} else if ( PolicyTypeUtil.samlTokenPolicy(originalKeyBinding)) {
logger.log(Level.SEVERE, LogStringsMessages.WSS_1345_UNSUPPORTED_DERIVEDKEYS_SAML_TOKEN());
throw new UnsupportedOperationException("DerivedKeys with SAMLToken not yet supported");
} else if (PolicyTypeUtil.secureConversationTokenKeyBinding(originalKeyBinding)) {
SecureConversationTokenKeyBinding sctBinding = (SecureConversationTokenKeyBinding)originalKeyBinding;
//STR for DerivedKeyToken
SecurityTokenReference tokenRef = new SecurityTokenReference(secureMessage.getSOAPPart());
SOAPElement sctElement = insertSCT(context, sctBinding, tokenRef);
String dktId = keyBinding.getUUID();
if (dktId == null) {
dktId = secureMessage.generateId();
}
String nonce = Base64.encode(dkt.getNonce());
DerivedKeyTokenHeaderBlock dktHeaderBlock =
new DerivedKeyTokenHeaderBlock(
securityHeader.getOwnerDocument(), tokenRef, nonce, dkt.getOffset(), dkt.getLength() ,dktId);
Node next = (sctElement != null) ? sctElement.getNextSibling() : null;
if (next == null) {
Node reflist = context.getCurrentRefList();
if (reflist != null) {
next = reflist;
context.setCurrentReferenceList(null);
}
}
SOAPElement dktElem = (SOAPElement)securityHeader.insertBefore(
dktHeaderBlock.getAsSoapElement(), next);
//Construct the STR for signature
DirectReference refSig = new DirectReference();
refSig.setURI("#"+dktId);
SecurityTokenReference sigTokenRef = new SecurityTokenReference(secureMessage.getSOAPPart());
sigTokenRef.setReference(refSig);
// signature should be below DKT
nextSibling = dktElem.getNextSibling();
nxtSiblingContainer[0] = nextSibling;
keyInfo = dsigHelper.constructKeyInfo(signaturePolicy,sigTokenRef);
return keyInfo;
}
} else if ( PolicyTypeUtil.issuedTokenKeyBinding(keyBinding)) {
//Get the IssuedToken and insert it into the message
IssuedTokenContext issuedTokenContext = context.getTrustContext();
GenericToken issuedToken = (GenericToken)issuedTokenContext.getSecurityToken();
SOAPElement tokenElem = null;
SecurityTokenReference str = null;
Element strElem = null;
SOAPElement issuedTokenElementFromMsg = null;
// check if the token is already present
IssuedTokenKeyBinding ikb = (IssuedTokenKeyBinding)keyBinding;
//String ikbPolicyId = ikb.getPolicyToken().getTokenId();
String ikbPolicyId = ikb.getUUID();
//Look for TrustToken in TokenCache
HashMap tokCache = context.getTokenCache();
Object tok = tokCache.get(ikbPolicyId);
String iTokenType = ikb.getIncludeToken();
boolean includeIST = (ikb.INCLUDE_ALWAYS_TO_RECIPIENT.equals(iTokenType) ||
ikb.INCLUDE_ALWAYS.equals(iTokenType) ||
ikb.INCLUDE_ALWAYS_VER2.equals(iTokenType) ||
ikb.INCLUDE_ALWAYS_TO_RECIPIENT_VER2.equals(iTokenType)
);
if (includeIST && (issuedToken == null)) {
logger.log(Level.SEVERE, LogStringsMessages.WSS_1343_NULL_ISSUED_TOKEN());
throw new XWSSecurityException("Issued Token to be inserted into the Message was Null");
}
if (issuedToken != null) {
// treat the token as an Opaque entity and just insert the token into message
Element elem = (Element)issuedToken.getTokenValue();
if (tok == null) {
//TODO: remove these expensive conversions DOM Imports
tokenElem = XMLUtil.convertToSoapElement(secureMessage.getSOAPPart(), elem);
//FIX for Issue 26: We need an Id to cache and MS is not setting in some cases
String tokId = tokenElem.getAttribute("Id");
if ("".equals(tokId) &&
MessageConstants.ENCRYPTED_DATA_LNAME.equals(tokenElem.getLocalName())) {
tokenElem.setAttribute("Id", secureMessage.generateId());
}
tokCache.put(ikbPolicyId, tokenElem);
} else {
// it will be SOAPElement retrieve its wsuId attr
String wsuId = SecurityUtil.getWsuIdOrId((Element)tok);
issuedTokenElementFromMsg = (SOAPElement)secureMessage.getElementById(wsuId);
if (issuedTokenElementFromMsg == null) {
logger.log(Level.SEVERE, LogStringsMessages.WSS_1344_ERROR_LOCATE_ISSUE_TOKEN_MESSAGE());
throw new XWSSecurityException("Could not locate Issued Token in Message");
}
}
}
if (includeIST) {
strElem = SecurityUtil.convertSTRToElement(issuedTokenContext.getAttachedSecurityTokenReference().getTokenValue(), secureMessage.getSOAPPart());
} else {
strElem = SecurityUtil.convertSTRToElement(issuedTokenContext.getUnAttachedSecurityTokenReference().getTokenValue(), secureMessage.getSOAPPart());
}
if(strElem == null){
logger.log(Level.SEVERE, LogStringsMessages.WSS_1378_UNABLETO_REFER_ISSUE_TOKEN());
throw new XWSSecurityException("Cannot determine how to reference the Issued Token in the Message");
}
//TODO: remove these expensive conversions
Element imported = (Element)secureMessage.getSOAPPart().importNode(strElem,true);
str = new SecurityTokenReference(
XMLUtil.convertToSoapElement(secureMessage.getSOAPPart(), (Element)imported.cloneNode(true)), false);
if (originalKey != null) {
SecurityUtil.updateSamlVsKeyCache(str, context, originalKey);
}
if (tokenElem != null) {
if(includeIST) {
secureMessage.findOrCreateSecurityHeader().insertHeaderBlockElement(tokenElem);
nxtSiblingContainer[0] = tokenElem.getNextSibling();
} else {
nxtSiblingContainer[0] = null;
}
// also store the token in Packet.invocationProperties to be used by
// client side response processing
context.setIssuedSAMLToken(tokenElem);
} else if (issuedTokenElementFromMsg != null) {
nxtSiblingContainer[0] = issuedTokenElementFromMsg.getNextSibling();
}
keyInfo = dsigHelper.constructKeyInfo(signaturePolicy,str);
return keyInfo;
} else if (PolicyTypeUtil.secureConversationTokenKeyBinding(keyBinding)){
SecurityTokenReference secTokenRef = new SecurityTokenReference(secureMessage.getSOAPPart());
SecureConversationTokenKeyBinding sctBinding = (SecureConversationTokenKeyBinding)keyBinding;
SOAPElement sctElement = insertSCT(context, sctBinding, secTokenRef);
// signature should be below SCT
nextSibling = (sctElement != null) ? sctElement.getNextSibling() : null;
nxtSiblingContainer[0] = nextSibling;