManager;
+ }
+ keyManager = new KeyManager(config.getSigningKey());
+ Properties sigProperties = createCryptoProperties(config.getSigningKey());
+ Crypto crypto;
+ try {
+ crypto = CryptoFactory.getInstance(sigProperties);
+ keyManager.setCrypto(crypto);
+ } catch (WSSecurityException e) {
+ keyManager = null;
+ LOG.error("Failed to load keystore '" + keyManager.getName() + "'", e);
+ throw new IllegalConfigurationException("Failed to load keystore '" + keyManager.getName() + "'");
+ }
+
+ return keyManager;
+
+ }
+
+ public KeyManager getDecryptionKey() {
+ if (decryptionKeyManager != null) {
+ return decryptionKeyManager;
+ }
+ decryptionKeyManager = new KeyManager(config.getTokenDecryptionKey());
+ Properties decProperties = createCryptoProperties(config.getTokenDecryptionKey());
+ Crypto crypto;
+ try {
+ crypto = CryptoFactory.getInstance(decProperties);
+ decryptionKeyManager.setCrypto(crypto);
+ } catch (WSSecurityException e) {
+ decryptionKeyManager = null;
+ LOG.error("Failed to load keystore '" + decryptionKeyManager.getName() + "'", e);
+ throw new IllegalConfigurationException("Failed to load keystore '" + decryptionKeyManager.getName() + "'");
+ }
+
+ return decryptionKeyManager;
+
+ }
+
+ public ReplayCache getTokenReplayCache() {
+ if (replayCache != null) {
+ return replayCache;
+ }
+ String replayCacheString = config.getTokenReplayCache();
+ String cacheKey = CACHE_KEY_PREFIX + "-" + config.getName();
+ ReplayCacheFactory replayCacheFactory = ReplayCacheFactory.newInstance();
+ if (replayCacheString == null || "".equals(replayCacheString)) {
+ replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
+ } else {
+ try {
+ Class<?> replayCacheClass = Loader.loadClass(replayCacheString);
+ replayCache = (ReplayCache) replayCacheClass.newInstance();
+ } catch (ClassNotFoundException e) {
+ replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
+ } catch (InstantiationException e) {
+ replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
+ } catch (IllegalAccessException e) {
+ replayCache = replayCacheFactory.newReplayCache(cacheKey, "fediz-ehcache.xml");
+ }
+ }
+ return replayCache;
+ }
+
+ public String getName() {
+ return config.getName();
+ }
+
+
+ public boolean isDetectExpiredTokens() {
+ return detectExpiredTokens;
+ }
+
+ public void setDetectExpiredTokens(boolean detectExpiredTokens) {
+ this.detectExpiredTokens = detectExpiredTokens;
+ }
+
+
+ public boolean isDetectReplayedTokens() {
+ return detectReplayedTokens;
+ }
+
+ public void setDetectReplayedTokens(boolean detectReplayedTokens) {
+ this.detectReplayedTokens = detectReplayedTokens;
+ }
+
+ public void setRelativePath(String relativePath) {
+ this.relativePath = relativePath;
+ }
+
+ public String getRelativePath() {
+ return relativePath;
+ }
+
+ @Override
+ public void close() throws IOException {
+ if (replayCache != null) {
+ replayCache.close();
+ }
+ }
+
+ private Properties createCryptoProperties(TrustManagersType tm) {
+ String trustStoreFile = null;
+ String trustStorePw = null;
+ KeyStoreType ks = tm.getKeyStore();
+ if (ks.getFile() != null && !ks.getFile().isEmpty()) {
+ trustStoreFile = ks.getFile();
+ trustStorePw = ks.getPassword();
+ } else {
+ throw new IllegalStateException("No certificate store configured");
+ }
+ File f = new File(trustStoreFile);
+ if (!f.exists() && getRelativePath() != null && !getRelativePath().isEmpty()) {
+ trustStoreFile = getRelativePath().concat(File.separator + trustStoreFile);
+ }
+
+ if (trustStoreFile == null || trustStoreFile.isEmpty()) {
+ throw new IllegalConfigurationException("truststoreFile not configured");
+ }
+ if (trustStorePw == null || trustStorePw.isEmpty()) {
+ throw new IllegalConfigurationException("trustStorePw not configured");
+ }
+ Properties p = new Properties();
+ p.put("org.apache.ws.security.crypto.provider",
+ "org.apache.ws.security.components.crypto.Merlin");
+ p.put("org.apache.ws.security.crypto.merlin.keystore.type", "jks");
+ p.put("org.apache.ws.security.crypto.merlin.keystore.password",
+ trustStorePw);
+ p.put("org.apache.ws.security.crypto.merlin.keystore.file",
+ trustStoreFile);
+ return p;
+ }
+
+ private Properties createCryptoProperties(KeyManagersType km) {
+ String keyStoreFile = null;
+ String keyStorePw = null;
+ String keyType = "jks";
+ KeyStoreType ks = km.getKeyStore();
+ if (ks.getFile() != null && !ks.getFile().isEmpty()) {
+ keyStoreFile = ks.getFile();
+ keyStorePw = ks.getPassword();
+ } else {
+ throw new IllegalStateException("No certificate store configured");
+ }
+ File f = new File(keyStoreFile);
+ if (!f.exists() && getRelativePath() != null && !getRelativePath().isEmpty()) {
+ keyStoreFile = getRelativePath().concat(File.separator + keyStoreFile);
+ }
+
+ if (keyStoreFile == null || keyStoreFile.isEmpty()) {
+ throw new IllegalConfigurationException("truststoreFile not configured");
+ }
+ if (keyStorePw == null || keyStorePw.isEmpty()) {
+ throw new IllegalConfigurationException("trustStorePw not configured");
