You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2019/01/30 11:49:23 UTC
svn commit: r1852518 - in /webservices/wss4j/trunk/ws-security-dom/src:
main/java/org/apache/wss4j/dom/action/
main/java/org/apache/wss4j/dom/message/
main/java/org/apache/wss4j/dom/message/token/
test/java/org/apache/wss4j/dom/message/
Author: coheigea
Date: Wed Jan 30 11:49:23 2019
New Revision: 1852518
URL: http://svn.apache.org/viewvc?rev=1852518&view=rev
Log:
Take salt out of the UsernameToken classes
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/UsernameTokenSignedAction.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecUsernameToken.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/token/UsernameToken.java
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTDerivedKeyTest.java
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTSignatureTest.java
Modified: webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/UsernameTokenSignedAction.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/UsernameTokenSignedAction.java?rev=1852518&r1=1852517&r2=1852518&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/UsernameTokenSignedAction.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/action/UsernameTokenSignedAction.java Wed Jan 30 11:49:23 2019
@@ -20,6 +20,7 @@
package org.apache.wss4j.dom.action;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.List;
import javax.security.auth.callback.CallbackHandler;
@@ -30,6 +31,7 @@ import org.apache.wss4j.common.Signature
import org.apache.wss4j.common.WSEncryptionPart;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.common.util.UsernameTokenUtil;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.handler.WSHandler;
import org.apache.wss4j.dom.message.WSSecUsernameToken;
@@ -67,12 +69,13 @@ public class UsernameTokenSignedAction i
int iterations = reqData.getDerivedKeyIterations();
boolean useMac = reqData.isUseDerivedKeyForMAC();
- builder.addDerivedKey(useMac, null, iterations);
+ builder.addDerivedKey(useMac, iterations);
builder.setUserInfo(reqData.getUsername(), passwordCallback.getPassword());
builder.addCreated();
builder.addNonce();
- builder.prepare();
+ byte[] salt = UsernameTokenUtil.generateSalt(useMac);
+ builder.prepare(salt);
// Now prepare to sign.
// First step: Get a WS Signature object and set config parameters
@@ -104,7 +107,7 @@ public class UsernameTokenSignedAction i
sign.setCustomTokenValueType(WSConstants.USERNAMETOKEN_NS + "#UsernameToken");
sign.setCustomTokenId(builder.getId());
- sign.setSecretKey(builder.getDerivedKey());
+ sign.setSecretKey(builder.getDerivedKey(salt));
sign.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
if (signatureToken.getDigestAlgorithm() != null) {
sign.setDigestAlgo(signatureToken.getDigestAlgorithm());
@@ -143,5 +146,7 @@ public class UsernameTokenSignedAction i
);
}
builder.prependToHeader();
+
+ Arrays.fill(salt, (byte)0);
}
}
Modified: webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecUsernameToken.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecUsernameToken.java?rev=1852518&r1=1852517&r2=1852518&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecUsernameToken.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecUsernameToken.java Wed Jan 30 11:49:23 2019
@@ -45,7 +45,6 @@ public class WSSecUsernameToken extends
private boolean created;
private boolean useDerivedKey;
private boolean useMac;
- private byte[] saltValue;
private int iteration = UsernameToken.DEFAULT_ITERATION;
private boolean passwordsAreEncoded;
private boolean precisionInMilliSeconds = true;
@@ -90,14 +89,12 @@ public class WSSecUsernameToken extends
/**
* Add a derived key to the UsernameToken
* @param useMac whether the derived key is to be used for a MAC or not
- * @param saltValue The salt value to use
* @param iteration The number of iterations to use in deriving a key
*/
- public void addDerivedKey(boolean useMac, byte[] saltValue, int iteration) {
+ public void addDerivedKey(boolean useMac, int iteration) {
passwordType = null;
useDerivedKey = true;
this.useMac = useMac;
- this.saltValue = saltValue;
if (iteration > 0) {
this.iteration = iteration;
}
@@ -110,10 +107,11 @@ public class WSSecUsernameToken extends
* to compute a derived key. The generation of this secret key is according
* to the UsernameTokenProfile 1.1 specification (section 4 - Key Derivation).
*
+ * @param saltValue The salt value to use
* @return Return the derived key of this token or null if <code>prepare()</code>
* was not called before.
