You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2016/01/08 14:44:21 UTC
[1/2] cxf git commit: Support referencing a SAML PublicKey with the
Asymmetric Binding + KeyValue
Repository: cxf
Updated Branches:
refs/heads/3.1.x-fixes 4e68076d7 -> 69b2098d6
Support referencing a SAML PublicKey with the Asymmetric Binding + KeyValue
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/d2ee79c9
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/d2ee79c9
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/d2ee79c9
Branch: refs/heads/3.1.x-fixes
Commit: d2ee79c9371fa23ecd8e2a3a0d907c3256466f28
Parents: 4e68076
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Jan 8 12:14:17 2016 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Jan 8 13:38:31 2016 +0000
----------------------------------------------------------------------
.../AsymmetricBindingHandler.java | 6 +++-
.../IssuedTokenPolicyValidator.java | 3 ++
.../sts/asymmetric/AsymmetricBindingTest.java | 35 +++++++++++++++++++-
.../cxf/systest/sts/asymmetric/DoubleIt.wsdl | 3 ++
.../cxf/systest/sts/asymmetric/cxf-client.xml | 30 +++++++++++++++++
.../cxf/systest/sts/asymmetric/cxf-service.xml | 7 ++++
.../systest/sts/asymmetric/cxf-stax-service.xml | 8 +++++
7 files changed, 90 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
----------------------------------------------------------------------
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
index 2508447..564cece 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
@@ -19,6 +19,7 @@
package org.apache.cxf.ws.security.wss4j.policyhandlers;
+import java.security.PublicKey;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
@@ -478,10 +479,13 @@ public class AsymmetricBindingHandler extends AbstractBindingBuilder {
if (!isRequestor() && securityToken != null
&& securityToken.getX509Certificate() != null) {
encr.setUseThisCert(securityToken.getX509Certificate());
+ } else if (!isRequestor() && securityToken != null
+ && securityToken.getKey() instanceof PublicKey) {
+ encr.setUseThisPublicKey((PublicKey)securityToken.getKey());
} else {
setEncryptionUser(encr, encrToken, false, crypto);
}
- if (!encr.isCertSet() && crypto == null) {
+ if (!encr.isCertSet() && encr.getUseThisPublicKey() == null && crypto == null) {
unassertPolicy(recToken, "Missing security configuration. "
+ "Make sure jaxws:client element is configured "
+ "with a " + SecurityConstants.ENCRYPT_PROPERTIES + " value.");
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/IssuedTokenPolicyValidator.java
----------------------------------------------------------------------
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/IssuedTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/IssuedTokenPolicyValidator.java
index 73f3f29..c2c21f2 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/IssuedTokenPolicyValidator.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/IssuedTokenPolicyValidator.java
@@ -270,6 +270,9 @@ public class IssuedTokenPolicyValidator extends AbstractSamlPolicyValidator {
if (certs != null && certs.length > 0) {
token.setX509Certificate(certs[0], null);
}
+ if (subjectKeyInfo.getPublicKey() != null) {
+ token.setKey(subjectKeyInfo.getPublicKey());
+ }
}
if (assertionWrapper.getSaml1() != null) {
token.setTokenType(WSConstants.WSS_SAML_TOKEN_TYPE);
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
index 6f63830..cb4627c 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
@@ -105,7 +105,6 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
{new TestParam(PORT, true, STSPORT2)},
{new TestParam(STAX_PORT, false, STSPORT2)},
{new TestParam(STAX_PORT, true, STSPORT2)},
-
{new TestParam(PORT, false, STAX_STSPORT2)},
{new TestParam(PORT, true, STAX_STSPORT2)},
{new TestParam(STAX_PORT, false, STAX_STSPORT2)},
@@ -177,6 +176,40 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
((java.io.Closeable)asymmetricSaml2Port).close();
bus.shutdown(true);
}
+
+ @org.junit.Test
+ public void testUsernameTokenSAML2KeyValue() throws Exception {
+ // TODO
+ if (test.isStreaming() || STAX_PORT.equals(test.getPort())) {
+ return;
+ }
+
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = AsymmetricBindingTest.class.getResource("cxf-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ SpringBusFactory.setDefaultBus(bus);
+ SpringBusFactory.setThreadDefaultBus(bus);
+
+ URL wsdl = AsymmetricBindingTest.class.getResource("DoubleIt.wsdl");
+ Service service = Service.create(wsdl, SERVICE_QNAME);
+ QName portQName = new QName(NAMESPACE, "DoubleItAsymmetricSAML2KeyValuePort");
+ DoubleItPortType asymmetricSaml2Port =
