You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2011/02/23 17:48:06 UTC
svn commit: r1073823 [2/3] - in /webservices/wss4j/trunk/src:
main/java/org/apache/ws/security/components/crypto/
main/java/org/apache/ws/security/message/
main/java/org/apache/ws/security/message/token/
main/java/org/apache/ws/security/processor/ main...
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/components/crypto/Merlin.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/components/crypto/Merlin.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/components/crypto/Merlin.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/components/crypto/Merlin.java Wed Feb 23 16:48:04 2011
@@ -21,16 +21,49 @@ package org.apache.ws.security.component
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
+import org.apache.ws.security.WSPasswordCallback;
+import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.util.Loader;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.math.BigInteger;
import java.security.GeneralSecurityException;
+import java.security.Key;
import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertPath;
+import java.security.cert.CertPathValidator;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
+import java.security.cert.PKIXParameters;
+import java.security.cert.TrustAnchor;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Enumeration;
+import java.util.HashSet;
+import java.util.List;
import java.util.Properties;
+import java.util.Set;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.x500.X500Principal;
+
+/**
+ * A Crypto implementation based on two Java KeyStore objects, one being the keystore, and one
+ * being the truststore.
+ */
public class Merlin extends CryptoBase {
/*
@@ -78,6 +111,8 @@ public class Merlin extends CryptoBase {
protected static CertificateFactory certFact;
protected Properties properties = null;
+ protected KeyStore keystore = null;
+ protected KeyStore truststore = null;
public Merlin() {
// default constructor
@@ -110,10 +145,16 @@ public class Merlin extends CryptoBase {
}
if (provider != null) {
provider = provider.trim();
+ cryptoProvider = provider;
}
//
// Load the KeyStore
//
+ String alias = properties.getProperty(KEYSTORE_ALIAS);
+ if (alias != null) {
+ alias = alias.trim();
+ defaultAlias = alias;
+ }
String keyStoreLocation = properties.getProperty(KEYSTORE_FILE);
if (keyStoreLocation == null) {
keyStoreLocation = properties.getProperty(OLD_KEYSTORE_FILE);
@@ -205,6 +246,7 @@ public class Merlin extends CryptoBase {
}
}
}
+
}
@@ -278,49 +320,977 @@ public class Merlin extends CryptoBase {
}
return ks;
}
-
+
+ //
+ // Accessor methods
+ //
+
+ /**
+ * Gets the Keystore that was loaded
+ *
+ * @return the Keystore
+ */
+ public KeyStore getKeyStore() {
+ return keystore;
+ }
+
+ /**
+ * Set the Keystore on this Crypto instance
+ *
+ * @param keyStore the Keystore to set
+ */
+ public void setKeyStore(KeyStore keyStore) {
+ keystore = keyStore;
+ }
+
+ /**
+ * Gets the trust store that was loaded by the underlying implementation
+ *
+ * @return the trust store
+ */
+ public KeyStore getTrustStore() {
+ return truststore;
+ }
+
+ /**
+ * Set the trust store on this Crypto instance
+ *
+ * @param trustStore the trust store to set
+ */
+ public void setTrustStore(KeyStore trustStore) {
+ truststore = trustStore;
+ }
+
+ /**
+ * Singleton certificate factory for this Crypto instance.
+ * <p/>
+ *
+ * @return Returns a <code>CertificateFactory</code> to construct
+ * X509 certificates
+ * @throws org.apache.ws.security.WSSecurityException
+ */
@Override
- public String
- getCryptoProvider() {
- if (cryptoProvider != null) {
- return cryptoProvider;
- } else {
- if (properties == null) {
- return null;
- }
- String provider = properties.getProperty(CRYPTO_PROVIDER);
- if (provider == null) {
- provider = properties.getProperty(OLD_CRYPTO_CERT_PROVIDER);
+ public CertificateFactory getCertificateFactory() throws WSSecurityException {
+ String provider = getCryptoProvider();
+ String keyStoreProvider = null;
+ if (keystore != null) {
+ keyStoreProvider = keystore.getProvider().getName();
+ }
+
+ //Try to find a CertificateFactory that generates certs that are fully
+ //compatible with the certs in the KeyStore (Sun -> Sun, BC -> BC, etc...)
+ CertificateFactory factory = null;
+ if (provider != null) {
+ factory = certFactMap.get(provider);
+ } else if (keyStoreProvider != null) {
+ factory =
+ certFactMap.get(mapKeystoreProviderToCertProvider(keyStoreProvider));
+ if (factory == null) {
+ factory = certFactMap.get(keyStoreProvider);
}
- if (provider != null) {
- provider = provider.trim();
+ } else {
+ factory = certFactMap.get("DEFAULT");
+ }
+ if (factory == null) {
+ try {
+ if (provider == null || provider.length() == 0) {
+ if (keyStoreProvider != null && keyStoreProvider.length() != 0) {
+ try {
+ factory =
+ CertificateFactory.getInstance(
+ "X.509", mapKeystoreProviderToCertProvider(keyStoreProvider)
+ );
+ certFactMap.put(keyStoreProvider, factory);
+ certFactMap.put(
+ mapKeystoreProviderToCertProvider(keyStoreProvider), factory
+ );
+ } catch (Exception ex) {
+ log.debug(ex);
+ //Ignore, we'll just use the default since they didn't specify one.
+ //Hopefully that will work for them.
+ }
+ }
+ if (factory == null) {
+ factory = CertificateFactory.getInstance("X.509");
+ certFactMap.put("DEFAULT", factory);
+ }
+ } else {
+ factory = CertificateFactory.getInstance("X.509", provider);
+ certFactMap.put(provider, factory);
+ }
+ certFactMap.put(factory.getProvider().getName(), factory);
+ } catch (CertificateException e) {
+ throw new WSSecurityException(
+ WSSecurityException.SECURITY_TOKEN_UNAVAILABLE, "unsupportedCertType",
+ null, e
+ );
+ } catch (NoSuchProviderException e) {
+ throw new WSSecurityException(
+ WSSecurityException.SECURITY_TOKEN_UNAVAILABLE, "noSecProvider",
+ null, e
+ );
}
- return provider;
}
+ return factory;
+ }
+
+ private String mapKeystoreProviderToCertProvider(String s) {
+ if ("SunJSSE".equals(s)) {
+ return "SUN";
+ }
+ return s;
}
/**
- * Retrieves the alias name of the default certificate which has been
- * specified as a property. This should be the certificate that is used for
- * signature and encryption. This alias corresponds to the certificate that
- * should be used whenever KeyInfo is not present in a signed or
- * an encrypted message. May return null.
+ * Retrieves the identifier name of the default certificate. This should be the certificate
+ * that is used for signature and encryption. This identifier corresponds to the certificate
+ * that should be used whenever KeyInfo is not present in a signed or an encrypted
+ * message. May return null. The identifier is implementation specific, e.g. it could be the
+ * KeyStore alias.
*
- * @return alias name of the default X509 certificate
+ * @return name of the default X509 certificate.
*/
@Override
- public String getDefaultX509Alias() {
+ public String getDefaultX509Identifier() throws WSSecurityException {
if (defaultAlias != null) {
return defaultAlias;
+ }
+
+ if (keystore != null) {
+ try {
+ Enumeration<String> as = keystore.aliases();
+ if (as.hasMoreElements()) {
+ String alias = as.nextElement();
+ if (!as.hasMoreElements()) {
+ defaultAlias = alias;
+ return alias;
+ }
+ }
+ } catch (KeyStoreException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "keystore", null, ex
+ );
+ }
+ }
+ return null;
+ }
+
+ //
+ // Keystore-specific Crypto functionality methods
+ //
+
+ /**
+ * Get an X509Certificate (chain) corresponding to the CryptoType argument. The supported
+ * types are as follows:
+ *
+ * TYPE.ISSUER_SERIAL - A certificate (chain) is located by the issuer name and serial number
+ * TYPE.THUMBPRINT_SHA1 - A certificate (chain) is located by the SHA1 of the (root) cert
+ * TYPE.SKI_BYTES - A certificate (chain) is located by the SKI bytes of the (root) cert
+ * TYPE.SUBJECT_DN - A certificate (chain) is located by the Subject DN of the (root) cert
+ * TYPE.ALIAS - A certificate (chain) is located by an alias, which for this implementation
+ * means an alias of the keystore or truststore.
