this.eleFac = WSTrustElementFactory.newInstance(wstVer);
}
public BaseSTSResponse issue(BaseSTSRequest request, IssuedTokenContext context) throws WSTrustException {
RequestSecurityToken rst = (RequestSecurityToken)request;
SecondaryParameters secParas = null;
context.getOtherProperties().put(IssuedTokenContext.WS_TRUST_VERSION, wstVer);
if (wstVer.getNamespaceURI().equals(WSTrustVersion.WS_TRUST_13_NS_URI)){
secParas = rst.getSecondaryParameters();
}
// Get token scope
final AppliesTo applies = rst.getAppliesTo();
String appliesTo = null;
X509Certificate serCert = null;
List<Object> at = null;
if(applies != null){
at = WSTrustUtil.parseAppliesTo(applies);
for (int i = 0; i < at.size(); i++){
Object obj = at.get(i);
if (obj instanceof String){
appliesTo = (String)obj;
}else if (obj instanceof X509Certificate){
serCert = (X509Certificate)obj;
}
}
}
context.setAppliesTo(appliesTo);
// Get token issuer
String issuer = stsConfig.getIssuer();
context.setTokenIssuer(issuer);
// Get the metadata for the SP as identified by the AppliesTo
TrustSPMetadata spMd = stsConfig.getTrustSPMetadata(appliesTo);
if (spMd == null){
// Only used for testing purpose; default should not documented
spMd = stsConfig.getTrustSPMetadata("default");
}
if (spMd == null){
log.log(Level.SEVERE,
LogStringsMessages.WST_0004_UNKNOWN_SERVICEPROVIDER(appliesTo));
throw new WSTrustException(LogStringsMessages.WST_0004_UNKNOWN_SERVICEPROVIDER(appliesTo));
}
// Get service certificate
if (serCert == null){
serCert = this.getServiceCertificate(spMd, appliesTo);
}
if (serCert != null){
context.getOtherProperties().put(IssuedTokenContext.TARGET_SERVICE_CERTIFICATE, serCert);
}
// Get STS certificate and private key
Object[] certAndKey = this.getSTSCertAndPrivateKey();
context.getOtherProperties().put(IssuedTokenContext.STS_CERTIFICATE, (X509Certificate)certAndKey[0]);
context.getOtherProperties().put(IssuedTokenContext.STS_PRIVATE_KEY, (PrivateKey)certAndKey[1]);
// Get TokenType
String tokenType = null;
URI tokenTypeURI = rst.getTokenType();
if (tokenTypeURI == null && secParas != null){
tokenTypeURI = secParas.getTokenType();
}
if (tokenTypeURI != null){
tokenType = tokenTypeURI.toString();
}else{
tokenType = spMd.getTokenType();
}
if (tokenType == null){
tokenType = WSTrustConstants.SAML11_ASSERTION_TOKEN_TYPE;
}
context.setTokenType(tokenType);
// Get KeyType
String keyType = null;
URI keyTypeURI = rst.getKeyType();
if (keyTypeURI == null && secParas != null){
keyTypeURI = secParas.getKeyType();
}
if (keyTypeURI != null){
keyType = keyTypeURI.toString();
}else{
keyType = spMd.getKeyType();
}
if (keyType == null){
keyType = wstVer.getSymmetricKeyTypeURI();
}
context.setKeyType(keyType);
// Get crypto algorithms
String encryptionAlgorithm = null;
URI encryptionAlgorithmURI = rst.getEncryptionAlgorithm();
if(encryptionAlgorithmURI == null && secParas != null){
encryptionAlgorithmURI = secParas.getEncryptionAlgorithm();
}
if(encryptionAlgorithmURI != null){
encryptionAlgorithm = encryptionAlgorithmURI.toString();
}
context.setEncryptionAlgorithm(encryptionAlgorithm);
String signatureAlgorithm = null;
URI signatureAlgorithmURI = rst.getSignatureAlgorithm();
if(signatureAlgorithmURI == null && secParas != null){
signatureAlgorithmURI = secParas.getSignatureAlgorithm();
}
if(signatureAlgorithmURI != null){
signatureAlgorithm = signatureAlgorithmURI.toString();
}
context.setSignatureAlgorithm(signatureAlgorithm);
String canonicalizationAlgorithm = null;
URI canonicalizationAlgorithmURI = rst.getCanonicalizationAlgorithm();
if(canonicalizationAlgorithmURI == null && secParas != null){
canonicalizationAlgorithmURI = secParas.getCanonicalizationAlgorithm();
}
if(canonicalizationAlgorithmURI != null){
canonicalizationAlgorithm = canonicalizationAlgorithmURI.toString();
}
context.setCanonicalizationAlgorithm(canonicalizationAlgorithm);
// Get KeyWrap Algorithm, which is the part of WS-Trust wssx versaion
URI keyWrapAlgorithmURI = null;
if(secParas != null){
keyWrapAlgorithmURI = secParas.getKeyWrapAlgorithm();
}
if(keyWrapAlgorithmURI != null){
context.getOtherProperties().put(IssuedTokenContext.KEY_WRAP_ALGORITHM, keyWrapAlgorithmURI.toString());
}
// Get authenticaed client Subject
