You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2013/07/24 11:46:56 UTC
svn commit: r1506472 - in /webservices/wss4j/trunk:
ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/
ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/
ws-security-stax/src/test/java/org/apache...
Author: coheigea
Date: Wed Jul 24 09:46:55 2013
New Revision: 1506472
URL: http://svn.apache.org/r1506472
Log:
Fixed a problem with SAML HOK validation
Modified:
webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/TokenAssertionState.java
webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SAMLTokenInputHandler.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java
webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenReferenceTest.java
Modified: webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/TokenAssertionState.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/TokenAssertionState.java?rev=1506472&r1=1506471&r2=1506472&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/TokenAssertionState.java (original)
+++ webservices/wss4j/trunk/ws-security-policy-stax/src/main/java/org/apache/wss4j/policy/stax/assertionStates/TokenAssertionState.java Wed Jul 24 09:46:55 2013
@@ -114,6 +114,11 @@ public abstract class TokenAssertionStat
WSSecurityTokenConstants.TokenUsage_EndorsingEncryptedSupportingTokens.equals(tokenUsage) ||
WSSecurityTokenConstants.TokenUsage_SignedEndorsingEncryptedSupportingTokens.equals(tokenUsage)
) {
+
+ if (parentAssertion instanceof TransportToken) {
+ continue loop;
+ }
+
if (!(parentAssertion instanceof SupportingTokens)) {
ignoreToken++;
continue loop;
Modified: webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SAMLTokenInputHandler.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SAMLTokenInputHandler.java?rev=1506472&r1=1506471&r2=1506472&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SAMLTokenInputHandler.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/main/java/org/apache/wss4j/stax/impl/processor/input/SAMLTokenInputHandler.java Wed Jul 24 09:46:55 2013
@@ -555,7 +555,7 @@ public class SAMLTokenInputHandler exten
/**
* Processor to check the holder-of-key or sender-vouches requirements against the received assertion
- * which can not be done until the whole soap-header is processed and we now that the whole soap-body
+ * which can not be done until the whole soap-header is processed and we know that the whole soap-body
* is signed.
*/
class SAMLTokenVerifierInputProcessor extends AbstractInputProcessor implements SecurityEventListener {
@@ -671,7 +671,10 @@ public class SAMLTokenInputHandler exten
for (int j = 0; j < securityTokenProviders.size(); j++) {
SecurityTokenProvider<? extends InboundSecurityToken> securityTokenProvider = securityTokenProviders.get(j);
InboundSecurityToken securityToken = securityTokenProvider.getSecurityToken();
- if (securityToken == httpsSecurityToken) {
+ // Don't compare to the original SAML Token credentials...
+ if (securityToken == httpsSecurityToken || securityToken == subjectSecurityToken
+ || !(securityToken.getTokenUsages().contains(WSSecurityTokenConstants.TokenUsage_MainSignature)
+ || securityToken.getTokenUsages().contains(WSSecurityTokenConstants.TokenUsage_Signature))) {
continue;
}
X509Certificate[] x509Certificates = securityToken.getX509Certificates();
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java?rev=1506472&r1=1506471&r2=1506472&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenHOKTest.java Wed Jul 24 09:46:55 2013
@@ -503,6 +503,7 @@ public class SAMLTokenHOKTest extends Ab
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
+ securityProperties.setValidateSamlSubjectConfirmation(false);
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
@@ -995,6 +996,7 @@ public class SAMLTokenHOKTest extends Ab
//done signature; now test sig-verification:
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
+ securityProperties.setValidateSamlSubjectConfirmation(false);
securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
InboundWSSec wsSecIn = WSSec.getInboundWSSec(securityProperties);
XMLStreamReader xmlStreamReader = wsSecIn.processInMessage(xmlInputFactory.createXMLStreamReader(new ByteArrayInputStream(baos.toByteArray())));
Modified: webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenReferenceTest.java
URL: http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenReferenceTest.java?rev=1506472&r1=1506471&r2=1506472&view=diff
==============================================================================
--- webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenReferenceTest.java (original)
+++ webservices/wss4j/trunk/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLTokenReferenceTest.java Wed Jul 24 09:46:55 2013
@@ -391,6 +391,7 @@ public class SAMLTokenReferenceTest exte
//done signature; now test sig-verification:
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
+ securityProperties.setValidateSamlSubjectConfirmation(false);
securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
securityProperties.loadDecryptionKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
CallbackHandlerImpl callbackHandler = new CallbackHandlerImpl();
@@ -475,6 +476,7 @@ public class SAMLTokenReferenceTest exte
//done signature; now test sig-verification:
{
WSSSecurityProperties securityProperties = new WSSSecurityProperties();
+ securityProperties.setValidateSamlSubjectConfirmation(false);
securityProperties.loadSignatureVerificationKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
securityProperties.loadDecryptionKeystore(this.getClass().getClassLoader().getResource("receiver.jks"), "default".toCharArray());
CallbackHandlerImpl callbackHandler = new CallbackHandlerImpl();