diff --git a/core/src/test/java/org/springframework/ws/server/endpoint/mapping/PayloadRootAnnotationMethodEndpointMappingTest.java b/core/src/test/java/org/springframework/ws/server/endpoint/mapping/PayloadRootAnnotationMethodEndpointMappingTest.java index 926ed48b..5714f3a3 100644 --- a/core/src/test/java/org/springframework/ws/server/endpoint/mapping/PayloadRootAnnotationMethodEndpointMappingTest.java +++ b/core/src/test/java/org/springframework/ws/server/endpoint/mapping/PayloadRootAnnotationMethodEndpointMappingTest.java @@ -27,6 +27,7 @@ import org.springframework.test.AbstractDependencyInjectionSpringContextTests; import org.springframework.ws.context.DefaultMessageContext; import org.springframework.ws.context.MessageContext; import org.springframework.ws.server.EndpointAdapter; +import org.springframework.ws.server.EndpointMapping; import org.springframework.ws.server.MessageDispatcher; import org.springframework.ws.server.endpoint.MethodEndpoint; import org.springframework.ws.server.endpoint.adapter.PayloadMethodEndpointAdapter; @@ -69,7 +70,7 @@ public class PayloadRootAnnotationMethodEndpointMappingTest extends AbstractDepe MessageDispatcher messageDispatcher = new SoapMessageDispatcher(); messageDispatcher.setApplicationContext(applicationContext); - messageDispatcher.setEndpointMappings(Collections.singletonList(mapping)); + messageDispatcher.setEndpointMappings(Collections.singletonList(mapping)); messageDispatcher.setEndpointAdapters(Collections.singletonList(adapter)); messageDispatcher.receive(messageContext); diff --git a/core/src/test/java/org/springframework/ws/transport/http/CommonsHttpMessageSenderIntegrationTest.java b/core/src/test/java/org/springframework/ws/transport/http/CommonsHttpMessageSenderIntegrationTest.java index 2699461c..055a7a69 100644 --- a/core/src/test/java/org/springframework/ws/transport/http/CommonsHttpMessageSenderIntegrationTest.java +++ b/core/src/test/java/org/springframework/ws/transport/http/CommonsHttpMessageSenderIntegrationTest.java @@ -19,19 +19,14 @@ package org.springframework.ws.transport.http; import java.io.IOException; import java.net.URI; import java.net.URISyntaxException; -import java.util.Properties; +import java.util.HashMap; +import java.util.Map; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.xml.soap.MessageFactory; -import org.apache.commons.httpclient.ConnectTimeoutException; -import org.apache.commons.httpclient.URIException; -import org.mortbay.jetty.Server; -import org.mortbay.jetty.servlet.Context; -import org.mortbay.jetty.servlet.ServletHolder; - import org.springframework.context.support.StaticApplicationContext; import org.springframework.util.FileCopyUtils; import org.springframework.ws.MockWebServiceMessage; @@ -40,6 +35,12 @@ import org.springframework.ws.soap.saaj.SaajSoapMessage; import org.springframework.ws.soap.saaj.SaajSoapMessageFactory; import org.springframework.ws.transport.WebServiceConnection; +import org.apache.commons.httpclient.ConnectTimeoutException; +import org.apache.commons.httpclient.URIException; +import org.mortbay.jetty.Server; +import org.mortbay.jetty.servlet.Context; +import org.mortbay.jetty.servlet.ServletHolder; + public class CommonsHttpMessageSenderIntegrationTest extends AbstractHttpWebServiceMessageSenderIntegrationTestCase { @Override @@ -64,11 +65,11 @@ public class CommonsHttpMessageSenderIntegrationTest extends AbstractHttpWebServ public void testMaxConnections() throws URISyntaxException, URIException { CommonsHttpMessageSender messageSender = new CommonsHttpMessageSender(); messageSender.setMaxTotalConnections(2); - Properties maxConnectionsPerHost = new Properties(); - maxConnectionsPerHost.setProperty("https://www.example.com", "1"); - maxConnectionsPerHost.setProperty("http://www.example.com:8080", "7"); - maxConnectionsPerHost.setProperty("www.springframework.org", "10"); - maxConnectionsPerHost.setProperty("*", "5"); + Map maxConnectionsPerHost = new HashMap(); + maxConnectionsPerHost.put("https://www.example.com", "1"); + maxConnectionsPerHost.put("http://www.example.com:8080", "7"); + maxConnectionsPerHost.put("www.springframework.org", "10"); + maxConnectionsPerHost.put("*", "5"); messageSender.setMaxConnectionsPerHost(maxConnectionsPerHost); } diff --git a/security/src/main/java/org/springframework/ws/soap/security/callback/AbstractCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/callback/AbstractCallbackHandler.java index 2ea793bc..e21ee806 