* Licensed to the Apache Software Foundation (ASF) under one

* or more contributor license agreements. See the NOTICE file

* distributed with this work for additional information

* regarding copyright ownership. The ASF licenses this file

* to you under the Apache License, Version 2.0 (the

* "License"); you may not use this file except in compliance

* with the License. You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing,

* software distributed under the License is distributed on an

* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

* KIND, either express or implied. See the License for the

* specific language governing permissions and limitations

* under the License.

*/

* An abstract class with some functionality to invoke on a SecurityTokenService (STS) via the

* WS-Trust protocol.

*/

    private static final Logger LOG = LogUtils.getL7dLogger(AbstractSTSClient.class);

   

    protected Bus bus;

    protected String name = "default.sts-client";

    protected Client client;

    protected String location;

    protected String wsdlLocation;

    protected QName serviceName;

    protected QName endpointName;

    protected Policy policy;

    protected String soapVersion = SoapBindingConstants.SOAP11_BINDING_ID;

    protected int keySize = 256;

    protected boolean requiresEntropy = true;

    protected Element template;

    protected Element claims;

    protected CallbackHandler claimsCallbackHandler;

    protected AlgorithmSuite algorithmSuite;

    protected String namespace = STSUtils.WST_NS_05_12;

    protected String addressingNamespace = "http://www.w3.org/2005/08/addressing";

    protected String wspNamespace = "http://www.w3.org/ns/ws-policy";

    protected Object onBehalfOf;

    protected boolean enableAppliesTo = true;

    protected boolean useCertificateForConfirmationKeyInfo;

    protected boolean isSecureConv;

    protected boolean isSpnego;

    protected boolean enableLifetime;

    protected int ttl = 300;

    protected boolean sendRenewing = true;

    protected boolean allowRenewing = true;

    protected boolean allowRenewingAfterExpiry;

   

    protected Object actAs;

    protected String tokenType;

    protected String keyType;

    protected boolean sendKeyType = true;

    protected Message message;

    protected String context;

    protected X509Certificate useKeyCertificate;

    protected Map<String, Object> ctx = new HashMap<String, Object>();

   

    protected List<Interceptor<? extends Message>> in

        = new ModCountCopyOnWriteArrayList<Interceptor<? extends Message>>();

    protected List<Interceptor<? extends Message>> out

        = new ModCountCopyOnWriteArrayList<Interceptor<? extends Message>>();

    protected List<Interceptor<? extends Message>> outFault 

        = new ModCountCopyOnWriteArrayList<Interceptor<? extends Message>>();

    protected List<Interceptor<? extends Message>> inFault

        = new ModCountCopyOnWriteArrayList<Interceptor<? extends Message>>();

    protected List<Feature> features;

    public AbstractSTSClient(Bus b) {

        bus = b;

    }

    public String getBeanName() {

        return name;

    }

    public void setBeanName(String s) {

        name = s;

    }

   

    public String getLocation() {

        return location;

    }

    public void setLocation(String location) {

        this.location = location;

    }

   

    public void setMessage(Message message) {

        this.message = message;

    }

    public void setTtl(int ttl) {

        this.ttl = ttl;

    }

   

    public void setEnableLifetime(boolean enableLifetime) {

        this.enableLifetime = enableLifetime;

    }

   

    public void setSendRenewing(boolean sendRenewing) {

        this.sendRenewing = sendRenewing;

    }

   

    /**

     * Sets the WS-P policy that is applied to communications between this client and the remote server

     * if no value is supplied for {@link #setWsdlLocation(String)}.

     * <p/>

     * Accepts {@link Policy} or {@link Element} as input.

     *

     * @param newPolicy the policy object

     *

     * @throws IllegalArgumentException if {@code newPolicy} is not one of the supported types.

