createSecurityContext(new CustomTokenPrincipal("alice"))
);
WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);
// Issue a token
RequestSecurityTokenResponseCollectionType response =
issueOperation.issue(request, webServiceContext);
List<RequestSecurityTokenResponseType> securityTokenResponse =
response.getRequestSecurityTokenResponse();
assertTrue(!securityTokenResponse.isEmpty());
// Test the generated token.
Element assertion = null;
for (Object tokenObject : securityTokenResponse.get(0).getAny()) {
if (tokenObject instanceof JAXBElement<?>
&& REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {
RequestedSecurityTokenType rstType =
(RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();
assertion = (Element)rstType.getAny();
}
}
String tokenString = DOM2Writer.nodeToString(assertion);
assertTrue(tokenString.contains("AttributeStatement"));
assertTrue(tokenString.contains("alice"));
assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));
// Now remove the UseKey + send a non-trusted UseKey certificate
request.getAny().remove(useKeyType);
Properties properties = new Properties();
properties.put(
"org.apache.wss4j.crypto.provider", "org.apache.wss4j.common.crypto.Merlin"
);
properties.put("org.apache.wss4j.crypto.merlin.keystore.password", "evespass");
properties.put("org.apache.wss4j.crypto.merlin.keystore.file", "eve.jks");
useKey = createUseKey(CryptoFactory.getInstance(properties), "eve");
useKeyType = new JAXBElement<UseKeyType>(QNameConstants.USE_KEY, UseKeyType.class, useKey);
request.getAny().add(useKeyType);
// This should fail as the UseKey certificate is not trusted
try {
issueOperation.issue(request, webServiceContext);
fail("Failure expected as the UseKey certificate is not trusted");
} catch (STSException ex) {
// expected
}
// Now allow non-trusted UseKey certificates...
stsProperties.setValidateUseKey(false);
response = issueOperation.issue(request, webServiceContext);
securityTokenResponse = response.getRequestSecurityTokenResponse();
assertTrue(!securityTokenResponse.isEmpty());
}