You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2017/09/27 13:28:28 UTC
[cxf-fediz] branch master updated: Upgrading to CXF 3.2.x
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf-fediz.git
The following commit(s) were added to refs/heads/master by this push:
new 88b5f35 Upgrading to CXF 3.2.x
88b5f35 is described below
commit 88b5f3516b4194fe581bc32409f2587349d9acd0
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 27 14:28:16 2017 +0100
Upgrading to CXF 3.2.x
---
.../cxf/fediz/core/TokenValidatorResponse.java | 38 +++-------
.../core/processor/AbstractFedizProcessor.java | 10 +--
.../core/processor/FederationProcessorImpl.java | 82 +++++++++-------------
.../cxf/fediz/core/processor/FedizResponse.java | 30 +++-----
.../fediz/core/processor/SAMLProcessorImpl.java | 4 +-
.../core/saml/FedizSignatureTrustValidator.java | 2 +-
.../cxf/fediz/core/saml/SAMLTokenValidator.java | 16 ++---
.../samlsso/SAMLProtocolResponseValidator.java | 3 +-
.../core/samlsso/SAMLSSOResponseValidator.java | 5 +-
.../fediz/core/samlsso/SSOValidatorResponse.java | 19 ++---
.../fediz/core/AbstractSAMLCallbackHandler.java | 4 +-
.../core/federation/FederationResponseTest.java | 4 +-
.../cxf/plugin/FedizRedirectBindingFilter.java | 6 +-
.../cxf/fediz/jetty9/FederationAuthenticator.java | 8 +--
.../cxf/fediz/jetty9/FederationLoginService.java | 4 +-
.../cxf/fediz/jetty9/FederationUserIdentity.java | 4 +-
.../spring/web/FederationAuthenticationFilter.java | 8 +--
.../spring/web/FederationAuthenticationFilter.java | 8 +--
.../cxf/fediz/tomcat8/FederationAuthenticator.java | 8 +--
.../apache/cxf/fediz/was/tai/FedizInterceptor.java | 8 +--
pom.xml | 9 ++-
.../idp/beans/samlsso/AuthnRequestParser.java | 3 +-
.../service/idp/beans/wsfed/WfreshParser.java | 9 ++-
.../AbstractTrustedIdpOAuth2ProtocolHandler.java | 9 +--
.../TrustedIdpFacebookProtocolHandler.java | 5 +-
.../protocols/TrustedIdpOIDCProtocolHandler.java | 10 +--
services/idp/src/main/resources/restContext.xml | 4 +-
.../src/test/java/custom/CustomClaimsHandler.java | 7 +-
28 files changed, 139 insertions(+), 188 deletions(-)
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorResponse.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorResponse.java
index 2d9788e..c21c9ec 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorResponse.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/TokenValidatorResponse.java
@@ -19,7 +19,7 @@
package org.apache.cxf.fediz.core;
-import java.util.Date;
+import java.time.Instant;
import java.util.List;
public class TokenValidatorResponse {
@@ -30,8 +30,8 @@ public class TokenValidatorResponse {
private String issuer;
private String audience;
private List<Claim> claims;
- private Date expires;
- private Date created;
+ private Instant expires;
+ private Instant created;
@@ -65,36 +65,20 @@ public class TokenValidatorResponse {
return claims;
}
- public Date getExpires() {
- if (expires != null) {
- return new Date(expires.getTime());
- }
- return null;
+ public Instant getExpires() {
+ return expires;
}
- public void setExpires(Date expires) {
- if (expires != null) {
- this.expires = new Date(expires.getTime());
- } else {
- this.expires = null;
- }
+ public void setExpires(Instant expires) {
+ this.expires = expires;
}
-
- public Date getCreated() {
- if (created != null) {
- return new Date(created.getTime());
- }
- return null;
+ public Instant getCreated() {
+ return created;
}
-
- public void setCreated(Date created) {
- if (created != null) {
- this.created = new Date(created.getTime());
- } else {
- this.created = null;
- }
+ public void setCreated(Instant created) {
+ this.created = created;
}
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/AbstractFedizProcessor.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/AbstractFedizProcessor.java
index cad8c60..f7900cb 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/AbstractFedizProcessor.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/AbstractFedizProcessor.java
@@ -22,7 +22,7 @@ package org.apache.cxf.fediz.core.processor;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
-import java.util.Date;
+import java.time.Instant;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
@@ -75,7 +75,7 @@ public abstract class AbstractFedizProcessor implements FedizProcessor {
return wtRealm;
}
- protected void testForReplayAttack(String tokenId, FedizContext config, Date expires)
+ protected void testForReplayAttack(String tokenId, FedizContext config, Instant expires)
throws ProcessingException {
// Check whether token already used for signin
if (tokenId != null && config.isDetectReplayedTokens()) {
@@ -84,9 +84,9 @@ public abstract class AbstractFedizProcessor implements FedizProcessor {
if (!config.getTokenReplayCache().contains(tokenId)) {
// not cached
if (expires != null) {
- Date currentTime = new Date();
- long ttl = expires.getTime() - currentTime.getTime();
- config.getTokenReplayCache().add(tokenId, ttl / 1000L);
+ Instant now = Instant.now();
+ long ttl = expires.getEpochSecond() - now.getEpochSecond();
+ config.getTokenReplayCache().add(tokenId, ttl);
} else {
config.getTokenReplayCache().add(tokenId);
}
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java