+ service.getPort(portQName, DoubleItPortType.class);
+ updateAddressPort(asymmetricSaml2Port, test.getPort());
+
+ TokenTestUtils.updateSTSPort((BindingProvider)asymmetricSaml2Port, test.getStsPort());
+
+ if (test.isStreaming()) {
+ SecurityTestUtil.enableStreaming(asymmetricSaml2Port);
+ }
+
+ doubleIt(asymmetricSaml2Port, 30);
+ TokenTestUtils.verifyToken(asymmetricSaml2Port);
+
+ ((java.io.Closeable)asymmetricSaml2Port).close();
+ bus.shutdown(true);
+ }
@org.junit.Test
public void testUsernameTokenSAML1Encrypted() throws Exception {
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl
index 2f78416..c6f7c1a 100644
--- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl
@@ -56,6 +56,9 @@
<wsdl:port name="DoubleItAsymmetricSAML2Port" binding="tns:DoubleItAsymmetricSAML2Binding">
<soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml2"/>
</wsdl:port>
+ <wsdl:port name="DoubleItAsymmetricSAML2KeyValuePort" binding="tns:DoubleItAsymmetricSAML2Binding">
+ <soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml2keyvalue"/>
+ </wsdl:port>
<wsdl:port name="DoubleItAsymmetricSAML1EncryptedPort" binding="tns:DoubleItAsymmetricSAML1Binding">
<soap:address location="http://localhost:8082/doubleit/services/doubleitasymmetricsaml1encrypted"/>
</wsdl:port>
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-client.xml
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-client.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-client.xml
index e98ffba..ed6013b 100644
--- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-client.xml
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-client.xml
@@ -61,6 +61,36 @@
<entry key="security.sts.client" value-ref="stsClient"/>
</jaxws:properties>
</jaxws:client>
+
+ <jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItAsymmetricSAML2KeyValuePort" createdFromAPI="true">
+ <jaxws:properties>
+ <entry key="security.signature.properties" value="clientKeystore.properties"/>
+ <entry key="security.signature.username" value="myclientkey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.encryption.properties" value="clientKeystore.properties"/>
+ <entry key="security.encryption.username" value="myservicekey"/>
+ <entry key="security.sts.client">
+ <bean class="org.apache.cxf.ws.security.trust.STSClient">
+ <constructor-arg ref="cxf"/>
+ <property name="wsdlLocation" value="http://localhost:8080/SecurityTokenService/UT?wsdl"/>
+ <property name="serviceName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService"/>
+ <property name="endpointName" value="{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}UT_Port"/>
+ <property name="properties">
+ <map>
+ <entry key="security.username" value="alice"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.encryption.username" value="mystskey"/>
+ <entry key="security.encryption.properties" value="clientKeystore.properties"/>
+ <entry key="security.sts.token.username" value="myclientkey"/>
+ <entry key="security.sts.token.properties" value="clientKeystore.properties"/>
+ <entry key="ws-security.is-bsp-compliant" value="false"/>
+ </map>
+ </property>
+ </bean>
+ </entry>
+ </jaxws:properties>
+ </jaxws:client>
+
<jaxws:client name="{http://www.example.org/contract/DoubleIt}DoubleItAsymmetricSAML1EncryptedPort" createdFromAPI="true">
<jaxws:properties>
<entry key="security.signature.properties" value="clientKeystore.properties"/>
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service.xml
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service.xml
index 3c3e88b..cbc183c 100644
--- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service.xml
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-service.xml
@@ -34,6 +34,13 @@
<entry key="security.signature.properties" value="serviceKeystore.properties"/>
</jaxws:properties>
</jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleitasymmetricsaml2keyvalue" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2KeyValuePort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.asymmetric.Server}/doubleit/services/doubleitasymmetricsaml2keyvalue" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
<jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleitasymmetricsaml1encrypted" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML1EncryptedPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.asymmetric.Server}/doubleit/services/doubleitasymmetricsaml1encrypted" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl">
<jaxws:properties>
<entry key="security.signature.username" value="myservicekey"/>
