From f9de2577a035619f24c23a2b3b99d1e9f512919c Mon Sep 17 00:00:00 2001 From: Arjen Poutsma Date: Wed, 3 Feb 2016 15:15:44 +0100 Subject: [PATCH] SWS-943 Upgraded from WSS4J 2.0 to 2.1 --- build.gradle | 2 +- .../ws/soap/security/wss4j2/Wss4jHandler.java | 10 ++- .../wss4j2/Wss4jSecurityInterceptor.java | 75 +++++++++++-------- 3 files changed, 51 insertions(+), 36 deletions(-) diff --git a/build.gradle b/build.gradle index bf547ad8..688946c7 100644 --- a/build.gradle +++ b/build.gradle @@ -252,7 +252,7 @@ project('spring-ws-security') { } compile("org.apache.ws.security:wss4j:1.6.19") - compile("org.apache.wss4j:wss4j-ws-security-dom:2.0.5") + compile("org.apache.wss4j:wss4j-ws-security-dom:2.1.4") // SOAP provided("com.sun.xml.messaging.saaj:saaj-impl:1.3.19") // required for XWSS diff --git a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java index 3955a93c..8afa9041 100644 --- a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java +++ b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java @@ -19,15 +19,16 @@ package org.springframework.ws.soap.security.wss4j2; import java.util.List; import java.util.Properties; -import org.springframework.ws.context.MessageContext; -import org.w3c.dom.Document; import org.apache.wss4j.common.ConfigurationConstants; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.ext.WSSecurityException; -import org.apache.wss4j.dom.WSSecurityEngineResult; +import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.dom.handler.HandlerAction; import org.apache.wss4j.dom.handler.RequestData; import org.apache.wss4j.dom.handler.WSHandler; +import org.w3c.dom.Document; + +import org.springframework.ws.context.MessageContext; /** * @author Tareq Abed Rabbo @@ -37,7 +38,7 @@ import org.apache.wss4j.dom.handler.WSHandler; */ class Wss4jHandler extends WSHandler { - /** Keys are constants from {@link WSHandlerConstants}; values are strings. */ + /** Keys are constants from {@link ConfigurationConstants}; values are strings. */ private Properties options = new Properties(); private String securementPassword; @@ -52,6 +53,7 @@ class Wss4jHandler extends WSHandler { options.setProperty(ConfigurationConstants.ENABLE_SIGNATURE_CONFIRMATION, Boolean.toString(true)); } + @Override public void doSenderAction( Document doc, RequestData reqData, diff --git a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java index a3e573e1..91efe957 100644 --- a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java +++ b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java @@ -20,6 +20,7 @@ import java.io.IOException; import java.security.Principal; import java.security.cert.X509Certificate; import java.util.ArrayList; +import java.util.Collections; import java.util.List; import javax.security.auth.callback.Callback; @@ -31,9 +32,9 @@ import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl; import org.apache.wss4j.dom.WSConstants; -import org.apache.wss4j.dom.WSSConfig; -import org.apache.wss4j.dom.WSSecurityEngine; -import org.apache.wss4j.dom.WSSecurityEngineResult; +import org.apache.wss4j.dom.engine.WSSConfig; +import org.apache.wss4j.dom.engine.WSSecurityEngine; +import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.dom.handler.HandlerAction; import org.apache.wss4j.dom.handler.RequestData; import org.apache.wss4j.dom.handler.WSHandlerConstants; @@ -520,8 +521,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl // securement actions are not to be validated at start up as they could // be configured dynamically via the message context - // allow for qualified password types for .Net interoperability - securityEngine.getWssConfig().setAllowNamespaceQualifiedPasswordTypes(true); } @Override @@ -574,14 +573,17 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl requestData.setUsername(securementUsername); } - requestData.setTimeToLive(securementTimeToLive); + requestData.setTimeStampTTL(securementTimeToLive); requestData.setUseDerivedKeyForMAC(securementUseDerivedKey); requestData.setWssConfig(wssConfig); messageContext.setProperty(WSHandlerConstants.TTL_TIMESTAMP, Integer.toString(securementTimeToLive)); - + + // allow for qualified password types for .Net interoperability + requestData.setAllowNamespaceQualifiedPasswordTypes(true); + return requestData; } @@ -612,6 +614,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl { requestData.getBSPEnforcer().setDisableBSPRules(!bspCompliant); } + // allow