Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

#1160 - Update code style.

Browse Source
This commit is contained in:
Greg L. Turnquist
2020-09-29 20:27:41 -05:00
parent 419b0b2180
commit d24b4fb5d5
747 changed files with 8602 additions and 10072 deletions
Download Patch File Download Diff File Expand all files Collapse all files

125
spring-ws-security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java
View File

@@ -18,11 +18,11 @@ package org.springframework.ws.soap.security;
import java.util.Iterator;
import java.util.Locale;
import javax.xml.namespace.QName;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.Assert;
import org.springframework.ws.client.WebServiceClientException;
import org.springframework.ws.client.support.interceptor.ClientInterceptor;
@@ -39,10 +39,11 @@ import org.springframework.ws.soap.soap11.Soap11Body;
/**
* Interceptor base class for interceptors that handle WS-Security. Can be used on the server side, registered in a
* {@link org.springframework.ws.server.endpoint.mapping.AbstractEndpointMapping#setInterceptors(org.springframework.ws.server.EndpointInterceptor[])
* endpoint mapping}; or on the client side, on the {@link org.springframework.ws.client.core.WebServiceTemplate#setInterceptors(ClientInterceptor[])
* web service template}.
*
* <p>Subclasses of this base class can be configured to secure incoming and secure outgoing messages. By default, both are
* endpoint mapping}; or on the client side, on the
* {@link org.springframework.ws.client.core.WebServiceTemplate#setInterceptors(ClientInterceptor[]) web service
* template}.
* <p>
* Subclasses of this base class can be configured to secure incoming and secure outgoing messages. By default, both are
* on.
*
* @author Arjen Poutsma
@@ -53,8 +54,8 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
/** Logger available to subclasses. */
protected final Log logger = LogFactory.getLog(getClass());
protected static final QName WS_SECURITY_NAME =
new QName("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security");
protected static final QName WS_SECURITY_NAME = new QName(
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security");
private boolean secureResponse = true;
@@ -63,7 +64,7 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
private boolean secureRequest = true;
private boolean validateResponse = true;
private boolean skipValidationIfNoHeaderPresent = false;
private EndpointExceptionResolver exceptionResolver;
@@ -94,8 +95,7 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/** Allows skipping validation if no security header is present. */
public void setSkipValidationIfNoHeaderPresent(
boolean skipValidationIfNoHeaderPresent) {
public void setSkipValidationIfNoHeaderPresent(boolean skipValidationIfNoHeaderPresent) {
this.skipValidationIfNoHeaderPresent = skipValidationIfNoHeaderPresent;
}
@@ -104,11 +104,12 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
*/
/**
* Validates a server-side incoming request. Delegates to {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setValidateRequest(boolean) validateRequest} property is {@code true}.
* Validates a server-side incoming request. Delegates to
* {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setValidateRequest(boolean) validateRequest} property is {@code true}.
*
* @param messageContext the message context, containing the request to be validated
* @param endpoint chosen endpoint to invoke
* @param endpoint chosen endpoint to invoke
* @return {@code true} if the request was valid; {@code false} otherwise.
* @throws Exception in case of errors
* @see #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)
@@ -117,31 +118,29 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
public final boolean handleRequest(MessageContext messageContext, Object endpoint) throws Exception {
if (validateRequest) {
Assert.isInstanceOf(SoapMessage.class, messageContext.getRequest());
if(skipValidationIfNoHeaderPresent && !isSecurityHeaderPresent((SoapMessage) messageContext.getRequest())){
if (skipValidationIfNoHeaderPresent && !isSecurityHeaderPresent((SoapMessage) messageContext.getRequest())) {
return true;
}
try {
validateMessage((SoapMessage) messageContext.getRequest(), messageContext);
return true;
}
catch (WsSecurityValidationException ex) {
} catch (WsSecurityValidationException ex) {
return handleValidationException(ex, messageContext);
}
catch (WsSecurityFaultException ex) {
} catch (WsSecurityFaultException ex) {
return handleFaultException(ex, messageContext);
}
}
else {
} else {
return true;
}
}
/**
* Secures a server-side outgoing response. Delegates to {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setSecureResponse(boolean) secureResponse} property is {@code true}.
* Secures a server-side outgoing response. Delegates to
* {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setSecureResponse(boolean) secureResponse} property is {@code true}.
*
* @param messageContext the message context, containing the response to be secured
* @param endpoint chosen endpoint to invoke
* @param endpoint chosen endpoint to invoke
* @return {@code true} if the response was secured; {@code false} otherwise.
* @throws Exception in case of errors
* @see #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)
@@ -155,16 +154,13 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
Assert.isInstanceOf(SoapMessage.class, messageContext.getResponse());
try {
secureMessage((SoapMessage) messageContext.getResponse(), messageContext);
}
catch (WsSecuritySecurementException ex) {
} catch (WsSecuritySecurementException ex) {
result = handleSecurementException(ex, messageContext);
}
catch (WsSecurityFaultException ex) {
} catch (WsSecurityFaultException ex) {
result = handleFaultException(ex, messageContext);
}
}
}
finally {
} finally {
if (!result) {
messageContext.clearResponse();
}
@@ -178,7 +174,6 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
return true;
}
@Override
public void afterCompletion(MessageContext messageContext, Object endpoint, Exception ex) {
cleanUp();
@@ -194,8 +189,9 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
*/
/**
* Secures a client-side outgoing request. Delegates to {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setSecureRequest(boolean) secureRequest} property is {@code true}.
* Secures a client-side outgoing request. Delegates to
* {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setSecureRequest(boolean) secureRequest} property is {@code true}.
*
* @param messageContext the message context, containing the request to be secured
* @return {@code true} if the response was secured; {@code false} otherwise.
@@ -209,22 +205,20 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
try {
secureMessage((SoapMessage) messageContext.getRequest(), messageContext);
return true;
}
catch (WsSecuritySecurementException ex) {
} catch (WsSecuritySecurementException ex) {
return handleSecurementException(ex, messageContext);
}
catch (WsSecurityFaultException ex) {
} catch (WsSecurityFaultException ex) {
return handleFaultException(ex, messageContext);
}
}
else {
} else {
return true;
}
}
/**
* Validates a client-side incoming response. Delegates to {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setValidateResponse(boolean) validateResponse} property is {@code true}.
* Validates a client-side incoming response. Delegates to
* {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setValidateResponse(boolean) validateResponse} property is {@code true}.
*
* @param messageContext the message context, containing the response to be validated
* @return {@code true} if the request was valid; {@code false} otherwise.
@@ -236,21 +230,18 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
if (validateResponse) {
Assert.isTrue(messageContext.hasResponse(), "MessageContext contains no response");
Assert.isInstanceOf(SoapMessage.class, messageContext.getResponse());
if(skipValidationIfNoHeaderPresent && !isSecurityHeaderPresent((SoapMessage) messageContext.getRequest())){
if (skipValidationIfNoHeaderPresent && !isSecurityHeaderPresent((SoapMessage) messageContext.getRequest())) {
return true;
}
try {
validateMessage((SoapMessage) messageContext.getResponse(), messageContext);
return true;
}
catch (WsSecurityValidationException ex) {
} catch (WsSecurityValidationException ex) {
return handleValidationException(ex, messageContext);
}
catch (WsSecurityFaultException ex) {
} catch (WsSecurityFaultException ex) {
return handleFaultException(ex, messageContext);
}
}
else {
} else {
return true;
}
}
@@ -262,16 +253,14 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
@Override
public void afterCompletion(MessageContext messageContext, Exception ex)
throws WebServiceClientException {
public void afterCompletion(MessageContext messageContext, Exception ex) throws WebServiceClientException {
cleanUp();
}
/**
* Handles an securement exception. Default implementation logs the given exception, and returns
* {@code false}.
* Handles an securement exception. Default implementation logs the given exception, and returns {@code false}.
*
* @param ex the validation exception
* @param ex the validation exception
* @param messageContext the message context
* @return {@code true} to continue processing the message, {@code false} (the default) otherwise
*/
@@ -283,11 +272,11 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/**
* Handles an invalid SOAP message. Default implementation logs the given exception, delegates to the set {@link
* #setExceptionResolver(EndpointExceptionResolver) exceptionResolver} if any, or creates a SOAP 1.1 Client or SOAP
* 1.2 Sender Fault with the exception message as fault string, and returns {@code false}.
* Handles an invalid SOAP message. Default implementation logs the given exception, delegates to the set
* {@link #setExceptionResolver(EndpointExceptionResolver) exceptionResolver} if any, or creates a SOAP 1.1 Client or
* SOAP 1.2 Sender Fault with the exception message as fault string, and returns {@code false}.
*
* @param ex the validation exception
* @param ex the validation exception
* @param messageContext the message context
* @return {@code true} to continue processing the message, {@code false} (the default) otherwise
*/
@@ -297,8 +286,7 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
if (exceptionResolver != null) {
exceptionResolver.resolveException(messageContext, null, ex);
}
else {
} else {
if (logger.isDebugEnabled()) {
logger.debug("No exception resolver present, creating basic soap fault");
}
@@ -312,7 +300,7 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
* Handles a fault exception.Default implementation logs the given exception, and creates a SOAP Fault with the
* properties of the given exception, and returns {@code false}.
*
* @param ex the validation exception
* @param ex the validation exception
* @param messageContext the message context
* @return {@code true} to continue processing the message, {@code false} (the default) otherwise
*/
@@ -324,8 +312,7 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
SoapFault fault;
if (response instanceof Soap11Body) {
fault = ((Soap11Body) response).addFault(ex.getFaultCode(), ex.getFaultString(), Locale.ENGLISH);
}
else {
} else {
fault = response.addClientOrSenderFault(ex.getFaultString(), Locale.ENGLISH);
}
fault.setFaultActorOrRole(ex.getFaultActor());
@@ -333,8 +320,8 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/**
* Abstract template method. Subclasses are required to validate the request contained in the given {@link
* SoapMessage}, and replace the original request with the validated version.
* Abstract template method. Subclasses are required to validate the request contained in the given
* {@link SoapMessage}, and replace the original request with the validated version.
*
* @param soapMessage the soap message to validate
* @throws WsSecurityValidationException in case of validation errors
@@ -343,8 +330,8 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
throws WsSecurityValidationException;
/**
* Abstract template method. Subclasses are required to secure the response contained in the given {@link
* SoapMessage}, and replace the original response with the secured version.
* Abstract template method. Subclasses are required to secure the response contained in the given
* {@link SoapMessage}, and replace the original response with the secured version.
*
* @param soapMessage the soap message to secure
* @throws WsSecuritySecurementException in case of securement errors
@@ -355,17 +342,17 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
protected abstract void cleanUp();
/**
* Iterates over header elements and returns true if WS-Security header is found.
* Iterates over header elements and returns true if WS-Security header is found.
*/
private boolean isSecurityHeaderPresent(SoapMessage message) {
SoapHeader soapHeader = message.getSoapHeader();
if(soapHeader == null){
if (soapHeader == null) {
return false;
}
Iterator<SoapHeaderElement> elements = soapHeader.examineAllHeaderElements();
while(elements.hasNext()){
while (elements.hasNext()) {
SoapHeaderElement e = elements.next();
if(e.getName().equals(WS_SECURITY_NAME)){
if (e.getName().equals(WS_SECURITY_NAME)) {
return true;
}
}

4
spring-ws-security/src/main/java/org/springframework/ws/soap/security/WsSecuritySecurementException.java
View File

@@ -18,8 +18,8 @@ package org.springframework.ws.soap.security;
/**
* Exception indicating that something went wrong during the securement of a message.
*
* <p>This is a checked exception since we want it to be caught, logged and handled rather than cause the application to
* <p>
* This is a checked exception since we want it to be caught, logged and handled rather than cause the application to
* fail. Failure to secure a message is usually not a fatal problem.
*
* @author Arjen Poutsma

4
spring-ws-security/src/main/java/org/springframework/ws/soap/security/WsSecurityValidationException.java
View File

@@ -18,8 +18,8 @@ package org.springframework.ws.soap.security;
/**
* Exception indicating that something went wrong during the validation of a message.
*
* <p>This is a checked exception since we want it to be caught, logged and handled rather than cause the application to
* <p>
* This is a checked exception since we want it to be caught, logged and handled rather than cause the application to
* fail. Failure to validate a message is usually not a fatal problem.
*
* @author Arjen Poutsma

4
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/AbstractCallbackHandler.java
View File

@@ -17,6 +17,7 @@
package org.springframework.ws.soap.security.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -35,8 +36,7 @@ public abstract class AbstractCallbackHandler implements CallbackHandler {
/** Logger available to subclasses. */
protected final Log logger = LogFactory.getLog(getClass());
protected AbstractCallbackHandler() {
}
protected AbstractCallbackHandler() {}
/**
* Iterates over the given callbacks, and calls {@code handleInternal} for each of them.

8
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java
View File

@@ -17,6 +17,7 @@
package org.springframework.ws.soap.security.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -45,10 +46,9 @@ public class CallbackHandlerChain extends AbstractCallbackHandler {
boolean allUnsupported = true;
for (CallbackHandler callbackHandler : callbackHandlers) {
try {
callbackHandler.handle(new Callback[]{callback});
callbackHandler.handle(new Callback[] { callback });
allUnsupported = false;
}
catch (UnsupportedCallbackException ex) {
} catch (UnsupportedCallbackException ex) {
// if an UnsupportedCallbackException occurs, go to the next handler
}
}
@@ -56,4 +56,4 @@ public class CallbackHandlerChain extends AbstractCallbackHandler {
throw new UnsupportedCallbackException(callback);
}
}
}
}

5
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/CleanupCallback.java
View File

@@ -17,11 +17,12 @@
package org.springframework.ws.soap.security.callback;
import java.io.Serializable;
import javax.security.auth.callback.Callback;
/**
* Underlying security services instantiate and pass a {@code CleanupCallback} to the {@code handle} method of
* a {@code CallbackHandler} to clean up security state.
* Underlying security services instantiate and pass a {@code CleanupCallback} to the {@code handle} method of a
* {@code CallbackHandler} to clean up security state.
*
* @author Arjen Poutsma
* @since 1.0.4

14
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/KeyManagersFactoryBean.java
View File

@@ -17,6 +17,7 @@
package org.springframework.ws.soap.security.support;
import java.security.KeyStore;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
@@ -26,8 +27,8 @@ import org.springframework.util.StringUtils;
/**
* Spring factory bean for an array of {@link KeyManager}s.
*
* <p>Uses the {@link KeyManagerFactory} to create the {@code KeyManager}s.
* <p>
* Uses the {@link KeyManagerFactory} to create the {@code KeyManager}s.
*
* @author Stephen More
* @author Arjen Poutsma
@@ -99,12 +100,11 @@ public class KeyManagersFactoryBean implements FactoryBean<KeyManager[]>, Initia
@Override
public void afterPropertiesSet() throws Exception {
String algorithm =
StringUtils.hasLength(this.algorithm) ? this.algorithm : KeyManagerFactory.getDefaultAlgorithm();
String algorithm = StringUtils.hasLength(this.algorithm) ? this.algorithm : KeyManagerFactory.getDefaultAlgorithm();
KeyManagerFactory keyManagerFactory =
StringUtils.hasLength(this.provider) ? KeyManagerFactory.getInstance(algorithm, this.provider) :
KeyManagerFactory.getInstance(algorithm);
KeyManagerFactory keyManagerFactory = StringUtils.hasLength(this.provider)
? KeyManagerFactory.getInstance(algorithm, this.provider)
: KeyManagerFactory.getInstance(algorithm);
keyManagerFactory.init(keyStore, password);

19
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java
View File

@@ -23,7 +23,6 @@ import java.security.KeyStore;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.FactoryBean;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.core.io.Resource;
@@ -31,9 +30,9 @@ import org.springframework.util.StringUtils;
/**
* Spring factory bean for a {@link KeyStore}.
*
* <p>To load an existing key store, you must set the {@code location} property. If this property is not set, a new,
* empty key store is created, which is most likely not what you want.
* <p>
* To load an existing key store, you must set the {@code location} property. If this property is not set, a new, empty
* key store is created, which is most likely not what you want.
*
* @author Arjen Poutsma
* @see #setLocation(org.springframework.core.io.Resource)
@@ -106,11 +105,9 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
public final void afterPropertiesSet() throws GeneralSecurityException, IOException {
if (StringUtils.hasLength(provider) && StringUtils.hasLength(type)) {
keyStore = KeyStore.getInstance(type, provider);
}
else if (StringUtils.hasLength(type)) {
} else if (StringUtils.hasLength(type)) {
keyStore = KeyStore.getInstance(type);
}
else {
} else {
keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
}
InputStream is = null;
@@ -120,13 +117,11 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
if (logger.isInfoEnabled()) {
logger.info("Loading key store from " + location);
}
}
else if (logger.isWarnEnabled()) {
} else if (logger.isWarnEnabled()) {
logger.warn("Creating empty key store");
}
keyStore.load(is, password);
}
finally {
} finally {
if (is != null) {
is.close();
}

41
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreUtils.java
View File

@@ -37,14 +37,14 @@ public abstract class KeyStoreUtils {
* Loads the key store indicated by system properties. This method tries to load a key store by consulting the
* following system properties:{@code javax.net.ssl.keyStore}, {@code javax.net.ssl.keyStorePassword}, and
* {@code javax.net.ssl.keyStoreType}.
*
* <p>If these properties specify a file with an appropriate password, the factory uses this file for the key store. If
* <p>
* If these properties specify a file with an appropriate password, the factory uses this file for the key store. If
* that file does not exist, then a default, empty keystore is created.
*
* <p>This behavior corresponds to the standard J2SDK behavior for SSL key stores.
* <p>
* This behavior corresponds to the standard J2SDK behavior for SSL key stores.
*
* @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509KeyManager">The
* standard J2SDK SSL key store mechanism</a>
* standard J2SDK SSL key store mechanism</a>
*/
public static KeyStore loadDefaultKeyStore() throws GeneralSecurityException, IOException {
Resource location = null;
@@ -72,21 +72,23 @@ public abstract class KeyStoreUtils {
}
/**
* Loads a default trust store. This method uses the following algorithm: <ol> <li> If the system property
* {@code javax.net.ssl.trustStore} is defined, its value is loaded. If the
* {@code javax.net.ssl.trustStorePassword} system property is also defined, its value is used as a password.
* If the {@code javax.net.ssl.trustStoreType} system property is defined, its value is used as a key store
* type.
*
* <p>If {@code javax.net.ssl.trustStore} is defined but the specified file does not exist, then a default, empty
* trust store is created. </li> <li> If the {@code javax.net.ssl.trustStore} system property was not
* specified, but if the file {@code $JAVA_HOME/lib/security/jssecacerts} exists, that file is used. </li>
* Otherwise, <li>If the file {@code $JAVA_HOME/lib/security/cacerts} exists, that file is used. </ol>
*
* <p>This behavior corresponds to the standard J2SDK behavior for SSL trust stores.
* Loads a default trust store. This method uses the following algorithm:
* <ol>
* <li>If the system property {@code javax.net.ssl.trustStore} is defined, its value is loaded. If the
* {@code javax.net.ssl.trustStorePassword} system property is also defined, its value is used as a password. If the
* {@code javax.net.ssl.trustStoreType} system property is defined, its value is used as a key store type.
* <p>
* If {@code javax.net.ssl.trustStore} is defined but the specified file does not exist, then a default, empty trust
* store is created.</li>
* <li>If the {@code javax.net.ssl.trustStore} system property was not specified, but if the file
* {@code $JAVA_HOME/lib/security/jssecacerts} exists, that file is used.</li> Otherwise,
* <li>If the file {@code $JAVA_HOME/lib/security/cacerts} exists, that file is used.
* </ol>
* <p>
* This behavior corresponds to the standard J2SDK behavior for SSL trust stores.
*
* @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509TrustManager">The
* standard J2SDK SSL trust store mechanism</a>
* standard J2SDK SSL trust store mechanism</a>
*/
public static KeyStore loadDefaultTrustStore() throws GeneralSecurityException, IOException {
Resource location = null;
@@ -103,8 +105,7 @@ public abstract class KeyStoreUtils {
password = passwordProperty;
}
type = System.getProperty("javax.net.ssl.trustStoreType");
}
else {
} else {
String javaHome = System.getProperty("java.home");
location = new FileSystemResource(javaHome + "/lib/security/jssecacerts");
if (!location.exists()) {

1
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/SpringSecurityUtils.java
View File

@@ -32,6 +32,7 @@ public abstract class SpringSecurityUtils {
/**
* Checks the validity of a user's account and credentials.
*
* @param user the user to check
* @throws AccountExpiredException if the account has expired
* @throws CredentialsExpiredException if the credentials have expired

26
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/TrustManagersFactoryBean.java
View File

@@ -17,6 +17,7 @@
package org.springframework.ws.soap.security.support;
import java.security.KeyStore;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
@@ -26,16 +27,15 @@ import org.springframework.util.StringUtils;
/**
* Spring factory bean for an array of {@link TrustManager}s.
*
* <p>Uses the {@link TrustManagerFactory} to create the {@code TrustManager}s.
* <p>
* Uses the {@link TrustManagerFactory} to create the {@code TrustManager}s.
*
* @author Arjen Poutsma
* @see TrustManager
* @see TrustManagerFactory
* @since 2.2
*/
public class TrustManagersFactoryBean
implements FactoryBean<TrustManager[]>, InitializingBean {
public class TrustManagersFactoryBean implements FactoryBean<TrustManager[]>, InitializingBean {
private TrustManager[] trustManagers;
@@ -46,16 +46,15 @@ public class TrustManagersFactoryBean
private String provider;
/**
* Sets the provider of the trust manager to use. If this is not set, the default is
* used.
* Sets the provider of the trust manager to use. If this is not set, the default is used.
*/
public void setProvider(String provider) {
this.provider = provider;
}
/**
* Sets the algorithm of the {@code TrustManager} to use. If this is not set, the
* default is used.
* Sets the algorithm of the {@code TrustManager} to use. If this is not set, the default is used.
*
* @see TrustManagerFactory#getDefaultAlgorithm()
*/
public void setAlgorithm(String algorithm) {
@@ -64,6 +63,7 @@ public class TrustManagersFactoryBean
/**
* Sets the source of certificate authorities and related trust material.
*
* @see TrustManagerFactory#init(KeyStore)
*/
public void setKeyStore(KeyStore keyStore) {
@@ -87,12 +87,12 @@ public class TrustManagersFactoryBean
@Override
public void afterPropertiesSet() throws Exception {
String algorithm = StringUtils.hasLength(this.algorithm) ? this.algorithm :
TrustManagerFactory.getDefaultAlgorithm();
String algorithm = StringUtils.hasLength(this.algorithm) ? this.algorithm
: TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory trustManagerFactory = StringUtils.hasLength(this.provider) ?
TrustManagerFactory.getInstance(algorithm, this.provider) :
TrustManagerFactory.getInstance(algorithm);
TrustManagerFactory trustManagerFactory = StringUtils.hasLength(this.provider)
? TrustManagerFactory.getInstance(algorithm, this.provider)
: TrustManagerFactory.getInstance(algorithm);
trustManagerFactory.init(keyStore);

13
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java
View File

@@ -26,9 +26,8 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
import org.apache.wss4j.dom.handler.HandlerAction;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.handler.WSHandler;
import org.w3c.dom.Document;
import org.springframework.ws.context.MessageContext;
import org.w3c.dom.Document;
/**
* @author Tareq Abed Rabbo
@@ -52,14 +51,10 @@ class Wss4jHandler extends WSHandler {
options.setProperty(ConfigurationConstants.MUST_UNDERSTAND, Boolean.toString(true));
options.setProperty(ConfigurationConstants.ENABLE_SIGNATURE_CONFIRMATION, Boolean.toString(true));
}
@Override
public void doSenderAction(
Document doc,
RequestData reqData,
List<HandlerAction> actions,
boolean isRequest) throws WSSecurityException
{
public void doSenderAction(Document doc, RequestData reqData, List<HandlerAction> actions, boolean isRequest)
throws WSSecurityException {
super.doSenderAction(doc, reqData, actions, isRequest);
}

