Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Review Javadoc

Browse Source 
Closes gh-1467
This commit is contained in:
Stéphane Nicoll
2025-02-26 14:36:27 +01:00
parent e5740412bf
commit da47205e58
52 changed files with 137 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-ws-security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java
View File

@@ -216,7 +216,6 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
* if the {@link #setSecureRequest(boolean) secureRequest} property is {@code true}.
* @param messageContext the message context, containing the request to be secured
* @return {@code true} if the response was secured; {@code false} otherwise.
* @throws Exception in case of errors
* @see #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)
*/
@Override
@@ -246,7 +245,6 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
* {@code true}.
* @param messageContext the message context, containing the response to be validated
* @return {@code true} if the request was valid; {@code false} otherwise.
* @throws Exception in case of errors
* @see #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)
*/
@Override

2
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/package-info.java
View File

@@ -15,6 +15,6 @@
*/
/**
* Contains generic <code>CallbackHandler</code> implementations.
* Contains generic {@code CallbackHandler} implementations.
*/
package org.springframework.ws.soap.security.callback;

2
spring-ws-security/src/main/java/org/springframework/ws/soap/security/package-info.java
View File

@@ -16,6 +16,6 @@
/**
* Provides WS-Security implementation classes. Contains the
* <code>AbstractWsSecurityInterceptor</code> and exceptions.
* {@code AbstractWsSecurityInterceptor} and exceptions.
*/
package org.springframework.ws.soap.security;

