Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Format code with spring-javaformat

Browse Source 
This commit configures the build to use spring-javaformat and makes a
first pass to format the code of the project. As part of this, imports
have been optimized, and the license header has been harmonized.

Closes gh-1458
This commit is contained in:
Stéphane Nicoll
2025-02-19 13:32:37 +01:00
parent ac71c3017b
commit fdede99aa0
679 changed files with 10401 additions and 7621 deletions
Download Patch File Download Diff File Expand all files Collapse all files

150
spring-ws-security/src/main/java/org/springframework/ws/soap/security/AbstractWsSecurityInterceptor.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,6 +23,7 @@ import javax.xml.namespace.QName;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.Assert;
import org.springframework.ws.client.WebServiceClientException;
import org.springframework.ws.client.support.interceptor.ClientInterceptor;
@@ -37,14 +38,15 @@ import org.springframework.ws.soap.server.SoapEndpointInterceptor;
import org.springframework.ws.soap.soap11.Soap11Body;
/**
* Interceptor base class for interceptors that handle WS-Security. Can be used on the server side, registered in a
* Interceptor base class for interceptors that handle WS-Security. Can be used on the
* server side, registered in a
* {@link org.springframework.ws.server.endpoint.mapping.AbstractEndpointMapping#setInterceptors(org.springframework.ws.server.EndpointInterceptor[])
* endpoint mapping}; or on the client side, on the
* {@link org.springframework.ws.client.core.WebServiceTemplate#setInterceptors(ClientInterceptor[]) web service
* template}.
* {@link org.springframework.ws.client.core.WebServiceTemplate#setInterceptors(ClientInterceptor[])
* web service template}.
* <p>
* Subclasses of this base class can be configured to secure incoming and secure outgoing messages. By default, both are
* on.
* Subclasses of this base class can be configured to secure incoming and secure outgoing
* messages. By default, both are on.
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -69,27 +71,41 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
private EndpointExceptionResolver exceptionResolver;
/** Indicates whether server-side incoming request are to be validated. Defaults to {@code true}. */
/**
* Indicates whether server-side incoming request are to be validated. Defaults to
* {@code true}.
*/
public void setValidateRequest(boolean validateRequest) {
this.validateRequest = validateRequest;
}
/** Indicates whether server-side outgoing responses are to be secured. Defaults to {@code true}. */
/**
* Indicates whether server-side outgoing responses are to be secured. Defaults to
* {@code true}.
*/
public void setSecureResponse(boolean secureResponse) {
this.secureResponse = secureResponse;
}
/** Indicates whether client-side outgoing requests are to be secured. Defaults to {@code true}. */
/**
* Indicates whether client-side outgoing requests are to be secured. Defaults to
* {@code true}.
*/
public void setSecureRequest(boolean secureRequest) {
this.secureRequest = secureRequest;
}
/** Indicates whether client-side incoming responses are to be validated. Defaults to {@code true}. */
/**
* Indicates whether client-side incoming responses are to be validated. Defaults to
* {@code true}.
*/
public void setValidateResponse(boolean validateResponse) {
this.validateResponse = validateResponse;
}
/** Provide an {@link EndpointExceptionResolver} for resolving validation exceptions. */
/**
* Provide an {@link EndpointExceptionResolver} for resolving validation exceptions.
*/
public void setExceptionResolver(EndpointExceptionResolver exceptionResolver) {
this.exceptionResolver = exceptionResolver;
}
@@ -105,9 +121,9 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
/**
* Validates a server-side incoming request. Delegates to
* {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setValidateRequest(boolean) validateRequest} property is {@code true}.
*
* {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setValidateRequest(boolean) validateRequest} property is
* {@code true}.
* @param messageContext the message context, containing the request to be validated
* @param endpoint chosen endpoint to invoke
* @return {@code true} if the request was valid; {@code false} otherwise.
@@ -118,27 +134,30 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
public final boolean handleRequest(MessageContext messageContext, Object endpoint) throws Exception {
