Examples of org.apache.cxf.fediz.core.exception.ProcessingException

Package org.apache.cxf.fediz.core.exception

Examples of org.apache.cxf.fediz.core.exception.ProcessingException

org.apache.cxf.fediz.core.exception.ProcessingException

        KeyManager decryptionKeyManager = config.getDecryptionKey();
        if (decryptionKeyManager == null || decryptionKeyManager.getCrypto() == null) {
            LOG.debug(
                "We must have a decryption Crypto instance configured to decrypt encrypted tokens"
            );
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        String keyPassword = decryptionKeyManager.getKeyPassword();
        if (keyPassword == null) {
            LOG.debug(
                "We must have a decryption key password to decrypt encrypted tokens"
            );
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        
        EncryptedDataProcessor proc = new EncryptedDataProcessor();
        WSDocInfo docInfo = new WSDocInfo(encryptedRST.getOwnerDocument());
        RequestData data = new RequestData();
        
        // Disable WSS4J processing of the (decrypted) SAML Token
        WSSConfig wssConfig = WSSConfig.getNewInstance();
        wssConfig.setProcessor(WSSecurityEngine.SAML_TOKEN, new NOOpProcessor());
        wssConfig.setProcessor(WSSecurityEngine.SAML2_TOKEN, new NOOpProcessor());
        data.setWssConfig(wssConfig);
        
        data.setDecCrypto(decryptionKeyManager.getCrypto());
        data.setCallbackHandler(new DecryptionCallbackHandler(keyPassword));
        try {
            List<WSSecurityEngineResult> result =
                proc.handleToken(encryptedRST, data, docInfo);
            if (result.size() > 0) {
                @SuppressWarnings("unchecked")
                List<WSDataRef> dataRefs = 
                    (List<WSDataRef>)result.get(result.size() - 1).get(WSSecurityEngineResult.TAG_DATA_REF_URIS);
                if (dataRefs != null && dataRefs.size() > 0) {
                    return dataRefs.get(0).getProtectedElement();
                }
            }
        } catch (WSSecurityException e) {
            LOG.debug(e.getMessage(), e);
            throw new ProcessingException(TYPE.TOKEN_INVALID);
        }
        return null;
    }

View Full Code Here


            return new LifeTime(created, expires);


        } catch (ParseException e) {
            LOG.error("Failed to parse lifetime element in wresult: " + e.getMessage());
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
    }

View Full Code Here

            }
            
            redirectURL = redirectURL + "?" + sb.toString();
        } catch (Exception ex) {
            LOG.error("Failed to create SignInRequest", ex);
            throw new ProcessingException("Failed to create SignInRequest");
        }        
        return redirectURL;
    }

View Full Code Here

        sts.setAddressingNamespace(HTTP_WWW_W3_ORG_2005_08_ADDRESSING);
        
        ServiceConfig serviceConfig = idpConfig.getServices().get(wtrealm);
        if (serviceConfig == null) {
            LOG.warn("No service config found for " + wtrealm);
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        
        // Parse wreq parameter - we only support parsing TokenType and KeyType for now
        String wreq = (String)WebUtils.getAttributeFromFlowScope(context, FederationConstants.PARAM_REQUEST);
        String stsTokenType = null;
        String stsKeyType = keyType;
        if (wreq != null) {
            Element wreqElement = getRSTFromWReq(wreq);
            if (wreqElement != null) {
                Element tokenTypeElement = 
                    DOMUtils.getFirstChildWithName(wreqElement, wreqElement.getNamespaceURI(), "TokenType");
                if (tokenTypeElement != null) {
                    stsTokenType = tokenTypeElement.getTextContent();
                }
                Element keyTypeElement = 
                    DOMUtils.getFirstChildWithName(wreqElement, wreqElement.getNamespaceURI(), "KeyType");
                if (keyTypeElement != null) {
                    stsKeyType = keyTypeElement.getTextContent();
                }
            }
        }
        
        if (stsTokenType != null) {
            sts.setTokenType(stsTokenType);
        } else if (serviceConfig.getTokenType() != null && serviceConfig.getTokenType().length() > 0) {
            sts.setTokenType(serviceConfig.getTokenType());
        } else {
            sts.setTokenType(getTokenType());
        }
        
        if (serviceConfig.getPolicyNamespace() != null && serviceConfig.getPolicyNamespace().length() > 0) {
            sts.setWspNamespace(serviceConfig.getPolicyNamespace());
        }
        
        if (LOG.isDebugEnabled()) {
            LOG.debug("TokenType " + sts.getTokenType() + " set for " + wtrealm);
        }
        
        sts.setKeyType(stsKeyType);
        if (HTTP_DOCS_OASIS_OPEN_ORG_WS_SX_WS_TRUST_200512_PUBLICKEY.equals(stsKeyType)) {
            HttpServletRequest servletRequest = WebUtils.getHttpServletRequest(context);
            if (servletRequest != null) {
                X509Certificate certs[] = 
                    (X509Certificate[])servletRequest.getAttribute("javax.servlet.request.X509Certificate");
                if (certs != null && certs.length > 0) {
                    sts.setUseCertificateForConfirmationKeyInfo(true);
                    sts.setUseKeyCertificate(certs[0]);
                } else {
                    LOG.info("Can't send a PublicKey KeyType as no client certs are available");
                    sts.setKeyType(HTTP_DOCS_OASIS_OPEN_ORG_WS_SX_WS_TRUST_200512_BEARER);
                }
            }
        }


