* JBoss, Home of Professional Open Source. Copyright 2009, Red Hat Middleware LLC, and individual contributors as

* indicated by the @author tags. See the copyright.txt file in the distribution for a full listing of individual

* contributors.

*

* This is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public

* License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any

* later version.

*

* This software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more

* details.

*

* You should have received a copy of the GNU Lesser General Public License along with this software; if not, write to

* the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA, or see the FSF site:

* http://www.fsf.org.

*/

* <p>

* This {@code TestCase} tests the behavior of the {@code PicketLinkSTS} service.

* </p>

*

* @author <a href="mailto:sguilhen@redhat.com">Stefan Guilhen</a>

*/

    private TestSTS tokenService;

    /*

     * (non-Javadoc)

     *

     * @see junit.framework.TestCase#setUp()

     */

    @Before

    public void setUp() throws Exception {

        // for testing purposes we can instantiate the TestSTS as a regular POJO.

        this.tokenService = new TestSTS();

        TestContext context = new TestContext();

        context.setUserPrincipal(new TestPrincipal("jduke"));

        this.tokenService.setContext(context);

    }

    /**

     * <p>

     * This test verifies that the STS service can read and load all configuration parameters correctly. The configuration file

     * (picketlink-sts.xml) looks like the following:

     *

     * <pre>

     *    &lt;PicketLinkSTS xmlns=&quot;urn:picketlink:identity-federation:config:1.0&quot;

     *     STSName=&quot;Test STS&quot; TokenTimeout=&quot;7200&quot; EncryptToken=&quot;true&quot;&gt;

     *     &lt;KeyProvider ClassName=&quot;org.jboss.identity.federation.bindings.tomcat.KeyStoreKeyManager&quot;&gt;

     *         &lt;Auth Key=&quot;KeyStoreURL&quot; Value=&quot;keystore/sts_keystore.jks&quot;/&gt;

     *         &lt;Auth Key=&quot;KeyStorePass&quot; Value=&quot;testpass&quot;/&gt;

     *         &lt;Auth Key=&quot;SigningKeyAlias&quot; Value=&quot;sts&quot;/&gt;

     *         &lt;Auth Key=&quot;SigningKeyPass&quot; Value=&quot;keypass&quot;/&gt;

     *         &lt;ValidatingAlias Key=&quot;http://services.testcorp.org/provider1&quot; Value=&quot;service1&quot;/&gt;

     *         &lt;ValidatingAlias Key=&quot;http://services.testcorp.org/provider2&quot; Value=&quot;service2&quot;/&gt;

     *     &lt;/KeyProvider&gt;

     *     &lt;RequestHandler&gt;org.jboss.identity.federation.core.wstrust.StandardRequestHandler&lt;/RequestHandler&gt;

     *     &lt;TokenProviders&gt;

     *         &lt;TokenProvider ProviderClass=&quot;org.jboss.test.identity.federation.bindings.trust.SpecialTokenProvider&quot;

     *             TokenType=&quot;http://www.tokens.org/SpecialToken&quot;

     *             TokenElement=&quot;SpecialToken&quot;

     *             TokenElementNS=&quot;http://www.tokens.org&quot;&gt;

     *             &lt;Property Key=&quot;Property1&quot; Value=&quot;Value1&quot;/&gt;

     *             &lt;Property Key=&quot;Property2&quot; Value=&quot;Value2&quot;/&gt;

     *         &lt;/TokenProvider&gt;

     *         &lt;TokenProvider ProviderClass=&quot;org.jboss.identity.federation.core.wstrust.SAML11TokenProvider&quot;

     *             TokenType=&quot;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1&quot;

     *             TokenElement=&quot;Assertion&quot;

     *             TokenElementNS=&quot;urn:oasis:names:tc:SAML:1.0:assertion&quot;/&gt;

     *         &lt;TokenProvider ProviderClass=&quot;org.jboss.identity.federation.core.wstrust.SAML20TokenProvider&quot;

     *             TokenType=&quot;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0&quot;

     *             TokenElement=&quot;Assertion&quot;

     *             TokenElementNS=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;/&gt;/&gt;

     *     &lt;/TokenProviders&gt;

     *     &lt;ServiceProviders&gt;

     *         &lt;ServiceProvider Endpoint=&quot;http://services.testcorp.org/provider1&quot; TokenType=&quot;http://www.tokens.org/SpecialToken&quot;

     *             TruststoreAlias=&quot;service1&quot;/&gt;

     *         &lt;ServiceProvider Endpoint=&quot;http://services.testcorp.org/provider2&quot; TokenType=&quot;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0&quot;

     *             TruststoreAlias=&quot;service2&quot;/&gt;

     *     &lt;/ServiceProviders&gt;

     *    &lt;/PicketLinkSTS&gt;    *

     * </pre>

     *

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testSTSConfiguration() throws Exception {

        // make the STS read the configuration file.

