Return-Path: X-Original-To: apmail-cxf-commits-archive@www.apache.org Delivered-To: apmail-cxf-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 239B317708 for ; Thu, 25 Sep 2014 20:22:23 +0000 (UTC) Received: (qmail 34522 invoked by uid 500); 25 Sep 2014 20:22:23 -0000 Delivered-To: apmail-cxf-commits-archive@cxf.apache.org Received: (qmail 34461 invoked by uid 500); 25 Sep 2014 20:22:22 -0000 Mailing-List: contact commits-help@cxf.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@cxf.apache.org Delivered-To: mailing list commits@cxf.apache.org Received: (qmail 34452 invoked by uid 99); 25 Sep 2014 20:22:22 -0000 Received: from tyr.zones.apache.org (HELO tyr.zones.apache.org) (140.211.11.114) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 25 Sep 2014 20:22:22 +0000 Received: by tyr.zones.apache.org (Postfix, from userid 65534) id 62B5888050A; Thu, 25 Sep 2014 20:22:20 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: coheigea@apache.org To: commits@cxf.apache.org Date: Thu, 25 Sep 2014 20:22:16 -0000 Message-Id: <2b2fc65766a845c19300ff2b3f30ea30@git.apache.org> In-Reply-To: <79b2bc31b39c41a79e3f317227cbcc36@git.apache.org> References: <79b2bc31b39c41a79e3f317227cbcc36@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: [3/3] git commit: Fixes to last commit Fixes to last commit Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/503bc977 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/503bc977 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/503bc977 Branch: refs/heads/2.7.x-fixes Commit: 503bc977ab096051056bf3d5d485360fb6dafbcc Parents: a0dc474 Author: Colm O hEigeartaigh Authored: Thu Sep 25 21:19:52 2014 +0100 Committer: Colm O hEigeartaigh Committed: Thu Sep 25 21:19:52 2014 +0100 ---------------------------------------------------------------------- .../ws/security/wss4j/WSS4JInInterceptor.java | 76 +---- .../wss4j/saml/CustomSamlValidator.java | 20 +- .../ws/security/wss4j/saml/SamlTokenTest.java | 63 +---- .../src/test/resources/saml_bearer.properties | 6 + .../systest/ws/saml/CustomSaml2Validator.java | 59 ---- .../cxf/systest/ws/saml/SamlTokenTest.java | 32 +-- .../ws/saml/client/SamlRoleCallbackHandler.java | 19 +- .../ws/saml/server/CustomSaml2Validator.java | 10 +- .../org/apache/cxf/systest/ws/saml/server.xml | 279 ------------------- .../cxf/systest/ws/saml/server/server.xml | 6 +- 10 files changed, 47 insertions(+), 523 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java index a5c9964..ada29bc 100644 --- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java +++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java @@ -20,13 +20,8 @@ package org.apache.cxf.ws.security.wss4j; import java.io.IOException; import java.security.Principal; -<<<<<<< HEAD -======= -import java.security.Provider; import java.security.PublicKey; -import java.security.cert.Certificate; import java.security.cert.X509Certificate; ->>>>>>> 3e21a02... Some changes to how the security context is populated import java.util.ArrayList; import java.util.Collection; import java.util.HashMap; @@ -77,10 +72,7 @@ import org.apache.cxf.ws.security.SecurityConstants; import org.apache.cxf.ws.security.policy.interceptors.NegotiationUtils; import org.apache.cxf.ws.security.tokenstore.SecurityToken; import org.apache.cxf.ws.security.tokenstore.TokenStore; -<<<<<<< HEAD -import org.apache.ws.security.CustomTokenPrincipal; import org.apache.ws.security.WSConstants; -import org.apache.ws.security.WSDerivedKeyTokenPrincipal; import org.apache.ws.security.WSPasswordCallback; import org.apache.ws.security.WSSConfig; import org.apache.ws.security.WSSecurityEngine; @@ -91,31 +83,12 @@ import org.apache.ws.security.components.crypto.Crypto; import org.apache.ws.security.handler.RequestData; import org.apache.ws.security.handler.WSHandlerConstants; import org.apache.ws.security.handler.WSHandlerResult; +import org.apache.ws.security.message.token.KerberosSecurity; import org.apache.ws.security.message.token.SecurityTokenReference; import org.apache.ws.security.processor.Processor; import org.apache.ws.security.util.WSSecurityUtil; import org.apache.ws.security.validate.NoOpValidator; import org.apache.ws.security.validate.Validator; -======= -import org.apache.wss4j.common.cache.ReplayCache; -import org.apache.wss4j.common.crypto.Crypto; -import org.apache.wss4j.common.crypto.ThreadLocalSecurityProvider; -import