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/callback/AbstractCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/callback/AbstractCallbackHandler.java @@ -1,5 +1,5 @@ /* - * Copyright 2006 the original author or authors. + * Copyright 2005-2010 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -45,8 +45,8 @@ public abstract class AbstractCallbackHandler implements CallbackHandler { * @see #handleInternal(javax.security.auth.callback.Callback) */ public final void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { - for (int i = 0; i < callbacks.length; i++) { - handleInternal(callbacks[i]); + for (Callback callback : callbacks) { + handleInternal(callback); } } diff --git a/security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java b/security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java index 0ecbf804..d32f974e 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java +++ b/security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java @@ -43,8 +43,7 @@ public class CallbackHandlerChain extends AbstractCallbackHandler { @Override protected void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException { boolean allUnsupported = true; - for (int i = 0; i < callbackHandlers.length; i++) { - CallbackHandler callbackHandler = callbackHandlers[i]; + for (CallbackHandler callbackHandler : callbackHandlers) { try { callbackHandler.handle(new Callback[]{callback}); allUnsupported = false; diff --git a/security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java b/security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java index 8f430ba5..901fc8f4 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java +++ b/security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java @@ -1,5 +1,5 @@ /* - * Copyright 2006 the original author or authors. + * Copyright 2005-2010 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -21,14 +21,14 @@ import java.io.InputStream; import java.security.GeneralSecurityException; import java.security.KeyStore; -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; - import org.springframework.beans.factory.FactoryBean; import org.springframework.beans.factory.InitializingBean; import org.springframework.core.io.Resource; import org.springframework.util.StringUtils; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + /** * Spring factory bean for a {@link KeyStore}. *

@@ -40,7 +40,7 @@ import org.springframework.util.StringUtils; * @see KeyStore * @since 1.0.0 */ -public class KeyStoreFactoryBean implements FactoryBean, InitializingBean { +public class KeyStoreFactoryBean implements FactoryBean, InitializingBean { private static final Log logger = LogFactory.getLog(KeyStoreFactoryBean.class); @@ -87,11 +87,11 @@ public class KeyStoreFactoryBean implements FactoryBean, InitializingBean { this.type = type; } - public Object getObject() { + public KeyStore getObject() { return keyStore; } - public Class getObjectType() { + public Class getObjectType() { return KeyStore.class; } diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java index ee1f86af..4036b250 100755 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java @@ -27,22 +27,6 @@ import javax.security.auth.callback.CallbackHandler; import javax.security.auth.callback.UnsupportedCallbackException; import javax.xml.soap.MessageFactory; -import org.apache.axiom.soap.SOAPEnvelope; -import org.apache.axiom.soap.SOAPFactory; -import org.apache.axiom.soap.SOAPMessage; -import org.apache.ws.security.WSConstants; -import org.apache.ws.security.WSSecurityEngine; -import org.apache.ws.security.WSSecurityEngineResult; -import org.apache.ws.security.WSSecurityException; -import org.apache.ws.security.WSUsernameTokenPrincipal; -import org.apache.ws.security.components.crypto.Crypto; -import org.apache.ws.security.handler.RequestData; -import org.apache.ws.security.handler.WSHandlerConstants; -import org.apache.ws.security.handler.WSHandlerResult; -import org.apache.ws.security.message.token.Timestamp; -import org.apache.ws.security.util.WSSecurityUtil; -import org.w3c.dom.Document; - import org.springframework.beans.factory.InitializingBean; import org.springframework.util.Assert; import org.springframework.util.CollectionUtils; @@ -62,6 +46,22 @@ import org.springframework.ws.soap.security.callback.CallbackHandlerChain; import org.springframework.ws.soap.security.callback.CleanupCallback; import org.springframework.ws.soap.security.wss4j.callback.UsernameTokenPrincipalCallback; +import org.apache.axiom.soap.SOAPEnvelope; +import org.apache.axiom.soap.SOAPFactory; +import