public SymmetricKeyHandler(TokenProviderParameters tokenParameters) {
KeyRequirements keyRequirements = tokenParameters.getKeyRequirements();
keySize = Long.valueOf(keyRequirements.getKeySize()).intValue();
STSPropertiesMBean stsProperties = tokenParameters.getStsProperties();
SignatureProperties signatureProperties = stsProperties.getSignatureProperties();
// Test EncryptWith
String encryptWith = keyRequirements.getEncryptWith();
if (encryptWith != null) {
if ((WSConstants.AES_128.equals(encryptWith) || WSConstants.AES_128_GCM.equals(encryptWith))
&& keySize < 128) {
keySize = 128;
} else if ((WSConstants.AES_192.equals(encryptWith)
|| WSConstants.AES_192_GCM.equals(encryptWith))
&& keySize < 192) {
keySize = 192;
} else if ((WSConstants.AES_256.equals(encryptWith)
|| WSConstants.AES_256_GCM.equals(encryptWith))
&& keySize < 256) {
keySize = 256;
} else if (WSConstants.TRIPLE_DES.equals(encryptWith) && keySize < 192) {
keySize = 192;
}
}
// Test KeySize
if (keySize < signatureProperties.getMinimumKeySize()
|| keySize > signatureProperties.getMaximumKeySize()) {
keySize = Long.valueOf(signatureProperties.getKeySize()).intValue();
LOG.log(
Level.WARNING, "Received KeySize of " + keyRequirements.getKeySize()
+ " not accepted so defaulting to " + signatureProperties.getKeySize()
);
}
// Test Entropy
clientEntropy = keyRequirements.getEntropy();
if (clientEntropy == null) {
LOG.log(Level.WARNING, "A SymmetricKey KeyType is requested, but no client entropy is provided");
} else if (clientEntropy.getBinarySecret() != null) {
BinarySecret binarySecret = clientEntropy.getBinarySecret();
if (STSConstants.NONCE_TYPE.equals(binarySecret.getBinarySecretType())) {
byte[] nonce = binarySecret.getBinarySecretValue();
if (nonce == null || (nonce.length < (keySize / 8))) {
LOG.log(Level.WARNING, "User Entropy rejected");
clientEntropy = null;
}
String computedKeyAlgorithm = keyRequirements.getComputedKeyAlgorithm();
if (!STSConstants.COMPUTED_KEY_PSHA1.equals(computedKeyAlgorithm)) {
LOG.log(
Level.WARNING,
"The computed key algorithm of " + computedKeyAlgorithm + " is not supported"
);
throw new STSException(
"Computed Key Algorithm not supported", STSException.INVALID_REQUEST
);
}
} else if (STSConstants.SYMMETRIC_KEY_TYPE.equals(binarySecret.getBinarySecretType())
|| binarySecret.getBinarySecretType() == null) {
byte[] secretValue = binarySecret.getBinarySecretValue();
if (((long)secretValue.length * 8L) < signatureProperties.getMinimumKeySize()
|| ((long)secretValue.length * 8L) > signatureProperties.getMaximumKeySize()) {
LOG.log(
Level.WARNING, "Received secret of length " + secretValue.length
+ " bits is not accepted"
);
LOG.log(Level.WARNING, "User Entropy rejected");
clientEntropy = null;
}
} else {
LOG.log(
Level.WARNING, "The type " + binarySecret.getBinarySecretType() + " is not supported"
);
throw new STSException(
"No user supplied entropy for SymmetricKey case", STSException.INVALID_REQUEST
);
}
} else if (clientEntropy.getDecryptedKey() != null) {
byte[] secretValue = clientEntropy.getDecryptedKey();
if (((long)secretValue.length * 8L) < signatureProperties.getMinimumKeySize()
|| ((long)secretValue.length * 8L) > signatureProperties.getMaximumKeySize()) {
LOG.log(
Level.WARNING, "Received secret of length " + secretValue.length
+ " bits is not accepted"
);
LOG.log(Level.WARNING, "User Entropy rejected");