if (validateRequest) {
Assert.isInstanceOf(SoapMessage.class, messageContext.getRequest());
if (skipValidationIfNoHeaderPresent && !isSecurityHeaderPresent((SoapMessage) messageContext.getRequest())) {
if (skipValidationIfNoHeaderPresent
&& !isSecurityHeaderPresent((SoapMessage) messageContext.getRequest())) {
return true;
}
try {
validateMessage((SoapMessage) messageContext.getRequest(), messageContext);
return true;
} catch (WsSecurityValidationException ex) {
}
catch (WsSecurityValidationException ex) {
return handleValidationException(ex, messageContext);
} catch (WsSecurityFaultException ex) {
}
catch (WsSecurityFaultException ex) {
return handleFaultException(ex, messageContext);
}
} else {
}
else {
return true;
}
}
/**
* Secures a server-side outgoing response. Delegates to
* {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setSecureResponse(boolean) secureResponse} property is {@code true}.
*
* {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setSecureResponse(boolean) secureResponse} property is {@code true}.
* @param messageContext the message context, containing the response to be secured
* @param endpoint chosen endpoint to invoke
* @return {@code true} if the response was secured; {@code false} otherwise.
@@ -154,13 +173,16 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
Assert.isInstanceOf(SoapMessage.class, messageContext.getResponse());
try {
secureMessage((SoapMessage) messageContext.getResponse(), messageContext);
} catch (WsSecuritySecurementException ex) {
}
catch (WsSecuritySecurementException ex) {
result = handleSecurementException(ex, messageContext);
} catch (WsSecurityFaultException ex) {
}
catch (WsSecurityFaultException ex) {
result = handleFaultException(ex, messageContext);
}
}
} finally {
}
finally {
if (!result) {
messageContext.clearResponse();
}
@@ -190,9 +212,8 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
/**
* Secures a client-side outgoing request. Delegates to
* {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setSecureRequest(boolean) secureRequest} property is {@code true}.
*
* {@link #secureMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setSecureRequest(boolean) secureRequest} property is {@code true}.
* @param messageContext the message context, containing the request to be secured
* @return {@code true} if the response was secured; {@code false} otherwise.
* @throws Exception in case of errors
@@ -205,21 +226,24 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
try {
secureMessage((SoapMessage) messageContext.getRequest(), messageContext);
return true;
} catch (WsSecuritySecurementException ex) {
}
catch (WsSecuritySecurementException ex) {
return handleSecurementException(ex, messageContext);
} catch (WsSecurityFaultException ex) {
}
catch (WsSecurityFaultException ex) {
return handleFaultException(ex, messageContext);
}
} else {
}
else {
return true;
}
}
/**
* Validates a client-side incoming response. Delegates to
* {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)} if
* the {@link #setValidateResponse(boolean) validateResponse} property is {@code true}.
*
* {@link #validateMessage(org.springframework.ws.soap.SoapMessage,org.springframework.ws.context.MessageContext)}
* if the {@link #setValidateResponse(boolean) validateResponse} property is
* {@code true}.
* @param messageContext the message context, containing the response to be validated
* @return {@code true} if the request was valid; {@code false} otherwise.
* @throws Exception in case of errors
@@ -230,18 +254,22 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
if (validateResponse) {
Assert.isTrue(messageContext.hasResponse(), "MessageContext contains no response");
Assert.isInstanceOf(SoapMessage.class, messageContext.getResponse());
if (skipValidationIfNoHeaderPresent && !isSecurityHeaderPresent((SoapMessage) messageContext.getResponse())) {
if (skipValidationIfNoHeaderPresent
&& !isSecurityHeaderPresent((SoapMessage) messageContext.getResponse())) {
return true;
}
try {
validateMessage((SoapMessage) messageContext.getResponse(), messageContext);
return true;
} catch (WsSecurityValidationException ex) {
}
catch (WsSecurityValidationException ex) {
return handleValidationException(ex, messageContext);
} catch (WsSecurityFaultException ex) {
}
catch (WsSecurityFaultException ex) {
return handleFaultException(ex, messageContext);
}
} else {
}
else {
return true;
}
}
@@ -258,11 +286,12 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/**