        STSConfiguration config = this.tokenService.getConfiguration();

        // check the values that have been configured.

        assertEquals("Unexpected service name", "Test STS", config.getSTSName());

        assertEquals("Unexpected token timeout value", 7200 * 1000, config.getIssuedTokenTimeout());

        assertFalse("Encrypt token should be true", config.encryptIssuedToken());

        WSTrustRequestHandler handler = config.getRequestHandler();

        assertNotNull("Unexpected null request handler found", handler);

        assertTrue("Unexpected request handler type", handler instanceof StandardRequestHandler);

        // check the token type -> token provider mapping.

        SecurityTokenProvider provider = config.getProviderForTokenType("http://www.tokens.org/SpecialToken");

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SpecialTokenProvider);

        Map<String, String> properties = ((SpecialTokenProvider) provider).getProperties();

        assertNotNull("Unexpected null properties map", properties);

        assertEquals("Invalid property found", "Value1", properties.get("Property1"));

        assertEquals("Invalid property found", "Value2", properties.get("Property2"));

        provider = config.getProviderForTokenType(SAMLUtil.SAML2_TOKEN_TYPE);

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SAML20TokenProvider);

        provider = config.getProviderForTokenType(SAMLUtil.SAML11_TOKEN_TYPE);

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SAML11TokenProvider);

        assertNull(config.getProviderForTokenType("unexistentType"));

        // check the service provider -> token provider mapping.

        provider = config.getProviderForService("http://services.testcorp.org/provider1");

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SpecialTokenProvider);

        provider = config.getProviderForService("http://services.testcorp.org/provider2");

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SAML20TokenProvider);

        assertNull(config.getProviderForService("http://invalid.service/service"));

        String family = SecurityTokenProvider.FAMILY_TYPE.WS_TRUST.toString();

        // check the token element and namespace -> token provider mapping.

        provider = config.getProviderForTokenElementNS(family, new QName("http://www.tokens.org", "SpecialToken"));

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SpecialTokenProvider);

        provider = config.getProviderForTokenElementNS(family, new QName(JBossSAMLURIConstants.ASSERTION_NSURI.get(),

                JBossSAMLConstants.ASSERTION.get()));

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SAML20TokenProvider);

        provider = config.getProviderForTokenElementNS(family, new QName(SAML11Constants.ASSERTION_11_NSURI,

                JBossSAMLConstants.ASSERTION.get()));

        assertNotNull("Unexpected null token provider", provider);

        assertTrue("Unexpected token provider type", provider instanceof SAML11TokenProvider);

        assertNull(config.getProviderForTokenElementNS(family, new QName("InvalidNamespace", "SpecialToken")));

        // check the service provider -> token type mapping.

        assertEquals("Invalid token type for service provider 1", "http://www.tokens.org/SpecialToken",

                config.getTokenTypeForService("http://services.testcorp.org/provider1"));

        assertEquals("Invalid token type for service provider 2", SAMLUtil.SAML2_TOKEN_TYPE,

                config.getTokenTypeForService("http://services.testcorp.org/provider2"));

        assertNull(config.getTokenTypeForService("http://invalid.service/service"));

        // check the keystore configuration.

        assertNotNull("Invalid null STS key pair", config.getSTSKeyPair());

        assertNotNull("Invalid null STS public key", config.getSTSKeyPair().getPublic());

        assertNotNull("Invalid null STS private key", config.getSTSKeyPair().getPrivate());

        assertNotNull("Invalid null validating key for service provider 1",

                config.getServiceProviderPublicKey("http://services.testcorp.org/provider1"));

        assertNotNull("Invalid null validating key for service provider 2",

                config.getServiceProviderPublicKey("http://services.testcorp.org/provider2"));

    }

    /**

     * <p>

     * This tests sends a security token request to PicketLinkSTS custom {@code SpecialTokenProvider}. The returned response is

     * verified to make sure the expected tokens have been returned by the service. The token that is generated in this test

     * looks as follows:

     *

     * <pre>

     *    &lt;token:SpecialToken xmlns:token=&quot;http://www.tokens.org&quot; TokenType=&quot;http://www.tokens.org/SpecialToken&quot;&gt;

     *       Principal:sguilhen

     *    &lt;/token:SpecialToken&gt;

     * </pre>

     *

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeCustom() throws Exception {

        // create a simple token request, asking for a "special" test token.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                "http://www.tokens.org/SpecialToken", null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        this.validateCustomTokenResponse(baseResponse);

    }

    /**

     * <p>

     * This tests sends a SAMLV2.0 security token request to PicketLinkSTS. This request should be handled by the

     * {@code SAML11TokenProvider} and should result in a SAMLV1.1 assertion.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML11() throws Exception {