index 5fc4893..a01eb70 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FederationProcessorImpl.java
@@ -26,8 +26,10 @@ import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLEncoder;
import java.security.cert.Certificate;
-import java.text.DateFormat;
-import java.text.ParseException;
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
import java.util.Collections;
import java.util.Date;
import java.util.List;
@@ -68,6 +70,7 @@ import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
import org.apache.wss4j.common.util.DOM2Writer;
+import org.apache.wss4j.common.util.DateUtil;
import org.apache.wss4j.dom.WSConstants;
import org.apache.wss4j.dom.WSDataRef;
import org.apache.wss4j.dom.WSDocInfo;
@@ -76,7 +79,6 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.processor.EncryptedDataProcessor;
import org.apache.wss4j.dom.processor.Processor;
-import org.apache.wss4j.dom.util.XmlSchemaDateFormat;
import org.joda.time.DateTime;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -177,13 +179,13 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
}
if (lifeTime != null) {
- Date currentDate = new Date();
- if (currentDate.after(lifeTime.getExpires())) {
+ Instant rightNow = Instant.now();
+ if (rightNow.isAfter(lifeTime.getExpires())) {
LOG.warn("RSTR Lifetime expired");
throw new ProcessingException(TYPE.TOKEN_EXPIRED);
}
DateTime currentTime = new DateTime();
- DateTime validFrom = new DateTime(lifeTime.created);
+ DateTime validFrom = new DateTime(Date.from(lifeTime.created));
currentTime = currentTime.plusSeconds(config.getMaximumClockSkew().intValue());
if (validFrom.isAfter(currentTime)) {
LOG.debug("RSTR Lifetime not yet valid");
@@ -202,7 +204,7 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
TokenValidatorResponse validatorResponse = validateToken(rst, tt, config, request.getCerts());
// Check whether token already used for signin
- Date expires = null;
+ Instant expires = null;
if (lifeTime != null && lifeTime.getExpires() != null) {
expires = lifeTime.getExpires();
} else {
@@ -214,7 +216,7 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
validatorResponse.getClaims(),
validatorResponse.getRoles() != null && !validatorResponse.getRoles().isEmpty());
- Date created = validatorResponse.getCreated();
+ Instant created = validatorResponse.getCreated();
if (lifeTime != null && lifeTime.getCreated() != null) {
created = lifeTime.getCreated();
}
@@ -274,6 +276,7 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
EncryptedDataProcessor proc = new EncryptedDataProcessor();
WSDocInfo docInfo = new WSDocInfo(encryptedRST.getOwnerDocument());
RequestData data = new RequestData();
+ data.setWsDocInfo(docInfo);
// Disable WSS4J processing of the (decrypted) SAML Token
WSSConfig wssConfig = WSSConfig.getNewInstance();
@@ -284,7 +287,7 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
data.setDecCrypto(decryptionKeyManager.getCrypto());
data.setCallbackHandler(new DecryptionCallbackHandler(keyPassword));
try {
- List<WSSecurityEngineResult> result = proc.handleToken(encryptedRST, data, docInfo);
+ List<WSSecurityEngineResult> result = proc.handleToken(encryptedRST, data);
if (!result.isEmpty()) {
@SuppressWarnings("unchecked")
List<WSDataRef> dataRefs = (List<WSDataRef>)result.get(result.size() - 1)
@@ -301,55 +304,34 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
}
private LifeTime processLifeTime(Element lifetimeElem) throws ProcessingException {
- try {
- Element createdElem = DOMUtils.getFirstChildWithName(lifetimeElem, WSConstants.WSU_NS,
- WSConstants.CREATED_LN);
- DateFormat zulu = new XmlSchemaDateFormat();
-
- Date created = zulu.parse(DOMUtils.getContent(createdElem));
+ Element createdElem = DOMUtils.getFirstChildWithName(lifetimeElem, WSConstants.WSU_NS,
+ WSConstants.CREATED_LN);
- Element expiresElem = DOMUtils.getFirstChildWithName(lifetimeElem, WSConstants.WSU_NS,
- WSConstants.EXPIRES_LN);
- Date expires = zulu.parse(DOMUtils.getContent(expiresElem));
+ ZonedDateTime createdDateTime = ZonedDateTime.parse(DOMUtils.getContent(createdElem));
- return new LifeTime(created, expires);
+ Element expiresElem = DOMUtils.getFirstChildWithName(lifetimeElem, WSConstants.WSU_NS,
+ WSConstants.EXPIRES_LN);
+ ZonedDateTime expiresDateTime = ZonedDateTime.parse(DOMUtils.getContent(expiresElem));
- } catch (ParseException e) {
- LOG.error("Failed to parse lifetime element in wresult: {}", e.getMessage());
- throw new ProcessingException(TYPE.BAD_REQUEST);
- }
+ return new LifeTime(createdDateTime.toInstant(), expiresDateTime.toInstant());
}
public static class LifeTime {
- private final Date created;
- private final Date expires;
+ private final Instant created;
+ private final Instant expires;
- public LifeTime(Date created, Date expires) {
- if (created != null) {
- this.created = new Date(created.getTime());
- } else {
- this.created = null;
- }
- if (expires != null) {
- this.expires = new Date(expires.getTime());
- } else {
- this.expires = null;
- }
+ public LifeTime(Instant created, Instant expires) {
+ this.created = created;
+ this.expires = expires;
}
- public Date getCreated() {
- if (created != null) {
- return new Date(created.getTime());
- }
- return null;
+ public Instant getCreated() {
+ return created;
}
- public Date getExpires() {
