try {
X509Certificate cert = context.getSecurityEnvironment().getCertificate(
context.getExtraneousProperties(), keyIdBytes, MessageConstants.KEY_INDETIFIER_TYPE);
WSSElementFactory elementFactory = new WSSElementFactory(context.getSOAPVersion());
SecurityElement bst = elementFactory.createBinarySecurityToken(null, cert.getEncoded());
SSEData data = new SSEData(bst, false, context.getNamespaceContext());
context.getSTRTransformCache().put(strId, data);
} catch (XWSSecurityException ex) {
} catch (CertificateEncodingException ex) {
} catch (Exception ex) {
//ignore the exception
}
}
} else if (MessageConstants.ThumbPrintIdentifier_NS.equals(valueType)) {
//for policy verification
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
x509Binding.setValueType(MessageConstants.ThumbPrintIdentifier_NS);
x509Binding.setReferenceType(MessageConstants.KEY_INDETIFIER_TYPE);
if (inferredKB == null) {
context.getSecurityContext().setInferredKB(x509Binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(inferredKB)) {
((SymmetricKeyBinding) inferredKB).setKeyBinding(x509Binding);
isSymmetric = true;
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
DerivedTokenKeyBinding dktBind = (DerivedTokenKeyBinding) inferredKB;
if (dktBind.getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(x509Binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(dktBind.getOriginalKeyBinding())) {
dktBind.getOriginalKeyBinding().setKeyBinding(x509Binding);
isSymmetric = true;
}
}
// get the key
byte[] keyIdBytes = XMLUtil.getDecodedBase64EncodedData(referenceValue);
if (purpose == Purpose.VERIFY || purpose == Purpose.ENCRYPT) {
context.setExtraneousProperty(MessageConstants.REQUESTER_KEYID, new String(keyIdBytes));
X509Certificate cert = context.getSecurityEnvironment().getCertificate(
context.getExtraneousProperties(), keyIdBytes, MessageConstants.THUMB_PRINT_TYPE);
if (!isSymmetric) {
context.getSecurityEnvironment().updateOtherPartySubject(
DefaultSecurityEnvironmentImpl.getSubject(context), cert);
}
returnKey = cert.getPublicKey();
} else if (purpose == Purpose.SIGN || purpose == Purpose.DECRYPT) {
returnKey = context.getSecurityEnvironment().getPrivateKey(
context.getExtraneousProperties(),
keyIdBytes, MessageConstants.THUMB_PRINT_TYPE);
}
if (strId != null) {
try {
X509Certificate cert = context.getSecurityEnvironment().getCertificate(
context.getExtraneousProperties(), keyIdBytes, MessageConstants.THUMB_PRINT_TYPE);
WSSElementFactory elementFactory = new WSSElementFactory(context.getSOAPVersion());
SecurityElement bst = elementFactory.createBinarySecurityToken(null, cert.getEncoded());
SSEData data = new SSEData(bst, false, context.getNamespaceContext());
context.getSTRTransformCache().put(strId, data);
} catch (XWSSecurityException ex) {
} catch (CertificateEncodingException ex) {
} catch (Exception ex) {
//ignore the exception
}
}
} else if (MessageConstants.KERBEROS_v5_APREQ_IDENTIFIER.equals(valueType)) {
//for policy verification
SymmetricKeyBinding skBinding = new SymmetricKeyBinding();
AuthenticationTokenPolicy.KerberosTokenBinding ktBinding = new AuthenticationTokenPolicy.KerberosTokenBinding();
ktBinding.setReferenceType(MessageConstants.KEY_INDETIFIER_TYPE);
skBinding.setKeyBinding(ktBinding);
if (inferredKB == null) {
context.getSecurityContext().setInferredKB(skBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
if (((DerivedTokenKeyBinding) inferredKB).getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(skBinding);
}
}
// now get the key
String algo = SecurityUtil.getSecretKeyAlgorithm(context.getAlgorithmSuite().getEncryptionAlgorithm());
KerberosContext krbContext = context.getKerberosContext();
if (krbContext != null) {
String encodedRef = (String) context.getExtraneousProperty(MessageConstants.KERBEROS_SHA1_VALUE);
if (!referenceValue.equals(encodedRef)) {
throw new XWSSecurityException("SecretKey could not be obtained, Incorrect Kerberos Context found");
}
returnKey = krbContext.getSecretKey(algo);
} else {
throw new XWSSecurityException("SecretKey could not be obtained, Kerberos Context not set");
}
} else if (MessageConstants.EncryptedKeyIdentifier_NS.equals(valueType)) {
//for policy verification
SymmetricKeyBinding skBinding = new SymmetricKeyBinding();
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
x509Binding.setReferenceType(MessageConstants.KEY_INDETIFIER_TYPE);
skBinding.setKeyBinding(x509Binding);
//TODO: ValueType not set on X509Binding
if (inferredKB == null) {
context.getSecurityContext().setInferredKB(skBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
if (((DerivedTokenKeyBinding) inferredKB).getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(skBinding);
}
}
// get the key
String ekSha1RefValue = (String) context.getExtraneousProperty("EncryptedKeySHA1");
Key secretKey = (Key) context.getExtraneousProperty("SecretKey");
String keyRefValue = referenceValue;
if (ekSha1RefValue != null && secretKey != null) {
if (ekSha1RefValue.equals(keyRefValue)) {
returnKey = secretKey;
//Cannot determine whether the original key was X509 or PasswordDerivedKey
skBinding.usesEKSHA1KeyBinding(true);
}
} else {
String message = "EncryptedKeySHA1 reference not correct";
logger.log(Level.SEVERE, LogStringsMessages.WSS_1306_UNSUPPORTED_KEY_IDENTIFIER_REFERENCE_TYPE(), new Object[]{message});
throw new KeySelectorException(message);
}
} else if (MessageConstants.WSSE_SAML_KEY_IDENTIFIER_VALUE_TYPE.equals(valueType) ||
MessageConstants.WSSE_SAML_v2_0_KEY_IDENTIFIER_VALUE_TYPE.equals(valueType)) {
//for policy verification
IssuedTokenKeyBinding itkBinding = new IssuedTokenKeyBinding();
if (inferredKB == null) {
if (context.hasIssuedToken()) {
context.getSecurityContext().setInferredKB(itkBinding);
} else {
context.getSecurityContext().setInferredKB(new AuthenticationTokenPolicy.SAMLAssertionBinding());
}
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
if (((DerivedTokenKeyBinding) inferredKB).getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(itkBinding);
}
}
// TODO:
SecurityHeaderElement she = resolveToken(referenceValue, xc);
if (she != null && she instanceof SAMLAssertion) {
SAMLAssertion samlAssertion = (SAMLAssertion) she;
returnKey = samlAssertion.getKey();
if (strId != null && strId.length() > 0) {
Data data = new SSEData((SecurityElement) samlAssertion, false, context.getNamespaceContext());
context.getElementCache().put(strId, data);
}
} else {
HashMap sentSamlKeys = (HashMap) context.getExtraneousProperty(MessageConstants.STORED_SAML_KEYS);
if (sentSamlKeys != null) {