        // create a simple token request, asking for a SAMLv1.1 token.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML11_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        InputStream is = DocumentUtil.getSourceAsStream(responseMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser().parse(is);

        // validate the security token response.

        this.validateSAML11AssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML11_BEARER_URI);

    }

    /**

     * <p>

     * This tests sends a SAMLV2.0 security token request to PicketLinkSTS. This request should be handled by the standard

     * {@code SAML20TokenProvider} and should result in a SAMLV2.0 assertion that looks like the following:

     *

     * <pre>

     * &lt;saml2:Assertion xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;

     *                  xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot;

     *                  xmlns:xenc=&quot;http://www.w3.org/2001/04/xmlenc#&quot;

     *                  ID=&quot;ID-cc541137-74dc-4fc0-8bcc-7e9e3a4c899d&quot;

     *                  IssueInstant=&quot;2009-05-29T18:02:13.458Z&quot;&gt;

     *     &lt;saml2:Issuer&gt;

     *         PicketLinkSTS

     *     &lt;/saml2:Issuer&gt;

     *     &lt;saml2:Subject&gt;

     *         &lt;saml2:NameID NameQualifier=&quot;http://www.jboss.org&quot;&gt;

     *             sguilhen

     *         &lt;/saml2:NameID&gt;

     *         &lt;saml2:SubjectConfirmation Method=&quot;urn:oasis:names:tc:SAML:2.0:cm:bearer&quot;/&gt;

     *     &lt;/saml2:Subject&gt;

     *     &lt;saml2:Conditions NotBefore=&quot;2009-05-29T18:02:13.458Z&quot; NotOnOrAfter=&quot;2009-05-29T19:02:13.458Z&quot;&gt;

     *         &lt;saml2:AudienceRestriction&gt;

     *             &lt;saml2:Audience&gt;

     *                 http://services.testcorp.org/provider2

     *             &lt;/saml2:Audience&gt;

     *         &lt;/saml2:AudienceRestriction&gt;

     *     &lt;/saml2:Conditions&gt;

     *     &lt;ds:Signature&gt;

     *         ...

     *     &lt;/ds:Signature&gt;

     * &lt;/saml2:Assertion&gt;

     * </pre>

     *

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20() throws Exception {

        // create a simple token request, asking for a SAMLv2.0 token.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML2_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        InputStream is = DocumentUtil.getSourceAsStream(responseMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser().parse(is);

        // validate the security token response.

        this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML2_BEARER_URI);

    }

    /**

     * Use SOAP12

     *

     * @see #testInvokeSAML20()

     * @throws Exception

     */

    @Test

    public void testInvokeSAML20WithSOAP12() throws Exception {

        // create a simple token request, asking for a SAMLv2.0 token.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML2_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        this.tokenService.setSoap12(true); // Set to SOAP12

        try {

            // invoke the token service.

            Source responseMessage = this.tokenService.invoke(requestMessage);

            InputStream is = DocumentUtil.getSourceAsStream(responseMessage);

            BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser().parse(is);

            // validate the security token response.

            this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML2_BEARER_URI);

        } finally {

            this.tokenService.setSoap12(false);

        }

    }

    /**

     * <p>

     * This test requests a token to the STS using the {@code AppliesTo} to identify the service provider. The STS must be able

     * to find out the type of the token that must be issued using the service provider URI. In this specific case, the request

     * should be handled by the custom {@code SpecialTokenProvider}.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeCustomAppliesTo() throws Exception {

        // create a simple token request, this time using the applies to get to the token type.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider1");

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        this.validateCustomTokenResponse(baseResponse);

    }

    /**

     * <p>

     * This test requests a token to the STS using the {@code AppliesTo} to identify the service provider. The STS must be able

     * to find out the type of the token that must be issued using the service provider URI. In this specific case, the request

     * should be handled by the standard {@code SAML20TokenProvider}.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20AppliesTo() throws Exception {

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider2");

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        AssertionType assertion = this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke",

                SAMLUtil.SAML2_BEARER_URI);

        // in this scenario, the conditions section should have an audience restriction.

        ConditionsType conditions = assertion.getConditions();

        assertEquals("Unexpected restriction list size", 1, conditions.getConditions().size());

        ConditionAbstractType abstractType = conditions.getConditions().get(0);

        assertTrue("Unexpected restriction type", abstractType instanceof AudienceRestrictionType);

        AudienceRestrictionType audienceRestriction = (AudienceRestrictionType) abstractType;

        assertEquals("Unexpected audience restriction list size", 1, audienceRestriction.getAudience().size());

        assertEquals("Unexpected audience restriction item", "http://services.testcorp.org/provider2", audienceRestriction

                .getAudience().get(0).toString());

    }

    /**

     * <p>

     * This test requests a SAMLV2.0 assertion on behalf of another identity. The STS must issue an assertion for the identity

     * contained in the {@code OnBehalfOf} section of the WS-Trust request (and not for the identity that sent the request).