390
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
View File

@@ -22,6 +22,7 @@ import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -43,9 +44,6 @@ import org.apache.wss4j.dom.util.WSSecurityUtil;
import org.apache.wss4j.dom.validate.Credential;
import org.apache.wss4j.dom.validate.SignatureTrustValidator;
import org.apache.wss4j.dom.validate.TimestampValidator;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
import org.springframework.util.CollectionUtils;
@@ -58,40 +56,80 @@ import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.springframework.ws.soap.security.callback.CallbackHandlerChain;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.wss4j2.callback.UsernameTokenPrincipalCallback;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
/**
* A WS-Security endpoint interceptor based on Apache's WSS4J. This interceptor supports messages created by the {@link
* org.springframework.ws.soap.axiom.AxiomSoapMessageFactory} and the {@link org.springframework.ws.soap.saaj.SaajSoapMessageFactory}.
*
* <p>The validation and securement actions executed by this interceptor are configured via {@code validationActions}
* and {@code securementActions} properties, respectively. Actions should be passed as a space-separated strings.
*
* <p>Valid <strong>validation</strong> actions are:
*
* <blockquote>
* <table>
* <tr><th>Validation action</th><th>Description</th></tr>
* <tr><td>{@code UsernameToken}</td><td>Validates username token</td></tr>
* <tr><td>{@code Timestamp}</td><td>Validates the timestamp</td></tr>
* <tr><td>{@code Encrypt}</td><td>Decrypts the message</td></tr>
* <tr><td>{@code Signature}</td><td>Validates the signature</td></tr>
* <tr><td>{@code NoSecurity}</td><td>No action performed</td></tr>
* </table></blockquote>
* A WS-Security endpoint interceptor based on Apache's WSS4J. This interceptor supports messages created by the
* {@link org.springframework.ws.soap.axiom.AxiomSoapMessageFactory} and the
* {@link org.springframework.ws.soap.saaj.SaajSoapMessageFactory}.
* <p>
* <strong>Securement</strong> actions are:
*
* <blockquote>
* The validation and securement actions executed by this interceptor are configured via {@code validationActions} and
* {@code securementActions} properties, respectively. Actions should be passed as a space-separated strings.
* <p>
* Valid <strong>validation</strong> actions are: <blockquote>
* <table>
* <tr><th>Securement action</th><th>Description</th></tr>
* <tr><td>{@code UsernameToken}</td><td>Adds a username token</td></tr>
* <tr><td>{@code UsernameTokenSignature}</td><td>Adds a username token and a signature username token secret key</td></tr>
* <tr><td>{@code Timestamp}</td><td>Adds a timestamp</td></tr>
* <tr><td>{@code Encrypt}</td><td>Encrypts the response</td></tr>
* <tr><td>{@code Signature}</td><td>Signs the response</td></tr>
* <tr><td>{@code NoSecurity}</td><td>No action performed</td></tr>
* </table></blockquote>
*
* <p>The order of the actions that the client performed to secure the messages is significant and is enforced by the
* <tr>
* <th>Validation action</th>
* <th>Description</th>
* </tr>
* <tr>
* <td>{@code UsernameToken}</td>
* <td>Validates username token</td>
* </tr>
* <tr>
* <td>{@code Timestamp}</td>
* <td>Validates the timestamp</td>
* </tr>
* <tr>
* <td>{@code Encrypt}</td>
* <td>Decrypts the message</td>
* </tr>
* <tr>
* <td>{@code Signature}</td>
* <td>Validates the signature</td>
* </tr>
* <tr>
* <td>{@code NoSecurity}</td>
* <td>No action performed</td>
* </tr>
* </table>
* </blockquote>
* <p>
* <strong>Securement</strong> actions are: <blockquote>
* <table>
* <tr>
* <th>Securement action</th>
* <th>Description</th>
* </tr>
* <tr>
* <td>{@code UsernameToken}</td>
* <td>Adds a username token</td>
* </tr>
* <tr>
* <td>{@code UsernameTokenSignature}</td>
* <td>Adds a username token and a signature username token secret key</td>
* </tr>
* <tr>
* <td>{@code Timestamp}</td>
* <td>Adds a timestamp</td>
* </tr>
* <tr>
* <td>{@code Encrypt}</td>
* <td>Encrypts the response</td>
* </tr>
* <tr>
* <td>{@code Signature}</td>
* <td>Signs the response</td>
* </tr>
* <tr>
* <td>{@code NoSecurity}</td>
* <td>No action performed</td>
* </tr>
* </table>
* </blockquote>
* <p>
* The order of the actions that the client performed to secure the messages is significant and is enforced by the
* interceptor.
*
* @author Tareq Abed Rabbo
@@ -130,7 +168,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
private int securementTimeToLive = 300;
private int futureTimeToLive = 60;
private WSSConfig wssConfig;
private final Wss4jHandler handler = new Wss4jHandler();
@@ -142,9 +180,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
private boolean bspCompliant;
private boolean securementUseDerivedKey;
private CallbackHandler samlCallbackHandler;
// Allow RSA 15 to maintain default behavior
private boolean allowRSA15KeyTransportAlgorithm = true;
@@ -160,6 +198,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Inject a customize {@link WSSecurityEngine}.
*
* @param securityEngine
*/
public Wss4jSecurityInterceptor(WSSecurityEngine securityEngine) {
@@ -172,10 +211,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* The actor name of the {@code wsse:Security} header.
*
* <p>If this parameter is omitted, the actor name is not set.
*
* <p>The value of the actor or role has to match the receiver's setting or may contain standard values.
* <p>
* If this parameter is omitted, the actor name is not set.
* <p>
* The value of the actor or role has to match the receiver's setting or may contain standard values.
*/
public void setSecurementActor(String securementActor) {
handler.setOption(WSHandlerConstants.ACTOR, securementActor);
@@ -184,21 +223,21 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
public void setSecurementEncryptionCrypto(Crypto securementEncryptionCrypto) {
handler.setSecurementEncryptionCrypto(securementEncryptionCrypto);
}
/**
* Defines which key identifier type to use. The WS-Security specifications recommends to use the identifier type
* {@code IssuerSerial}. For possible encryption key identifier types refer to {@link
* org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For encryption {@code IssuerSerial},
* {@code X509KeyIdentifier}, {@code DirectReference}, {@code Thumbprint},
* {@code SKIKeyIdentifier}, and {@code EmbeddedKeyName} are valid only.
* {@code IssuerSerial}. For possible encryption key identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For encryption {@code IssuerSerial},
* {@code X509KeyIdentifier}, {@code DirectReference}, {@code Thumbprint}, {@code SKIKeyIdentifier}, and
* {@code EmbeddedKeyName} are valid only.
*/
public void setSecurementEncryptionKeyIdentifier(String securementEncryptionKeyIdentifier) {
handler.setOption(WSHandlerConstants.ENC_KEY_ID, securementEncryptionKeyIdentifier);
}
/**
* Defines which algorithm to use to encrypt the generated symmetric key. Currently WSS4J supports {@link
* WSConstants#KEYTRANSPORT_RSA15} and {@link WSConstants#KEYTRANSPORT_RSAOEP}.
* Defines which algorithm to use to encrypt the generated symmetric key. Currently WSS4J supports
* {@link WSConstants#KEYTRANSPORT_RSA15} and {@link WSConstants#KEYTRANSPORT_RSAOEP}.
*/
public void setSecurementEncryptionKeyTransportAlgorithm(String securementEncryptionKeyTransportAlgorithm) {
handler.setOption(WSHandlerConstants.ENC_KEY_TRANSPORT, securementEncryptionKeyTransportAlgorithm);
@@ -206,43 +245,45 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Property to define which parts of the request shall be encrypted.
*
* <p>The value of this property is a list of semicolon separated element names that identify the elements to encrypt.
* An encryption mode specifier and a namespace identification, each inside a pair of curly brackets, may precede
* each element name.
*
* <p>The encryption mode specifier is either {@code {Content}} or {@code {Element}}. Please refer to the W3C
* XML Encryption specification about the differences between Element and Content encryption. The encryption mode
* defaults to {@code Content} if it is omitted. Example of a list:
* <p>
* The value of this property is a list of semicolon separated element names that identify the elements to encrypt. An
* encryption mode specifier and a namespace identification, each inside a pair of curly brackets, may precede each
* element name.
* <p>
* The encryption mode specifier is either {@code {Content}} or {@code {Element}}. Please refer to the W3C XML
* Encryption specification about the differences between Element and Content encryption. The encryption mode defaults
* to {@code Content} if it is omitted. Example of a list:
*
* <pre>
* &lt;property name="securementEncryptionParts"
* value="{Content}{http://example.org/paymentv2}CreditCard;
* {Element}{}UserName" />
* </pre>
*
* The first entry of the list identifies the element {@code CreditCard} in the namespace
* {@code http://example.org/paymentv2}, and will encrypt its content. Be aware that the element name, the
* namespace identifier, and the encryption modifier are case sensitive.
*
* <p>The encryption modifier and the namespace identifier can be omitted. In this case the encryption mode defaults to
* {@code http://example.org/paymentv2}, and will encrypt its content. Be aware that the element name, the namespace
* identifier, and the encryption modifier are case sensitive.
* <p>
* The encryption modifier and the namespace identifier can be omitted. In this case the encryption mode defaults to
* {@code Content} and the namespace is set to the SOAP namespace.
*
* <p>An empty encryption mode defaults to {@code Content}, an empty namespace identifier defaults to the SOAP
* namespace. The second line of the example defines {@code Element} as encryption mode for an
* {@code UserName} element in the SOAP namespace.
*
* <p>To specify an element without a namespace use the string {@code Null} as the namespace name (this is a case
* <p>
* An empty encryption mode defaults to {@code Content}, an empty namespace identifier defaults to the SOAP namespace.
* The second line of the example defines {@code Element} as encryption mode for an {@code UserName} element in the
* SOAP namespace.
* <p>
* To specify an element without a namespace use the string {@code Null} as the namespace name (this is a case
* sensitive string)
*
* <p>If no list is specified, the handler encrypts the SOAP Body in {@code Content} mode by default.
* <p>
* If no list is specified, the handler encrypts the SOAP Body in {@code Content} mode by default.
*/
public void setSecurementEncryptionParts(String securementEncryptionParts) {
handler.setOption(WSHandlerConstants.ENCRYPTION_PARTS, securementEncryptionParts);
}
/**
* Defines which symmetric encryption algorithm to use. WSS4J supports the following alorithms: {@link
* WSConstants#TRIPLE_DES}, {@link WSConstants#AES_128}, {@link WSConstants#AES_256}, and {@link
* WSConstants#AES_192}. Except for AES 192 all of these algorithms are required by the XML Encryption
* Defines which symmetric encryption algorithm to use. WSS4J supports the following alorithms:
* {@link WSConstants#TRIPLE_DES}, {@link WSConstants#AES_128}, {@link WSConstants#AES_256}, and
* {@link WSConstants#AES_192}. Except for AES 192 all of these algorithms are required by the XML Encryption
* specification.
*/
public void setSecurementEncryptionSymAlgorithm(String securementEncryptionSymAlgorithm) {
@@ -251,19 +292,19 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* The user's name for encryption.
*
* <p>The encryption functions uses the public key of this user's certificate to encrypt the generated symmetric key.
*
* <p>If this parameter is not set, then the encryption function falls back to the {@link
* org.apache.ws.security.handler.WSHandlerConstants#USER} parameter to get the certificate.
*
* <p>If <b>only</b> encryption of the SOAP body data is requested, it is recommended to use this parameter to define
* the username. The application can then use the standard user and password functions (see example at {@link
* org.apache.ws.security.handler.WSHandlerConstants#USER} to enable HTTP authentication functions.
*
* <p>Encryption only does not authenticate a user / sender, therefore it does not need a password.
*
* <p>Placing the username of the encryption certificate in the configuration file is not a security risk, because the
* <p>
* The encryption functions uses the public key of this user's certificate to encrypt the generated symmetric key.
* <p>
* If this parameter is not set, then the encryption function falls back to the
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} parameter to get the certificate.
* <p>
* If <b>only</b> encryption of the SOAP body data is requested, it is recommended to use this parameter to define the
* username. The application can then use the standard user and password functions (see example at
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} to enable HTTP authentication functions.
* <p>
* Encryption only does not authenticate a user / sender, therefore it does not need a password.
* <p>
* Placing the username of the encryption certificate in the configuration file is not a security risk, because the
* public key of that certificate is used only.
*/
public void setSecurementEncryptionUser(String securementEncryptionUser) {
@@ -276,10 +317,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Specific parameter for UsernameToken action to define the encoding of the passowrd.
*
* <p>The parameter can be set to either {@link WSConstants#PW_DIGEST} or to {@link WSConstants#PW_TEXT}.
*
* <p>The default setting is PW_DIGEST.
* <p>
* The parameter can be set to either {@link WSConstants#PW_DIGEST} or to {@link WSConstants#PW_TEXT}.
* <p>
* The default setting is PW_DIGEST.
*/
public void setSecurementPasswordType(String securementUsernameTokenPasswordType) {
handler.setOption(WSHandlerConstants.PASSWORD_TYPE, securementUsernameTokenPasswordType);
@@ -287,6 +328,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Defines which signature algorithm to use.
*
* @see WSConstants#RSA
* @see WSConstants#DSA
*/
@@ -307,8 +349,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Defines which key identifier type to use. The WS-Security specifications recommends to use the identifier type
* {@code IssuerSerial}. For possible signature key identifier types refer to {@link
* org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For signature {@code IssuerSerial} and
* {@code IssuerSerial}. For possible signature key identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For signature {@code IssuerSerial} and
* {@code DirectReference} are valid only.
*/
public void setSecurementSignatureKeyIdentifier(String securementSignatureKeyIdentifier) {
@@ -317,26 +359,28 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Property to define which parts of the request shall be signed.
*
* <p>Refer to {@link #setSecurementEncryptionParts(String)} for a detailed description of the format of the value
* <p>
* Refer to {@link #setSecurementEncryptionParts(String)} for a detailed description of the format of the value
* string.
*
* <p>If this property is not specified the handler signs the SOAP Body by default.
*
* <p>The WS Security specifications define several formats to transfer the signature tokens (certificates) or
* references to these tokens. Thus, the plain element name {@code Token} signs the token and takes care of the
* different formats.
*
* <p>To sign the SOAP body <b>and</b> the signature token the value of this parameter must contain:
* <p>
* If this property is not specified the handler signs the SOAP Body by default.
* <p>
* The WS Security specifications define several formats to transfer the signature tokens (certificates) or references
* to these tokens. Thus, the plain element name {@code Token} signs the token and takes care of the different
* formats.
* <p>
* To sign the SOAP body <b>and</b> the signature token the value of this parameter must contain:
*
* <pre>
* &lt;property name="securementSignatureParts"
* value="{}{http://schemas.xmlsoap.org/soap/envelope/}Body; Token" />
* </pre>
*
* To specify an element without a namespace use the string {@code Null} as the namespace name (this is a case
* sensitive string)
*
* <p>If there is no other element in the request with a local name of {@code Body} then the SOAP namespace
* identifier can be empty ({@code {}}).
* <p>
* If there is no other element in the request with a local name of {@code Body} then the SOAP namespace identifier
* can be empty ({@code {}}).
*/
public void setSecurementSignatureParts(String securementSignatureParts) {
handler.setOption(WSHandlerConstants.SIGNATURE_PARTS, securementSignatureParts);
@@ -344,13 +388,11 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* The user's name for signature.
*
* <p>This name is used as the alias name in the keystore to get user's
* certificate and private key to perform signing.
*
* <p>If this parameter is not set, then the signature
* function falls back to the alias specified by {@link #setSecurementUsername(String)}.
*
* <p>
* This name is used as the alias name in the keystore to get user's certificate and private key to perform signing.
* <p>
* If this parameter is not set, then the signature function falls back to the alias specified by
* {@link #setSecurementUsername(String)}.
*/
public void setSecurementSignatureUser(String securementSignatureUser) {
handler.setOption(WSHandlerConstants.SIGNATURE_USER, securementSignatureUser);
@@ -375,7 +417,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
public void setSecurementUseDerivedKey(boolean securementUseDerivedKey) {
this.securementUseDerivedKey = securementUseDerivedKey;
}
/**
* Sets the SAML Callback used for generating SAML tokens.
*
@@ -398,8 +440,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
this.validationActions = actions;
try {
validationActionsVector = WSSecurityUtil.decodeAction(actions);
}
catch (WSSecurityException ex) {
} catch (WSSecurityException ex) {
throw new IllegalArgumentException(ex);
}
}
@@ -453,35 +494,31 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Enables the {@code mustUnderstand} attribute on WS-Security headers on outgoing messages. Default is
* {@code true}.
* Enables the {@code mustUnderstand} attribute on WS-Security headers on outgoing messages. Default is {@code true}.
*/
public void setSecurementMustUnderstand(boolean securementMustUnderstand) {
handler.setOption(WSHandlerConstants.MUST_UNDERSTAND, securementMustUnderstand);
}
/**
* Sets whether or not a {@code Nonce} element is added to the
* {@code UsernameToken}s. Default is {@code false}.
* Sets whether or not a {@code Nonce} element is added to the {@code UsernameToken}s. Default is {@code false}.
*/
public void setSecurementUsernameTokenNonce(boolean securementUsernameTokenNonce) {
handler.setOption(ConfigurationConstants.ADD_USERNAMETOKEN_NONCE, securementUsernameTokenNonce);
}
/**
* Sets whether or not a {@code Created} element is added to the
* {@code UsernameToken}s. Default is {@code false}.
* Sets whether or not a {@code Created} element is added to the {@code UsernameToken}s. Default is {@code false}.
*/
public void setSecurementUsernameTokenCreated(boolean securementUsernameTokenCreated)
{
public void setSecurementUsernameTokenCreated(boolean securementUsernameTokenCreated) {
handler.setOption(ConfigurationConstants.ADD_USERNAMETOKEN_CREATED, securementUsernameTokenCreated);
}
/**
* Sets the web service specification settings.
* <p>
* The default settings follow the latest OASIS and changing anything might violate the OASIS specs.
*
*
* @param config web service security configuration or {@code null} to use default settings
*/
public void setWssConfig(WSSConfig config) {
@@ -503,18 +540,17 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
this.handler.setOption(WSHandlerConstants.IS_BSP_COMPLIANT, bspCompliant);
this.bspCompliant = bspCompliant;
}
/**
* Sets whether the RSA 1.5 key transport algorithm is allowed.
*/
public void setAllowRSA15KeyTransportAlgorithm(boolean allow)
{
public void setAllowRSA15KeyTransportAlgorithm(boolean allow) {
this.allowRSA15KeyTransportAlgorithm = allow;
}
/**
* Sets the time in seconds in the future within which the Created time of an
* incoming Timestamp is valid. The default is 60 seconds.
* Sets the time in seconds in the future within which the Created time of an incoming Timestamp is valid. The default
* is 60 seconds.
*/
public void setFutureTimeToLive(int futureTimeToLive) {
if (futureTimeToLive <= 0) {
@@ -556,11 +592,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
List<HandlerAction> securementActionsVector = new ArrayList<HandlerAction>();
try {
securementActionsVector = WSSecurityUtil.decodeHandlerAction(securementActions, wssConfig);
}
catch (WSSecurityException ex) {
} catch (WSSecurityException ex) {
throw new Wss4jSecuritySecurementException(ex.getMessage(), ex);
}
if (securementActionsVector.isEmpty() && !enableSignatureConfirmation) {
return;
}
@@ -572,8 +607,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
Document envelopeAsDocument = soapMessage.getDocument();
try {
handler.doSenderAction(envelopeAsDocument, requestData, securementActionsVector, false);
}
catch (WSSecurityException ex) {
} catch (WSSecurityException ex) {
throw new Wss4jSecuritySecurementException(ex.getMessage(), ex);
}
@@ -594,23 +628,22 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
String contextUsername = (String) messageContext.getProperty(SECUREMENT_USER_PROPERTY_NAME);
if (StringUtils.hasLength(contextUsername)) {
requestData.setUsername(contextUsername);
}
else {
} else {
requestData.setUsername(securementUsername);
}
requestData.setTimeStampTTL(securementTimeToLive);
requestData.setUseDerivedKeyForMAC(securementUseDerivedKey);
requestData.setWssConfig(wssConfig);
messageContext.setProperty(WSHandlerConstants.TTL_TIMESTAMP, Integer.toString(securementTimeToLive));
if (this.samlCallbackHandler != null) {
messageContext.setProperty(WSHandlerConstants.SAML_CALLBACK_REF, this.samlCallbackHandler);
}
// allow for qualified password types for .Net interoperability
requestData.setAllowNamespaceQualifiedPasswordTypes(true);
@@ -626,19 +659,19 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
protected RequestData initializeValidationRequestData(MessageContext messageContext) {
RequestData requestData = new RequestData();
requestData.setMsgContext(messageContext);
requestData.setWssConfig(wssConfig);
requestData.setDecCrypto(validationDecryptionCrypto);
requestData.setSigVerCrypto(validationSignatureCrypto);
requestData.setCallbackHandler(validationCallbackHandler);
messageContext.setProperty(WSHandlerConstants.TTL_TIMESTAMP, Integer.toString(validationTimeToLive));
requestData.setAllowRSA15KeyTransportAlgorithm(allowRSA15KeyTransportAlgorithm);
requestData.setDisableBSPEnforcement(!bspCompliant);
if (requestData.getBSPEnforcer() != null) {
requestData.getBSPEnforcer().setDisableBSPRules(!bspCompliant);
@@ -646,7 +679,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
// allow for qualified password types for .Net interoperability
requestData.setAllowNamespaceQualifiedPasswordTypes(true);
return requestData;
}
@@ -669,13 +701,12 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
RequestData validationData = initializeValidationRequestData(messageContext);
String actor = validationActor;
if (actor == null) {
actor = "";
}
Element elem = WSSecurityUtil.getSecurityHeader(envelopeAsDocument, actor);
WSHandlerResult result = securityEngine
.processSecurityHeader(elem, validationData);
if (actor == null) {
actor = "";
}
Element elem = WSSecurityUtil.getSecurityHeader(envelopeAsDocument, actor);
WSHandlerResult result = securityEngine.processSecurityHeader(elem, validationData);
// Results verification
if (CollectionUtils.isEmpty(result.getResults())) {
@@ -693,8 +724,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
verifyTimestamp(result);
processPrincipal(result);
}
catch (WSSecurityException ex) {
} catch (WSSecurityException ex) {
throw new Wss4jSecurityValidationException(ex.getMessage(), ex);
}
@@ -709,7 +739,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* Checks whether the received headers match the configured validation actions. Subclasses could override this method
* for custom verification behavior.
*
*
* @param results the results of the validation function
* @param validationActions the decoded validation actions
* @throws Wss4jSecurityValidationException if the results are deemed invalid
@@ -722,34 +751,36 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Puts the results of WS-Security headers processing in the message context. Some actions like Signature
* Confirmation require this.
* Puts the results of WS-Security headers processing in the message context. Some actions like Signature Confirmation
* require this.
*/
@SuppressWarnings("unchecked")
private void updateContextWithResults(MessageContext messageContext, List<WSSecurityEngineResult> results) {
List<WSHandlerResult> handlerResults;
if ((handlerResults = (List<WSHandlerResult>) messageContext.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
if ((handlerResults = (List<WSHandlerResult>) messageContext
.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
handlerResults = new ArrayList<WSHandlerResult>();
messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults);
}
WSHandlerResult rResult = new WSHandlerResult(validationActor, results,
Collections.<Integer, List<WSSecurityEngineResult>>emptyMap());
Collections.<Integer, List<WSSecurityEngineResult>> emptyMap());
handlerResults.add(0, rResult);
messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults);
}
/** Verifies the trust of a certificate.
* @param result*/
/**
* Verifies the trust of a certificate.
*
* @param result
*/
protected void verifyCertificateTrust(WSHandlerResult result) throws WSSecurityException {
List<WSSecurityEngineResult> results =
result.getActionResults().get(WSConstants.SIGN);
List<WSSecurityEngineResult> results = result.getActionResults().get(WSConstants.SIGN);
if (!CollectionUtils.isEmpty(results)) {
WSSecurityEngineResult actionResult = results.get(0);
X509Certificate returnCert =
(X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
X509Certificate returnCert = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
Credential credential = new Credential();
credential.setCertificates(new X509Certificate[] { returnCert});
credential.setCertificates(new X509Certificate[] { returnCert });
RequestData requestData = new RequestData();
requestData.setSigVerCrypto(validationSignatureCrypto);
@@ -760,11 +791,13 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
}
/** Verifies the timestamp.
* @param result*/
/**
* Verifies the timestamp.
*
* @param result
*/
protected void verifyTimestamp(WSHandlerResult result) throws WSSecurityException {
List<WSSecurityEngineResult> results =
result.getActionResults().get(WSConstants.TS);
List<WSSecurityEngineResult> results = result.getActionResults().get(WSConstants.TS);
if (!CollectionUtils.isEmpty(results)) {
WSSecurityEngineResult actionResult = results.get(0);
@@ -786,8 +819,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
private void processPrincipal(WSHandlerResult result) {
List<WSSecurityEngineResult> results =
result.getActionResults().get(WSConstants.UT);
List<WSSecurityEngineResult> results = result.getActionResults().get(WSConstants.UT);
if (!CollectionUtils.isEmpty(results)) {
WSSecurityEngineResult actionResult = results.get(0);
@@ -796,12 +828,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
WSUsernameTokenPrincipalImpl usernameTokenPrincipal = (WSUsernameTokenPrincipalImpl) principal;
UsernameTokenPrincipalCallback callback = new UsernameTokenPrincipalCallback(usernameTokenPrincipal);
try {
validationCallbackHandler.handle(new Callback[]{callback});
}
catch (IOException ex) {
validationCallbackHandler.handle(new Callback[] { callback });
} catch (IOException ex) {
logger.warn("Principal callback resulted in IOException", ex);
}
catch (UnsupportedCallbackException ex) {
} catch (UnsupportedCallbackException ex) {
// ignore
}
}
@@ -813,12 +843,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
if (validationCallbackHandler != null) {
try {
CleanupCallback cleanupCallback = new CleanupCallback();
validationCallbackHandler.handle(new Callback[]{cleanupCallback});
}
catch (IOException ex) {
validationCallbackHandler.handle(new Callback[] { cleanupCallback });
} catch (IOException ex) {
logger.warn("Cleanup callback resulted in IOException", ex);
}
catch (UnsupportedCallbackException ex) {
} catch (UnsupportedCallbackException ex) {
// ignore
}
}

71
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/AbstractWsPasswordCallbackHandler.java
View File

@@ -17,6 +17,7 @@
package org.springframework.ws.soap.security.wss4j2.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -25,8 +26,8 @@ import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import org.springframework.ws.soap.security.callback.CleanupCallback;
/**
* Abstract base class for {@link javax.security.auth.callback.CallbackHandler} implementations that handle {@link
* WSPasswordCallback} callbacks.
* Abstract base class for {@link javax.security.auth.callback.CallbackHandler} implementations that handle
* {@link WSPasswordCallback} callbacks.
*
* @author Arjen Poutsma
* @author Jamin Hitchcock
@@ -39,7 +40,7 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
* code, and calls the various {@code handle*} template methods.
*
* @param callback the callback
* @throws IOException in case of I/O errors
* @throws IOException in case of I/O errors
* @throws UnsupportedCallbackException when the callback is not supported
*/
@Override
@@ -66,30 +67,26 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
handleSecretKey(passwordCallback);
break;
default:
throw new UnsupportedCallbackException(callback,
"Unknown usage [" + passwordCallback.getUsage() + "]");
throw new UnsupportedCallbackException(callback, "Unknown usage [" + passwordCallback.getUsage() + "]");
}
}
else if (callback instanceof CleanupCallback) {
} else if (callback instanceof CleanupCallback) {
handleCleanup((CleanupCallback) callback);
}
else if (callback instanceof UsernameTokenPrincipalCallback) {
} else if (callback instanceof UsernameTokenPrincipalCallback) {
handleUsernameTokenPrincipal((UsernameTokenPrincipalCallback) callback);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
/**
* Invoked when the callback has a {@link WSPasswordCallback#DECRYPT} usage.
*
* <p>This method is invoked when WSS4J needs a password to get the private key of the {@link
* WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* <p>
* This method is invoked when WSS4J needs a password to get the private key of the
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* decrypt the session (symmetric) key. Because the encryption method uses the public key to encrypt the session key
* it needs no password (a public key is usually not protected by a password).
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleDecrypt(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
@@ -97,10 +94,10 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when the callback has a {@link WSPasswordCallback#USERNAME_TOKEN} usage.
*
* <p>This method is invoked when WSS4J needs the password to fill in or to verify a UsernameToken.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* This method is invoked when WSS4J needs the password to fill in or to verify a UsernameToken.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleUsernameToken(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
@@ -108,12 +105,12 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when the callback has a {@link WSPasswordCallback#SIGNATURE} usage.
*
* <p>This method is invoked when WSS4J needs the password to get the private key of the {@link
* WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* <p>
* This method is invoked when WSS4J needs the password to get the private key of the
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* produce a signature. The signature verfication uses the public key to verfiy the signature.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleSignature(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
@@ -121,10 +118,10 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when the callback has a {@link WSPasswordCallback#SECURITY_CONTEXT_TOKEN} usage.
*
* <p>This method is invoked when WSS4J needs the key to to be associated with a SecurityContextToken.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* This method is invoked when WSS4J needs the key to to be associated with a SecurityContextToken.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleSecurityContextToken(WSPasswordCallback callback)
throws IOException, UnsupportedCallbackException {
@@ -133,8 +130,8 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when the callback has a {@link WSPasswordCallback#CUSTOM_TOKEN} usage.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleCustomToken(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
@@ -142,8 +139,8 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when the callback has a {@link WSPasswordCallback#SECRET_KEY} usage.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleSecretKey(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
@@ -151,8 +148,8 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when a {@link CleanupCallback} is passed to {@link #handle(Callback[])}.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleCleanup(CleanupCallback callback) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
@@ -160,8 +157,8 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when a {@link UsernameTokenPrincipalCallback} is passed to {@link #handle(Callback[])}.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleUsernameTokenPrincipal(UsernameTokenPrincipalCallback callback)
throws IOException, UnsupportedCallbackException {