     */

    public void setPolicy(Object newPolicy) {

        if (newPolicy instanceof Policy) {

            this.setPolicyInternal((Policy) newPolicy);

        } else if (newPolicy instanceof Element) {

            this.setPolicyInternal((Element) newPolicy);   

        } else if (newPolicy instanceof String) {

            this.setPolicyInternal((String) newPolicy);   

        } else {

            throw new IllegalArgumentException("Unsupported policy object.  Type must be "

                       + "org.apache.neethi.Policy or org.w3c.dom.Element.");

        }

    }

    public void setSoap12() {

        soapVersion = SoapBindingConstants.SOAP12_BINDING_ID;

    }

    public void setSoap11() {

        soapVersion = SoapBindingConstants.SOAP11_BINDING_ID;

    }

    public void setSoap11(boolean b) {

        if (b) {

            setSoap11();

        } else {

            setSoap12();

        }

    }

    public void setAddressingNamespace(String ad) {

        addressingNamespace = ad;

    }

    public void setTrust(Trust10 trust) {

        if (trust != null) {

            namespace = STSUtils.WST_NS_05_02;

            requiresEntropy = trust.isRequireClientEntropy();

        }

    }

    public void setTrust(Trust13 trust) {

        if (trust != null) {

            namespace = STSUtils.WST_NS_05_12;

            requiresEntropy = trust.isRequireClientEntropy();

        }

    }

    public boolean isRequiresEntropy() {

        return requiresEntropy;

    }

    public void setRequiresEntropy(boolean requiresEntropy) {

        this.requiresEntropy = requiresEntropy;

    }

    public boolean isSecureConv() {

        return isSecureConv;

    }

    public void setSecureConv(boolean secureConv) {

        this.isSecureConv = secureConv;

    }

   

    public boolean isSpnego() {

        return isSpnego;

    }

    public void setSpnego(boolean spnego) {

        this.isSpnego = spnego;

    }

   

    public boolean isAllowRenewing() {

        return allowRenewing;

    }

    public void setAllowRenewing(boolean allowRenewing) {

        this.allowRenewing = allowRenewing;

    }

    public boolean isAllowRenewingAfterExpiry() {

        return allowRenewingAfterExpiry;

    }

    public void setAllowRenewingAfterExpiry(boolean allowRenewingAfterExpiry) {

        this.allowRenewingAfterExpiry = allowRenewingAfterExpiry;

    }

   

    public boolean isEnableAppliesTo() {

        return enableAppliesTo;

    }

   

    public void setEnableAppliesTo(boolean enableAppliesTo) {

        this.enableAppliesTo = enableAppliesTo;

    }

   

    public String getContext() {

        return context;

    }

   

    public void setContext(String context) {

        this.context = context;

    }

    public void setAlgorithmSuite(AlgorithmSuite ag) {

        algorithmSuite = ag;

    }

    public Map<String, Object> getRequestContext() {

        return ctx;

    }

    public void setProperties(Map<String, Object> p) {

        ctx.putAll(p);

    }

    public Map<String, Object> getProperties() {

        return ctx;

    }

    public void setWsdlLocation(String wsdl) {

        wsdlLocation = wsdl;

    }

    public String getWsdlLocation() {

        return wsdlLocation;

    }

    public void setServiceName(String qn) {

        serviceName = QName.valueOf(qn);

    }

    public void setEndpointName(String qn) {

        endpointName = QName.valueOf(qn);

    }

   

    public void setServiceQName(QName qn) {

        serviceName = qn;

    }

    public QName getServiceQName() {

        return serviceName;

    }

    public void setEndpointQName(QName qn) {

        endpointName = qn;

    }

    public QName getEndpointQName() {

        return endpointName;

    }

   

    public void setActAs(Object actAs) {

        this.actAs = actAs;

    }

   

    public void setKeySize(int i) {

        keySize = i;

    }

   

    public int getKeySize() {

        return keySize;

    }

    public void setTokenType(String tokenType) {

        this.tokenType = tokenType;

    }

   

    public String getTokenType() {

        return tokenType;

    }

   

    public void setSendKeyType(boolean sendKeyType) {

        this.sendKeyType = sendKeyType;

    }

   

    public void setKeyType(String keyType) {

        this.keyType = keyType;

    }

   

    @Deprecated

    public void setOnBehalfOfElement(Element onBehalfOfElement) {

        this.onBehalfOf = onBehalfOfElement;

    }

    public void setOnBehalfOf(Object onBehalfOf) {

        this.onBehalfOf = onBehalfOf;

    }

   

    /**

     * Indicate whether to use the signer's public X509 certificate for the subject confirmation key info

     * when creating a RequestsSecurityToken message. If the property is set to 'false', only the public key

     * value will be provided in the request. If the property is set to 'true' the complete certificate will

     * be sent in the request.