+ */
+ public X509Certificate[] getX509Certificates(CryptoType cryptoType) throws WSSecurityException {
+ if (cryptoType == null) {
+ return null;
+ }
+ CryptoType.TYPE type = cryptoType.getType();
+ X509Certificate[] certs = null;
+ switch (type) {
+ case ISSUER_SERIAL: {
+ certs = getX509Certificates(cryptoType.getIssuer(), cryptoType.getSerial());
+ break;
+ }
+ case THUMBPRINT_SHA1: {
+ certs = getX509Certificates(cryptoType.getBytes());
+ break;
+ }
+ case SKI_BYTES: {
+ certs = getX509CertificatesSKI(cryptoType.getBytes());
+ break;
+ }
+ case SUBJECT_DN: {
+ certs = getX509CertificatesSubjectDN(cryptoType.getSubjectDN());
+ break;
+ }
+ case ALIAS: {
+ certs = getX509Certificates(cryptoType.getAlias());
+ break;
+ }
+ }
+ return certs;
+ }
+
+ /**
+ * Get the implementation-specific identifier corresponding to the cert parameter. In this
+ * case, the identifier corresponds to a KeyStore alias.
+ * @param cert The X509Certificate for which to search for an identifier
+ * @return the identifier corresponding to the cert parameter
+ * @throws WSSecurityException
+ */
+ public String getX509Identifier(X509Certificate cert) throws WSSecurityException {
+ String identifier = null;
+
+ if (keystore != null) {
+ identifier = getIdentifier(cert, keystore);
+ }
+
+ if (identifier == null && truststore != null) {
+ identifier = getIdentifier(cert, truststore);
+ }
+
+ return identifier;
+ }
+
+ /**
+ * Gets the private key corresponding to the certificate.
+ *
+ * @param certificate The X509Certificate corresponding to the private key
+ * @param callbackHandler The callbackHandler needed to get the password
+ * @return The private key
+ */
+ public PrivateKey getPrivateKey(
+ X509Certificate certificate,
+ CallbackHandler callbackHandler
+ ) throws WSSecurityException {
+ if (keystore == null) {
+ throw new WSSecurityException("The keystore is null");
+ }
+ if (callbackHandler == null) {
+ throw new WSSecurityException("The CallbackHandler is null");
+ }
+
+ String identifier = getIdentifier(certificate, keystore);
+ try {
+ if (identifier == null || !keystore.isKeyEntry(identifier)) {
+ String msg = "Cannot find key for alias: [" + identifier + "]";
+ String logMsg = createKeyStoreErrorMessage(keystore);
+ log.error(msg + logMsg);
+ throw new WSSecurityException(msg);
+ }
+ String password = getPassword(identifier, callbackHandler);
+ Key keyTmp = keystore.getKey(identifier, password == null
+ ? new char[]{} : password.toCharArray());
+ if (!(keyTmp instanceof PrivateKey)) {
+ String msg = "Key is not a private key, alias: [" + identifier + "]";
+ String logMsg = createKeyStoreErrorMessage(keystore);
+ log.error(msg + logMsg);
+ throw new WSSecurityException(msg);
+ }
+ return (PrivateKey) keyTmp;
+ } catch (KeyStoreException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noPrivateKey", new Object[]{ex.getMessage()}, ex
+ );
+ } catch (UnrecoverableKeyException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noPrivateKey", new Object[]{ex.getMessage()}, ex
+ );
+ } catch (NoSuchAlgorithmException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noPrivateKey", new Object[]{ex.getMessage()}, ex
+ );
+ }
+ }
+
+ /**
+ * Gets the private key corresponding to the identifier.
+ *
+ * @param identifier The implementation-specific identifier corresponding to the key
+ * @param password The password needed to get the key
+ * @return The private key
+ */
+ public PrivateKey getPrivateKey(
+ String identifier,
+ String password
+ ) throws WSSecurityException {
+ if (keystore == null) {
+ throw new WSSecurityException("The keystore is null");
+ }
+ try {
+ if (identifier == null || !keystore.isKeyEntry(identifier)) {
+ String msg = "Cannot find key for alias: [" + identifier + "]";
+ String logMsg = createKeyStoreErrorMessage(keystore);
+ log.error(msg + logMsg);
+ throw new WSSecurityException(msg);
+ }
+ Key keyTmp = keystore.getKey(identifier, password == null
+ ? new char[]{} : password.toCharArray());
+ if (!(keyTmp instanceof PrivateKey)) {
+ String msg = "Key is not a private key, alias: [" + identifier + "]";
+ String logMsg = createKeyStoreErrorMessage(keystore);
+ log.error(msg + logMsg);
+ throw new WSSecurityException(msg);
+ }
+ return (PrivateKey) keyTmp;
+ } catch (KeyStoreException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noPrivateKey", new Object[]{ex.getMessage()}, ex
+ );
+ } catch (UnrecoverableKeyException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noPrivateKey", new Object[]{ex.getMessage()}, ex
+ );
+ } catch (NoSuchAlgorithmException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noPrivateKey", new Object[]{ex.getMessage()}, ex
+ );
+ }
+ }
+
+ /**
+ * Evaluate whether a given certificate chain should be trusted.
+ * Uses the CertPath API to validate a given certificate chain.
+ *
+ * @param certs Certificate chain to validate
+ * @return true if the certificate chain is valid, false otherwise
+ * @throws WSSecurityException
+ */
+ public boolean verifyTrust(X509Certificate[] certs) throws WSSecurityException {
+ try {
+ // Generate cert path
+ List<X509Certificate> certList = Arrays.asList(certs);
+ CertPath path = getCertificateFactory().generateCertPath(certList);
+
+ Set<TrustAnchor> set = new HashSet<TrustAnchor>();
+ if (truststore != null) {
+ Enumeration<String> truststoreAliases = truststore.aliases();
+ while (truststoreAliases.hasMoreElements()) {
+ String alias = truststoreAliases.nextElement();
+ X509Certificate cert =
+ (X509Certificate) truststore.getCertificate(alias);
+ if (cert != null) {
+ TrustAnchor anchor =
+ new TrustAnchor(cert, cert.getExtensionValue(NAME_CONSTRAINTS_OID));
+ set.add(anchor);
+ }
+ }
+ }
+
+ // Add certificates from the keystore
+ if (keystore != null) {
+ Enumeration<String> aliases = keystore.aliases();
+ while (aliases.hasMoreElements()) {
+ String alias = aliases.nextElement();
+ X509Certificate cert =
+ (X509Certificate) keystore.getCertificate(alias);
+ if (cert != null) {
+ TrustAnchor anchor =
+ new TrustAnchor(cert, cert.getExtensionValue(NAME_CONSTRAINTS_OID));
+ set.add(anchor);
+ }
+ }
+ }
+
+ PKIXParameters param = new PKIXParameters(set);
+
+ // Do not check a revocation list
+ param.setRevocationEnabled(false);
+
+ // Verify the trust path using the above settings
+ String provider = getCryptoProvider();
+ CertPathValidator validator = null;
+ if (provider == null || provider.length() == 0) {
+ validator = CertPathValidator.getInstance("PKIX");
+ } else {
+ validator = CertPathValidator.getInstance("PKIX", provider);
+ }
+ validator.validate(path, param);
+ return true;
+ } catch (java.security.NoSuchProviderException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "certpath",
+ new Object[] { e.getMessage() }, e
+ );
+ } catch (java.security.NoSuchAlgorithmException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE,
+ "certpath", new Object[] { e.getMessage() },
+ e
+ );
+ } catch (java.security.cert.CertificateException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "certpath",
+ new Object[] { e.getMessage() }, e
+ );
+ } catch (java.security.InvalidAlgorithmParameterException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "certpath",
+ new Object[] { e.getMessage() }, e
+ );
+ } catch (java.security.cert.CertPathValidatorException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "certpath",
+ new Object[] { e.getMessage() }, e
+ );
+ } catch (java.security.KeyStoreException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "certpath",
+ new Object[] { e.getMessage() }, e
+ );
+ }
+ }
+
+ /**
+ * Evaluate whether a given public key should be trusted.