* Handles an securement exception. Default implementation logs the given exception, and returns {@code false}.
*
* Handles an securement exception. Default implementation logs the given exception,
* and returns {@code false}.
* @param ex the validation exception
* @param messageContext the message context
* @return {@code true} to continue processing the message, {@code false} (the default) otherwise
* @return {@code true} to continue processing the message, {@code false} (the
* default) otherwise
*/
protected boolean handleSecurementException(WsSecuritySecurementException ex, MessageContext messageContext) {
if (logger.isErrorEnabled()) {
@@ -272,13 +301,14 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/**
* Handles an invalid SOAP message. Default implementation logs the given exception, delegates to the set
* {@link #setExceptionResolver(EndpointExceptionResolver) exceptionResolver} if any, or creates a SOAP 1.1 Client or
* SOAP 1.2 Sender Fault with the exception message as fault string, and returns {@code false}.
*
* Handles an invalid SOAP message. Default implementation logs the given exception,
* delegates to the set {@link #setExceptionResolver(EndpointExceptionResolver)
* exceptionResolver} if any, or creates a SOAP 1.1 Client or SOAP 1.2 Sender Fault
* with the exception message as fault string, and returns {@code false}.
* @param ex the validation exception
* @param messageContext the message context
* @return {@code true} to continue processing the message, {@code false} (the default) otherwise
* @return {@code true} to continue processing the message, {@code false} (the
* default) otherwise
*/
protected boolean handleValidationException(WsSecurityValidationException ex, MessageContext messageContext) {
if (logger.isWarnEnabled()) {
@@ -286,7 +316,8 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
if (exceptionResolver != null) {
exceptionResolver.resolveException(messageContext, null, ex);
} else {
}
else {
if (logger.isDebugEnabled()) {
logger.debug("No exception resolver present, creating basic soap fault");
}
@@ -297,12 +328,13 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/**
* Handles a fault exception.Default implementation logs the given exception, and creates a SOAP Fault with the
* properties of the given exception, and returns {@code false}.
*
* Handles a fault exception.Default implementation logs the given exception, and
* creates a SOAP Fault with the properties of the given exception, and returns
* {@code false}.
* @param ex the validation exception
* @param messageContext the message context
* @return {@code true} to continue processing the message, {@code false} (the default) otherwise
* @return {@code true} to continue processing the message, {@code false} (the
* default) otherwise
*/
protected boolean handleFaultException(WsSecurityFaultException ex, MessageContext messageContext) {
if (logger.isWarnEnabled()) {
@@ -312,7 +344,8 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
SoapFault fault;
if (response instanceof Soap11Body) {
fault = ((Soap11Body) response).addFault(ex.getFaultCode(), ex.getFaultString(), Locale.ENGLISH);
} else {
}
else {
fault = response.addClientOrSenderFault(ex.getFaultString(), Locale.ENGLISH);
}
fault.setFaultActorOrRole(ex.getFaultActor());
@@ -320,9 +353,9 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
/**
* Abstract template method. Subclasses are required to validate the request contained in the given
* {@link SoapMessage}, and replace the original request with the validated version.
*
* Abstract template method. Subclasses are required to validate the request contained
* in the given {@link SoapMessage}, and replace the original request with the
* validated version.
* @param soapMessage the soap message to validate
* @throws WsSecurityValidationException in case of validation errors
*/
@@ -330,9 +363,9 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
throws WsSecurityValidationException;
/**
* Abstract template method. Subclasses are required to secure the response contained in the given
* {@link SoapMessage}, and replace the original response with the secured version.
*
* Abstract template method. Subclasses are required to secure the response contained
* in the given {@link SoapMessage}, and replace the original response with the
* secured version.
* @param soapMessage the soap message to secure
* @throws WsSecuritySecurementException in case of securement errors
*/
@@ -358,4 +391,5 @@ public abstract class AbstractWsSecurityInterceptor implements SoapEndpointInter
}
return false;
}
}