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20OnBehalfOf() throws Exception {

        // create a simple token request, asking for a SAMLv2.0 token.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML2_TOKEN_TYPE, null);

        OnBehalfOfType onBehalfOf = WSTrustUtil.createOnBehalfOfWithUsername("anotherduke", "id");

        request.setOnBehalfOf(onBehalfOf);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response (assertion principal should be anotherduke as specified by OnBehalfOf).

        this.validateSAMLAssertionResponse(baseResponse, "testcontext", "anotherduke", SAMLUtil.SAML2_SENDER_VOUCHES_URI);

    }

    /**

     * <p>

     * This test requests a SAMLV2.0 assertion and requires a symmetric key to be used as a proof-of-possession token. As the

     * request doesn't contain any client-specified key, the STS is responsible for generating a random key and use this key as

     * the proof token. The WS-Trust response should contain the STS-generated key.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20WithSTSGeneratedSymmetricKey() throws Exception {

        // create a simple token request, asking for a SAMLv2.0 token.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider2");

        // add a symmetric key type to the request, but don't supply any client key - STS should generate one.

        request.setKeyType(URI.create(WSTrustConstants.KEY_TYPE_SYMMETRIC));

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        AssertionType assertion = this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke",

                SAMLUtil.SAML2_HOLDER_OF_KEY_URI);

        // validate the holder of key contents.

        SubjectConfirmationType subjConfirmation = assertion.getSubject().getConfirmation().get(0);

        this.validateHolderOfKeyContents(subjConfirmation, WSTrustConstants.KEY_TYPE_SYMMETRIC, null, false);

        // check if the response contains the STS-generated key.

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        RequestSecurityTokenResponse response = collection.getRequestSecurityTokenResponses().get(0);

        RequestedProofTokenType proofToken = response.getRequestedProofToken();

        assertNotNull("Unexpected null proof token", proofToken);

        assertTrue(proofToken.getAny().get(0) instanceof BinarySecretType);

        BinarySecretType serverBinarySecret = (BinarySecretType) proofToken.getAny().get(0);

        assertNotNull("Unexpected null secret", serverBinarySecret.getValue());

        // default key size is 128 bits (16 bytes).

        byte[] encodedSecret = serverBinarySecret.getValue();

        assertEquals("Unexpected secret size", 16, Base64.decode(encodedSecret, 0, encodedSecret.length).length);

    }

    /**

     * <p>

     * This test requests a SAMLV2.0 assertion and requires a symmetric key to be used as a proof-of-possession token. In this

     * case, the client supplies a secret key in the WS-Trust request, so the STS should combine the client- specified key with

     * the STS-generated key and use this combined key as the proof token. The WS-Trust response should include the STS key to

     * allow reconstruction of the combined key and the algorithm used to combine the keys.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20WithCombinedSymmetricKey() throws Exception {

        // create a 64-bit random client secret.

        byte[] clientSecret = WSTrustUtil.createRandomSecret(8);

        BinarySecretType clientBinarySecret = new BinarySecretType();

        clientBinarySecret.setType(WSTrustConstants.BS_TYPE_NONCE);

        clientBinarySecret.setValue(Base64.encodeBytes(clientSecret).getBytes());

        // set the client secret in the client entropy.

        EntropyType clientEntropy = new EntropyType();

        clientEntropy.addAny(clientBinarySecret);

        // create a token request specifying the key type, key size, and client entropy.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider2");

        request.setKeyType(URI.create(WSTrustConstants.KEY_TYPE_SYMMETRIC));

        request.setEntropy(clientEntropy);

        request.setKeySize(64);

        // invoke the token service.

        Source requestMessage = this.createSourceFromRequest(request);

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        AssertionType assertion = this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke",

                SAMLUtil.SAML2_HOLDER_OF_KEY_URI);

        // validate the holder of key contents.

        SubjectConfirmationType subjConfirmation = assertion.getSubject().getConfirmation().get(0);

        this.validateHolderOfKeyContents(subjConfirmation, WSTrustConstants.KEY_TYPE_SYMMETRIC, null, false);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        RequestSecurityTokenResponse response = collection.getRequestSecurityTokenResponses().get(0);

        RequestedProofTokenType proofToken = response.getRequestedProofToken();

        assertNotNull("Unexpected null proof token", proofToken);

        assertTrue(proofToken.getAny().get(0) instanceof ComputedKeyType);

        ComputedKeyType computedKey = (ComputedKeyType) proofToken.getAny().get(0);

        assertEquals("Unexpected computed key algorithm", WSTrustConstants.CK_PSHA1, computedKey.getAlgorithm());

        // server entropy must have been included in the response to allow reconstruction of the computed key.