     *

     * Note: this setting is only applicable for assertions that use an asymmetric proof key

     */

    public void setUseCertificateForConfirmationKeyInfo(boolean useCertificate) {

        this.useCertificateForConfirmationKeyInfo = useCertificate;

    }

   

    public boolean isUseCertificateForConfirmationKeyInfo() {

        return useCertificateForConfirmationKeyInfo;

    }

   

    protected void setPolicyInternal(Policy newPolicy) {

        this.policy = newPolicy;

        if (algorithmSuite == null) {

            Iterator<?> i = policy.getAlternatives();

            while (i.hasNext() && algorithmSuite == null) {

                List<PolicyComponent> p = CastUtils.cast((List<?>)i.next());

                for (PolicyComponent p2 : p) {

                    if (p2 instanceof AbstractBinding) {

                        algorithmSuite = ((AbstractBinding)p2).getAlgorithmSuite();

                    }

                }

            }

        }

    }

   

    protected void setPolicyInternal(Element newPolicy) {

        this.setPolicyInternal(bus.getExtension(PolicyBuilder.class).getPolicy(newPolicy));

    }

   

    protected void setPolicyInternal(String policyReference) {

        PolicyBuilder builder = bus.getExtension(PolicyBuilder.class);

        ReferenceResolver resolver = new RemoteReferenceResolver(null, builder);

        PolicyRegistry registry = bus.getExtension(PolicyEngine.class).getRegistry();

        Policy resolved = registry.lookup(policyReference);

        if (null != resolved) {

            this.setPolicyInternal(resolved);

        } else {

            this.setPolicyInternal(resolver.resolveReference(policyReference));

        }

    }

    public Client getClient()  throws BusException, EndpointException {

        if (client == null) {

            createClient();

        }

        return client;

    }

   

    public void configureViaEPR(EndpointReferenceType ref, boolean useEPRWSAAddrAsMEXLocation) {

        if (client != null) {

            return;

        }

        location = EndpointReferenceUtils.getAddress(ref);

        if (location != null) {

            location = location.trim();

        }

        final QName sName = EndpointReferenceUtils.getServiceName(ref, bus);

        if (sName != null) {

            serviceName = sName;

            final QName epName = EndpointReferenceUtils.getPortQName(ref, bus);

            if (epName != null) {

                endpointName = epName;

            }

        }

        final String wsdlLoc = EndpointReferenceUtils.getWSDLLocation(ref);

        if (wsdlLoc != null) {

            wsdlLocation = wsdlLoc;

        }

        String mexLoc = findMEXLocation(ref, useEPRWSAAddrAsMEXLocation);

        if (mexLoc != null) {

            try {

                JaxWsProxyFactoryBean proxyFac = new JaxWsProxyFactoryBean();

                proxyFac.setBindingId(soapVersion);

                proxyFac.setAddress(mexLoc);

                MetadataExchange exc = proxyFac.create(MetadataExchange.class);

                Metadata metadata = exc.get2004();

                for (MetadataSection s : metadata.getMetadataSection()) {

                    if ("http://schemas.xmlsoap.org/wsdl/".equals(s.getDialect())) {

                        //got the wsdl...

                        Definition definition = bus.getExtension(WSDLManager.class)

                            .getDefinition((Element)s.getAny());

                        WSDLServiceFactory factory = new WSDLServiceFactory(bus, definition);

                        SourceDataBinding dataBinding = new SourceDataBinding();

                        factory.setDataBinding(dataBinding);

                        Service service = factory.create();

                        service.setDataBinding(dataBinding);

                       

                       

                        for (ServiceInfo serv : service.getServiceInfos()) {

                            for (EndpointInfo ei : serv.getEndpoints()) {

                                if (ei.getAddress().equals(location)) {

                                    endpointName = ei.getName();

                                    serviceName = serv.getName();

                                }

                            }

                        }

                        EndpointInfo ei = service.getEndpointInfo(endpointName);

                        Endpoint endpoint = new EndpointImpl(bus, service, ei);

                        client = new ClientImpl(bus, endpoint);

                    }

                }

            } catch (Exception ex) {

                //TODO

                ex.printStackTrace();

            }

        }

    }

    protected String findMEXLocation(EndpointReferenceType ref, boolean useEPRWSAAddrAsMEXLocation) {

        if (ref.getMetadata() != null && ref.getMetadata().getAny() != null) {

            for (Object any : ref.getMetadata().getAny()) {

                if (any instanceof Element) {

                    String addr = findMEXLocation((Element)any);

                    if (addr != null) {

                        return addr;