org.apache.wss4j.common.ext.WSPasswordCallback; -import org.apache.wss4j.common.ext.WSSecurityException; -import org.apache.wss4j.common.saml.SamlAssertionWrapper; -import org.apache.wss4j.dom.WSConstants; -import org.apache.wss4j.dom.WSSConfig; -import org.apache.wss4j.dom.WSSecurityEngine; -import org.apache.wss4j.dom.WSSecurityEngineResult; -import org.apache.wss4j.dom.handler.RequestData; -import org.apache.wss4j.dom.handler.WSHandlerConstants; -import org.apache.wss4j.dom.handler.WSHandlerResult; -import org.apache.wss4j.dom.message.token.KerberosSecurity; -import org.apache.wss4j.dom.processor.Processor; -import org.apache.wss4j.dom.util.WSSecurityUtil; -import org.apache.wss4j.dom.validate.NoOpValidator; -import org.apache.wss4j.dom.validate.Validator; ->>>>>>> 3e21a02... Some changes to how the security context is populated /** * Performs WS-Security inbound actions. @@ -582,31 +555,6 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { msg.put(SecurityContext.class, context); break; } -<<<<<<< HEAD - Object receivedAssertion = null; - if (o.get(WSSecurityEngineResult.TAG_DELEGATION_CREDENTIAL) != null) { - msg.put(SecurityConstants.DELEGATED_CREDENTIAL, - o.get(WSSecurityEngineResult.TAG_DELEGATION_CREDENTIAL)); - } - - List roles = null; - if (o.get(WSSecurityEngineResult.TAG_SAML_ASSERTION) != null) { - String roleAttributeName = (String)msg.getContextualProperty( - SecurityConstants.SAML_ROLE_ATTRIBUTENAME); - if (roleAttributeName == null || roleAttributeName.length() == 0) { - roleAttributeName = SAML_ROLE_ATTRIBUTENAME_DEFAULT; - } - receivedAssertion = o.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); - roles = SAMLUtils.parseRolesInAssertion(receivedAssertion, roleAttributeName); - SAMLSecurityContext context = createSecurityContext(p, roles); - context.setIssuer(SAMLUtils.getIssuer(receivedAssertion)); - context.setAssertionElement(SAMLUtils.getAssertionElement(receivedAssertion)); - msg.put(SecurityContext.class, context); - } else { - msg.put(SecurityContext.class, createSecurityContext(p)); - } - break; -======= } } } @@ -615,7 +563,7 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { SoapMessage msg, Subject subject, Principal p, boolean useJAASSubject, WSSecurityEngineResult wsResult, boolean utWithCallbacks ) { - if (subject != null && !(p instanceof KerberosPrincipal) && useJAASSubject) { + if ((subject != null) && !(p instanceof KerberosPrincipal) && useJAASSubject) { String roleClassifier = (String)msg.getContextualProperty(SecurityConstants.SUBJECT_ROLE_CLASSIFIER); if (roleClassifier != null && !"".equals(roleClassifier)) { @@ -633,35 +581,27 @@ public class WSS4JInInterceptor extends AbstractWSS4JInterceptor { if (!utWithCallbacks) { WSS4JTokenConverter.convertToken(msg, p); } - Object receivedAssertion = wsResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); - if (receivedAssertion == null) { - receivedAssertion = wsResult.get(WSSecurityEngineResult.TAG_TRANSFORMED_TOKEN); - } + Object receivedAssertion = null; if (wsResult.get(WSSecurityEngineResult.TAG_DELEGATION_CREDENTIAL) != null) { msg.put(SecurityConstants.DELEGATED_CREDENTIAL, wsResult.get(WSSecurityEngineResult.TAG_DELEGATION_CREDENTIAL)); } - if (receivedAssertion instanceof SamlAssertionWrapper) { + List roles = null; + if (wsResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION) != null) { String roleAttributeName = (String)msg.getContextualProperty( SecurityConstants.SAML_ROLE_ATTRIBUTENAME); if (roleAttributeName == null || roleAttributeName.length() == 0) { roleAttributeName = SAML_ROLE_ATTRIBUTENAME_DEFAULT; } - - ClaimCollection claims = - SAMLUtils.getClaims((SamlAssertionWrapper)receivedAssertion); - Set roles = - SAMLUtils.parseRolesFromClaims(claims, roleAttributeName, null); - - SAMLSecurityContext context = - new SAMLSecurityContext(p, roles, claims); + receivedAssertion = wsResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); + roles = SAMLUtils.parseRolesInAssertion(receivedAssertion, roleAttributeName); + SAMLSecurityContext context = createSecurityContext(p, roles); context.setIssuer(SAMLUtils.getIssuer(receivedAssertion)); context.setAssertionElement(SAMLUtils.getAssertionElement(receivedAssertion)); return context; } else { return createSecurityContext(p); ->>>>>>> 3e21a02... Some changes to how the security context is populated } } http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/CustomSamlValidator.