- if (expires != null) {
- return new Date(expires.getTime());
- }
- return null;
+ public Instant getExpires() {
+ return expires;
}
}
@@ -457,9 +439,9 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
}
// add current time parameter wct
- Date creationTime = new Date();
- XmlSchemaDateFormat fmt = new XmlSchemaDateFormat();
- String wct = fmt.format(creationTime);
+ Instant now = Instant.now();
+ DateTimeFormatter formatter = DateUtil.getDateTimeFormatter(true);
+ String wct = now.atZone(ZoneOffset.UTC).format(formatter);
sb.append('&').append(FederationConstants.PARAM_CURRENT_TIME).append('=')
.append(URLEncoder.encode(wct, "UTF-8"));
@@ -812,7 +794,7 @@ public class FederationProcessorImpl extends AbstractFedizProcessor {
private static class NOOpProcessor implements Processor {
@Override
- public List<WSSecurityEngineResult> handleToken(Element arg0, RequestData arg1, WSDocInfo arg2)
+ public List<WSSecurityEngineResult> handleToken(Element arg0, RequestData arg1)
throws WSSecurityException {
return Collections.emptyList();
}
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java
index e6bf782..3a07b30 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/FedizResponse.java
@@ -24,8 +24,8 @@ import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.io.StringReader;
+import java.time.Instant;
import java.util.Collections;
-import java.util.Date;
import java.util.List;
import javax.xml.parsers.ParserConfigurationException;
@@ -54,27 +54,23 @@ public class FedizResponse implements Serializable {
/**
* Created time
*/
- private Date tokenCreated;
+ private Instant tokenCreated;
/**
* Expiration time
*/
- private Date tokenExpires;
+ private Instant tokenExpires;
//CHECKSTYLE:OFF
public FedizResponse(String username, String issuer, List<String> roles, List<Claim> claims, String audience,
- Date created, Date expires, Element token, String uniqueTokenId) {
+ Instant created, Instant expires, Element token, String uniqueTokenId) {
this.username = username;
this.issuer = issuer;
this.roles = roles;
this.claims = claims;
this.audience = audience;
- if (created != null) {
- this.tokenCreated = new Date(created.getTime());
- }
- if (expires != null) {
- this.tokenExpires = new Date(expires.getTime());
- }
+ this.tokenCreated = created;
+ this.tokenExpires = expires;
this.token = token;
this.uniqueTokenId = uniqueTokenId;
}
@@ -109,18 +105,12 @@ public class FedizResponse implements Serializable {
return Collections.unmodifiableList(claims);
}
- public Date getTokenCreated() {
- if (tokenCreated != null) {
- return new Date(tokenCreated.getTime());
- }
- return null;
+ public Instant getTokenCreated() {
+ return tokenCreated;
}
- public Date getTokenExpires() {
- if (tokenExpires != null) {
- return new Date(tokenExpires.getTime());
- }
- return null;
+ public Instant getTokenExpires() {
+ return tokenExpires;
}
public Element getToken() {
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
index 60cf3ac..fc227e1 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/processor/SAMLProcessorImpl.java
@@ -26,8 +26,8 @@ import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.security.PrivateKey;
import java.security.Signature;
+import java.time.Instant;
import java.util.Base64;
-import java.util.Date;
import java.util.List;
import java.util.UUID;
import java.util.zip.DataFormatException;
@@ -206,7 +206,7 @@ public class SAMLProcessorImpl extends AbstractFedizProcessor {
}
// Check whether token already used for signin
- Date expires = validatorResponse.getExpires();
+ Instant expires = validatorResponse.getExpires();
if (expires == null) {
expires = ssoValidatorResponse.getSessionNotOnOrAfter();
}
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/FedizSignatureTrustValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/FedizSignatureTrustValidator.java
index 8cc61e3..fbe7132 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/FedizSignatureTrustValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/FedizSignatureTrustValidator.java
@@ -179,7 +179,7 @@ public class FedizSignatureTrustValidator implements Validator {
// Use the validation method from the crypto to check whether the subjects'
// certificate was really signed by the issuer stated in the certificate
//
- crypto.verifyTrust(certificates, enableRevocation, null);
+ crypto.verifyTrust(certificates, enableRevocation, null, null);
String subjectString = certificates[0].getSubjectX500Principal().getName();
LOG.debug(
"Certificate path has been verified for certificate with subject {}", subjectString
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
index 7d2bc88..586bf01 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/saml/SAMLTokenValidator.java
@@ -20,9 +20,9 @@
package org.apache.cxf.fediz.core.saml;
import java.net.URI;
+import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
@@ -89,6 +89,7 @@ public class SAMLTokenValidator implements TokenValidator {
RequestData requestData = new RequestData();
WSSConfig wssConfig = WSSConfig.getNewInstance();
requestData.setWssConfig(wssConfig);
+ requestData.setWsDocInfo(new WSDocInfo(token.getOwnerDocument()));
// not needed as no private key must be read
// requestData.setCallbackHandler(new
// PasswordCallbackHandler(password));