+ *
+ * @param publicKey The PublicKey to be evaluated
+ * @return whether the PublicKey parameter is trusted or not
+ */
+ public boolean verifyTrust(PublicKey publicKey) throws WSSecurityException {
+ //
+ // If the public key is null, do not trust the signature
+ //
+ if (publicKey == null) {
+ return false;
+ }
+
+ //
+ // Search the keystore for the transmitted public key (direct trust)
+ //
+ boolean trust = findPublicKeyInKeyStore(publicKey, keystore);
+ if (trust) {
+ return true;
} else {
- if (properties == null) {
+ //
+ // Now search the truststore for the transmitted public key (direct trust)
+ //
+ trust = findPublicKeyInKeyStore(publicKey, truststore);
+ if (trust) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Get an X509 Certificate (chain) according to a given serial number and issuer string.
+ *
+ * @param issuer The Issuer String
+ * @param serialNumber The serial number of the certificate
+ * @return an X509 Certificate (chain) corresponding to the found certificate(s)
+ * @throws WSSecurityException
+ */
+ private X509Certificate[] getX509Certificates(
+ String issuer,
+ BigInteger serialNumber
+ ) throws WSSecurityException {
+ //
+ // Convert the subject DN to a java X500Principal object first. This is to ensure
+ // interop with a DN constructed from .NET, where e.g. it uses "S" instead of "ST".
+ // Then convert it to a BouncyCastle X509Name, which will order the attributes of
+ // the DN in a particular way (see WSS-168). If the conversion to an X500Principal
+ // object fails (e.g. if the DN contains "E" instead of "EMAILADDRESS"), then fall
+ // back on a direct conversion to a BC X509Name
+ //
+ Object issuerName = null;
+ try {
+ X500Principal issuerRDN = new X500Principal(issuer);
+ issuerName = createBCX509Name(issuerRDN.getName());
+ } catch (java.lang.IllegalArgumentException ex) {
+ issuerName = createBCX509Name(issuer);
+ }
+ Certificate[] certs = null;
+ if (keystore != null) {
+ certs = getCertificates(issuerName, serialNumber, keystore);
+ }
+
+ //If we can't find the issuer in the keystore then look at the truststore
+ if ((certs == null || certs.length == 0) && truststore != null) {
+ certs = getCertificates(issuerName, serialNumber, truststore);
+ }
+
+ if ((certs == null || certs.length == 0)) {
+ return null;
+ }
+
+ X509Certificate[] x509certs = new X509Certificate[certs.length];
+ for (int i = 0; i < certs.length; i++) {
+ x509certs[i] = (X509Certificate) certs[i];
+ }
+ return x509certs;
+ }
+
+ /**
+ * Get an X509 Certificate (chain) of the X500Principal argument in the supplied KeyStore
+ * @param subjectRDN either an X500Principal or a BouncyCastle X509Name instance.
+ * @param store The KeyStore
+ * @return an X509 Certificate (chain)
+ * @throws WSSecurityException
+ */
+ private Certificate[] getCertificates(
+ Object issuerRDN,
+ BigInteger serialNumber,
+ KeyStore store
+ ) throws WSSecurityException {
+ try {
+ for (Enumeration<String> e = store.aliases(); e.hasMoreElements();) {
+ String alias = e.nextElement();
+ Certificate cert = null;
+ Certificate[] certs = store.getCertificateChain(alias);
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ cert = store.getCertificate(alias);
+ if (cert == null) {
+ continue;
+ }
+ certs = new Certificate[]{cert};
+ } else {
+ cert = certs[0];
+ }
+ if (cert instanceof X509Certificate) {
+ X509Certificate x509cert = (X509Certificate) cert;
+ if (x509cert.getSerialNumber().compareTo(serialNumber) == 0) {
+ Object certName =
+ createBCX509Name(x509cert.getIssuerX500Principal().getName());
+ if (certName.equals(issuerRDN)) {
+ if (certs == null) {
+ return new Certificate[]{cert};
+ } else {
+ return certs;
+ }
+ }
+ }
+ }
+ }
+ } catch (KeyStoreException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "keystore", null, e
+ );
+ }
+ return new Certificate[]{};
+ }
+
+ /**
+ * Get an X509 Certificate (chain) according to a given Thumbprint.
+ *
+ * @param thumbprint The SHA1 thumbprint info bytes
+ * @return the X509 Certificate (chain) that was found (can be null)
+ * @throws WSSecurityException if problems during keystore handling or wrong certificate
+ */
+ private X509Certificate[] getX509Certificates(byte[] thumbprint) throws WSSecurityException {
+ MessageDigest sha = null;
+
+ if (keystore == null) {
+ return null;
+ }
+
+ try {
+ sha = MessageDigest.getInstance("SHA1");
+ } catch (NoSuchAlgorithmException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "noSHA1availabe", null, e
+ );
+ }
+ Certificate[] certs = null;
+ if (keystore != null) {
+ certs = getCertificates(thumbprint, keystore, sha);
+ }
+
+ //If we can't find the issuer in the keystore then look at the truststore
+ if ((certs == null || certs.length == 0) && truststore != null) {
+ certs = getCertificates(thumbprint, truststore, sha);
+ }
+
+ if ((certs == null || certs.length == 0)) {
+ return null;
+ }
+
+ X509Certificate[] x509certs = new X509Certificate[certs.length];
+ for (int i = 0; i < certs.length; i++) {
+ x509certs[i] = (X509Certificate) certs[i];
+ }
+ return x509certs;
+ }
+
+ /**
+ * Get an X509 Certificate (chain) of the X500Principal argument in the supplied KeyStore
+ * @param subjectRDN either an X500Principal or a BouncyCastle X509Name instance.
+ * @param store The KeyStore
+ * @return an X509 Certificate (chain)
+ * @throws WSSecurityException
+ */
+ private Certificate[] getCertificates(
+ byte[] thumbprint,
+ KeyStore store,
+ MessageDigest sha
+ ) throws WSSecurityException {
+ try {
+ for (Enumeration<String> e = store.aliases(); e.hasMoreElements();) {
+ String alias = e.nextElement();
+ Certificate cert = null;
+ Certificate[] certs = store.getCertificateChain(alias);
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ cert = store.getCertificate(alias);
+ if (cert == null) {
+ continue;
+ }
+ certs = new Certificate[]{cert};
+ } else {
+ cert = certs[0];
+ }
+ if (cert instanceof X509Certificate) {
+ X509Certificate x509cert = (X509Certificate) cert;
+ try {
+ sha.update(x509cert.getEncoded());
+ } catch (CertificateEncodingException ex) {
+ throw new WSSecurityException(
+ WSSecurityException.SECURITY_TOKEN_UNAVAILABLE, "encodeError",
+ null, ex
+ );
+ }
+ byte[] data = sha.digest();
+
+ if (Arrays.equals(data, thumbprint)) {
+ if (certs == null) {
+ return new Certificate[]{x509cert};
+ } else {
+ return certs;
+ }
+ }
+ }
+ }
+ } catch (KeyStoreException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "keystore", null, e
+ );
+ }
+ return new Certificate[]{};
+ }
+
+ /**
+ * Get an X509 Certificate (chain) according to a given SubjectKeyIdentifier.