+ }
+ if (ks.getType() != null) {
+ keyType = ks.getType();
+ }
+
+ Properties p = new Properties();
+ p.put("org.apache.ws.security.crypto.provider",
+ "org.apache.ws.security.components.crypto.Merlin");
+ p.put("org.apache.ws.security.crypto.merlin.keystore.type", keyType);
+ p.put("org.apache.ws.security.crypto.merlin.keystore.password",
+ keyStorePw);
+ p.put("org.apache.ws.security.crypto.merlin.keystore.file",
+ keyStoreFile);
+ return p;
+ }
+
+ private X509Certificate readX509Certificate(String filename) {
+ Certificate cert = null;
+ BufferedInputStream bis = null;
+ try {
+ ClassLoader cl = getClassloader();
+ if (cl == null) {
+ cl = Thread.currentThread().getContextClassLoader();
+ }
+ InputStream is = Merlin.loadInputStream(cl, filename);
+
+ bis = new BufferedInputStream(is);
+
+ CertificateFactory cf = CertificateFactory.getInstance("X.509");
+
+ if (bis.available() > 0) {
+ cert = cf.generateCertificate(bis);
+ if (!(cert instanceof X509Certificate)) {
+ LOG.error("Certificate " + filename + " is not of type X509Certificate");
+ throw new IllegalConfigurationException("Certificate "
+ + filename + " is not of type X509Certificate");
+ }
+ if (bis.available() > 0) {
+ LOG.warn("There are more certificates configured in " + filename + ". Only first is parsed");
+ }
+ return (X509Certificate)cert;
+ } else {
+ LOG.error("No bytes can be read in certificate file " + filename);
+ throw new IllegalConfigurationException("No bytes can be read in certificate file " + filename);
+ }
+ } catch (IllegalConfigurationException ex) {
+ throw ex;
+ } catch (Exception ex) {
+ LOG.error("Failed to read certificate file " + filename, ex);
+ throw new IllegalConfigurationException("Failed to read certificate file " + filename, ex);
+ } finally {
+ try {
+ bis.close();
+ } catch (IOException ex) {
+ LOG.error("Failed to close certificate file " + filename, ex);
+ }
+ }
+ }
+
+ public ClassLoader getClassloader() {
+ return classloader;
+ }
+
+ public void setClassloader(ClassLoader classloader) {
+ this.classloader = classloader;
+ }
+
+
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/Protocol.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/Protocol.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/Protocol.java
index 75577c9..1683e6e 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/Protocol.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/Protocol.java
@@ -19,10 +19,21 @@
package org.apache.cxf.fediz.core.config;
+import javax.security.auth.callback.CallbackHandler;
+
+import org.apache.cxf.fediz.core.config.jaxb.ArgumentType;
+import org.apache.cxf.fediz.core.config.jaxb.CallbackType;
import org.apache.cxf.fediz.core.config.jaxb.ProtocolType;
+import org.apache.cxf.fediz.core.util.ClassLoaderUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
public abstract class Protocol {
+ private static final Logger LOG = LoggerFactory.getLogger(Protocol.class);
+
private ProtocolType protocolType;
+ private ClassLoader classloader;
+ private Object issuer;
public Protocol(ProtocolType protocolType) {
super();
@@ -49,6 +60,72 @@ public abstract class Protocol {
return protocolType.toString();
}
+ public ClassLoader getClassloader() {
+ return classloader;
+ }
+
+ public void setClassloader(ClassLoader classloader) {
+ this.classloader = classloader;
+ }
+ public String getRoleDelimiter() {
+ return getProtocolType().getRoleDelimiter();
+ }
+
+ public void setRoleDelimiter(String value) {
+ getProtocolType().setRoleDelimiter(value);
+ }
+
+ public String getRoleURI() {
+ return getProtocolType().getRoleURI();
+ }
+
+ public void setRoleURI(String value) {
+ getProtocolType().setRoleURI(value);
+ }
+
+ public Object getIssuer() {
+ if (this.issuer != null) {
+ return this.issuer;
+ }
+ CallbackType cbt = getProtocolType().getIssuer();
+ this.issuer = loadCallbackType(cbt, "Issuer");
+ return this.issuer;
+ }
+
+ public void setIssuer(Object value) {
+ final boolean isString = value instanceof String;
+ final boolean isCallbackHandler = value instanceof CallbackHandler;
+ if (isString || isCallbackHandler) {
+ this.issuer = value;
+ } else {
+ LOG.error("Unsupported 'Issuer' object");
+ throw new IllegalArgumentException("Unsupported 'Issuer' object. Type must be "
+ + "java.lang.String or javax.security.auth.callback.CallbackHandler.");
+ }
+ }
+
+ protected Object loadCallbackType(CallbackType cbt, String name) {
+ if (cbt == null) {
+ return null;
+ }
+ if (cbt.getType() == null || cbt.getType().equals(ArgumentType.STRING)) {
+ return new String(cbt.getValue());
+ } else if (cbt.getType().equals(ArgumentType.CLASS)) {
+ try {
+ if (getClassloader() == null) {
+ return ClassLoaderUtils.loadClass(cbt.getValue(), this.getClass()).newInstance();
+ } else {
+ return getClassloader().loadClass(cbt.getValue()).newInstance();
+ }
+ } catch (Exception e) {
+ LOG.error("Failed to create instance of " + cbt.getValue(), e);