org.apache.axiom.soap.SOAPMessage; +import org.apache.ws.security.WSConstants; +import org.apache.ws.security.WSSecurityEngine; +import org.apache.ws.security.WSSecurityEngineResult; +import org.apache.ws.security.WSSecurityException; +import org.apache.ws.security.WSUsernameTokenPrincipal; +import org.apache.ws.security.components.crypto.Crypto; +import org.apache.ws.security.handler.RequestData; +import org.apache.ws.security.handler.WSHandlerConstants; +import org.apache.ws.security.handler.WSHandlerResult; +import org.apache.ws.security.message.token.Timestamp; +import org.apache.ws.security.util.WSSecurityUtil; +import org.w3c.dom.Document; + /** * A WS-Security endpoint interceptor based on Apache's WSS4J. This inteceptor supports messages created by the {@link * org.springframework.ws.soap.axiom.AxiomSoapMessageFactory} and the {@link org.springframework.ws.soap.saaj.SaajSoapMessageFactory}. @@ -99,7 +99,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl private String securementActions; - private Vector securementActionsVector; + private Vector securementActionsVector; private String securementUsername; @@ -109,7 +109,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl private String validationActions; - private Vector validationActionsVector; + private Vector validationActionsVector; private String validationActor; @@ -490,7 +490,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl // action, we need to pass an empty securementActionsVector to avoid // NPE if (securementAction == WSConstants.NO_SECURITY) { - securementActionsVector = new Vector(0); + securementActionsVector = new Vector(0); } handler.doSenderAction(securementAction, envelopeAsDocument, requestData, securementActionsVector, false); @@ -523,6 +523,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } @Override + @SuppressWarnings("unchecked") protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext) throws WsSecurityValidationException { if (logger.isDebugEnabled()) { @@ -538,7 +539,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl // Header processing try { - Vector results = securityEngine + Vector results = securityEngine .processSecurityHeader(envelopeAsDocument, validationActor, validationCallbackHandler, validationSignatureCrypto, validationDecryptionCrypto); @@ -575,7 +576,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl * @param validationActionsVector the decoded validation actions * @throws Wss4jSecurityValidationException if the results are deemed invalid */ - protected void checkResults(Vector results, Vector validationActionsVector) + protected void checkResults(Vector results, Vector validationActionsVector) throws Wss4jSecurityValidationException { if (!handler.checkReceiverResultsAnyOrder(results, validationActionsVector)) { throw new Wss4jSecurityValidationException("Security processing failed (actions mismatch)"); @@ -586,10 +587,11 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl * Puts the results of WS-Security headers processing in the message context. Some actions like Signature * Confirmation require this. */ - private void updateContextWithResults(MessageContext messageContext, Vector results) { - Vector handlerResults; - if ((handlerResults = (Vector) messageContext.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) { - handlerResults = new Vector(); + @SuppressWarnings("unchecked") + private void updateContextWithResults(MessageContext messageContext, Vector results) { + Vector handlerResults; + if ((handlerResults = (Vector) messageContext.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) { + handlerResults = new Vector(); messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults); } WSHandlerResult rResult = new WSHandlerResult(validationActor, results); @@ -598,7 +600,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } /** Verifies the trust of a certificate. */ - protected void verifyCertificateTrust(Vector results) throws WSSecurityException { + protected void verifyCertificateTrust(Vector results) throws WSSecurityException { RequestData requestData = new RequestData(); requestData.setSigCrypto(validationSignatureCrypto); WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.SIGN); @@ -613,7 +615,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } /** Verifies the timestamp. */ - protected void verifyTimestamp(Vector results) throws WSSecurityException { + protected void verifyTimestamp(Vector results) throws WSSecurityException { WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.TS); if (actionResult != null) { @@ -626,7 +628,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } } - private void processPrincipal(Vector results) { + private void processPrincipal(Vector results) { WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.UT); if (actionResult != null) { diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/SimplePasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/SimplePasswordValidationCallbackHandler.java index 0b735634..980fcd81 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/SimplePasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/callback/SimplePasswordValidationCallbackHandler.java @@ -17,17 +17,17 @@ package org.springframework.ws.soap.security.wss4j.callback; import java.io.IOException; -import java.util.Iterator; +import java.util.HashMap; import java.util.Map; import java.util.Properties; import javax.security.auth.callback.UnsupportedCallbackException; -import org.apache.ws.security.WSPasswordCallback; -import org.apache.ws.security.WSSecurityException; - import org.springframework.beans.factory.InitializingBean; import org.springframework.util.Assert; +import org.apache.ws.security.WSPasswordCallback; +import org.apache.ws.security.WSSecurityException; + /** * Simple callback handler that validates passwords agains a in-memory Properties object. Password * validation is done on a case-sensitive basis. @@ -40,19 +40,19 @@ import org.springframework.util.Assert; public class SimplePasswordValidationCallbackHandler extends AbstractWsPasswordCallbackHandler implements InitializingBean { - private Properties users = new Properties(); + private Map users = new HashMap(); /** Sets the users to validate against. Property names are usernames, property values are passwords. */ public void setUsers(Properties users) { - this.users = users; + for (Map.Entry entry : users.entrySet()) { + if (entry.getKey() instanceof String && entry.getValue() instanceof String) { + this.users.put((String) entry.getKey(), (String) entry.getValue()); + } + } } - public void setUsersMap(Map users) { - for (Iterator iterator = users.keySet().iterator(); iterator.hasNext();) { - String username = (String) iterator.next(); - String password = (String) users.get(username); - this.users.setProperty(username, password); - } + public void setUsersMap(Map users) { + this.users = users; } public void afterPropertiesSet() throws Exception { @@ -62,14 +62,14 @@ public class SimplePasswordValidationCallbackHandler extends AbstractWsPasswordC @Override protected void handleUsernameToken(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException { String identifier = callback.getIdentifier(); - callback.setPassword(users.getProperty(identifier)); + callback.setPassword(users.get(identifier)); } @Override protected void handleUsernameTokenUnknown(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException { String identifier = callback.getIdentifier(); - String storedPassword = users.getProperty(identifier); + String storedPassword = users.get(identifier); String givenPassword = callback.getPassword(); if (storedPassword == null || !storedPassword.equals(givenPassword)) { throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION); diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/support/CryptoFactoryBean.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/support/CryptoFactoryBean.java index 1e95da64..4c96039a 100755 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/support/CryptoFactoryBean.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/support/CryptoFactoryBean.java @@ -1,5 +1,5 @@ /* - * Copyright 2006 the original author or authors. + * Copyright 2005-2010 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -20,16 +20,16 @@ import java.io.File; import java.io.IOException; import java.util.Properties; -import org.apache.ws.security.components.crypto.Crypto; -import org.apache.ws.security.components.crypto.CryptoFactory; -import org.apache.ws.security.components.crypto.Merlin; - import org.springframework.beans.factory.BeanClassLoaderAware; import org.springframework.beans.factory.FactoryBean; import org.springframework.beans.factory.InitializingBean; import org.springframework.core.io.Resource; import org.springframework.util.Assert; +import org.apache.ws.security.components.crypto.Crypto; +import org.apache.ws.security.components.crypto.CryptoFactory; +import org.apache.ws.security.components.crypto.Merlin; + /** * Spring factory bean for a WSS4J {@link Crypto}. Allows for strong-typed property configuration, or configuration * through {@link Properties}. @@ -42,7 +42,7 @@ import org.springframework.util.Assert; * @see org.apache.ws.security.components.crypto.Crypto * @since 1.5.0 */ -public class CryptoFactoryBean implements FactoryBean, BeanClassLoaderAware, InitializingBean { +public class CryptoFactoryBean implements FactoryBean, BeanClassLoaderAware, InitializingBean { private Properties configuration = new Properties(); @@ -71,7 +71,7 @@ public class CryptoFactoryBean implements FactoryBean, BeanClassLoaderAware, Ini * * @param cryptoProviderClass the crypto provider class */ - public void setCryptoProvider(Class cryptoProviderClass) { + public void setCryptoProvider(Class cryptoProviderClass) { this.configuration.setProperty(CRYPTO_PROVIDER_PROPERTY, cryptoProviderClass.getName()); } @@ -160,7 +160,7 @@ public class CryptoFactoryBean implements FactoryBean, BeanClassLoaderAware, Ini this.crypto = CryptoFactory.getInstance(configuration, classLoader); } - public Class getObjectType() { + public Class getObjectType() { return Crypto.class; } @@ -168,7 +168,7 @@ public class CryptoFactoryBean implements FactoryBean, BeanClassLoaderAware, Ini return true; } - public Object getObject() throws Exception { + public Crypto getObject() throws Exception { return crypto; } diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandler.java index 8b6ae1fa..12fc0c1d 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandler.java @@ -35,6 +35,9 @@ import java.util.Arrays; import java.util.Enumeration; import javax.crypto.SecretKey; +import org.springframework.beans.factory.InitializingBean; +import org.springframework.ws.soap.security.support.KeyStoreUtils; + import com.sun.xml.wss.impl.callback.CertificateValidationCallback; import com.sun.xml.wss.impl.callback.DecryptionKeyCallback; import com.sun.xml.wss.impl.callback.EncryptionKeyCallback; @@ -42,9 +45,6 @@ import com.sun.xml.wss.impl.callback.SignatureKeyCallback; import com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback; import org.apache.xml.security.utils.RFC2253Parser; -import org.springframework.beans.factory.InitializingBean; -import org.springframework.ws.soap.security.support.KeyStoreUtils; - /** * Callback handler that uses Java Security KeyStores to handle cryptographic callbacks. Allows for * specific key stores to be set for various cryptographic operations. @@ -135,9 +135,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme private static X509Certificate getCertificate(PublicKey pk, KeyStore store) throws IOException { try { - Enumeration aliases = store.aliases(); + Enumeration aliases = store.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); Certificate cert = store.getCertificate(alias); if (cert == null || !X_509_CERTIFICATE_TYPE.equals(cert.getType())) { continue; @@ -395,9 +395,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme protected X509Certificate getCertificateFromTrustStore(byte[] subjectKeyIdentifier) throws IOException { try { - Enumeration aliases = trustStore.aliases(); + Enumeration aliases = trustStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); Certificate cert = trustStore.getCertificate(alias); if (cert == null || !X_509_CERTIFICATE_TYPE.equals(cert.getType())) { continue; @@ -426,9 +426,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme protected X509Certificate getCertificateFromTrustStore(String issuerName, BigInteger serialNumber) throws IOException { try { - Enumeration aliases = trustStore.aliases(); + Enumeration aliases = trustStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); Certificate cert = trustStore.getCertificate(alias); if (cert == null || !X_509_CERTIFICATE_TYPE.equals(cert.getType())) { continue; @@ -460,9 +460,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme protected PrivateKey getPrivateKey(PublicKey publicKey) throws IOException { try { - Enumeration aliases = keyStore.aliases(); + Enumeration aliases = keyStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); if (keyStore.isKeyEntry(alias)) { // Just returning the first one here return (PrivateKey) keyStore.getKey(alias, privateKeyPassword); @@ -477,9 +477,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme protected PrivateKey getPrivateKey(X509Certificate certificate) throws IOException { try { - Enumeration aliases = keyStore.aliases(); + Enumeration aliases = keyStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); if (!keyStore.isKeyEntry(alias)) { continue; } @@ -497,9 +497,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme protected PrivateKey getPrivateKey(byte[] keyIdentifier) throws IOException { try { - Enumeration aliases = keyStore.aliases(); + Enumeration aliases = keyStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); if (!keyStore.isKeyEntry(alias)) { continue; } @@ -526,9 +526,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme protected PrivateKey getPrivateKey(String issuerName, BigInteger serialNumber) throws IOException { try { - Enumeration aliases = keyStore.aliases(); + Enumeration aliases = keyStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); if (!keyStore.isKeyEntry(alias)) { continue; } @@ -682,9 +682,9 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme return false; } try { - Enumeration aliases = keyStore.aliases(); + Enumeration aliases = keyStore.aliases(); while (aliases.hasMoreElements()) { - String alias = (String) aliases.nextElement(); + String alias = aliases.nextElement(); if (keyStore.isKeyEntry(alias)) { X509Certificate x509Cert = (X509Certificate) keyStore.getCertificate(alias); if (x509Cert != null) { diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java index bff9c55f..e640a3ef 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java @@ -17,19 +17,19 @@ package org.springframework.ws.soap.security.xwss.callback; import java.io.IOException; -import java.util.Iterator; +import java.util.HashMap; import java.util.Map; import java.util.Properties; import javax.security.auth.callback.Callback; import javax.security.auth.callback.UnsupportedCallbackException; -import com.sun.xml.wss.impl.callback.PasswordValidationCallback; -import com.sun.xml.wss.impl.callback.TimestampValidationCallback; - import org.springframework.beans.factory.InitializingBean; import org.springframework.util.Assert; import org.springframework.ws.soap.security.callback.AbstractCallbackHandler; +import com.sun.xml.wss.impl.callback.PasswordValidationCallback; +import com.sun.xml.wss.impl.callback.TimestampValidationCallback; + /** * Simple callback handler that validates passwords agains a in-memory Properties object. Password * validation is done on a case-sensitive basis. @@ -43,10 +43,18 @@ import org.springframework.ws.soap.security.callback.AbstractCallbackHandler; */ public class SimplePasswordValidationCallbackHandler extends AbstractCallbackHandler implements InitializingBean { - private Properties users = new Properties(); + private Map users = new HashMap(); /** Sets the users to validate against. Property names are usernames, property values are passwords. */ public void setUsers(Properties users) { + for (Map.Entry entry : users.entrySet()) { + if (entry.getKey() instanceof String && entry.getValue() instanceof String) { + this.users.put((String) entry.getKey(), (String) entry.getValue()); + } + } + } + + public void setUsersMap(Map users) { this.users = users; } @@ -64,7 +72,7 @@ public class SimplePasswordValidationCallbackHandler extends AbstractCallbackHan else if (passwordCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) { PasswordValidationCallback.DigestPasswordRequest digestPasswordRequest = (PasswordValidationCallback.DigestPasswordRequest) passwordCallback.getRequest(); - String password = users.getProperty(digestPasswordRequest.getUsername()); + String password = users.get(digestPasswordRequest.getUsername()); digestPasswordRequest.setPassword(password); passwordCallback.setValidator(new PasswordValidationCallback.DigestPasswordValidator()); } @@ -78,21 +86,13 @@ public class SimplePasswordValidationCallbackHandler extends AbstractCallbackHan } } - public void setUsersMap(Map users) { - for (Iterator iterator = users.keySet().iterator(); iterator.hasNext();) { - String username = (String) iterator.next(); - String password = (String) users.get(username); - this.users.setProperty(username, password); - } - } - private class SimplePlainTextPasswordValidator implements PasswordValidationCallback.PasswordValidator { public boolean validate(PasswordValidationCallback.Request request) throws PasswordValidationCallback.PasswordValidationException { PasswordValidationCallback.PlainTextPasswordRequest plainTextPasswordRequest = (PasswordValidationCallback.PlainTextPasswordRequest) request; - String password = users.getProperty(plainTextPasswordRequest.getUsername()); + String password = users.get(plainTextPasswordRequest.getUsername()); return password != null && password.equals(plainTextPasswordRequest.getPassword()); } }