31
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/KeyStoreCallbackHandler.java
View File

@@ -17,11 +17,11 @@
package org.springframework.ws.soap.security.wss4j2.callback;
import java.io.IOException;
import java.security.Key;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.Key;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -30,8 +30,8 @@ import org.springframework.beans.factory.InitializingBean;
import org.springframework.ws.soap.security.support.KeyStoreUtils;
/**
* Callback handler that uses Java Security {@code KeyStore}s to handle cryptographic callbacks. Allows for
* specific key stores to be set for various cryptographic operations.
* Callback handler that uses Java Security {@code KeyStore}s to handle cryptographic callbacks. Allows for specific key
* stores to be set for various cryptographic operations.
*
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
@@ -46,30 +46,30 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
private char[] symmetricKeyPassword;
private KeyStore keyStore;
/**
* Invoked when the callback has a {@link WSPasswordCallback#DECRYPT} usage.
*
* <p>This method is invoked when WSS4J needs a password to get the private key of the {@link
* WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* <p>
* This method is invoked when WSS4J needs a password to get the private key of the
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* decrypt the session (symmetric) key. Because the encryption method uses the public key to encrypt the session key
* it needs no password (a public key is usually not protected by a password).
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleDecrypt(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
callback.setPassword(privateKeyPassword);
}
/**
* Invoked when the callback has a {@link WSPasswordCallback#SECRET_KEY} usage.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleSecretKey(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
String id = callback.getIdentifier();
Key key;
try {
key = keyStore.getKey(id, symmetricKeyPassword != null ? symmetricKeyPassword : privateKeyPassword.toCharArray());
} catch (UnrecoverableKeyException e) {
@@ -79,7 +79,7 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
} catch (NoSuchAlgorithmException e) {
throw new IOException("Could not get key", e);
}
callback.setKey(key.getEncoded());
}
@@ -127,8 +127,7 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
if (logger.isDebugEnabled()) {
logger.debug("Loaded default key store");
}
}
catch (Exception ex) {
} catch (Exception ex) {
logger.warn("Could not open default key store", ex);
}
}

11
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/SimplePasswordValidationCallbackHandler.java
View File

@@ -28,8 +28,8 @@ import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
/**
* Simple callback handler that validates passwords against a in-memory {@code Properties} object. Password
* validation is done on a case-sensitive basis.
* Simple callback handler that validates passwords against a in-memory {@code Properties} object. Password validation
* is done on a case-sensitive basis.
*
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
@@ -59,12 +59,11 @@ public class SimplePasswordValidationCallbackHandler extends AbstractWsPasswordC
public void afterPropertiesSet() throws Exception {
Assert.notNull(users, "users is required");
}
@Override
public void handleUsernameToken(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException
{
public void handleUsernameToken(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
String username = callback.getIdentifier();
String passwd = users.get(username);
callback.setPassword(passwd);
}
}
}

23
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/SpringSecurityPasswordValidationCallbackHandler.java
View File

@@ -37,9 +37,9 @@ import org.springframework.ws.soap.security.support.SpringSecurityUtils;
/**
* Callback handler that validates a plain text or digest password using an Spring Security {@code UserDetailsService}.
*
* <p>An Spring Security {@link UserDetailsService} is used to load {@link UserDetails} from. The digest of the
* password contained in this details object is then compared with the digest in the message.
* <p>
* An Spring Security {@link UserDetailsService} is used to load {@link UserDetails} from. The digest of the password
* contained in this details object is then compared with the digest in the message.
*
* @author Arjen Poutsma
* @author Jamin Hitchcock
@@ -66,15 +66,13 @@ public class SpringSecurityPasswordValidationCallbackHandler extends AbstractWsP
public void afterPropertiesSet() throws Exception {
Assert.notNull(userDetailsService, "userDetailsService is required");
}
/**
* Invoked when the callback has a {@link WSPasswordCallback#USERNAME_TOKEN} usage.
*
* <p>This method is invoked when WSS4J needs the password to fill in or to verify a UsernameToken.
*
* <p>Default implementation throws an {@link UnsupportedCallbackException}.
* <p>
* This method is invoked when WSS4J needs the password to fill in or to verify a UsernameToken.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
protected void handleUsernameToken(WSPasswordCallback callback) throws IOException, UnsupportedCallbackException {
UserDetails user = loadUserDetails(callback.getIdentifier());
@@ -89,8 +87,8 @@ public class SpringSecurityPasswordValidationCallbackHandler extends AbstractWsP
throws IOException, UnsupportedCallbackException {
UserDetails user = loadUserDetails(callback.getPrincipal().getName());
WSUsernameTokenPrincipalImpl principal = callback.getPrincipal();
UsernamePasswordAuthenticationToken authRequest =
new UsernamePasswordAuthenticationToken(principal, principal.getPassword(), user.getAuthorities());
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(principal,
principal.getPassword(), user.getAuthorities());
if (logger.isDebugEnabled()) {
logger.debug("Authentication success: " + authRequest.toString());
}
@@ -108,8 +106,7 @@ public class SpringSecurityPasswordValidationCallbackHandler extends AbstractWsP
if (user == null) {
try {
user = userDetailsService.loadUserByUsername(username);
}
catch (UsernameNotFoundException notFound) {
} catch (UsernameNotFoundException notFound) {
if (logger.isDebugEnabled()) {
logger.debug("Username '" + username + "' not found");
}

6
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/UsernameTokenPrincipalCallback.java
View File

@@ -17,14 +17,14 @@
package org.springframework.ws.soap.security.wss4j2.callback;
import java.io.Serializable;
import javax.security.auth.callback.Callback;
import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
/**
* Underlying security services instantiate and pass a {@code UsernameTokenPrincipalCallback} to the
* {@code handle} method of a {@code CallbackHandler} to pass a security
* {@code WSUsernameTokenPrincipal}.
* Underlying security services instantiate and pass a {@code UsernameTokenPrincipalCallback} to the {@code handle}
* method of a {@code CallbackHandler} to pass a security {@code WSUsernameTokenPrincipal}.
*
* @author Arjen Poutsma
* @author Jamin Hitchcock

3
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/package.html
View File

@@ -1,6 +1,7 @@
<html>
<body>
Contains classes for using the <a href="http://ws.apache.org/wss4j/">Apache WSS4J 2.0</a> WS-Security implementation within
Contains classes for using the <a href="http://ws.apache.org/wss4j/">Apache WSS4J 2.0</a> WS-Security implementation
within
Spring-WS.
</body>
</html>

50
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/support/CryptoFactoryBean.java
View File

@@ -31,8 +31,8 @@ import org.springframework.util.Assert;
/**
* Spring factory bean for a WSS4J {@link Crypto}. Allows for strong-typed property configuration, or configuration
* through {@link Properties}.
*
* <p>Requires either individual properties, or the {@link #setConfiguration(java.util.Properties) configuration} property
* <p>
* Requires either individual properties, or the {@link #setConfiguration(java.util.Properties) configuration} property
* to be set.
*
* @author Tareq Abed Rabbo
@@ -50,8 +50,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
private static final String CRYPTO_PROVIDER_PROPERTY = "org.apache.wss4j.crypto.provider";
/**
* Sets the configuration of the Crypto. Setting this property overrides all previously set configuration, through
* the type-safe properties
* Sets the configuration of the Crypto. Setting this property overrides all previously set configuration, through the
* type-safe properties
*
* @see org.apache.ws.security.components.crypto.CryptoFactory#getInstance(java.util.Properties)
*/
@@ -61,10 +61,10 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the {@link org.apache.ws.security.components.crypto.Crypto} provider name. Defaults to {@link
* org.apache.ws.security.components.crypto.Merlin}.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.provider} property.
* Sets the {@link org.apache.ws.security.components.crypto.Crypto} provider name. Defaults to
* {@link org.apache.ws.security.components.crypto.Merlin}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.provider} property.
*
* @param cryptoProviderClass the crypto provider class
*/
@@ -75,8 +75,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the location of the key store to be loaded in the {@link org.apache.ws.security.components.crypto.Crypto}
* instance.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.file} property.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.file} property.
*
* @param location the key store location
* @throws java.io.IOException when the resource cannot be opened
@@ -89,13 +89,11 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
private String getResourcePath(Resource resource) throws IOException {
try {
return resource.getFile().getAbsolutePath();
}
catch (IOException ex) {
} catch (IOException ex) {
if (resource instanceof ClassPathResource) {
ClassPathResource classPathResource = (ClassPathResource) resource;
return classPathResource.getPath();
}
else {
} else {
throw ex;
}
}
@@ -103,8 +101,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the key store provider.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.provider} property.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.provider} property.
*
* @param provider the key store provider
*/
@@ -114,8 +112,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the key store password. Defaults to {@code security}.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.password} property.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.password} property.
*
* @param password the key store password
*/
@@ -125,8 +123,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the key store type. Defaults to {@link java.security.KeyStore#getDefaultType()}.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.type} property.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.type} property.
*
* @param type the key store type
*/
@@ -136,10 +134,10 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the trust store password. Defaults to {@code changeit}.
*
* <p>WSS4J crypto uses the standard J2SE trust store, i.e. {@code $JAVA_HOME/lib/security/cacerts}.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.cacerts.password} property.
* <p>
* WSS4J crypto uses the standard J2SE trust store, i.e. {@code $JAVA_HOME/lib/security/cacerts}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.cacerts.password} property.
*
* @param password the trust store password
*/
@@ -151,8 +149,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
* Sets the alias name of the default certificate which has been specified as a property. This should be the
* certificate that is used for signature and encryption. This alias corresponds to the certificate that should be
* used whenever KeyInfo is not present in a signed or an encrypted message.
*
* <p>This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.alias} property.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.alias} property.
*
* @param defaultX509Alias alias name of the default X509 certificate
*/

29
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/X509AuthenticationProvider.java
View File

@@ -20,7 +20,6 @@ import java.security.cert.X509Certificate;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.MessageSource;
import org.springframework.context.MessageSourceAware;
@@ -35,26 +34,27 @@ import org.springframework.util.Assert;
import org.springframework.ws.soap.security.x509.cache.NullX509UserCache;
import org.springframework.ws.soap.security.x509.cache.X509UserCache;
/**
* Processes an X.509 authentication request.
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
*
* @author Luke Taylor
* @version $Id: X509AuthenticationProvider.java 3256 2008-08-18 18:20:48Z luke_t $
*/
public class X509AuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
//~ Static fields/initializers =====================================================================================
// ~ Static fields/initializers =====================================================================================
private static final Log logger = LogFactory.getLog(X509AuthenticationProvider.class);
//~ Instance fields ================================================================================================
// ~ Instance fields ================================================================================================
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
private X509AuthoritiesPopulator x509AuthoritiesPopulator;
private X509UserCache userCache = new NullX509UserCache();
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
@Override
public void afterPropertiesSet() throws Exception {
@@ -66,20 +66,19 @@ public class X509AuthenticationProvider implements AuthenticationProvider, Initi
/**
* If the supplied authentication token contains a certificate then this will be passed to the configured
* {@link X509AuthoritiesPopulator} to obtain the user details and authorities for the user identified by the
* certificate.<p>If no certificate is present (for example, if the filter is applied to an HttpRequest for
* which client authentication hasn't been configured in the container) then a BadCredentialsException will be
* raised.</p>
* certificate.
* <p>
* If no certificate is present (for example, if the filter is applied to an HttpRequest for which client
* authentication hasn't been configured in the container) then a BadCredentialsException will be raised.
* </p>
*
* @param authentication the authentication request.
*
* @return an X509AuthenticationToken containing the authorities of the principal represented by the certificate.
*
* @throws AuthenticationException if the {@link X509AuthoritiesPopulator} rejects the certficate.
* @throws BadCredentialsException if no certificate was presented in the authentication request.
*/
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
if (!supports(authentication.getClass())) {
return null;
}
@@ -91,8 +90,8 @@ public class X509AuthenticationProvider implements AuthenticationProvider, Initi
X509Certificate clientCertificate = (X509Certificate) authentication.getCredentials();
if (clientCertificate == null) {
throw new BadCredentialsException(messages.getMessage("X509AuthenticationProvider.certificateNull",
"Certificate is null"));
throw new BadCredentialsException(
messages.getMessage("X509AuthenticationProvider.certificateNull", "Certificate is null"));
}
UserDetails user = userCache.getUserFromCache(clientCertificate);

25
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/X509AuthenticationToken.java
View File

@@ -22,25 +22,26 @@ import java.util.Collection;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
/**
* {@code Authentication} implementation for X.509 client-certificate authentication.
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
*
* @author Luke Taylor
*/
public class X509AuthenticationToken extends AbstractAuthenticationToken {
//~ Instance fields ================================================================================================
// ~ Instance fields ================================================================================================
private static final long serialVersionUID = 1L;
private Object principal;
private X509Certificate credentials;
//~ Constructors ===================================================================================================
// ~ Constructors ===================================================================================================
/**
* Used for an authentication request. The {@link org.springframework.security.core.Authentication#isAuthenticated()} will return
* {@code false}.
* Used for an authentication request. The {@link org.springframework.security.core.Authentication#isAuthenticated()}
* will return {@code false}.
*
* @param credentials the certificate
*/
@@ -50,22 +51,22 @@ public class X509AuthenticationToken extends AbstractAuthenticationToken {
}
/**
* Used for an authentication response object. The {@link org.springframework.security.core.Authentication#isAuthenticated()}
* will return {@code true}.
* Used for an authentication response object. The
* {@link org.springframework.security.core.Authentication#isAuthenticated()} will return {@code true}.
*
* @param principal the principal, which is generally a
* {@code UserDetails}
* @param principal the principal, which is generally a {@code UserDetails}
* @param credentials the certificate
* @param authorities the authorities
*/
public X509AuthenticationToken(Object principal, X509Certificate credentials, Collection<? extends GrantedAuthority> authorities) {
public X509AuthenticationToken(Object principal, X509Certificate credentials,
Collection<? extends GrantedAuthority> authorities) {
super(authorities);
this.principal = principal;
this.credentials = credentials;
setAuthenticated(true);
}
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
@Override
public Object getCredentials() {

30
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/X509AuthoritiesPopulator.java
View File

@@ -21,34 +21,32 @@ import java.security.cert.X509Certificate;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
/**
* Populates the {@code UserDetails} associated with the X.509
* certificate presented by a client.
* Populates the {@code UserDetails} associated with the X.509 certificate presented by a client.
* <p>
* Although the certificate will already have been validated by the web container,
* implementations may choose to perform additional application-specific checks on
* the certificate content here. If an implementation chooses to reject the certificate,
* it should throw a {@link org.springframework.security.authentication.BadCredentialsException}.
* Although the certificate will already have been validated by the web container, implementations may choose to perform
* additional application-specific checks on the certificate content here. If an implementation chooses to reject the
* certificate, it should throw a {@link org.springframework.security.authentication.BadCredentialsException}.
* </p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
*
* @author Luke Taylor
*/
public interface X509AuthoritiesPopulator {
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
/**
* Obtains the granted authorities for the specified user.<p>May throw any
* {@code AuthenticationException} or return {@code null} if the authorities are unavailable.</p>
* Obtains the granted authorities for the specified user.
* <p>
* May throw any {@code AuthenticationException} or return {@code null} if the authorities are unavailable.
* </p>
*
* @param userCertificate the X.509 certificate supplied
*
* @return the details of the indicated user (at minimum the granted authorities and the username)
*
* @throws AuthenticationException if the user details are not available or the certificate isn't valid for the
* application's purpose.
* application's purpose.
*/
UserDetails getUserDetails(X509Certificate userCertificate)
throws AuthenticationException;
UserDetails getUserDetails(X509Certificate userCertificate) throws AuthenticationException;
}

24
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/EhCacheBasedX509UserCache.java vendored
View File

@@ -16,42 +16,42 @@
package org.springframework.ws.soap.security.x509.cache;
import java.security.cert.X509Certificate;
import net.sf.ehcache.CacheException;
import net.sf.ehcache.Ehcache;
import net.sf.ehcache.Element;
import java.security.cert.X509Certificate;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.dao.DataRetrievalFailureException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.Assert;
/**
* Caches {@code User} objects using a Spring IoC defined <a
* href="http://ehcache.sourceforge.net">EHCACHE</a>.
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
* Caches {@code User} objects using a Spring IoC defined <a href="http://ehcache.sourceforge.net">EHCACHE</a>.
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
*
* @author Luke Taylor
* @author Ben Alex
* @author Greg Turnquist
*
* @deprecated Migrate to {@link SpringBasedX509UserCache} and inject a platform neutral Spring-based {@link org.springframework.cache.Cache}.
* @deprecated Migrate to {@link SpringBasedX509UserCache} and inject a platform neutral Spring-based
* {@link org.springframework.cache.Cache}.
*/
@Deprecated
public class EhCacheBasedX509UserCache implements X509UserCache, InitializingBean {
//~ Static fields/initializers =====================================================================================
// ~ Static fields/initializers =====================================================================================
private static final Log logger = LogFactory.getLog(EhCacheBasedX509UserCache.class);
//~ Instance fields ================================================================================================
// ~ Instance fields ================================================================================================
private Ehcache cache;
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
@Override
public void afterPropertiesSet() throws Exception {

7
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/NullX509UserCache.java vendored
View File

@@ -20,15 +20,16 @@ import java.security.cert.X509Certificate;
import org.springframework.security.core.userdetails.UserDetails;
/**
* "Cache" that doesn't do any caching.
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
*
* @author Luke Taylor
*/
public class NullX509UserCache implements X509UserCache {
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
@Override
public UserDetails getUserFromCache(X509Certificate certificate) {

9
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/SpringBasedX509UserCache.java vendored
View File

@@ -20,24 +20,23 @@ import java.security.cert.X509Certificate;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.cache.Cache;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.Assert;
/**
* Caches {@code User} objects using a Spring Framework-based {@link Cache}.
*
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
*
* @author Luke Taylor
* @author Ben Alex
* @author Greg Turnquist
*/
public class SpringBasedX509UserCache implements X509UserCache, InitializingBean {
private static final Log logger = LogFactory.getLog(SpringBasedX509UserCache.class);
private Cache cache;

12
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/X509UserCache.java vendored
View File

@@ -20,21 +20,21 @@ import java.security.cert.X509Certificate;
import org.springframework.security.core.userdetails.UserDetails;
/**
* Provides a cache of {@link UserDetails} objects for the
* {@link org.springframework.ws.soap.security.x509.X509AuthenticationProvider}.
* <p>
* Similar in function to the {@link org.springframework.security.core.userdetails.UserCache}
* used by the Dao provider, but the cache is keyed with the user's certificate
* rather than the user name.
* Similar in function to the {@link org.springframework.security.core.userdetails.UserCache} used by the Dao provider,
* but the cache is keyed with the user's certificate rather than the user name.
* </p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
*
* @author Luke Taylor
*/
public interface X509UserCache {
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
UserDetails getUserFromCache(X509Certificate userCertificate);

27
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/populator/DaoX509AuthoritiesPopulator.java
View File

@@ -35,21 +35,23 @@ import org.springframework.ws.soap.security.x509.X509AuthoritiesPopulator;
/**
* Populates the X509 authorities via an {@link org.springframework.security.core.userdetails.UserDetailsService}.
* <p>Migrated from Spring Security 2 since it has been removed in Spring Security 3.</p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
*
* @author Luke Taylor
* @version $Id: DaoX509AuthoritiesPopulator.java 2544 2008-01-29 11:50:33Z luke_t $
*/
public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, InitializingBean, MessageSourceAware {
//~ Instance fields ================================================================================================
// ~ Instance fields ================================================================================================
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
private Pattern subjectDNPattern;
private String subjectDNRegex = "CN=(.*?),";
private UserDetailsService userDetailsService;
//~ Methods ========================================================================================================
// ~ Methods ========================================================================================================
@Override
public void afterPropertiesSet() throws Exception {
@@ -67,7 +69,7 @@ public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, In
if (!matcher.find()) {
throw new BadCredentialsException(messages.getMessage("DaoX509AuthoritiesPopulator.noMatching",
new Object[] {subjectDN}, "No matching pattern was found in subjectDN: {0}"));
new Object[] { subjectDN }, "No matching pattern was found in subjectDN: {0}"));
}
if (matcher.groupCount() != 1) {
@@ -80,7 +82,7 @@ public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, In
if (user == null) {
throw new AuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
"UserDetailsService returned null, which is an interface contract violation");
}
return user;
@@ -92,12 +94,15 @@ public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, In
}
/**
* Sets the regular expression which will by used to extract the user name from the certificate's Subject
* DN.
* <p>It should contain a single group; for example the default expression "CN=(.?)," matches the common
* name field. So "CN=Jimi Hendrix, OU=..." will give a user name of "Jimi Hendrix".</p>
* <p>The matches are case insensitive. So "emailAddress=(.?)," will match "EMAILADDRESS=jimi@hendrix.org,
* CN=..." giving a user name "jimi@hendrix.org"</p>
* Sets the regular expression which will by used to extract the user name from the certificate's Subject DN.
* <p>
* It should contain a single group; for example the default expression "CN=(.?)," matches the common name field. So
* "CN=Jimi Hendrix, OU=..." will give a user name of "Jimi Hendrix".
* </p>
* <p>
* The matches are case insensitive. So "emailAddress=(.?)," will match "EMAILADDRESS=jimi@hendrix.org, CN=..." giving
* a user name "jimi@hendrix.org"
* </p>
*
* @param subjectDNRegex the regular expression to find in the subject
*/

79
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptor.java
View File

@@ -18,17 +18,12 @@ package org.springframework.ws.soap.security.xwss;
import java.io.IOException;
import java.io.InputStream;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.xml.soap.SOAPMessage;
import com.sun.xml.wss.ProcessingContext;
import com.sun.xml.wss.XWSSProcessor;
import com.sun.xml.wss.XWSSProcessorFactory;
import com.sun.xml.wss.XWSSecurityException;
import com.sun.xml.wss.impl.WssSoapFaultException;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.core.io.Resource;
import org.springframework.util.Assert;
@@ -40,20 +35,27 @@ import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.xwss.callback.XwssCallbackHandlerChain;
import com.sun.xml.wss.ProcessingContext;
import com.sun.xml.wss.XWSSProcessor;
import com.sun.xml.wss.XWSSProcessorFactory;
import com.sun.xml.wss.XWSSecurityException;
import com.sun.xml.wss.impl.WssSoapFaultException;
/**
* WS-Security endpoint interceptor that is based on Sun's XML and Web Services Security package (XWSS). This
* WS-Security endpoint interceptor that is based on Sun's XML and Web Services Security package (XWSS). This
* WS-Security implementation is part of the Java Web Services Developer Pack (Java WSDP).
*
* <p>This interceptor needs a {@code CallbackHandler} to operate. This handler is used to retrieve certificates,
* private keys, validate user credentials, etc. Refer to the XWSS Javadoc to learn more about the specific
* {@code Callback}s fired by XWSS. You can also set multiple handlers, each of which will be used in turn.
*
* <p>Additionally, you must define a XWSS policy file by setting {@code policyConfiguration} property. The format of
* the policy file is documented in the <a href="http://java.sun.com/webservices/docs/1.6/tutorial/doc/XWS-SecurityIntro4.html#wp529900">Java
* Web Services Tutorial</a>.
*
* <p><b>Note</b> that this interceptor depends on SAAJ, and thus requires {@code SaajSoapMessage}s to operate. This
* means that you must use a {@code SaajSoapMessageFactory} to create the SOAP messages.
* <p>
* This interceptor needs a {@code CallbackHandler} to operate. This handler is used to retrieve certificates, private
* keys, validate user credentials, etc. Refer to the XWSS Javadoc to learn more about the specific {@code Callback}s
* fired by XWSS. You can also set multiple handlers, each of which will be used in turn.
* <p>
* Additionally, you must define a XWSS policy file by setting {@code policyConfiguration} property. The format of the
* policy file is documented in the
* <a href="http://java.sun.com/webservices/docs/1.6/tutorial/doc/XWS-SecurityIntro4.html#wp529900">Java Web Services
* Tutorial</a>.
* <p>
* <b>Note</b> that this interceptor depends on SAAJ, and thus requires {@code SaajSoapMessage}s to operate. This means
* that you must use a {@code SaajSoapMessageFactory} to create the SOAP messages.
*
* @author Arjen Poutsma
* @see #setCallbackHandler(javax.security.auth.callback.CallbackHandler)
@@ -72,8 +74,7 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem
private Resource policyConfiguration;
/**
* Sets the handler to resolve XWSS callbacks. Setting either this propery, or {@code callbackHandlers}, is
* required.
* Sets the handler to resolve XWSS callbacks. Setting either this propery, or {@code callbackHandlers}, is required.
*
* @see com.sun.xml.wss.impl.callback.XWSSCallback
* @see #setCallbackHandlers(javax.security.auth.callback.CallbackHandler[])
@@ -83,8 +84,7 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem
}
/**
* Sets the handlers to resolve XWSS callbacks. Setting either this propery, or {@code callbackHandlers}, is
* required.
* Sets the handlers to resolve XWSS callbacks. Setting either this propery, or {@code callbackHandlers}, is required.
*
* @see com.sun.xml.wss.impl.callback.XWSSCallback
* @see #setCallbackHandler(javax.security.auth.callback.CallbackHandler)
@@ -111,8 +111,7 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem
}
is = policyConfiguration.getInputStream();
processor = processorFactory.createProcessorForSecurityConfiguration(is, callbackHandler);
}
finally {
} finally {
if (is != null) {
is.close();
}
@@ -124,23 +123,21 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem
*
* @param soapMessage the message to be secured
* @throws XwsSecuritySecurementException in case of errors
* @throws IllegalArgumentException when soapMessage is not a {@code SaajSoapMessage}
* @throws IllegalArgumentException when soapMessage is not a {@code SaajSoapMessage}
*/
@Override
protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
throws XwsSecuritySecurementException {
Assert.isTrue(soapMessage instanceof SaajSoapMessage, "XwsSecurityInterceptor requires a SaajSoapMessage. " +
"Use a SaajSoapMessageFactory to create the SOAP messages.");
Assert.isTrue(soapMessage instanceof SaajSoapMessage, "XwsSecurityInterceptor requires a SaajSoapMessage. "
+ "Use a SaajSoapMessageFactory to create the SOAP messages.");
SaajSoapMessage saajSoapMessage = (SaajSoapMessage) soapMessage;
try {
ProcessingContext context = processor.createProcessingContext(saajSoapMessage.getSaajMessage());
SOAPMessage result = processor.secureOutboundMessage(context);
saajSoapMessage.setSaajMessage(result);
}
catch (XWSSecurityException ex) {
} catch (XWSSecurityException ex) {
throw new XwsSecuritySecurementException(ex.getMessage(), ex);
}
catch (WssSoapFaultException ex) {
} catch (WssSoapFaultException ex) {
throw new XwsSecurityFaultException(ex.getFaultCode(), ex.getFaultString(), ex.getFaultActor());
}
}
@@ -150,23 +147,21 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem
*
* @param soapMessage the message to be validated
* @throws XwsSecurityValidationException in case of errors
* @throws IllegalArgumentException when soapMessage is not a {@code SaajSoapMessage}
* @throws IllegalArgumentException when soapMessage is not a {@code SaajSoapMessage}
*/
@Override
protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
throws WsSecurityValidationException {
Assert.isTrue(soapMessage instanceof SaajSoapMessage, "XwsSecurityInterceptor requires a SaajSoapMessage. " +
"Use a SaajSoapMessageFactory to create the SOAP messages.");
Assert.isTrue(soapMessage instanceof SaajSoapMessage, "XwsSecurityInterceptor requires a SaajSoapMessage. "
+ "Use a SaajSoapMessageFactory to create the SOAP messages.");
SaajSoapMessage saajSoapMessage = (SaajSoapMessage) soapMessage;
try {
ProcessingContext context = processor.createProcessingContext(saajSoapMessage.getSaajMessage());
SOAPMessage result = processor.verifyInboundMessage(context);
saajSoapMessage.setSaajMessage(result);
}
catch (XWSSecurityException ex) {
} catch (XWSSecurityException ex) {
throw new XwsSecurityValidationException(ex.getMessage(), ex);
}
catch (WssSoapFaultException ex) {
} catch (WssSoapFaultException ex) {
throw new XwsSecurityFaultException(ex.getFaultCode(), ex.getFaultString(), ex.getFaultActor());
}
}
@@ -176,12 +171,10 @@ public class XwsSecurityInterceptor extends AbstractWsSecurityInterceptor implem
if (callbackHandler != null) {
try {
CleanupCallback cleanupCallback = new CleanupCallback();
callbackHandler.handle(new Callback[]{cleanupCallback});
}
catch (IOException ex) {
callbackHandler.handle(new Callback[] { cleanupCallback });
} catch (IOException ex) {
logger.warn("Cleanup callback resulted in IOException", ex);
}
catch (UnsupportedCallbackException ex) {
} catch (UnsupportedCallbackException ex) {
// ignore
}
}