+ *
+ * @param skiBytes The SKI bytes
+ * @return the X509 certificate (chain) that was found (can be null)
+ */
+ private X509Certificate[] getX509CertificatesSKI(byte[] skiBytes) throws WSSecurityException {
+ Certificate[] certs = null;
+ if (keystore != null) {
+ certs = getCertificates(skiBytes, keystore);
+ }
+
+ //If we can't find the issuer in the keystore then look at the truststore
+ if ((certs == null || certs.length == 0) && truststore != null) {
+ certs = getCertificates(skiBytes, truststore);
+ }
+
+ if ((certs == null || certs.length == 0)) {
+ return null;
+ }
+
+ X509Certificate[] x509certs = new X509Certificate[certs.length];
+ for (int i = 0; i < certs.length; i++) {
+ x509certs[i] = (X509Certificate) certs[i];
+ }
+ return x509certs;
+ }
+
+ /**
+ * Get an X509 Certificate (chain) of the X500Principal argument in the supplied KeyStore
+ * @param subjectRDN either an X500Principal or a BouncyCastle X509Name instance.
+ * @param store The KeyStore
+ * @return an X509 Certificate (chain)
+ * @throws WSSecurityException
+ */
+ private Certificate[] getCertificates(
+ byte[] skiBytes,
+ KeyStore store
+ ) throws WSSecurityException {
+ try {
+ for (Enumeration<String> e = store.aliases(); e.hasMoreElements();) {
+ String alias = e.nextElement();
+ Certificate cert = null;
+ Certificate[] certs = store.getCertificateChain(alias);
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ cert = store.getCertificate(alias);
+ if (cert == null) {
+ continue;
+ }
+ certs = new Certificate[]{cert};
+ } else {
+ cert = certs[0];
+ }
+ if (cert instanceof X509Certificate) {
+ X509Certificate x509cert = (X509Certificate) cert;
+ byte[] data = getSKIBytesFromCert(x509cert);
+ if (data.length == skiBytes.length && Arrays.equals(data, skiBytes)) {
+ if (certs == null) {
+ return new Certificate[]{x509cert};
+ } else {
+ return certs;
+ }
+ }
+ }
+ }
+ } catch (KeyStoreException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "keystore", null, e
+ );
+ }
+ return new Certificate[]{};
+ }
+
+ /**
+ * Get an X509 Certificate (chain) according to a given DN of the subject of the certificate
+ *
+ * @param subjectDN The DN of subject to look for
+ * @return An X509 Certificate (chain) with the same DN as given in the parameters
+ * @throws WSSecurityException
+ */
+ private X509Certificate[] getX509CertificatesSubjectDN(String subjectDN) throws WSSecurityException {
+ //
+ // Convert the subject DN to a java X500Principal object first. This is to ensure
+ // interop with a DN constructed from .NET, where e.g. it uses "S" instead of "ST".
+ // Then convert it to a BouncyCastle X509Name, which will order the attributes of
+ // the DN in a particular way (see WSS-168). If the conversion to an X500Principal
+ // object fails (e.g. if the DN contains "E" instead of "EMAILADDRESS"), then fall
+ // back on a direct conversion to a BC X509Name
+ //
+ Object subject;
+ try {
+ X500Principal subjectRDN = new X500Principal(subjectDN);
+ subject = createBCX509Name(subjectRDN.getName());
+ } catch (java.lang.IllegalArgumentException ex) {
+ subject = createBCX509Name(subjectDN);
+ }
+
+ Certificate[] certs = null;
+ if (keystore != null) {
+ certs = getCertificates(subject, keystore);
+ }
+
+ //If we can't find the issuer in the keystore then look at the truststore
+ if ((certs == null || certs.length == 0) && truststore != null) {
+ certs = getCertificates(subject, truststore);
+ }
+
+ if ((certs == null || certs.length == 0)) {
+ return null;
+ }
+
+ X509Certificate[] x509certs = new X509Certificate[certs.length];
+ for (int i = 0; i < certs.length; i++) {
+ x509certs[i] = (X509Certificate) certs[i];
+ }
+ return x509certs;
+ }
+
+ /**
+ * Get an X509 Certificate (chain) that correspond to the identifier. For this implementation,
+ * the identifier corresponds to the KeyStore alias.
+ *
+ * @param identifier The identifier that corresponds to the returned certs
+ * @return an X509 Certificate (chain) that corresponds to the identifier
+ */
+ private X509Certificate[] getX509Certificates(String identifier) throws WSSecurityException {
+ Certificate[] certs = null;
+ try {
+ if (keystore != null) {
+ // There's a chance that there can only be a set of trust stores
+ certs = keystore.getCertificateChain(identifier);
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ Certificate cert = keystore.getCertificate(identifier);
+ if (cert != null) {
+ certs = new Certificate[]{cert};
+ }
+ }
+ }
+
+ if (certs == null && truststore != null) {
+ // Now look into the trust stores
+ certs = truststore.getCertificateChain(identifier);
+ if (certs == null) {
+ Certificate cert = truststore.getCertificate(identifier);
+ if (cert != null) {
+ certs = new Certificate[]{cert};
+ }
+ }
+ }
+
+ if (certs == null) {
return null;
}
- String alias = properties.getProperty(KEYSTORE_ALIAS);
- if (alias != null) {
- alias = alias.trim();
+ } catch (KeyStoreException e) {
+ throw new WSSecurityException(WSSecurityException.FAILURE, "keystore", null, e);
+ }
+
+ X509Certificate[] x509certs = new X509Certificate[certs.length];
+ for (int i = 0; i < certs.length; i++) {
+ x509certs[i] = (X509Certificate) certs[i];
+ }
+ return x509certs;
+ }
+
+ /**
+ * Find the Public Key in a keystore.
+ */
+ private boolean findPublicKeyInKeyStore(PublicKey publicKey, KeyStore keyStoreToSearch) {
+ try {
+ for (Enumeration<String> e = keyStoreToSearch.aliases(); e.hasMoreElements();) {
+ String alias = e.nextElement();
+ Certificate[] certs = keyStoreToSearch.getCertificateChain(alias);
+ Certificate cert;
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ cert = keyStoreToSearch.getCertificate(alias);
+ if (cert == null) {
+ continue;
+ }
+ } else {
+ cert = certs[0];
+ }
+ if (!(cert instanceof X509Certificate)) {
+ continue;
+ }
+ X509Certificate x509cert = (X509Certificate) cert;
+ if (publicKey.equals(x509cert.getPublicKey())) {
+ return true;
+ }
}
- return alias;
+ } catch (KeyStoreException e) {
+ return false;
}
+ return false;
}
+
+ /**
+ * Get an X509 Certificate (chain) of the X500Principal argument in the supplied KeyStore
+ * @param subjectRDN either an X500Principal or a BouncyCastle X509Name instance.
+ * @param store The KeyStore
+ * @return an X509 Certificate (chain)
+ * @throws WSSecurityException
+ */
+ private Certificate[] getCertificates(Object subjectRDN, KeyStore store)
+ throws WSSecurityException {
+ try {
+ for (Enumeration<String> e = store.aliases(); e.hasMoreElements();) {
+ String alias = e.nextElement();
+ Certificate cert = null;
+ Certificate[] certs = store.getCertificateChain(alias);
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ cert = store.getCertificate(alias);
+ if (cert == null) {
+ continue;
+ }
+ certs = new Certificate[]{cert};
+ } else {
+ cert = certs[0];
+ }
+ if (cert instanceof X509Certificate) {
+ X500Principal foundRDN = ((X509Certificate) cert).getSubjectX500Principal();
+ Object certName = createBCX509Name(foundRDN.getName());
+
+ if (subjectRDN.equals(certName)) {
+ if (certs == null) {
+ return new Certificate[]{cert};
+ } else {
+ return certs;
+ }
+ }
+ }
+ }
+ } catch (KeyStoreException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE, "keystore", null, e
+ );
+ }
+ return new Certificate[]{};
+ }
+
+ private static String createKeyStoreErrorMessage(KeyStore keystore) throws KeyStoreException {
+ Enumeration<String> aliases = keystore.aliases();
+ StringBuilder sb = new StringBuilder(keystore.size() * 7);
+ boolean firstAlias = true;
+ while (aliases.hasMoreElements()) {
+ if (!firstAlias) {
+ sb.append(", ");
+ }
+ sb.append(aliases.nextElement());
+ firstAlias = false;
+ }
+ String msg = " in keystore of type [" + keystore.getType()
+ + "] from provider [" + keystore.getProvider()
+ + "] with size [" + keystore.size() + "] and aliases: {"
+ + sb.toString() + "}";
+ return msg;
+ }
+
+ /**
+ * Get an implementation-specific identifier that corresponds to the X509Certificate. In
+ * this case, the identifier is the KeyStore alias.
