cxf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From dk...@apache.org
Subject svn commit: r808464 - in /cxf/trunk: common/common/src/main/java/org/apache/cxf/helpers/ rt/transports/http/src/main/java/org/apache/cxf/transport/http/ rt/ws/security/ rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/builders/ rt/ws/secu...
Date Thu, 27 Aug 2009 15:38:46 GMT
Author: dkulp
Date: Thu Aug 27 15:38:42 2009
New Revision: 808464

URL: http://svn.apache.org/viewvc?rev=808464&view=rev
Log:
[CXF-2406] Fix issues with HttpsToken RequireClientCertificate

Modified:
    cxf/trunk/common/common/src/main/java/org/apache/cxf/helpers/DOMUtils.java
    cxf/trunk/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
    cxf/trunk/rt/ws/security/pom.xml
    cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/builders/HttpsTokenBuilder.java
    cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/HttpsTokenInterceptorProvider.java

Modified: cxf/trunk/common/common/src/main/java/org/apache/cxf/helpers/DOMUtils.java
URL: http://svn.apache.org/viewvc/cxf/trunk/common/common/src/main/java/org/apache/cxf/helpers/DOMUtils.java?rev=808464&r1=808463&r2=808464&view=diff
==============================================================================
--- cxf/trunk/common/common/src/main/java/org/apache/cxf/helpers/DOMUtils.java (original)
+++ cxf/trunk/common/common/src/main/java/org/apache/cxf/helpers/DOMUtils.java Thu Aug 27
15:38:42 2009
@@ -175,7 +175,13 @@
     }
 
     public static String getAttribute(Element element, QName attName) {
-        return element.getAttributeNS(attName.getNamespaceURI(), attName.getLocalPart());
+        Attr attr;
+        if (StringUtils.isEmpty(attName.getNamespaceURI())) {
+            attr = element.getAttributeNode(attName.getLocalPart());
+        } else {
+            attr = element.getAttributeNodeNS(attName.getNamespaceURI(), attName.getLocalPart());
+        }
+        return attr == null ? null : attr.getValue();
     }
 
     public static void setAttribute(Node node, String attName, String val) {

Modified: cxf/trunk/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
URL: http://svn.apache.org/viewvc/cxf/trunk/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java?rev=808464&r1=808463&r2=808464&view=diff
==============================================================================
--- cxf/trunk/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
(original)
+++ cxf/trunk/rt/transports/http/src/main/java/org/apache/cxf/transport/http/HTTPConduit.java
Thu Aug 27 15:38:42 2009
@@ -650,22 +650,39 @@
         HttpURLConnection connection = 
             (HttpURLConnection) message.get(KEY_HTTP_CONNECTION);
         
-        if (trustDecider != null) {
+        MessageTrustDecider decider2 = message.get(MessageTrustDecider.class);
+        if (trustDecider != null || decider2 != null) {
             try {
                 // We must connect or we will not get the credentials.
                 // The call is (said to be) ingored internally if
                 // already connected.
                 connection.connect();
-                trustDecider.establishTrust(
-                    getConduitName(), 
-                    getConnectionFactory(connection.getURL()).getConnectionInfo(connection),
-                    message);
-                if (LOG.isLoggable(Level.FINE)) {
-                    LOG.log(Level.FINE, "Trust Decider "
-                        + trustDecider.getLogicalName()
-                        + " considers Conduit "
-                        + getConduitName() 
-                        + " trusted.");
+                URLConnectionInfo info = getConnectionFactory(connection.getURL())
+                    .getConnectionInfo(connection);
+                if (trustDecider != null) {
+                    trustDecider.establishTrust(
+                        getConduitName(), 
+                        info,
+                        message);
+                    if (LOG.isLoggable(Level.FINE)) {
+                        LOG.log(Level.FINE, "Trust Decider "
+                            + trustDecider.getLogicalName()
+                            + " considers Conduit "
+                            + getConduitName() 
+                            + " trusted.");
+                    }
+                }
+                if (decider2 != null) {
+                    decider2.establishTrust(getConduitName(), 
+                                            info,
+                                            message);
+                    if (LOG.isLoggable(Level.FINE)) {
+                        LOG.log(Level.FINE, "Trust Decider "
+                            + decider2.getLogicalName()
+                            + " considers Conduit "
+                            + getConduitName() 
+                            + " trusted.");
+                    }
                 }
             } catch (UntrustedURLConnectionIOException untrustedEx) {
                 // This cast covers HttpsURLConnection as well.