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/CustomSamlValidator.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/CustomSamlValidator.java index 676797c..590febd 100644 --- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/CustomSamlValidator.java +++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/CustomSamlValidator.java @@ -19,23 +19,14 @@ package org.apache.cxf.ws.security.wss4j.saml; -<<<<<<< HEAD import org.apache.ws.security.WSSecurityException; import org.apache.ws.security.handler.RequestData; import org.apache.ws.security.saml.ext.AssertionWrapper; import org.apache.ws.security.saml.ext.OpenSAMLUtil; +import org.apache.ws.security.saml.ext.builder.SAML1Constants; +import org.apache.ws.security.saml.ext.builder.SAML2Constants; import org.apache.ws.security.validate.Credential; import org.apache.ws.security.validate.SamlAssertionValidator; -======= -import org.apache.wss4j.common.ext.WSSecurityException; -import org.apache.wss4j.common.saml.OpenSAMLUtil; -import org.apache.wss4j.common.saml.SamlAssertionWrapper; -import org.apache.wss4j.common.saml.builder.SAML1Constants; -import org.apache.wss4j.common.saml.builder.SAML2Constants; -import org.apache.wss4j.dom.handler.RequestData; -import org.apache.wss4j.dom.validate.Credential; -import org.apache.wss4j.dom.validate.SamlAssertionValidator; ->>>>>>> 3e21a02... Some changes to how the security context is populated /** * A trivial custom Validator for a SAML Assertion. It makes sure that the issuer is @@ -83,16 +74,11 @@ public class CustomSamlValidator extends SamlAssertionValidator { throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); } if (requireSenderVouches && !OpenSAMLUtil.isMethodSenderVouches(confirmationMethod)) { -<<<<<<< HEAD throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); - } else if (!requireSenderVouches -======= - throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity"); } else if (requireBearer && !(SAML2Constants.CONF_BEARER.equals(confirmationMethod) || SAML1Constants.CONF_BEARER.equals(confirmationMethod))) { - throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity"); + throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); } else if (!requireBearer && !requireSenderVouches ->>>>>>> 3e21a02... Some changes to how the security context is populated && !OpenSAMLUtil.isMethodHolderOfKey(confirmationMethod)) { throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); } http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/SamlTokenTest.java ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/SamlTokenTest.java b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/SamlTokenTest.java index cee8ddf..aca3e98 100644 --- a/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/SamlTokenTest.java +++ b/rt/ws/security/src/test/java/org/apache/cxf/ws/security/wss4j/saml/SamlTokenTest.java @@ -388,18 +388,9 @@ public class SamlTokenTest extends AbstractSecurityTest { public void testSaml2TokenWithRoles() throws Exception { Map outProperties = new HashMap(); outProperties.put(WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_UNSIGNED); -<<<<<<< HEAD - outProperties.put(WSHandlerConstants.SAML_PROP_FILE, "saml_sv.properties"); - -======= - outProperties.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference"); - outProperties.put(WSHandlerConstants.USER, "alice"); - outProperties.put("password", "password"); - outProperties.put(WSHandlerConstants.SIG_PROP_FILE, "alice.properties"); ->>>>>>> 3e21a02... Some changes to how the security context is populated + outProperties.put(WSHandlerConstants.SAML_PROP_FILE, "saml_bearer.properties"); SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(); callbackHandler.setConfirmationMethod(SAML2Constants.CONF_HOLDER_KEY); - callbackHandler.setSignAssertion(true); callbackHandler.setStatement(Statement.ATTR); callbackHandler.setConfirmationMethod(SAML2Constants.CONF_BEARER); @@ -411,7 +402,7 @@ public class SamlTokenTest extends AbstractSecurityTest { inProperties.put( WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_SIGNED ); - inProperties.put(WSHandlerConstants.SIG_VER_PROP_FILE, "insecurity.properties"); + inProperties.put(WSHandlerConstants.SIG_PROP_FILE, "insecurity.properties"); final Map customMap = new HashMap(); CustomSamlValidator validator = new CustomSamlValidator(); validator.setRequireSAML1Assertion(false); @@ -438,15 +429,9 @@ public class SamlTokenTest