289
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/CryptographyCallbackHandler.java
View File

@@ -17,21 +17,22 @@
package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import com.sun.xml.wss.impl.callback.DecryptionKeyCallback;
import com.sun.xml.wss.impl.callback.EncryptionKeyCallback;
import com.sun.xml.wss.impl.callback.SignatureKeyCallback;
import com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
/**
* Default callback handler that handles cryptographic callback. This handler determines the exact callback passed, and
* calls a template method for it. By default, all template methods throw an {@code UnsupportedCallbackException},
* so you only need to override those you need.
* calls a template method for it. By default, all template methods throw an {@code UnsupportedCallbackException}, so
* you only need to override those you need.
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -42,20 +43,15 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
protected final void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException {
if (callback instanceof CertificateValidationCallback) {
handleCertificateValidationCallback((CertificateValidationCallback) callback);
}
else if (callback instanceof DecryptionKeyCallback) {
} else if (callback instanceof DecryptionKeyCallback) {
handleDecryptionKeyCallback((DecryptionKeyCallback) callback);
}
else if (callback instanceof EncryptionKeyCallback) {
} else if (callback instanceof EncryptionKeyCallback) {
handleEncryptionKeyCallback((EncryptionKeyCallback) callback);
}
else if (callback instanceof SignatureKeyCallback) {
} else if (callback instanceof SignatureKeyCallback) {
handleSignatureKeyCallback((SignatureKeyCallback) callback);
}
else if (callback instanceof SignatureVerificationKeyCallback) {
} else if (callback instanceof SignatureVerificationKeyCallback) {
handleSignatureVerificationKeyCallback((SignatureVerificationKeyCallback) callback);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
@@ -66,8 +62,8 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
//
/**
* Template method that handles {@code CertificateValidationCallback}s. Called from
* {@code handleInternal()}. Default implementation throws an {@code UnsupportedCallbackException}.
* Template method that handles {@code CertificateValidationCallback}s. Called from {@code handleInternal()}. Default
* implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleCertificateValidationCallback(CertificateValidationCallback callback)
throws IOException, UnsupportedCallbackException {
@@ -79,23 +75,21 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
//
/**
* Method that handles {@code DecryptionKeyCallback}s. Called from {@code handleInternal()}. Default
* implementation delegates to specific handling methods.
* Method that handles {@code DecryptionKeyCallback}s. Called from {@code handleInternal()}. Default implementation
* delegates to specific handling methods.
*
* @see #handlePrivateKeyRequest(com.sun.xml.wss.impl.callback.DecryptionKeyCallback,
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.PrivateKeyRequest)
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.PrivateKeyRequest)
* @see #handleSymmetricKeyRequest(com.sun.xml.wss.impl.callback.DecryptionKeyCallback,
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.SymmetricKeyRequest)
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.SymmetricKeyRequest)
*/
protected final void handleDecryptionKeyCallback(DecryptionKeyCallback callback)
throws IOException, UnsupportedCallbackException {
if (callback.getRequest() instanceof DecryptionKeyCallback.PrivateKeyRequest) {
handlePrivateKeyRequest(callback, (DecryptionKeyCallback.PrivateKeyRequest) callback.getRequest());
}
else if (callback.getRequest() instanceof DecryptionKeyCallback.SymmetricKeyRequest) {
} else if (callback.getRequest() instanceof DecryptionKeyCallback.SymmetricKeyRequest) {
handleSymmetricKeyRequest(callback, (DecryptionKeyCallback.SymmetricKeyRequest) callback.getRequest());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
@@ -105,65 +99,54 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
* {@code handleDecryptionKeyCallback()}. Default implementation delegates to specific handling methods.
*
* @see #handlePublicKeyBasedPrivKeyCertRequest(com.sun.xml.wss.impl.callback.SignatureKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest)
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest)
* @see #handleX509CertificateBasedRequest(com.sun.xml.wss.impl.callback.DecryptionKeyCallback,
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.X509CertificateBasedRequest)
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.X509CertificateBasedRequest)
* @see #handleX509IssuerSerialBasedRequest(com.sun.xml.wss.impl.callback.DecryptionKeyCallback,
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.X509IssuerSerialBasedRequest)
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.X509IssuerSerialBasedRequest)
* @see #handleX509SubjectKeyIdentifierBasedRequest(com.sun.xml.wss.impl.callback.DecryptionKeyCallback,
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest)
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest)
*/
protected final void handlePrivateKeyRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.PrivateKeyRequest request)
throws IOException, UnsupportedCallbackException {
DecryptionKeyCallback.PrivateKeyRequest request) throws IOException, UnsupportedCallbackException {
if (request instanceof DecryptionKeyCallback.PublicKeyBasedPrivKeyRequest) {
handlePublicKeyBasedPrivKeyRequest(callback, (DecryptionKeyCallback.PublicKeyBasedPrivKeyRequest) request);
}
else if (request instanceof DecryptionKeyCallback.X509CertificateBasedRequest) {
} else if (request instanceof DecryptionKeyCallback.X509CertificateBasedRequest) {
handleX509CertificateBasedRequest(callback, (DecryptionKeyCallback.X509CertificateBasedRequest) request);
}
else if (request instanceof DecryptionKeyCallback.X509IssuerSerialBasedRequest) {
} else if (request instanceof DecryptionKeyCallback.X509IssuerSerialBasedRequest) {
handleX509IssuerSerialBasedRequest(callback, (DecryptionKeyCallback.X509IssuerSerialBasedRequest) request);
}
else if (request instanceof DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest) {
} else if (request instanceof DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest) {
handleX509SubjectKeyIdentifierBasedRequest(callback,
(DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest) request);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
/**
* Template method that handles {@code DecryptionKeyCallback}s with {@code PublicKeyBasedPrivKeyRequest}s.
* Called from {@code handlePrivateKeyRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code DecryptionKeyCallback}s with {@code PublicKeyBasedPrivKeyRequest}s. Called from
* {@code handlePrivateKeyRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handlePublicKeyBasedPrivKeyRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.PublicKeyBasedPrivKeyRequest request)
throws IOException, UnsupportedCallbackException {
DecryptionKeyCallback.PublicKeyBasedPrivKeyRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code DecryptionKeyCallback}s with {@code X509CertificateBasedRequest}s.
* Called from {@code handlePrivateKeyRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code DecryptionKeyCallback}s with {@code X509CertificateBasedRequest}s. Called from
* {@code handlePrivateKeyRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleX509CertificateBasedRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.X509CertificateBasedRequest request)
throws IOException, UnsupportedCallbackException {
DecryptionKeyCallback.X509CertificateBasedRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code DecryptionKeyCallback}s with {@code X509IssuerSerialBasedRequest}s.
* Called from {@code handlePrivateKeyRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code DecryptionKeyCallback}s with {@code X509IssuerSerialBasedRequest}s. Called from
* {@code handlePrivateKeyRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleX509IssuerSerialBasedRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.X509IssuerSerialBasedRequest request)
throws IOException, UnsupportedCallbackException {
DecryptionKeyCallback.X509IssuerSerialBasedRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
@@ -173,7 +156,7 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
* {@code UnsupportedCallbackException}.
*/
protected void handleX509SubjectKeyIdentifierBasedRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest request)
DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest request)
throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
@@ -183,29 +166,24 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
* {@code handleDecryptionKeyCallback()}. Default implementation delegates to specific handling methods.
*
* @see #handleAliasSymmetricKeyRequest(com.sun.xml.wss.impl.callback.DecryptionKeyCallback,
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.AliasSymmetricKeyRequest)
* com.sun.xml.wss.impl.callback.DecryptionKeyCallback.AliasSymmetricKeyRequest)
*/
protected final void handleSymmetricKeyRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.SymmetricKeyRequest request)
throws IOException, UnsupportedCallbackException {
DecryptionKeyCallback.SymmetricKeyRequest request) throws IOException, UnsupportedCallbackException {
if (request instanceof DecryptionKeyCallback.AliasSymmetricKeyRequest) {
DecryptionKeyCallback.AliasSymmetricKeyRequest aliasSymmetricKeyRequest =
(DecryptionKeyCallback.AliasSymmetricKeyRequest) request;
DecryptionKeyCallback.AliasSymmetricKeyRequest aliasSymmetricKeyRequest = (DecryptionKeyCallback.AliasSymmetricKeyRequest) request;
handleAliasSymmetricKeyRequest(callback, aliasSymmetricKeyRequest);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
/**
* Template method that handles {@code DecryptionKeyCallback}s with {@code AliasSymmetricKeyRequest}s.
* Called from {@code handleSymmetricKeyRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code DecryptionKeyCallback}s with {@code AliasSymmetricKeyRequest}s. Called from
* {@code handleSymmetricKeyRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleAliasSymmetricKeyRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.AliasSymmetricKeyRequest request)
throws IOException, UnsupportedCallbackException {
DecryptionKeyCallback.AliasSymmetricKeyRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
@@ -214,24 +192,21 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
//
/**
* Method that handles {@code EncryptionKeyCallback}s. Called from {@code handleInternal()}. Default
* implementation delegates to specific handling methods.
* Method that handles {@code EncryptionKeyCallback}s. Called from {@code handleInternal()}. Default implementation
* delegates to specific handling methods.
*
* @see #handleSymmetricKeyRequest(com.sun.xml.wss.impl.callback.EncryptionKeyCallback,
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.SymmetricKeyRequest)
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.SymmetricKeyRequest)
* @see #handleX509CertificateRequest(com.sun.xml.wss.impl.callback.EncryptionKeyCallback,
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.X509CertificateRequest)
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.X509CertificateRequest)
*/
protected final void handleEncryptionKeyCallback(EncryptionKeyCallback callback)
throws IOException, UnsupportedCallbackException {
if (callback.getRequest() instanceof EncryptionKeyCallback.SymmetricKeyRequest) {
handleSymmetricKeyRequest(callback, (EncryptionKeyCallback.SymmetricKeyRequest) callback.getRequest());
}
else if (callback.getRequest() instanceof EncryptionKeyCallback.X509CertificateRequest) {
handleX509CertificateRequest(callback,
(EncryptionKeyCallback.X509CertificateRequest) callback.getRequest());
}
else {
} else if (callback.getRequest() instanceof EncryptionKeyCallback.X509CertificateRequest) {
handleX509CertificateRequest(callback, (EncryptionKeyCallback.X509CertificateRequest) callback.getRequest());
} else {
throw new UnsupportedCallbackException(callback);
}
@@ -242,24 +217,21 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
* {@code handleEncryptionKeyCallback()}. Default implementation delegates to specific handling methods.
*
* @see #handleAliasSymmetricKeyRequest(com.sun.xml.wss.impl.callback.EncryptionKeyCallback,
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.AliasSymmetricKeyRequest)
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.AliasSymmetricKeyRequest)
*/
protected final void handleSymmetricKeyRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.SymmetricKeyRequest request)
throws IOException, UnsupportedCallbackException {
EncryptionKeyCallback.SymmetricKeyRequest request) throws IOException, UnsupportedCallbackException {
if (request instanceof EncryptionKeyCallback.AliasSymmetricKeyRequest) {
handleAliasSymmetricKeyRequest(callback, (EncryptionKeyCallback.AliasSymmetricKeyRequest) request);
}
}
/**
* Template method that handles {@code EncryptionKeyCallback}s with {@code AliasSymmetricKeyRequest}s.
* Called from {@code handleSymmetricKeyRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code EncryptionKeyCallback}s with {@code AliasSymmetricKeyRequest}s. Called from
* {@code handleSymmetricKeyRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleAliasSymmetricKeyRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.AliasSymmetricKeyRequest request)
throws IOException, UnsupportedCallbackException {
EncryptionKeyCallback.AliasSymmetricKeyRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
@@ -268,60 +240,49 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
* {@code handleEncryptionKeyCallback()}. Default implementation delegates to specific handling methods.
*
* @see #handleAliasX509CertificateRequest(com.sun.xml.wss.impl.callback.EncryptionKeyCallback,
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.AliasX509CertificateRequest)
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.AliasX509CertificateRequest)
* @see #handleDefaultX509CertificateRequest(com.sun.xml.wss.impl.callback.EncryptionKeyCallback,
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.DefaultX509CertificateRequest)
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.DefaultX509CertificateRequest)
* @see #handlePublicKeyBasedRequest(com.sun.xml.wss.impl.callback.EncryptionKeyCallback,
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.PublicKeyBasedRequest)
* com.sun.xml.wss.impl.callback.EncryptionKeyCallback.PublicKeyBasedRequest)
*/
protected final void handleX509CertificateRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.X509CertificateRequest request)
throws IOException, UnsupportedCallbackException {
EncryptionKeyCallback.X509CertificateRequest request) throws IOException, UnsupportedCallbackException {
if (request instanceof EncryptionKeyCallback.AliasX509CertificateRequest) {
handleAliasX509CertificateRequest(callback, (EncryptionKeyCallback.AliasX509CertificateRequest) request);
}
else if (request instanceof EncryptionKeyCallback.DefaultX509CertificateRequest) {
handleDefaultX509CertificateRequest(callback,
(EncryptionKeyCallback.DefaultX509CertificateRequest) request);
}
else if (request instanceof EncryptionKeyCallback.PublicKeyBasedRequest) {
} else if (request instanceof EncryptionKeyCallback.DefaultX509CertificateRequest) {
handleDefaultX509CertificateRequest(callback, (EncryptionKeyCallback.DefaultX509CertificateRequest) request);
} else if (request instanceof EncryptionKeyCallback.PublicKeyBasedRequest) {
handlePublicKeyBasedRequest(callback, (EncryptionKeyCallback.PublicKeyBasedRequest) request);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
/**
* Template method that handles {@code EncryptionKeyCallback}s with {@code AliasX509CertificateRequest}s.
* Called from {@code handleX509CertificateRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code EncryptionKeyCallback}s with {@code AliasX509CertificateRequest}s. Called from
* {@code handleX509CertificateRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleAliasX509CertificateRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.AliasX509CertificateRequest request)
throws IOException, UnsupportedCallbackException {
EncryptionKeyCallback.AliasX509CertificateRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code EncryptionKeyCallback}s with {@code DefaultX509CertificateRequest}s.
* Called from {@code handleX509CertificateRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code EncryptionKeyCallback}s with {@code DefaultX509CertificateRequest}s. Called
* from {@code handleX509CertificateRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleDefaultX509CertificateRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.DefaultX509CertificateRequest request)
throws IOException, UnsupportedCallbackException {
EncryptionKeyCallback.DefaultX509CertificateRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code EncryptionKeyCallback}s with {@code PublicKeyBasedRequest}s. Called
* from {@code handleX509CertificateRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code EncryptionKeyCallback}s with {@code PublicKeyBasedRequest}s. Called from
* {@code handleX509CertificateRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handlePublicKeyBasedRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.PublicKeyBasedRequest request)
throws IOException, UnsupportedCallbackException {
EncryptionKeyCallback.PublicKeyBasedRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
@@ -330,18 +291,17 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
//
/**
* Method that handles {@code SignatureKeyCallback}s. Called from {@code handleInternal()}. Default
* implementation delegates to specific handling methods.
* Method that handles {@code SignatureKeyCallback}s. Called from {@code handleInternal()}. Default implementation
* delegates to specific handling methods.
*
* @see #handlePrivKeyCertRequest(com.sun.xml.wss.impl.callback.SignatureKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.PrivKeyCertRequest)
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.PrivKeyCertRequest)
*/
protected final void handleSignatureKeyCallback(SignatureKeyCallback callback)
throws IOException, UnsupportedCallbackException {
if (callback.getRequest() instanceof SignatureKeyCallback.PrivKeyCertRequest) {
handlePrivKeyCertRequest(callback, (SignatureKeyCallback.PrivKeyCertRequest) callback.getRequest());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
@@ -351,59 +311,49 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
* {@code handleSignatureKeyCallback()}. Default implementation delegates to specific handling methods.
*
* @see #handleDefaultPrivKeyCertRequest(com.sun.xml.wss.impl.callback.SignatureKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.DefaultPrivKeyCertRequest)
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.DefaultPrivKeyCertRequest)
* @see #handleAliasPrivKeyCertRequest(com.sun.xml.wss.impl.callback.SignatureKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.AliasPrivKeyCertRequest)
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.AliasPrivKeyCertRequest)
* @see #handlePublicKeyBasedPrivKeyCertRequest(com.sun.xml.wss.impl.callback.SignatureKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest)
* com.sun.xml.wss.impl.callback.SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest)
*/
protected final void handlePrivKeyCertRequest(SignatureKeyCallback cb,
SignatureKeyCallback.PrivKeyCertRequest request)
throws IOException, UnsupportedCallbackException {
SignatureKeyCallback.PrivKeyCertRequest request) throws IOException, UnsupportedCallbackException {
if (request instanceof SignatureKeyCallback.DefaultPrivKeyCertRequest) {
handleDefaultPrivKeyCertRequest(cb, (SignatureKeyCallback.DefaultPrivKeyCertRequest) request);
}
else if (cb.getRequest() instanceof SignatureKeyCallback.AliasPrivKeyCertRequest) {
} else if (cb.getRequest() instanceof SignatureKeyCallback.AliasPrivKeyCertRequest) {
handleAliasPrivKeyCertRequest(cb, (SignatureKeyCallback.AliasPrivKeyCertRequest) request);
}
else if (cb.getRequest() instanceof SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest) {
} else if (cb.getRequest() instanceof SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest) {
handlePublicKeyBasedPrivKeyCertRequest(cb, (SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest) request);
}
else {
} else {
throw new UnsupportedCallbackException(cb);
}
}
/**
* Template method that handles {@code SignatureKeyCallback}s with {@code DefaultPrivKeyCertRequest}s.
* Called from {@code handlePrivKeyCertRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code SignatureKeyCallback}s with {@code DefaultPrivKeyCertRequest}s. Called from
* {@code handlePrivKeyCertRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleDefaultPrivKeyCertRequest(SignatureKeyCallback callback,
SignatureKeyCallback.DefaultPrivKeyCertRequest request)
throws IOException, UnsupportedCallbackException {
SignatureKeyCallback.DefaultPrivKeyCertRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code SignatureKeyCallback}s with {@code AliasPrivKeyCertRequest}s.
* Called from {@code handlePrivKeyCertRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code SignatureKeyCallback}s with {@code AliasPrivKeyCertRequest}s. Called from
* {@code handlePrivKeyCertRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleAliasPrivKeyCertRequest(SignatureKeyCallback callback,
SignatureKeyCallback.AliasPrivKeyCertRequest request)
throws IOException, UnsupportedCallbackException {
SignatureKeyCallback.AliasPrivKeyCertRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code SignatureKeyCallback}s with {@code PublicKeyBasedPrivKeyCertRequest}s.
* Called from {@code handlePrivKeyCertRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code SignatureKeyCallback}s with {@code PublicKeyBasedPrivKeyCertRequest}s. Called
* from {@code handlePrivKeyCertRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handlePublicKeyBasedPrivKeyCertRequest(SignatureKeyCallback callback,
SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest request)
throws IOException, UnsupportedCallbackException {
SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
@@ -412,84 +362,75 @@ public class CryptographyCallbackHandler extends AbstractCallbackHandler {
//
/**
* Method that handles {@code SignatureVerificationKeyCallback}s. Called from {@code handleInternal()}.
* Default implementation delegates to specific handling methods.
* Method that handles {@code SignatureVerificationKeyCallback}s. Called from {@code handleInternal()}. Default
* implementation delegates to specific handling methods.
*
* @see #handleX509CertificateRequest(com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.X509CertificateRequest)
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.X509CertificateRequest)
*/
protected final void handleSignatureVerificationKeyCallback(SignatureVerificationKeyCallback callback)
throws UnsupportedCallbackException, IOException {
if (callback.getRequest() instanceof SignatureVerificationKeyCallback.X509CertificateRequest) {
handleX509CertificateRequest(callback,
(SignatureVerificationKeyCallback.X509CertificateRequest) callback.getRequest());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
/**
* Method that handles {@code SignatureVerificationKeyCallback}s with {@code X509CertificateRequest}s.
* Called from {@code handleSignatureVerificationKeyCallback()}. Default implementation delegates to specific
* handling methods.
* Method that handles {@code SignatureVerificationKeyCallback}s with {@code X509CertificateRequest}s. Called from
* {@code handleSignatureVerificationKeyCallback()}. Default implementation delegates to specific handling methods.
*
* @see #handlePublicKeyBasedRequest(com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.PublicKeyBasedRequest)
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.PublicKeyBasedRequest)
* @see #handleX509IssuerSerialBasedRequest(com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest)
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest)
* @see #handleX509SubjectKeyIdentifierBasedRequest(com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback,
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest)
* com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest)
*/
protected final void handleX509CertificateRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.X509CertificateRequest request)
SignatureVerificationKeyCallback.X509CertificateRequest request)
throws UnsupportedCallbackException, IOException {
if (request instanceof SignatureVerificationKeyCallback.PublicKeyBasedRequest) {
handlePublicKeyBasedRequest(callback, (SignatureVerificationKeyCallback.PublicKeyBasedRequest) request);
}
else if (request instanceof SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest) {
} else if (request instanceof SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest) {
handleX509IssuerSerialBasedRequest(callback,
(SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest) request);
}
else if (request instanceof SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest) {
} else if (request instanceof SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest) {
handleX509SubjectKeyIdentifierBasedRequest(callback,
(SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest) request);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
/**
* Template method that handles {@code SignatureKeyCallback}s with {@code PublicKeyBasedPrivKeyCertRequest}s.
* Called from {@code handlePrivKeyCertRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code SignatureKeyCallback}s with {@code PublicKeyBasedPrivKeyCertRequest}s. Called
* from {@code handlePrivKeyCertRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleX509SubjectKeyIdentifierBasedRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest request)
SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest request)
throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code SignatureKeyCallback}s with {@code X509IssuerSerialBasedRequest}s.
* Called from {@code handlePrivKeyCertRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code SignatureKeyCallback}s with {@code X509IssuerSerialBasedRequest}s. Called from
* {@code handlePrivKeyCertRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handleX509IssuerSerialBasedRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest request)
SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest request)
throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
/**
* Template method that handles {@code SignatureKeyCallback}s with {@code PublicKeyBasedRequest}s. Called
* from {@code handlePrivKeyCertRequest()}. Default implementation throws an
* {@code UnsupportedCallbackException}.
* Template method that handles {@code SignatureKeyCallback}s with {@code PublicKeyBasedRequest}s. Called from
* {@code handlePrivKeyCertRequest()}. Default implementation throws an {@code UnsupportedCallbackException}.
*/
protected void handlePublicKeyBasedRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.PublicKeyBasedRequest request)
throws IOException, UnsupportedCallbackException {
SignatureVerificationKeyCallback.PublicKeyBasedRequest request) throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
}

22
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/DefaultTimestampValidator.java
View File

@@ -25,8 +25,8 @@ import java.util.GregorianCalendar;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
/**
* A default implementation of a {@code TimestampValidationCallback.TimestampValidator}. Based on a version found
* in the JWSDP samples.
* A default implementation of a {@code TimestampValidationCallback.TimestampValidator}. Based on a version found in the
* JWSDP samples.
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -37,8 +37,7 @@ public class DefaultTimestampValidator implements TimestampValidationCallback.Ti
public void validate(TimestampValidationCallback.Request request)
throws TimestampValidationCallback.TimestampValidationException {
if (request instanceof TimestampValidationCallback.UTCTimestampRequest) {
TimestampValidationCallback.UTCTimestampRequest utcRequest =
(TimestampValidationCallback.UTCTimestampRequest) request;
TimestampValidationCallback.UTCTimestampRequest utcRequest = (TimestampValidationCallback.UTCTimestampRequest) request;
Date created = parseDate(utcRequest.getCreated());
validateCreationTime(created, utcRequest.getMaxClockSkew(), utcRequest.getTimestampFreshnessLimit());
@@ -47,8 +46,7 @@ public class DefaultTimestampValidator implements TimestampValidationCallback.Ti
Date expired = parseDate(utcRequest.getExpired());
validateExpirationTime(expired, utcRequest.getMaxClockSkew());
}
}
else {
} else {
throw new TimestampValidationCallback.TimestampValidationException("Unsupport request: [" + request + "]");
}
}
@@ -78,8 +76,7 @@ public class DefaultTimestampValidator implements TimestampValidationCallback.Ti
if (addSkew) {
currentTime = currentTime + maxClockSkew;
}
else {
} else {
currentTime = currentTime - maxClockSkew;
}
@@ -94,14 +91,11 @@ public class DefaultTimestampValidator implements TimestampValidationCallback.Ti
try {
try {
return calendarFormatter1.parse(date);
}
catch (ParseException ignored) {
} catch (ParseException ignored) {
return calendarFormatter2.parse(date);
}
}
catch (ParseException ex) {
throw new TimestampValidationCallback.TimestampValidationException("Could not parse request date: " + date,
ex);
} catch (ParseException ex) {
throw new TimestampValidationCallback.TimestampValidationException("Could not parse request date: " + date, ex);
}
}

