You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2018/03/05 17:44:53 UTC
[cxf] branch master updated: CXF-7667 - Don't add an STS operation
in the DefaultSecurityTokenServiceProvider if no STSProperties are
available
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/master by this push:
new d301485 CXF-7667 - Don't add an STS operation in the DefaultSecurityTokenServiceProvider if no STSProperties are available
d301485 is described below
commit d3014859cf4da3121bfe34143df06147b4321e2c
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Mon Mar 5 17:42:35 2018 +0000
CXF-7667 - Don't add an STS operation in the DefaultSecurityTokenServiceProvider if no STSProperties are available
---
.../DefaultSecurityTokenServiceProvider.java | 9 ++
.../defaultstsprovider/DefaultSTSProviderTest.java | 143 +++++++++++++++++++++
.../systest/sts/defaultstsprovider/STSServer.java | 50 +++++++
.../sts/defaultstsprovider/cxf-client-unit.xml | 37 ++++++
.../sts/defaultstsprovider/cxf-sts-common.xml | 49 +++++++
.../cxf/systest/sts/defaultstsprovider/cxf-sts.xml | 39 ++++++
6 files changed, 327 insertions(+)
diff --git a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/provider/DefaultSecurityTokenServiceProvider.java b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/provider/DefaultSecurityTokenServiceProvider.java
index cb73fb0..48a09e9 100644
--- a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/provider/DefaultSecurityTokenServiceProvider.java
+++ b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/provider/DefaultSecurityTokenServiceProvider.java
@@ -21,9 +21,11 @@ package org.apache.cxf.sts.provider;
import java.util.ArrayList;
import java.util.List;
+import java.util.logging.Logger;
import javax.xml.transform.Source;
+import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.sts.STSPropertiesMBean;
import org.apache.cxf.sts.claims.ClaimsManager;
import org.apache.cxf.sts.event.STSEventListener;
@@ -51,6 +53,8 @@ import org.apache.cxf.ws.security.tokenstore.TokenStore;
*/
public class DefaultSecurityTokenServiceProvider extends SecurityTokenServiceProvider {
+ private static final Logger LOG = LogUtils.getL7dLogger(DefaultSecurityTokenServiceProvider.class);
+
private STSPropertiesMBean stsProperties;
private boolean encryptIssuedToken;
private List<ServiceMBean> services;
@@ -131,6 +135,11 @@ public class DefaultSecurityTokenServiceProvider extends SecurityTokenServicePro
}
private void populateAbstractOperation(AbstractOperation abstractOperation) {
+ if (stsProperties == null) {
+ LOG.warning("No 'stsProperties' configured on the DefaultSecurityTokenServiceProvider");
+ return;
+ }
+
List<TokenProvider> tokenProviders = new ArrayList<>();
tokenProviders.add(new SAMLTokenProvider());
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/defaultstsprovider/DefaultSTSProviderTest.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/defaultstsprovider/DefaultSTSProviderTest.java
new file mode 100644
index 0000000..113b9b9
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/defaultstsprovider/DefaultSTSProviderTest.java
@@ -0,0 +1,143 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.systest.sts.defaultstsprovider;
+
+import java.net.URL;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.systest.sts.common.SecurityTestUtil;
+import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
+import org.apache.cxf.ws.security.SecurityConstants;
+import org.apache.cxf.ws.security.tokenstore.SecurityToken;
+import org.apache.cxf.ws.security.trust.STSClient;
+import org.apache.wss4j.common.WSS4JConstants;
+
+import org.junit.BeforeClass;
+
+/**
+ * Test the DefaultSecurityTokenServiceProvider
+ */
+public class DefaultSTSProviderTest extends AbstractBusClientServerTestBase {
+
+ static final String STSPORT = allocatePort(STSServer.class);
+
+ @BeforeClass
+ public static void startServers() throws Exception {
+ assertTrue(
+ "Server failed to launch",
+ // run the server in the same process
+ // set this to false to fork
+ launchServer(STSServer.class, true)
+ );
+ }
+
+ @org.junit.AfterClass
+ public static void cleanup() throws Exception {
+ SecurityTestUtil.cleanup();
+ stopAllServers();
+ }
+
+ @org.junit.Test
+ public void testIssueSAML2Token() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = DefaultSTSProviderTest.class.getResource("cxf-client-unit.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ String wsdlLocation =