for qualified password types for .Net interoperability + requestData.setAllowNamespaceQualifiedPasswordTypes(true); + return requestData; } @@ -640,25 +645,25 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } Element elem = WSSecurityUtil.getSecurityHeader(envelopeAsDocument, actor); - List results = securityEngine + WSHandlerResult result = securityEngine .processSecurityHeader(elem, validationData); // Results verification - if (CollectionUtils.isEmpty(results)) { + if (CollectionUtils.isEmpty(result.getResults())) { throw new Wss4jSecurityValidationException("No WS-Security header found"); } - checkResults(results, validationActionsVector); + checkResults(result.getResults(), validationActionsVector); // puts the results in the context // useful for Signature Confirmation - updateContextWithResults(messageContext, results); + updateContextWithResults(messageContext, result.getResults()); - verifyCertificateTrust(results); + verifyCertificateTrust(result); - verifyTimestamp(results); + verifyTimestamp(result); - processPrincipal(results); + processPrincipal(result); } catch (WSSecurityException ex) { throw new Wss4jSecurityValidationException(ex.getMessage(), ex); @@ -698,16 +703,20 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl handlerResults = new ArrayList(); messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults); } - WSHandlerResult rResult = new WSHandlerResult(validationActor, results); + WSHandlerResult rResult = new WSHandlerResult(validationActor, results, + Collections.>emptyMap()); handlerResults.add(0, rResult); messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults); } - /** Verifies the trust of a certificate. */ - protected void verifyCertificateTrust(List results) throws WSSecurityException { - WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.SIGN); + /** Verifies the trust of a certificate. + * @param result*/ + protected void verifyCertificateTrust(WSHandlerResult result) throws WSSecurityException { + List results = + result.getActionResults().get(WSConstants.SIGN); - if (actionResult != null) { + if (!CollectionUtils.isEmpty(results)) { + WSSecurityEngineResult actionResult = results.get(0); X509Certificate returnCert = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE); Credential credential = new Credential(); @@ -722,22 +731,24 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } } - /** Verifies the timestamp. */ - protected void verifyTimestamp(List results) throws WSSecurityException { - WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.TS); + /** Verifies the timestamp. + * @param result*/ + protected void verifyTimestamp(WSHandlerResult result) throws WSSecurityException { + List results = + result.getActionResults().get(WSConstants.TS); - if (actionResult != null) { + if (!CollectionUtils.isEmpty(results)) { + WSSecurityEngineResult actionResult = results.get(0); Timestamp timestamp = (Timestamp) actionResult.get(WSSecurityEngineResult.TAG_TIMESTAMP); if (timestamp != null && timestampStrict) { Credential credential = new Credential(); credential.setTimestamp(timestamp); RequestData requestData = new RequestData(); - WSSConfig config = WSSConfig.getNewInstance(); - config.setTimeStampTTL(validationTimeToLive); - config.setTimeStampStrict(timestampStrict); - config.setTimeStampFutureTTL(futureTimeToLive); - requestData.setWssConfig(config); + requestData.setWssConfig(WSSConfig.getNewInstance()); + requestData.setTimeStampTTL(validationTimeToLive); + requestData.setTimeStampStrict(timestampStrict); + requestData.setTimeStampFutureTTL(futureTimeToLive); TimestampValidator validator = new TimestampValidator(); validator.validate(credential, requestData); @@ -745,10 +756,12 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl } } - private void processPrincipal(List results) { - WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.UT); + private void processPrincipal(WSHandlerResult result) { + List results = + result.getActionResults().get(WSConstants.UT); - if (actionResult != null) { + if (!CollectionUtils.isEmpty(results)) { + WSSecurityEngineResult actionResult = results.get(0); Principal principal = (Principal) actionResult.get(WSSecurityEngineResult.TAG_PRINCIPAL); if (principal != null && principal instanceof WSUsernameTokenPrincipalImpl) { WSUsernameTokenPrincipalImpl usernameTokenPrincipal = (WSUsernameTokenPrincipalImpl) principal;