        EntropyType serverEntropy = response.getEntropy();

        assertNotNull("Unexpected null server entropy");

        assertEquals("Invalid number of elements in server entropy", 1, serverEntropy.getAny().size());

        BinarySecretType serverBinarySecret = (BinarySecretType) serverEntropy.getAny().get(0);

        assertEquals("Unexpected binary secret type", WSTrustConstants.BS_TYPE_NONCE, serverBinarySecret.getType());

        assertNotNull("Unexpected null secret value", serverBinarySecret.getValue());

        // get the base64 decoded

        byte[] encodedSecret = serverBinarySecret.getValue();

        assertEquals("Unexpected secret size", 8, Base64.decode(encodedSecret, 0, encodedSecret.length).length);

    }

    /**

     * <p>

     * This test requests a SAMLV2.0 assertion and sends a X.509 certificate to be used as the proof-of-possession token. The

     * STS must include the specified certificate in the SAML subject confirmation.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20WithCertificate() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider2");

        request.setKeyType(URI.create(WSTrustConstants.KEY_TYPE_PUBLIC));

        // include a UseKey section that specifies the certificate in the request.

        Certificate certificate = this.getCertificate("keystore/sts_keystore.jks", "testpass", "service1");

        UseKeyType useKey = new UseKeyType();

        useKey.add(Base64.encodeBytes(certificate.getEncoded()).getBytes());

        request.setUseKey(useKey);

        // invoke the token service.

        Source requestMessage = this.createSourceFromRequest(request);

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        AssertionType assertion = this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke",

                SAMLUtil.SAML2_HOLDER_OF_KEY_URI);

        // validate the holder of key contents.

        SubjectConfirmationType subjConfirmation = assertion.getSubject().getConfirmation().get(0);

        this.validateHolderOfKeyContents(subjConfirmation, WSTrustConstants.KEY_TYPE_PUBLIC, certificate, false);

    }

    /**

     * <p>

     * This test requests a SAMLV2.0 assertion and sends a public key to be used as the proof-of-possession token. The STS must

     * include the specified public key in the SAML subject confirmation.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20WithPublicKey() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider2");

        request.setKeyType(URI.create(WSTrustConstants.KEY_TYPE_PUBLIC));

        // include a UseKey section that sets the public key in the request.

        Certificate certificate = this.getCertificate("keystore/sts_keystore.jks", "testpass", "service1");

        KeyValueType keyValue = WSTrustUtil.createKeyValue(certificate.getPublicKey());

        UseKeyType useKey = new UseKeyType();

        useKey.add(keyValue);

        request.setUseKey(useKey);

        // invoke the token service.

        Source requestMessage = this.createSourceFromRequest(request);

        Source responseMessage = this.tokenService.invoke(requestMessage);

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) new WSTrustParser()

                .parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the security token response.

        AssertionType assertion = this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke",

                SAMLUtil.SAML2_HOLDER_OF_KEY_URI);

        // validate the holder of key contents.

        SubjectConfirmationType subjConfirmation = assertion.getSubject().getConfirmation().get(0);

        this.validateHolderOfKeyContents(subjConfirmation, WSTrustConstants.KEY_TYPE_PUBLIC, certificate, true);

    }

    /**

     * <p>

     * This test case first generates a SAMLV1.1 assertion and then sends a WS-Trust validate message to the STS to get the

     * assertion validated, checking the validation results.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML11Validate() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML11_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        WSTrustParser parser = new WSTrustParser();

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil

                .getSourceAsStream(responseMessage));

        // validate the response and get the SAML assertion from the request.

        this.validateSAML11AssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML11_BEARER_URI);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element assertion = (Element) collection.getRequestSecurityTokenResponses().get(0).getRequestedSecurityToken().getAny()

                .get(0);

        // now construct a WS-Trust validate request with the generated assertion.

        request = this.createRequest("validatecontext", WSTrustConstants.VALIDATE_REQUEST, WSTrustConstants.STATUS_TYPE, null);

        ValidateTargetType validateTarget = new ValidateTargetType();

        validateTarget.add(assertion);

        request.setValidateTarget(validateTarget);

        // invoke the token service.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the response contents.

        assertNotNull("Unexpected null response", baseResponse);

        assertTrue("Unexpected response type", baseResponse instanceof RequestSecurityTokenResponseCollection);

        collection = (RequestSecurityTokenResponseCollection) baseResponse;

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        RequestSecurityTokenResponse response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "validatecontext", response.getContext());

        assertEquals("Unexpected token type", WSTrustConstants.STATUS_TYPE, response.getTokenType().toString());

        StatusType status = response.getStatus();

        assertNotNull("Unexpected null status", status);

        assertEquals("Unexpected status code", WSTrustConstants.STATUS_CODE_VALID, status.getCode());

        assertEquals("Unexpected status reason", "SAMLV1.1 Assertion successfuly validated", status.getReason());

        // now let's temper the SAML assertion and try to validate it again.