9
spring-ws-security/src/main/java/org/springframework/ws/soap/security/WsSecurityException.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -19,8 +19,8 @@ package org.springframework.ws.soap.security;
import org.springframework.ws.WebServiceException;
/**
* Exception indicating that something went wrong during WS-Security executions. Has specific subclasses for securement
* and validation.
* Exception indicating that something went wrong during WS-Security executions. Has
* specific subclasses for securement and validation.
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -35,4 +35,5 @@ public abstract class WsSecurityException extends WebServiceException {
public WsSecurityException(String msg, Throwable ex) {
super(msg, ex);
}
}

10
spring-ws-security/src/main/java/org/springframework/ws/soap/security/WsSecurityFaultException.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -33,7 +33,10 @@ public abstract class WsSecurityFaultException extends WsSecurityException {
private String faultActor;
/** Construct a new {@code WsSecurityFaultException} with the given fault code, string, and actor. */
/**
* Construct a new {@code WsSecurityFaultException} with the given fault code, string,
* and actor.
*/
public WsSecurityFaultException(QName faultCode, String faultString, String faultActor) {
super(faultString);
this.faultCode = faultCode;
@@ -55,4 +58,5 @@ public abstract class WsSecurityFaultException extends WsSecurityException {
public String getFaultActor() {
return faultActor;
}
}

10
spring-ws-security/src/main/java/org/springframework/ws/soap/security/WsSecuritySecurementException.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -19,8 +19,9 @@ package org.springframework.ws.soap.security;
/**
* Exception indicating that something went wrong during the securement of a message.
* <p>
* This is a checked exception since we want it to be caught, logged and handled rather than cause the application to
* fail. Failure to secure a message is usually not a fatal problem.
* This is a checked exception since we want it to be caught, logged and handled rather
* than cause the application to fail. Failure to secure a message is usually not a fatal
* problem.
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -35,4 +36,5 @@ public abstract class WsSecuritySecurementException extends WsSecurityException
public WsSecuritySecurementException(String msg, Throwable ex) {
super(msg, ex);
}
}

10
spring-ws-security/src/main/java/org/springframework/ws/soap/security/WsSecurityValidationException.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -19,8 +19,9 @@ package org.springframework.ws.soap.security;
/**
* Exception indicating that something went wrong during the validation of a message.
* <p>
* This is a checked exception since we want it to be caught, logged and handled rather than cause the application to
* fail. Failure to validate a message is usually not a fatal problem.
* This is a checked exception since we want it to be caught, logged and handled rather
* than cause the application to fail. Failure to validate a message is usually not a
* fatal problem.
*
* @author Arjen Poutsma
* @since 1.0.0
@@ -35,4 +36,5 @@ public abstract class WsSecurityValidationException extends WsSecurityException
public WsSecurityValidationException(String msg, Throwable ex) {
super(msg, ex);
}
}

12
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/AbstractCallbackHandler.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -36,11 +36,12 @@ public abstract class AbstractCallbackHandler implements CallbackHandler {
/** Logger available to subclasses. */
protected final Log logger = LogFactory.getLog(getClass());
protected AbstractCallbackHandler() {}
protected AbstractCallbackHandler() {
}
/**
* Iterates over the given callbacks, and calls {@code handleInternal} for each of them.
*
* Iterates over the given callbacks, and calls {@code handleInternal} for each of
* them.
* @param callbacks the callbacks
* @see #handleInternal(javax.security.auth.callback.Callback)
*/
@@ -53,4 +54,5 @@ public abstract class AbstractCallbackHandler implements CallbackHandler {
/** Template method that should be implemented by subclasses. */
protected abstract void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException;
}

13
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,8 +23,9 @@ import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
/**
* Represents a chain of {@code CallbackHandler}s. For each callback, each of the handlers is called in term. If a
* handler throws a {@code UnsupportedCallbackException}, the next handler is tried.
* Represents a chain of {@code CallbackHandler}s. For each callback, each of the handlers
* is called in term. If a handler throws a {@code UnsupportedCallbackException}, the next
* handler is tried.
*
* @author Arjen Poutsma
* @since 1.5.0
@@ -48,7 +49,8 @@ public class CallbackHandlerChain extends AbstractCallbackHandler {
try {
callbackHandler.handle(new Callback[] { callback });
allUnsupported = false;
} catch (UnsupportedCallbackException ex) {
}
catch (UnsupportedCallbackException ex) {
// if an UnsupportedCallbackException occurs, go to the next handler
}
}
@@ -56,4 +58,5 @@ public class CallbackHandlerChain extends AbstractCallbackHandler {
throw new UnsupportedCallbackException(callback);
}
}
}

8
spring-ws-security/src/main/java/org/springframework/ws/soap/security/callback/CleanupCallback.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -21,8 +21,8 @@ import java.io.Serializable;
import javax.security.auth.callback.Callback;
/**
* Underlying security services instantiate and pass a {@code CleanupCallback} to the {@code handle} method of a
* {@code CallbackHandler} to clean up security state.
* Underlying security services instantiate and pass a {@code CleanupCallback} to the
* {@code handle} method of a {@code CallbackHandler} to clean up security state.
*
* @author Arjen Poutsma
* @since 1.0.4