224
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandler.java
View File

@@ -33,39 +33,68 @@ import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Enumeration;
import javax.crypto.SecretKey;
import org.apache.xml.security.utils.RFC2253Parser;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.ws.soap.security.support.KeyStoreUtils;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import com.sun.xml.wss.impl.callback.DecryptionKeyCallback;
import com.sun.xml.wss.impl.callback.EncryptionKeyCallback;
import com.sun.xml.wss.impl.callback.SignatureKeyCallback;
import com.sun.xml.wss.impl.callback.SignatureVerificationKeyCallback;
import org.apache.xml.security.utils.RFC2253Parser;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.ws.soap.security.support.KeyStoreUtils;
/**
* Callback handler that uses Java Security {@code KeyStore}s to handle cryptographic callbacks. Allows for
* specific key stores to be set for various cryptographic operations.
*
* <p>This handler requires one or more key stores to be set. You can configure them in your application context by using a
* Callback handler that uses Java Security {@code KeyStore}s to handle cryptographic callbacks. Allows for specific key
* stores to be set for various cryptographic operations.
* <p>
* This handler requires one or more key stores to be set. You can configure them in your application context by using a
* {@code KeyStoreFactoryBean}. The exact stores to be set depends on the cryptographic operations that are to be
* performed by this handler. The table underneath show the key store to be used for each operation: <table border="1">
* <tr> <td><strong>Cryptographic operation</strong></td> <td><strong>Key store used</strong></td> </tr> <tr>
* <td>Certificate validation</td> <td>first {@code keyStore}, then {@code trustStore}</td> </tr> <tr>
* <td>Decryption based on private key</td> <td>{@code keyStore}</td> </tr> <tr> <td>Decryption based on symmetric
* key</td> <td>{@code symmetricStore}</td> </tr> <tr> <td>Encryption based on certificate</td>
* <td>{@code trustStore}</td> </tr> <tr> <td>Encryption based on symmetric key</td>
* <td>{@code symmetricStore}</td> </tr> <tr> <td>Signing</td> <td>{@code keyStore}</td> </tr> <tr>
* <td>Signature verification</td> <td>{@code trustStore}</td> </tr> </table>
*
* <p><h3>Default key stores</h3> If the {@code symmetricStore} is not set, it will default to the
* {@code keyStore}. If the key or trust store is not set, this handler will use the standard Java mechanism to
* load or create it. See {@link #loadDefaultKeyStore()} and {@link #loadDefaultTrustStore()}.
*
* <p><h3>Examples</h3> For instance, if you want to use the {@code KeyStoreCallbackHandler} to validate incoming
* performed by this handler. The table underneath show the key store to be used for each operation:
* <table border="1">
* <tr>
* <td><strong>Cryptographic operation</strong></td>
* <td><strong>Key store used</strong></td>
* </tr>
* <tr>
* <td>Certificate validation</td>
* <td>first {@code keyStore}, then {@code trustStore}</td>
* </tr>
* <tr>
* <td>Decryption based on private key</td>
* <td>{@code keyStore}</td>
* </tr>
* <tr>
* <td>Decryption based on symmetric key</td>
* <td>{@code symmetricStore}</td>
* </tr>
* <tr>
* <td>Encryption based on certificate</td>
* <td>{@code trustStore}</td>
* </tr>
* <tr>
* <td>Encryption based on symmetric key</td>
* <td>{@code symmetricStore}</td>
* </tr>
* <tr>
* <td>Signing</td>
* <td>{@code keyStore}</td>
* </tr>
* <tr>
* <td>Signature verification</td>
* <td>{@code trustStore}</td>
* </tr>
* </table>
* <p>
* <h3>Default key stores</h3> If the {@code symmetricStore} is not set, it will default to the {@code keyStore}. If the
* key or trust store is not set, this handler will use the standard Java mechanism to load or create it. See
* {@link #loadDefaultKeyStore()} and {@link #loadDefaultTrustStore()}.
* <p>
* <h3>Examples</h3> For instance, if you want to use the {@code KeyStoreCallbackHandler} to validate incoming
* certificates or signatures, you would use a trust store, like so:
*
* <pre>
* &lt;bean id="keyStoreHandler" class="org.springframework.ws.soap.security.xwss.callback.KeyStoreCallbackHandler"&gt;
* &lt;property name="trustStore" ref="trustStore"/&gt;
@@ -76,8 +105,9 @@ import org.springframework.ws.soap.security.support.KeyStoreUtils;
* &lt;property name="password" value="changeit"/&gt;
* &lt;/bean&gt;
* </pre>
* If you want to use it to decrypt incoming certificates or sign outgoing messages, you would use a key store, like
* so:
*
* If you want to use it to decrypt incoming certificates or sign outgoing messages, you would use a key store, like so:
*
* <pre>
* &lt;bean id="keyStoreHandler" class="org.springframework.ws.soap.security.xwss.callback.KeyStoreCallbackHandler"&gt;
* &lt;property name="keyStore" ref="keyStore"/&gt;
@@ -90,9 +120,9 @@ import org.springframework.ws.soap.security.support.KeyStoreUtils;
* &lt;/bean&gt;
* </pre>
*
* <h3>Handled callbacks</h3> This class handles {@code CertificateValidationCallback}s,
* {@code DecryptionKeyCallback}s, {@code EncryptionKeyCallback}s, {@code SignatureKeyCallback}s, and
* {@code SignatureVerificationKeyCallback}s. It throws an {@code UnsupportedCallbackException} for others.
* <h3>Handled callbacks</h3> This class handles {@code CertificateValidationCallback}s, {@code DecryptionKeyCallback}s,
* {@code EncryptionKeyCallback}s, {@code SignatureKeyCallback}s, and {@code SignatureVerificationKeyCallback}s. It
* throws an {@code UnsupportedCallbackException} for others.
*
* @author Arjen Poutsma
* @see KeyStore
@@ -103,7 +133,7 @@ import org.springframework.ws.soap.security.support.KeyStoreUtils;
* @see SignatureKeyCallback
* @see SignatureVerificationKeyCallback
* @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509TrustManager">The
* standard Java trust store mechanism</a>
* standard Java trust store mechanism</a>
* @since 1.0.0
*/
public class KeyStoreCallbackHandler extends CryptographyCallbackHandler implements InitializingBean {
@@ -129,8 +159,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
private static X509Certificate getCertificate(String alias, KeyStore store) throws IOException {
try {
return (X509Certificate) store.getCertificate(alias);
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
}
@@ -149,8 +178,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return x509Cert;
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -183,8 +211,8 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
}
/**
* Sets the password used to retrieve keys from the symmetric keystore. If this property is not set, it default to
* the private key password.
* Sets the password used to retrieve keys from the symmetric keystore. If this property is not set, it default to the
* private key password.
*
* @see #setPrivateKeyPassword(String)
*/
@@ -217,8 +245,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
}
/**
* Determines if certificate revocation checking is enabled or not. Default is
* {@code false}.
* Determines if certificate revocation checking is enabled or not. Default is {@code false}.
*/
public void setRevocationEnabled(boolean revocationEnabled) {
this.revocationEnabled = revocationEnabled;
@@ -242,8 +269,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
@Override
protected final void handleAliasPrivKeyCertRequest(SignatureKeyCallback callback,
SignatureKeyCallback.AliasPrivKeyCertRequest request)
throws IOException {
SignatureKeyCallback.AliasPrivKeyCertRequest request) throws IOException {
PrivateKey privateKey = getPrivateKey(request.getAlias());
X509Certificate certificate = getCertificate(request.getAlias());
request.setPrivateKey(privateKey);
@@ -252,8 +278,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
@Override
protected final void handleAliasSymmetricKeyRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.AliasSymmetricKeyRequest request)
throws IOException {
DecryptionKeyCallback.AliasSymmetricKeyRequest request) throws IOException {
SecretKey secretKey = getSymmetricKey(request.getAlias());
request.setSymmetricKey(secretKey);
}
@@ -264,16 +289,14 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
@Override
protected final void handleAliasSymmetricKeyRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.AliasSymmetricKeyRequest request)
throws IOException {
EncryptionKeyCallback.AliasSymmetricKeyRequest request) throws IOException {
SecretKey secretKey = getSymmetricKey(request.getAlias());
request.setSymmetricKey(secretKey);
}
@Override
protected final void handleAliasX509CertificateRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.AliasX509CertificateRequest request)
throws IOException {
EncryptionKeyCallback.AliasX509CertificateRequest request) throws IOException {
X509Certificate certificate = getCertificateFromTrustStore(request.getAlias());
request.setX509Certificate(certificate);
}
@@ -293,8 +316,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
@Override
protected final void handleDefaultPrivKeyCertRequest(SignatureKeyCallback callback,
SignatureKeyCallback.DefaultPrivKeyCertRequest request)
throws IOException {
SignatureKeyCallback.DefaultPrivKeyCertRequest request) throws IOException {
PrivateKey privateKey = getPrivateKey(defaultAlias);
X509Certificate certificate = getCertificate(defaultAlias);
request.setPrivateKey(privateKey);
@@ -303,16 +325,14 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
@Override
protected final void handleDefaultX509CertificateRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.DefaultX509CertificateRequest request)
throws IOException {
EncryptionKeyCallback.DefaultX509CertificateRequest request) throws IOException {
X509Certificate certificate = getCertificateFromTrustStore(defaultAlias);
request.setX509Certificate(certificate);
}
@Override
protected final void handlePublicKeyBasedPrivKeyCertRequest(SignatureKeyCallback callback,
SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest request)
throws IOException {
SignatureKeyCallback.PublicKeyBasedPrivKeyCertRequest request) throws IOException {
PrivateKey privateKey = getPrivateKey(request.getPublicKey());
X509Certificate certificate = getCertificate(request.getPublicKey());
request.setPrivateKey(privateKey);
@@ -324,56 +344,49 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
//
@Override
protected final void handlePublicKeyBasedPrivKeyRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.PublicKeyBasedPrivKeyRequest request)
throws IOException {
DecryptionKeyCallback.PublicKeyBasedPrivKeyRequest request) throws IOException {
PrivateKey key = getPrivateKey(request.getPublicKey());
request.setPrivateKey(key);
}
@Override
protected final void handlePublicKeyBasedRequest(EncryptionKeyCallback callback,
EncryptionKeyCallback.PublicKeyBasedRequest request)
throws IOException {
EncryptionKeyCallback.PublicKeyBasedRequest request) throws IOException {
X509Certificate certificate = getCertificateFromTrustStore(request.getPublicKey());
request.setX509Certificate(certificate);
}
@Override
protected final void handlePublicKeyBasedRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.PublicKeyBasedRequest request)
throws IOException {
SignatureVerificationKeyCallback.PublicKeyBasedRequest request) throws IOException {
X509Certificate certificate = getCertificateFromTrustStore(request.getPublicKey());
request.setX509Certificate(certificate);
}
@Override
protected final void handleX509CertificateBasedRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.X509CertificateBasedRequest request)
throws IOException {
DecryptionKeyCallback.X509CertificateBasedRequest request) throws IOException {
PrivateKey privKey = getPrivateKey(request.getX509Certificate());
request.setPrivateKey(privKey);
}
@Override
protected final void handleX509IssuerSerialBasedRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.X509IssuerSerialBasedRequest request)
throws IOException {
DecryptionKeyCallback.X509IssuerSerialBasedRequest request) throws IOException {
PrivateKey key = getPrivateKey(request.getIssuerName(), request.getSerialNumber());
request.setPrivateKey(key);
}
@Override
protected final void handleX509IssuerSerialBasedRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest request)
throws IOException {
SignatureVerificationKeyCallback.X509IssuerSerialBasedRequest request) throws IOException {
X509Certificate certificate = getCertificateFromTrustStore(request.getIssuerName(), request.getSerialNumber());
request.setX509Certificate(certificate);
}
@Override
protected final void handleX509SubjectKeyIdentifierBasedRequest(DecryptionKeyCallback callback,
DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest request)
throws IOException {
DecryptionKeyCallback.X509SubjectKeyIdentifierBasedRequest request) throws IOException {
PrivateKey key = getPrivateKey(request.getSubjectKeyIdentifier());
request.setPrivateKey(key);
}
@@ -384,8 +397,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
@Override
protected final void handleX509SubjectKeyIdentifierBasedRequest(SignatureVerificationKeyCallback callback,
SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest request)
throws IOException {
SignatureVerificationKeyCallback.X509SubjectKeyIdentifierBasedRequest request) throws IOException {
X509Certificate certificate = getCertificateFromTrustStore(request.getSubjectKeyIdentifier());
request.setX509Certificate(certificate);
}
@@ -423,8 +435,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return x509Cert;
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -451,8 +462,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return x509Cert;
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -463,8 +473,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
protected PrivateKey getPrivateKey(String alias) throws IOException {
try {
return (PrivateKey) keyStore.getKey(alias, privateKeyPassword);
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
}
@@ -479,8 +488,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return (PrivateKey) keyStore.getKey(alias, privateKeyPassword);
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -499,8 +507,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return (PrivateKey) keyStore.getKey(alias, privateKeyPassword);
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -528,8 +535,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return (PrivateKey) keyStore.getKey(alias, privateKeyPassword);
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -554,8 +560,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return (PrivateKey) keyStore.getKey(alias, privateKeyPassword);
}
}
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
return null;
@@ -580,8 +585,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
protected SecretKey getSymmetricKey(String alias) throws IOException {
try {
return (SecretKey) symmetricStore.getKey(alias, symmetricKeyPassword);
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new IOException(e.getMessage());
}
}
@@ -593,8 +597,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
if (logger.isDebugEnabled()) {
logger.debug("Loaded default key store");
}
}
catch (Exception ex) {
} catch (Exception ex) {
logger.warn("Could not open default key store", ex);
}
}
@@ -606,16 +609,14 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
if (logger.isDebugEnabled()) {
logger.debug("Loaded default trust store");
}
}
catch (Exception ex) {
} catch (Exception ex) {
logger.warn("Could not open default trust store", ex);
}
}
/**
* Creates a {@code PKIXBuilderParameters} instance with the given parameters.
* Default implementation simply instantiates one, without setting additional
* parameters.
* Creates a {@code PKIXBuilderParameters} instance with the given parameters. Default implementation simply
* instantiates one, without setting additional parameters.
*
* @param trustStore the trust store to use
* @param certSelector the certificate selector to use
@@ -628,7 +629,6 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
return new PKIXBuilderParameters(trustStore, certSelector);
}
//
// Inner classes
//
@@ -640,29 +640,25 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
throws CertificateValidationCallback.CertificateValidationException {
if (isOwnedCert(certificate)) {
if (logger.isDebugEnabled()) {
logger.debug("Certificate with DN [" + certificate.getSubjectX500Principal().getName() +
"] is in private keystore");
logger.debug(
"Certificate with DN [" + certificate.getSubjectX500Principal().getName() + "] is in private keystore");
}
return true;
}
else if (trustStore == null) {
} else if (trustStore == null) {
return false;
}
try {
certificate.checkValidity();
}
catch (CertificateExpiredException e) {
} catch (CertificateExpiredException e) {
if (logger.isDebugEnabled()) {
logger.debug("Certificate with DN [" + certificate.getSubjectX500Principal().getName() +
"] has expired");
logger.debug("Certificate with DN [" + certificate.getSubjectX500Principal().getName() + "] has expired");
}
return false;
}
catch (CertificateNotYetValidException e) {
} catch (CertificateNotYetValidException e) {
if (logger.isDebugEnabled()) {
logger.debug("Certificate with DN [" + certificate.getSubjectX500Principal().getName() +
"] is not yet valid");
logger
.debug("Certificate with DN [" + certificate.getSubjectX500Principal().getName() + "] is not yet valid");
}
return false;
}
@@ -676,26 +672,23 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
parameters = createBuilderParameters(trustStore, certSelector);
parameters.setRevocationEnabled(revocationEnabled);
builder = CertPathBuilder.getInstance("PKIX");
}
catch (GeneralSecurityException ex) {
throw new CertificateValidationCallback.CertificateValidationException(
"Could not create PKIX CertPathBuilder", ex);
} catch (GeneralSecurityException ex) {
throw new CertificateValidationCallback.CertificateValidationException("Could not create PKIX CertPathBuilder",
ex);
}
try {
builder.build(parameters);
}
catch (CertPathBuilderException e) {
} catch (CertPathBuilderException e) {
if (logger.isDebugEnabled()) {
logger.debug("Certification path of certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] could not be validated");
logger.debug("Certification path of certificate with DN [" + certificate.getSubjectX500Principal().getName()
+ "] could not be validated");
}
return false;
}
catch (InvalidAlgorithmParameterException e) {
} catch (InvalidAlgorithmParameterException e) {
if (logger.isDebugEnabled()) {
logger.debug("Algorithm of certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] could not be validated");
logger.debug("Algorithm of certificate with DN [" + certificate.getSubjectX500Principal().getName()
+ "] could not be validated");
}
return false;
}
@@ -724,8 +717,7 @@ public class KeyStoreCallbackHandler extends CryptographyCallbackHandler impleme
}
}
return false;
}
catch (GeneralSecurityException e) {
} catch (GeneralSecurityException e) {
throw new CertificateValidationCallback.CertificateValidationException(
"Could not determine whether certificate is contained in main key store", e);
}

26
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/MockValidationCallbackHandler.java
View File

@@ -18,22 +18,23 @@ package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import java.security.cert.X509Certificate;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
/**
* Mock implementation of of callback handler that accepts all password and certificate validation callbacks.
*
* <p>If the {@code valid} property is set to {@code true} (the default), this handler simply accepts and
* validates every password or certificate validation callback that is passed to it.
*
* <p>This class handles {@code CertificateValidationCallback}s and {@code PasswordValidationCallback}s, and
* throws an {@code UnsupportedCallbackException} for others
* <p>
* If the {@code valid} property is set to {@code true} (the default), this handler simply accepts and validates every
* password or certificate validation callback that is passed to it.
* <p>
* This class handles {@code CertificateValidationCallback}s and {@code PasswordValidationCallback}s, and throws an
* {@code UnsupportedCallbackException} for others
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -42,8 +43,7 @@ public class MockValidationCallbackHandler extends AbstractCallbackHandler {
private boolean isValid = true;
public MockValidationCallbackHandler() {
}
public MockValidationCallbackHandler() {}
public MockValidationCallbackHandler(boolean valid) {
isValid = valid;
@@ -54,12 +54,10 @@ public class MockValidationCallbackHandler extends AbstractCallbackHandler {
if (callback instanceof CertificateValidationCallback) {
CertificateValidationCallback validationCallback = (CertificateValidationCallback) callback;
validationCallback.setValidator(new MockCertificateValidator());
}
else if (callback instanceof PasswordValidationCallback) {
} else if (callback instanceof PasswordValidationCallback) {
PasswordValidationCallback validationCallback = (PasswordValidationCallback) callback;
validationCallback.setValidator(new MockPasswordValidator());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}

33
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java
View File

@@ -20,22 +20,23 @@ import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
import java.util.Properties;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
/**
* Simple callback handler that validates passwords agains a in-memory {@code Properties} object. Password
* validation is done on a case-sensitive basis.
*
* <p>This class only handles {@code PasswordValidationCallback}s, and throws an
* {@code UnsupportedCallbackException} for others
* Simple callback handler that validates passwords agains a in-memory {@code Properties} object. Password validation is
* done on a case-sensitive basis.
* <p>
* This class only handles {@code PasswordValidationCallback}s, and throws an {@code UnsupportedCallbackException} for
* others
*
* @author Arjen Poutsma
* @see #setUsers(java.util.Properties)
@@ -69,20 +70,17 @@ public class SimplePasswordValidationCallbackHandler extends AbstractCallbackHan
PasswordValidationCallback passwordCallback = (PasswordValidationCallback) callback;
if (passwordCallback.getRequest() instanceof PasswordValidationCallback.PlainTextPasswordRequest) {
passwordCallback.setValidator(new SimplePlainTextPasswordValidator());
}
else if (passwordCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) {
PasswordValidationCallback.DigestPasswordRequest digestPasswordRequest =
(PasswordValidationCallback.DigestPasswordRequest) passwordCallback.getRequest();
} else if (passwordCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) {
PasswordValidationCallback.DigestPasswordRequest digestPasswordRequest = (PasswordValidationCallback.DigestPasswordRequest) passwordCallback
.getRequest();
String password = users.get(digestPasswordRequest.getUsername());
digestPasswordRequest.setPassword(password);
passwordCallback.setValidator(new PasswordValidationCallback.DigestPasswordValidator());
}
}
else if (callback instanceof TimestampValidationCallback) {
} else if (callback instanceof TimestampValidationCallback) {
TimestampValidationCallback timestampCallback = (TimestampValidationCallback) callback;
timestampCallback.setValidator(new DefaultTimestampValidator());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
@@ -92,8 +90,7 @@ public class SimplePasswordValidationCallbackHandler extends AbstractCallbackHan
@Override
public boolean validate(PasswordValidationCallback.Request request)
throws PasswordValidationCallback.PasswordValidationException {
PasswordValidationCallback.PlainTextPasswordRequest plainTextPasswordRequest =
(PasswordValidationCallback.PlainTextPasswordRequest) request;
PasswordValidationCallback.PlainTextPasswordRequest plainTextPasswordRequest = (PasswordValidationCallback.PlainTextPasswordRequest) request;
String password = users.get(plainTextPasswordRequest.getUsername());
return password != null && password.equals(plainTextPasswordRequest.getPassword());
}

21
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimpleUsernamePasswordCallbackHandler.java
View File

@@ -17,20 +17,21 @@
package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
/**
* Simple callback handler that supplies a username and password to a username token at runtime.
*
* <p>This class handles {@code UsernameCallback}s and {@code PasswordCallback}s, and throws an
* <p>
* This class handles {@code UsernameCallback}s and {@code PasswordCallback}s, and throws an
* {@code UnsupportedCallbackException} for others
*
* @author Arjen Poutsma
@@ -44,12 +45,10 @@ public class SimpleUsernamePasswordCallbackHandler extends AbstractCallbackHandl
private String password;
/**
* Constructs an empty instance of the {@code SimpleUsernamePasswordCallbackHandler}.
*/
public SimpleUsernamePasswordCallbackHandler() {
}
public SimpleUsernamePasswordCallbackHandler() {}
/**
* Constructs an instance of the {@code SimpleUsernamePasswordCallbackHandler} with the given name and password.
@@ -78,12 +77,10 @@ public class SimpleUsernamePasswordCallbackHandler extends AbstractCallbackHandl
if (callback instanceof UsernameCallback) {
UsernameCallback usernameCallback = (UsernameCallback) callback;
usernameCallback.setUsername(username);
}
else if (callback instanceof PasswordCallback) {
} else if (callback instanceof PasswordCallback) {
PasswordCallback passwordCallback = (PasswordCallback) callback;
passwordCallback.setPassword(password);
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}

52
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SpringCertificateValidationCallbackHandler.java
View File

@@ -18,11 +18,10 @@ package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import java.security.cert.X509Certificate;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
@@ -33,17 +32,20 @@ import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.x509.X509AuthenticationToken;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
/**
* Callback handler that validates a certificate using an Spring Security {@code AuthenticationManager}. Logic
* based on Spring Security's {@code X509ProcessingFilter}.
*
* <p>Spring Security {@code X509AuthenticationToken} is created with the certificate as the credentials.
*
* <p>The configured authentication manager is expected to supply a provider which can handle this token (usually an instance of
* {@code X509AuthenticationProvider}).</p>
*
* <p>This class only handles {@code CertificateValidationCallback}s, and throws an
* {@code UnsupportedCallbackException} for others.
* Callback handler that validates a certificate using an Spring Security {@code AuthenticationManager}. Logic based on
* Spring Security's {@code X509ProcessingFilter}.
* <p>
* Spring Security {@code X509AuthenticationToken} is created with the certificate as the credentials.
* <p>
* The configured authentication manager is expected to supply a provider which can handle this token (usually an
* instance of {@code X509AuthenticationProvider}).
* </p>
* <p>
* This class only handles {@code CertificateValidationCallback}s, and throws an {@code UnsupportedCallbackException}
* for others.
*
* @author Arjen Poutsma
* @see org.springframework.ws.soap.security.x509.X509AuthenticationToken
@@ -72,21 +74,17 @@ public class SpringCertificateValidationCallbackHandler extends AbstractCallback
}
/**
* Handles {@code CertificateValidationCallback}s, and throws an {@code UnsupportedCallbackException} for
* others
* Handles {@code CertificateValidationCallback}s, and throws an {@code UnsupportedCallbackException} for others
*
* @throws javax.security.auth.callback.UnsupportedCallbackException
* when the callback is not supported
* @throws javax.security.auth.callback.UnsupportedCallbackException when the callback is not supported
*/
@Override
protected void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException {
if (callback instanceof CertificateValidationCallback) {
((CertificateValidationCallback) callback).setValidator(new SpringSecurityCertificateValidator());
}
else if (callback instanceof CleanupCallback) {
} else if (callback instanceof CleanupCallback) {
SecurityContextHolder.clearContext();
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
@@ -98,19 +96,17 @@ public class SpringCertificateValidationCallbackHandler extends AbstractCallback
throws CertificateValidationCallback.CertificateValidationException {
boolean result;
try {
Authentication authResult =
authenticationManager.authenticate(new X509AuthenticationToken(certificate));
Authentication authResult = authenticationManager.authenticate(new X509AuthenticationToken(certificate));
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] successful");
logger.debug("Authentication request for certificate with DN ["
+ certificate.getSubjectX500Principal().getName() + "] successful");
}
SecurityContextHolder.getContext().setAuthentication(authResult);
return true;
}
catch (AuthenticationException failed) {
} catch (AuthenticationException failed) {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] failed: " + failed.toString());
logger.debug("Authentication request for certificate with DN ["
+ certificate.getSubjectX500Principal().getName() + "] failed: " + failed.toString());
}
SecurityContextHolder.clearContext();
result = ignoreFailure;

46
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SpringDigestPasswordValidationCallbackHandler.java
View File