        // assertion.getAttributeNode("Issuer").setNodeValue("ABC");

        // request.getValidateTarget().add(assertion);

        // Source theRequest = this.createSourceFromRequest(request);

        // responseMessage = this.tokenService.invoke(theRequest);

        // collection = (RequestSecurityTokenResponseCollection) parser.parse(DocumentUtil

        // .getSourceAsStream(responseMessage));

        // assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        // response = collection.getRequestSecurityTokenResponses().get(0);

        // assertEquals("Unexpected response context", "validatecontext", response.getContext());

        // assertEquals("Unexpected token type", WSTrustConstants.STATUS_TYPE, response.getTokenType().toString());

        // status = response.getStatus();

        // assertNotNull("Unexpected null status", status);

        // assertEquals("Unexpected status code", WSTrustConstants.STATUS_CODE_INVALID, status.getCode());

        // assertEquals("Unexpected status reason", "Validation failure: digital signature is invalid",

        // status.getReason());

    }

    /**

     * <p>

     * This test case first generates a SAMLV2.0 assertion and then sends a WS-Trust validate message to the STS to get the

     * assertion validated, checking the validation results.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20Validate() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML2_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        WSTrustParser parser = new WSTrustParser();

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil

                .getSourceAsStream(responseMessage));

        // validate the response and get the SAML assertion from the request.

        this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML2_BEARER_URI);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element assertion = (Element) collection.getRequestSecurityTokenResponses().get(0).getRequestedSecurityToken().getAny()

                .get(0);

        // now construct a WS-Trust validate request with the generated assertion.

        request = this.createRequest("validatecontext", WSTrustConstants.VALIDATE_REQUEST, WSTrustConstants.STATUS_TYPE, null);

        ValidateTargetType validateTarget = new ValidateTargetType();

        validateTarget.add(assertion);

        request.setValidateTarget(validateTarget);

        // invoke the token service.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the response contents.

        assertNotNull("Unexpected null response", baseResponse);

        assertTrue("Unexpected response type", baseResponse instanceof RequestSecurityTokenResponseCollection);

        collection = (RequestSecurityTokenResponseCollection) baseResponse;

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        RequestSecurityTokenResponse response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "validatecontext", response.getContext());

        assertEquals("Unexpected token type", WSTrustConstants.STATUS_TYPE, response.getTokenType().toString());

        StatusType status = response.getStatus();

        assertNotNull("Unexpected null status", status);

        assertEquals("Unexpected status code", WSTrustConstants.STATUS_CODE_VALID, status.getCode());

        assertEquals("Unexpected status reason", "SAMLV2.0 Assertion successfuly validated", status.getReason());

        // now let's temper the SAML assertion and try to validate it again.

        assertion.setAttribute("Version", "X");

        request.getValidateTarget().add(assertion);

        Source theRequest = this.createSourceFromRequest(request);

        responseMessage = this.tokenService.invoke(theRequest);

        collection = (RequestSecurityTokenResponseCollection) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "validatecontext", response.getContext());

        assertEquals("Unexpected token type", WSTrustConstants.STATUS_TYPE, response.getTokenType().toString());

        status = response.getStatus();

        assertNotNull("Unexpected null status", status);

        assertEquals("Unexpected status code", WSTrustConstants.STATUS_CODE_INVALID, status.getCode());

        assertEquals("Unexpected status reason", "Validation failure: digital signature is invalid", status.getReason());

    }

    /**

     * <p>

     * This test case first generates a SAMLV1.1 assertion and then sends a WS-Trust renew message to the STS to get the

     * assertion renewed (i.e. get a new assertion with an updated lifetime).

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML11Renew() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML11_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        WSTrustParser parser = new WSTrustParser();

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil

                .getSourceAsStream(responseMessage));

        // validate the response and get the SAML assertion from the request.

        this.validateSAML11AssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML11_BEARER_URI);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element assertionElement = (Element) collection.getRequestSecurityTokenResponses().get(0).getRequestedSecurityToken()

                .getAny().get(0);

        // now construct a WS-Trust renew request with the generated assertion.

        request = this.createRequest("renewcontext", WSTrustConstants.RENEW_REQUEST, SAMLUtil.SAML11_TOKEN_TYPE, null);

        RenewTargetType renewTarget = new RenewTargetType();

        renewTarget.add(assertionElement);

        request.setRenewTarget(renewTarget);

        // invoke the token service.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the renew response contents and get the renewed token.

        this.validateSAML11AssertionResponse(baseResponse, "renewcontext", "jduke", SAMLUtil.SAML11_BEARER_URI);

        collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element renewedAssertionElement = (Element) collection.getRequestSecurityTokenResponses().get(0)

                .getRequestedSecurityToken().getAny().get(0);

        // compare the assertions, checking if the lifetime has been updated.