extends AbstractSecurityTest { assertTrue(sc.isUserInRole("admin")); WSSecurityEngineResult actionResult = -<<<<<<< HEAD - WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_UNSIGNED); + WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_SIGNED); AssertionWrapper receivedAssertion = (AssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); -======= - WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_SIGNED); - SamlAssertionWrapper receivedAssertion = - (SamlAssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); ->>>>>>> 3e21a02... Some changes to how the security context is populated assertTrue(receivedAssertion != null && receivedAssertion.getSaml2() != null); assertTrue(receivedAssertion.isSigned()); } @@ -459,18 +444,9 @@ public class SamlTokenTest extends AbstractSecurityTest { public void testSaml2TokenWithRolesSingleValue() throws Exception { Map outProperties = new HashMap(); outProperties.put(WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_UNSIGNED); -<<<<<<< HEAD - outProperties.put(WSHandlerConstants.SAML_PROP_FILE, "saml_sv.properties"); - -======= - outProperties.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference"); - outProperties.put(WSHandlerConstants.USER, "alice"); - outProperties.put("password", "password"); - outProperties.put(WSHandlerConstants.SIG_PROP_FILE, "alice.properties"); ->>>>>>> 3e21a02... Some changes to how the security context is populated + outProperties.put(WSHandlerConstants.SAML_PROP_FILE, "saml_bearer.properties"); SAML2CallbackHandler callbackHandler = new SAML2CallbackHandler(false); callbackHandler.setConfirmationMethod(SAML2Constants.CONF_HOLDER_KEY); - callbackHandler.setSignAssertion(true); callbackHandler.setStatement(Statement.ATTR); callbackHandler.setConfirmationMethod(SAML2Constants.CONF_BEARER); @@ -482,7 +458,7 @@ public class SamlTokenTest extends AbstractSecurityTest { inProperties.put( WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_SIGNED ); - inProperties.put(WSHandlerConstants.SIG_VER_PROP_FILE, "insecurity.properties"); + inProperties.put(WSHandlerConstants.SIG_PROP_FILE, "insecurity.properties"); final Map customMap = new HashMap(); CustomSamlValidator validator = new CustomSamlValidator(); validator.setRequireSAML1Assertion(false); @@ -509,15 +485,9 @@ public class SamlTokenTest extends AbstractSecurityTest { assertTrue(sc.isUserInRole("admin")); WSSecurityEngineResult actionResult = -<<<<<<< HEAD - WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_UNSIGNED); + WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_SIGNED); AssertionWrapper receivedAssertion = (AssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); -======= - WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_SIGNED); - SamlAssertionWrapper receivedAssertion = - (SamlAssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); ->>>>>>> 3e21a02... Some changes to how the security context is populated assertTrue(receivedAssertion != null && receivedAssertion.getSaml2() != null); assertTrue(receivedAssertion.isSigned()); } @@ -530,18 +500,9 @@ public class SamlTokenTest extends AbstractSecurityTest { public void testSaml1TokenWithRoles() throws Exception { Map outProperties = new HashMap(); outProperties.put(WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_UNSIGNED); -<<<<<<< HEAD - outProperties.put(WSHandlerConstants.SAML_PROP_FILE, "saml_sv.properties"); - -======= - outProperties.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference"); - outProperties.put(WSHandlerConstants.USER, "alice"); - outProperties.put("password", "password"); - outProperties.put(WSHandlerConstants.SIG_PROP_FILE, "alice.properties"); ->>>>>>> 3e21a02... Some changes to how the security context is populated + outProperties.put(WSHandlerConstants.SAML_PROP_FILE, "saml_bearer.properties"); SAML1CallbackHandler callbackHandler = new SAML1CallbackHandler(); callbackHandler.setConfirmationMethod(SAML1Constants.CONF_HOLDER_KEY); - callbackHandler.setSignAssertion(true); callbackHandler.setStatement(Statement.ATTR); callbackHandler.setConfirmationMethod(SAML1Constants.CONF_BEARER); @@ -553,7 +514,7 @@ public class SamlTokenTest extends AbstractSecurityTest { inProperties.put( WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_SIGNED ); - inProperties.put(WSHandlerConstants.SIG_VER_PROP_FILE, "insecurity.properties"); + inProperties.put(WSHandlerConstants.SIG_PROP_FILE, "insecurity.properties"); final