@@ -17,12 +17,10 @@
package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.dao.DataAccessException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -37,15 +35,18 @@ import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.support.SpringSecurityUtils;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
/**
* Callback handler that validates a password digest using an Spring Security {@code UserDetailsService}. Logic
* based on Spring Security's {@code DigestProcessingFilter}.
*
* <p>An Spring Security {@code UserDetailService} is used to load {@code UserDetails} from. The digest of the
* password contained in this details object is then compared with the digest in the message.
*
* <p>This class only handles {@code PasswordValidationCallback}s that contain a {@code DigestPasswordRequest},
* and throws an {@code UnsupportedCallbackException} for others.
* Callback handler that validates a password digest using an Spring Security {@code UserDetailsService}. Logic based on
* Spring Security's {@code DigestProcessingFilter}.
* <p>
* An Spring Security {@code UserDetailService} is used to load {@code UserDetails} from. The digest of the password
* contained in this details object is then compared with the digest in the message.
* <p>
* This class only handles {@code PasswordValidationCallback}s that contain a {@code DigestPasswordRequest}, and throws
* an {@code UnsupportedCallbackException} for others.
*
* @author Arjen Poutsma
* @see org.springframework.security.core.userdetails.UserDetailsService
@@ -78,16 +79,15 @@ public class SpringDigestPasswordValidationCallbackHandler extends AbstractCallb
* Handles {@code PasswordValidationCallback}s that contain a {@code DigestPasswordRequest}, and throws an
* {@code UnsupportedCallbackException} for others
*
* @throws javax.security.auth.callback.UnsupportedCallbackException
* when the callback is not supported
* @throws javax.security.auth.callback.UnsupportedCallbackException when the callback is not supported
*/
@Override
protected void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException {
if (callback instanceof PasswordValidationCallback) {
PasswordValidationCallback passwordCallback = (PasswordValidationCallback) callback;
if (passwordCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) {
PasswordValidationCallback.DigestPasswordRequest request =
(PasswordValidationCallback.DigestPasswordRequest) passwordCallback.getRequest();
PasswordValidationCallback.DigestPasswordRequest request = (PasswordValidationCallback.DigestPasswordRequest) passwordCallback
.getRequest();
String username = request.getUsername();
UserDetails user = loadUserDetails(username);
if (user != null) {
@@ -98,13 +98,11 @@ public class SpringDigestPasswordValidationCallbackHandler extends AbstractCallb
passwordCallback.setValidator(validator);
return;
}
}
else if (callback instanceof TimestampValidationCallback) {
} else if (callback instanceof TimestampValidationCallback) {
TimestampValidationCallback timestampCallback = (TimestampValidationCallback) callback;
timestampCallback.setValidator(new DefaultTimestampValidator());
}
else if (callback instanceof CleanupCallback) {
} else if (callback instanceof CleanupCallback) {
SecurityContextHolder.clearContext();
return;
}
@@ -117,8 +115,7 @@ public class SpringDigestPasswordValidationCallbackHandler extends AbstractCallb
if (user == null) {
try {
user = userDetailsService.loadUserByUsername(username);
}
catch (UsernameNotFoundException notFound) {
} catch (UsernameNotFoundException notFound) {
if (logger.isDebugEnabled()) {
logger.debug("Username '" + username + "' not found");
}
@@ -141,16 +138,15 @@ public class SpringDigestPasswordValidationCallbackHandler extends AbstractCallb
public boolean validate(PasswordValidationCallback.Request request)
throws PasswordValidationCallback.PasswordValidationException {
if (super.validate(request)) {
UsernamePasswordAuthenticationToken authRequest =
new UsernamePasswordAuthenticationToken(user, user.getPassword());
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(user,
user.getPassword());
if (logger.isDebugEnabled()) {
logger.debug("Authentication success: " + authRequest.toString());
}
SecurityContextHolder.getContext().setAuthentication(authRequest);
return true;
}
else {
} else {
return false;
}
}

47
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SpringPlainTextPasswordValidationCallbackHandler.java
View File

@@ -17,11 +17,10 @@
package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -32,16 +31,18 @@ import org.springframework.util.Assert;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
/**
* Callback handler that validates a certificate uses an Spring Security {@code AuthenticationManager}. Logic based
* on Spring Security's {@code BasicProcessingFilter}.
*
* <p>This handler requires an Spring Security {@code AuthenticationManager} to operate. It can be set using the
* {@code authenticationManager} property. An Spring Security {@code UsernamePasswordAuthenticationToken} is
* created with the username as principal and password as credentials.
*
* <p>This class only handles {@code PasswordValidationCallback}s that contain a
* {@code PlainTextPasswordRequest}, and throws an {@code UnsupportedCallbackException} for others.
* Callback handler that validates a certificate uses an Spring Security {@code AuthenticationManager}. Logic based on
* Spring Security's {@code BasicProcessingFilter}.
* <p>
* This handler requires an Spring Security {@code AuthenticationManager} to operate. It can be set using the
* {@code authenticationManager} property. An Spring Security {@code UsernamePasswordAuthenticationToken} is created
* with the username as principal and password as credentials.
* <p>
* This class only handles {@code PasswordValidationCallback}s that contain a {@code PlainTextPasswordRequest}, and
* throws an {@code UnsupportedCallbackException} for others.
*
* @author Arjen Poutsma
* @see org.springframework.security.authentication.UsernamePasswordAuthenticationToken
@@ -71,11 +72,10 @@ public class SpringPlainTextPasswordValidationCallbackHandler extends AbstractCa
}
/**
* Handles {@code PasswordValidationCallback}s that contain a {@code PlainTextPasswordRequest}, and throws
* an {@code UnsupportedCallbackException} for others.
* Handles {@code PasswordValidationCallback}s that contain a {@code PlainTextPasswordRequest}, and throws an
* {@code UnsupportedCallbackException} for others.
*
* @throws javax.security.auth.callback.UnsupportedCallbackException
* when the callback is not supported
* @throws javax.security.auth.callback.UnsupportedCallbackException when the callback is not supported
*/
@Override
protected void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException {
@@ -85,8 +85,7 @@ public class SpringPlainTextPasswordValidationCallbackHandler extends AbstractCa
validationCallback.setValidator(new SpringSecurityPlainTextPasswordValidator());
return;
}
}
else if (callback instanceof CleanupCallback) {
} else if (callback instanceof CleanupCallback) {
SecurityContextHolder.clearContext();
return;
}
@@ -98,21 +97,19 @@ public class SpringPlainTextPasswordValidationCallbackHandler extends AbstractCa
@Override
public boolean validate(PasswordValidationCallback.Request request)
throws PasswordValidationCallback.PasswordValidationException {
PasswordValidationCallback.PlainTextPasswordRequest plainTextRequest =
(PasswordValidationCallback.PlainTextPasswordRequest) request;
PasswordValidationCallback.PlainTextPasswordRequest plainTextRequest = (PasswordValidationCallback.PlainTextPasswordRequest) request;
try {
Authentication authResult = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(
plainTextRequest.getUsername(), plainTextRequest.getPassword()));
Authentication authResult = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(plainTextRequest.getUsername(), plainTextRequest.getPassword()));
if (logger.isDebugEnabled()) {
logger.debug("Authentication success: " + authResult.toString());
}
SecurityContextHolder.getContext().setAuthentication(authResult);
return true;
}
catch (AuthenticationException failed) {
} catch (AuthenticationException failed) {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for user '" + plainTextRequest.getUsername() + "' failed: " +
failed.toString());
logger.debug(
"Authentication request for user '" + plainTextRequest.getUsername() + "' failed: " + failed.toString());
}
SecurityContextHolder.clearContext();
return ignoreFailure;

30
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SpringUsernamePasswordCallbackHandler.java
View File

@@ -17,21 +17,22 @@
package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
/**
* Callback handler that adds username/password information to a mesage using an Spring Security {@link
* org.springframework.security.core.context.SecurityContext}.
*
* <p>This class handles {@code UsernameCallback}s and {@code PasswordCallback}s, and throws an
* Callback handler that adds username/password information to a mesage using an Spring Security
* {@link org.springframework.security.core.context.SecurityContext}.
* <p>
* This class handles {@code UsernameCallback}s and {@code PasswordCallback}s, and throws an
* {@code UnsupportedCallbackException} for others
*
* @author Arjen Poutsma
@@ -47,22 +48,17 @@ public class SpringUsernamePasswordCallbackHandler extends AbstractCallbackHandl
UsernameCallback usernameCallback = (UsernameCallback) callback;
usernameCallback.setUsername(authentication.getName());
return;
} else {
logger.warn("Cannot handle UsernameCallback: Spring Security SecurityContext contains no Authentication");
}
else {
logger.warn(
"Cannot handle UsernameCallback: Spring Security SecurityContext contains no Authentication");
}
}
else if (callback instanceof PasswordCallback) {
} else if (callback instanceof PasswordCallback) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication != null && authentication.getName() != null) {
PasswordCallback passwordCallback = (PasswordCallback) callback;
passwordCallback.setPassword(authentication.getCredentials().toString());
return;
}
else {
logger.warn(
"Canot handle PasswordCallback: Spring Security SecurityContext contains no Authentication");
} else {
logger.warn("Canot handle PasswordCallback: Spring Security SecurityContext contains no Authentication");
}
}
throw new UnsupportedCallbackException(callback);

38
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/XwssCallbackHandlerChain.java
View File

@@ -18,16 +18,17 @@ package org.springframework.ws.soap.security.xwss.callback;
import java.io.IOException;
import java.security.cert.X509Certificate;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.springframework.ws.soap.security.callback.CallbackHandlerChain;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
import org.springframework.ws.soap.security.callback.CallbackHandlerChain;
/**
* Represents a chain of {@code CallbackHandler}s. For each callback, each of the handlers is called in term. If a
* handler throws a {@code UnsupportedCallbackException}, the next handler is tried.
@@ -45,14 +46,11 @@ public class XwssCallbackHandlerChain extends CallbackHandlerChain {
protected void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException {
if (callback instanceof CertificateValidationCallback) {
handleCertificateValidationCallback((CertificateValidationCallback) callback);
}
else if (callback instanceof PasswordValidationCallback) {
} else if (callback instanceof PasswordValidationCallback) {
handlePasswordValidationCallback((PasswordValidationCallback) callback);
}
else if (callback instanceof TimestampValidationCallback) {
} else if (callback instanceof TimestampValidationCallback) {
handleTimestampValidationCallback((TimestampValidationCallback) callback);
}
else {
} else {
super.handleInternal(callback);
}
}
@@ -83,13 +81,11 @@ public class XwssCallbackHandlerChain extends CallbackHandlerChain {
for (int i = 0; i < getCallbackHandlers().length; i++) {
CallbackHandler callbackHandler = getCallbackHandlers()[i];
try {
callbackHandler.handle(new Callback[]{callback});
callbackHandler.handle(new Callback[] { callback });
callback.getResult();
}
catch (IOException e) {
} catch (IOException e) {
throw new TimestampValidationCallback.TimestampValidationException(e);
}
catch (UnsupportedCallbackException e) {
} catch (UnsupportedCallbackException e) {
// ignore
}
}
@@ -111,16 +107,14 @@ public class XwssCallbackHandlerChain extends CallbackHandlerChain {
for (int i = 0; i < getCallbackHandlers().length; i++) {
CallbackHandler callbackHandler = getCallbackHandlers()[i];
try {
callbackHandler.handle(new Callback[]{callback});
callbackHandler.handle(new Callback[] { callback });
allUnsupported = false;
if (!callback.getResult()) {
return false;
}
}
catch (IOException e) {
} catch (IOException e) {
throw new PasswordValidationCallback.PasswordValidationException(e);
}
catch (UnsupportedCallbackException e) {
} catch (UnsupportedCallbackException e) {
// ignore
}
}
@@ -143,16 +137,14 @@ public class XwssCallbackHandlerChain extends CallbackHandlerChain {
for (int i = 0; i < getCallbackHandlers().length; i++) {
CallbackHandler callbackHandler = getCallbackHandlers()[i];
try {
callbackHandler.handle(new Callback[]{callback});
callbackHandler.handle(new Callback[] { callback });
allUnsupported = false;
if (!callback.getResult()) {
return false;
}
}
catch (IOException e) {
} catch (IOException e) {
throw new CertificateValidationCallback.CertificateValidationException(e);
}
catch (UnsupportedCallbackException e) {
} catch (UnsupportedCallbackException e) {
// ignore
}
}

3
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/AbstractJaasValidationCallbackHandler.java
View File

@@ -31,8 +31,7 @@ public abstract class AbstractJaasValidationCallbackHandler extends AbstractCall
private String loginContextName;
protected AbstractJaasValidationCallbackHandler() {
}
protected AbstractJaasValidationCallbackHandler() {}
/** Returns the login context name. */
public String getLoginContextName() {

37
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasCertificateValidationCallbackHandler.java
View File

@@ -17,6 +17,7 @@
package org.springframework.ws.soap.security.xwss.callback.jaas;
import java.security.cert.X509Certificate;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -28,9 +29,9 @@ import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
/**
* Provides basic support for integrating with JAAS and certificates. Requires the {@code loginContextName} to be
* set.Requires a {@code LoginContext} which handles {@code X500Principal}s.
*
* <p>This class only handles {@code CertificateValidationCallback}s, and throws an
* {@code UnsupportedCallbackException} for others.
* <p>
* This class only handles {@code CertificateValidationCallback}s, and throws an {@code UnsupportedCallbackException}
* for others.
*
* @author Arjen Poutsma
* @see javax.security.auth.x500.X500Principal
@@ -40,8 +41,7 @@ import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
public class JaasCertificateValidationCallbackHandler extends AbstractJaasValidationCallbackHandler {
/**
* Handles {@code CertificateValidationCallback}s, and throws an {@code UnsupportedCallbackException} for
* others
* Handles {@code CertificateValidationCallback}s, and throws an {@code UnsupportedCallbackException} for others
*
* @throws UnsupportedCallbackException when the callback is not supported
*/
@@ -49,8 +49,7 @@ public class JaasCertificateValidationCallbackHandler extends AbstractJaasValida
protected final void handleInternal(Callback callback) throws UnsupportedCallbackException {
if (callback instanceof CertificateValidationCallback) {
((CertificateValidationCallback) callback).setValidator(new JaasCertificateValidator());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
@@ -65,11 +64,9 @@ public class JaasCertificateValidationCallbackHandler extends AbstractJaasValida
LoginContext loginContext;
try {
loginContext = new LoginContext(getLoginContextName(), subject);
}
catch (LoginException ex) {
} catch (LoginException ex) {
throw new CertificateValidationCallback.CertificateValidationException(ex);
}
catch (SecurityException ex) {
} catch (SecurityException ex) {
throw new CertificateValidationCallback.CertificateValidationException(ex);
}
@@ -78,23 +75,21 @@ public class JaasCertificateValidationCallbackHandler extends AbstractJaasValida
Subject subj = loginContext.getSubject();
if (!subj.getPrincipals().isEmpty()) {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] successful");
logger.debug("Authentication request for certificate with DN ["
+ certificate.getSubjectX500Principal().getName() + "] successful");
}
return true;
}
else {
} else {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] failed");
logger.debug("Authentication request for certificate with DN ["
+ certificate.getSubjectX500Principal().getName() + "] failed");
}
return false;
}
}
catch (LoginException ex) {
} catch (LoginException ex) {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for certificate with DN [" +
certificate.getSubjectX500Principal().getName() + "] failed");
logger.debug("Authentication request for certificate with DN ["
+ certificate.getSubjectX500Principal().getName() + "] failed");
}
return false;
}

37
spring-ws-security/src/main/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasPlainTextPasswordValidationCallbackHandler.java
View File

@@ -24,15 +24,15 @@ import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
/**
* Provides basic support for integrating with JAAS and plain text passwords.
*
* <p>This class only handles {@code PasswordValidationCallback}s that contain a
* {@code PlainTextPasswordRequest}, and throws an {@code UnsupportedCallbackException} for others.
* <p>
* This class only handles {@code PasswordValidationCallback}s that contain a {@code PlainTextPasswordRequest}, and
* throws an {@code UnsupportedCallbackException} for others.
*
* @author Arjen Poutsma
* @see #getLoginContextName()
@@ -41,8 +41,8 @@ import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
public class JaasPlainTextPasswordValidationCallbackHandler extends AbstractJaasValidationCallbackHandler {
/**
* Handles {@code PasswordValidationCallback}s that contain a {@code PlainTextPasswordRequest}, and throws
* an {@code UnsupportedCallbackException} for others.
* Handles {@code PasswordValidationCallback}s that contain a {@code PlainTextPasswordRequest}, and throws an
* {@code UnsupportedCallbackException} for others.
*
* @throws UnsupportedCallbackException when the callback is not supported
*/
@@ -63,8 +63,7 @@ public class JaasPlainTextPasswordValidationCallbackHandler extends AbstractJaas
@Override
public boolean validate(PasswordValidationCallback.Request request)
throws PasswordValidationCallback.PasswordValidationException {
PasswordValidationCallback.PlainTextPasswordRequest plainTextRequest =
(PasswordValidationCallback.PlainTextPasswordRequest) request;
PasswordValidationCallback.PlainTextPasswordRequest plainTextRequest = (PasswordValidationCallback.PlainTextPasswordRequest) request;
final String username = plainTextRequest.getUsername();
final String password = plainTextRequest.getPassword();
@@ -77,20 +76,16 @@ public class JaasPlainTextPasswordValidationCallbackHandler extends AbstractJaas
protected void handleInternal(Callback callback) throws UnsupportedCallbackException {
if (callback instanceof NameCallback) {
((NameCallback) callback).setName(username);
}
else if (callback instanceof PasswordCallback) {
} else if (callback instanceof PasswordCallback) {
((PasswordCallback) callback).setPassword(password.toCharArray());
}
else {
} else {
throw new UnsupportedCallbackException(callback);
}
}
});
}
catch (LoginException ex) {
} catch (LoginException ex) {
throw new PasswordValidationCallback.PasswordValidationException(ex);
}
catch (SecurityException ex) {
} catch (SecurityException ex) {
throw new PasswordValidationCallback.PasswordValidationException(ex);
}
@@ -102,15 +97,13 @@ public class JaasPlainTextPasswordValidationCallbackHandler extends AbstractJaas
logger.debug("Authentication request for user '" + username + "' successful");
}
return true;
}
else {
} else {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for user '" + username + "' failed");
}
return false;
}
}
catch (LoginException ex) {
} catch (LoginException ex) {
if (logger.isDebugEnabled()) {
logger.debug("Authentication request for user '" + username + "' failed");
}
@@ -118,7 +111,5 @@ public class JaasPlainTextPasswordValidationCallbackHandler extends AbstractJaas
}
}
}
}

39
spring-ws-security/src/test/java/org/springframework/ws/soap/security/SkipValidationWsSecurityInterceptorTest.java
View File

@@ -1,7 +1,6 @@
package org.springframework.ws.soap.security;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
import static org.junit.Assert.*;
import java.io.IOException;
import java.io.InputStream;
@@ -33,21 +32,17 @@ public class SkipValidationWsSecurityInterceptorTest {
interceptor = new AbstractWsSecurityInterceptor() {
@Override
protected void validateMessage(SoapMessage soapMessage,
MessageContext messageContext)
protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
throws WsSecurityValidationException {
fail("validation must be skipped.");
}
@Override
protected void secureMessage(SoapMessage soapMessage,
MessageContext messageContext)
throws WsSecuritySecurementException {
}
protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
throws WsSecuritySecurementException {}
@Override
protected void cleanUp() {
}
protected void cleanUp() {}
};
interceptor.setSkipValidationIfNoHeaderPresent(true);
}
@@ -56,7 +51,7 @@ public class SkipValidationWsSecurityInterceptorTest {
public void testSkipValidationOnNoHeader() throws Exception {
doTestSkipValidation("noHeader-soap.xml");
}
@Test
public void testSkipValidationOnEmptyHeader() throws Exception {
doTestSkipValidation("emptyHeader-soap.xml");
@@ -66,31 +61,25 @@ public class SkipValidationWsSecurityInterceptorTest {
public void testSkipValidationOnNoSecurityHeader() throws Exception {
doTestSkipValidation("noSecurityHeader-soap.xml");
}
private void doTestSkipValidation(String fileName) throws Exception {
SoapMessage message = loadSaajMessage(fileName);
MessageContext messageContext = new DefaultMessageContext(message,
soapMessageFactory);
assertTrue("handeRequest result must be true", interceptor
.handleRequest(messageContext, null));
MessageContext messageContext = new DefaultMessageContext(message, soapMessageFactory);
assertTrue("handeRequest result must be true", interceptor.handleRequest(messageContext, null));
}
private SaajSoapMessage loadSaajMessage(String fileName)
throws SOAPException, IOException {
private SaajSoapMessage loadSaajMessage(String fileName) throws SOAPException, IOException {
MimeHeaders mimeHeaders = new MimeHeaders();
mimeHeaders.addHeader("Content-Type", "text/xml");
Resource resource = new ClassPathResource(fileName, getClass());
InputStream is = resource.getInputStream();
try {
assertTrue("Could not load SAAJ message [" + resource + "]",
resource.exists());
assertTrue("Could not load SAAJ message [" + resource + "]", resource.exists());
is = resource.getInputStream();
return new SaajSoapMessage(messageFactory.createMessage(
mimeHeaders, is));
return new SaajSoapMessage(messageFactory.createMessage(mimeHeaders, is));
} finally {
is.close();
}
}
}
}

20
spring-ws-security/src/test/java/org/springframework/ws/soap/security/callback/CallbackHandlerChainTest.java
View File

@@ -25,8 +25,7 @@ import org.junit.Test;
public class CallbackHandlerChainTest {
private CallbackHandler supported = new CallbackHandler() {
public void handle(Callback[] callbacks) {
}
public void handle(Callback[] callbacks) {}
};
private CallbackHandler unsupported = new CallbackHandler() {
@@ -35,24 +34,23 @@ public class CallbackHandlerChainTest {
}
};
private Callback callback = new Callback() {
};
private Callback callback = new Callback() {};
@Test
public void testSupported() throws Exception {
CallbackHandlerChain chain = new CallbackHandlerChain(new CallbackHandler[]{supported});
chain.handle(new Callback[]{callback});
CallbackHandlerChain chain = new CallbackHandlerChain(new CallbackHandler[] { supported });
chain.handle(new Callback[] { callback });
}
@Test
public void testUnsupportedSupported() throws Exception {
CallbackHandlerChain chain = new CallbackHandlerChain(new CallbackHandler[]{unsupported, supported});
chain.handle(new Callback[]{callback});
CallbackHandlerChain chain = new CallbackHandlerChain(new CallbackHandler[] { unsupported, supported });
chain.handle(new Callback[] { callback });
}
@Test(expected = UnsupportedCallbackException.class)
public void testUnsupported() throws Exception {
CallbackHandlerChain chain = new CallbackHandlerChain(new CallbackHandler[]{unsupported});
chain.handle(new Callback[]{callback});
CallbackHandlerChain chain = new CallbackHandlerChain(new CallbackHandler[] { unsupported });
chain.handle(new Callback[] { callback });
}
}
}

4
spring-ws-security/src/test/java/org/springframework/ws/soap/security/support/KeyManagersFactoryBeanTest.java
View File

@@ -16,10 +16,10 @@
package org.springframework.ws.soap.security.support;
import static org.junit.Assert.*;
import javax.net.ssl.KeyManager;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import org.junit.Test;
public class KeyManagersFactoryBeanTest {

4
spring-ws-security/src/test/java/org/springframework/ws/soap/security/support/TrustManagersFactoryBeanTest.java
View File

@@ -16,10 +16,10 @@
package org.springframework.ws.soap.security.support;
import static org.junit.Assert.*;
import javax.net.ssl.TrustManager;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import org.junit.Test;
public class TrustManagersFactoryBeanTest {

2
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/AxiomWss4jMessageInterceptorSpringSecurityCallbackHandlerTest.java
View File

@@ -19,4 +19,4 @@ package org.springframework.ws.soap.security.wss4j2;
public class AxiomWss4jMessageInterceptorSpringSecurityCallbackHandlerTest
extends Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase {
}
}

16
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jMessageInterceptorSignTest.java
View File

@@ -16,9 +16,12 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.*;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.util.Iterator;
import javax.xml.namespace.QName;
import javax.xml.soap.MimeHeaders;
import javax.xml.soap.SOAPHeader;
@@ -28,7 +31,6 @@ import javax.xml.transform.Transformer;
import javax.xml.transform.dom.DOMResult;
import org.junit.Test;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
@@ -37,12 +39,9 @@ import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.xml.transform.StringSource;
import org.springframework.xml.transform.TransformerFactoryUtils;
import static org.junit.Assert.*;
public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptorSignTestCase {
private static final String PAYLOAD =
"<tru:StockSymbol xmlns:tru=\"http://fabrikam123.com/payloads\">QQQ</tru:StockSymbol>";
private static final String PAYLOAD = "<tru:StockSymbol xmlns:tru=\"http://fabrikam123.com/payloads\">QQQ</tru:StockSymbol>";
@Test
public void testSignAndValidate() throws Exception {
@@ -54,13 +53,14 @@ public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptor
SOAPMessage saajMessage = saajSoap11MessageFactory.createMessage();
transformer.transform(new StringSource(PAYLOAD), new DOMResult(saajMessage.getSOAPBody()));
SoapMessage message = new SaajSoapMessage(saajMessage, saajSoap11MessageFactory);
MessageContext messageContext = new DefaultMessageContext(message, new SaajSoapMessageFactory(saajSoap11MessageFactory));
MessageContext messageContext = new DefaultMessageContext(message,
new SaajSoapMessageFactory(saajSoap11MessageFactory));
interceptor.secureMessage(message, messageContext);
SOAPHeader header = ((SaajSoapMessage) message).getSaajMessage().getSOAPHeader();
Iterator<?> iterator = header.getChildElements(new QName(
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security"));
Iterator<?> iterator = header.getChildElements(
new QName("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security"));
assertTrue("No security header", iterator.hasNext());
SOAPHeaderElement securityHeader = (SOAPHeaderElement) iterator.next();
iterator = securityHeader.getChildElements(new QName("http://www.w3.org/2000/09/xmldsig#", "Signature"));

2
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jMessageInterceptorSpringSecurityCallbackHandlerTest.java
View File

@@ -19,4 +19,4 @@ package org.springframework.ws.soap.security.wss4j2;
public class SaajWss4jMessageInterceptorSpringSecurityCallbackHandlerTest
extends Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase {
}
}

5
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jInterceptorTestCase.java
View File

@@ -16,9 +16,10 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.*;
import org.apache.wss4j.dom.engine.WSSecurityEngine;
import org.junit.Test;
import org.springframework.test.util.ReflectionTestUtils;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
@@ -26,8 +27,6 @@ import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.WsSecuritySecurementException;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import static org.junit.Assert.*;
public abstract class Wss4jInterceptorTestCase extends Wss4jTestCase {
@Test

9
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorEncryptionTestCase.java
View File

@@ -19,13 +19,12 @@ package org.springframework.ws.soap.security.wss4j2;
import java.util.Properties;
import org.junit.Test;
import org.w3c.dom.Document;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.KeyStoreCallbackHandler;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorEncryptionTestCase extends Wss4jTestCase {
@@ -53,10 +52,8 @@ public abstract class Wss4jMessageInterceptorEncryptionTestCase extends Wss4jTes
cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.file", "private.jks");
cryptoFactoryBean.setConfiguration(cryptoFactoryBeanConfig);
cryptoFactoryBean.afterPropertiesSet();
interceptor.setValidationDecryptionCrypto(cryptoFactoryBean
.getObject());
interceptor.setSecurementEncryptionCrypto(cryptoFactoryBean
.getObject());
interceptor.setValidationDecryptionCrypto(cryptoFactoryBean.getObject());
interceptor.setSecurementEncryptionCrypto(cryptoFactoryBean.getObject());
interceptor.afterPropertiesSet();
}

8
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorHeaderTestCase.java
View File

