if(context.getMode() == FilterProcessingContext.ADHOC) {
//AuthenticationTokenPolicy policy = (AuthenticationTokenPolicy)context.getSecurityPolicy();
if ( context.makeDynamicPolicyCallback() ) {
try {
AuthenticationTokenPolicy policy =
((AuthenticationTokenPolicy)context.getSecurityPolicy());
AuthenticationTokenPolicy.UsernameTokenBinding userNamePolicy =
(AuthenticationTokenPolicy.UsernameTokenBinding)policy.getFeatureBinding();
userNamePolicy.isReadOnly(true);
DynamicApplicationContext dynamicContext =
new DynamicApplicationContext(context.getPolicyContext());
dynamicContext.setMessageIdentifier(context.getMessageIdentifier());
dynamicContext.inBoundMessage(true);
DynamicPolicyCallback dynamicCallback =
new DynamicPolicyCallback(userNamePolicy, dynamicContext);
ProcessingContext.copy(dynamicContext.getRuntimeProperties(), context.getExtraneousProperties());
HarnessUtil.makeDynamicPolicyCallback(dynamicCallback,
context.getSecurityEnvironment().getCallbackHandler());
policy.setFeatureBinding((AuthenticationTokenPolicy.UsernameTokenBinding)dynamicCallback.getSecurityPolicy());
//context.setSecurityPolicy(policy);
} catch (Exception e) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1427_ERROR_ADHOC(),e);
throw new XWSSecurityException(e);
}
}
AuthenticationTokenPolicy policy = (AuthenticationTokenPolicy)context.getSecurityPolicy();
NodeList nodeList = wsseSecurity.getElementsByTagNameNS(MessageConstants.WSSE_NS,
MessageConstants.USERNAME_TOKEN_LNAME);
if(nodeList.getLength() <= 0){
log.log(Level.SEVERE, LogStringsMessages.WSS_1400_NOUSERNAME_FOUND());
throw new XWSSecurityException("No Username token found ,Receiver requirement not met");
} else if (nodeList.getLength() > 1) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1401_MORETHANONE_USERNAME_FOUND());
throw new XWSSecurityException(
"More than one Username token found, Receiver requirement not met");
}else{
SOAPElement userNameTokenElement = (SOAPElement)nodeList.item(0);
token = new UsernameToken(userNameTokenElement, policy.isBSP());
token.isBSP(policy.isBSP());
}
}else{
if (context.getMode() == FilterProcessingContext.POSTHOC) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1402_ERROR_POSTHOC());
throw new XWSSecurityException(
"Internal Error: Called UsernameTokenFilter in POSTHOC Mode");
}
try{
token = new UsernameToken(wsseSecurity.getCurrentHeaderElement());
} catch(XWSSecurityException ex) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1403_IMPORT_USERNAME_TOKEN(),ex);
throw SecurableSoapMessage.newSOAPFaultException(
MessageConstants.WSSE_INVALID_SECURITY_TOKEN,
"Exception while importing Username Password Token",
ex);
}
}
String username = token.getUsername();
String password = token.getPassword();
String passwordDigest = token.getPasswordDigest();
String passwordType = token.getPasswordType();
String nonce = token.getNonce();
String created = token.getCreated();
boolean authenticated = false;
if (context.getMode() == FilterProcessingContext.ADHOC) {
AuthenticationTokenPolicy policy = (AuthenticationTokenPolicy)context.getSecurityPolicy();
AuthenticationTokenPolicy.UsernameTokenBinding utBinding =
(AuthenticationTokenPolicy.UsernameTokenBinding)policy.getFeatureBinding();
// do policy checks
if (utBinding.getDigestOn() && (passwordDigest == null)) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1404_NOTMET_DIGESTED());
throw new XWSSecurityException(
"Receiver Requirement for Digested " +
"Password has not been met");
}
if (!utBinding.getDigestOn() && (passwordDigest != null)) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1405_NOTMET_PLAINTEXT());
throw new XWSSecurityException(
"Receiver Requirement for Plain-Text " +
"Password has not been met, Received token has Password-Digest");
}
if (utBinding.getUseNonce() && (nonce == null)) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1406_NOTMET_NONCE());
throw new XWSSecurityException(
"Receiver Requirement for nonce " +
"has not been met");
}
if (!utBinding.getUseNonce() && (nonce != null)) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1407_NOTMET_NONONCE());
throw new XWSSecurityException(
"Receiver Requirement for no nonce " +
"has not been met, Received token has a nonce specified");
}
} else if (context.getMode() == FilterProcessingContext.WSDL_POLICY) {
//try to infer a Policy here
AuthenticationTokenPolicy.UsernameTokenBinding sp = new AuthenticationTokenPolicy.UsernameTokenBinding();
if (passwordDigest != null) {
sp.setDigestOn(true);
}
if (nonce != null) {
sp.setUseNonce(true);
}
((MessagePolicy)context.getInferredSecurityPolicy()).append(sp);
}
try {
if (MessageConstants.PASSWORD_TEXT_NS == passwordType) {
authenticated = context.getSecurityEnvironment().authenticateUser(context.getExtraneousProperties(), username, password);
} else{
authenticated = context.getSecurityEnvironment().authenticateUser(
context.getExtraneousProperties(), username, passwordDigest, nonce, created);
}
if (!authenticated) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1408_FAILED_SENDER_AUTHENTICATION());
XWSSecurityException xwse =
new XWSSecurityException("Invalid Username Password Pair");
throw SecurableSoapMessage.newSOAPFaultException(
MessageConstants.WSSE_FAILED_AUTHENTICATION,
"Authentication of Username Password Token Failed",
xwse);
}
if (log.isLoggable(Level.FINEST)) {
log.log(Level.FINEST, "Password Validated.....");
}
long maxClockSkew = Timestamp.MAX_CLOCK_SKEW;
long freshnessLmt = Timestamp.TIMESTAMP_FRESHNESS_LIMIT;
long maxNonceAge = UsernameToken.MAX_NONCE_AGE;
if (context.getMode() == FilterProcessingContext.ADHOC) {
AuthenticationTokenPolicy authPolicy =
(AuthenticationTokenPolicy)context.getSecurityPolicy();
AuthenticationTokenPolicy.UsernameTokenBinding policy =
(AuthenticationTokenPolicy.UsernameTokenBinding)
authPolicy.getFeatureBinding();
if (created != null) {
TimestampPolicy tPolicy = (TimestampPolicy) policy.getFeatureBinding();
maxClockSkew = tPolicy.getMaxClockSkew();
freshnessLmt = tPolicy.getTimestampFreshness();