*/
- public byte[] getDerivedKey() throws WSSecurityException {
+ public byte[] getDerivedKey(byte[] saltValue) throws WSSecurityException {
if (ut == null || !useDerivedKey) {
return null;
}
@@ -163,13 +161,19 @@ public class WSSecUsernameToken extends
* <code>prepare()</code> all parameters such as user, password,
* passwordType etc. must be set. A complete <code>UsernameToken</code> is
* constructed.
+ *
+ * @param The salt value to use if we are using a derived key
*/
public void prepare() {
+ prepare(null);
+ }
+
+ public void prepare(byte[] saltValue) {
ut = new UsernameToken(precisionInMilliSeconds, getDocument(), wsTimeSource, passwordType);
ut.setPasswordsAreEncoded(passwordsAreEncoded);
ut.setName(user);
if (useDerivedKey) {
- saltValue = ut.addSalt(getDocument(), saltValue, useMac);
+ ut.addSalt(getDocument(), saltValue, useMac);
ut.addIteration(getDocument(), iteration);
} else {
ut.setPassword(password);
@@ -217,17 +221,22 @@ public class WSSecUsernameToken extends
* <code>UsernameToken</code> is constructed and added to the
* <code>wsse:Security</code> header.
*
+ * @param the salt value to add if we are using a derived key
* @return Document with UsernameToken added
*/
- public Document build() {
+ public Document build(byte[] salt) {
LOG.debug("Begin add username token...");
- prepare();
+ prepare(salt);
prependToHeader();
return getDocument();
}
+ public Document build() {
+ return build(null);
+ }
+
/**
* Returns the <code>UsernameToken</code> element.
*
Modified: webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/token/UsernameToken.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/token/UsernameToken.java?rev=1852518&r1=1852517&r2=1852518&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/token/UsernameToken.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/token/UsernameToken.java Wed Jan 30 11:49:23 2019
@@ -331,21 +331,14 @@ public class UsernameToken {
}
/**
- * Adds and optionally creates a Salt element to this UsernameToken.
- *
- * If the <code>saltValue</code> is <code>null</code> the the method
- * generates a new salt. Otherwise it uses the the given value.
+ * Adds a Salt element to this UsernameToken.
*
* @param doc The Document for the UsernameToken
- * @param saltValue The salt to add, if null generate a new salt value
+ * @param saltValue The salt to add.
* @param mac If <code>true</code> then an optionally generated value is
* usable for a MAC
- * @return Returns the added salt
*/
- public byte[] addSalt(Document doc, byte[] saltValue, boolean mac) {
- if (saltValue == null) {
- saltValue = UsernameTokenUtil.generateSalt(mac);
- }
+ public void addSalt(Document doc, byte[] saltValue, boolean mac) {
elementSalt =
doc.createElementNS(
WSConstants.WSSE11_NS, WSConstants.WSSE11_PREFIX + ":" + WSConstants.SALT_LN
@@ -353,7 +346,6 @@ public class UsernameToken {
XMLUtils.setNamespace(element, WSConstants.WSSE11_NS, WSConstants.WSSE11_PREFIX);
elementSalt.appendChild(doc.createTextNode(org.apache.xml.security.utils.XMLUtils.encodeToString(saltValue)));
element.appendChild(elementSalt);
- return saltValue;
}
/**
Modified: webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTDerivedKeyTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTDerivedKeyTest.java?rev=1852518&r1=1852517&r2=1852518&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTDerivedKeyTest.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTDerivedKeyTest.java Wed Jan 30 11:49:23 2019
@@ -84,7 +84,8 @@ public class UTDerivedKeyTest {
UsernameToken usernameToken = new UsernameToken(true, doc, null);
usernameToken.setName("bob");
- byte[] salt = usernameToken.addSalt(doc, null, false);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ usernameToken.addSalt(doc, salt, false);
assertTrue(salt.length == 16);
assertTrue(salt[0] == 0x02);
byte[] utSalt = usernameToken.getSalt();
@@ -143,10 +144,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(false, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(false, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -196,10 +198,11 @@ public class UTDerivedKeyTest {
builder.setPasswordsAreEncoded(true);
byte[] bytes = MessageDigest.getInstance("SHA-1").digest("security".getBytes(StandardCharsets.UTF_8));
builder.setUserInfo("bob", org.apache.xml.security.utils.XMLUtils.encodeToString(bytes));
- builder.addDerivedKey(false, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(false, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -246,10 +249,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(false, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(false, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
derivedKey[5] = 'z';
derivedKey[6] = 'a';
assertTrue(derivedKey.length == 20);
@@ -298,10 +302,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("colm", "security");