+ "https://localhost:" + STSPORT + "/SecurityTokenService/Transport?wsdl";
+
+ // Request the token
+ SecurityToken token =
+ requestSecurityToken(bus, wsdlLocation, WSS4JConstants.WSS_SAML2_TOKEN_TYPE, 2, true);
+ assertNotNull(token);
+
+ // Validate the token
+ validateSecurityToken(bus, wsdlLocation, token);
+
+ bus.shutdown(true);
+ }
+
+ private SecurityToken requestSecurityToken(
+ Bus bus, String wsdlLocation, String tokenType, int ttl, boolean allowExpired
+ ) throws Exception {
+ return requestSecurityToken(bus, wsdlLocation, tokenType, ttl, allowExpired, true);
+ }
+
+ private SecurityToken requestSecurityToken(
+ Bus bus, String wsdlLocation, String tokenType, int ttl, boolean allowExpired, boolean sendRenewing
+ ) throws Exception {
+ STSClient stsClient = new STSClient(bus);
+ stsClient.setWsdlLocation(wsdlLocation);
+ stsClient.setServiceName("{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService");
+ stsClient.setEndpointName("{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port");
+ stsClient.setTokenType(tokenType);
+ stsClient.setKeyType("http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer");
+
+ Map<String, Object> properties = new HashMap<>();
+ properties.put(SecurityConstants.USERNAME, "alice");
+ properties.put(
+ SecurityConstants.CALLBACK_HANDLER,
+ "org.apache.cxf.systest.sts.common.CommonCallbackHandler"
+ );
+ properties.put(SecurityConstants.STS_TOKEN_PROPERTIES, "serviceKeystore.properties");
+
+ stsClient.setTtl(ttl);
+ stsClient.setAllowRenewingAfterExpiry(allowExpired);
+ stsClient.setEnableLifetime(true);
+
+ stsClient.setProperties(properties);
+ stsClient.setRequiresEntropy(true);
+ stsClient.setKeySize(128);
+ stsClient.setAddressingNamespace("http://www.w3.org/2005/08/addressing");
+ stsClient.setSendRenewing(sendRenewing);
+
+ return stsClient.requestSecurityToken("https://localhost:8081/doubleit/services/doubleittransport");
+ }
+
+ private List<SecurityToken> validateSecurityToken(
+ Bus bus, String wsdlLocation, SecurityToken securityToken
+ ) throws Exception {
+ STSClient stsClient = new STSClient(bus);
+ stsClient.setWsdlLocation(wsdlLocation);
+ stsClient.setServiceName("{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService");
+ stsClient.setEndpointName("{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Transport_Port");
+
+ Map<String, Object> properties = new HashMap<>();
+ properties.put(SecurityConstants.USERNAME, "alice");
+ properties.put(
+ SecurityConstants.CALLBACK_HANDLER,
+ "org.apache.cxf.systest.sts.common.CommonCallbackHandler"
+ );
+ properties.put(SecurityConstants.STS_TOKEN_PROPERTIES, "serviceKeystore.properties");
+
+ stsClient.setProperties(properties);
+ stsClient.setAddressingNamespace("http://www.w3.org/2005/08/addressing");
+
+ return stsClient.validateSecurityToken(securityToken);
+ }
+
+}
diff --git a/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/defaultstsprovider/STSServer.java b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/defaultstsprovider/STSServer.java
new file mode 100644
index 0000000..8838df9
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/java/org/apache/cxf/systest/sts/defaultstsprovider/STSServer.java
@@ -0,0 +1,50 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cxf.systest.sts.defaultstsprovider;
+
+import java.net.URL;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.testutil.common.AbstractBusTestServerBase;
+
+public class STSServer extends AbstractBusTestServerBase {
+
+ public STSServer() {
+
+ }
+
+ protected void run() {
+ URL busFile = STSServer.class.getResource("cxf-sts.xml");
+ Bus busLocal = new SpringBusFactory().createBus(busFile);
+ BusFactory.setDefaultBus(busLocal);
+ setBus(busLocal);
+
+ try {
+ new STSServer();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ }
+
+ public static void main(String args[]) {
+ new STSServer().run();
+ }
+}
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-client-unit.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-client-unit.xml
new file mode 100644
index 0000000..6106dff
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-client-unit.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:cxf="http://cxf.apache.org/core" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:sec="http://cxf.apache.org/configuration/security" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.2.xsd http://cxf.apache.org/core http://cxf.apache.o [...]