@@ -99,19 +100,18 @@ public class SAMLTokenValidator implements TokenValidator {
throw new ProcessingException(TYPE.TOKEN_NO_SIGNATURE);
}
// Verify the signature
- WSDocInfo docInfo = new WSDocInfo(token.getOwnerDocument());
Signature sig = assertion.getSignature();
KeyInfo keyInfo = sig.getKeyInfo();
SAMLKeyInfo samlKeyInfo =
org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromKeyInfo(
- keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData, docInfo),
+ keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData),
requestData.getSigVerCrypto()
);
assertion.verifySignature(samlKeyInfo);
// Parse the subject if it exists
assertion.parseSubject(
- new WSSSAMLKeyInfoProcessor(requestData, docInfo), requestData.getSigVerCrypto(),
+ new WSSSAMLKeyInfoProcessor(requestData), requestData.getSigVerCrypto(),
requestData.getCallbackHandler()
);
@@ -428,7 +428,7 @@ public class SAMLTokenValidator implements TokenValidator {
}
- private Date getExpires(SamlAssertionWrapper assertion) {
+ private Instant getExpires(SamlAssertionWrapper assertion) {
DateTime validTill = null;
if (assertion.getSamlVersion().equals(SAMLVersion.VERSION_20)) {
validTill = assertion.getSaml2().getConditions().getNotOnOrAfter();
@@ -439,10 +439,10 @@ public class SAMLTokenValidator implements TokenValidator {
if (validTill == null) {
return null;
}
- return validTill.toDate();
+ return validTill.toDate().toInstant();
}
- private Date getCreated(SamlAssertionWrapper assertion) {
+ private Instant getCreated(SamlAssertionWrapper assertion) {
DateTime validFrom = null;
if (assertion.getSamlVersion().equals(SAMLVersion.VERSION_20)) {
validFrom = assertion.getSaml2().getConditions().getNotBefore();
@@ -453,7 +453,7 @@ public class SAMLTokenValidator implements TokenValidator {
if (validFrom == null) {
return null;
}
- return validFrom.toDate();
+ return validFrom.toDate().toInstant();
}
/**
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLProtocolResponseValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLProtocolResponseValidator.java
index 9f2c038..3d69147 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLProtocolResponseValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLProtocolResponseValidator.java
@@ -159,6 +159,7 @@ public class SAMLProtocolResponseValidator {
RequestData requestData = new RequestData();
WSSConfig wssConfig = WSSConfig.getNewInstance();
requestData.setWssConfig(wssConfig);
+ requestData.setWsDocInfo(new WSDocInfo(doc));
SAMLKeyInfo samlKeyInfo = null;
@@ -167,7 +168,7 @@ public class SAMLProtocolResponseValidator {
try {
samlKeyInfo =
SAMLUtil.getCredentialFromKeyInfo(
- keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData, new WSDocInfo(doc)),
+ keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData),
requestData.getSigVerCrypto()
);
} catch (WSSecurityException ex) {
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLSSOResponseValidator.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLSSOResponseValidator.java
index 1541b89..c92da54 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLSSOResponseValidator.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SAMLSSOResponseValidator.java
@@ -18,6 +18,7 @@
*/
package org.apache.cxf.fediz.core.samlsso;
+import java.time.Instant;
import java.util.Date;
import java.util.List;
@@ -101,7 +102,7 @@ public class SAMLSSOResponseValidator {
// Validate Assertions
org.opensaml.saml.saml2.core.Assertion validAssertion = null;
- Date sessionNotOnOrAfter = null;
+ Instant sessionNotOnOrAfter = null;
for (org.opensaml.saml.saml2.core.Assertion assertion : samlResponse.getAssertions()) {
// Check the Issuer
if (assertion.getIssuer() == null) {
@@ -125,7 +126,7 @@ public class SAMLSSOResponseValidator {
// Store Session NotOnOrAfter
for (AuthnStatement authnStatment : assertion.getAuthnStatements()) {
if (authnStatment.getSessionNotOnOrAfter() != null) {
- sessionNotOnOrAfter = authnStatment.getSessionNotOnOrAfter().toDate();
+ sessionNotOnOrAfter = authnStatment.getSessionNotOnOrAfter().toDate().toInstant();
}
}
}
diff --git a/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SSOValidatorResponse.java b/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SSOValidatorResponse.java
index a16be80..d4e63d3 100644
--- a/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SSOValidatorResponse.java
+++ b/plugins/core/src/main/java/org/apache/cxf/fediz/core/samlsso/SSOValidatorResponse.java
@@ -18,7 +18,7 @@
*/
package org.apache.cxf.fediz.core.samlsso;
-import java.util.Date;
+import java.time.Instant;
import org.w3c.dom.Element;
@@ -26,7 +26,7 @@ import org.w3c.dom.Element;
* Some information that encapsulates a successful validation by the SAMLSSOResponseValidator
*/
public class SSOValidatorResponse {
- private Date sessionNotOnOrAfter;
+ private Instant sessionNotOnOrAfter;
private String responseId;
private String assertion;
private Element assertionElement;
@@ -39,19 +39,12 @@ public class SSOValidatorResponse {
this.assertion = assertion;
}
- public Date getSessionNotOnOrAfter() {
- if (sessionNotOnOrAfter != null) {
- return new Date(sessionNotOnOrAfter.getTime());
- }
- return null;
+ public Instant getSessionNotOnOrAfter() {
+ return sessionNotOnOrAfter;
}