Modified: cxf/trunk/rt/ws/security/pom.xml
URL: http://svn.apache.org/viewvc/cxf/trunk/rt/ws/security/pom.xml?rev=808464&r1=808463&r2=808464&view=diff
==============================================================================
--- cxf/trunk/rt/ws/security/pom.xml (original)
+++ cxf/trunk/rt/ws/security/pom.xml Thu Aug 27 15:38:42 2009
@@ -82,6 +82,12 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-transports-http</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
             <groupId>javax.xml.soap</groupId>
             <artifactId>saaj-api</artifactId>
         </dependency>

Modified: cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/builders/HttpsTokenBuilder.java
URL: http://svn.apache.org/viewvc/cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/builders/HttpsTokenBuilder.java?rev=808464&r1=808463&r2=808464&view=diff
==============================================================================
--- cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/builders/HttpsTokenBuilder.java
(original)
+++ cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/builders/HttpsTokenBuilder.java
Thu Aug 27 15:38:42 2009
@@ -76,7 +76,7 @@
             if (attr != null) {
                 httpsToken.setRequireClientCertificate("true".equals(attr));
             }
-        } else if (consts.getVersion() == SPConstants.Version.SP_V11) {
+        } else {
             Element polEl = PolicyConstants.findPolicyElement(element);
              
             if (polEl != null) {

Modified: cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/HttpsTokenInterceptorProvider.java
URL: http://svn.apache.org/viewvc/cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/HttpsTokenInterceptorProvider.java?rev=808464&r1=808463&r2=808464&view=diff
==============================================================================
--- cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/HttpsTokenInterceptorProvider.java
(original)
+++ cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/HttpsTokenInterceptorProvider.java
Thu Aug 27 15:38:42 2009
@@ -34,6 +34,10 @@
 import org.apache.cxf.phase.AbstractPhaseInterceptor;
 import org.apache.cxf.phase.Phase;
 import org.apache.cxf.security.transport.TLSSessionInfo;
+import org.apache.cxf.transport.http.MessageTrustDecider;
+import org.apache.cxf.transport.http.URLConnectionInfo;
+import org.apache.cxf.transport.http.UntrustedURLConnectionIOException;
+import org.apache.cxf.transport.https.HttpsURLConnectionInfo;
 import org.apache.cxf.ws.policy.AbstractPolicyInterceptorProvider;
 import org.apache.cxf.ws.policy.AssertionInfo;
 import org.apache.cxf.ws.policy.AssertionInfoMap;
@@ -46,7 +50,7 @@
  * 
  */
 public class HttpsTokenInterceptorProvider extends AbstractPolicyInterceptorProvider {
-
+    
     public HttpsTokenInterceptorProvider() {
         super(Arrays.asList(SP11Constants.HTTPS_TOKEN, SP12Constants.HTTPS_TOKEN));
         this.getOutInterceptors().add(new HttpsTokenOutInterceptor());
@@ -67,7 +71,7 @@
 
     static class HttpsTokenOutInterceptor extends AbstractPhaseInterceptor<Message>
{
         public HttpsTokenOutInterceptor() {
-            super(Phase.PREPARE_SEND);
+            super(Phase.PRE_STREAM);
         }
         public void handleMessage(Message message) throws Fault {
             AssertionInfoMap aim = message.get(AssertionInfoMap.class);
@@ -96,11 +100,29 @@
                 
                 ai.setAsserted(true);
                 Map<String, List<String>> headers = getSetProtocolHeaders(message);
+                
                 if (connection instanceof HttpsURLConnection) {
-                    HttpsURLConnection https = (HttpsURLConnection)connection;
-                    if (token.isRequireClientCertificate()
-                        && https.getLocalCertificates().length == 0) {
-                        ai.setNotAsserted("RequireClientCertificate is set, but no local
certificates");
+                    if (token.isRequireClientCertificate()) {
+                        final MessageTrustDecider orig = message.get(MessageTrustDecider.class);
+                        MessageTrustDecider trust = new MessageTrustDecider() {
+                            public void establishTrust(String conduitName,
+                                                       URLConnectionInfo connectionInfo,
+                                                       Message message)
+                                throws UntrustedURLConnectionIOException {
+                                if (orig != null) {
+                                    orig.establishTrust(conduitName, connectionInfo, message);
+                                }
+                                HttpsURLConnectionInfo info = (HttpsURLConnectionInfo)connectionInfo;
+                                if (info.getLocalCertificates() == null 
+                                    || info.getLocalCertificates().length == 0) {
+                                    throw new UntrustedURLConnectionIOException(
+                                        "RequireClientCertificate is set, "
+                                        + "but no local certificates we negotiated.  Is"
+                                        + " the server set to ask for client authorization?");
+                                }
+                            }
+                        };
+                        message.put(MessageTrustDecider.class, trust);
                     }
                     if (token.isHttpBasicAuthentication()) {
                         List<String> auth = headers.get("Authorization");
@@ -174,7 +196,8 @@
                 TLSSessionInfo tlsInfo = message.get(TLSSessionInfo.class);             
  
                 if (tlsInfo != null) {
                     if (token.isRequireClientCertificate()
-                        && tlsInfo.getPeerCertificates().length == 0) {
+                        && (tlsInfo.getPeerCertificates() == null 
+                            || tlsInfo.getPeerCertificates().length == 0)) {
                         asserted = false;
                     }
                 } else {



Mime
View raw message