@@ -21,10 +21,10 @@ import static org.junit.Assert.*;
import java.io.ByteArrayOutputStream;
import java.util.Iterator;
import java.util.Properties;
import javax.xml.namespace.QName;
import org.junit.Test;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapHeaderElement;
@@ -63,7 +63,7 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
interceptorThatKeepsSecurityHeader.setRemoveSecurityHeader(false);
interceptorThatKeepsSecurityHeader.afterPropertiesSet();
}
@Test
public void testValidateUsernameTokenPlainText() throws Exception {
SoapMessage message = loadSoap11Message("usernameTokenPlainTextWithHeaders-soap.xml");
@@ -114,13 +114,13 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
}
@Test(expected=WsSecurityValidationException.class)
@Test(expected = WsSecurityValidationException.class)
public void testEmptySecurityHeader() throws Exception {
SoapMessage message = loadSoap11Message("emptySecurityHeader-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getSoap11MessageFactory());
interceptor.validateMessage(message, messageContext);
}
@Test
public void testPreserveCustomHeaders() throws Exception {
interceptor.setSecurementActions("UsernameToken");

56
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSamlTestCase.java
View File

@@ -2,6 +2,7 @@ package org.springframework.ws.soap.security.wss4j2;
import java.io.IOException;
import java.security.cert.X509Certificate;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
@@ -15,12 +16,11 @@ import org.apache.wss4j.common.saml.bean.SubjectBean;
import org.apache.wss4j.common.saml.bean.Version;
import org.apache.wss4j.common.saml.builder.SAML2Constants;
import org.junit.Test;
import org.w3c.dom.Document;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorSamlTestCase extends Wss4jTestCase {
@@ -38,18 +38,18 @@ public abstract class Wss4jMessageInterceptorSamlTestCase extends Wss4jTestCase
cryptoFactoryBean.setKeyStoreLocation(new ClassPathResource("private.jks"));
cryptoFactoryBean.afterPropertiesSet();
Crypto crypto = cryptoFactoryBean.getObject();
CryptoType type = new CryptoType(CryptoType.TYPE.ALIAS);
type.setAlias("rsaKey");
X509Certificate userCertificate = crypto.getX509Certificates(type)[0];
interceptor.setSecurementSignatureCrypto(crypto);
interceptor.setValidationSignatureCrypto(crypto);
interceptor.setSecurementSamlCallbackHandler(getSamlCalbackHandler(crypto, userCertificate));
interceptor.afterPropertiesSet();
}
@Test
public void testAddSAML() throws Exception {
interceptor.setSecurementPassword("123456");
@@ -66,43 +66,43 @@ public abstract class Wss4jMessageInterceptorSamlTestCase extends Wss4jTestCase
// lets verify the signature that we've just generated
interceptor.validateMessage(message, messageContext);
}
protected CallbackHandler getSamlCalbackHandler(Crypto crypto, X509Certificate userCert) {
return new SamlCallbackHandler(crypto, userCert);
}
private class SamlCallbackHandler implements CallbackHandler {
private Crypto crypto;
private X509Certificate userCertificate;
public SamlCallbackHandler(Crypto crypto, X509Certificate userCertificate) {
this.crypto = crypto;
this.userCertificate = userCertificate;
}
@Override
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
if (callbacks[i] instanceof SAMLCallback) {
SAMLCallback callback = (SAMLCallback) callbacks[i];
callback.setSamlVersion(Version.SAML_20);
callback.setIssuerCrypto(crypto);
callback.setIssuerKeyName("rsaKey");
callback.setIssuerKeyPassword("123456");
callback.setIssuer("test-issuer");
SubjectBean subject = new SubjectBean("test-subject", "", SAML2Constants.CONF_BEARER);
KeyInfoBean keyInfo = new KeyInfoBean();
keyInfo.setCertificate(userCertificate);
subject.setKeyInfo(keyInfo);
callback.setSubject(subject);
callback.setSignAssertion(true);
}
}
for (int i = 0; i < callbacks.length; i++) {
if (callbacks[i] instanceof SAMLCallback) {
SAMLCallback callback = (SAMLCallback) callbacks[i];
callback.setSamlVersion(Version.SAML_20);
callback.setIssuerCrypto(crypto);
callback.setIssuerKeyName("rsaKey");
callback.setIssuerKeyPassword("123456");
callback.setIssuer("test-issuer");
SubjectBean subject = new SubjectBean("test-subject", "", SAML2Constants.CONF_BEARER);
KeyInfoBean keyInfo = new KeyInfoBean();
keyInfo.setCertificate(userCertificate);
subject.setKeyInfo(keyInfo);
callback.setSubject(subject);
callback.setSignAssertion(true);
}
}
}
}
}

15
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSignTestCase.java
View File

@@ -16,19 +16,18 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.*;
import java.util.Properties;
import org.junit.Test;
import org.springframework.ws.WebServiceMessage;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.junit.Test;
import org.w3c.dom.Document;
import static org.junit.Assert.assertNotNull;
public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase {
protected Wss4jSecurityInterceptor interceptor;
@@ -49,10 +48,8 @@ public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase
cryptoFactoryBeanConfig.setProperty("org.apache.ws.security.crypto.merlin.file", "private.jks");
cryptoFactoryBean.setConfiguration(cryptoFactoryBeanConfig);
cryptoFactoryBean.afterPropertiesSet();
interceptor.setValidationSignatureCrypto(cryptoFactoryBean
.getObject());
interceptor.setSecurementSignatureCrypto(cryptoFactoryBean
.getObject());
interceptor.setValidationSignatureCrypto(cryptoFactoryBean.getObject());
interceptor.setSecurementSignatureCrypto(cryptoFactoryBean.getObject());
interceptor.afterPropertiesSet();
}
@@ -100,7 +97,6 @@ public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase
assertXpathExists("Absent SignatureConfirmation element",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/ds:Signature", document);
}
@Test
@@ -118,6 +114,5 @@ public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase
assertXpathExists("Absent SignatureConfirmation element",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/ds:Signature", document);
}
}

10
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSoapActionTestCase.java
View File

@@ -16,18 +16,17 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.*;
import java.util.Properties;
import org.apache.wss4j.dom.WSConstants;
import org.junit.Test;
import org.springframework.ws.WebServiceMessageFactory;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.SimplePasswordValidationCallbackHandler;
import org.apache.wss4j.dom.WSConstants;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
public abstract class Wss4jMessageInterceptorSoapActionTestCase extends Wss4jTestCase {
@@ -103,5 +102,4 @@ public abstract class Wss4jMessageInterceptorSoapActionTestCase extends Wss4jTes
}
}

23
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase.java
View File

@@ -16,8 +16,14 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.easymock.EasyMock.*;
import static org.junit.Assert.*;
import java.util.Properties;
import org.apache.wss4j.dom.WSConstants;
import org.junit.After;
import org.junit.Test;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -26,13 +32,6 @@ import org.springframework.ws.context.MessageContext;
import org.springframework.ws.server.EndpointInterceptor;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.SpringSecurityPasswordValidationCallbackHandler;
import org.apache.wss4j.dom.WSConstants;
import org.junit.After;
import org.junit.Test;
import static org.easymock.EasyMock.*;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertNull;
public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase extends Wss4jTestCase {
@@ -75,7 +74,6 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
interceptor.setSecurementPassword("Ernie");
interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
SoapMessage message = loadSoap11Message("empty-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getSoap11MessageFactory());
interceptor.handleRequest(messageContext);
@@ -104,18 +102,15 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
if (validating) {
interceptor.setValidationActions(actions);
}
else {
} else {
interceptor.setSecurementActions(actions);
}
SpringSecurityPasswordValidationCallbackHandler callbackHandler =
new SpringSecurityPasswordValidationCallbackHandler();
SpringSecurityPasswordValidationCallbackHandler callbackHandler = new SpringSecurityPasswordValidationCallbackHandler();
InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager(users);
callbackHandler.setUserDetailsService(userDetailsManager);
if (digest) {
interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
}
else {
} else {
interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
}
interceptor.setValidationCallbackHandler(callbackHandler);

20
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorTimestampTestCase.java
View File

@@ -16,19 +16,18 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.*;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import org.junit.Test;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.junit.Test;
import org.w3c.dom.Document;
import static org.junit.Assert.assertEquals;
public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTestCase {
@Test
@@ -40,8 +39,8 @@ public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTest
MessageContext context = getSoap11MessageContext(message);
interceptor.secureMessage(message, context);
Document document = getDocument(message);
assertXpathExists("timestamp header not found",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp", document);
assertXpathExists("timestamp header not found", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp",
document);
}
@Test
@@ -67,7 +66,6 @@ public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTest
interceptor.validateMessage(message, context);
}
@Test
public void testSecureTimestampWithCustomTtl() throws Exception {
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
@@ -79,10 +77,12 @@ public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTest
SoapMessage message = loadSoap11Message("empty-soap.xml");
MessageContext context = new DefaultMessageContext(message, getSoap11MessageFactory());
interceptor.secureMessage(message, context);
String created = xpathTemplate.evaluateAsString("/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp/wsu:Created/text()",
String created = xpathTemplate.evaluateAsString(
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp/wsu:Created/text()",
message.getEnvelope().getSource());
String expires = xpathTemplate.evaluateAsString("/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp/wsu:Expires/text()",
String expires = xpathTemplate.evaluateAsString(
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp/wsu:Expires/text()",
message.getEnvelope().getSource());
DateFormat format = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SS'Z'");

3
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenSignatureTestCase.java
View File

@@ -16,10 +16,9 @@
package org.springframework.ws.soap.security.wss4j2;
import org.junit.Test;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.junit.Test;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorUsernameTokenSignatureTestCase extends Wss4jTestCase {

12
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java
View File

@@ -16,7 +16,7 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.*;
import java.util.Properties;
@@ -132,22 +132,20 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
if (validating) {
interceptor.setValidationActions(actions);
}
else {
} else {
interceptor.setSecurementActions(actions);
}
SimplePasswordValidationCallbackHandler callbackHandler = new SimplePasswordValidationCallbackHandler();
callbackHandler.setUsers(users);
if (digest) {
interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
}
else {
} else {
interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
}
interceptor.setValidationCallbackHandler(callbackHandler);
interceptor.setBspCompliant(false);
interceptor.afterPropertiesSet();
return interceptor;
}

9
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorX509TestCase.java
View File

@@ -18,12 +18,11 @@ package org.springframework.ws.soap.security.wss4j2;
import org.apache.wss4j.common.crypto.Merlin;
import org.junit.Test;
import org.w3c.dom.Document;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorX509TestCase extends Wss4jTestCase {
@@ -41,10 +40,8 @@ public abstract class Wss4jMessageInterceptorX509TestCase extends Wss4jTestCase
cryptoFactoryBean.setKeyStoreLocation(new ClassPathResource("private.jks"));
cryptoFactoryBean.afterPropertiesSet();
interceptor.setSecurementSignatureCrypto(cryptoFactoryBean
.getObject());
interceptor.setValidationSignatureCrypto(cryptoFactoryBean
.getObject());
interceptor.setSecurementSignatureCrypto(cryptoFactoryBean.getObject());
interceptor.setValidationSignatureCrypto(cryptoFactoryBean.getObject());
interceptor.afterPropertiesSet();
}

50
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jTestCase.java
View File

@@ -16,9 +16,12 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.Assert.*;
import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
import javax.xml.soap.MessageFactory;
import javax.xml.soap.MimeHeaders;
import javax.xml.soap.SOAPConstants;
@@ -29,9 +32,6 @@ import org.apache.axiom.om.OMXMLBuilderFactory;
import org.apache.axiom.soap.SOAPModelBuilder;
import org.junit.Assert;
import org.junit.Before;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.ws.WebServiceMessage;
@@ -47,8 +47,8 @@ import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.xml.transform.StringSource;
import org.springframework.xml.xpath.Jaxp13XPathTemplate;
import static org.junit.Assert.*;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
public abstract class Wss4jTestCase {
@@ -71,32 +71,25 @@ public abstract class Wss4jTestCase {
saajSoap12MessageFactory = MessageFactory.newInstance(SOAPConstants.SOAP_1_2_PROTOCOL);
Map<String, String> namespaces = new HashMap<String, String>();
namespaces.put("SOAP-ENV", "http://schemas.xmlsoap.org/soap/envelope/");
namespaces.put("wsse",
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
namespaces.put("wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
namespaces.put("ds", "http://www.w3.org/2000/09/xmldsig#");
namespaces.put("xenc", "http://www.w3.org/2001/04/xmlenc#");
namespaces.put("wsse11", "http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd");
namespaces.put("echo", "http://www.springframework.org/spring-ws/samples/echo");
namespaces.put("wsu",
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
namespaces.put("wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
namespaces.put("saml", "urn:oasis:names:tc:SAML:2.0:assertion");
namespaces.put("test", "http://test");
xpathTemplate.setNamespaces(namespaces);
onSetup();
}
protected void assertXpathEvaluatesTo(String message,
String expectedValue,
String xpathExpression,
Document document) {
protected void assertXpathEvaluatesTo(String message, String expectedValue, String xpathExpression,
Document document) {
String actualValue = xpathTemplate.evaluateAsString(xpathExpression, new DOMSource(document));
Assert.assertEquals(message, expectedValue, actualValue);
}
protected void assertXpathEvaluatesTo(String message,
String expectedValue,
String xpathExpression,
String document) {
protected void assertXpathEvaluatesTo(String message, String expectedValue, String xpathExpression, String document) {
String actualValue = xpathTemplate.evaluateAsString(xpathExpression, new StringSource(document));
Assert.assertEquals(message, expectedValue, actualValue);
}
@@ -125,12 +118,11 @@ public abstract class Wss4jTestCase {
assertTrue("Could not load SAAJ message [" + resource + "]", resource.exists());
is = resource.getInputStream();
return new SaajSoapMessage(saajSoap11MessageFactory.createMessage(mimeHeaders, is), saajSoap11MessageFactory);
}
finally {
} finally {
is.close();
}
}
protected SaajSoapMessage loadSaaj12Message(String fileName) throws Exception {
MimeHeaders mimeHeaders = new MimeHeaders();
mimeHeaders.addHeader("Content-Type", "application/soap+xml");
@@ -140,8 +132,7 @@ public abstract class Wss4jTestCase {
assertTrue("Could not load SAAJ message [" + resource + "]", resource.exists());
is = resource.getInputStream();
return new SaajSoapMessage(saajSoap12MessageFactory.createMessage(mimeHeaders, is), saajSoap12MessageFactory);
}
finally {
} finally {
is.close();
}
}
@@ -157,14 +148,13 @@ public abstract class Wss4jTestCase {
org.apache.axiom.soap.SOAPMessage soapMessage = builder.getSOAPMessage();
builder.detach();
return new AxiomSoapMessage(soapMessage, "", true, true);
}
finally {
} finally {
is.close();
}
}
@SuppressWarnings("Since15")
protected AxiomSoapMessage loadAxiom12Message(String fileName) throws Exception {
@SuppressWarnings("Since15")
protected AxiomSoapMessage loadAxiom12Message(String fileName) throws Exception {
Resource resource = new ClassPathResource(fileName, getClass());
InputStream is = resource.getInputStream();
try {
@@ -175,8 +165,7 @@ public abstract class Wss4jTestCase {
org.apache.axiom.soap.SOAPMessage soapMessage = builder.getSOAPMessage();
builder.detach();
return new AxiomSoapMessage(soapMessage, "", true, true);
}
finally {
} finally {
is.close();
}
}
@@ -204,8 +193,7 @@ public abstract class Wss4jTestCase {
throw new IllegalArgumentException("Illegal message: " + message);
}
protected void onSetup() throws Exception {
}
protected void onSetup() throws Exception {}
protected SoapMessage loadSoap11Message(String fileName) throws Exception {
if (axiomTest) {
@@ -248,7 +236,7 @@ public abstract class Wss4jTestCase {
messageFactory.setSoapVersion(SoapVersion.SOAP_12);
return messageFactory;
}
protected Document getDocument(SoapMessage message) throws Exception {
if (axiomTest) {
return AxiomUtils.toDocument(((AxiomSoapMessage) message).getAxiomMessage().getSOAPEnvelope());

4
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/callback/KeyStoreCallbackHandlerTest.java
View File

@@ -18,12 +18,12 @@ package org.springframework.ws.soap.security.wss4j2.callback;
import java.security.KeyStore;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.soap.security.support.KeyStoreFactoryBean;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.soap.security.support.KeyStoreFactoryBean;
public class KeyStoreCallbackHandlerTest {

28
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/callback/SpringSecurityPasswordValidationCallbackHandlerTest.java
View File

@@ -16,9 +16,16 @@
package org.springframework.ws.soap.security.wss4j2.callback;
import static org.easymock.EasyMock.*;
import java.util.Collection;
import java.util.Collections;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -28,13 +35,6 @@ import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import static org.easymock.EasyMock.*;
/** @author tareq */
public class SpringSecurityPasswordValidationCallbackHandlerTest {
@@ -44,7 +44,7 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
private SimpleGrantedAuthority grantedAuthority;
private UsernameTokenPrincipalCallback callback;
private WSPasswordCallback passwordCallback;
private UserDetails user;
@@ -58,10 +58,10 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
WSUsernameTokenPrincipalImpl principal = new WSUsernameTokenPrincipalImpl("Ernie", true);
callback = new UsernameTokenPrincipalCallback(principal);
passwordCallback = new WSPasswordCallback("Ernie", null, "type", WSPasswordCallback.USERNAME_TOKEN);
}
@Test
public void testHandleUsernameToken() throws Exception {
UserDetailsService userDetailsService = createMock(UserDetailsService.class);
@@ -76,13 +76,14 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
verify(userDetailsService);
}
@Test
public void testHandleUsernameTokenUserNotFound() throws Exception {
UserDetailsService userDetailsService = createMock(UserDetailsService.class);
callbackHandler.setUserDetailsService(userDetailsService);
expect(userDetailsService.loadUserByUsername("Ernie")).andThrow(new UsernameNotFoundException("User 'Ernie' not found"));
expect(userDetailsService.loadUserByUsername("Ernie"))
.andThrow(new UsernameNotFoundException("User 'Ernie' not found"));
replay(userDetailsService);
@@ -107,8 +108,7 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
Authentication authentication = context.getAuthentication();
Assert.assertNotNull("Authentication must not be null", authentication);
Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
Assert.assertTrue("GrantedAuthority[] must not be null or empty",
(authorities != null && authorities.size() > 0));
Assert.assertTrue("GrantedAuthority[] must not be null or empty", (authorities != null && authorities.size() > 0));
Assert.assertEquals("Unexpected authority", grantedAuthority, authorities.iterator().next());
verify(userDetailsService);

2
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/support/CryptoFactoryBeanTest.java
View File

@@ -60,4 +60,4 @@ public class CryptoFactoryBeanTest {
Assert.assertNotNull("No result", result);
Assert.assertTrue("Not a Merlin instance", result instanceof Merlin);
}
}
}

3
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/AbstractXwssMessageInterceptorKeyStoreTestCase.java
View File

@@ -34,8 +34,7 @@ public abstract class AbstractXwssMessageInterceptorKeyStoreTestCase extends Abs
try {
is = getClass().getResourceAsStream("test-keystore.jks");
keyStore.load(is, "password".toCharArray());
}
finally {
} finally {
if (is != null) {
is.close();
}

22
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/AbstractXwssMessageInterceptorTestCase.java
View File

@@ -16,28 +16,28 @@
package org.springframework.ws.soap.security.xwss;
import static org.junit.Assert.*;
import java.io.IOException;
import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
import javax.xml.soap.MessageFactory;
import javax.xml.soap.MimeHeaders;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPMessage;
import org.junit.Assert;
import org.junit.Before;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.xml.xpath.XPathExpression;
import org.springframework.xml.xpath.XPathExpressionFactory;
import org.junit.Assert;
import org.junit.Before;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import static org.junit.Assert.assertTrue;
public abstract class AbstractXwssMessageInterceptorTestCase {
protected XwsSecurityInterceptor interceptor;
@@ -59,10 +59,8 @@ public abstract class AbstractXwssMessageInterceptorTestCase {
onSetup();
}
protected void assertXpathEvaluatesTo(String message,
String expectedValue,
String xpathExpression,
SOAPMessage soapMessage) {
protected void assertXpathEvaluatesTo(String message, String expectedValue, String xpathExpression,
SOAPMessage soapMessage) {
XPathExpression expression = XPathExpressionFactory.createXPathExpression(xpathExpression, namespaces);
Document document = soapMessage.getSOAPPart();
String actualValue = expression.evaluateAsString(document);
@@ -92,12 +90,10 @@ public abstract class AbstractXwssMessageInterceptorTestCase {
assertTrue("Could not load SAAJ message [" + resource + "]", resource.exists());
is = resource.getInputStream();
return new SaajSoapMessage(messageFactory.createMessage(mimeHeaders, is));
}
finally {
} finally {
is.close();
}
}
protected void onSetup() throws Exception {
}
protected void onSetup() throws Exception {}
}

32
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/XwsSecurityInterceptorTest.java
View File

@@ -16,9 +16,13 @@
package org.springframework.ws.soap.security.xwss;
import static org.junit.Assert.*;
import javax.xml.soap.MessageFactory;
import javax.xml.soap.SOAPMessage;
import org.junit.Before;
import org.junit.Test;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
@@ -26,11 +30,6 @@ import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.junit.Before;
import org.junit.Test;
import static org.junit.Assert.*;
public class XwsSecurityInterceptorTest {
private MessageFactory messageFactory;
@@ -61,8 +60,8 @@ public class XwsSecurityInterceptorTest {
}
};
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
MessageContext context = new DefaultMessageContext(new SaajSoapMessage(request),
new SaajSoapMessageFactory(messageFactory));
interceptor.handleRequest(context, null);
assertEquals("Invalid request", validatedRequest, ((SaajSoapMessage) context.getRequest()).getSaajMessage());
}
@@ -94,8 +93,8 @@ public class XwsSecurityInterceptorTest {
};
SOAPMessage request = messageFactory.createMessage();
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
MessageContext context = new DefaultMessageContext(new SaajSoapMessage(request),
new SaajSoapMessageFactory(messageFactory));
context.getResponse();
interceptor.handleResponse(context, null);
interceptor.afterCompletion(context, null, null);
@@ -109,7 +108,6 @@ public class XwsSecurityInterceptorTest {
cleanupCalled[0] = false;
XwsSecurityInterceptor interceptor = new XwsSecurityInterceptor() {
@Override
protected void cleanUp() {
cleanupCalled[0] = true;
@@ -117,8 +115,8 @@ public class XwsSecurityInterceptorTest {
};
SOAPMessage request = messageFactory.createMessage();
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
MessageContext context = new DefaultMessageContext(new SaajSoapMessage(request),
new SaajSoapMessageFactory(messageFactory));
context.getResponse();
interceptor.handleFault(context, null);
interceptor.afterCompletion(context, null, null);
@@ -146,8 +144,8 @@ public class XwsSecurityInterceptorTest {
}
};
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
MessageContext context = new DefaultMessageContext(new SaajSoapMessage(request),
new SaajSoapMessageFactory(messageFactory));
interceptor.handleRequest(context);
assertEquals("Invalid request", securedRequest, ((SaajSoapMessage) context.getRequest()).getSaajMessage());
}
@@ -172,11 +170,11 @@ public class XwsSecurityInterceptorTest {
};
SOAPMessage request = messageFactory.createMessage();
MessageContext context =
new DefaultMessageContext(new SaajSoapMessage(request), new SaajSoapMessageFactory(messageFactory));
MessageContext context = new DefaultMessageContext(new SaajSoapMessage(request),
new SaajSoapMessageFactory(messageFactory));
context.getResponse();
interceptor.handleResponse(context);
assertEquals("Invalid response", validatedResponse, ((SaajSoapMessage) context.getResponse()).getSaajMessage());
}
}
}

46
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/XwssMessageInterceptorEncryptTest.java
View File

@@ -16,20 +16,20 @@
package org.springframework.ws.soap.security.xwss;
import static org.junit.Assert.*;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.xml.soap.SOAPMessage;
import org.junit.Ignore;
import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.DecryptionKeyCallback;
import com.sun.xml.wss.impl.callback.EncryptionKeyCallback;
import org.junit.Ignore;
import org.junit.Test;
import static org.junit.Assert.*;
public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterceptorKeyStoreTestCase {
@@ -44,16 +44,14 @@ public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterc
if (callback instanceof EncryptionKeyCallback) {
EncryptionKeyCallback keyCallback = (EncryptionKeyCallback) callback;
if (keyCallback.getRequest() instanceof EncryptionKeyCallback.AliasX509CertificateRequest) {
EncryptionKeyCallback.AliasX509CertificateRequest request =
(EncryptionKeyCallback.AliasX509CertificateRequest) keyCallback.getRequest();
EncryptionKeyCallback.AliasX509CertificateRequest request = (EncryptionKeyCallback.AliasX509CertificateRequest) keyCallback
.getRequest();
assertEquals("Invalid alias", "", request.getAlias());
request.setX509Certificate(certificate);
}
else {
} else {
fail("Unexpected request");
}
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -66,8 +64,8 @@ public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterc
assertNotNull("No result returned", result);
assertXpathExists("BinarySecurityToken does not exist",
"SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:BinarySecurityToken", result);
assertXpathExists("Signature does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/xenc:EncryptedKey", result);
assertXpathExists("Signature does not exist", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/xenc:EncryptedKey",
result);
}
@Test
@@ -81,16 +79,14 @@ public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterc
if (callback instanceof EncryptionKeyCallback) {
EncryptionKeyCallback keyCallback = (EncryptionKeyCallback) callback;
if (keyCallback.getRequest() instanceof EncryptionKeyCallback.AliasX509CertificateRequest) {
EncryptionKeyCallback.AliasX509CertificateRequest request =
(EncryptionKeyCallback.AliasX509CertificateRequest) keyCallback.getRequest();
EncryptionKeyCallback.AliasX509CertificateRequest request = (EncryptionKeyCallback.AliasX509CertificateRequest) keyCallback
.getRequest();
assertEquals("Invalid alias", "alias", request.getAlias());
request.setX509Certificate(certificate);
}
else {
} else {
fail("Unexpected request");
}
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -103,8 +99,8 @@ public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterc
assertNotNull("No result returned", result);
assertXpathExists("BinarySecurityToken does not exist",
"SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:BinarySecurityToken", result);
assertXpathExists("Signature does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/xenc:EncryptedKey", result);
assertXpathExists("Signature does not exist", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/xenc:EncryptedKey",
result);
}
@Test
@@ -118,16 +114,14 @@ public class XwssMessageInterceptorEncryptTest extends AbstractXwssMessageInterc
if (callback instanceof DecryptionKeyCallback) {
DecryptionKeyCallback keyCallback = (DecryptionKeyCallback) callback;
if (keyCallback.getRequest() instanceof DecryptionKeyCallback.X509CertificateBasedRequest) {
DecryptionKeyCallback.X509CertificateBasedRequest request =
(DecryptionKeyCallback.X509CertificateBasedRequest) keyCallback.getRequest();
DecryptionKeyCallback.X509CertificateBasedRequest request = (DecryptionKeyCallback.X509CertificateBasedRequest) keyCallback
.getRequest();
assertEquals("Invalid certificate", certificate, request.getX509Certificate());
request.setPrivateKey(privateKey);
}
else {
} else {
fail("Unexpected request");
}
}
else {
} else {
fail("Unexpected callback");
}
}