        SAML11AssertionType originalAssertion = SAMLUtil.saml11FromElement(assertionElement);

        SAML11AssertionType renewedAssertion = SAMLUtil.saml11FromElement(renewedAssertionElement);

        // assertions should have different ids and lifetimes.

        assertFalse("Renewed assertion should have a unique id", originalAssertion.getID().equals(renewedAssertion.getID()));

        assertEquals(DatatypeConstants.LESSER,

                originalAssertion.getConditions().getNotBefore().compare(renewedAssertion.getConditions().getNotBefore()));

        assertEquals(DatatypeConstants.LESSER,

                originalAssertion.getConditions().getNotOnOrAfter().compare(renewedAssertion.getConditions().getNotOnOrAfter()));

    }

    /**

     * <p>

     * This test case first generates a SAMLV2.0 assertion and then sends a WS-Trust renew message to the STS to get the

     * assertion renewed (i.e. get a new assertion with an updated lifetime).

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20Renew() throws Exception {

        // create a simple token request, using applies-to to identify the token type.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST, null,

                "http://services.testcorp.org/provider2");

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        WSTrustParser parser = new WSTrustParser();

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil

                .getSourceAsStream(responseMessage));

        // validate the response and get the SAML assertion from the request.

        this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML2_BEARER_URI);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element assertionElement = (Element) collection.getRequestSecurityTokenResponses().get(0).getRequestedSecurityToken()

                .getAny().get(0);

        // now construct a WS-Trust renew request with the generated assertion.

        request = this.createRequest("renewcontext", WSTrustConstants.RENEW_REQUEST, SAMLUtil.SAML2_TOKEN_TYPE, null);

        RenewTargetType renewTarget = new RenewTargetType();

        renewTarget.add(assertionElement);

        request.setRenewTarget(renewTarget);

        // invoke the token service.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the renew response contents and get the renewed token.

        this.validateSAMLAssertionResponse(baseResponse, "renewcontext", "jduke", SAMLUtil.SAML2_BEARER_URI);

        collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element renewedAssertionElement = (Element) collection.getRequestSecurityTokenResponses().get(0)

                .getRequestedSecurityToken().getAny().get(0);

        // compare the assertions, checking if the lifetime has been updated.

        AssertionType originalAssertion = SAMLUtil.fromElement(assertionElement);

        AssertionType renewedAssertion = SAMLUtil.fromElement(renewedAssertionElement);

        // assertions should have different ids and lifetimes.

        assertFalse("Renewed assertion should have a unique id", originalAssertion.getID().equals(renewedAssertion.getID()));

        assertEquals(DatatypeConstants.LESSER,

                originalAssertion.getConditions().getNotBefore().compare(renewedAssertion.getConditions().getNotBefore()));

        assertEquals(DatatypeConstants.LESSER,

                originalAssertion.getConditions().getNotOnOrAfter().compare(renewedAssertion.getConditions().getNotOnOrAfter()));

    }

    /**

     * <p>

     * This test case first generates a SAMLV1.1 assertion and then sends a WS-Trust cancel message to the STS to cancel the

     * assertion. A canceled assertion cannot be renewed or considered valid anymore.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML11Cancel() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML11_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        WSTrustParser parser = new WSTrustParser();

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil

                .getSourceAsStream(responseMessage));

        // validate the response and get the SAML assertion from the request.

        this.validateSAML11AssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML11_BEARER_URI);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element assertion = (Element) collection.getRequestSecurityTokenResponses().get(0).getRequestedSecurityToken().getAny()

                .get(0);

        // now construct a WS-Trust cancel request with the generated assertion.

        request = this.createRequest("cancelcontext", WSTrustConstants.CANCEL_REQUEST, null, null);

        CancelTargetType cancelTarget = new CancelTargetType();

        cancelTarget.add(assertion);

        request.setCancelTarget(cancelTarget);

        // invoke the token service.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the response contents.

        assertNotNull("Unexpected null response", baseResponse);

        assertTrue("Unexpected response type", baseResponse instanceof RequestSecurityTokenResponseCollection);

        collection = (RequestSecurityTokenResponseCollection) baseResponse;

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        RequestSecurityTokenResponse response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "cancelcontext", response.getContext());

        assertNotNull("Cancel response should contain a RequestedTokenCancelled element", response.getRequestedTokenCancelled());

        // try to validate the canceled assertion.

        request = this.createRequest("validatecontext", WSTrustConstants.VALIDATE_REQUEST, null, null);

        ValidateTargetType validateTarget = new ValidateTargetType();

        validateTarget.add(assertion);

        request.setValidateTarget(validateTarget);

