callbackHandler = handler.getPasswordCallbackHandler(reqData);
}
WSPasswordCallback passwordCallback =
handler.getPasswordCB(reqData.getUsername(), WSConstants.UT_SIGN, callbackHandler, reqData);
WSSecUsernameToken builder = new WSSecUsernameToken(reqData.getWssConfig());
int iterations = reqData.getDerivedKeyIterations();
boolean useMac = reqData.isUseDerivedKeyForMAC();
builder.addDerivedKey(useMac, null, iterations);
builder.setUserInfo(reqData.getUsername(), passwordCallback.getPassword());
builder.addCreated();
builder.addNonce();
builder.prepare(doc);
// Now prepare to sign.
// First step: Get a WS Signature object and set config parameters
// second step: set user data and algorithm parameters. This
// _must_ be done before we "prepare"
// third step: Call "prepare". This creates the internal WS Signature
// data structures, XML element, fills in the algorithms
// and other data.
// fourth step: Get the references. These references identify the parts
// of the document that will be included into the
// signature. If no references are given sign the message
// body by default.
// fifth step: compute the signature
//
// after "prepare" the Signature XML element is ready and may prepend
// this to the security header.
SignatureActionToken signatureToken = null;
if (actionToken instanceof SignatureActionToken) {
signatureToken = (SignatureActionToken)actionToken;
}
if (signatureToken == null) {
signatureToken = reqData.getSignatureToken();
}
WSSecSignature sign = new WSSecSignature(reqData.getWssConfig());
sign.setCustomTokenValueType(WSConstants.USERNAMETOKEN_NS + "#UsernameToken");
sign.setCustomTokenId(builder.getId());
sign.setSecretKey(builder.getDerivedKey());
sign.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
if (signatureToken.getDigestAlgorithm() != null) {
sign.setDigestAlgo(signatureToken.getDigestAlgorithm());
}
if (signatureToken.getSignatureAlgorithm() != null) {
sign.setSignatureAlgorithm(signatureToken.getSignatureAlgorithm());
} else {
sign.setSignatureAlgorithm(WSConstants.HMAC_SHA1);
}
sign.prepare(doc, null, reqData.getSecHeader());
// prepend in this order: first the Signature Element and then the
// UsernameToken Element. This way the server gets the UsernameToken
// first, can check it and are prepared to compute the Signature key.
// sign.prependToHeader(reqData.getSecHeader());
// builder.prependToHeader(reqData.getSecHeader());
List<WSEncryptionPart> parts = null;
if (signatureToken.getParts().size() > 0) {
parts = signatureToken.getParts();
} else {
SOAPConstants soapConstants = reqData.getSoapConstants();
if (soapConstants == null) {
soapConstants = WSSecurityUtil.getSOAPConstants(doc.getDocumentElement());
}
parts = new ArrayList<WSEncryptionPart>();
WSEncryptionPart encP =
new WSEncryptionPart(WSConstants.ELEM_BODY, soapConstants.getEnvelopeURI(), "Content");
parts.add(encP);
}
List<javax.xml.crypto.dsig.Reference> referenceList =
sign.addReferencesToSign(parts, reqData.getSecHeader());
try {
sign.computeSignature(referenceList);
reqData.getSignatureValues().add(sign.getSignatureValue());
} catch (WSSecurityException e) {
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE,
"empty", e,
"WSHandler: Error during UsernameTokenSignature"
);
}
builder.prependToHeader(reqData.getSecHeader());
}