cxf-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Sunil Bapat <suba...@gmail.com>
Subject Re: STSClient configuration
Date Wed, 16 May 2012 14:25:48 GMT
Thanks for the help.
In the SAMLCallbackHandler, I am calling setAssertionElement as you mentioned:

DOMParser parser = new DOMParser();
parser.parse(new InputSource(new StringReader(samlAssertionString)));
callback.setAssertionElement(parser.getDocument().getDocumentElement());

In the STS client, I am setting the following properties:
Map<String, Object> properties = new HashMap<String, Object>();
properties.put(WSHandlerConstants.ACTION, WSHandlerConstants.SAML_TOKEN_SIGNED);
properties.put("ws-security.saml-callback-handler", new
SAMLCallbackHandler(assertionString));
client.setProperties(properties);

After doing this, I am getting the exception below. OpenSAMLUtil.toDom
is trying to sign the assertion. The assertion is already signed by
the STS which issued it. I don't have the private key to configure. It
looks like the SAML assertion is deconstructed and reconstructed. Is
the above code correct? Am I missing some other configuration?

Exception:

org.apache.cxf.interceptor.Fault
	at org.apache.cxf.ws.security.wss4j.policyhandlers.TransportBindingHandler.handleBinding(TransportBindingHandler.java:151)
	at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessage(PolicyBasedWSS4JOutInterceptor.java:158)
	at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessage(PolicyBasedWSS4JOutInterceptor.java:88)
	at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)
	at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:533)
	at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:463)
	at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:366)
	at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:319)
	at org.apache.cxf.ws.security.trust.STSClient.requestSecurityToken(STSClient.java:673)
.....
.....

Caused by: java.lang.NullPointerException
	at org.apache.xml.security.algorithms.implementations.SignatureDSA.engineInitSign(Unknown
Source)
	at org.apache.xml.security.algorithms.SignatureAlgorithm.initSign(Unknown
Source)
	at org.apache.xml.security.signature.XMLSignature.sign(Unknown Source)
	at org.opensaml.xml.signature.Signer.signObject(Signer.java:76)
	at org.apache.ws.security.saml.ext.OpenSAMLUtil.toDom(OpenSAMLUtil.java:132)
	at org.apache.ws.security.saml.ext.AssertionWrapper.toDOM(AssertionWrapper.java:287)
	at org.apache.cxf.ws.security.wss4j.policyhandlers.TransportBindingHandler.addSignedSupportingTokens(TransportBindingHandler.java:106)
	at org.apache.cxf.ws.security.wss4j.policyhandlers.TransportBindingHandler.handleNonEndorsingSupportingTokens(TransportBindingHandler.java:166)
	at org.apache.cxf.ws.security.wss4j.policyhandlers.TransportBindingHandler.handleBinding(TransportBindingHandler.java:144)

Thanks
Sunil.


On Wed, May 16, 2012 at 4:39 AM, Colm O hEigeartaigh
<coheigea@apache.org> wrote:
> Are you using WS-SecurityPolicy? The only way I can think of to do
> this is if the STS is secured with a WS-SecurityPolicy expression that
> requires a SAML Token as a SupportingToken, see here for some
> examples:
>
> http://svn.apache.org/viewvc/cxf/trunk/systests/ws-security-examples/src/test/resources/org/apache/cxf/systest/wssec/examples/saml/DoubleItSaml.wsdl?view=markup
>
>  In this case, you'll need to configure the client with a special
> callback handler to retrieve the SAML Assertion, for example:
>
> http://svn.apache.org/viewvc/cxf/trunk/systests/ws-security-examples/src/test/resources/org/apache/cxf/systest/wssec/examples/saml/client/client.xml?view=markup
>
> The following example referenced above generates a new SAML Assertion:
>
> http://svn.apache.org/viewvc/cxf/trunk/systests/ws-security-examples/src/test/java/org/apache/cxf/systest/wssec/examples/saml/SamlCallbackHandler.java?view=markup
>
> However if you have access to the DOM Element you can just set this
> instead on the SAMLCallback object.
>
> Colm.
>
> On Tue, May 15, 2012 at 9:03 PM, Urmila & Sunil Bapat <subapat@gmail.com> wrote:
>> How do I configure the STSClient to pass in a existing SAML assertion?
>> The scenario is that the STS is secured by a SAML assertion. Therefore
>> to call the STS, we need to pass this SAML assertion. What properties
>> and callbacks can I configure on the STSClient to send this SAML
>> assertion in the header of the RequestSecurityToken call to the STS?
>>
>> Thanks
>> Sunil.
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com

Mime
View raw message