+ throw new IllegalStateException("Failed to create instance of " + cbt.getValue());
+ }
+ } else {
+ LOG.error("Only String and Class are supported for '" + name + "'");
+ throw new IllegalStateException("Only String and Class are supported for '" + name + "'");
+ }
+ }
}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java
new file mode 100644
index 0000000..b334537
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/config/SAMLProtocol.java
@@ -0,0 +1,61 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.config;
+
+import org.apache.cxf.fediz.core.config.jaxb.ProtocolType;
+
+public class SAMLProtocol extends Protocol {
+
+ // private static final Logger LOG = LoggerFactory.getLogger(SAMLProtocol.class);
+
+ public SAMLProtocol(ProtocolType protocolType) {
+ super(protocolType);
+
+ /*FederationProtocolType fp = (FederationProtocolType)protocolType;
+ if (fp.getTokenValidators() != null && fp.getTokenValidators().getValidator() != null) {
+ for (String validatorClassname : fp.getTokenValidators().getValidator()) {
+ Object obj = null;
+ try {
+ if (super.getClassloader() == null) {
+ obj = ClassLoaderUtils.loadClass(validatorClassname, this.getClass()).newInstance();
+ } else {
+ obj = super.getClassloader().loadClass(validatorClassname).newInstance();
+ }
+ } catch (Exception ex) {
+ LOG.error("Failed to instantiate TokenValidator implementation class: '"
+ + validatorClassname + "'\n" + ex.getClass().getCanonicalName() + ": " + ex.getMessage());
+ }
+ if (obj instanceof TokenValidator) {
+ validators.add((TokenValidator)obj);
+ } else if (obj != null) {
+ LOG.error("Invalid TokenValidator implementation class: '" + validatorClassname + "'");
+ }
+ }
+ }*/
+
+ // add SAMLTokenValidator as the last one
+ // Fediz chooses the first validator in the list if its
+ // canHandleToken or canHandleTokenType method return true
+ //SAMLTokenValidator validator = new SAMLTokenValidator();
+ //validators.add(validators.size(), validator);
+ }
+
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/metadata/MetadataWriter.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/metadata/MetadataWriter.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/metadata/MetadataWriter.java
index 9ef969c..c3c97ed 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/metadata/MetadataWriter.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/metadata/MetadataWriter.java
@@ -34,8 +34,8 @@ import javax.xml.stream.XMLStreamWriter;
import org.w3c.dom.Document;
import org.apache.cxf.fediz.core.config.Claim;
-import org.apache.cxf.fediz.core.config.FederationContext;
import org.apache.cxf.fediz.core.config.FederationProtocol;
+import org.apache.cxf.fediz.core.config.FedizContext;
import org.apache.cxf.fediz.core.config.Protocol;
import org.apache.cxf.fediz.core.exception.ProcessingException;
import org.apache.cxf.fediz.core.util.DOMUtils;
@@ -61,7 +61,7 @@ public class MetadataWriter {
}
//CHECKSTYLE:OFF
- public Document getMetaData(FederationContext config) throws ProcessingException {
+ public Document getMetaData(FedizContext config) throws ProcessingException {
try {
ByteArrayOutputStream bout = new ByteArrayOutputStream(4096);
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java
new file mode 100644
index 0000000..12f4669
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java
@@ -0,0 +1,681 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.processor;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.text.DateFormat;
+import java.text.ParseException;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.servlet.http.HttpServletRequest;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.apache.cxf.fediz.core.FederationConstants;
+import org.apache.cxf.fediz.core.TokenValidator;
+import org.apache.cxf.fediz.core.TokenValidatorRequest;
+import org.apache.cxf.fediz.core.TokenValidatorResponse;
+import org.apache.cxf.fediz.core.config.FederationProtocol;
+import org.apache.cxf.fediz.core.config.FedizContext;
+import org.apache.cxf.fediz.core.config.KeyManager;
+import org.apache.cxf.fediz.core.exception.ProcessingException;
+import org.apache.cxf.fediz.core.exception.ProcessingException.TYPE;
+import org.apache.cxf.fediz.core.metadata.MetadataWriter;
+import org.apache.cxf.fediz.core.spi.FreshnessCallback;
+import org.apache.cxf.fediz.core.spi.HomeRealmCallback;
+import org.apache.cxf.fediz.core.spi.IDPCallback;
+import org.apache.cxf.fediz.core.spi.RealmCallback;
+import org.apache.cxf.fediz.core.spi.SignInQueryCallback;
+import org.apache.cxf.fediz.core.spi.WAuthCallback;
+import org.apache.cxf.fediz.core.spi.WReqCallback;
+import org.apache.cxf.fediz.core.util.DOMUtils;
+import org.apache.wss4j.common.ext.WSPasswordCallback;
+import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.dom.WSConstants;
+import org.apache.wss4j.dom.WSDataRef;
+import org.apache.wss4j.dom.WSDocInfo;
+import org.apache.wss4j.dom.WSSConfig;
+import org.apache.wss4j.dom.WSSecurityEngine;
