* * X509 SubjectKeyIdentifier
* * SAML Assertion ID
* (3). Embedded Reference
* (4). X509 Issuer Serial
*/
SecurityToken secToken = null;
FilterProcessingContext filterContext = (FilterProcessingContext)context.get (MessageConstants.WSS_PROCESSING_CONTEXT);
SecurableSoapMessage secureMessage = filterContext.getSecurableSoapMessage ();
Document soapDocument = secureMessage.getSOAPPart ();
SOAPElement soapElem = XMLUtil.convertToSoapElement (soapDocument, (Element) element);
SecurityTokenReference tokenRef = new SecurityTokenReference (soapElem);
ReferenceElement refElement = tokenRef.getReference ();
HashMap tokenCache = filterContext.getTokenCache ();
Element tokenElement = null;
Element newElement = null;
if (refElement instanceof DirectReference) {
// isXMLToken = true;
/* Use the URI value to locate the BST */
String uri = ((DirectReference) refElement).getURI ();
String tokenId = uri.substring (1);
secToken = (SecurityToken)tokenCache.get (tokenId);
if(secToken == null){
tokenElement = secureMessage.getElementById (tokenId);
if(tokenElement == null){
throw new URIReferenceException ("Could not locate token with following ID"+tokenId);
}
} else {
tokenElement = secToken.getAsSoapElement();
}
newElement = (Element)element.getOwnerDocument ().importNode (tokenElement, true);
} else if (refElement instanceof KeyIdentifier) {
String valueType = ((KeyIdentifier) refElement).getValueType ();
String keyId = ((KeyIdentifier) refElement).getReferenceValue ();
if (MessageConstants.X509SubjectKeyIdentifier_NS.
equals (valueType) ||
MessageConstants.X509v3SubjectKeyIdentifier_NS.
equals (valueType)) {
/* Use the Subject Key Identifier to locate BST */
// isXMLToken = false;
X509Certificate cert = null;
Object token = tokenCache.get (keyId);
if(token instanceof X509SubjectKeyIdentifier ){
if(token != null){
cert = ((X509SubjectKeyIdentifier)token).getCertificate ();
}
}
if(cert == null){
cert = filterContext.getSecurityEnvironment ().getCertificate (
filterContext.getExtraneousProperties (), XMLUtil.getDecodedBase64EncodedData (keyId));
}
secToken = new X509SecurityToken (soapDocument, cert);
tokenElement = secToken.getAsSoapElement ();
newElement = tokenElement;
//(Element)element.getOwnerDocument().importNode(tokenElement, true);
try {
// EncodingType should not be set -
// As specified by WSS spec
newElement.removeAttribute ("EncodingType");
} catch (DOMException de) {
logger.log(Level.SEVERE,com.sun.xml.wss.logging.LogStringsMessages.WSS_0607_STR_TRANSFORM_EXCEPTION());
throw new XWSSecurityRuntimeException (de.getMessage (), de);
}
} else if (MessageConstants.ThumbPrintIdentifier_NS.equals (valueType)) {
X509Certificate cert = null;
Object token = tokenCache.get (keyId);
if(token instanceof X509ThumbPrintIdentifier ){
if(token != null){
cert = ((X509ThumbPrintIdentifier)token).getCertificate ();
}
}
if(cert == null){
cert = filterContext.getSecurityEnvironment ().getCertificate (
filterContext.getExtraneousProperties (), XMLUtil.getDecodedBase64EncodedData (keyId), MessageConstants.THUMB_PRINT_TYPE);
}
secToken = new X509SecurityToken (soapDocument, cert);
tokenElement = secToken.getAsSoapElement ();
newElement = tokenElement;
//(Element)element.getOwnerDocument().importNode(tokenElement, true);
try {
// EncodingType should not be set -
// As specified by WSS spec
newElement.removeAttribute ("EncodingType");
} catch (DOMException de) {
logger.log(Level.SEVERE,com.sun.xml.wss.logging.LogStringsMessages.WSS_0607_STR_TRANSFORM_EXCEPTION());
throw new XWSSecurityRuntimeException (de.getMessage (), de);
}
}else if(MessageConstants.EncryptedKeyIdentifier_NS.equals (valueType)){
// do something here
newElement = null;
} else if (MessageConstants.WSSE_SAML_KEY_IDENTIFIER_VALUE_TYPE.equals (valueType) ||
MessageConstants.WSSE_SAML_v2_0_KEY_IDENTIFIER_VALUE_TYPE.equals (valueType)) {
//TODO : should we first try locating from the cache
if (tokenRef.getSamlAuthorityBinding () != null) {
tokenElement = filterContext.getSecurityEnvironment ().
locateSAMLAssertion (
filterContext.getExtraneousProperties(), tokenRef.getSamlAuthorityBinding (), keyId, secureMessage.getSOAPPart ());
} else {
tokenElement = SAMLUtil.locateSamlAssertion (keyId,secureMessage.getSOAPPart ());
}
newElement = (Element)element.getOwnerDocument ().importNode (tokenElement, true);
Assertion assertion = null;
try {
assertion = AssertionUtil.fromElement(tokenElement);
} catch (Exception e) {
throw new XWSSecurityException (e);
}
tokenCache.put (keyId, assertion);
} else {
try {
tokenElement = resolveSAMLToken (tokenRef, keyId, filterContext);
} catch (Exception e) {
// ignore
}
if (tokenElement != null) {
newElement = (Element)element.getOwnerDocument ().importNode (tokenElement, true);
} else {
//TODO : there can be a X509 KeyIdentifier without ValueType
// log.log(Level.SEVERE, "WSS0334.unsupported.keyidentifier");
XWSSecurityException xwsse =
new XWSSecurityException (
"WSS_DSIG0008:unsupported KeyIdentifier Reference Type "
+ valueType);
throw SecurableSoapMessage.newSOAPFaultException (
MessageConstants.WSSE_INVALID_SECURITY_TOKEN,
xwsse.getMessage (),
xwsse);
}
}
} else if (refElement instanceof X509IssuerSerial) {
// isXMLToken = false;
BigInteger serialNumber =
((X509IssuerSerial) refElement).getSerialNumber ();
String issuerName = ((X509IssuerSerial) refElement).getIssuerName ();
X509Certificate cert = null;
Object token = tokenCache.get (issuerName+serialNumber);
if(token instanceof X509IssuerSerial){
cert = ((X509IssuerSerial)token).getCertificate ();
}
if(cert == null){
cert = filterContext.getSecurityEnvironment ().getCertificate (
filterContext.getExtraneousProperties (),serialNumber, issuerName);
}
secToken = new X509SecurityToken (soapDocument, cert);
tokenElement = secToken.getAsSoapElement ();
newElement = tokenElement;
//(Element)element.getOwnerDocument().importNode(tokenElement, true);
try {
// EncodingType should not be set - As specified by WSS spec
newElement.removeAttribute ("EncodingType");