        processWsdlLocation(context);
        sts.setWsdlLocation(wsdlLocation);
        sts.setServiceQName(new QName(
                HTTP_DOCS_OASIS_OPEN_ORG_WS_SX_WS_TRUST_200512,
                SECURITY_TOKEN_SERVICE));
        sts.setEndpointQName(new QName(
                HTTP_DOCS_OASIS_OPEN_ORG_WS_SX_WS_TRUST_200512, wsdlEndpoint));


        if (serviceConfig.getRequestedClaims() != null && serviceConfig.getRequestedClaims().size() > 0) {
            addClaims(sts, serviceConfig.getRequestedClaims());
            if (LOG.isDebugEnabled()) {
                LOG.debug("Requested claims set for " + wtrealm);
            }
        }
        
        sts.setEnableLifetime(true);
        if (serviceConfig.getLifeTime() != null && serviceConfig.getLifeTime().length() > 0) {
            try {
                int lifetime = Integer.parseInt(serviceConfig.getLifeTime());
                sts.setTtl(lifetime);
                sts.setEnableLifetime(lifetime > 0);
                if (LOG.isDebugEnabled()) {
                    LOG.debug("Lifetime set to " + serviceConfig.getLifeTime() + " seconds for " + wtrealm);
                }
            } catch (NumberFormatException ex) {
                LOG.warn("Invalid lifetime configured for service provider " + wtrealm);
                sts.setTtl(this.ttl);
                sts.setEnableLifetime(this.ttl > 0);
            }
        } else {
            sts.setTtl(this.ttl);
            sts.setEnableLifetime(this.ttl > 0);
            if (LOG.isDebugEnabled()) {
                LOG.debug("Lifetime set to " + this.ttl + " seconds for " + wtrealm);
            }
        }
        
        
        sts.setOnBehalfOf(idpToken.getToken());
        if (!(serviceConfig.getProtocol() == null
            || FederationConstants.WS_FEDERATION_NS.equals(serviceConfig.getProtocol()))) {
            LOG.error("Protocol " + serviceConfig.getProtocol() + " not supported for " + wtrealm);
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        
        String rpToken = sts.requestSecurityTokenResponse(wtrealm);
        
        InputStream is = new ByteArrayInputStream(rpToken.getBytes());

View Full Code Here

                    || STSUtils.WST_NS_05_02.equals(wreqElement.getNamespaceURI()))) {
                return wreqElement;
            }
        } catch (Exception e) {
            LOG.warn("Error parsing 'wreq' parameter: " + e.getMessage());
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        return null;
    }

View Full Code Here

                            + "] successfully retrieved from cache for home realm ["
                            + whr + "]");
                }
            } else {
                LOG.error("IDP_TOKEN not found");
                throw new ProcessingException(TYPE.BAD_REQUEST);
            }
        } else {
            LOG.error("Home realm not found");
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        return idpToken;
    }

View Full Code Here

            if (hasSigningKey) {
                ByteArrayOutputStream result = signMetaInfo(config, is, referenceID);
                if (result != null) {
                    is = new ByteArrayInputStream(result.toByteArray());
                } else {
                    throw new ProcessingException("Failed to sign the metadata document: result=null");
                }
            }
            return DOMUtils.readXml(is);
        } catch (ProcessingException e) {
            throw e;
        } catch (Exception e) {
            LOG.error("Error creating service metadata information ", e);
            throw new ProcessingException("Error creating service metadata information: " + e.getMessage());
        }


    }

View Full Code Here

        PrivateKey keyEntry = keyManager.getCrypto().getPrivateKey(keyAlias, keypass);
        CryptoType cryptoType = new CryptoType(CryptoType.TYPE.ALIAS);
        cryptoType.setAlias(keyAlias);
        X509Certificate[] issuerCerts = keyManager.getCrypto().getX509Certificates(cryptoType);
        if (issuerCerts == null || issuerCerts.length == 0) {
            throw new ProcessingException(
                    "No issuer certs were found to sign the metadata using issuer name: "
                            + keyAlias);
        }
        X509Certificate cert = issuerCerts[0];

View Full Code Here

        FederationResponse response = null;
        if (FederationConstants.ACTION_SIGNIN.equals(request.getWa())) {
            response = this.processSignInRequest(request, config);
        } else {
            LOG.error("Invalid action '" + request.getWa() + "'");
            throw new ProcessingException(TYPE.INVALID_REQUEST);
        }
        return response;
    }

View Full Code Here

            doc = DOMUtils.readXml(new ByteArrayInputStream(wresult));
            el = doc.getDocumentElement();