- public void setSessionNotOnOrAfter(Date sessionNotOnOrAfter) {
- if (sessionNotOnOrAfter != null) {
- this.sessionNotOnOrAfter = new Date(sessionNotOnOrAfter.getTime());
- } else {
- this.sessionNotOnOrAfter = null;
- }
+ public void setSessionNotOnOrAfter(Instant sessionNotOnOrAfter) {
+ this.sessionNotOnOrAfter = sessionNotOnOrAfter;
}
public String getResponseId() {
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/AbstractSAMLCallbackHandler.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/AbstractSAMLCallbackHandler.java
index b4b926f..fe90905 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/AbstractSAMLCallbackHandler.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/AbstractSAMLCallbackHandler.java
@@ -395,10 +395,10 @@ public abstract class AbstractSAMLCallbackHandler implements CallbackHandler {
Document doc = docBuilder.newDocument();
// Create an Encrypted Key
- WSSecEncryptedKey encrKey = new WSSecEncryptedKey();
+ WSSecEncryptedKey encrKey = new WSSecEncryptedKey(doc);
encrKey.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);
encrKey.setUseThisCert(certs[0]);
- encrKey.prepare(doc, null);
+ encrKey.prepare(null);
ephemeralKey = encrKey.getEphemeralKey();
Element encryptedKeyElement = encrKey.getEncryptedKeyElement();
diff --git a/plugins/core/src/test/java/org/apache/cxf/fediz/core/federation/FederationResponseTest.java b/plugins/core/src/test/java/org/apache/cxf/fediz/core/federation/FederationResponseTest.java
index a4e159d..c34eb4e 100644
--- a/plugins/core/src/test/java/org/apache/cxf/fediz/core/federation/FederationResponseTest.java
+++ b/plugins/core/src/test/java/org/apache/cxf/fediz/core/federation/FederationResponseTest.java
@@ -1630,7 +1630,7 @@ public class FederationResponseTest {
}
e.appendChild(token);
- WSSecEncrypt builder = new WSSecEncrypt();
+ WSSecEncrypt builder = new WSSecEncrypt(token.getOwnerDocument());
builder.setUserInfo("mystskey");
builder.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);
@@ -1642,7 +1642,7 @@ public class FederationResponseTest {
encryptionPart.setElement(token);
Crypto encrCrypto = CryptoFactory.getInstance("signature.properties");
- builder.prepare(token.getOwnerDocument(), encrCrypto);
+ builder.prepare(encrCrypto);
builder.encryptForRef(null, Collections.singletonList(encryptionPart));
// return doc.getDocumentElement();
diff --git a/plugins/cxf/src/main/java/org/apache/cxf/fediz/cxf/plugin/FedizRedirectBindingFilter.java b/plugins/cxf/src/main/java/org/apache/cxf/fediz/cxf/plugin/FedizRedirectBindingFilter.java
index 3e4db0e..600e21f 100644
--- a/plugins/cxf/src/main/java/org/apache/cxf/fediz/cxf/plugin/FedizRedirectBindingFilter.java
+++ b/plugins/cxf/src/main/java/org/apache/cxf/fediz/cxf/plugin/FedizRedirectBindingFilter.java
@@ -22,9 +22,9 @@ import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.security.cert.X509Certificate;
+import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
@@ -145,10 +145,10 @@ public class FedizRedirectBindingFilter extends AbstractServiceProviderFilter
String securityContextKey = UUID.randomUUID().toString();
long currentTime = System.currentTimeMillis();
- Date notOnOrAfter = wfRes.getTokenExpires();
+ Instant notOnOrAfter = wfRes.getTokenExpires();
long expiresAt = 0;
if (notOnOrAfter != null) {
- expiresAt = notOnOrAfter.getTime();
+ expiresAt = notOnOrAfter.toEpochMilli();
} else {
expiresAt = currentTime + getStateTimeToLive();
}
diff --git a/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationAuthenticator.java b/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationAuthenticator.java
index 9ce5603..23837a1 100644
--- a/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationAuthenticator.java
+++ b/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationAuthenticator.java
@@ -24,7 +24,7 @@ import java.io.IOException;
import java.io.InputStream;
import java.io.UnsupportedEncodingException;
import java.security.cert.X509Certificate;
-import java.util.Date;
+import java.time.Instant;
import java.util.Map;
import java.util.Map.Entry;
@@ -414,14 +414,14 @@ public class FederationAuthenticator extends LoginAuthenticator {
if (fedConfig.isDetectExpiredTokens()) {
try {
FederationUserIdentity fui = (FederationUserIdentity)userIdentity;
- Date tokenExpires = fui.getExpiryDate();
+ Instant tokenExpires = fui.getExpiryDate();
if (tokenExpires == null) {
LOG.debug("Token doesn't expire");
return false;
}
- Date currentTime = new Date();
- if (!currentTime.after(tokenExpires)) {
+ Instant currentTime = Instant.now();
+ if (!currentTime.isAfter(tokenExpires)) {
return false;
} else {
LOG.warn("Token already expired. Clean up and redirect");
diff --git a/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationLoginService.java b/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationLoginService.java
index 79f333a..5a04bec 100644
--- a/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationLoginService.java
+++ b/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationLoginService.java
@@ -19,9 +19,9 @@
package org.apache.cxf.fediz.jetty9;
+import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.Date;
import java.util.List;
import javax.security.auth.Subject;
@@ -145,7 +145,7 @@ public class FederationLoginService extends AbstractLifeCycle implements LoginSe
