boolean wss11Sender = "true".equals(context.getExtraneousProperty("EnableWSS11PolicySender"));
boolean sendEKSHA1 = wss11Receiver && wss11Sender && (getReceivedSecret(context) != null);
boolean wss10 = !wss11Sender;
if (!context.makeDynamicPolicyCallback()) {
WSSPolicy keyBinding = (WSSPolicy) policy.getKeyBinding();
String dataEncAlgo = MessageConstants.TRIPLE_DES_BLOCK_ENCRYPTION;
EncryptionPolicy.FeatureBinding featureBinding =
(EncryptionPolicy.FeatureBinding) policy.getFeatureBinding();
String tmp = featureBinding.getDataEncryptionAlgorithm();
if (tmp == null || "".equals(tmp)) {
if (context.getAlgorithmSuite() != null) {
tmp = context.getAlgorithmSuite().getEncryptionAlgorithm();
} else {
// warn that no dataEncAlgo was set
}
}
if(tmp != null && !"".equals(tmp)){
dataEncAlgo = tmp;
}
// derivedTokenKeyBinding with x509 as originalkeyBinding is to be treated same as
// DerivedKey with Symmetric binding and X509 as key binding of Symmetric binding
if(PolicyTypeUtil.derivedTokenKeyBinding(keyBinding)){
DerivedTokenKeyBinding dtk = (DerivedTokenKeyBinding)keyBinding.clone();
WSSPolicy originalKeyBinding = dtk.getOriginalKeyBinding();
if (PolicyTypeUtil.x509CertificateBinding(originalKeyBinding)){
AuthenticationTokenPolicy.X509CertificateBinding ckBindingClone =
(AuthenticationTokenPolicy.X509CertificateBinding)originalKeyBinding.clone();
//create a symmetric key binding and set it as original key binding of dkt
SymmetricKeyBinding skb = new SymmetricKeyBinding();
skb.setKeyBinding(ckBindingClone);
// set the x509 binding as key binding of symmetric binding
dtk.setOriginalKeyBinding(skb);
keyBinding = dtk;
}else if(PolicyTypeUtil.usernameTokenBinding(originalKeyBinding)){
AuthenticationTokenPolicy.UsernameTokenBinding ckBindingClone =
(AuthenticationTokenPolicy.UsernameTokenBinding)originalKeyBinding.clone();
SymmetricKeyBinding skb = new SymmetricKeyBinding();
skb.setKeyBinding(ckBindingClone);
dtk.setOriginalKeyBinding(skb);
keyBinding = dtk;
}
}
if(PolicyTypeUtil.usernameTokenBinding(keyBinding)){
UsernameTokenBinding binding = createUntBinding(context,(UsernameTokenBinding)keyBinding);
context.setUsernameTokenBinding(binding);
}else if (PolicyTypeUtil.x509CertificateBinding(keyBinding)) {
try {
AuthenticationTokenPolicy.X509CertificateBinding binding =
(AuthenticationTokenPolicy.X509CertificateBinding)keyBinding.clone();
String certIdentifier = binding.getCertificateIdentifier();
X509Certificate cert = context.getSecurityEnvironment().