Subject subject = context.getRequestorSubject();
if (subject == null){
AccessControlContext acc = AccessController.getContext();
subject = Subject.getSubject(acc);
context.setRequestorSubject(subject);
}
if(subject == null){
log.log(Level.SEVERE,
LogStringsMessages.WST_0030_REQUESTOR_NULL());
throw new WSTrustException(LogStringsMessages.WST_0030_REQUESTOR_NULL());
}
// Get client authentication context
String authnCtx = (String)stsConfig.getOtherOptions().get(WSTrustConstants.AUTHN_CONTEXT_CLASS);
if (authnCtx != null){
context.getOtherProperties().put(IssuedTokenContext.AUTHN_CONTEXT, authnCtx);
}
// Get Claims from the RST
Claims claims = rst.getClaims();
if (claims == null && secParas != null){
claims = secParas.getClaims();
}
if (claims != null){
// Add supporting information
List<Object> si = rst.getExtensionElements();
claims.getSupportingProperties().addAll(si);
if (at != null){
claims.getSupportingProperties().addAll(at);
}
}else{
claims = eleFac.createClaims();
}
String confirMethod = null;
Element assertionInRST = (Element)stsConfig.getOtherOptions().get(WSTrustConstants.SAML_ASSERTION_ELEMENT_IN_RST);
// Handle OnBehalfOf token
OnBehalfOf obo = rst.getOnBehalfOf();
if (obo != null){
Object oboToken = obo.getAny();
if (assertionInRST != null){
oboToken = assertionInRST;
}
if (oboToken != null){
subject.getPublicCredentials().add(eleFac.toElement(oboToken));
// set OnBehalfOf attribute
claims.getOtherAttributes().put(new QName("OnBehalfOf"), "true");
context.getOtherProperties().put("OnBehalfOf", "true");
// Create a Subject with ActAs credential and put it in claims
Subject oboSubj = new Subject();
oboSubj.getPublicCredentials().add(eleFac.toElement(oboToken));
claims.getSupportingProperties().add(oboSubj);
}
}
// Handle ActAs token
ActAs actAs = rst.getActAs();
if (actAs != null){
Object actAsToken = actAs.getAny();
if (assertionInRST != null){
actAsToken = assertionInRST;
}
if (actAsToken != null){
// set ActAs attribute
claims.getOtherAttributes().put(new QName("ActAs"), "true");
context.getOtherProperties().put("ActAs", "true");
// Create a Subject with ActAs credential and put it in claims
Subject actAsSubj = new Subject();
actAsSubj.getPublicCredentials().add(eleFac.toElement(actAsToken));
claims.getSupportingProperties().add(actAsSubj);
}
}
if (confirMethod != null){
context.getOtherProperties().put(IssuedTokenContext.CONFIRMATION_METHOD, confirMethod);
}
// Check if the client is authorized to be issued the token from the STSAuthorizationProvider
//ToDo: handling ActAs case
final STSAuthorizationProvider authzProvider = WSTrustFactory.getSTSAuthorizationProvider();
if (!authzProvider.isAuthorized(subject, appliesTo, tokenType, keyType)){
String user = subject.getPrincipals().iterator().next().getName();
log.log(Level.SEVERE,
LogStringsMessages.WST_0015_CLIENT_NOT_AUTHORIZED(
user, tokenType, appliesTo));
throw new WSTrustException(LogStringsMessages.WST_0015_CLIENT_NOT_AUTHORIZED(
user, tokenType, appliesTo));
}
// Get claimed attributes from the STSAttributeProvider
final STSAttributeProvider attrProvider = WSTrustFactory.getSTSAttributeProvider();
final Map<QName, List<String>> claimedAttrs = attrProvider.getClaimedAttributes(subject, appliesTo, tokenType, claims);
context.getOtherProperties().put(IssuedTokenContext.CLAIMED_ATTRUBUTES, claimedAttrs);
//==========================================
// Create proof key and RequestedProofToken
//==========================================
RequestedProofToken proofToken = null;
Entropy serverEntropy = null;
int keySize = 0;
if (wstVer.getSymmetricKeyTypeURI().equals(keyType)){
proofToken = eleFac.createRequestedProofToken();
// Get client entropy
byte[] clientEntr = null;
final Entropy clientEntropy = rst.getEntropy();
if (clientEntropy != null){
final BinarySecret clientBS = clientEntropy.getBinarySecret();
if (clientBS == null){
if(log.isLoggable(Level.FINE)) {
log.log(Level.FINE,
LogStringsMessages.WST_1009_NULL_BINARY_SECRET());
}
}else {
clientEntr = clientBS.getRawValue();
}
}
// Get KeySize
keySize = (int)rst.getKeySize();
if (keySize < 1 && secParas != null){
keySize = (int) secParas.getKeySize();
}
if (keySize < 1){
keySize = DEFAULT_KEY_SIZE;
}
if(log.isLoggable(Level.FINE)) {