public boolean validate(UserIdentity user) {
try {
FederationUserIdentity fui = (FederationUserIdentity)user;
- return fui.getExpiryDate().after(new Date());
+ return fui.getExpiryDate().isAfter(Instant.now());
} catch (ClassCastException ex) {
LOG.warn("UserIdentity must be instance of FederationUserIdentity");
throw new IllegalStateException("UserIdentity must be instance of FederationUserIdentity");
diff --git a/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationUserIdentity.java b/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationUserIdentity.java
index 0c6f366..9b71291 100644
--- a/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationUserIdentity.java
+++ b/plugins/jetty9/src/main/java/org/apache/cxf/fediz/jetty9/FederationUserIdentity.java
@@ -21,8 +21,8 @@ package org.apache.cxf.fediz.jetty9;
import java.security.Principal;
+import java.time.Instant;
import java.util.Arrays;
-import java.util.Date;
import javax.security.auth.Subject;
@@ -71,7 +71,7 @@ public class FederationUserIdentity implements UserIdentity {
return false;
}
- public Date getExpiryDate() {
+ public Instant getExpiryDate() {
return fedResponse.getTokenExpires();
}
diff --git a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
index 485ca38..c0c40d3 100644
--- a/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
+++ b/plugins/spring/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.web;
import java.io.IOException;
import java.security.cert.X509Certificate;
-import java.util.Date;
+import java.time.Instant;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
@@ -90,14 +90,14 @@ public class FederationAuthenticationFilter extends AbstractAuthenticationProces
if (context != null && detectExpiredTokens) {
Authentication authentication = context.getAuthentication();
if (authentication instanceof FederationAuthenticationToken) {
- Date tokenExpires =
+ Instant tokenExpires =
((FederationAuthenticationToken)authentication).getResponse().getTokenExpires();
if (tokenExpires == null) {
return false;
}
- Date currentTime = new Date();
- if (currentTime.after(tokenExpires)) {
+ Instant currentTime = Instant.now();
+ if (currentTime.isAfter(tokenExpires)) {
return true;
}
}
diff --git a/plugins/spring3/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java b/plugins/spring3/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
index 485ca38..c0c40d3 100644
--- a/plugins/spring3/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
+++ b/plugins/spring3/src/main/java/org/apache/cxf/fediz/spring/web/FederationAuthenticationFilter.java
@@ -21,7 +21,7 @@ package org.apache.cxf.fediz.spring.web;
import java.io.IOException;
import java.security.cert.X509Certificate;
-import java.util.Date;
+import java.time.Instant;
import javax.servlet.ServletRequest;
import javax.servlet.http.HttpServletRequest;
@@ -90,14 +90,14 @@ public class FederationAuthenticationFilter extends AbstractAuthenticationProces
if (context != null && detectExpiredTokens) {
Authentication authentication = context.getAuthentication();
if (authentication instanceof FederationAuthenticationToken) {
- Date tokenExpires =
+ Instant tokenExpires =
((FederationAuthenticationToken)authentication).getResponse().getTokenExpires();
if (tokenExpires == null) {
return false;
}
- Date currentTime = new Date();
- if (currentTime.after(tokenExpires)) {
+ Instant currentTime = Instant.now();
+ if (currentTime.isAfter(tokenExpires)) {
return true;
}
}
diff --git a/plugins/tomcat8/src/main/java/org/apache/cxf/fediz/tomcat8/FederationAuthenticator.java b/plugins/tomcat8/src/main/java/org/apache/cxf/fediz/tomcat8/FederationAuthenticator.java
index e3da1db..1acd551 100644
--- a/plugins/tomcat8/src/main/java/org/apache/cxf/fediz/tomcat8/FederationAuthenticator.java
+++ b/plugins/tomcat8/src/main/java/org/apache/cxf/fediz/tomcat8/FederationAuthenticator.java
@@ -22,7 +22,7 @@ package org.apache.cxf.fediz.tomcat8;
import java.io.File;
import java.io.IOException;
import java.security.Principal;
-import java.util.Date;
+import java.time.Instant;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
@@ -399,14 +399,14 @@ public class FederationAuthenticator extends FormAuthenticator {
if (session != null) {
FedizResponse wfRes = (FedizResponse)session.getNote(FEDERATION_NOTE);
- Date tokenExpires = wfRes.getTokenExpires();
+ Instant tokenExpires = wfRes.getTokenExpires();
if (tokenExpires == null) {
LOG.debug("Token doesn't expire");
return true;
}
- Date currentTime = new Date();
- if (!currentTime.after(tokenExpires)) {
+ Instant currentTime = Instant.now();
+ if (!currentTime.isAfter(tokenExpires)) {
return true;
} else {
LOG.warn("Token already expired. Clean up and redirect");
diff --git a/plugins/websphere/src/main/java/org/apache/cxf/fediz/was/tai/FedizInterceptor.java b/plugins/websphere/src/main/java/org/apache/cxf/fediz/was/tai/FedizInterceptor.java
index e458604..e31e61f 100644
--- a/plugins/websphere/src/main/java/org/apache/cxf/fediz/was/tai/FedizInterceptor.java
+++ b/plugins/websphere/src/main/java/org/apache/cxf/fediz/was/tai/FedizInterceptor.java
@@ -21,8 +21,8 @@ package org.apache.cxf.fediz.was.tai;
import java.io.File;
import java.io.IOException;
import java.rmi.RemoteException;