                    }

                }

            }

        }

        return useEPRWSAAddrAsMEXLocation ? EndpointReferenceUtils.getAddress(ref) : null;

    }

   

    protected String findMEXLocation(Element ref) {

        Element el = DOMUtils.getFirstElement(ref);

        while (el != null) {

            if (el.getLocalName().equals("Address")

                && VersionTransformer.isSupported(el.getNamespaceURI())

                && "MetadataReference".equals(ref.getLocalName())) {

                return DOMUtils.getContent(el);

            } else {

                String ad = findMEXLocation(el);

                if (ad != null) {

                    return ad;

                }

            }

            el = DOMUtils.getNextElement(el);

        }

        return null;

    }

   

    protected void createClient() throws BusException, EndpointException {

        if (client != null) {

            return;

        }

        bus.getExtension(Configurer.class).configureBean(name, this);

        if (wsdlLocation != null) {

            WSDLServiceFactory factory = new WSDLServiceFactory(bus, wsdlLocation, serviceName);

            SourceDataBinding dataBinding = new SourceDataBinding();

            factory.setDataBinding(dataBinding);

            Service service = factory.create();

            service.setDataBinding(dataBinding);

            EndpointInfo ei = service.getEndpointInfo(endpointName);

            Endpoint endpoint = new EndpointImpl(bus, service, ei);

            client = new ClientImpl(bus, endpoint);

        } else {

            Endpoint endpoint = STSUtils.createSTSEndpoint(bus, namespace, null, location, soapVersion,

                                                           policy, endpointName);

            client = new ClientImpl(bus, endpoint);

        }

       

        client.getInFaultInterceptors().addAll(inFault);

        client.getInInterceptors().addAll(in);

        client.getOutInterceptors().addAll(out);

        client.getOutFaultInterceptors().addAll(outFault);

        in = null;

        out = null;

        inFault = null;

        outFault = null;

        if (features != null) {

            for (Feature f : features) {

                f.initialize(client, bus);

            }

        }

    }

    protected BindingOperationInfo findOperation(String suffix) {

        BindingInfo bi = client.getEndpoint().getBinding().getBindingInfo();

        for (BindingOperationInfo boi : bi.getOperations()) {

            SoapOperationInfo soi = boi.getExtensor(SoapOperationInfo.class);

            String soapAction = soi != null ? soi.getAction() : null;

            Object o  = boi.getOperationInfo().getInput()

                    .getExtensionAttribute(new QName("http://www.w3.org/2007/05/addressing/metadata",

                                                     "Action"));

            if (o instanceof QName) {

                o = ((QName)o).getLocalPart();

            }

            String wsamAction = o == null ? null : o.toString();

           

            if ((soapAction != null && soapAction.endsWith(suffix))

                || (wsamAction != null && wsamAction.endsWith(suffix))) {

                PolicyEngine pe = bus.getExtension(PolicyEngine.class);

                Conduit conduit = client.getConduit();

                EffectivePolicy effectivePolicy

                    = pe.getEffectiveClientRequestPolicy(client.getEndpoint().getEndpointInfo(),

                                                         boi, conduit,

                                                         PhaseInterceptorChain.getCurrentMessage());

                setPolicyInternal(effectivePolicy.getPolicy());

                return boi;

            }

        }

        //operation is not correct as the Action is not set correctly.   Let's see if

        //we can at least find it by name and then set the action and such manually later.

        for (BindingOperationInfo boi : bi.getOperations()) {

            if (suffix.endsWith(boi.getName().getLocalPart())) {

                return boi;

            }

        }       

        //Still didn't find anything useful

        for (BindingOperationInfo boi : bi.getOperations()) {

            if (boi.getInput().getMessageInfo().getMessageParts().size() > 0) {

                MessagePartInfo mpi = boi.getInput().getMessageInfo().getMessagePart(0);

                if ("RequestSecurityToken".equals(mpi.getConcreteName().getLocalPart())) {

                    return boi;

                }

            }

        }

        return null;

    }

    /**

     * Make an "Issue" invocation and return the response as a STSResponse Object

     */

    protected STSResponse issue(

        String appliesTo, String action, String requestType, String binaryExchange

    ) throws Exception {

        createClient();

        BindingOperationInfo boi = findOperation("/RST/Issue");

        client.getRequestContext().putAll(ctx);

        if (action != null) {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION, action);