getCertificate(context.getExtraneousProperties(), certIdentifier, false);
binding.setX509Certificate(cert);
context.setX509CertificateBinding(binding);
} catch (Exception e) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1413_ERROR_EXTRACTING_CERTIFICATE(), e);
throw new XWSSecurityException(e);
}
} else if(PolicyTypeUtil.kerberosTokenBinding(keyBinding)) {
AuthenticationTokenPolicy.KerberosTokenBinding binding = (AuthenticationTokenPolicy.KerberosTokenBinding)keyBinding.clone();
//String ktPolicyId = binding.getUUID();
String encodedRef = (String)context.getExtraneousProperty(MessageConstants.KERBEROS_SHA1_VALUE);
KerberosContext krbContext = null;
if(encodedRef != null){
krbContext = context.getKerberosContext();
}
if(krbContext != null){
byte[] kerberosToken = krbContext.getKerberosToken();
binding.setTokenValue(kerberosToken);
SecretKey sKey = krbContext.getSecretKey(SecurityUtil.getSecretKeyAlgorithm(dataEncAlgo));
binding.setSecretKey(sKey);
}else{
log.log(Level.SEVERE, LogStringsMessages.WSS_1423_KERBEROS_CONTEXT_NOTSET());
throw new XWSSecurityException("WSS1423.kerberos.context.notset");
}
context.setKerberosTokenBinding(binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(keyBinding)) {
try {
SymmetricKeyBinding binding = (SymmetricKeyBinding)keyBinding.clone();
String keyIdentifier = binding.getKeyIdentifier();
SecretKey sKey = null;
WSSPolicy ckBinding = (WSSPolicy) binding.getKeyBinding();
if(PolicyTypeUtil.usernameTokenBinding(ckBinding)){
if (!sendEKSHA1) {
AuthenticationTokenPolicy.UsernameTokenBinding untbinding = createUntBinding(context,(UsernameTokenBinding)ckBinding);
context.setUsernameTokenBinding(untbinding);
}
}else if (PolicyTypeUtil.x509CertificateBinding(ckBinding)) {
try {
if (!sendEKSHA1) {
AuthenticationTokenPolicy.X509CertificateBinding ckBindingClone =
(AuthenticationTokenPolicy.X509CertificateBinding)ckBinding.clone();
String certIdentifier = ckBindingClone.getCertificateIdentifier();
X509Certificate cert = context.getSecurityEnvironment().
getCertificate(context.getExtraneousProperties(), certIdentifier, false);
ckBindingClone.setX509Certificate(cert);
context.setX509CertificateBinding(ckBindingClone);
}
} catch (Exception e) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1413_ERROR_EXTRACTING_CERTIFICATE(), e);
throw new XWSSecurityException(e);
}
} else if(PolicyTypeUtil.kerberosTokenBinding(ckBinding)){
AuthenticationTokenPolicy.KerberosTokenBinding ckBindingClone =
(AuthenticationTokenPolicy.KerberosTokenBinding)ckBinding;
//String ktPolicyId = ckBindingClone.getUUID();
String encodedRef = (String)context.getExtraneousProperty(MessageConstants.KERBEROS_SHA1_VALUE);
KerberosContext krbContext = null;
if(encodedRef != null){
krbContext = context.getKerberosContext();
}
if(krbContext != null){
byte[] kerberosToken = krbContext.getKerberosToken();
ckBindingClone.setTokenValue(kerberosToken);
sKey = krbContext.getSecretKey(SecurityUtil.getSecretKeyAlgorithm(dataEncAlgo));
ckBindingClone.setSecretKey(sKey);
} else{
log.log(Level.SEVERE, LogStringsMessages.WSS_1423_KERBEROS_CONTEXT_NOTSET());
throw new XWSSecurityException("WSS1423.kerberos.context.notset");
}
context.setKerberosTokenBinding(ckBindingClone);
}
if(!PolicyTypeUtil.kerberosTokenBinding(ckBinding)){
if(!keyIdentifier.equals(MessageConstants._EMPTY)){
sKey = context.getSecurityEnvironment().getSecretKey(
context.getExtraneousProperties(),
keyIdentifier, true);
} else if(sendEKSHA1){
sKey = getReceivedSecret(context);
}else if(wss11Sender || wss10){