30
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/XwssMessageInterceptorSignTest.java
View File

@@ -16,20 +16,21 @@
package org.springframework.ws.soap.security.xwss;
import static org.junit.Assert.*;
import java.security.cert.X509Certificate;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.xml.soap.SOAPMessage;
import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import com.sun.xml.wss.impl.callback.SignatureKeyCallback;
import org.junit.Test;
import static org.junit.Assert.*;
public class XwssMessageInterceptorSignTest extends AbstractXwssMessageInterceptorKeyStoreTestCase {
@@ -43,16 +44,14 @@ public class XwssMessageInterceptorSignTest extends AbstractXwssMessageIntercept
if (callback instanceof SignatureKeyCallback) {
SignatureKeyCallback keyCallback = (SignatureKeyCallback) callback;
if (keyCallback.getRequest() instanceof SignatureKeyCallback.DefaultPrivKeyCertRequest) {
SignatureKeyCallback.DefaultPrivKeyCertRequest request =
(SignatureKeyCallback.DefaultPrivKeyCertRequest) keyCallback.getRequest();
SignatureKeyCallback.DefaultPrivKeyCertRequest request = (SignatureKeyCallback.DefaultPrivKeyCertRequest) keyCallback
.getRequest();
request.setX509Certificate(certificate);
request.setPrivateKey(privateKey);
}
else {
} else {
fail("Unexpected request");
}
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -79,17 +78,15 @@ public class XwssMessageInterceptorSignTest extends AbstractXwssMessageIntercept
if (callback instanceof SignatureKeyCallback) {
SignatureKeyCallback keyCallback = (SignatureKeyCallback) callback;
if (keyCallback.getRequest() instanceof SignatureKeyCallback.AliasPrivKeyCertRequest) {
SignatureKeyCallback.AliasPrivKeyCertRequest request =
(SignatureKeyCallback.AliasPrivKeyCertRequest) keyCallback.getRequest();
SignatureKeyCallback.AliasPrivKeyCertRequest request = (SignatureKeyCallback.AliasPrivKeyCertRequest) keyCallback
.getRequest();
assertEquals("Invalid alias", "alias", request.getAlias());
request.setX509Certificate(certificate);
request.setPrivateKey(privateKey);
}
else {
} else {
fail("Unexpected request");
}
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -121,8 +118,7 @@ public class XwssMessageInterceptorSignTest extends AbstractXwssMessageIntercept
return true;
}
});
}
else {
} else {
fail("Unexpected callback");
}
}

94
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/XwssMessageInterceptorUsernameTokenTest.java
View File

@@ -16,10 +16,13 @@
package org.springframework.ws.soap.security.xwss;
import static org.junit.Assert.*;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.xml.soap.SOAPMessage;
import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
@@ -28,15 +31,11 @@ import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
import org.junit.Test;
import static org.junit.Assert.*;
public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessageInterceptorTestCase {
@Test
public void testAddUsernameTokenDigest() throws Exception {
public void testAddUsernameTokenDigest() throws Exception {
interceptor.setPolicyConfiguration(new ClassPathResource("usernameToken-digest-config.xml", getClass()));
CallbackHandler handler = new AbstractCallbackHandler() {
@@ -44,12 +43,10 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
protected void handleInternal(Callback callback) {
if (callback instanceof UsernameCallback) {
((UsernameCallback) callback).setUsername("Bert");
}
else if (callback instanceof PasswordCallback) {
} else if (callback instanceof PasswordCallback) {
PasswordCallback passwordCallback = (PasswordCallback) callback;
passwordCallback.setPassword("Ernie");
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -61,17 +58,14 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
SOAPMessage result = message.getSaajMessage();
assertNotNull("No result returned", result);
assertXpathEvaluatesTo("Invalid Username", "Bert",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()",
result);
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", result);
assertXpathExists("Password does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest']",
result);
assertXpathExists("Nonce does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Nonce",
result);
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Nonce", result);
assertXpathExists("Created does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsu:Created",
result);
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsu:Created", result);
}
@Test
@@ -83,12 +77,10 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
protected void handleInternal(Callback callback) {
if (callback instanceof UsernameCallback) {
((UsernameCallback) callback).setUsername("Bert");
}
else if (callback instanceof PasswordCallback) {
} else if (callback instanceof PasswordCallback) {
PasswordCallback passwordCallback = (PasswordCallback) callback;
passwordCallback.setPassword("Ernie");
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -108,21 +100,17 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
@Test
public void testAddUsernameTokenPlainTextNonce() throws Exception {
interceptor.setPolicyConfiguration(
new ClassPathResource("usernameToken-plainText-nonce-config.xml",
getClass()));
interceptor.setPolicyConfiguration(new ClassPathResource("usernameToken-plainText-nonce-config.xml", getClass()));
CallbackHandler handler = new AbstractCallbackHandler() {
@Override
protected void handleInternal(Callback callback) {
if (callback instanceof UsernameCallback) {
((UsernameCallback) callback).setUsername("Bert");
}
else if (callback instanceof PasswordCallback) {
} else if (callback instanceof PasswordCallback) {
PasswordCallback passwordCallback = (PasswordCallback) callback;
passwordCallback.setPassword("Ernie");
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -134,23 +122,19 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
SOAPMessage result = message.getSaajMessage();
assertNotNull("No result returned", result);
assertXpathEvaluatesTo("Invalid Username", "Bert",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()",
result);
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", result);
assertXpathEvaluatesTo("Invalid Password", "Ernie",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText']/text()",
result);
assertXpathExists("Nonce does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Nonce",
result);
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Nonce", result);
assertXpathExists("Created does not exist",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsu:Created",
result);
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsu:Created", result);
}
@Test
public void testValidateUsernameTokenPlainText() throws Exception {
interceptor
.setPolicyConfiguration(new ClassPathResource("requireUsernameToken-plainText-config.xml", getClass()));
interceptor.setPolicyConfiguration(new ClassPathResource("requireUsernameToken-plainText-config.xml", getClass()));
CallbackHandler handler = new AbstractCallbackHandler() {
@Override
@@ -160,20 +144,17 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
validationCallback.setValidator(new PasswordValidationCallback.PasswordValidator() {
public boolean validate(PasswordValidationCallback.Request request) {
if (request instanceof PasswordValidationCallback.PlainTextPasswordRequest) {
PasswordValidationCallback.PlainTextPasswordRequest passwordRequest =
(PasswordValidationCallback.PlainTextPasswordRequest) request;
PasswordValidationCallback.PlainTextPasswordRequest passwordRequest = (PasswordValidationCallback.PlainTextPasswordRequest) request;
assertEquals("Invalid username", "Bert", passwordRequest.getUsername());
assertEquals("Invalid password", "Ernie", passwordRequest.getPassword());
return true;
}
else {
} else {
fail("Unexpected request");
return false;
}
}
});
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -200,27 +181,22 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
validationCallback.setValidator(new PasswordValidationCallback.PasswordValidator() {
public boolean validate(PasswordValidationCallback.Request request) {
if (request instanceof PasswordValidationCallback.PlainTextPasswordRequest) {
PasswordValidationCallback.PlainTextPasswordRequest passwordRequest =
(PasswordValidationCallback.PlainTextPasswordRequest) request;
PasswordValidationCallback.PlainTextPasswordRequest passwordRequest = (PasswordValidationCallback.PlainTextPasswordRequest) request;
assertEquals("Invalid username", "Bert", passwordRequest.getUsername());
assertEquals("Invalid password", "Ernie", passwordRequest.getPassword());
return true;
}
else {
} else {
fail("Unexpected request");
return false;
}
}
});
}
else if (callback instanceof TimestampValidationCallback) {
} else if (callback instanceof TimestampValidationCallback) {
TimestampValidationCallback validationCallback = (TimestampValidationCallback) callback;
validationCallback.setValidator(new TimestampValidationCallback.TimestampValidator() {
public void validate(TimestampValidationCallback.Request request) {
}
public void validate(TimestampValidationCallback.Request request) {}
});
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -244,24 +220,20 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
if (callback instanceof PasswordValidationCallback) {
PasswordValidationCallback validationCallback = (PasswordValidationCallback) callback;
if (validationCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) {
PasswordValidationCallback.DigestPasswordRequest passwordRequest =
(PasswordValidationCallback.DigestPasswordRequest) validationCallback.getRequest();
PasswordValidationCallback.DigestPasswordRequest passwordRequest = (PasswordValidationCallback.DigestPasswordRequest) validationCallback
.getRequest();
assertEquals("Invalid username", "Bert", passwordRequest.getUsername());
passwordRequest.setPassword("Ernie");
validationCallback.setValidator(new PasswordValidationCallback.DigestPasswordValidator());
}
else {
} else {
fail("Unexpected request");
}
}
else if (callback instanceof TimestampValidationCallback) {
} else if (callback instanceof TimestampValidationCallback) {
TimestampValidationCallback validationCallback = (TimestampValidationCallback) callback;
validationCallback.setValidator(new TimestampValidationCallback.TimestampValidator() {
public void validate(TimestampValidationCallback.Request request) {
}
public void validate(TimestampValidationCallback.Request request) {}
});
}
else {
} else {
fail("Unexpected callback");
}
}
@@ -275,4 +247,4 @@ public class XwssMessageInterceptorUsernameTokenTest extends AbstractXwssMessage
assertXpathNotExists("Security Header not removed", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security", result);
}
}
}

9
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/DefaultTimestampValidatorTest.java
View File

@@ -16,10 +16,11 @@
package org.springframework.ws.soap.security.xwss.callback;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
import org.junit.Before;
import org.junit.Test;
import com.sun.xml.wss.impl.callback.TimestampValidationCallback;
public class DefaultTimestampValidatorTest {
private DefaultTimestampValidator validator;
@@ -38,8 +39,8 @@ public class DefaultTimestampValidatorTest {
@Test
public void testValidateNoExpired() throws Exception {
TimestampValidationCallback.Request request =
new TimestampValidationCallback.UTCTimestampRequest("2006-09-25T20:42:50Z", null, 100, Long.MAX_VALUE);
TimestampValidationCallback.Request request = new TimestampValidationCallback.UTCTimestampRequest(
"2006-09-25T20:42:50Z", null, 100, Long.MAX_VALUE);
validator.validate(request);
}
}
}

5
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/KeyStoreCallbackHandlerTest.java
View File

@@ -30,8 +30,7 @@ public class KeyStoreCallbackHandlerTest {
@Test
public void testLoadDefaultTrustStore() throws Exception {
System.setProperty("javax.net.ssl.trustStore",
"/System/Library/Frameworks/JavaVM.framework/Versions/1.5.0/Home/");
System.setProperty("javax.net.ssl.trustStore", "/System/Library/Frameworks/JavaVM.framework/Versions/1.5.0/Home/");
handler.loadDefaultTrustStore();
}
}
}

25
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandlerTest.java
View File

@@ -18,11 +18,12 @@ package org.springframework.ws.soap.security.xwss.callback;
import java.util.Properties;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
public class SimplePasswordValidationCallbackHandlerTest {
private SimplePasswordValidationCallbackHandler handler;
@@ -37,8 +38,8 @@ public class SimplePasswordValidationCallbackHandlerTest {
@Test
public void testPlainTextPasswordValid() throws Exception {
PasswordValidationCallback.PlainTextPasswordRequest request =
new PasswordValidationCallback.PlainTextPasswordRequest("Bert", "Ernie");
PasswordValidationCallback.PlainTextPasswordRequest request = new PasswordValidationCallback.PlainTextPasswordRequest(
"Bert", "Ernie");
PasswordValidationCallback callback = new PasswordValidationCallback(request);
handler.handleInternal(callback);
boolean authenticated = callback.getResult();
@@ -47,8 +48,8 @@ public class SimplePasswordValidationCallbackHandlerTest {
@Test
public void testPlainTextPasswordInvalid() throws Exception {
PasswordValidationCallback.PlainTextPasswordRequest request =
new PasswordValidationCallback.PlainTextPasswordRequest("Bert", "Big bird");
PasswordValidationCallback.PlainTextPasswordRequest request = new PasswordValidationCallback.PlainTextPasswordRequest(
"Bert", "Big bird");
PasswordValidationCallback callback = new PasswordValidationCallback(request);
handler.handleInternal(callback);
boolean authenticated = callback.getResult();
@@ -57,8 +58,8 @@ public class SimplePasswordValidationCallbackHandlerTest {
@Test
public void testPlainTextPasswordNoSuchUser() throws Exception {
PasswordValidationCallback.PlainTextPasswordRequest request =
new PasswordValidationCallback.PlainTextPasswordRequest("Big bird", "Bert");
PasswordValidationCallback.PlainTextPasswordRequest request = new PasswordValidationCallback.PlainTextPasswordRequest(
"Big bird", "Bert");
PasswordValidationCallback callback = new PasswordValidationCallback(request);
handler.handleInternal(callback);
boolean authenticated = callback.getResult();
@@ -71,8 +72,8 @@ public class SimplePasswordValidationCallbackHandlerTest {
String nonce = "9mdsYDCrjjYRur0rxzYt2oD7";
String passwordDigest = "kwNstEaiFOrI7B31j7GuETYvdgk=";
String creationTime = "2006-06-01T23:48:42Z";
PasswordValidationCallback.DigestPasswordRequest request =
new PasswordValidationCallback.DigestPasswordRequest(username, passwordDigest, nonce, creationTime);
PasswordValidationCallback.DigestPasswordRequest request = new PasswordValidationCallback.DigestPasswordRequest(
username, passwordDigest, nonce, creationTime);
PasswordValidationCallback callback = new PasswordValidationCallback(request);
handler.handleInternal(callback);
boolean authenticated = callback.getResult();
@@ -86,12 +87,12 @@ public class SimplePasswordValidationCallbackHandlerTest {
String nonce = "9mdsYDCrjjYRur0rxzYt2oD7";
String passwordDigest = "kwNstEaiFOrI7B31j7GuETYvdgk";
String creationTime = "2006-06-01T23:48:42Z";
PasswordValidationCallback.DigestPasswordRequest request =
new PasswordValidationCallback.DigestPasswordRequest(username, passwordDigest, nonce, creationTime);
PasswordValidationCallback.DigestPasswordRequest request = new PasswordValidationCallback.DigestPasswordRequest(
username, passwordDigest, nonce, creationTime);
PasswordValidationCallback callback = new PasswordValidationCallback(request);
handler.handleInternal(callback);
boolean authenticated = callback.getResult();
Assert.assertFalse("Authenticated", authenticated);
}
}
}

7
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SimpleUsernamePasswordCallbackHandlerTest.java
View File

@@ -16,12 +16,13 @@
package org.springframework.ws.soap.security.xwss.callback;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
public class SimpleUsernamePasswordCallbackHandlerTest {
private SimpleUsernamePasswordCallbackHandler handler;
@@ -46,4 +47,4 @@ public class SimpleUsernamePasswordCallbackHandlerTest {
handler.handleInternal(passwordCallback);
Assert.assertEquals("Invalid username", "Ernie", passwordCallback.getPassword());
}
}
}

21
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SpringCertificateValidationCallbackHandlerTest.java
View File

@@ -16,11 +16,17 @@
package org.springframework.ws.soap.security.xwss.callback;
import static org.easymock.EasyMock.*;
import java.io.InputStream;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.util.Collections;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
@@ -31,12 +37,6 @@ import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.x509.X509AuthenticationToken;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import static org.easymock.EasyMock.*;
public class SpringCertificateValidationCallbackHandlerTest {
@@ -58,8 +58,7 @@ public class SpringCertificateValidationCallbackHandlerTest {
try {
is = new ClassPathResource("/org/springframework/ws/soap/security/xwss/test-keystore.jks").getInputStream();
keyStore.load(is, "password".toCharArray());
}
finally {
} finally {
if (is != null) {
is.close();
}
@@ -76,7 +75,7 @@ public class SpringCertificateValidationCallbackHandlerTest {
@Test
public void testValidateCertificateValid() throws Exception {
expect(authenticationManager.authenticate(isA(X509AuthenticationToken.class)))
.andReturn(new TestingAuthenticationToken(certificate, null, Collections.<GrantedAuthority>emptyList()));
.andReturn(new TestingAuthenticationToken(certificate, null, Collections.<GrantedAuthority> emptyList()));
replay(authenticationManager);
@@ -105,8 +104,8 @@ public class SpringCertificateValidationCallbackHandlerTest {
@Test
public void testCleanUp() throws Exception {
TestingAuthenticationToken authentication =
new TestingAuthenticationToken(new Object(), new Object(), Collections.<GrantedAuthority>emptyList());
TestingAuthenticationToken authentication = new TestingAuthenticationToken(new Object(), new Object(),
Collections.<GrantedAuthority> emptyList());
SecurityContextHolder.getContext().setAuthentication(authentication);
CleanupCallback cleanupCallback = new CleanupCallback();

26
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SpringDigestPasswordValidationCallbackHandlerTest.java
View File

@@ -16,8 +16,14 @@
package org.springframework.ws.soap.security.xwss.callback;
import static org.easymock.EasyMock.*;
import java.util.Collections;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
@@ -28,12 +34,6 @@ import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import static org.easymock.EasyMock.*;
public class SpringDigestPasswordValidationCallbackHandlerTest {
@@ -57,8 +57,8 @@ public class SpringDigestPasswordValidationCallbackHandlerTest {
String nonce = "9mdsYDCrjjYRur0rxzYt2oD7";
String passwordDigest = "kwNstEaiFOrI7B31j7GuETYvdgk=";
String creationTime = "2006-06-01T23:48:42Z";
PasswordValidationCallback.DigestPasswordRequest request =
new PasswordValidationCallback.DigestPasswordRequest(username, passwordDigest, nonce, creationTime);
PasswordValidationCallback.DigestPasswordRequest request = new PasswordValidationCallback.DigestPasswordRequest(
username, passwordDigest, nonce, creationTime);
callback = new PasswordValidationCallback(request);
}
@@ -83,7 +83,7 @@ public class SpringDigestPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserDigestValid() throws Exception {
User user = new User(username, password, true, true, true, true, Collections.<GrantedAuthority>emptyList());
User user = new User(username, password, true, true, true, true, Collections.<GrantedAuthority> emptyList());
expect(userDetailsService.loadUserByUsername(username)).andReturn(user);
replay(userDetailsService);
@@ -98,7 +98,7 @@ public class SpringDigestPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserDigestValidInvalid() throws Exception {
User user = new User(username, "Big bird", true, true, true, true, Collections.<GrantedAuthority>emptyList());
User user = new User(username, "Big bird", true, true, true, true, Collections.<GrantedAuthority> emptyList());
expect(userDetailsService.loadUserByUsername(username)).andReturn(user);
replay(userDetailsService);
@@ -113,7 +113,7 @@ public class SpringDigestPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserDigestDisabled() throws Exception {
User user = new User(username, "Ernie", false, true, true, true, Collections.<GrantedAuthority>emptyList());
User user = new User(username, "Ernie", false, true, true, true, Collections.<GrantedAuthority> emptyList());
expect(userDetailsService.loadUserByUsername(username)).andReturn(user);
replay(userDetailsService);
@@ -129,8 +129,8 @@ public class SpringDigestPasswordValidationCallbackHandlerTest {
@Test
public void testCleanUp() throws Exception {
TestingAuthenticationToken authentication =
new TestingAuthenticationToken(new Object(), new Object(), Collections.<GrantedAuthority>emptyList());
TestingAuthenticationToken authentication = new TestingAuthenticationToken(new Object(), new Object(),
Collections.<GrantedAuthority> emptyList());
SecurityContextHolder.getContext().setAuthentication(authentication);
CleanupCallback cleanupCallback = new CleanupCallback();

30
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SpringPlainTextPasswordValidationCallbackHandlerTest.java
View File

@@ -16,8 +16,14 @@
package org.springframework.ws.soap.security.xwss.callback;
import static org.easymock.EasyMock.*;
import java.util.Collections;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.TestingAuthenticationToken;
@@ -28,12 +34,6 @@ import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import static org.easymock.EasyMock.*;
public class SpringPlainTextPasswordValidationCallbackHandlerTest {
@@ -54,8 +54,8 @@ public class SpringPlainTextPasswordValidationCallbackHandlerTest {
callbackHandler.setAuthenticationManager(authenticationManager);
username = "Bert";
password = "Ernie";
PasswordValidationCallback.PlainTextPasswordRequest request =
new PasswordValidationCallback.PlainTextPasswordRequest(username, password);
PasswordValidationCallback.PlainTextPasswordRequest request = new PasswordValidationCallback.PlainTextPasswordRequest(
username, password);
callback = new PasswordValidationCallback(request);
}
@@ -66,9 +66,10 @@ public class SpringPlainTextPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserPlainTextValid() throws Exception {
Authentication authResult = new TestingAuthenticationToken(username, password, Collections
.<GrantedAuthority>emptyList());
expect(authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password))).andReturn(authResult);
Authentication authResult = new TestingAuthenticationToken(username, password,
Collections.<GrantedAuthority> emptyList());
expect(authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password)))
.andReturn(authResult);
replay(authenticationManager);
@@ -82,7 +83,8 @@ public class SpringPlainTextPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserPlainTextInvalid() throws Exception {
expect(authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password))).andThrow(new BadCredentialsException(""));
expect(authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password)))
.andThrow(new BadCredentialsException(""));
replay(authenticationManager);
@@ -96,8 +98,8 @@ public class SpringPlainTextPasswordValidationCallbackHandlerTest {
@Test
public void testCleanUp() throws Exception {
TestingAuthenticationToken authentication =
new TestingAuthenticationToken(new Object(), new Object(), Collections.<GrantedAuthority>emptyList());
TestingAuthenticationToken authentication = new TestingAuthenticationToken(new Object(), new Object(),
Collections.<GrantedAuthority> emptyList());
SecurityContextHolder.getContext().setAuthentication(authentication);
CleanupCallback cleanupCallback = new CleanupCallback();

12
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SpringUsernamePasswordCallbackHandlerTest.java
View File

@@ -16,16 +16,16 @@
package org.springframework.ws.soap.security.xwss.callback;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import com.sun.xml.wss.impl.callback.PasswordCallback;
import com.sun.xml.wss.impl.callback.UsernameCallback;
public class SpringUsernamePasswordCallbackHandlerTest {

6
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/CertificateLoginModule.java
View File

@@ -48,10 +48,8 @@ public class CertificateLoginModule implements LoginModule {
}
@Override
public void initialize(Subject subject,
CallbackHandler callbackHandler,
Map<String,?> sharedState,
Map<String,?> options) {
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
Map<String, ?> options) {
this.subject = subject;
}

9
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasCertificateValidationCallbackHandlerTest.java
View File

@@ -20,12 +20,12 @@ import java.io.InputStream;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import org.springframework.core.io.ClassPathResource;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import com.sun.xml.wss.impl.callback.CertificateValidationCallback;
public class JaasCertificateValidationCallbackHandlerTest {
@@ -43,8 +43,7 @@ public class JaasCertificateValidationCallbackHandlerTest {
try {
is = new ClassPathResource("/org/springframework/ws/soap/security/xwss/test-keystore.jks").getInputStream();
keyStore.load(is, "password".toCharArray());
}
finally {
} finally {
if (is != null) {
is.close();
}

13
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/JaasPlainTextPasswordValidationCallbackHandlerTest.java
View File

@@ -16,11 +16,12 @@
package org.springframework.ws.soap.security.xwss.callback.jaas;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import com.sun.xml.wss.impl.callback.PasswordValidationCallback;
public class JaasPlainTextPasswordValidationCallbackHandlerTest {
private JaasPlainTextPasswordValidationCallbackHandler callbackHandler;
@@ -34,8 +35,8 @@ public class JaasPlainTextPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserPlainTextValid() throws Exception {
PasswordValidationCallback.PlainTextPasswordRequest request =
new PasswordValidationCallback.PlainTextPasswordRequest("Bert", "Ernie");
PasswordValidationCallback.PlainTextPasswordRequest request = new PasswordValidationCallback.PlainTextPasswordRequest(
"Bert", "Ernie");
PasswordValidationCallback callback = new PasswordValidationCallback(request);
callbackHandler.handleInternal(callback);
boolean authenticated = callback.getResult();
@@ -44,12 +45,12 @@ public class JaasPlainTextPasswordValidationCallbackHandlerTest {
@Test
public void testAuthenticateUserPlainTextInvalid() throws Exception {
PasswordValidationCallback.PlainTextPasswordRequest request =
new PasswordValidationCallback.PlainTextPasswordRequest("Bert", "Big bird");
PasswordValidationCallback.PlainTextPasswordRequest request = new PasswordValidationCallback.PlainTextPasswordRequest(
"Bert", "Big bird");
PasswordValidationCallback callback = new PasswordValidationCallback(request);
callbackHandler.handleInternal(callback);
boolean authenticated = callback.getResult();
Assert.assertFalse("Authenticated", authenticated);
}
}
}

24
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/PlainTextLoginModule.java
View File

@@ -57,22 +57,18 @@ public class PlainTextLoginModule implements LoginModule {
subject.getPrincipals().addAll(principals);
principals.clear();
return true;
}
catch (Exception e) {
} catch (Exception e) {
throw new LoginException(e.getMessage());
}
}
else {
} else {
principals.clear();
}
return true;
}
@Override
public void initialize(Subject subject,
CallbackHandler callbackHandler,
Map<String,?> sharedState,
Map<String,?> options) {
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState,
Map<String, ?> options) {
this.subject = subject;
this.callbackHandler = callbackHandler;
}
@@ -85,7 +81,7 @@ public class PlainTextLoginModule implements LoginModule {
try {
NameCallback nameCallback = new NameCallback("Username: ");
PasswordCallback passwordCallback = new PasswordCallback("Password: ", false);
Callback[] callbacks = new Callback[]{nameCallback, passwordCallback};
Callback[] callbacks = new Callback[] { nameCallback, passwordCallback };
callbackHandler.handle(callbacks);
@@ -104,11 +100,9 @@ public class PlainTextLoginModule implements LoginModule {
}
return true;
}
catch (LoginException ex) {
} catch (LoginException ex) {
throw ex;
}
catch (Exception ex) {
} catch (Exception ex) {
success = false;
throw new LoginException(ex.getMessage());
}
@@ -118,8 +112,7 @@ public class PlainTextLoginModule implements LoginModule {
if ("Bert".equals(username) && "Ernie".equals(password)) {
this.principals.add(new SimplePrincipal(username));
return true;
}
else {
} else {
return false;
}
}
@@ -137,5 +130,4 @@ public class PlainTextLoginModule implements LoginModule {
return true;
}
}

2
spring-ws-security/src/test/java/org/springframework/ws/soap/security/xwss/callback/jaas/SimplePrincipal.java
View File

@@ -49,4 +49,4 @@ public final class SimplePrincipal implements Principal {
public String toString() {
return name;
}
}
}