58
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
View File

@@ -63,7 +63,6 @@ import org.springframework.ws.soap.security.wss4j2.callback.UsernameTokenPrincip
/**
* A WS-Security endpoint interceptor based on Apache's WSS4J. This interceptor supports
* messages created by the
* {@link org.springframework.ws.soap.axiom.AxiomSoapMessageFactory} and the
* {@link org.springframework.ws.soap.saaj.SaajSoapMessageFactory}.
* <p>
* The validation and securement actions executed by this interceptor are configured via
@@ -207,7 +206,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Inject a customize {@link WSSecurityEngine}.
* @param securityEngine
* @param securityEngine the security engine to use
*/
public Wss4jSecurityInterceptor(WSSecurityEngine securityEngine) {
this.securityEngine = securityEngine;
@@ -236,20 +235,19 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Defines which key identifier type to use. The WS-Security specifications recommends
* to use the identifier type {@code IssuerSerial}. For possible encryption key
* identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For
* encryption {@code IssuerSerial}, {@code X509KeyIdentifier},
* {@code DirectReference}, {@code Thumbprint}, {@code SKIKeyIdentifier}, and
* {@code EmbeddedKeyName} are valid only.
* identifier types refer to {@link WSHandlerConstants}. For encryption
* {@code IssuerSerial}, {@code X509KeyIdentifier}, {@code DirectReference},
* {@code Thumbprint}, {@code SKIKeyIdentifier}, and {@code EmbeddedKeyName} are valid
* only.
*/
public void setSecurementEncryptionKeyIdentifier(String securementEncryptionKeyIdentifier) {
handler.setOption(WSHandlerConstants.ENC_KEY_ID, securementEncryptionKeyIdentifier);
}
/**
* Defines which algorithm to use to encrypt the generated symmetric key. Currently
* Defines which algorithm to use to encrypt the generated symmetric key. Currently,
* WSS4J supports {@link WSConstants#KEYTRANSPORT_RSA15} and
* {@link WSConstants#KEYTRANSPORT_RSAOEP}.
* {@link WSConstants#KEYTRANSPORT_RSAOAEP}.
*/
public void setSecurementEncryptionKeyTransportAlgorithm(String securementEncryptionKeyTransportAlgorithm) {
handler.setOption(WSHandlerConstants.ENC_KEY_TRANSPORT, securementEncryptionKeyTransportAlgorithm);
@@ -277,7 +275,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* The first entry of the list identifies the element {@code CreditCard} in the
* namespace {@code http://example.org/paymentv2}, and will encrypt its content. Be
* aware that the element name, the namespace identifier, and the encryption modifier
* are case sensitive.
* are case-sensitive.
* <p>
* The encryption modifier and the namespace identifier can be omitted. In this case
* the encryption mode defaults to {@code Content} and the namespace is set to the
@@ -289,7 +287,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* namespace.
* <p>
* To specify an element without a namespace use the string {@code Null} as the
* namespace name (this is a case sensitive string)
* namespace name (this is a case-sensitive string)
* <p>
* If no list is specified, the handler encrypts the SOAP Body in {@code Content} mode
* by default.
@@ -300,7 +298,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Defines which symmetric encryption algorithm to use. WSS4J supports the following
* alorithms: {@link WSConstants#TRIPLE_DES}, {@link WSConstants#AES_128},
* algorithms: {@link WSConstants#TRIPLE_DES}, {@link WSConstants#AES_128},
* {@link WSConstants#AES_256}, and {@link WSConstants#AES_192}. Except for AES 192
* all of these algorithms are required by the XML Encryption specification.
*/
@@ -315,14 +313,12 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* the generated symmetric key.
* <p>
* If this parameter is not set, then the encryption function falls back to the
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} parameter to get the
* certificate.
* {@link WSHandlerConstants#USER} parameter to get the certificate.
* <p>
* If <b>only</b> encryption of the SOAP body data is requested, it is recommended to
* use this parameter to define the username. The application can then use the
* standard user and password functions (see example at
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} to enable HTTP
* authentication functions.
* standard user and password functions, see example at
* {@link WSHandlerConstants#USER} to enable HTTP authentication functions.
* <p>
* Encryption only does not authenticate a user / sender, therefore it does not need a
* password.
@@ -339,7 +335,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Specific parameter for UsernameToken action to define the encoding of the passowrd.
* Specific parameter for UsernameToken action to define the encoding of the password.
* <p>
* The parameter can be set to either {@link WSConstants#PW_DIGEST} or to
* {@link WSConstants#PW_TEXT}.
@@ -373,9 +369,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Defines which key identifier type to use. The WS-Security specifications recommends
* to use the identifier type {@code IssuerSerial}. For possible signature key
* identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For
* signature {@code IssuerSerial} and {@code DirectReference} are valid only.
* identifier types refer to {@link WSHandlerConstants}. For signature
* {@code IssuerSerial} and {@code DirectReference} are valid only.
*/
public void setSecurementSignatureKeyIdentifier(String securementSignatureKeyIdentifier) {
handler.setOption(WSHandlerConstants.SIG_KEY_ID, securementSignatureKeyIdentifier);
@@ -402,7 +397,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* </pre>
*
* To specify an element without a namespace use the string {@code Null} as the
* namespace name (this is a case sensitive string)
* namespace name (this is a case-sensitive string)
* <p>
* If there is no other element in the request with a local name of {@code Body} then
* the SOAP namespace identifier can be empty ({@code {}}).
@@ -451,7 +446,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Sets the SAML Callback used for generating SAML tokens.
* @param samlCallback
* @param samlCallbackHandler the SAML callback handler
*/
public void setSecurementSamlCallbackHandler(CallbackHandler samlCallbackHandler) {
this.samlCallbackHandler = samlCallbackHandler;
@@ -509,8 +504,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Whether to enable signatureConfirmation or not. By default signatureConfirmation is
* enabled
* Whether to enable signatureConfirmation or not. By default, signatureConfirmation
* is enabled.
*/
public void setEnableSignatureConfirmation(boolean enableSignatureConfirmation) {
@@ -524,8 +519,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets whether or not timestamp verification is done with the server-side time to
* live
* Sets whether timestamp verification is done with the server-side time to live
*/
public void setTimestampStrict(boolean timestampStrict) {
this.timestampStrict = timestampStrict;
@@ -540,7 +534,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets whether or not a {@code Nonce} element is added to the {@code UsernameToken}s.
* Sets whether a {@code Nonce} element is added to the {@code UsernameToken}s.
* Default is {@code false}.
*/
public void setSecurementUsernameTokenNonce(boolean securementUsernameTokenNonce) {
@@ -548,8 +542,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets whether or not a {@code Created} element is added to the
* {@code UsernameToken}s. Default is {@code false}.
* Sets whether a {@code Created} element is added to the {@code UsernameToken}s.
* Default is {@code false}.
*/
public void setSecurementUsernameTokenCreated(boolean securementUsernameTokenCreated) {
handler.setOption(ConfigurationConstants.ADD_USERNAMETOKEN_CREATED, securementUsernameTokenCreated);
@@ -839,7 +833,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Verifies the trust of a certificate.
* @param result
* @param result the {@link WSHandlerResult} to use
*/
protected void verifyCertificateTrust(WSHandlerResult result) throws WSSecurityException {
@@ -863,7 +857,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Verifies the timestamp.
* @param result
* @param result the {@link WSHandlerResult} to use
*/
protected void verifyTimestamp(WSHandlerResult result) throws WSSecurityException {

