Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Date: Mon, 14 Jul 2014 16:11:05 +0000 (UTC)
From: "Colm O hEigeartaigh (JIRA)" <jira@apache.org>
To: issues@cxf.apache.org
Message-ID: <JIRA.12727100.1405349513730.36287.1405354265785@arcas>
In-Reply-To: <JIRA.12727100.1405349513730@arcas>
References: <JIRA.12727100.1405349513730@arcas>
Subject: [jira] [Resolved] (CXF-5877) SCT in a (SAML1.1 + SCT) scenario
 failing to renew ore reissue
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


     [ https://issues.apache.org/jira/browse/CXF-5877?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh resolved CXF-5877.
--------------------------------------

    Resolution: Fixed

> SCT in a (SAML1.1 + SCT) scenario failing to renew ore reissue
> --------------------------------------------------------------
>
>                 Key: CXF-5877
>                 URL: https://issues.apache.org/jira/browse/CXF-5877
>             Project: CXF
>          Issue Type: Bug
>            Reporter: Freddy Exposito
>            Assignee: Colm O hEigeartaigh
>            Priority: Minor
>             Fix For: 2.7.12, 3.0.1
>
>         Attachments: sct+saml-issue.patch
>
>
> Hi All,=20
> We are having issues working with Secure Conversation and SAML Token rene=
wing (or reissuing) SCT in a (SAML1.1 + SCT) scenario (using the mock STS f=
or SCTs).=20
> When CXF tries to renew (or reissue) and expired SCT, it includes the Iss=
uedTokenOutInterceptor  in the interceptors chain (as expected) to renew or=
 reissue the SAML token.=20
> However, the contextual properties  "ws-security.token" and "ws-security.=
token.id"  =E2=80=98received=E2=80=99 in the IssuedTokenOutInterceptor=20
> are referencing the expired SCT token (added to the context in the Abstra=
ctSTSClient) so it tries to renew the SCT token (created by the mock STS) a=
gainst the SAML STS failing of course.=20
> If we understand right how this is working, the AbstractSTSClient.renew()=
 method, when renewing the SCT, must put the token in the RCT going to the =
MockSTS but can not put the SCT in=20
> the context that is intended to be used by the IssuedTokenOutInterceptor =
that is expecting a SAML token to be there (and it's getting an SCT).=20
> The attached CXF patch fixed the issue for us and illustrate the behaviou=
r we are expecting.=20
> Are we missing something here or it's something going on wrong in the way=
 'token' and 'token.id'=20
> are being copied from the STSClient to the Interceptors?=20
> Note: In our case we are only using renew and issue but I see the token b=
eing added in the AbstractSTSClient.validate() and AbstractSTSClient.cancel=
() as well that might be causing an issue too.


--
This message was sent by Atlassian JIRA
(v6.2#6252)