cxf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cohei...@apache.org
Subject [2/6] cxf git commit: Got the PublicKey case working with TLS client certs
Date Mon, 08 Feb 2016 16:34:44 GMT
Got the PublicKey case working with TLS client certs


Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/4102f1d7
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/4102f1d7
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/4102f1d7

Branch: refs/heads/master
Commit: 4102f1d7c551a03f92421ac9894019631daeb748
Parents: 276a607
Author: Colm O hEigeartaigh <coheigea@apache.org>
Authored: Mon Feb 8 14:13:16 2016 +0000
Committer: Colm O hEigeartaigh <coheigea@apache.org>
Committed: Mon Feb 8 16:34:01 2016 +0000

----------------------------------------------------------------------
 .../sts/rest/RESTSecurityTokenServiceImpl.java  | 52 +++++++++++++++-----
 .../cxf/systest/sts/rest/RESTUnitTest.java      |  5 +-
 2 files changed, 43 insertions(+), 14 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cxf/blob/4102f1d7/services/sts/sts-core/src/main/java/org/apache/cxf/sts/rest/RESTSecurityTokenServiceImpl.java
----------------------------------------------------------------------
diff --git a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/rest/RESTSecurityTokenServiceImpl.java
b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/rest/RESTSecurityTokenServiceImpl.java
index 181a05a..f1291c0 100644
--- a/services/sts/sts-core/src/main/java/org/apache/cxf/sts/rest/RESTSecurityTokenServiceImpl.java
+++ b/services/sts/sts-core/src/main/java/org/apache/cxf/sts/rest/RESTSecurityTokenServiceImpl.java
@@ -46,8 +46,11 @@ import org.apache.cxf.ws.security.sts.provider.model.ObjectFactory;
 import org.apache.cxf.ws.security.sts.provider.model.RequestSecurityTokenResponseType;
 import org.apache.cxf.ws.security.sts.provider.model.RequestSecurityTokenType;
 import org.apache.cxf.ws.security.sts.provider.model.RequestedSecurityTokenType;
+import org.apache.cxf.ws.security.sts.provider.model.UseKeyType;
 import org.apache.cxf.ws.security.trust.STSUtils;
 import org.apache.wss4j.dom.WSConstants;
+import org.apache.xml.security.exceptions.XMLSecurityException;
+import org.apache.xml.security.keys.content.X509Data;
 
 public class RESTSecurityTokenServiceImpl extends SecurityTokenServiceImpl implements RESTSecurityTokenService
{
 
@@ -132,9 +135,31 @@ public class RESTSecurityTokenServiceImpl extends SecurityTokenServiceImpl
imple
 
         request.getAny().add(of.createRequestType("http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue"));
 
-        request.getAny().add(of.createKeyType(keyType != null
-            ? keyType
-            : defaultKeyType));
+        String desiredKeyType = keyType != null ? keyType : defaultKeyType;
+        request.getAny().add(of.createKeyType(desiredKeyType));
+        
+        // Add the TLS client Certificate as the UseKey Element if the KeyType is PublicKey
+        if (STSConstants.PUBLIC_KEY_KEYTYPE.equals(desiredKeyType)) {
+            X509Certificate clientCert = getTLSClientCertificate();
+            if (clientCert != null) {
+                Document doc = DOMUtils.createDocument();
+                Element keyInfoElement = doc.createElementNS("http://www.w3.org/2000/09/xmldsig#",
"KeyInfo");
+                
+                try {
+                    X509Data certElem = new X509Data(doc);
+                    certElem.addCertificate(clientCert);
+                    keyInfoElement.appendChild(certElem.getElement());
+                    
+                    UseKeyType useKeyType = of.createUseKeyType();
+                    useKeyType.setAny(keyInfoElement);
+                    
+                    JAXBElement<UseKeyType> useKey = of.createUseKey(useKeyType);
+                    request.getAny().add(useKey);
+                } catch (XMLSecurityException ex) {
+                    // TODO
+                }
+            }
+        }
 
         // Claims
         if (requestedClaims == null) {
@@ -266,18 +291,23 @@ public class RESTSecurityTokenServiceImpl extends SecurityTokenServiceImpl
imple
         SecurityContext sc = (SecurityContext)messageContext.get(SecurityContext.class);
         if (sc == null || sc.getUserPrincipal() == null) {
             // Get the TLS client principal if no security context is set up
-            TLSSessionInfo tlsInfo = 
-                (TLSSessionInfo)PhaseInterceptorChain.getCurrentMessage().get(TLSSessionInfo.class);
-            if (tlsInfo != null && tlsInfo.getPeerCertificates() != null 
-                    && tlsInfo.getPeerCertificates().length > 0
-                    && (tlsInfo.getPeerCertificates()[0] instanceof X509Certificate)
-            ) {
-                return ((X509Certificate)tlsInfo.getPeerCertificates()[0]).getSubjectX500Principal();
-            } 
+            return getTLSClientCertificate().getSubjectX500Principal();
         }
         return messageContext.getSecurityContext().getUserPrincipal();
     }
     
+    private X509Certificate getTLSClientCertificate() {
+        TLSSessionInfo tlsInfo = 
+            (TLSSessionInfo)PhaseInterceptorChain.getCurrentMessage().get(TLSSessionInfo.class);
+        if (tlsInfo != null && tlsInfo.getPeerCertificates() != null 
+                && tlsInfo.getPeerCertificates().length > 0
+                && (tlsInfo.getPeerCertificates()[0] instanceof X509Certificate)
+        ) {
+            return (X509Certificate)tlsInfo.getPeerCertificates()[0];
+        }
+        return null;
+    }
+    
     @Override
     protected Map<String, Object> getMessageContext() {
         return PhaseInterceptorChain.getCurrentMessage();

http://git-wip-us.apache.org/repos/asf/cxf/blob/4102f1d7/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/rest/RESTUnitTest.java
----------------------------------------------------------------------
diff --git a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/rest/RESTUnitTest.java
b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/rest/RESTUnitTest.java
index 65c0cf3..8ecd2b6 100644
--- a/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/rest/RESTUnitTest.java
+++ b/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/rest/RESTUnitTest.java
@@ -189,7 +189,6 @@ public class RESTUnitTest extends AbstractBusClientServerTestBase {
     }
     
     @org.junit.Test
-    @org.junit.Ignore
     public void testIssuePublicKeySAML2Token() throws Exception {
         SpringBusFactory bf = new SpringBusFactory();
         URL busFile = RESTUnitTest.class.getResource("cxf-client.xml");
@@ -230,7 +229,7 @@ public class RESTUnitTest extends AbstractBusClientServerTestBase {
 
         bus.shutdown(true);
     }
-    
+    /*
     @org.junit.Test
     public void testIssueBearerSAML1Token() throws Exception {
         SpringBusFactory bf = new SpringBusFactory();
@@ -392,7 +391,7 @@ public class RESTUnitTest extends AbstractBusClientServerTestBase {
         
         bus.shutdown(true);
     }
-
+*/
     @org.junit.Test
     @org.junit.Ignore
     public void testIssueJWTToken() throws Exception {


Mime
View raw message