+import org.apache.wss4j.dom.WSSecurityEngineResult;
+import org.apache.wss4j.dom.handler.RequestData;
+import org.apache.wss4j.dom.processor.EncryptedDataProcessor;
+import org.apache.wss4j.dom.processor.Processor;
+import org.apache.wss4j.dom.util.XmlSchemaDateFormat;
+import org.joda.time.DateTime;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class FederationProcessorImpl implements FedizProcessor {
+
+ private static final Logger LOG = LoggerFactory.getLogger(FederationProcessorImpl.class);
+
+ /**
+ * Default constructor
+ */
+ public FederationProcessorImpl() {
+ super();
+ }
+
+ @Override
+ public FedizResponse processRequest(FedizRequest request,
+ FedizContext config)
+ throws ProcessingException {
+
+ if (!(config.getProtocol() instanceof FederationProtocol)) {
+ LOG.error("Unsupported protocol");
+ throw new IllegalStateException("Unsupported protocol");
+ }
+ FedizResponse response = null;
+ if (FederationConstants.ACTION_SIGNIN.equals(request.getWa())) {
+ response = this.processSignInRequest(request, config);
+ } else {
+ LOG.error("Invalid action '" + request.getWa() + "'");
+ throw new ProcessingException(TYPE.INVALID_REQUEST);
+ }
+ return response;
+ }
+
+
+ public Document getMetaData(FedizContext config) throws ProcessingException {
+ return new MetadataWriter().getMetaData(config);
+ }
+
+ protected FedizResponse processSignInRequest(
+ FedizRequest request, FedizContext config)
+ throws ProcessingException {
+
+ byte[] wresult = request.getWresult().getBytes();
+
+ Document doc = null;
+ Element el = null;
+ try {
+ doc = DOMUtils.readXml(new ByteArrayInputStream(wresult));
+ el = doc.getDocumentElement();
+
+ } catch (Exception e) {
+ LOG.warn("Failed to parse wresult: " + e.getMessage());
+ throw new ProcessingException(TYPE.INVALID_REQUEST);
+ }
+
+ if ("RequestSecurityTokenResponseCollection".equals(el.getLocalName())) {
+ el = DOMUtils.getFirstElement(el);
+ }
+ if (!"RequestSecurityTokenResponse".equals(el.getLocalName())) {
+ LOG.warn("Unexpected root element of wresult: '" + el.getLocalName() + "'");
+ throw new ProcessingException(TYPE.INVALID_REQUEST);
+ }
+ el = DOMUtils.getFirstElement(el);
+ Element rst = null;
+ Element lifetimeElem = null;
+ String tt = null;
+
+ while (el != null) {
+ String ln = el.getLocalName();
+ if (FederationConstants.WS_TRUST_13_NS.equals(el.getNamespaceURI())
+ || FederationConstants.WS_TRUST_2005_02_NS.equals(el.getNamespaceURI())) {
+ if ("Lifetime".equals(ln)) {
+ lifetimeElem = el;
+ } else if ("RequestedSecurityToken".equals(ln)) {
+ rst = DOMUtils.getFirstElement(el);
+ } else if ("TokenType".equals(ln)) {
+ tt = DOMUtils.getContent(el);
+ }
+ }
+ el = DOMUtils.getNextElement(el);
+ }
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("RST: " + ((rst != null) ? rst.toString() : "null"));
+ LOG.debug("Lifetime: "
+ + ((lifetimeElem != null) ? lifetimeElem.toString()
+ : "null"));
+ LOG.debug("Tokentype: " + ((tt != null) ? tt.toString() : "null"));
+ }
+ if (rst == null) {
+ LOG.warn("RequestedSecurityToken element not found in wresult");
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ LifeTime lifeTime = null;
+ if (lifetimeElem != null) {
+ lifeTime = processLifeTime(lifetimeElem);
+ }
+
+ if (config.isDetectExpiredTokens() && lifeTime != null) {
+ Date currentDate = new Date();
+ if (currentDate.after(lifeTime.getExpires())) {
+ LOG.warn("RSTR Lifetime expired");
+ throw new ProcessingException(TYPE.TOKEN_EXPIRED);
+ }
+ DateTime currentTime = new DateTime();
+ DateTime validFrom = new DateTime(lifeTime.created);
+ currentTime = currentTime.plusSeconds(config.getMaximumClockSkew().intValue());
+ if (validFrom.isAfter(currentTime)) {
+ LOG.debug("RSTR Lifetime not yet valid");
+ throw new ProcessingException(TYPE.TOKEN_INVALID);
+ }
+ }
+
+ // Check to see if RST is encrypted
+ if ("EncryptedData".equals(rst.getLocalName())
+ && WSConstants.ENC_NS.equals(rst.getNamespaceURI())) {
+ Element decryptedRST = decryptEncryptedRST(rst, config);
+ if (decryptedRST != null) {
+ rst = decryptedRST;
+ }
+ }
+
+ TokenValidatorResponse validatorResponse = null;
+ List<TokenValidator> validators = ((FederationProtocol)config.getProtocol()).getTokenValidators();
+ for (TokenValidator validator : validators) {
+ boolean canHandle = false;
+ if (tt != null) {
+ canHandle = validator.canHandleTokenType(tt);
+ } else {
+ canHandle = validator.canHandleToken(rst);
+ }
+ if (canHandle) {
+ try {
+ TokenValidatorRequest validatorRequest =
+ new TokenValidatorRequest(rst, request.getCerts());
+ validatorResponse = validator.validateAndProcessToken(validatorRequest, config);
+ } catch (ProcessingException ex) {
+ throw ex;
+ } catch (Exception ex) {
+ LOG.warn("Failed to validate token", ex);
+ throw new ProcessingException(TYPE.TOKEN_INVALID);
+ }
+ break;
+ } else {
+ LOG.warn("No security token validator found for '" + tt + "'");
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ }
+
+ // Check whether token already used for signin