        // the response should contain a status indicating that the token is not valid.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        collection = (RequestSecurityTokenResponseCollection) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "validatecontext", response.getContext());

        assertEquals("Unexpected token type", WSTrustConstants.STATUS_TYPE, response.getTokenType().toString());

        StatusType status = response.getStatus();

        assertNotNull("Unexpected null status", status);

        assertEquals("Unexpected status code", WSTrustConstants.STATUS_CODE_INVALID, status.getCode());

        assertEquals("Unexpected status reason",

                "Validation failure: assertion with id " + assertion.getAttribute("AssertionID") + " has been canceled",

                status.getReason());

        // now try to renew the canceled assertion.

        request = this.createRequest("renewcontext", WSTrustConstants.RENEW_REQUEST, null, null);

        RenewTargetType renewTarget = new RenewTargetType();

        renewTarget.add(assertion);

        request.setRenewTarget(renewTarget);

        // we should receive an exception when renewing the token.

        try {

            this.tokenService.invoke(this.createSourceFromRequest(request));

            fail("Renewing a canceled token should result in an exception being thrown");

        } catch (WebServiceException we) {

            Throwable t = we.getCause();

            assertTrue("Unexpected cause type", t instanceof WSTrustException);

            String msg = t.getMessage();

            if (msg.contains("has been canceled and cannot be renewed") == false)

                throw new RuntimeException("Unexpected exception message");

        }

    }

    /**

     * <p>

     * This test case first generates a SAMLV2.0 assertion and then sends a WS-Trust cancel message to the STS to cancel the

     * assertion. A canceled assertion cannot be renewed or considered valid anymore.

     * </p>

     *

     * @throws Exception if an error occurs while running the test.

     */

    @Test

    public void testInvokeSAML20Cancel() throws Exception {

        // create a simple token request.

        RequestSecurityToken request = this.createRequest("testcontext", WSTrustConstants.ISSUE_REQUEST,

                SAMLUtil.SAML2_TOKEN_TYPE, null);

        Source requestMessage = this.createSourceFromRequest(request);

        // invoke the token service.

        Source responseMessage = this.tokenService.invoke(requestMessage);

        WSTrustParser parser = new WSTrustParser();

        BaseRequestSecurityTokenResponse baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil

                .getSourceAsStream(responseMessage));

        // validate the response and get the SAML assertion from the request.

        this.validateSAMLAssertionResponse(baseResponse, "testcontext", "jduke", SAMLUtil.SAML2_BEARER_URI);

        RequestSecurityTokenResponseCollection collection = (RequestSecurityTokenResponseCollection) baseResponse;

        Element assertion = (Element) collection.getRequestSecurityTokenResponses().get(0).getRequestedSecurityToken().getAny()

                .get(0);

        // now construct a WS-Trust cancel request with the generated assertion.

        request = this.createRequest("cancelcontext", WSTrustConstants.CANCEL_REQUEST, null, null);

        CancelTargetType cancelTarget = new CancelTargetType();

        cancelTarget.add(assertion);

        request.setCancelTarget(cancelTarget);

        // invoke the token service.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        baseResponse = (BaseRequestSecurityTokenResponse) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        // validate the response contents.

        assertNotNull("Unexpected null response", baseResponse);

        assertTrue("Unexpected response type", baseResponse instanceof RequestSecurityTokenResponseCollection);

        collection = (RequestSecurityTokenResponseCollection) baseResponse;

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        RequestSecurityTokenResponse response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "cancelcontext", response.getContext());

        assertNotNull("Cancel response should contain a RequestedTokenCancelled element", response.getRequestedTokenCancelled());

        // try to validate the canceled assertion.

        request = this.createRequest("validatecontext", WSTrustConstants.VALIDATE_REQUEST, null, null);

        ValidateTargetType validateTarget = new ValidateTargetType();

        validateTarget.add(assertion);

        request.setValidateTarget(validateTarget);

        // the response should contain a status indicating that the token is not valid.

        responseMessage = this.tokenService.invoke(this.createSourceFromRequest(request));

        collection = (RequestSecurityTokenResponseCollection) parser.parse(DocumentUtil.getSourceAsStream(responseMessage));

        assertEquals("Unexpected number of responses", 1, collection.getRequestSecurityTokenResponses().size());

        response = collection.getRequestSecurityTokenResponses().get(0);

        assertEquals("Unexpected response context", "validatecontext", response.getContext());

        assertEquals("Unexpected token type", WSTrustConstants.STATUS_TYPE, response.getTokenType().toString());

        StatusType status = response.getStatus();

        assertNotNull("Unexpected null status", status);

        assertEquals("Unexpected status code", WSTrustConstants.STATUS_CODE_INVALID, status.getCode());

        assertEquals("Unexpected status reason", "Validation failure: assertion with id " + assertion.getAttribute("ID")