sKey = SecurityUtil.generateSymmetricKey(dataEncAlgo);
}
}
binding.setSecretKey(sKey);
context.setSymmetricKeyBinding(binding);
} catch (Exception e) {
//TODO: this error message should come only in Symm Keystore case
log.log(Level.SEVERE, LogStringsMessages.WSS_1414_ERROR_EXTRACTING_SYMMETRICKEY(new Object[] { e.getMessage()}));
throw new XWSSecurityException(e);
}
} else if (PolicyTypeUtil.samlTokenPolicy(keyBinding)) {
//resolvedPolicy = (EncryptionPolicy)policy.clone();
keyBinding =(WSSPolicy) ((EncryptionPolicy) policy).getKeyBinding();
DynamicApplicationContext dynamicContext =
new DynamicApplicationContext(context.getPolicyContext());
dynamicContext.setMessageIdentifier(context.getMessageIdentifier());
dynamicContext.inBoundMessage(false);
AuthenticationTokenPolicy.SAMLAssertionBinding binding =
(AuthenticationTokenPolicy.SAMLAssertionBinding)keyBinding;
binding.isReadOnly(true);
AuthenticationTokenPolicy.SAMLAssertionBinding samlBinding =
new AuthenticationTokenPolicy.SAMLAssertionBinding();
if (context.getExtraneousProperty(MessageConstants.INCOMING_SAML_ASSERTION) == null) {
AuthenticationTokenPolicy.SAMLAssertionBinding resolvedSAMLBinding =
(AuthenticationTokenPolicy.SAMLAssertionBinding)
context.getExtraneousProperties().get(MessageConstants.SAML_ASSERTION_CLIENT_CACHE);
if (resolvedSAMLBinding == null) {
//try to obtain the HOK assertion
resolvedSAMLBinding =
context.getSecurityEnvironment().populateSAMLPolicy(context.getExtraneousProperties(), binding, dynamicContext);
context.getExtraneousProperties().put(MessageConstants.SAML_ASSERTION_CLIENT_CACHE, resolvedSAMLBinding);
samlBinding = resolvedSAMLBinding;
}
}else{
Object assertion = context.getExtraneousProperty(MessageConstants.INCOMING_SAML_ASSERTION);
if(assertion instanceof Element){
samlBinding.setAssertion((Element)assertion);
}
}
policy.setKeyBinding(samlBinding);
resolvedPolicy = (EncryptionPolicy)policy;
} else if (PolicyTypeUtil.secureConversationTokenKeyBinding(keyBinding)) {
// resolve the ProofKey here and set it into ProcessingContext
SecureConversationTokenKeyBinding sctBinding = (SecureConversationTokenKeyBinding)keyBinding;
SecurityUtil.resolveSCT(context, sctBinding);
} else if (PolicyTypeUtil.issuedTokenKeyBinding(keyBinding)) {
IssuedTokenKeyBinding itkb = (IssuedTokenKeyBinding)keyBinding;
SecurityUtil.resolveIssuedToken(context, itkb);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(keyBinding)) {
DerivedTokenKeyBinding dtk = (DerivedTokenKeyBinding)keyBinding.clone();
WSSPolicy originalKeyBinding = dtk.getOriginalKeyBinding();
if ( PolicyTypeUtil.symmetricKeyBinding(originalKeyBinding)) {
SymmetricKeyBinding symmBinding = (SymmetricKeyBinding)originalKeyBinding.clone();
SecretKey sKey = null;
WSSPolicy ckBinding = (WSSPolicy) originalKeyBinding.getKeyBinding();
if(PolicyTypeUtil.usernameTokenBinding(ckBinding)){
try {
if (!sendEKSHA1) {
AuthenticationTokenPolicy.UsernameTokenBinding untbinding = createUntBinding(context, (UsernameTokenBinding) ckBinding);
context.setUsernameTokenBinding(untbinding);
}
} catch (Exception e) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1433_ERROR_EXTRACTING_USERNAMETOKEN(), e);
throw new XWSSecurityException(e);
}
}
if (PolicyTypeUtil.x509CertificateBinding(ckBinding)) {
try {
if (!sendEKSHA1) {
AuthenticationTokenPolicy.X509CertificateBinding ckBindingClone =
(AuthenticationTokenPolicy.X509CertificateBinding)ckBinding.clone();
String certIdentifier = ckBindingClone.getCertificateIdentifier();
X509Certificate cert = context.getSecurityEnvironment().
