RampartPolicyData rpd = rmd.getPolicyData();
Vector signatureValues = new Vector();
Token encryptionToken = rpd.getEncryptionToken();
Vector encrParts = RampartUtil.getEncryptedParts(rmd);
if(encryptionToken == null && encrParts.size() > 0) {
throw new RampartException("encryptionTokenMissing");
}
if(encryptionToken != null && encrParts.size() > 0) {
//The encryption token can be an IssuedToken or a
//SecureConversationToken
String tokenId = null;
org.apache.rahas.Token tok = null;
if(encryptionToken instanceof IssuedToken) {
tokenId = rmd.getIssuedEncryptionTokenId();
log.debug("Issued EncryptionToken Id : " + tokenId);
} else if(encryptionToken instanceof SecureConversationToken) {
tokenId = rmd.getSecConvTokenId();
log.debug("SCT Id : " + tokenId);
} else if (encryptionToken instanceof X509Token) {
tokenId = setupEncryptedKey(rmd, encryptionToken);
} //TODO SAMLToken
if(tokenId == null || tokenId.length() == 0) {
throw new RampartException("noSecurityToken");
}
/*
* Get hold of the token from the token storage
*/
tok = this.getToken(rmd, tokenId);
/*
* Attach the token into the message based on token inclusion
* values
*/
boolean attached = false;
Element encrTokenElement = null;
Element refList = null;
WSSecDKEncrypt dkEncr = null;
WSSecEncrypt encr = null;
Element encrDKTokenElem = null;
if(Constants.INCLUDE_ALWAYS.equals(encryptionToken.getInclusion()) ||
Constants.INCLUDE_ONCE.equals(encryptionToken.getInclusion()) ||
(rmd.isClientSide() && Constants.INCLUDE_ALWAYS_TO_RECIPIENT.equals(encryptionToken.getInclusion()))) {
encrTokenElement = RampartUtil.appendChildToSecHeader(rmd, tok.getToken());
attached = true;
}
//In the X509 case we MUST add the EncryptedKey
if(encryptionToken instanceof X509Token) {
RampartUtil.appendChildToSecHeader(rmd, tok.getToken());
}
Document doc = rmd.getDocument();
if(encryptionToken.isDerivedKeys()) {
log.debug("Use drived keys");
dkEncr = new WSSecDKEncrypt();
if(attached && tok.getAttachedReference() != null) {
dkEncr.setExternalKey(tok.getSecret(), (Element) doc
.importNode((Element) tok.getAttachedReference(),
true));
} else if(tok.getUnattachedReference() != null) {
dkEncr.setExternalKey(tok.getSecret(), (Element) doc
.importNode((Element) tok.getUnattachedReference(),
true));
} else {
dkEncr.setExternalKey(tok.getSecret(), tok.getId());
}
try {
dkEncr.prepare(doc);
encrDKTokenElem = dkEncr.getdktElement();
RampartUtil.appendChildToSecHeader(rmd, encrDKTokenElem);
refList = dkEncr.encryptForExternalRef(null, encrParts);
} catch (WSSecurityException e) {
throw new RampartException("errorInDKEncr");
} catch (ConversationException e) {
throw new RampartException("errorInDKEncr");
}
} else {
log.debug("NO derived keys, use the shared secret");
encr = new WSSecEncrypt();
encr.setWsConfig(rmd.getConfig());
encr.setEphemeralKey(tok.getSecret());
encr.setDocument(doc);
try {
//Encrypt, get hold of the ref list and add it
refList = encr.encryptForExternalRef(null, encrParts);
} catch (WSSecurityException e) {
throw new RampartException("errorInEncryption", e);
}
}
RampartUtil.appendChildToSecHeader(rmd, refList);
this.setInsertionLocation(encrTokenElement);
HashMap sigSuppTokMap = null;
HashMap endSuppTokMap = null;
HashMap sgndEndSuppTokMap = null;
Vector sigParts = RampartUtil.getSignedParts(rmd);
sigParts.add(new WSEncryptionPart(RampartUtil
.addWsuIdToElement((OMElement) this.timestampElement)));
if(rmd.isClientSide()) {
// Now add the supporting tokens
SupportingToken sgndSuppTokens = rpd.getSignedSupportingTokens();
sigSuppTokMap = this.handleSupportingTokens(rmd, sgndSuppTokens);
SupportingToken endSuppTokens = rpd.getEndorsingSupportingTokens();
endSuppTokMap = this.handleSupportingTokens(rmd, endSuppTokens);
SupportingToken sgndEndSuppTokens = rpd.getSignedEndorsingSupportingTokens();
sgndEndSuppTokMap = this.handleSupportingTokens(rmd, sgndEndSuppTokens);
//Setup signature parts
sigParts = addSignatureParts(sigSuppTokMap, sigParts);
sigParts = addSignatureParts(sgndEndSuppTokMap, sigParts);
} else {
addSignatureConfirmation(rmd, sigParts);
}
//Sign the message
//We should use the same key in the case of EncryptBeforeSig
signatureValues.add(this.doSymmSignature(rmd, encryptionToken, tok, sigParts));
this.mainSigId = RampartUtil.addWsuIdToElement((OMElement)this.getInsertionLocation());
if(rmd.isClientSide()) {
//Do endorsed signatures
Vector endSigVals = this.doEndorsedSignatures(rmd, endSuppTokMap);
for (Iterator iter = endSigVals.iterator(); iter.hasNext();) {
signatureValues.add(iter.next());
}
//Do signed endorsing signatures
Vector sigEndSigVals = this.doEndorsedSignatures(rmd, sgndEndSuppTokMap);
for (Iterator iter = sigEndSigVals.iterator(); iter.hasNext();) {
signatureValues.add(iter.next());
}
}
//Check for signature protection
if(rpd.isSignatureProtection() && this.mainSigId != null) {
Vector secondEncrParts = new Vector();
//Now encrypt the signature using the above token
secondEncrParts.add(new WSEncryptionPart(this.mainSigId, "Element"));
Element secondRefList = null;
if(encryptionToken.isDerivedKeys()) {
try {
secondRefList = dkEncr.encryptForExternalRef(null,
secondEncrParts);
RampartUtil.insertSiblingAfter(
rmd,