+ if (validatorResponse.getUniqueTokenId() != null
+ && config.isDetectReplayedTokens()) {
+ // Check whether token has already been processed once, prevent
+ // replay attack
+ if (!config.getTokenReplayCache().contains(validatorResponse.getUniqueTokenId())) {
+ // not cached
+ Date expires = null;
+ if (lifeTime != null && lifeTime.getExpires() != null) {
+ expires = lifeTime.getExpires();
+ } else {
+ expires = validatorResponse.getExpires();
+ }
+ if (expires != null) {
+ Date currentTime = new Date();
+ long ttl = expires.getTime() - currentTime.getTime();
+ config.getTokenReplayCache().add(validatorResponse.getUniqueTokenId(), ttl / 1000L);
+ } else {
+ config.getTokenReplayCache().add(validatorResponse.getUniqueTokenId());
+ }
+ } else {
+ LOG.error("Replay attack with token id: " + validatorResponse.getUniqueTokenId());
+ throw new ProcessingException("Replay attack with token id: "
+ + validatorResponse.getUniqueTokenId(), TYPE.TOKEN_REPLAY);
+ }
+ }
+
+ FedizResponse fedResponse = new FedizResponse(
+ validatorResponse.getUsername(), validatorResponse.getIssuer(),
+ validatorResponse.getRoles(), validatorResponse.getClaims(),
+ validatorResponse.getAudience(),
+ (lifeTime != null) ? lifeTime.getCreated() : null,
+ (lifeTime != null) ? lifeTime.getExpires() : null, rst,
+ validatorResponse.getUniqueTokenId());
+
+ return fedResponse;
+ }
+
+ private Element decryptEncryptedRST(
+ Element encryptedRST,
+ FedizContext config
+ ) throws ProcessingException {
+
+ KeyManager decryptionKeyManager = config.getDecryptionKey();
+ if (decryptionKeyManager == null || decryptionKeyManager.getCrypto() == null) {
+ LOG.debug(
+ "We must have a decryption Crypto instance configured to decrypt encrypted tokens"
+ );
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ String keyPassword = decryptionKeyManager.getKeyPassword();
+ if (keyPassword == null) {
+ LOG.debug(
+ "We must have a decryption key password to decrypt encrypted tokens"
+ );
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+
+ EncryptedDataProcessor proc = new EncryptedDataProcessor();
+ WSDocInfo docInfo = new WSDocInfo(encryptedRST.getOwnerDocument());
+ RequestData data = new RequestData();
+
+ // Disable WSS4J processing of the (decrypted) SAML Token
+ WSSConfig wssConfig = WSSConfig.getNewInstance();
+ wssConfig.setProcessor(WSSecurityEngine.SAML_TOKEN, new NOOpProcessor());
+ wssConfig.setProcessor(WSSecurityEngine.SAML2_TOKEN, new NOOpProcessor());
+ data.setWssConfig(wssConfig);
+
+ data.setDecCrypto(decryptionKeyManager.getCrypto());
+ data.setCallbackHandler(new DecryptionCallbackHandler(keyPassword));
+ try {
+ List<WSSecurityEngineResult> result =
+ proc.handleToken(encryptedRST, data, docInfo);
+ if (result.size() > 0) {
+ @SuppressWarnings("unchecked")
+ List<WSDataRef> dataRefs =
+ (List<WSDataRef>)result.get(result.size() - 1).get(WSSecurityEngineResult.TAG_DATA_REF_URIS);
+ if (dataRefs != null && dataRefs.size() > 0) {
+ return dataRefs.get(0).getProtectedElement();
+ }
+ }
+ } catch (WSSecurityException e) {
+ LOG.debug(e.getMessage(), e);
+ throw new ProcessingException(TYPE.TOKEN_INVALID);
+ }
+ return null;
+ }
+
+ private LifeTime processLifeTime(Element lifetimeElem) throws ProcessingException {
+ try {
+ Element createdElem = DOMUtils.getFirstChildWithName(lifetimeElem,
+ WSConstants.WSU_NS, WSConstants.CREATED_LN);
+ DateFormat zulu = new XmlSchemaDateFormat();
+
+ Date created = zulu.parse(DOMUtils.getContent(createdElem));
+
+ Element expiresElem = DOMUtils.getFirstChildWithName(lifetimeElem,
+ WSConstants.WSU_NS, WSConstants.EXPIRES_LN);
+ Date expires = zulu.parse(DOMUtils.getContent(expiresElem));
+
+ return new LifeTime(created, expires);
+
+ } catch (ParseException e) {
+ LOG.error("Failed to parse lifetime element in wresult: " + e.getMessage());
+ throw new ProcessingException(TYPE.BAD_REQUEST);
+ }
+ }
+
+ public class LifeTime {
+
+ private Date created;
+ private Date expires;
+
+ public LifeTime(Date created, Date expires) {
+ this.created = created;
+ this.expires = expires;
+ }
+
+ public Date getCreated() {
+ return created;
+ }
+
+ public Date getExpires() {
+ return expires;
+ }
+
+ }
+
+ @Override
+ public String createSignInRequest(HttpServletRequest request, FedizContext config)
+ throws ProcessingException {
+
+ String redirectURL = null;
+ try {
+ if (!(config.getProtocol() instanceof FederationProtocol)) {
+ LOG.error("Unsupported protocol");
+ throw new IllegalStateException("Unsupported protocol");
+ }
+
+ String issuerURL = resolveIssuer(request, config);
+ LOG.info("Issuer url: " + issuerURL);
+ if (issuerURL != null && issuerURL.length() > 0) {
+ redirectURL = issuerURL;
+ }
+
+ String wAuth = resolveAuthenticationType(request, config);
+ LOG.info("WAuth: " + wAuth);
+
+ String wReq = resolveRequest(request, config);
+ LOG.info("WReq: " + wReq);
+
+ String homeRealm = resolveHomeRealm(request, config);
+ LOG.info("HomeRealm: " + homeRealm);
+