Map customMap = new HashMap(); CustomSamlValidator validator = new CustomSamlValidator(); validator.setRequireSAML1Assertion(true); @@ -580,15 +541,9 @@ public class SamlTokenTest extends AbstractSecurityTest { assertTrue(sc.isUserInRole("admin")); WSSecurityEngineResult actionResult = -<<<<<<< HEAD - WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_UNSIGNED); + WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_SIGNED); AssertionWrapper receivedAssertion = (AssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); -======= - WSSecurityUtil.fetchActionResult(handlerResults.get(0).getResults(), WSConstants.ST_SIGNED); - SamlAssertionWrapper receivedAssertion = - (SamlAssertionWrapper) actionResult.get(WSSecurityEngineResult.TAG_SAML_ASSERTION); ->>>>>>> 3e21a02... Some changes to how the security context is populated assertTrue(receivedAssertion != null && receivedAssertion.getSaml1() != null); assertTrue(receivedAssertion.isSigned()); } http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/rt/ws/security/src/test/resources/saml_bearer.properties ---------------------------------------------------------------------- diff --git a/rt/ws/security/src/test/resources/saml_bearer.properties b/rt/ws/security/src/test/resources/saml_bearer.properties new file mode 100644 index 0000000..72b1824 --- /dev/null +++ b/rt/ws/security/src/test/resources/saml_bearer.properties @@ -0,0 +1,6 @@ +org.apache.ws.security.saml.issuerClass=org.apache.ws.security.saml.SAMLIssuerImpl +org.apache.ws.security.saml.issuer=www.example.com +org.apache.ws.security.saml.issuer.cryptoProp.file=outsecurity.properties +org.apache.ws.security.saml.issuer.key.name=myalias +org.apache.ws.security.saml.issuer.key.password=myAliasPassword +org.apache.ws.security.saml.issuer.signAssertion=true \ No newline at end of file http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/CustomSaml2Validator.java ---------------------------------------------------------------------- diff --git a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/CustomSaml2Validator.java b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/CustomSaml2Validator.java deleted file mode 100644 index e5c63fb..0000000 --- a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/CustomSaml2Validator.java +++ /dev/null @@ -1,59 +0,0 @@ -/** - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.cxf.systest.ws.saml; - -import java.util.List; - -import org.apache.wss4j.common.ext.WSSecurityException; -import org.apache.wss4j.common.saml.SamlAssertionWrapper; -import org.apache.wss4j.dom.handler.RequestData; -import org.apache.wss4j.dom.validate.Credential; -import org.apache.wss4j.dom.validate.SamlAssertionValidator; -import org.opensaml.saml2.core.Assertion; -import org.opensaml.saml2.core.AttributeStatement; - -/** - * This class does some trivial validation of a received SAML Assertion. It checks that it is - * a SAML 2 Assertion, and checks the issuer name and that it has an Attribute Statement. - */ -public class CustomSaml2Validator extends SamlAssertionValidator { - - @Override - public Credential validate(Credential credential, RequestData data) throws WSSecurityException { - Credential validatedCredential = super.validate(credential, data); - SamlAssertionWrapper assertion = validatedCredential.getSamlAssertion(); - - if (!"sts".equals(assertion.getIssuerString())) { - throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity"); - } - - Assertion saml2Assertion = assertion.getSaml2(); - if (saml2Assertion == null) { - throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity"); - } - - List attributeStatements = saml2Assertion.getAttributeStatements(); - if (attributeStatements == null || attributeStatements.isEmpty()) { - throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity"); - } - - return validatedCredential; - } - -} http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/SamlTokenTest.java ---------------------------------------------------------------------- diff --git a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/SamlTokenTest.java b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/SamlTokenTest.java index 7fe3be0..1d56d95 100644 --- a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/SamlTokenTest.java +++ b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/SamlTokenTest.java @@ -274,10 +274,8 @@ public class SamlTokenTest