2
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/package-info.java
View File

@@ -15,6 +15,6 @@
*/
/**
* Contains <code>CallbackHandler</code> implementations for WSS4J 2.0.
* Contains {@code CallbackHandler} implementations for WSS4J 2.0.
*/
package org.springframework.ws.soap.security.wss4j2.callback;

20
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/support/CryptoFactoryBean.java
View File

@@ -39,7 +39,7 @@ import org.springframework.util.Assert;
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
* @author Jamin Hitchcock
* @see org.apache.ws.security.components.crypto.Crypto
* @see Crypto
* @since 2.3.0
*/
public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean {
@@ -50,10 +50,12 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
private static final String CRYPTO_PROVIDER_PROPERTY = "org.apache.wss4j.crypto.provider";
private static final String CRYPTO_MERLIN_FILE_PROPERTY = "org.apache.ws.security.crypto.merlin.file";
/**
* Sets the configuration of the Crypto. Setting this property overrides all
* previously set configuration, through the type-safe properties
* @see org.apache.ws.security.components.crypto.CryptoFactory#getInstance(java.util.Properties)
* @see CryptoFactory#getInstance(java.util.Properties)
*/
public void setConfiguration(Properties properties) {
Assert.notNull(properties, "'properties' must not be null");
@@ -61,11 +63,9 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the {@link org.apache.ws.security.components.crypto.Crypto} provider name.
* Defaults to {@link org.apache.ws.security.components.crypto.Merlin}.
* Sets the {@link Crypto} provider name. Defaults to {@link Merlin}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.provider}
* property.
* This property maps to the WSS4J {@value CRYPTO_PROVIDER_PROPERTY} property.
* @param cryptoProviderClass the crypto provider class
*/
public void setCryptoProvider(Class<? extends Crypto> cryptoProviderClass) {
@@ -73,17 +73,15 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the location of the key store to be loaded in the
* {@link org.apache.ws.security.components.crypto.Crypto} instance.
* Sets the location of the key store to be loaded in the {@link Crypto} instance.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.file}
* property.
* This property maps to the WSS4J {@value CRYPTO_MERLIN_FILE_PROPERTY} property.
* @param location the key store location
* @throws java.io.IOException when the resource cannot be opened
*/
public void setKeyStoreLocation(Resource location) throws IOException {
String resourcePath = getResourcePath(location);
this.configuration.setProperty("org.apache.ws.security.crypto.merlin.file", resourcePath);
this.configuration.setProperty(CRYPTO_MERLIN_FILE_PROPERTY, resourcePath);
}
private String getResourcePath(Resource resource) throws IOException {