        } else if (isSecureConv) {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION,

                                           namespace + "/RST/SCT");

        } else {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION,

                                           namespace + "/RST/Issue");

        }

        W3CDOMStreamWriter writer = new W3CDOMStreamWriter();

        writer.writeStartElement("wst", "RequestSecurityToken", namespace);

        writer.writeNamespace("wst", namespace);

        if (context != null) {

            writer.writeAttribute(null, "Context", context);

        }

       

        boolean wroteKeySize = false;

        String keyTypeTemplate = null;

        String sptt = null;

       

        if (template != null && DOMUtils.getFirstElement(template) != null) {

            if (this.useSecondaryParameters()) {

                writer.writeStartElement("wst", "SecondaryParameters", namespace);

            }

           

            Element tl = DOMUtils.getFirstElement(template);

            while (tl != null) {

                StaxUtils.copy(tl, writer);

                if ("KeyType".equals(tl.getLocalName())) {

                    keyTypeTemplate = DOMUtils.getContent(tl);

                } else if ("KeySize".equals(tl.getLocalName())) {

                    wroteKeySize = true;

                    keySize = Integer.parseInt(DOMUtils.getContent(tl));

                } else if ("TokenType".equals(tl.getLocalName())) {

                    sptt = DOMUtils.getContent(tl);

                }

                tl = DOMUtils.getNextElement(tl);

            }

           

            if (this.useSecondaryParameters()) {

                writer.writeEndElement();

            }

        }

       

        if (isSpnego) {

            tokenType = STSUtils.getTokenTypeSCT(namespace);

            sendKeyType = false;

        }

        addRequestType(requestType, writer);

        if (enableAppliesTo) {

            addAppliesTo(writer, appliesTo);

        }

       

        addClaims(writer);

       

        Element onBehalfOfToken = getOnBehalfOfToken();

        if (onBehalfOfToken != null) {

            writer.writeStartElement("wst", "OnBehalfOf", namespace);

            StaxUtils.copy(onBehalfOfToken, writer);

            writer.writeEndElement();

        }

        if (sptt == null) {

            addTokenType(writer);

        }

        if (isSecureConv || enableLifetime) {

            addLifetime(writer);

        }

        if (keyTypeTemplate == null) {

            keyTypeTemplate = writeKeyType(writer, keyType);

        }

        byte[] requestorEntropy = null;

        X509Certificate cert = null;

        Crypto crypto = null;

        if (keySize <= 0) {

            keySize = 256;

        }

        if (keyTypeTemplate != null && keyTypeTemplate.endsWith("SymmetricKey")) {

            requestorEntropy = writeElementsForRSTSymmetricKey(writer, wroteKeySize);

        } else if (keyTypeTemplate != null && keyTypeTemplate.endsWith("PublicKey")) {

            // Use the given cert, or else get it from a Crypto instance

            if (useKeyCertificate != null) {

                cert = useKeyCertificate;

            } else {

                crypto = createCrypto(false);

                cert = getCert(crypto);

            }

            writeElementsForRSTPublicKey(writer, cert);

        } else if (isSpnego || isSecureConv) {

            addKeySize(keySize, writer);

        }

       

        if (binaryExchange != null) {

            addBinaryExchange(binaryExchange, writer);

        }

        Element actAsSecurityToken = getActAsToken();

        if (actAsSecurityToken != null) {

            writer.writeStartElement(STSUtils.WST_NS_08_02, "ActAs");

            StaxUtils.copy(actAsSecurityToken, writer);

            writer.writeEndElement();

        }

       

        // Write out renewal semantics

        if (sendRenewing) {

            writer.writeStartElement("wst", "Renewing", namespace);

            if (!allowRenewing) {

                writer.writeAttribute(null, "Allow", "false");

            }

            if (allowRenewing && allowRenewingAfterExpiry) {

                writer.writeAttribute(null, "OK", "true");

            }

            writer.writeEndElement();

        }

       

        writer.writeEndElement();

        Object obj[] = client.invoke(boi, new DOMSource(writer.getDocument().getDocumentElement()));

        return new STSResponse((DOMSource)obj[0], requestorEntropy, cert, crypto);

    }

   

    /**

     * Get the "OnBehalfOf" element to be sent to the STS.

     */

    public Element getOnBehalfOfToken() throws Exception {

        return getDelegationSecurityToken(this.onBehalfOf);

    }

   

    /**

     * Get the "ActAs" element to be sent to the STS.