+import java.time.Instant;
import java.util.ArrayList;
-import java.util.Date;
import java.util.Hashtable;
import java.util.List;
import java.util.Map;
@@ -483,14 +483,14 @@ public class FedizInterceptor implements TrustAssociationInterceptor {
return false;
}
- Date tokenExpires = wfRes.getTokenExpires();
+ Instant tokenExpires = wfRes.getTokenExpires();
if (tokenExpires == null) {
LOG.debug("Token doesn't expire");
return true;
}
- Date currentTime = new Date();
- if (!currentTime.after(tokenExpires)) {
+ Instant currentTime = Instant.now();
+ if (!currentTime.isAfter(tokenExpires)) {
return true;
} else {
LOG.warn("Token already expired since {}", tokenExpires);
diff --git a/pom.xml b/pom.xml
index 1734aa6..5c5f060 100644
--- a/pom.xml
+++ b/pom.xml
@@ -43,18 +43,17 @@
<commons.logging.version>1.2</commons.logging.version>
<commons.io.version>2.5</commons.io.version>
<commons.validator.version>1.6</commons.validator.version>
- <cxf.version>3.1.13</cxf.version>
- <cxf.build-utils.version>3.2.0</cxf.build-utils.version>
+ <cxf.version>3.2.1-SNAPSHOT</cxf.version>
+ <cxf.build-utils.version>3.3.0</cxf.build-utils.version>
<dbcp.version>2.1.1</dbcp.version>
<easymock.version>3.4</easymock.version>
<ehcache.version>2.10.4</ehcache.version>
<hsqldb.version>2.3.4</hsqldb.version>
<htmlunit.version>2.27</htmlunit.version>
- <jackson.version>2.8.8</jackson.version>
+ <jackson.version>2.9.1</jackson.version>
<javassist.version>3.19.0-GA</javassist.version>
<javax.el.version>3.0.0</javax.el.version>
<javax.validation.version>1.1.0.Final</javax.validation.version>
- <jericho.version>3.3</jericho.version>
<jetty9.version>9.3.9.v20160517</jetty9.version>
<junit.version>4.12</junit.version>
<kerby.version>1.0.1</kerby.version>
@@ -65,7 +64,7 @@
<spring.version>4.3.10.RELEASE</spring.version>
<spring.security.version>4.2.3.RELEASE</spring.security.version>
<tomcat8.version>8.5.20</tomcat8.version>
- <wss4j.version>2.1.11</wss4j.version>
+ <wss4j.version>2.2.0</wss4j.version>
<tomcat.url>http://localhost:8080/manager/text</tomcat.url>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
diff --git a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
index 2c8ee5a..264fb0f 100644
--- a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
+++ b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/samlsso/AuthnRequestParser.java
@@ -318,9 +318,10 @@ public class AuthnRequestParser {
if (keyInfo != null) {
try {
Document doc = signature.getDOM().getOwnerDocument();
+ requestData.setWsDocInfo(new WSDocInfo(doc));
samlKeyInfo =
SAMLUtil.getCredentialFromKeyInfo(
- keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData, new WSDocInfo(doc)), sigCrypto
+ keyInfo.getDOM(), new WSSSAMLKeyInfoProcessor(requestData), sigCrypto
);
} catch (WSSecurityException ex) {
LOG.debug("Error in getting KeyInfo from SAML AuthnRequest: {}", ex.getMessage(), ex);
diff --git a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/wsfed/WfreshParser.java b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/wsfed/WfreshParser.java
index f9dee3a..78c339c 100644
--- a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/wsfed/WfreshParser.java
+++ b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/beans/wsfed/WfreshParser.java
@@ -18,7 +18,7 @@
*/
package org.apache.cxf.fediz.service.idp.beans.wsfed;
-import java.util.Date;
+import java.time.Instant;
import org.apache.cxf.fediz.service.idp.util.WebUtils;
import org.apache.cxf.ws.security.tokenstore.SecurityToken;
@@ -61,11 +61,10 @@ public class WfreshParser {
long ttlMs = ttl * 60L * 1000L;
if (ttlMs > 0) {
- Date createdDate = idpToken.getCreated();
+ Instant createdDate = idpToken.getCreated();
if (createdDate != null) {
- Date expiryDate = new Date();
- expiryDate.setTime(createdDate.getTime() + ttlMs);
- if (expiryDate.before(new Date())) {
+ Instant expiryDate = createdDate.plusMillis(ttlMs);
+ if (expiryDate.isBefore(Instant.now())) {
LOG.info("[IDP_TOKEN="
+ idpToken.getId()
+ "] is valid but relying party requested new authentication caused by wfresh="
diff --git a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpOAuth2ProtocolHandler.java b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpOAuth2ProtocolHandler.java
index f5182c8..a59daeb 100644
--- a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpOAuth2ProtocolHandler.java
+++ b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/AbstractTrustedIdpOAuth2ProtocolHandler.java
@@ -24,6 +24,7 @@ import java.io.UnsupportedEncodingException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLEncoder;
+import java.time.Instant;
import java.util.Date;
import javax.security.auth.callback.Callback;
@@ -115,8 +116,8 @@ public abstract class AbstractTrustedIdpOAuth2ProtocolHandler extends AbstractTr
}
protected SamlAssertionWrapper createSamlAssertion(Idp idp, TrustedIdp trustedIdp, String subjectName,
- Date notBefore,
- Date expires) throws Exception {
+ Instant notBefore,
+ Instant expires) throws Exception {
SamlCallbackHandler callbackHandler = new SamlCallbackHandler();
String issuer = idp.getServiceDisplayName();
if (issuer == null) {
@@ -133,9 +134,9 @@ public abstract class AbstractTrustedIdpOAuth2ProtocolHandler extends AbstractTr
// Conditions
