You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2017/11/14 11:30:50 UTC
svn commit: r1815204 - in /webservices/wss4j/trunk/ws-security-dom/src:
main/java/org/apache/wss4j/dom/message/WSSecBase.java
main/java/org/apache/wss4j/dom/message/WSSecSignature.java
test/java/org/apache/wss4j/dom/message/SignaturePartsTest.java
Author: coheigea
Date: Tue Nov 14 11:30:50 2017
New Revision: 1815204
URL: http://svn.apache.org/viewvc?rev=1815204&view=rev
Log:
WSS-618 - Cannot create signature which includes KeyInfo
Modified:
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecBase.java
webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecSignature.java
webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePartsTest.java
Modified: webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecBase.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecBase.java?rev=1815204&r1=1815203&r2=1815204&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecBase.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecBase.java Tue Nov 14 11:30:50 2017
@@ -177,6 +177,9 @@ public class WSSecBase {
} else if (WSConstants.SAML2_NS.equals(bodyElement.getNamespaceURI())
&& "Assertion".equals(bodyElement.getLocalName())) {
id = bodyElement.getAttributeNS(null, "ID");
+ } else if (WSConstants.SIG_NS.equals(bodyElement.getNamespaceURI())
+ && "KeyInfo".equals(bodyElement.getLocalName())) {
+ id = bodyElement.getAttributeNS(null, "Id");
}
}
Modified: webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecSignature.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecSignature.java?rev=1815204&r1=1815203&r2=1815204&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecSignature.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/message/WSSecSignature.java Tue Nov 14 11:30:50 2017
@@ -26,7 +26,9 @@ import java.security.cert.X509Certificat
import java.util.Base64;
import java.util.List;
+import javax.xml.crypto.MarshalException;
import javax.xml.crypto.XMLStructure;
+import javax.xml.crypto.dom.DOMCryptoContext;
import javax.xml.crypto.dom.DOMStructure;
import javax.xml.crypto.dsig.CanonicalizationMethod;
import javax.xml.crypto.dsig.SignatureMethod;
@@ -372,6 +374,23 @@ public class WSSecSignature extends WSSe
for (WSEncryptionPart part : getParts()) {
if (part.getId() == null && "STRTransform".equals(part.getName())) {
part.setId(strUri);
+ } else if ("KeyInfo".equals(part.getName()) && WSConstants.SIG_NS.equals(part.getNamespace())
+ && part.getElement() == null) {
+ // Special code to sign the KeyInfo - we have to marshal the KeyInfo to a DOM Element
+ // before the signing process
+ Element parent = secRef.getElement().getOwnerDocument().createElement("temp");
+ DOMCryptoContext cryptoContext = new DOMCryptoContext() { };
+ cryptoContext.putNamespacePrefix(WSConstants.SIG_NS, WSConstants.SIG_PREFIX);
+ try {
+ keyInfo.marshal(new DOMStructure(parent), cryptoContext);
+ } catch (MarshalException ex) {
+ LOG.error(ex.getMessage(), ex);
+ throw new WSSecurityException(
+ WSSecurityException.ErrorCode.FAILED_SIGNATURE, ex
+ );
+ }
+ part.setElement((Element)parent.getFirstChild());
+ break;
}
}
}
Modified: webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePartsTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePartsTest.java?rev=1815204&r1=1815203&r2=1815204&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePartsTest.java (original)
+++ webservices/wss4j/trunk/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePartsTest.java Tue Nov 14 11:30:50 2017
@@ -550,6 +550,62 @@ public class SignaturePartsTest extends
verify(signedDoc);
}
+ @Test
+ public void testSignedKeyInfo() throws Exception {
+ Document doc = SOAPUtil.toSOAPPart(SOAPMSG);
+ WSSecHeader secHeader = new WSSecHeader(doc);
+ secHeader.insertSecurityHeader();
+
+ WSSecSignature sign = new WSSecSignature(secHeader);
+ sign.setUserInfo("16c73ab6-b892-458f-abf5-2f875f74882e", "security");
+ sign.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);
+
+ WSEncryptionPart encP =
+ new WSEncryptionPart(
+ "KeyInfo",
+ WSConstants.SIG_NS,
+ "");
+ sign.getParts().add(encP);
+
+ Document signedDoc = sign.build(crypto);
+
+ if (LOG.isDebugEnabled()) {
+ String outputString =
+ XMLUtils.prettyDocumentToString(signedDoc);
+ LOG.debug(outputString);
+ }
+
+ WSHandlerResult results = verify(signedDoc);
+
+ WSSecurityEngineResult actionResult =
+ results.getActionResults().get(WSConstants.SIGN).get(0);
+ assertTrue(actionResult != null);
+ assertFalse(actionResult.isEmpty());
+ final List<WSDataRef> refs =
+ (List<WSDataRef>) actionResult.get(WSSecurityEngineResult.TAG_DATA_REF_URIS);
+
+ WSDataRef wsDataRef = refs.get(0);
+ String xpath = wsDataRef.getXpath();
+ assertEquals("/soapenv:Envelope/soapenv:Header/wsse:Security/ds:Signature/ds:KeyInfo", xpath);
+ assertEquals(WSConstants.RSA_SHA1, wsDataRef.getAlgorithm());
+ assertNotNull(wsDataRef.getDigestValue());
+ assertTrue(wsDataRef.getDigestValue().length > 0);
+ QName expectedQName = new QName(WSConstants.SIG_NS, "KeyInfo");
+ assertEquals(expectedQName, wsDataRef.getName());
+
+ assertEquals(WSConstants.SHA1, wsDataRef.getDigestAlgorithm());
+
+ String sigMethod = (String)actionResult.get(WSSecurityEngineResult.TAG_SIGNATURE_METHOD);
+ assertEquals(WSConstants.RSA_SHA1, sigMethod);
+
+ String c14nMethod =
+ (String)actionResult.get(WSSecurityEngineResult.TAG_CANONICALIZATION_METHOD);
+ assertEquals(WSConstants.C14N_EXCL_OMIT_COMMENTS, c14nMethod);
+
+ List<String> transformAlgorithms = wsDataRef.getTransformAlgorithms();
+ assertTrue(transformAlgorithms.size() == 1);
+ assertTrue(WSConstants.C14N_EXCL_OMIT_COMMENTS.equals(transformAlgorithms.get(0)));
+ }
/**
* Verifies the soap envelope