+ String freshness = resolveFreshness(request, config);
+ LOG.info("Freshness: " + freshness);
+
+ String signInQuery = resolveSignInQuery(request, config);
+ LOG.info("SignIn Query: " + signInQuery);
+
+
+ StringBuilder sb = new StringBuilder();
+ sb.append(FederationConstants.PARAM_ACTION).append('=').append(FederationConstants.ACTION_SIGNIN);
+
+ String reply = ((FederationProtocol)config.getProtocol()).getReply();
+ if (reply == null || reply.length() == 0) {
+ reply = request.getRequestURL().toString();
+ } else {
+ try {
+ new URL(reply);
+ } catch (MalformedURLException ex) {
+ if (reply.startsWith("/")) {
+ reply = extractFullContextPath(request).concat(reply.substring(1));
+ } else {
+ reply = extractFullContextPath(request).concat(reply);
+ }
+ }
+ }
+
+ LOG.debug("wreply=" + reply);
+ sb.append('&').append(FederationConstants.PARAM_REPLY).append('=');
+ sb.append(URLEncoder.encode(reply, "UTF-8"));
+
+ String realm = resolveWTRealm(request, config);
+ LOG.debug("wtrealm=" + realm);
+
+ //add wtrealm parameter
+ sb.append('&').append(FederationConstants.PARAM_TREALM).append('=')
+ .append(URLEncoder.encode(realm, "UTF-8"));
+
+ // add authentication type parameter wauth if set
+ if (wAuth != null && wAuth.length() > 0) {
+ sb.append('&').append(FederationConstants.PARAM_AUTH_TYPE).append('=')
+ .append(URLEncoder.encode(wAuth, "UTF-8"));
+ }
+
+ // add tokenRequest parameter wreq if set
+ if (wReq != null && wReq.length() > 0) {
+ sb.append('&').append(FederationConstants.PARAM_REQUEST).append('=')
+ .append(URLEncoder.encode(wReq, "UTF-8"));
+ }
+
+ // add home realm parameter whr if set
+ if (homeRealm != null && homeRealm.length() > 0) {
+ sb.append('&').append(FederationConstants.PARAM_HOME_REALM).append('=')
+ .append(URLEncoder.encode(homeRealm, "UTF-8"));
+ }
+
+ // add freshness parameter wfresh if set
+ if (freshness != null && freshness.length() > 0) {
+ sb.append('&').append(FederationConstants.PARAM_FRESHNESS).append('=')
+ .append(URLEncoder.encode(freshness, "UTF-8"));
+ }
+
+ // add current time parameter wct
+ Date creationTime = new Date();
+ XmlSchemaDateFormat fmt = new XmlSchemaDateFormat();
+ String wct = fmt.format(creationTime);
+ sb.append('&').append(FederationConstants.PARAM_CURRENT_TIME).append('=')
+ .append(URLEncoder.encode(wct, "UTF-8"));
+
+ // add signin query extensions
+ if (signInQuery != null && signInQuery.length() > 0) {
+ sb.append('&').append(signInQuery);
+ }
+
+ redirectURL = redirectURL + "?" + sb.toString();
+ } catch (Exception ex) {
+ LOG.error("Failed to create SignInRequest", ex);
+ throw new ProcessingException("Failed to create SignInRequest");
+ }
+ return redirectURL;
+ }
+
+ @Override
+ public String createSignOutRequest(HttpServletRequest request, FedizContext config)
+ throws ProcessingException {
+
+ String redirectURL = null;
+ try {
+ if (!(config.getProtocol() instanceof FederationProtocol)) {
+ LOG.error("Unsupported protocol");
+ throw new IllegalStateException("Unsupported protocol");
+ }
+
+ String issuerURL = resolveIssuer(request, config);
+ LOG.info("Issuer url: " + issuerURL);
+ if (issuerURL != null && issuerURL.length() > 0) {
+ redirectURL = issuerURL;
+ }
+
+ StringBuilder sb = new StringBuilder();
+ sb.append(FederationConstants.PARAM_ACTION).append('=').append(FederationConstants.ACTION_SIGNOUT);
+
+ String logoutRedirectTo = config.getLogoutRedirectTo();
+ if (logoutRedirectTo != null && !logoutRedirectTo.isEmpty()) {
+
+ if (logoutRedirectTo.startsWith("/")) {
+ logoutRedirectTo = extractFullContextPath(request).concat(logoutRedirectTo.substring(1));
+ } else {
+ logoutRedirectTo = extractFullContextPath(request).concat(logoutRedirectTo);
+ }
+
+ LOG.debug("wreply=" + logoutRedirectTo);
+
+ sb.append('&').append(FederationConstants.PARAM_REPLY).append('=');
+ sb.append(URLEncoder.encode(logoutRedirectTo, "UTF-8"));
+ }
+
+ redirectURL = redirectURL + "?" + sb.toString();
+ } catch (Exception ex) {
+ LOG.error("Failed to create SignInRequest", ex);
+ throw new ProcessingException("Failed to create SignInRequest");
+ }
+ return redirectURL;
+ }
+
+ private String resolveSignInQuery(HttpServletRequest request, FedizContext config)
+ throws IOException, UnsupportedCallbackException, UnsupportedEncodingException {
+ Object signInQueryObj = ((FederationProtocol)config.getProtocol()).getSignInQuery();
+ String signInQuery = null;
+ if (signInQueryObj != null) {
+ if (signInQueryObj instanceof String) {
+ signInQuery = (String)signInQueryObj;
+ } else if (signInQueryObj instanceof CallbackHandler) {
+ CallbackHandler frCB = (CallbackHandler)signInQueryObj;
+ SignInQueryCallback callback = new SignInQueryCallback(request);
+ frCB.handle(new Callback[] {callback});
+ Map<String, String> signInQueryMap = callback.getSignInQueryParamMap();
+ StringBuilder sbQuery = new StringBuilder();
+ for (String key : signInQueryMap.keySet()) {
+ if (sbQuery.length() > 0) {
+ sbQuery.append("&");
+ }
+ sbQuery.append(key).append('=').