23
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/KeyManagersFactoryBean.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -49,8 +49,8 @@ public class KeyManagersFactoryBean implements FactoryBean<KeyManager[]>, Initia
private char[] password;
/**
* Sets the password to use for integrity checking. If this property is not set, then integrity checking is not
* performed.
* Sets the password to use for integrity checking. If this property is not set, then
* integrity checking is not performed.
*/
public void setPassword(String password) {
if (password != null) {
@@ -59,15 +59,16 @@ public class KeyManagersFactoryBean implements FactoryBean<KeyManager[]>, Initia
}
/**
* Sets the provider of the key manager to use. If this is not set, the default is used.
* Sets the provider of the key manager to use. If this is not set, the default is
* used.
*/
public void setProvider(String provider) {
this.provider = provider;
}
/**
* Sets the algorithm of the {@code KeyManager} to use. If this is not set, the default is used.
*
* Sets the algorithm of the {@code KeyManager} to use. If this is not set, the
* default is used.
* @see KeyManagerFactory#getDefaultAlgorithm()
*/
public void setAlgorithm(String algorithm) {
@@ -76,7 +77,6 @@ public class KeyManagersFactoryBean implements FactoryBean<KeyManager[]>, Initia
/**
* Sets the source of key material.
*
* @see KeyManagerFactory#init(KeyStore, char[])
*/
public void setKeyStore(KeyStore keyStore) {
@@ -100,14 +100,15 @@ public class KeyManagersFactoryBean implements FactoryBean<KeyManager[]>, Initia
@Override
public void afterPropertiesSet() throws Exception {
String algorithm = StringUtils.hasLength(this.algorithm) ? this.algorithm : KeyManagerFactory.getDefaultAlgorithm();
String algorithm = StringUtils.hasLength(this.algorithm) ? this.algorithm
: KeyManagerFactory.getDefaultAlgorithm();
KeyManagerFactory keyManagerFactory = StringUtils.hasLength(this.provider)
? KeyManagerFactory.getInstance(algorithm, this.provider)
: KeyManagerFactory.getInstance(algorithm);
? KeyManagerFactory.getInstance(algorithm, this.provider) : KeyManagerFactory.getInstance(algorithm);
keyManagerFactory.init(keyStore, password);
this.keyManagers = keyManagerFactory.getKeyManagers();
}
}

39
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,6 +23,7 @@ import java.security.KeyStore;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.FactoryBean;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.core.io.Resource;
@@ -31,8 +32,9 @@ import org.springframework.util.StringUtils;
/**
* Spring factory bean for a {@link KeyStore}.
* <p>
* To load an existing key store, you must set the {@code location} property. If this property is not set, a new, empty
* key store is created, which is most likely not what you want.
* To load an existing key store, you must set the {@code location} property. If this
* property is not set, a new, empty key store is created, which is most likely not what
* you want.
*
* @author Arjen Poutsma
* @see #setLocation(org.springframework.core.io.Resource)
@@ -54,8 +56,8 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
private char[] password;
/**
* Sets the location of the key store to use. If this is not set, a new, empty key store will be used.
*
* Sets the location of the key store to use. If this is not set, a new, empty key
* store will be used.
* @see KeyStore#load(java.io.InputStream,char[])
*/
public void setLocation(Resource location) {
@@ -63,8 +65,8 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
}
/**
* Sets the password to use for integrity checking. If this property is not set, then integrity checking is not
* performed.
* Sets the password to use for integrity checking. If this property is not set, then
* integrity checking is not performed.
*/
public void setPassword(String password) {
if (password != null) {
@@ -72,14 +74,16 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
}
}
/** Sets the provider of the key store to use. If this is not set, the default is used. */
/**
* Sets the provider of the key store to use. If this is not set, the default is used.
*/
public void setProvider(String provider) {
this.provider = provider;
}
/**
* Sets the type of the {@code KeyStore} to use. If this is not set, the default is used.
*
* Sets the type of the {@code KeyStore} to use. If this is not set, the default is
* used.
* @see KeyStore#getDefaultType()
*/
public void setType(String type) {
@@ -105,9 +109,11 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
public final void afterPropertiesSet() throws GeneralSecurityException, IOException {
if (StringUtils.hasLength(provider) && StringUtils.hasLength(type)) {
keyStore = KeyStore.getInstance(type, provider);
} else if (StringUtils.hasLength(type)) {
}
else if (StringUtils.hasLength(type)) {
keyStore = KeyStore.getInstance(type);
} else {
}
else {
keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
}
InputStream is = null;
@@ -117,14 +123,17 @@ public class KeyStoreFactoryBean implements FactoryBean<KeyStore>, InitializingB
if (logger.isInfoEnabled()) {
logger.info("Loading key store from " + location);
}
} else if (logger.isWarnEnabled()) {
}
else if (logger.isWarnEnabled()) {
logger.warn("Creating empty key store");
}
keyStore.load(is, password);
} finally {
}
finally {
if (is != null) {
is.close();
}
}
}
}