- builder.addDerivedKey(false, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(false, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -347,10 +352,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(true, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(true, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(true);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -398,10 +404,11 @@ public class UTDerivedKeyTest {
builder.setPasswordsAreEncoded(true);
byte[] bytes = MessageDigest.getInstance("SHA-1").digest("security".getBytes(StandardCharsets.UTF_8));
builder.setUserInfo("bob", org.apache.xml.security.utils.XMLUtils.encodeToString(bytes));
- builder.addDerivedKey(true, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(true, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(true);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -456,10 +463,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(true, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(true, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(true);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
if (derivedKey[5] != 12) {
derivedKey[5] = 12;
} else {
@@ -506,10 +514,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("colm", "security");
- builder.addDerivedKey(true, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(true, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(true);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -605,7 +614,8 @@ public class UTDerivedKeyTest {
WSSConfig config = WSSConfig.getNewInstance();
usernameToken.setID(config.getIdAllocator().createId("UsernameToken-", usernameToken));
- byte[] salt = usernameToken.addSalt(doc, null, false);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ usernameToken.addSalt(doc, salt, false);
byte[] derivedKey = UsernameTokenUtil.generateDerivedKey("security", salt, 1000);
//
@@ -655,7 +665,8 @@ public class UTDerivedKeyTest {
usernameToken.setID(config.getIdAllocator().createId("UsernameToken-", usernameToken));
usernameToken.addIteration(doc, 500);
- byte[] salt = usernameToken.addSalt(doc, null, false);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ usernameToken.addSalt(doc, salt, false);
byte[] derivedKey = UsernameTokenUtil.generateDerivedKey("security", salt, 500);
//
@@ -713,10 +724,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(false, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(false, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
@@ -776,10 +788,11 @@ public class UTDerivedKeyTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(false, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(false, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(false);
+ builder.prepare(salt);
- byte[] derivedKey = builder.getDerivedKey();
+ byte[] derivedKey = builder.getDerivedKey(salt);
assertTrue(derivedKey.length == 20);
String tokenIdentifier = builder.getId();
Modified: webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTSignatureTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTSignatureTest.java?rev=1852518&r1=1852517&r2=1852518&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTSignatureTest.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/UTSignatureTest.java Wed Jan 30 11:49:23 2019
@@ -30,6 +30,7 @@ import org.apache.wss4j.dom.engine.WSSec
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
+import org.apache.wss4j.common.util.UsernameTokenUtil;
import org.apache.wss4j.common.util.XMLUtils;
import org.apache.wss4j.dom.handler.HandlerAction;
import org.apache.wss4j.dom.handler.RequestData;
@@ -80,13 +81,14 @@ public class UTSignatureTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("bob", "security");
- builder.addDerivedKey(true, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(true, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(true);
+ builder.prepare(salt);
WSSecSignature sign = new WSSecSignature(secHeader);
sign.setCustomTokenValueType(WSConstants.USERNAMETOKEN_NS + "#UsernameToken");
sign.setCustomTokenId(builder.getId());
- sign.setSecretKey(builder.getDerivedKey());
+ sign.setSecretKey(builder.getDerivedKey(salt));
sign.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
sign.setSignatureAlgorithm(WSConstants.HMAC_SHA1);
@@ -131,13 +133,14 @@ public class UTSignatureTest {
WSSecUsernameToken builder = new WSSecUsernameToken(secHeader);
builder.setUserInfo("colm", "security");
- builder.addDerivedKey(true, null, 1000);
- builder.prepare();
+ builder.addDerivedKey(true, 1000);
+ byte[] salt = UsernameTokenUtil.generateSalt(true);
+ builder.prepare(salt);
WSSecSignature sign = new WSSecSignature(secHeader);
sign.setCustomTokenValueType(WSConstants.USERNAMETOKEN_NS + "#UsernameToken");
sign.setCustomTokenId(builder.getId());
- sign.setSecretKey(builder.getDerivedKey());
+ sign.setSecretKey(builder.getDerivedKey(salt));
sign.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
sign.setSignatureAlgorithm(WSConstants.HMAC_SHA1);