public boolean assertToken(TokenSecurityEvent<? extends SecurityToken> tokenSecurityEvent,
AbstractToken abstractToken) throws WSSPolicyException, XMLSecurityException {
if (!(tokenSecurityEvent instanceof UsernameTokenSecurityEvent)) {
throw new WSSPolicyException("Expected a UsernameSecurityTokenEvent but got " + tokenSecurityEvent.getClass().getName());
}
UsernameSecurityToken usernameSecurityToken = (UsernameSecurityToken) tokenSecurityEvent.getSecurityToken();
UsernameTokenSecurityEvent usernameTokenSecurityEvent = (UsernameTokenSecurityEvent) tokenSecurityEvent;
UsernameToken usernameToken = (UsernameToken) abstractToken;
String namespace = getAssertion().getName().getNamespaceURI();
if (usernameToken.getPasswordType() != null) {
switch (usernameToken.getPasswordType()) {
case NoPassword:
if (usernameTokenSecurityEvent.getUsernameTokenPasswordType() != WSSConstants.UsernameTokenPasswordType.PASSWORD_NONE) {
setErrorMessage("UsernameToken contains a password but the policy prohibits it");
getPolicyAsserter().unassertPolicy(new QName(namespace, SPConstants.NO_PASSWORD),
getErrorMessage());
return false;
}
getPolicyAsserter().assertPolicy(new QName(namespace, SPConstants.NO_PASSWORD));
break;
case HashPassword:
if (usernameTokenSecurityEvent.getUsernameTokenPasswordType() != WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST) {
setErrorMessage("UsernameToken does not contain a hashed password");
getPolicyAsserter().unassertPolicy(new QName(namespace, SPConstants.HASH_PASSWORD),
getErrorMessage());
return false;
}
getPolicyAsserter().assertPolicy(new QName(namespace, SPConstants.HASH_PASSWORD));
break;
}
} else if (usernameTokenSecurityEvent.getUsernameTokenPasswordType() == WSSConstants.UsernameTokenPasswordType.PASSWORD_NONE) {
// We must have a password for the default case
setErrorMessage("UsernameToken must contain a password");
getPolicyAsserter().unassertPolicy(getAssertion(), getErrorMessage());
return false;
} else if (usernameTokenSecurityEvent.getUsernameTokenPasswordType() == WSSConstants.UsernameTokenPasswordType.PASSWORD_DIGEST) {
// We must have a plaintext password for the default case
setErrorMessage("UsernameToken password must not be hashed");
getPolicyAsserter().unassertPolicy(getAssertion(), getErrorMessage());
return false;
}
if (usernameToken.isCreated()) {
if (usernameSecurityToken.getCreatedTime() == null || usernameTokenSecurityEvent.getUsernameTokenPasswordType() != WSSConstants.UsernameTokenPasswordType.PASSWORD_TEXT) {
setErrorMessage("UsernameToken does not contain a created timestamp or password is not plain text");
getPolicyAsserter().unassertPolicy(SP13Constants.CREATED, getErrorMessage());
return false;
} else {
getPolicyAsserter().assertPolicy(SP13Constants.CREATED);
}
}
if (usernameToken.isNonce()) {
if (usernameSecurityToken.getNonce() == null || usernameTokenSecurityEvent.getUsernameTokenPasswordType() != WSSConstants.UsernameTokenPasswordType.PASSWORD_TEXT) {
setErrorMessage("UsernameToken does not contain a nonce or password is not plain text");
getPolicyAsserter().unassertPolicy(SP13Constants.NONCE, getErrorMessage());
return false;
} else {
getPolicyAsserter().assertPolicy(SP13Constants.NONCE);