47
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreUtils.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -34,17 +34,18 @@ import org.springframework.util.StringUtils;
public abstract class KeyStoreUtils {
/**
* Loads the key store indicated by system properties. This method tries to load a key store by consulting the
* following system properties:{@code javax.net.ssl.keyStore}, {@code javax.net.ssl.keyStorePassword}, and
* {@code javax.net.ssl.keyStoreType}.
* Loads the key store indicated by system properties. This method tries to load a key
* store by consulting the following system properties:{@code javax.net.ssl.keyStore},
* {@code javax.net.ssl.keyStorePassword}, and {@code javax.net.ssl.keyStoreType}.
* <p>
* If these properties specify a file with an appropriate password, the factory uses this file for the key store. If
* that file does not exist, then a default, empty keystore is created.
* If these properties specify a file with an appropriate password, the factory uses
* this file for the key store. If that file does not exist, then a default, empty
* keystore is created.
* <p>
* This behavior corresponds to the standard J2SDK behavior for SSL key stores.
*
* @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509KeyManager">The
* standard J2SDK SSL key store mechanism</a>
* @see <a href=
* "http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509KeyManager">The
* standard J2SDK SSL key store mechanism</a>
*/
public static KeyStore loadDefaultKeyStore() throws GeneralSecurityException, IOException {
Resource location = null;
@@ -74,21 +75,24 @@ public abstract class KeyStoreUtils {
/**
* Loads a default trust store. This method uses the following algorithm:
* <ol>
* <li>If the system property {@code javax.net.ssl.trustStore} is defined, its value is loaded. If the
* {@code javax.net.ssl.trustStorePassword} system property is also defined, its value is used as a password. If the
* {@code javax.net.ssl.trustStoreType} system property is defined, its value is used as a key store type.
* <li>If the system property {@code javax.net.ssl.trustStore} is defined, its value
* is loaded. If the {@code javax.net.ssl.trustStorePassword} system property is also
* defined, its value is used as a password. If the
* {@code javax.net.ssl.trustStoreType} system property is defined, its value is used
* as a key store type.
* <p>
* If {@code javax.net.ssl.trustStore} is defined but the specified file does not exist, then a default, empty trust
* store is created.</li>
* <li>If the {@code javax.net.ssl.trustStore} system property was not specified, but if the file
* {@code $JAVA_HOME/lib/security/jssecacerts} exists, that file is used.</li> Otherwise,
* If {@code javax.net.ssl.trustStore} is defined but the specified file does not
* exist, then a default, empty trust store is created.</li>
* <li>If the {@code javax.net.ssl.trustStore} system property was not specified, but
* if the file {@code $JAVA_HOME/lib/security/jssecacerts} exists, that file is
* used.</li> Otherwise,
* <li>If the file {@code $JAVA_HOME/lib/security/cacerts} exists, that file is used.
* </ol>
* <p>
* This behavior corresponds to the standard J2SDK behavior for SSL trust stores.
*
* @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509TrustManager">The
* standard J2SDK SSL trust store mechanism</a>
* @see <a href=
* "http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509TrustManager">The
* standard J2SDK SSL trust store mechanism</a>
*/
public static KeyStore loadDefaultTrustStore() throws GeneralSecurityException, IOException {
Resource location = null;
@@ -105,7 +109,8 @@ public abstract class KeyStoreUtils {
password = passwordProperty;
}
type = System.getProperty("javax.net.ssl.trustStoreType");
} else {
}
else {
String javaHome = System.getProperty("java.home");
location = new FileSystemResource(javaHome + "/lib/security/jssecacerts");
if (!location.exists()) {