+ * @param cert The X509Certificate corresponding to the returned identifier
+ * @param store The KeyStore to search
+ * @return An implementation-specific identifier that corresponds to the X509Certificate
+ */
+ private String getIdentifier(X509Certificate cert, KeyStore store)
+ throws WSSecurityException {
+ try {
+ for (Enumeration<String> e = store.aliases(); e.hasMoreElements();) {
+ String alias = e.nextElement();
+
+ Certificate[] certs = store.getCertificateChain(alias);
+ Certificate retrievedCert = null;
+ if (certs == null || certs.length == 0) {
+ // no cert chain, so lets check if getCertificate gives us a result.
+ retrievedCert = store.getCertificate(alias);
+ if (retrievedCert == null) {
+ continue;
+ }
+ } else {
+ retrievedCert = certs[0];
+ }
+ if (!(retrievedCert instanceof X509Certificate)) {
+ continue;
+ }
+ if (retrievedCert != null && retrievedCert.equals(cert)) {
+ return alias;
+ }
+ }
+ } catch (KeyStoreException e) {
+ throw new WSSecurityException(WSSecurityException.FAILURE, "keystore", null, e);
+ }
+ return null;
+ }
+
+ /**
+ * Get a password from the CallbackHandler
+ * @param identifier The identifier to give to the Callback
+ * @param cb The CallbackHandler
+ * @return The password retrieved from the CallbackHandler
+ * @throws WSSecurityException
+ */
+ private String getPassword(
+ String identifier,
+ CallbackHandler cb
+ ) throws WSSecurityException {
+ WSPasswordCallback pwCb =
+ new WSPasswordCallback(identifier, WSPasswordCallback.DECRYPT);
+ try {
+ Callback[] callbacks = new Callback[]{pwCb};
+ cb.handle(callbacks);
+ } catch (IOException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE,
+ "noPassword",
+ new Object[]{identifier},
+ e
+ );
+ } catch (UnsupportedCallbackException e) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE,
+ "noPassword",
+ new Object[]{identifier},
+ e
+ );
+ }
+
+ return pwCb.getPassword();
+ }
+
+
}
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncrypt.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncrypt.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncrypt.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncrypt.java Wed Feb 23 16:48:04 2011
@@ -26,6 +26,7 @@ import org.apache.ws.security.WSEncrypti
import org.apache.ws.security.WSSConfig;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.token.Reference;
import org.apache.ws.security.message.token.SecurityTokenReference;
import org.apache.ws.security.util.Base64;
@@ -199,7 +200,9 @@ public class WSSecEncrypt extends WSSecE
if (encryptSymmKey) {
X509Certificate remoteCert = useThisCert;
if (remoteCert == null) {
- X509Certificate[] certs = crypto.getCertificates(user);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(user);
+ X509Certificate[] certs = crypto.getX509Certificates(cryptoType);
if (certs == null || certs.length <= 0) {
throw new WSSecurityException(
WSSecurityException.FAILURE,
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncryptedKey.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncryptedKey.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncryptedKey.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecEncryptedKey.java Wed Feb 23 16:48:04 2011
@@ -31,6 +31,7 @@ import org.apache.commons.logging.LogFac
import org.apache.ws.security.WSConstants;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.token.BinarySecurity;
import org.apache.ws.security.message.token.DOMX509Data;
import org.apache.ws.security.message.token.DOMX509IssuerSerial;
@@ -168,7 +169,9 @@ public class WSSecEncryptedKey extends W
//
X509Certificate remoteCert = useThisCert;
if (remoteCert == null) {
- X509Certificate[] certs = crypto.getCertificates(user);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(user);
+ X509Certificate[] certs = crypto.getX509Certificates(cryptoType);
if (certs == null || certs.length <= 0) {
throw new WSSecurityException(
WSSecurityException.FAILURE,
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecSignature.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecSignature.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecSignature.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/WSSecSignature.java Wed Feb 23 16:48:04 2011
@@ -26,6 +26,7 @@ import org.apache.ws.security.WSDocInfo;
import org.apache.ws.security.WSEncryptionPart;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.token.BinarySecurity;
import org.apache.ws.security.message.token.DOMX509Data;
import org.apache.ws.security.message.token.DOMX509IssuerSerial;
@@ -705,7 +706,9 @@ public class WSSecSignature extends WSSe
|| keyIdentifierType == WSConstants.ENCRYPTED_KEY_SHA1_IDENTIFIER
|| keyIdentifierType == WSConstants.CUSTOM_KEY_IDENTIFIER)) {
if (useThisCert == null) {
- certs = crypto.getCertificates(user);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(user);
+ certs = crypto.getX509Certificates(cryptoType);
} else {
certs = new X509Certificate[] {useThisCert};
}
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/PKIPathSecurity.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/PKIPathSecurity.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/PKIPathSecurity.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/PKIPathSecurity.java Wed Feb 23 16:48:04 2011
@@ -72,7 +72,7 @@ public class PKIPathSecurity extends Bin
if (data == null) {
return null;
}
- return crypto.getX509Certificates(data);
+ return crypto.getCertificatesFromBytes(data);
}
/**
@@ -89,7 +89,7 @@ public class PKIPathSecurity extends Bin
if (certs == null) {
throw new WSSecurityException(WSSecurityException.FAILURE, "noCert");
}
- byte[] data = crypto.getCertificateData(certs);
+ byte[] data = crypto.getBytesFromCertificates(certs);
setToken(data);
}
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/SecurityTokenReference.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/SecurityTokenReference.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/SecurityTokenReference.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/message/token/SecurityTokenReference.java Wed Feb 23 16:48:04 2011
@@ -26,6 +26,7 @@ import org.apache.ws.security.WSDocInfo;
import org.apache.ws.security.WSPasswordCallback;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.util.DOM2Writer;
import org.apache.ws.security.util.WSSecurityUtil;
import org.apache.ws.security.util.Base64;
@@ -457,7 +458,6 @@ public class SecurityTokenReference {
public X509Certificate[] getKeyIdentifier(Crypto crypto) throws WSSecurityException {
Element elem = getFirstElement();
String value = elem.getAttribute("ValueType");
- String alias = null;
if (X509Security.X509_V3_TYPE.equals(value)) {
X509Security token = new X509Security(elem);
@@ -466,7 +466,8 @@ public class SecurityTokenReference {
return new X509Certificate[]{cert};
}
} else if (SKI_URI.equals(value)) {
- alias = getX509SKIAlias(crypto);
+ X509Certificate cert = getX509SKIAlias(crypto);
+ return new X509Certificate[]{cert};
} else if (THUMB_URI.equals(value)) {
Node node = getFirstElement().getFirstChild();
if (node == null) {
@@ -474,13 +475,15 @@ public class SecurityTokenReference {
}
if (Node.TEXT_NODE == node.getNodeType()) {
byte[] thumb = Base64.decode(((Text) node).getData());
- alias = crypto.getAliasForX509CertThumb(thumb);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.THUMBPRINT_SHA1);
+ cryptoType.setBytes(thumb);
+ X509Certificate[] certs = crypto.getX509Certificates(cryptoType);
+ if (certs != null) {
+ return new X509Certificate[]{certs[0]};
+ }
}
}
- if (alias != null) {
- return crypto.getCertificates(alias);
- }
return null;
}
@@ -505,18 +508,20 @@ public class SecurityTokenReference {
return null;
}
- public String getX509SKIAlias(Crypto crypto) throws WSSecurityException {
+ public X509Certificate getX509SKIAlias(Crypto crypto) throws WSSecurityException {
if (skiBytes == null) {
skiBytes = getSKIBytes();
if (skiBytes == null) {
return null;
}
}
- String alias = crypto.getAliasForX509Cert(skiBytes);
- if (doDebug) {
- log.info("X509 SKI alias: " + alias);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.SKI_BYTES);
+ cryptoType.setBytes(skiBytes);
+ X509Certificate[] certs = crypto.getX509Certificates(cryptoType);
+ if (certs != null) {
+ return certs[0];
}
- return alias;
+ return null;
}
public byte[] getSKIBytes() {
@@ -578,33 +583,15 @@ public class SecurityTokenReference {
* @return a certificate array or null if nothing found
*/
public X509Certificate[] getX509IssuerSerial(Crypto crypto) throws WSSecurityException {
- String alias = getX509IssuerSerialAlias(crypto);
- if (alias != null) {
- return crypto.getCertificates(alias);
- }
- return null;
- }
-
- /**
- * Gets the alias name of the certificate identified with X509 issuerSerial data.