+ append(URLEncoder.encode(signInQueryMap.get(key), "UTF-8"));
+ }
+ signInQuery = sbQuery.toString();
+
+ }
+ }
+ return signInQuery;
+ }
+
+ private String resolveFreshness(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object freshnessObj = ((FederationProtocol)config.getProtocol()).getFreshness();
+ String freshness = null;
+ if (freshnessObj != null) {
+ if (freshnessObj instanceof String) {
+ freshness = (String)freshnessObj;
+ } else if (freshnessObj instanceof CallbackHandler) {
+ CallbackHandler frCB = (CallbackHandler)freshnessObj;
+ FreshnessCallback callback = new FreshnessCallback(request);
+ frCB.handle(new Callback[] {callback});
+ freshness = callback.getFreshness();
+ }
+ }
+ return freshness;
+ }
+
+ private String resolveHomeRealm(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object homeRealmObj = ((FederationProtocol)config.getProtocol()).getHomeRealm();
+ String homeRealm = null;
+ if (homeRealmObj != null) {
+ if (homeRealmObj instanceof String) {
+ homeRealm = (String)homeRealmObj;
+ } else if (homeRealmObj instanceof CallbackHandler) {
+ CallbackHandler hrCB = (CallbackHandler)homeRealmObj;
+ HomeRealmCallback callback = new HomeRealmCallback(request);
+ hrCB.handle(new Callback[] {callback});
+ homeRealm = callback.getHomeRealm();
+ }
+ }
+ return homeRealm;
+ }
+
+ private String resolveAuthenticationType(HttpServletRequest request, FedizContext config)
+ throws IOException, UnsupportedCallbackException {
+ Object wAuthObj = ((FederationProtocol)config.getProtocol()).getAuthenticationType();
+ String wAuth = null;
+ if (wAuthObj != null) {
+ if (wAuthObj instanceof String) {
+ wAuth = (String)wAuthObj;
+ } else if (wAuthObj instanceof CallbackHandler) {
+ CallbackHandler wauthCB = (CallbackHandler)wAuthObj;
+ WAuthCallback callback = new WAuthCallback(request);
+ wauthCB.handle(new Callback[] {callback});
+ wAuth = callback.getWauth();
+ }
+ }
+ return wAuth;
+ }
+
+ private String resolveRequest(HttpServletRequest request, FedizContext config)
+ throws IOException, UnsupportedCallbackException {
+ Object wReqObj = ((FederationProtocol)config.getProtocol()).getRequest();
+ String wReq = null;
+ if (wReqObj != null) {
+ if (wReqObj instanceof String) {
+ wReq = (String)wReqObj;
+ } else if (wReqObj instanceof CallbackHandler) {
+ CallbackHandler wauthCB = (CallbackHandler)wReqObj;
+ WReqCallback callback = new WReqCallback(request);
+ wauthCB.handle(new Callback[] {callback});
+ wReq = callback.getWreq();
+ }
+ }
+ return wReq;
+ }
+
+ private String resolveIssuer(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object issuerObj = ((FederationProtocol)config.getProtocol()).getIssuer();
+ String issuerURL = null;
+ if (issuerObj instanceof String) {
+ issuerURL = (String)issuerObj;
+ } else if (issuerObj instanceof CallbackHandler) {
+ CallbackHandler issuerCB = (CallbackHandler)issuerObj;
+ IDPCallback callback = new IDPCallback(request);
+ issuerCB.handle(new Callback[] {callback});
+ issuerURL = callback.getIssuerUrl().toString();
+ }
+ return issuerURL;
+ }
+
+ private String resolveWTRealm(HttpServletRequest request, FedizContext config) throws IOException,
+ UnsupportedCallbackException {
+ Object wtRealmObj = ((FederationProtocol)config.getProtocol()).getRealm();
+ String wtRealm = null;
+ if (wtRealmObj != null) {
+ if (wtRealmObj instanceof String) {
+ wtRealm = (String)wtRealmObj;
+ } else if (wtRealmObj instanceof CallbackHandler) {
+ CallbackHandler hrCB = (CallbackHandler)wtRealmObj;
+ RealmCallback callback = new RealmCallback(request);
+ hrCB.handle(new Callback[] {callback});
+ wtRealm = callback.getRealm();
+ }
+ } else {
+ wtRealm = extractFullContextPath(request); //default value
+ }
+ return wtRealm;
+ }
+
+
+ private String extractFullContextPath(HttpServletRequest request) throws MalformedURLException {
+ String result = null;
+ String contextPath = request.getContextPath();
+ String requestUrl = request.getRequestURL().toString();
+ String requestPath = new URL(requestUrl).getPath();
+ // Cut request path of request url and add context path if not ROOT
+ if (requestPath != null && requestPath.length() > 0) {
+ int lastIndex = requestUrl.lastIndexOf(requestPath);
+ result = requestUrl.substring(0, lastIndex);
+ } else {
+ result = requestUrl;
+ }
+ if (contextPath != null && contextPath.length() > 0) {
+ // contextPath contains starting slash
+ result = result + contextPath + "/";
+ } else {
+ result = result + "/";
+ }
+ return result;
+ }
+
+ private static class DecryptionCallbackHandler implements CallbackHandler {
+
+ private final String password;
+
+ public DecryptionCallbackHandler(String password) {
+ this.password = password;
+ }
+
+ @Override
+ public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
+ for (int i = 0; i < callbacks.length; i++) {
+ if (callbacks[i] instanceof WSPasswordCallback) {
+ WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
+ pc.setPassword(password);
+ } else {
+ throw new UnsupportedCallbackException(callbacks[i], "Unrecognized Callback");
+ }
+ }
+ }
+
+ }
+
+ private static class NOOpProcessor implements Processor {
+
+ @Override
+ public List<WSSecurityEngineResult> handleToken(Element arg0, RequestData arg1, WSDocInfo arg2)
+ throws WSSecurityException {
+ return new ArrayList<WSSecurityEngineResult>();
+ }
+