     */

    public Element getActAsToken() throws Exception {

        return getDelegationSecurityToken(this.actAs);

    }

   

    protected Element getDelegationSecurityToken(Object delegationObject) throws Exception {

        if (delegationObject != null) {

            final boolean isString = delegationObject instanceof String;

            final boolean isElement = delegationObject instanceof Element;

            final boolean isCallbackHandler = delegationObject instanceof CallbackHandler;

            if (isString || isElement || isCallbackHandler) {

                if (isString) {

                    final Document doc =

                        StaxUtils.read(new StringReader((String) delegationObject));

                    return doc.getDocumentElement();

                } else if (isElement) {

                    return (Element) delegationObject;

                } else {

                    DelegationCallback callback = new DelegationCallback(message);

                    ((CallbackHandler)delegationObject).handle(new Callback[]{callback});

                    return callback.getToken();

                }

            }

        }

        return null;

    }

   

    protected byte[] writeElementsForRSTSymmetricKey(W3CDOMStreamWriter writer,

            boolean wroteKeySize) throws Exception {

        byte[] requestorEntropy = null;

        if (!wroteKeySize) {

            addKeySize(keySize, writer);

        }

        if (requiresEntropy) {

            writer.writeStartElement("wst", "Entropy", namespace);

            writer.writeStartElement("wst", "BinarySecret", namespace);

            writer.writeAttribute("Type", namespace + "/Nonce");

            if (algorithmSuite == null) {

                requestorEntropy = WSSecurityUtil.generateNonce(keySize / 8);

            } else {

                AlgorithmSuiteType algType = algorithmSuite.getAlgorithmSuiteType();

                requestorEntropy = WSSecurityUtil

                    .generateNonce(algType.getMaximumSymmetricKeyLength() / 8);

            }

            writer.writeCharacters(Base64.encode(requestorEntropy));

            writer.writeEndElement();

            writer.writeEndElement();

            writer.writeStartElement("wst", "ComputedKeyAlgorithm", namespace);

            writer.writeCharacters(namespace + "/CK/PSHA1");

            writer.writeEndElement();

        }

        return requestorEntropy;

    }

    protected void writeElementsForRSTPublicKey(W3CDOMStreamWriter writer,

            X509Certificate cert) throws Exception {

        writer.writeStartElement("wst", "UseKey", namespace);

        writer.writeStartElement("ds", "KeyInfo", "http://www.w3.org/2000/09/xmldsig#");

        writer.writeNamespace("ds", "http://www.w3.org/2000/09/xmldsig#");

        boolean useCert = useCertificateForConfirmationKeyInfo;

        String useCertStr = (String)getProperty(SecurityConstants.STS_TOKEN_USE_CERT_FOR_KEYINFO);

        if (useCertStr != null) {

            useCert = Boolean.parseBoolean(useCertStr);

        }

        if (useCert) {

            X509Data certElem = new X509Data(writer.getDocument());

            certElem.addCertificate(cert);

            writer.getCurrentNode().appendChild(certElem.getElement());

        } else {

            writer.writeStartElement("ds", "KeyValue", "http://www.w3.org/2000/09/xmldsig#");

            PublicKey key = cert.getPublicKey();

            String pubKeyAlgo = key.getAlgorithm();

            if ("DSA".equalsIgnoreCase(pubKeyAlgo)) {

                DSAKeyValue dsaKeyValue = new DSAKeyValue(writer.getDocument(), key);

                writer.getCurrentNode().appendChild(dsaKeyValue.getElement());

            } else if ("RSA".equalsIgnoreCase(pubKeyAlgo)) {

                RSAKeyValue rsaKeyValue = new RSAKeyValue(writer.getDocument(), key);

                writer.getCurrentNode().appendChild(rsaKeyValue.getElement());

            }

            writer.writeEndElement();

        }

        writer.writeEndElement();

        writer.writeEndElement();

    }

   

    protected void addBinaryExchange(

        String binaryExchange,

        W3CDOMStreamWriter writer

    ) throws XMLStreamException {

        writer.writeStartElement("wst", "BinaryExchange", namespace);

        writer.writeAttribute("EncodingType", BinarySecurity.BASE64_ENCODING);

        writer.writeAttribute("ValueType", namespace + "/spnego");

        writer.writeCharacters(binaryExchange);

        writer.writeEndElement();