- * The keystore identifies the certificate and the key with this alias name.
- *
- * @return the alias name for the certificate or null if nothing found
- */
- public String getX509IssuerSerialAlias(Crypto crypto) throws WSSecurityException {
if (issuerSerial == null) {
issuerSerial = getIssuerSerial();
if (issuerSerial == null) {
return null;
}
}
-
- String alias =
- crypto.getAliasForX509Cert(issuerSerial.getIssuer(), issuerSerial.getSerialNumber());
- if (doDebug) {
- log.debug("X509IssuerSerial alias: " + alias);
- }
- return alias;
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ISSUER_SERIAL);
+ cryptoType.setIssuerSerial(issuerSerial.getIssuer(), issuerSerial.getSerialNumber());
+ return crypto.getX509Certificates(cryptoType);
}
private DOMX509IssuerSerial getIssuerSerial() throws WSSecurityException {
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/EncryptedKeyProcessor.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/EncryptedKeyProcessor.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/EncryptedKeyProcessor.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/EncryptedKeyProcessor.java Wed Feb 23 16:48:04 2011
@@ -24,11 +24,11 @@ import org.apache.commons.logging.LogFac
import org.apache.ws.security.WSConstants;
import org.apache.ws.security.WSDataRef;
import org.apache.ws.security.WSDocInfo;
-import org.apache.ws.security.WSPasswordCallback;
import org.apache.ws.security.WSSConfig;
import org.apache.ws.security.WSSecurityEngineResult;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.token.SecurityTokenReference;
import org.apache.ws.security.str.EncryptedKeySTRParser;
import org.apache.ws.security.str.STRParser;
@@ -44,11 +44,8 @@ import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.SecretKey;
-import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
-import java.io.IOException;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
@@ -112,11 +109,11 @@ public class EncryptedKeyProcessor imple
throw new WSSecurityException(WSSecurityException.INVALID_SECURITY, "noCipher");
}
- String alias = getAliasFromEncryptedKey(elem, decCrypto, cb, wsDocInfo, config);
- PrivateKey privateKey = getPrivateKeyFromKeyInfo(decCrypto, cb, alias);
- X509Certificate[] certs = decCrypto.getCertificates(alias);
+ X509Certificate[] certs =
+ getCertificatesFromEncryptedKey(elem, decCrypto, cb, wsDocInfo, config);
try {
+ PrivateKey privateKey = decCrypto.getPrivateKey(certs[0], cb);
cipher.init(Cipher.DECRYPT_MODE, privateKey);
} catch (Exception ex) {
throw new WSSecurityException(WSSecurityException.FAILED_CHECK, null, null, ex);
@@ -174,10 +171,10 @@ public class EncryptedKeyProcessor imple
}
/**
- * @return the alias corresponding to the public key reference in the
+ * @return the Certificate(s) corresponding to the public key reference in the
* EncryptedKey Element
*/
- private String getAliasFromEncryptedKey(
+ private X509Certificate[] getCertificatesFromEncryptedKey(
Element xencEncryptedKey,
Crypto crypto,
CallbackHandler cb,
@@ -188,7 +185,6 @@ public class EncryptedKeyProcessor imple
WSSecurityUtil.getDirectChildElement(
xencEncryptedKey, "KeyInfo", WSConstants.SIG_NS
);
- String alias = null;
if (keyInfo != null) {
Element strElement = null;
if (config.isWsiBSPCompliant()) {
@@ -233,74 +229,25 @@ public class EncryptedKeyProcessor imple
new Object[] {"decryption (KeyId)"}
);
}
- alias = crypto.getAliasForX509Cert(certs[0]);
- } else if (!config.isWsiBSPCompliant() && crypto.getDefaultX509Alias() != null) {
- alias = crypto.getDefaultX509Alias();
+ return certs;
+ } else if (!config.isWsiBSPCompliant() && crypto.getDefaultX509Identifier() != null) {
+ String alias = crypto.getDefaultX509Identifier();
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(alias);
+ X509Certificate[] certs = crypto.getX509Certificates(cryptoType);
+ if (certs == null || certs.length < 1 || certs[0] == null) {
+ throw new WSSecurityException(
+ WSSecurityException.FAILURE,
+ "noCertsFound",
+ new Object[] {"decryption (KeyId)"}
+ );
+ }
+ return certs;
} else {
throw new WSSecurityException(WSSecurityException.INVALID_SECURITY, "noKeyinfo");
}
- return alias;
- }
-
- /**
- * @return the private key corresponding to the public key reference in the
- * EncryptedKey Element
- */
- private PrivateKey getPrivateKeyFromKeyInfo(
- Crypto crypto,
- CallbackHandler cb,
- String alias
- ) throws WSSecurityException {
- //
- // If the alias is null then throw an Exception, as the private key doesn't exist
- // in our key store
- //
- if (alias == null) {
- throw new WSSecurityException(WSSecurityException.FAILED_CHECK, "noPrivateKey");
- }
- //
- // At this point we have all information necessary to decrypt the session
- // key:
- // - the Cipher object intialized with the correct methods
- // - The data that holds the encrypted session key
- // - the alias name for the private key
- //
- // Now use the callback here to get password that enables
- // us to read the private key
- //
- WSPasswordCallback pwCb = new WSPasswordCallback(alias, WSPasswordCallback.DECRYPT);
- try {
- cb.handle(new Callback[]{pwCb});
- } catch (IOException e) {
- throw new WSSecurityException(
- WSSecurityException.FAILURE,
- "noPassword",
- new Object[]{alias},
- e
- );
- } catch (UnsupportedCallbackException e) {
- throw new WSSecurityException(
- WSSecurityException.FAILURE,
- "noPassword",
- new Object[]{alias},
- e
- );
- }
- String password = pwCb.getPassword();
- if (password == null) {
- throw new WSSecurityException(
- WSSecurityException.FAILURE, "noPassword", new Object[]{alias}
- );
- }
-
- try {
- return crypto.getPrivateKey(alias, password);
- } catch (Exception e) {
- throw new WSSecurityException(WSSecurityException.FAILED_CHECK, null, null, e);
- }
}
-
/**
* Decrypt all data references
*/
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/processor/SignatureProcessor.java Wed Feb 23 16:48:04 2011
@@ -30,6 +30,7 @@ import org.apache.ws.security.WSSecurity
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.WSUsernameTokenPrincipal;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.DOMURIDereferencer;
import org.apache.ws.security.message.token.SecurityTokenReference;
import org.apache.ws.security.str.STRParser;
@@ -220,8 +221,10 @@ public class SignatureProcessor implemen
if (crypto == null) {
throw new WSSecurityException(WSSecurityException.FAILURE, "noSigCryptoFile");
}
- if (crypto.getDefaultX509Alias() != null) {
- return crypto.getCertificates(crypto.getDefaultX509Alias());