6
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/SpringSecurityUtils.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -32,7 +32,6 @@ public abstract class SpringSecurityUtils {
/**
* Checks the validity of a user's account and credentials.
*
* @param user the user to check
* @throws AccountExpiredException if the account has expired
* @throws CredentialsExpiredException if the credentials have expired
@@ -57,4 +56,5 @@ public abstract class SpringSecurityUtils {
throw new CredentialsExpiredException("Credentials for user '" + user + "' have expired");
}
}
}

13
spring-ws-security/src/main/java/org/springframework/ws/soap/security/support/TrustManagersFactoryBean.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -46,15 +46,16 @@ public class TrustManagersFactoryBean implements FactoryBean<TrustManager[]>, In
private String provider;
/**
* Sets the provider of the trust manager to use. If this is not set, the default is used.
* Sets the provider of the trust manager to use. If this is not set, the default is
* used.
*/
public void setProvider(String provider) {
this.provider = provider;
}
/**
* Sets the algorithm of the {@code TrustManager} to use. If this is not set, the default is used.
*
* Sets the algorithm of the {@code TrustManager} to use. If this is not set, the
* default is used.
* @see TrustManagerFactory#getDefaultAlgorithm()
*/
public void setAlgorithm(String algorithm) {
@@ -63,7 +64,6 @@ public class TrustManagersFactoryBean implements FactoryBean<TrustManager[]>, In
/**
* Sets the source of certificate authorities and related trust material.
*
* @see TrustManagerFactory#init(KeyStore)
*/
public void setKeyStore(KeyStore keyStore) {
@@ -98,4 +98,5 @@ public class TrustManagersFactoryBean implements FactoryBean<TrustManager[]>, In
this.trustManagers = trustManagerFactory.getTrustManagers();
}
}

14
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,8 +16,6 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor.SECUREMENT_PASSWORD_PROPERTY_NAME;
import java.util.List;
import java.util.Properties;
@@ -28,9 +26,12 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
import org.apache.wss4j.dom.handler.HandlerAction;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.handler.WSHandler;
import org.w3c.dom.Document;
import org.springframework.util.StringUtils;
import org.springframework.ws.context.MessageContext;
import org.w3c.dom.Document;
import static org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor.SECUREMENT_PASSWORD_PROPERTY_NAME;
/**
* @author Tareq Abed Rabbo
@@ -94,7 +95,7 @@ class Wss4jHandler extends WSHandler {
@Override
public String getPassword(Object msgContext) {
String contextPassword = (String)getProperty(msgContext, SECUREMENT_PASSWORD_PROPERTY_NAME);
String contextPassword = (String) getProperty(msgContext, SECUREMENT_PASSWORD_PROPERTY_NAME);
if (StringUtils.hasLength(contextPassword)) {
return contextPassword;
}
@@ -125,4 +126,5 @@ class Wss4jHandler extends WSHandler {
public void setProperty(Object msgContext, String key, Object value) {
((MessageContext) msgContext).setProperty(key, value);
}
}

5
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityFaultException.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -34,4 +34,5 @@ public class Wss4jSecurityFaultException extends WsSecurityFaultException {
public Wss4jSecurityFaultException(QName faultCode, String faultString, String faultActor) {
super(faultCode, faultString, faultActor);
}
}