    }

   

    protected void addKeySize(int keysize, W3CDOMStreamWriter writer) throws XMLStreamException {

        writer.writeStartElement("wst", "KeySize", namespace);

        writer.writeCharacters(Integer.toString(keysize));

        writer.writeEndElement();

    }

    protected void addRequestType(String requestType, W3CDOMStreamWriter writer) throws XMLStreamException {

        writer.writeStartElement("wst", "RequestType", namespace);

        writer.writeCharacters(namespace + requestType);

        writer.writeEndElement();

    }

   

    protected Element getDocumentElement(DOMSource ds) {

        Node nd = ds.getNode();

        if (nd instanceof Document) {

            nd = ((Document)nd).getDocumentElement();

        }

        return (Element)nd;

    }

    /**

     * Make an "Renew" invocation and return the response as a STSResponse Object

     */

    public STSResponse renew(SecurityToken tok) throws Exception {

        createClient();

        BindingOperationInfo boi = findOperation("/RST/Renew");

        client.getRequestContext().putAll(ctx);

        if (isSecureConv) {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION, namespace + "/RST/SCT/Renew");

        } else {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION, namespace + "/RST/Renew");

        }

        W3CDOMStreamWriter writer = new W3CDOMStreamWriter();

        writer.writeStartElement("wst", "RequestSecurityToken", namespace);

        writer.writeNamespace("wst", namespace);

        if (context != null) {

            writer.writeAttribute(null, "Context", context);

        }

       

        String sptt = null;

        if (template != null && DOMUtils.getFirstElement(template) != null) {

            if (this.useSecondaryParameters()) {

                writer.writeStartElement("wst", "SecondaryParameters", namespace);

            }

           

            Element tl = DOMUtils.getFirstElement(template);

            while (tl != null) {

                StaxUtils.copy(tl, writer);

                if ("TokenType".equals(tl.getLocalName())) {

                    sptt = DOMUtils.getContent(tl);

                }

                tl = DOMUtils.getNextElement(tl);

            }

           

            if (this.useSecondaryParameters()) {

                writer.writeEndElement();

            }

        }

       

        if (isSpnego) {

            tokenType = STSUtils.getTokenTypeSCT(namespace);

        }

        addRequestType("/Renew", writer);

        if (enableAppliesTo) {

            addAppliesTo(writer, tok.getIssuerAddress());

        }

       

        if (sptt == null) {

            addTokenType(writer);

        }

        if (isSecureConv || enableLifetime) {

            addLifetime(writer);

        }

        writer.writeStartElement("wst", "RenewTarget", namespace);

        client.getRequestContext().put(SecurityConstants.TOKEN, tok);

        StaxUtils.copy(tok.getToken(), writer);

        writer.writeEndElement();

       

        // Write out renewal semantics

        if (sendRenewing) {

            writer.writeStartElement("wst", "Renewing", namespace);

            if (!allowRenewing) {

                writer.writeAttribute(null, "Allow", "false");

            }

            if (allowRenewing && allowRenewingAfterExpiry) {

                writer.writeAttribute(null, "OK", "true");

            }

            writer.writeEndElement();

        }

       

        writer.writeEndElement();

        Object obj[] = client.invoke(boi, new DOMSource(writer.getDocument().getDocumentElement()));

        return new STSResponse((DOMSource)obj[0], null);

    }

    protected PrimitiveAssertion getAddressingAssertion() {

        String ns = "http://schemas.xmlsoap.org/ws/2004/08/addressing/policy";

        String local = "UsingAddressing";

        if ("http://www.w3.org/2005/08/addressing".equals(addressingNamespace)) {

            ns = "http://www.w3.org/2007/02/addressing/metadata";

            local = "Addressing";

        }

        return new PrimitiveAssertion(new QName(ns, local), true);

    }

   

    /**

     * Make an "Validate" invocation and return the response as a STSResponse Object

     */

    protected STSResponse validate(SecurityToken tok, String tokentype)

        throws Exception {

        createClient();

       

        if (tokentype == null) {

            tokentype = tokenType;

        }

        if (tokentype == null) {

            tokentype = namespace + "/RSTR/Status";

        }

        Policy validatePolicy = new Policy();

        ExactlyOne one = new ExactlyOne();

        validatePolicy.addPolicyComponent(one);