        } catch (Exception e) {
            LOG.warn("Failed to parse wresult: " + e.getMessage());
            throw new ProcessingException(TYPE.INVALID_REQUEST);
        }


        if ("RequestSecurityTokenResponseCollection".equals(el.getLocalName())) {
            el = DOMUtils.getFirstElement(el);
        }
        if (!"RequestSecurityTokenResponse".equals(el.getLocalName())) {
            LOG.warn("Unexpected root element of wresult: '" + el.getLocalName() + "'");
            throw new ProcessingException(TYPE.INVALID_REQUEST);
        }
        el = DOMUtils.getFirstElement(el);
        Element rst = null;
        Element lifetimeElem = null;
        String tt = null;


        while (el != null) {
            String ln = el.getLocalName();
            if (FederationConstants.WS_TRUST_13_NS.equals(el.getNamespaceURI()) 
                || FederationConstants.WS_TRUST_2005_02_NS.equals(el.getNamespaceURI())) {
                if ("Lifetime".equals(ln)) {
                    lifetimeElem = el;
                } else if ("RequestedSecurityToken".equals(ln)) {
                    rst = DOMUtils.getFirstElement(el);
                } else if ("TokenType".equals(ln)) {
                    tt = DOMUtils.getContent(el);
                }
            }
            el = DOMUtils.getNextElement(el);
        }
        if (LOG.isDebugEnabled()) {
            LOG.debug("RST: " + ((rst != null) ? rst.toString() : "null"));
            LOG.debug("Lifetime: "
                    + ((lifetimeElem != null) ? lifetimeElem.toString()
                            : "null"));
            LOG.debug("Tokentype: " + ((tt != null) ? tt.toString() : "null"));
        }
        if (rst == null) {
            LOG.warn("RequestedSecurityToken element not found in wresult");
            throw new ProcessingException(TYPE.BAD_REQUEST);
        }
        LifeTime lifeTime = null;
        if (lifetimeElem != null) {
            lifeTime = processLifeTime(lifetimeElem);
        }


        if (config.isDetectExpiredTokens() && lifeTime != null) {
            Date currentDate = new Date();
            if (currentDate.after(lifeTime.getExpires())) {
                LOG.warn("RSTR Lifetime expired");
                throw new ProcessingException(TYPE.TOKEN_EXPIRED);
            }
            DateTime currentTime = new DateTime();
            DateTime validFrom = new DateTime(lifeTime.created);
            currentTime = currentTime.plusSeconds(config.getMaximumClockSkew().intValue());
            if (validFrom.isAfter(currentTime)) {
                LOG.debug("RSTR Lifetime not yet valid");
                throw new ProcessingException(TYPE.TOKEN_INVALID);
            }
        }


        TokenValidatorResponse validatorResponse = null;
        List<TokenValidator> validators = ((FederationProtocol)config.getProtocol()).getTokenValidators();
        for (TokenValidator validator : validators) {
            boolean canHandle = false;
            if (tt != null) {
                canHandle = validator.canHandleTokenType(tt);
            } else {
                canHandle = validator.canHandleToken(rst);
            }
            if (canHandle) {
                try {
                    validatorResponse = validator.validateAndProcessToken(rst, config);
                } catch (ProcessingException ex) {
                    throw ex;
                } catch (Exception ex) {
                    LOG.warn("Failed to validate token", ex);
                    throw new ProcessingException(TYPE.TOKEN_INVALID);
                }
                break;
            } else {
                LOG.warn("No security token validator found for '" + tt + "'");
                throw new ProcessingException(TYPE.BAD_REQUEST);
            }
        }


        // Check whether token already used for signin
        if (validatorResponse.getUniqueTokenId() != null
                && config.isDetectReplayedTokens()) {
            // Check whether token has already been processed once, prevent
            // replay attack
            if (config.getTokenReplayCache().getId(validatorResponse.getUniqueTokenId()) == null) {
                // not cached
                Date expires = null;
                if (lifeTime != null && lifeTime.getExpires() != null) {
                    expires = lifeTime.getExpires();
                } else {
                    expires = validatorResponse.getExpires();
                }
                if (expires != null) {
                    Date currentTime = new Date();
                    long ttl = expires.getTime() - currentTime.getTime();
                    config.getTokenReplayCache().putId(validatorResponse.getUniqueTokenId(), ttl / 1000L);
                } else {
                    config.getTokenReplayCache().putId(validatorResponse.getUniqueTokenId());
                }
            } else {
                LOG.error("Replay attack with token id: " + validatorResponse.getUniqueTokenId());
                throw new ProcessingException("Replay attack with token id: "
                        + validatorResponse.getUniqueTokenId(), TYPE.TOKEN_REPLAY);
            }
        }


        FederationResponse fedResponse = new FederationResponse(

View Full Code Here

0 1 2 3

TOP

Related Classes of org.apache.cxf.fediz.core.exception.ProcessingException

org.apache.cxf.fediz.core.FederationProcessorImpl

org.apache.cxf.fediz.core.metadata.MetadataWriter

org.apache.cxf.fediz.core.saml.SAMLTokenValidator

org.apache.cxf.fediz.service.idp.beans.STSClientAction

org.apache.cxf.fediz.service.idp.beans.ValidateTokenAction

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.