+ if (crypto.getDefaultX509Identifier() != null) {
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(crypto.getDefaultX509Identifier());
+ return crypto.getX509Certificates(cryptoType);
} else {
throw new WSSecurityException(
WSSecurityException.INVALID_SECURITY, "unsupportedKeyInfo"
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLIssuerImpl.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLIssuerImpl.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLIssuerImpl.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLIssuerImpl.java Wed Feb 23 16:48:04 2011
@@ -24,6 +24,7 @@ import org.apache.commons.logging.LogFac
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.components.crypto.CryptoFactory;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.saml.ext.AssertionWrapper;
import org.apache.ws.security.saml.ext.OpenSAMLUtil;
@@ -173,7 +174,9 @@ public class SAMLIssuerImpl implements S
);
// prepare to sign the SAML token
- X509Certificate[] issuerCerts = issuerCrypto.getCertificates(issuerKeyName);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(issuerKeyName);
+ X509Certificate[] issuerCerts = issuerCrypto.getX509Certificates(cryptoType);
if (issuerCerts == null) {
throw new WSSecurityException(
"No issuer certs were found to sign the SAML Assertion using issuer name: "
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLUtil.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLUtil.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLUtil.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/SAMLUtil.java Wed Feb 23 16:48:04 2011
@@ -27,6 +27,7 @@ import org.apache.ws.security.WSSecurity
import org.apache.ws.security.WSSecurityEngineResult;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.token.SecurityTokenReference;
import org.apache.ws.security.processor.EncryptedKeyProcessor;
import org.apache.ws.security.saml.ext.AssertionWrapper;
@@ -318,18 +319,18 @@ public class SAMLUtil {
WSSecurityException.FAILURE, "noSigCryptoFile"
);
}
- String alias =
- crypto.getAliasForX509Cert(
- ((X509IssuerSerial)x509obj).getIssuerName(),
- ((X509IssuerSerial)x509obj).getSerialNumber()
- );
- if (alias == null) {
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ISSUER_SERIAL);
+ cryptoType.setIssuerSerial(
+ ((X509IssuerSerial)x509obj).getIssuerName(),
+ ((X509IssuerSerial)x509obj).getSerialNumber()
+ );
+ certs = crypto.getX509Certificates(cryptoType);
+ if (certs == null || certs.length < 1) {
throw new WSSecurityException(
WSSecurityException.FAILURE, "invalidSAMLsecurity",
new Object[]{"cannot get certificate or key"}
);
}
- certs = crypto.getCertificates(alias);
return new SAMLKeyInfo(certs);
}
}
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/WSSecSignatureSAML.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/WSSecSignatureSAML.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/WSSecSignatureSAML.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/saml/WSSecSignatureSAML.java Wed Feb 23 16:48:04 2011
@@ -26,6 +26,7 @@ import org.apache.ws.security.WSDocInfo;
import org.apache.ws.security.WSEncryptionPart;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.message.DOMURIDereferencer;
import org.apache.ws.security.message.WSSecHeader;
import org.apache.ws.security.message.WSSecSignature;
@@ -230,7 +231,9 @@ public class WSSecSignatureSAML extends
PublicKey publicKey = null;
if (senderVouches) {
- certs = issuerCrypto.getCertificates(issuerKeyName);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias(issuerKeyName);
+ certs = issuerCrypto.getX509Certificates(cryptoType);
wsDocInfo.setCrypto(issuerCrypto);
}
//
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/DerivedKeyTokenSTRParser.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/DerivedKeyTokenSTRParser.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/DerivedKeyTokenSTRParser.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/DerivedKeyTokenSTRParser.java Wed Feb 23 16:48:04 2011
@@ -33,7 +33,6 @@ import org.apache.ws.security.saml.SAMLU
import org.apache.ws.security.saml.ext.AssertionWrapper;
import org.w3c.dom.Element;
-import java.io.IOException;
import java.security.Principal;
import java.security.PublicKey;
import java.security.cert.X509Certificate;
@@ -41,7 +40,6 @@ import java.util.Map;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.callback.UnsupportedCallbackException;
/**
* This implementation of STRParser is for parsing a SecurityTokenReference element associated
@@ -136,7 +134,7 @@ public class DerivedKeyTokenSTRParser im
WSPasswordCallback.SECRET_KEY, cb
);
} else {
- secretKey = this.getSecret(cb, crypto, certs);
+ secretKey = crypto.getPrivateKey(certs[0], cb).getEncoded();
}
} else {
throw new WSSecurityException(
@@ -211,52 +209,4 @@ public class DerivedKeyTokenSTRParser im
return pwcb.getKey();
}
- private byte[] getSecret(
- CallbackHandler cb,
- Crypto crypto,
- X509Certificate certs[]
- ) throws WSSecurityException {
- if (cb == null) {
- throw new WSSecurityException(WSSecurityException.FAILURE, "noCallback");
- }
-
- String alias = crypto.getAliasForX509Cert(certs[0]);
-
- WSPasswordCallback pwCb =
- new WSPasswordCallback(alias, WSPasswordCallback.DECRYPT);
- try {
- Callback[] callbacks = new Callback[]{pwCb};
- cb.handle(callbacks);
- } catch (IOException e) {
- throw new WSSecurityException(
- WSSecurityException.FAILURE,
- "noPassword",
- new Object[]{alias},
- e
- );
- } catch (UnsupportedCallbackException e) {
- throw new WSSecurityException(
- WSSecurityException.FAILURE,
- "noPassword",
- new Object[]{alias},
- e
- );
- }
-
- String password = pwCb.getPassword();
- if (password == null) {
- throw new WSSecurityException(
- WSSecurityException.FAILURE, "noPassword", new Object[]{alias}
- );
- }
-
- java.security.Key privateKey;
- try {
- privateKey = crypto.getPrivateKey(alias, password);
- return privateKey.getEncoded();
- } catch (Exception e) {
- throw new WSSecurityException(WSSecurityException.FAILED_CHECK, null, null, e);
- }
- }
-
}
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/EncryptedKeySTRParser.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/EncryptedKeySTRParser.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/EncryptedKeySTRParser.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/str/EncryptedKeySTRParser.java Wed Feb 23 16:48:04 2011
@@ -86,13 +86,7 @@ public class EncryptedKeySTRParser imple
// Then look up the certificate alias according to issuer name and serial number.