http://git-wip-us.apache.org/repos/asf/cxf/blob/d2ee79c9/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service.xml
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service.xml b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service.xml
index d484007..3c6ca76 100644
--- a/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service.xml
+++ b/services/sts/systests/basic/src/test/resources/org/apache/cxf/systest/sts/asymmetric/cxf-stax-service.xml
@@ -36,6 +36,14 @@
<entry key="ws-security.enable.streaming" value="true"/>
</jaxws:properties>
</jaxws:endpoint>
+ <jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleitasymmetricsaml2keyvalue" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML2KeyValuePort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.asymmetric.StaxServer}/doubleit/services/doubleitasymmetricsaml2keyvalue" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl">
+ <jaxws:properties>
+ <entry key="security.signature.username" value="myservicekey"/>
+ <entry key="security.callback-handler" value="org.apache.cxf.systest.sts.common.CommonCallbackHandler"/>
+ <entry key="security.signature.properties" value="serviceKeystore.properties"/>
+ <entry key="ws-security.enable.streaming" value="true"/>
+ </jaxws:properties>
+ </jaxws:endpoint>
<jaxws:endpoint xmlns:s="http://www.example.org/contract/DoubleIt" id="doubleitasymmetricsaml1encrypted" implementor="org.apache.cxf.systest.sts.common.DoubleItPortTypeImpl" endpointName="s:DoubleItAsymmetricSAML1EncryptedPort" serviceName="s:DoubleItService" address="http://localhost:${testutil.ports.asymmetric.StaxServer}/doubleit/services/doubleitasymmetricsaml1encrypted" wsdlLocation="org/apache/cxf/systest/sts/asymmetric/DoubleIt.wsdl">
<jaxws:properties>
<entry key="security.signature.username" value="myservicekey"/>
[2/2] cxf git commit: Minor changes
Posted by co...@apache.org.
Minor changes
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/69b2098d
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/69b2098d
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/69b2098d
Branch: refs/heads/3.1.x-fixes
Commit: 69b2098d6e3bc83e26b614c5766b808f6d23f108
Parents: d2ee79c
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Fri Jan 8 13:44:12 2016 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Fri Jan 8 13:44:12 2016 +0000
----------------------------------------------------------------------
.../wss4j/policyhandlers/AsymmetricBindingHandler.java | 8 ++++----
.../cxf/systest/sts/asymmetric/AsymmetricBindingTest.java | 2 ++
2 files changed, 6 insertions(+), 4 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/69b2098d/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
----------------------------------------------------------------------
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
index 564cece..d16b521 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AsymmetricBindingHandler.java
@@ -19,7 +19,6 @@
package org.apache.cxf.ws.security.wss4j.policyhandlers;
-import java.security.PublicKey;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
@@ -479,13 +478,14 @@ public class AsymmetricBindingHandler extends AbstractBindingBuilder {
if (!isRequestor() && securityToken != null
&& securityToken.getX509Certificate() != null) {
encr.setUseThisCert(securityToken.getX509Certificate());
- } else if (!isRequestor() && securityToken != null
+ } else { /* TODO when WSS4J 2.1.5 is released else if (!isRequestor() && securityToken != null
&& securityToken.getKey() instanceof PublicKey) {
encr.setUseThisPublicKey((PublicKey)securityToken.getKey());
- } else {
+ } */
setEncryptionUser(encr, encrToken, false, crypto);
}
- if (!encr.isCertSet() && encr.getUseThisPublicKey() == null && crypto == null) {
+ if (!encr.isCertSet() // TODO when WSS4J 2.1.5 is released&& encr.getUseThisPublicKey() == null
+ && crypto == null) {
unassertPolicy(recToken, "Missing security configuration. "
+ "Make sure jaxws:client element is configured "
+ "with a " + SecurityConstants.ENCRYPT_PROPERTIES + " value.");
http://git-wip-us.apache.org/repos/asf/cxf/blob/69b2098d/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
index cb4627c..68eaec5 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/asymmetric/AsymmetricBindingTest.java
@@ -177,7 +177,9 @@ public class AsymmetricBindingTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
+ // TODO enable when WSS4J 2.1.5 is released, and some stuff in the AsymmetricBindingHandler
@org.junit.Test
+ @org.junit.Ignore
public void testUsernameTokenSAML2KeyValue() throws Exception {
// TODO
if (test.isStreaming() || STAX_PORT.equals(test.getPort())) {