RequestData data,
WSDocInfo wsDocInfo,
Map<String, Object> parameters
) throws WSSecurityException {
Crypto crypto = data.getSigVerCrypto();
SecurityTokenReference secRef =
new SecurityTokenReference(strElement, data.getBSPEnforcer());
//
// Here we get some information about the document that is being
// processed, in particular the crypto implementation, and already
// detected BST that may be used later during dereferencing.
//
String uri = null;
if (secRef.containsReference()) {
uri = secRef.getReference().getURI();
if (uri.charAt(0) == '#') {
uri = uri.substring(1);
}
referenceType = REFERENCE_TYPE.DIRECT_REF;
} else if (secRef.containsKeyIdentifier()) {
uri = secRef.getKeyIdentifierValue();
if (SecurityTokenReference.THUMB_URI.equals(secRef.getKeyIdentifierValueType())) {
referenceType = REFERENCE_TYPE.THUMBPRINT_SHA1;
} else {
referenceType = REFERENCE_TYPE.KEY_IDENTIFIER;
}
}
WSSecurityEngineResult result = wsDocInfo.getResult(uri);
if (result != null) {
processPreviousResult(result, secRef, data, parameters);
} else if (secRef.containsReference()) {
Reference reference = secRef.getReference();
// Try asking the CallbackHandler for the secret key
secretKey = getSecretKeyFromToken(uri, reference.getValueType(), data);
principal = new CustomTokenPrincipal(uri);
if (secretKey == null) {
Element token =
secRef.getTokenElement(strElement.getOwnerDocument(), wsDocInfo, data.getCallbackHandler());
QName el = new QName(token.getNamespaceURI(), token.getLocalName());
if (el.equals(WSSecurityEngine.BINARY_TOKEN)) {
Processor proc = data.getWssConfig().getProcessor(WSSecurityEngine.BINARY_TOKEN);
List<WSSecurityEngineResult> bstResult =
proc.handleToken(token, data, wsDocInfo);
BinarySecurity bstToken =
(BinarySecurity)bstResult.get(0).get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
STRParserUtil.checkBinarySecurityBSPCompliance(
secRef, bstToken, data.getBSPEnforcer()
);
certs = (X509Certificate[])bstResult.get(0).get(WSSecurityEngineResult.TAG_X509_CERTIFICATES);
secretKey = (byte[])bstResult.get(0).get(WSSecurityEngineResult.TAG_SECRET);
principal = (Principal)bstResult.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
} else if (el.equals(WSSecurityEngine.SAML_TOKEN)
|| el.equals(WSSecurityEngine.SAML2_TOKEN)) {
Processor proc = data.getWssConfig().getProcessor(WSSecurityEngine.SAML_TOKEN);
//
// Just check to see whether the token was processed or not
//
Element processedToken =
secRef.findProcessedTokenElement(
strElement.getOwnerDocument(), wsDocInfo,
data.getCallbackHandler(), uri, secRef.getReference().getValueType()
);
SamlAssertionWrapper samlAssertion = null;
if (processedToken == null) {
List<WSSecurityEngineResult> samlResult =
proc.handleToken(token, data, wsDocInfo);
samlAssertion =
(SamlAssertionWrapper)samlResult.get(0).get(
WSSecurityEngineResult.TAG_SAML_ASSERTION
);
} else {
samlAssertion = new SamlAssertionWrapper(processedToken);
samlAssertion.parseSubject(
new WSSSAMLKeyInfoProcessor(data, wsDocInfo),
data.getSigVerCrypto(), data.getCallbackHandler()
);
}
STRParserUtil.checkSamlTokenBSPCompliance(secRef, samlAssertion, data.getBSPEnforcer());
SAMLKeyInfo keyInfo = samlAssertion.getSubjectKeyInfo();
X509Certificate[] foundCerts = keyInfo.getCerts();
if (foundCerts != null && foundCerts.length > 0) {
certs = new X509Certificate[]{foundCerts[0]};
}
secretKey = keyInfo.getSecret();
principal = createPrincipalFromSAML(samlAssertion);
} else if (el.equals(WSSecurityEngine.ENCRYPTED_KEY)) {
STRParserUtil.checkEncryptedKeyBSPCompliance(secRef, data.getBSPEnforcer());
Processor proc = data.getWssConfig().getProcessor(WSSecurityEngine.ENCRYPTED_KEY);
List<WSSecurityEngineResult> encrResult =
proc.handleToken(token, data, wsDocInfo);
secretKey =
(byte[])encrResult.get(0).get(WSSecurityEngineResult.TAG_SECRET);
principal = new CustomTokenPrincipal(token.getAttributeNS(null, "Id"));
}
}
} else if (secRef.containsX509Data() || secRef.containsX509IssuerSerial()) {
referenceType = REFERENCE_TYPE.ISSUER_SERIAL;
X509Certificate[] foundCerts = secRef.getX509IssuerSerial(crypto);
if (foundCerts != null && foundCerts.length > 0) {
certs = new X509Certificate[]{foundCerts[0]};
}
} else if (secRef.containsKeyIdentifier()) {
if (secRef.getKeyIdentifierValueType().equals(SecurityTokenReference.ENC_KEY_SHA1_URI)) {
STRParserUtil.checkEncryptedKeyBSPCompliance(secRef, data.getBSPEnforcer());
String id = secRef.getKeyIdentifierValue();
secretKey =
getSecretKeyFromToken(id, SecurityTokenReference.ENC_KEY_SHA1_URI, data);
principal = new CustomTokenPrincipal(id);
} else if (WSConstants.WSS_SAML_KI_VALUE_TYPE.equals(secRef.getKeyIdentifierValueType())
|| WSConstants.WSS_SAML2_KI_VALUE_TYPE.equals(secRef.getKeyIdentifierValueType())) {
parseSAMLKeyIdentifier(secRef, wsDocInfo, data);
} else {
parseBSTKeyIdentifier(secRef, crypto, wsDocInfo, data);
}
} else {