        All all = new All();

        one.addPolicyComponent(all);

        all.addAssertion(getAddressingAssertion());

        client.getRequestContext().clear();

        client.getRequestContext().putAll(ctx);

        client.getRequestContext().put(SecurityConstants.TOKEN, tok);

        BindingOperationInfo boi = findOperation("/RST/Validate");

        if (boi == null) {

            boi = findOperation("/RST/Issue");

            client.getRequestContext().put(PolicyConstants.POLICY_OVERRIDE, validatePolicy);

        }

       

        client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION,

                                       namespace + "/RST/Validate");

       

        W3CDOMStreamWriter writer = new W3CDOMStreamWriter();

        writer.writeStartElement("wst", "RequestSecurityToken", namespace);

        writer.writeNamespace("wst", namespace);

        writer.writeStartElement("wst", "RequestType", namespace);

        writer.writeCharacters(namespace + "/Validate");

        writer.writeEndElement();

        writer.writeStartElement("wst", "TokenType", namespace);

        writer.writeCharacters(tokentype);

        writer.writeEndElement();

       

        addClaims(writer);

        writer.writeStartElement("wst", "ValidateTarget", namespace);

        Element el = tok.getToken();

        StaxUtils.copy(el, writer);

        writer.writeEndElement();

        writer.writeEndElement();

        Object o[] = client.invoke(boi, new DOMSource(writer.getDocument().getDocumentElement()));

       

        return new STSResponse((DOMSource)o[0], null);

    }

    /**

     * Make an "Cancel" invocation and return the response as a STSResponse Object

     */

    protected STSResponse cancel(SecurityToken token) throws Exception {

        createClient();

        client.getRequestContext().clear();

        client.getRequestContext().putAll(ctx);

        client.getRequestContext().put(SecurityConstants.TOKEN, token);

       

        BindingOperationInfo boi = findOperation("/RST/Cancel");

        boolean attachTokenDirectly = true;

        if (boi == null) {

            attachTokenDirectly = false;

            boi = findOperation("/RST/Issue");

           

            Policy cancelPolicy = new Policy();

            ExactlyOne one = new ExactlyOne();

            cancelPolicy.addPolicyComponent(one);

            All all = new All();

            one.addPolicyComponent(all);

            all.addAssertion(getAddressingAssertion());

            final SecureConversationToken secureConversationToken =

                new SecureConversationToken(

                    SPConstants.SPVersion.SP12,

                    SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,

                    null,

                    null,

                    null,

                    null

                );

            secureConversationToken.setOptional(true);

           

            class InternalProtectionToken extends ProtectionToken {

                public InternalProtectionToken(SPVersion version, Policy nestedPolicy) {

                    super(version, nestedPolicy);

                    super.setToken(secureConversationToken);

                }

            }

           

            DefaultSymmetricBinding binding =

                new DefaultSymmetricBinding(SPConstants.SPVersion.SP12, new Policy());

            all.addAssertion(binding);

            all.addAssertion(getAddressingAssertion());

            binding.setProtectionToken(

                new InternalProtectionToken(SPConstants.SPVersion.SP12, new Policy())

            );

            binding.setIncludeTimestamp(true);

            binding.setOnlySignEntireHeadersAndBody(true);

            binding.setProtectTokens(false);

           

            String addrNamespace = addressingNamespace;

            if (addrNamespace == null) {

                addrNamespace = "http://www.w3.org/2005/08/addressing";

            }

           

            List<Header> headers = new ArrayList<Header>();

            headers.add(new Header("To", addrNamespace));

            headers.add(new Header("From", addrNamespace));

            headers.add(new Header("FaultTo", addrNamespace));

            headers.add(new Header("ReplyTo", addrNamespace));

            headers.add(new Header("Action", addrNamespace));

            headers.add(new Header("MessageID", addrNamespace));

            headers.add(new Header("RelatesTo", addrNamespace));

           

            SignedParts parts = new SignedParts(SPConstants.SPVersion.SP12, true, null, headers, false);

            parts.setOptional(true);

            all.addPolicyComponent(parts);

           

            client.getRequestContext().put(PolicyConstants.POLICY_OVERRIDE, cancelPolicy);

        }

       

        if (isSecureConv) {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION,

                                           namespace + "/RST/SCT/Cancel");

        } else {

            client.getRequestContext().put(SoapBindingConstants.SOAP_ACTION,

                                           namespace + "/RST/Cancel");