extends AbstractBusClientServerTestBase { assertTrue(ex.getMessage().contains("Wrong SAML Version")); } - SamlCallbackHandler samlCallbackHandler = new SamlCallbackHandler(); - samlCallbackHandler.setSignAssertion(true); ((BindingProvider)saml2Port).getRequestContext().put( - "ws-security.saml-callback-handler", samlCallbackHandler + "ws-security.saml-callback-handler", new SamlCallbackHandler() ); int result = saml2Port.doubleIt(25); assertTrue(result == 50); @@ -497,23 +495,11 @@ public class SamlTokenTest extends AbstractBusClientServerTestBase { service.getPort(portQName, DoubleItPortType.class); updateAddressPort(saml2Port, PORT); -<<<<<<< HEAD ((BindingProvider)saml2Port).getRequestContext().put( "ws-security.saml-callback-handler", new SamlCallbackHandler() ); int result = saml2Port.doubleIt(25); assertTrue(result == 50); -======= - // This test only works for DOM - if (!test.isStreaming() && PORT.equals(test.getPort())) { - SamlCallbackHandler samlCallbackHandler = new SamlCallbackHandler(); - ((BindingProvider)saml2Port).getRequestContext().put( - "ws-security.saml-callback-handler", samlCallbackHandler - ); - int result = saml2Port.doubleIt(25); - assertTrue(result == 50); - } ->>>>>>> 3e21a02... Some changes to how the security context is populated ((java.io.Closeable)saml2Port).close(); bus.shutdown(true); @@ -754,7 +740,21 @@ public class SamlTokenTest extends AbstractBusClientServerTestBase { SamlRoleCallbackHandler roleCallbackHandler = new SamlRoleCallbackHandler(); - roleCallbackHandler.setSignAssertion(true); + roleCallbackHandler.setConfirmationMethod(SAML2Constants.CONF_BEARER); + ((BindingProvider)saml2Port).getRequestContext().put( + SecurityConstants.SELF_SIGN_SAML_ASSERTION, true + ); + ((BindingProvider)saml2Port).getRequestContext().put( + SecurityConstants.SIGNATURE_USERNAME, "alice" + ); + ((BindingProvider)saml2Port).getRequestContext().put( + SecurityConstants.SIGNATURE_PROPERTIES, + "org/apache/cxf/systest/ws/wssec10/client/alice.properties" + ); + ((BindingProvider)saml2Port).getRequestContext().put( + SecurityConstants.CALLBACK_HANDLER, + "org.apache.cxf.systest.ws.wssec10.client.KeystorePasswordCallback" + ); roleCallbackHandler.setRoleName("manager"); ((BindingProvider)saml2Port).getRequestContext().put( "ws-security.saml-callback-handler", roleCallbackHandler http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/client/SamlRoleCallbackHandler.java ---------------------------------------------------------------------- diff --git a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/client/SamlRoleCallbackHandler.java b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/client/SamlRoleCallbackHandler.java index 37fcf9f..71ee987 100644 --- a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/client/SamlRoleCallbackHandler.java +++ b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/client/SamlRoleCallbackHandler.java @@ -47,13 +47,9 @@ public class SamlRoleCallbackHandler implements CallbackHandler { private static final String ROLE_URI = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role"; private boolean saml2 = true; - private String confirmationMethod = SAML2Constants.CONF_BEARER; + private String confirmationMethod = SAML2Constants.CONF_SENDER_VOUCHES; private CERT_IDENTIFIER keyInfoIdentifier = CERT_IDENTIFIER.X509_CERT; private String roleName; - private boolean signAssertion; - private String cryptoAlias = "alice"; - private String cryptoPassword = "password"; - private String cryptoPropertiesFile = "alice.properties"; public SamlRoleCallbackHandler() { // @@ -126,16 +122,6 @@ public class SamlRoleCallbackHandler implements CallbackHandler { attributeBean.setAttributeValues(Collections.singletonList(roleName)); attrBean.setSamlAttributes(Collections.singletonList(attributeBean)); callback.setAttributeStatementData(Collections.singletonList(attrBean)); - - try { - Crypto crypto = CryptoFactory.getInstance(cryptoPropertiesFile); - callback.setIssuerCrypto(crypto); - callback.setIssuerKeyName(cryptoAlias); - callback.setIssuerKeyPassword(cryptoPassword); - callback.setSignAssertion(signAssertion); - } catch (Exception ex) { - throw new IOException("Problem creating KeyInfo: " + ex.getMessage()); - } } } } @@ -166,7 +152,4 @@ public class SamlRoleCallbackHandler implements CallbackHandler { this.roleName = roleName; } - public void setSignAssertion(boolean signAssertion) { - this.signAssertion = signAssertion; - } } http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/server/CustomSaml2Validator.java ---------------------------------------------------------------------- diff --git a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/server/CustomSaml2Validator.java b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/server/CustomSaml2Validator.java index c83901a..6061c0c 100644 --- a/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/server/CustomSaml2Validator.java +++ b/systests/ws-security/src/test/java/org/apache/cxf/systest/ws/saml/server/CustomSaml2Validator.java @@ -23,7 +23,6 @@ import java.util.List; import org.apache.ws.security.WSSecurityException; import org.apache.ws.security.handler.RequestData; import org.apache.ws.security.saml.ext.AssertionWrapper; -import org.apache.ws.security.saml.ext.OpenSAMLUtil; import org.apache.ws.security.validate.Credential; import org.apache.ws.security.validate.SamlAssertionValidator; import org.opensaml.saml2.core.Assertion; @@ -31,8 +30,7 @@ import org.opensaml.saml2.core.AttributeStatement; /** * This class does some trivial validation of a received SAML Assertion. It checks that it is - * a SAML 2 Assertion, and checks the issuer name and confirmation method, and that it has - * an Attribute Statement. + * a SAML 2 Assertion, and checks the issuer name and that it has an Attribute Statement. */ public class CustomSaml2Validator extends SamlAssertionValidator { @@ -45,12 +43,6 @@ public class CustomSaml2Validator extends SamlAssertionValidator { throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); } - String confirmationMethod = assertion.getConfirmationMethods().get(0); - if (!(OpenSAMLUtil.isMethodSenderVouches(confirmationMethod) - || OpenSAMLUtil.isMethodHolderOfKey(confirmationMethod))) { - throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); - } - Assertion saml2Assertion = assertion.getSaml2(); if (saml2Assertion == null) { throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity"); http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server.xml ---------------------------------------------------------------------- diff --git a/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server.xml b/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server.xml deleted file mode 100644 index 6027841..0000000 --- a/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server.xml +++ /dev/null @@ -1,279 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - .*_EXPORT_.* - .*_EXPORT1024_.* - .*_WITH_DES_.* - .*_WITH_AES_.* - .*_WITH_NULL_.* - .*_DH_anon_.* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://localhost:${testutil.ports.Server.2}/DoubleItSaml2Transport2 - https://localhost:${testutil.ports.StaxServer.2}/DoubleItSaml2Transport2 - - - - - - - - - - - - - http://git-wip-us.apache.org/repos/asf/cxf/blob/503bc977/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server/server.xml ---------------------------------------------------------------------- diff --git a/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server/server.xml b/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server/server.xml index 136c49f..3fedf31 100644 --- a/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server/server.xml +++ b/systests/ws-security/src/test/resources/org/apache/cxf/systest/ws/saml/server/server.xml @@ -133,7 +133,7 @@ serviceName="s:DoubleItService" endpointName="s:DoubleItSaml2SymmetricPort" xmlns:s="http://www.example.org/contract/DoubleIt" - implementor="org.apache.cxf.systest.ws.common.DoubleItPortTypeImpl" + implementor="org.apache.cxf.systest.ws.common.DoubleItImpl" wsdlLocation="org/apache/cxf/systest/ws/saml/DoubleItSaml.wsdl"> @@ -308,7 +308,7 @@ serviceName="s:DoubleItService" endpointName="s:DoubleItSaml2SymmetricSignedElementsPort" xmlns:s="http://www.example.org/contract/DoubleIt" - implementor="org.apache.cxf.systest.ws.common.DoubleItPortTypeImpl" + implementor="org.apache.cxf.systest.ws.common.DoubleItImpl" wsdlLocation="org/apache/cxf/systest/ws/saml/DoubleItSaml.wsdl"> @@ -466,7 +466,7 @@ serviceName="s:DoubleItService" endpointName="s:DoubleItSaml2PEPPort" xmlns:s="http://www.example.org/contract/DoubleIt" - implementor="org.apache.cxf.systest.ws.common.DoubleItPortTypeImpl" + implementor="org.apache.cxf.systest.ws.common.DoubleItImpl" wsdlLocation="org/apache/cxf/systest/ws/saml/DoubleItSaml.wsdl">