+ <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="cspass" resource="keys/clientstore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="ckpass">
+ <sec:keyStore type="jks" password="cspass" resource="keys/clientstore.jks"/>
+ </sec:keyManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-sts-common.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-sts-common.xml
new file mode 100644
index 0000000..5c05485
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-sts-common.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:cxf="http://cxf.apache.org/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://cxf.apache.org/configuration/security" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration" xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:util="http://www.springframework.org/schema/util" xsi:schemaLocation=" http://cxf.apac [...]
+
+ <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
+ <property name="location" value="classpath:org/apache/cxf/systest/sts/deployment/sts.properties"/>
+ </bean>
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <bean id="transportSTSProviderBean" class="org.apache.cxf.sts.provider.DefaultSecurityTokenServiceProvider">
+ <property name="stsProperties" ref="transportSTSProperties" />
+ <property name="services" ref="transportService" />
+ </bean>
+ <bean id="transportService" class="org.apache.cxf.sts.service.StaticService">
+ <property name="endpoints" ref="transportEndpoints"/>
+ </bean>
+ <util:list id="transportEndpoints">
+ <value>https://localhost:(\d)*/doubleit/services/doubleit.*</value>
+ </util:list>
+ <bean id="transportSTSProperties" class="org.apache.cxf.sts.StaticSTSProperties">
+ <property name="signaturePropertiesFile" value="${signature.properties}"/>
+ <property name="signatureUsername" value="${signature.username}"/>
+ <property name="callbackHandlerClass" value="${callback.handler}"/>
+ <property name="encryptionPropertiesFile" value="${encryption.properties}"/>
+ <property name="issuer" value="${issuer}"/>
+ <property name="encryptionUsername" value="${encryption.username}"/>
+ </bean>
+</beans>
diff --git a/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-sts.xml b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-sts.xml
new file mode 100644
index 0000000..1db4ca5
--- /dev/null
+++ b/services/sts/systests/advanced/src/test/resources/org/apache/cxf/systest/sts/defaultstsprovider/cxf-sts.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:cxf="http://cxf.apache.org/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://cxf.apache.org/configuration/security" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration" xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:util="http://www.springframework.org/schema/util" xsi:schemaLocation=" http://cxf.apac [...]
+
+ <import resource="cxf-sts-common.xml" />
+
+ <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" id="localSTS" implementor="#transportSTSProviderBean" address="https://localhost:${testutil.ports.defaultstsprovider.STSServer}/SecurityTokenService/Transport" wsdlLocation="src/test/resources/org/apache/cxf/systest/sts/deployment/ws-trust-1.4-service.wsdl" depends-on="ClientAuthHttpsSettings" serviceName="ns1:SecurityTokenService" endpointName="ns1:Transport_Port">
+ </jaxws:endpoint>
+ <httpj:engine-factory id="ClientAuthHttpsSettings" bus="cxf">
+ <httpj:engine port="${testutil.ports.defaultstsprovider.STSServer}">
+ <httpj:tlsServerParameters>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:trustManagers>
+ <sec:keyManagers keyPassword="stskpass">
+ <sec:keyStore type="jks" password="stsspass" resource="keys/stsstore.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+</beans>
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.