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessor.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessor.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessor.java
new file mode 100644
index 0000000..1081f05
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessor.java
@@ -0,0 +1,38 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.processor;
+
+import javax.servlet.http.HttpServletRequest;
+import org.w3c.dom.Document;
+import org.apache.cxf.fediz.core.config.FedizContext;
+import org.apache.cxf.fediz.core.exception.ProcessingException;
+
+
+public interface FedizProcessor {
+
+ FedizResponse processRequest(FedizRequest request, FedizContext config) throws ProcessingException;
+
+ String createSignInRequest(HttpServletRequest request, FedizContext config) throws ProcessingException;
+
+ String createSignOutRequest(HttpServletRequest request, FedizContext config) throws ProcessingException;
+
+ Document getMetaData(FedizContext config) throws ProcessingException;
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessorFactory.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessorFactory.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessorFactory.java
new file mode 100644
index 0000000..c44a40b
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizProcessorFactory.java
@@ -0,0 +1,44 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.processor;
+
+import org.apache.cxf.fediz.core.config.FederationProtocol;
+import org.apache.cxf.fediz.core.config.Protocol;
+// import org.apache.cxf.fediz.core.config.SAMLProtocol;
+
+/**
+ * A Factory to return FedizProcessor instances depending on the Protocol
+ */
+public final class FedizProcessorFactory {
+
+ private FedizProcessorFactory() {
+ // complete
+ }
+
+ public static FedizProcessor newFedizProcessor(Protocol protocol) {
+ if (protocol instanceof FederationProtocol) {
+ return new FederationProcessorImpl();
+ } /*else if (protocol instanceof SAMLProtocol) {
+ return new SAMLProcessorImpl();
+ }*/
+ return null;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizRequest.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizRequest.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizRequest.java
new file mode 100644
index 0000000..bf296e5
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizRequest.java
@@ -0,0 +1,62 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.processor;
+
+import java.io.Serializable;
+import java.security.cert.Certificate;
+
+public class FedizRequest implements Serializable {
+
+ private static final long serialVersionUID = 1L;
+
+ private String wa;
+ private String wresult;
+ private String wct;
+ private Certificate[] certs;
+
+
+ public String getWct() {
+ return wct;
+ }
+ public void setWct(String wct) {
+ this.wct = wct;
+ }
+
+ public String getWa() {
+ return wa;
+ }
+ public void setWa(String wa) {
+ this.wa = wa;
+ }
+ public String getWresult() {
+ return wresult;
+ }
+ public void setWresult(String wresult) {
+ this.wresult = wresult;
+ }
+ public Certificate[] getCerts() {
+ return certs;
+ }
+ public void setCerts(Certificate[] certs) {
+ this.certs = certs;
+ }
+
+
+}
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/08af52b6/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java
----------------------------------------------------------------------
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java
new file mode 100644
index 0000000..b392ad2
--- /dev/null
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java
@@ -0,0 +1,109 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.fediz.core.processor;
+
+import java.io.Serializable;
+import java.util.Collections;
+import java.util.Date;
+import java.util.List;
+
+import org.w3c.dom.Element;
+
+import org.apache.cxf.fediz.core.Claim;
+
+public class FedizResponse implements Serializable {
+
+ private static final long serialVersionUID = 1L;
+
+ private String audience;
+ private String username;
+ private List<String> roles;
+ private String issuer;
+ private List<Claim> claims;
+ private Element token;
+ private String uniqueTokenId;
+
+ /**
+ * Created time
+ */
+ private Date tokenCreated;
+
+ /**
+ * Expiration time
+ */
+ private Date tokenExpires;
+
+ //CHECKSTYLE:OFF
+ public FedizResponse(String username, String issuer, List<String> roles, List<Claim> claims, String audience, Date created, Date expires, Element token, String uniqueTokenId) {
+ this.username = username;
+ this.issuer = issuer;
+ this.roles = roles;
+ this.claims = claims;
+ this.audience = audience;
+ this.tokenCreated = created;
+ this.tokenExpires = expires;
+ this.token = token;
+ this.uniqueTokenId = uniqueTokenId;
+ }
+
+ public String getUniqueTokenId() {
+ return uniqueTokenId;
+ }
+
+ public String getAudience() {
+ return audience;
+ }
+
+ public String getUsername() {
+ return username;
+ }
+
+ public List<String> getRoles() {
+ if (roles == null) {
+ return null;
+ }
+ return Collections.unmodifiableList(roles);
+ }
+
+ public String getIssuer() {
+ return issuer;
+ }
+
+ public List<Claim> getClaims() {
+ if (claims == null) {
+ return null;
+ }
+ return Collections.unmodifiableList(claims);
+ }
+
+ public Date getTokenCreated() {
+ return tokenCreated;
+ }
+
+ public Date getTokenExpires() {
+ return tokenExpires;
+ }
+
+ public Element getToken() {
+ return token;
+ }
+
+
+}