ConditionsBean conditionsBean = new ConditionsBean();
- conditionsBean.setNotAfter(new DateTime(expires));
+ conditionsBean.setNotAfter(new DateTime(Date.from(expires)));
if (notBefore != null) {
- DateTime notBeforeDT = new DateTime(notBefore);
+ DateTime notBeforeDT = new DateTime(Date.from(notBefore));
conditionsBean.setNotBefore(notBeforeDT);
} else {
conditionsBean.setNotBefore(new DateTime());
diff --git a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpFacebookProtocolHandler.java b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpFacebookProtocolHandler.java
index bde582b..bafb62c 100644
--- a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpFacebookProtocolHandler.java
+++ b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpFacebookProtocolHandler.java
@@ -19,9 +19,9 @@
package org.apache.cxf.fediz.service.idp.protocols;
+import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
-import java.util.Date;
import java.util.List;
import javax.ws.rs.core.Form;
@@ -125,8 +125,7 @@ public class TrustedIdpFacebookProtocolHandler extends AbstractTrustedIdpOAuth2P
}
// Convert into a SAML Token
- Date expires = new Date();
- expires.setTime(expires.getTime() + (accessToken.getExpiresIn() * 1000L));
+ Instant expires = Instant.now().plusSeconds(accessToken.getExpiresIn());
SecurityToken idpToken = new SecurityToken(IDGenerator.generateID(null), null, expires);
SamlAssertionWrapper assertion =
createSamlAssertion(idp, trustedIdp, subjectName, null, expires);
diff --git a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java
index 0751d39..1e478e3 100644
--- a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java
+++ b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/protocols/TrustedIdpOIDCProtocolHandler.java
@@ -22,8 +22,8 @@ package org.apache.cxf.fediz.service.idp.protocols;
import java.io.IOException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
+import java.time.Instant;
import java.util.ArrayList;
-import java.util.Date;
import java.util.List;
import java.util.Map;
@@ -188,13 +188,13 @@ public class TrustedIdpOIDCProtocolHandler extends AbstractTrustedIdpOAuth2Proto
// Make sure the received token is valid according to the spec
validateToken(jwt, clientId);
- Date created = new Date((long)jwt.getClaim(JwtConstants.CLAIM_ISSUED_AT) * 1000L);
- Date notBefore = null;
+ Instant created = Instant.ofEpochSecond((long)jwt.getClaim(JwtConstants.CLAIM_ISSUED_AT));
+ Instant notBefore = null;
if (jwt.getClaim(JwtConstants.CLAIM_NOT_BEFORE) != null) {
- notBefore = new Date((long)jwt.getClaim(JwtConstants.CLAIM_NOT_BEFORE) * 1000L);
+ notBefore = Instant.ofEpochSecond((long)jwt.getClaim(JwtConstants.CLAIM_NOT_BEFORE));
}
- Date expires = new Date((long)jwt.getClaim(JwtConstants.CLAIM_EXPIRY) * 1000L);
+ Instant expires = Instant.ofEpochSecond((long)jwt.getClaim(JwtConstants.CLAIM_EXPIRY));
// Subject
String subjectName = getProperty(trustedIdp, SUBJECT_CLAIM);
diff --git a/services/idp/src/main/resources/restContext.xml b/services/idp/src/main/resources/restContext.xml
index 6245c51..e33094f 100644
--- a/services/idp/src/main/resources/restContext.xml
+++ b/services/idp/src/main/resources/restContext.xml
@@ -56,7 +56,7 @@
<bean id="jsonProvider" class="com.fasterxml.jackson.jaxrs.json.JacksonJaxbJsonProvider" />
<!-- CXF Swagger2Feature -->
- <bean id="swagger2Serializers" class="org.apache.cxf.jaxrs.swagger.DefaultSwagger2Serializers">
+ <bean id="swagger2Customizer" class="org.apache.cxf.jaxrs.swagger.Swagger2Customizer">
<property name="replaceTags" value="true" />
</bean>
<bean id="swagger2Feature" class="org.apache.cxf.jaxrs.swagger.Swagger2Feature">
@@ -68,7 +68,7 @@
<property name="resourcePackage" value="org.apache.cxf.fediz.service.idp.rest" />
<property name="scanAllResources" value="true" />
- <property name="swagger2Serializers" ref="swagger2Serializers" />
+ <property name="customizer" ref="swagger2Customizer" />
<property name="prettyPrint" value="true" />
</bean>
diff --git a/systests/custom/src/test/java/custom/CustomClaimsHandler.java b/systests/custom/src/test/java/custom/CustomClaimsHandler.java
index f87bd9d..f308682 100644
--- a/systests/custom/src/test/java/custom/CustomClaimsHandler.java
+++ b/systests/custom/src/test/java/custom/CustomClaimsHandler.java
@@ -77,10 +77,11 @@ public class CustomClaimsHandler implements ClaimsHandler {
ClaimsParameters parameters) {
// Insist that a "realm" Custom Content is available in the RST with a value equal to "custom-realm"
- List<Element> customContent = parameters.getTokenRequirements().getCustomContent();
+ List<Object> customContent = parameters.getTokenRequirements().getCustomContent();
boolean foundRealm = false;
- for (Element customContentElement : customContent) {
- Element customRealm = XMLUtils.findElement(customContentElement, "realm", "http://cxf.apache.org/custom");
+ for (Object customContentElement : customContent) {
+ Element customRealm =
+ XMLUtils.findElement((Element)customContentElement, "realm", "http://cxf.apache.org/custom");
if (customRealm != null) {
String realmStr = customRealm.getTextContent();
if ("custom-realm".equals(realmStr)) {
--
To stop receiving notification emails like this one, please contact
['"commits@cxf.apache.org" <co...@cxf.apache.org>'].