You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2013/12/16 16:28:16 UTC
svn commit: r1551233 -
/cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
Author: coheigea
Date: Mon Dec 16 15:28:16 2013
New Revision: 1551233
URL: http://svn.apache.org/r1551233
Log:
Merged revisions 1551231 via git cherry-pick from
https://svn.apache.org/repos/asf/cxf/branches/2.7.x-fixes
........
r1551231 | coheigea | 2013-12-16 15:25:35 +0000 (Mon, 16 Dec 2013) | 2 lines
Fixing build
........
Modified:
cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
Modified: cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java
URL: http://svn.apache.org/viewvc/cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java?rev=1551233&r1=1551232&r2=1551233&view=diff
==============================================================================
--- cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java (original)
+++ cxf/branches/2.6.x-fixes/services/sts/sts-core/src/main/java/org/apache/cxf/sts/token/validator/SAMLTokenValidator.java Mon Dec 16 15:28:16 2013
@@ -149,24 +149,18 @@ public class SAMLTokenValidator implemen
LOG.log(Level.WARNING, "The received assertion is not signed, and therefore not trusted");
return response;
}
-
+
RequestData requestData = new RequestData();
- requestData.setSigVerCrypto(sigCrypto);
+ requestData.setSigCrypto(sigCrypto);
WSSConfig wssConfig = WSSConfig.getNewInstance();
requestData.setWssConfig(wssConfig);
requestData.setCallbackHandler(callbackHandler);
requestData.setMsgContext(tokenParameters.getWebServiceContext().getMessageContext());
- WSDocInfo docInfo = new WSDocInfo(validateTargetElement.getOwnerDocument());
-
// Verify the signature
- Signature sig = assertion.getSignature();
- KeyInfo keyInfo = sig.getKeyInfo();
- SAMLKeyInfo samlKeyInfo =
- SAMLUtil.getCredentialFromKeyInfo(
- keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData, docInfo), sigCrypto
- );
- assertion.verifySignature(samlKeyInfo);
+ assertion.verifySignature(
+ requestData, new WSDocInfo(validateTargetElement.getOwnerDocument())
+ );
SecurityToken secToken = null;
byte[] signatureValue = assertion.getSignatureValue();
@@ -185,6 +179,7 @@ public class SAMLTokenValidator implemen
if (secToken == null) {
<<<<<<< HEAD
+<<<<<<< HEAD
if (!assertion.isSigned()) {
LOG.log(Level.WARNING, "The received assertion is not signed, and therefore not trusted");
return response;
@@ -203,6 +198,8 @@ public class SAMLTokenValidator implemen
=======
>>>>>>> 4b3dbb3... Validation fix in the STS
+=======
+>>>>>>> 8b51624... Fixing build
// Validate the assertion against schemas/profiles
validateAssertion(assertion);