You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2013/04/19 12:34:01 UTC
svn commit: r1469774 -
/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
Author: coheigea
Date: Fri Apr 19 10:34:01 2013
New Revision: 1469774
URL: http://svn.apache.org/r1469774
Log:
Don't validate a SAML Subject Cert if it's HOK + a signed Assertion
Modified:
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
Modified: webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java?rev=1469774&r1=1469773&r2=1469774&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/securityToken/SamlSecurityTokenImpl.java Fri Apr 19 10:34:01 2013
@@ -21,6 +21,7 @@ package org.apache.wss4j.stax.impl.secur
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.principal.SAMLTokenPrincipal;
+import org.apache.wss4j.common.saml.OpenSAMLUtil;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
import org.apache.wss4j.stax.ext.WSInboundSecurityContext;
import org.apache.wss4j.stax.ext.WSSSecurityProperties;
@@ -39,6 +40,7 @@ import java.security.PublicKey;
import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateNotYetValidException;
import java.security.cert.X509Certificate;
+import java.util.List;
public class SamlSecurityTokenImpl extends AbstractInboundSecurityToken implements SamlSecurityToken {
@@ -104,19 +106,28 @@ public class SamlSecurityTokenImpl exten
//todo revisit verify for every security token incl. public-key
//todo should we call verify implicit when accessing the keys?
try {
- X509Certificate[] x509Certificates = getX509Certificates();
- if (x509Certificates != null && x509Certificates.length > 0) {
- //todo I don't think the checkValidity is necessary because the CertPathChecker
- x509Certificates[0].checkValidity();
- boolean enableRevocation = false;
- if (securityProperties != null) {
- enableRevocation = securityProperties.isEnableRevocation();
- }
- crypto.verifyTrust(x509Certificates, enableRevocation);
+ String confirmMethod = null;
+ List<String> methods = samlAssertionWrapper.getConfirmationMethods();
+ if (methods != null && methods.size() > 0) {
+ confirmMethod = methods.get(0);
}
- PublicKey publicKey = getPublicKey();
- if (publicKey != null) {
- crypto.verifyTrust(publicKey);
+ // If HOK + Token is signed then we don't need to verify the subject cert, as we
+ // indirectly trust it
+ if (!OpenSAMLUtil.isMethodHolderOfKey(confirmMethod) && !samlAssertionWrapper.isSigned()) {
+ X509Certificate[] x509Certificates = getX509Certificates();
+ if (x509Certificates != null && x509Certificates.length > 0) {
+ //todo I don't think the checkValidity is necessary because the CertPathChecker
+ x509Certificates[0].checkValidity();
+ boolean enableRevocation = false;
+ if (securityProperties != null) {
+ enableRevocation = securityProperties.isEnableRevocation();
+ }
+ crypto.verifyTrust(x509Certificates, enableRevocation);
+ }
+ PublicKey publicKey = getPublicKey();
+ if (publicKey != null) {
+ crypto.verifyTrust(publicKey);
+ }
}
} catch (CertificateExpiredException e) {
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION, e);