getCertificate(context.getExtraneousProperties(), certIdentifier, false);
ckBindingClone.setX509Certificate(cert);
context.setX509CertificateBinding(ckBindingClone);
}
} catch (Exception e) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1413_ERROR_EXTRACTING_CERTIFICATE(), e);
throw new XWSSecurityException(e);
}
} else if(PolicyTypeUtil.kerberosTokenBinding(ckBinding)){
AuthenticationTokenPolicy.KerberosTokenBinding ckBindingClone =
(AuthenticationTokenPolicy.KerberosTokenBinding)ckBinding;
String encodedRef = (String)context.getExtraneousProperty(MessageConstants.KERBEROS_SHA1_VALUE);
KerberosContext krbContext = null;
if(encodedRef != null){
krbContext = context.getKerberosContext();
}
if(krbContext != null){
byte[] kerberosToken = krbContext.getKerberosToken();
ckBindingClone.setTokenValue(kerberosToken);
sKey = krbContext.getSecretKey(SecurityUtil.getSecretKeyAlgorithm(dataEncAlgo));
ckBindingClone.setSecretKey(sKey);
} else{
log.log(Level.SEVERE, LogStringsMessages.WSS_1423_KERBEROS_CONTEXT_NOTSET());
throw new XWSSecurityException("WSS1423.kerberos.context.notset");
}
context.setKerberosTokenBinding(ckBindingClone);
}
if(!PolicyTypeUtil.kerberosTokenBinding(ckBinding)){
if(sendEKSHA1){
sKey = getReceivedSecret(context);
}else if(wss11Sender || wss10){
sKey = SecurityUtil.generateSymmetricKey(dataEncAlgo);
}
}
symmBinding.setSecretKey(sKey);
context.setSymmetricKeyBinding(symmBinding);
} else if ( PolicyTypeUtil.secureConversationTokenKeyBinding(originalKeyBinding)) {
// resolve the ProofKey here and set it into ProcessingContext
SecureConversationTokenKeyBinding sctBinding = (SecureConversationTokenKeyBinding)originalKeyBinding;
SecurityUtil.resolveSCT(context, sctBinding);
} else if ( PolicyTypeUtil.issuedTokenKeyBinding(originalKeyBinding)) {
IssuedTokenKeyBinding itkb = (IssuedTokenKeyBinding)originalKeyBinding;
SecurityUtil.resolveIssuedToken(context, itkb);
}
} else {
log.log(Level.SEVERE, LogStringsMessages.WSS_1422_UNSUPPORTED_KEYBINDING_ENCRYPTION_POLICY());
throw new XWSSecurityException("Unsupported KeyBinding for EncryptionPolicy");
}
} else {
try {
//resolvedPolicy = (EncryptionPolicy)policy.clone();
((EncryptionPolicy)policy).isReadOnly(true);
DynamicApplicationContext dynamicContext =
new DynamicApplicationContext(context.getPolicyContext());
dynamicContext.setMessageIdentifier(context.getMessageIdentifier());
dynamicContext.inBoundMessage(false);
// TODO: copy runtime context for making dynamic callback
DynamicPolicyCallback dynamicCallback = new DynamicPolicyCallback(
policy, dynamicContext);
ProcessingContext.copy(dynamicContext.getRuntimeProperties(), context.getExtraneousProperties());
HarnessUtil.makeDynamicPolicyCallback(dynamicCallback,
context.getSecurityEnvironment().getCallbackHandler());
resolvedPolicy = (EncryptionPolicy)dynamicCallback.getSecurityPolicy();
} catch (Exception e) {
log.log(Level.SEVERE, LogStringsMessages.WSS_1412_ERROR_PROCESSING_DYNAMICPOLICY(new Object[] { e.getMessage()}));
throw new XWSSecurityException(e);
}
}
context.setSecurityPolicy(resolvedPolicy);
encrypt(context);
} else {
if ( context.makeDynamicPolicyCallback()) {
WSSPolicy policy =(WSSPolicy) context.getSecurityPolicy();
EncryptionPolicy resolvedPolicy = null;
try {
((EncryptionPolicy)policy).isReadOnly(true);
DynamicApplicationContext dynamicContext =