//
if (secRef.containsX509Data() || secRef.containsX509IssuerSerial()) {
- String alias = secRef.getX509IssuerSerialAlias(crypto);
- if (alias != null) {
- certs = crypto.getCertificates(alias);
- }
- if (LOG.isDebugEnabled()) {
- LOG.debug("X509IssuerSerial alias: " + alias);
- }
+ certs = secRef.getX509IssuerSerial(crypto);
}
//
// If wsse:KeyIdentifier found, then the public key of the attached cert was used to
Modified: webservices/wss4j/trunk/src/main/java/org/apache/ws/security/validate/SignatureTrustValidator.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/main/java/org/apache/ws/security/validate/SignatureTrustValidator.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/main/java/org/apache/ws/security/validate/SignatureTrustValidator.java (original)
+++ webservices/wss4j/trunk/src/main/java/org/apache/ws/security/validate/SignatureTrustValidator.java Wed Feb 23 16:48:04 2011
@@ -21,11 +21,9 @@ package org.apache.ws.security.validate;
import java.math.BigInteger;
import java.security.PublicKey;
-import java.security.cert.Certificate;
import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;
-import java.util.List;
import javax.security.auth.callback.CallbackHandler;
@@ -34,6 +32,7 @@ import org.apache.commons.logging.LogFac
import org.apache.ws.security.WSSConfig;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
+import org.apache.ws.security.components.crypto.CryptoType;
/**
* This class verifies trust in a credential used to verify a signature, which is extracted
@@ -169,14 +168,16 @@ public class SignatureTrustValidator imp
}
//
- // SECOND step - Search for the issuer of the transmitted certificate in the
+ // SECOND step - Search for the issuer cert (chain) of the transmitted certificate in the
// keystore or the truststore
//
- List<Certificate[]> foundCerts = crypto.getCertificatesForDN(issuerString);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.SUBJECT_DN);
+ cryptoType.setSubjectDN(issuerString);
+ X509Certificate[] foundCerts = crypto.getX509Certificates(cryptoType);
// If the certs have not been found, the issuer is not in the keystore/truststore
// As a direct result, do not trust the transmitted certificate
- if (foundCerts == null || foundCerts.size() < 1) {
+ if (foundCerts == null || foundCerts.length < 1) {
if (LOG.isDebugEnabled()) {
LOG.debug(
"No certs found in keystore for issuer " + issuerString
@@ -188,38 +189,35 @@ public class SignatureTrustValidator imp
//
// THIRD step
- // Check the certificate trust path for every cert of the issuer found in the
- // keystore/truststore
+ // Check the certificate trust path for the issuer cert chain
//
if (LOG.isDebugEnabled()) {
LOG.debug(
"Preparing to validate certificate path for issuer " + issuerString
);
}
- for (Certificate[] foundCertChain : foundCerts) {
- //
- // Form a certificate chain from the transmitted certificate
- // and the certificate(s) of the issuer from the keystore/truststore
- //
- X509Certificate[] x509certs = new X509Certificate[foundCertChain.length + 1];
- x509certs[0] = cert;
- for (int j = 0; j < foundCertChain.length; j++) {
- x509certs[j + 1] = (X509Certificate)foundCertChain[j];
- }
+ //
+ // Form a certificate chain from the transmitted certificate
+ // and the certificate(s) of the issuer from the keystore/truststore
+ //
+ X509Certificate[] x509certs = new X509Certificate[foundCerts.length + 1];
+ x509certs[0] = cert;
+ for (int j = 0; j < foundCerts.length; j++) {
+ x509certs[j + 1] = (X509Certificate)foundCerts[j];
+ }
- //
- // Use the validation method from the crypto to check whether the subjects'
- // certificate was really signed by the issuer stated in the certificate
- //
- if (crypto.validateCertPath(x509certs)) {
- if (LOG.isDebugEnabled()) {
- LOG.debug(
- "Certificate path has been verified for certificate with subject "
- + subjectString
- );
- }
- return true;
+ //
+ // Use the validation method from the crypto to check whether the subjects'
+ // certificate was really signed by the issuer stated in the certificate
+ //
+ if (crypto.verifyTrust(x509certs)) {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(
+ "Certificate path has been verified for certificate with subject "
+ + subjectString
+ );
}
+ return true;
}
if (LOG.isDebugEnabled()) {
@@ -245,13 +243,15 @@ public class SignatureTrustValidator imp
String issuerString = cert.getIssuerX500Principal().getName();
BigInteger issuerSerial = cert.getSerialNumber();
- X509Certificate foundCert = crypto.getX509Certificate(issuerString, issuerSerial);
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ISSUER_SERIAL);
+ cryptoType.setIssuerSerial(issuerString, issuerSerial);
+ X509Certificate[] foundCerts = crypto.getX509Certificates(cryptoType);
//
// If a certificate has been found, the certificates must be compared
// to ensure against phony DNs (compare encoded form including signature)
//
- if (foundCert != null && foundCert.equals(cert)) {
+ if (foundCerts != null && foundCerts[0] != null && foundCerts[0].equals(cert)) {
if (LOG.isDebugEnabled()) {
LOG.debug(
"Direct trust for certificate with " + cert.getSubjectX500Principal().getName()
@@ -282,7 +282,7 @@ public class SignatureTrustValidator imp
// certificate was really signed by the issuer stated in the certificate
//
if (certificates != null && certificates.length > 1
- && crypto.validateCertPath(certificates)) {
+ && crypto.verifyTrust(certificates)) {
if (LOG.isDebugEnabled()) {
LOG.debug(
"Certificate path has been verified for certificate with subject "
Modified: webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/CustomCrypto.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/CustomCrypto.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/CustomCrypto.java (original)
+++ webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/CustomCrypto.java Wed Feb 23 16:48:04 2011
@@ -19,9 +19,9 @@
package org.apache.ws.security.common;
-import org.apache.ws.security.components.crypto.CryptoBase;
+import org.apache.ws.security.components.crypto.Merlin;
-public class CustomCrypto extends CryptoBase {
+public class CustomCrypto extends Merlin {
private java.util.Map<String, Object> config = null;
Modified: webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1AuthnHOKHandler.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1AuthnHOKHandler.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1AuthnHOKHandler.java (original)
+++ webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1AuthnHOKHandler.java Wed Feb 23 16:48:04 2011
@@ -22,6 +22,7 @@ package org.apache.ws.security.common;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.components.crypto.CryptoFactory;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.saml.ext.SAMLCallback;
import org.apache.ws.security.saml.ext.bean.AuthenticationStatementBean;
import org.apache.ws.security.saml.ext.bean.KeyInfoBean;
@@ -47,7 +48,9 @@ public class SAML1AuthnHOKHandler implem
public SAML1AuthnHOKHandler() throws WSSecurityException {
Crypto crypto = CryptoFactory.getInstance("wss40.properties");
- certs = crypto.getCertificates("wss40");
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias("wss40");
+ certs = crypto.getX509Certificates(cryptoType);
}
public void handle(Callback[] callbacks)
Modified: webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1CallbackHandler.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1CallbackHandler.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1CallbackHandler.java (original)
+++ webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML1CallbackHandler.java Wed Feb 23 16:48:04 2011
@@ -21,6 +21,7 @@ package org.apache.ws.security.common;
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.components.crypto.CryptoFactory;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.saml.ext.SAMLCallback;
import org.apache.ws.security.saml.ext.bean.KeyInfoBean;
import org.apache.ws.security.saml.ext.bean.SubjectBean;
@@ -39,7 +40,9 @@ public class SAML1CallbackHandler extend
public SAML1CallbackHandler() throws Exception {
Crypto crypto = CryptoFactory.getInstance("wss40.properties");
- certs = crypto.getCertificates("wss40");
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias("wss40");
+ certs = crypto.getX509Certificates(cryptoType);
subjectName = "uid=joe,ou=people,ou=saml-demo,o=example.com";
subjectQualifier = "www.example.com";
Modified: webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML2CallbackHandler.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML2CallbackHandler.java?rev=1073823&r1=1073822&r2=1073823&view=diff
==============================================================================
--- webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML2CallbackHandler.java (original)
+++ webservices/wss4j/trunk/src/test/java/org/apache/ws/security/common/SAML2CallbackHandler.java Wed Feb 23 16:48:04 2011
@@ -21,6 +21,7 @@ package org.apache.ws.security.common;
import org.apache.ws.security.components.crypto.Crypto;
import org.apache.ws.security.components.crypto.CryptoFactory;
+import org.apache.ws.security.components.crypto.CryptoType;
import org.apache.ws.security.saml.ext.SAMLCallback;
import org.apache.ws.security.saml.ext.bean.KeyInfoBean;
import org.apache.ws.security.saml.ext.bean.SubjectBean;
@@ -38,7 +39,9 @@ public class SAML2CallbackHandler extend
public SAML2CallbackHandler() throws Exception {
Crypto crypto = CryptoFactory.getInstance("wss40.properties");
- certs = crypto.getCertificates("wss40");
+ CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
+ cryptoType.setAlias("wss40");
+ certs = crypto.getX509Certificates(cryptoType);
subjectName = "uid=joe,ou=people,ou=saml-demo,o=example.com";
subjectQualifier = "www.example.com";