247
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -44,6 +44,9 @@ import org.apache.wss4j.dom.util.WSSecurityUtil;
import org.apache.wss4j.dom.validate.Credential;
import org.apache.wss4j.dom.validate.SignatureTrustValidator;
import org.apache.wss4j.dom.validate.TimestampValidator;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
import org.springframework.util.CollectionUtils;
@@ -56,16 +59,16 @@ import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.springframework.ws.soap.security.callback.CallbackHandlerChain;
import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.wss4j2.callback.UsernameTokenPrincipalCallback;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
/**
* A WS-Security endpoint interceptor based on Apache's WSS4J. This interceptor supports messages created by the
* A WS-Security endpoint interceptor based on Apache's WSS4J. This interceptor supports
* messages created by the
* {@link org.springframework.ws.soap.axiom.AxiomSoapMessageFactory} and the
* {@link org.springframework.ws.soap.saaj.SaajSoapMessageFactory}.
* <p>
* The validation and securement actions executed by this interceptor are configured via {@code validationActions} and
* {@code securementActions} properties, respectively. Actions should be passed as a space-separated strings.
* The validation and securement actions executed by this interceptor are configured via
* {@code validationActions} and {@code securementActions} properties, respectively.
* Actions should be passed as a space-separated strings.
* <p>
* Valid <strong>validation</strong> actions are: <blockquote>
* <table>
@@ -129,8 +132,8 @@ import org.w3c.dom.Element;
* </table>
* </blockquote>
* <p>
* The order of the actions that the client performed to secure the messages is significant and is enforced by the
* interceptor.
* The order of the actions that the client performed to secure the messages is
* significant and is enforced by the interceptor.
*
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
@@ -144,7 +147,7 @@ import org.w3c.dom.Element;
public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor implements InitializingBean {
public static final String SECUREMENT_USER_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementUser";
public static final String SECUREMENT_PASSWORD_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementPassword";
private String securementActions;
@@ -184,6 +187,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
private boolean bspCompliant;
private boolean addInclusivePrefixes = true;
private boolean securementUseDerivedKey;
private CallbackHandler samlCallbackHandler;
@@ -203,7 +207,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Inject a customize {@link WSSecurityEngine}.
*
* @param securityEngine
*/
public Wss4jSecurityInterceptor(WSSecurityEngine securityEngine) {
@@ -219,7 +222,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* <p>
* If this parameter is omitted, the actor name is not set.
* <p>
* The value of the actor or role has to match the receiver's setting or may contain standard values.
* The value of the actor or role has to match the receiver's setting or may contain
* standard values.
*/
public void setSecurementActor(String securementActor) {
handler.setOption(WSHandlerConstants.ACTOR, securementActor);
@@ -230,10 +234,12 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Defines which key identifier type to use. The WS-Security specifications recommends to use the identifier type
* {@code IssuerSerial}. For possible encryption key identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For encryption {@code IssuerSerial},
* {@code X509KeyIdentifier}, {@code DirectReference}, {@code Thumbprint}, {@code SKIKeyIdentifier}, and
* Defines which key identifier type to use. The WS-Security specifications recommends
* to use the identifier type {@code IssuerSerial}. For possible encryption key
* identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For
* encryption {@code IssuerSerial}, {@code X509KeyIdentifier},
* {@code DirectReference}, {@code Thumbprint}, {@code SKIKeyIdentifier}, and
* {@code EmbeddedKeyName} are valid only.
*/
public void setSecurementEncryptionKeyIdentifier(String securementEncryptionKeyIdentifier) {
@@ -241,8 +247,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Defines which algorithm to use to encrypt the generated symmetric key. Currently WSS4J supports
* {@link WSConstants#KEYTRANSPORT_RSA15} and {@link WSConstants#KEYTRANSPORT_RSAOEP}.
* Defines which algorithm to use to encrypt the generated symmetric key. Currently
* WSS4J supports {@link WSConstants#KEYTRANSPORT_RSA15} and
* {@link WSConstants#KEYTRANSPORT_RSAOEP}.
*/
public void setSecurementEncryptionKeyTransportAlgorithm(String securementEncryptionKeyTransportAlgorithm) {
handler.setOption(WSHandlerConstants.ENC_KEY_TRANSPORT, securementEncryptionKeyTransportAlgorithm);
@@ -251,13 +258,15 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Property to define which parts of the request shall be encrypted.
* <p>
* The value of this property is a list of semicolon separated element names that identify the elements to encrypt. An
* encryption mode specifier and a namespace identification, each inside a pair of curly brackets, may precede each
* element name.
* The value of this property is a list of semicolon separated element names that
* identify the elements to encrypt. An encryption mode specifier and a namespace
* identification, each inside a pair of curly brackets, may precede each element
* name.
* <p>
* The encryption mode specifier is either {@code {Content}} or {@code {Element}}. Please refer to the W3C XML
* Encryption specification about the differences between Element and Content encryption. The encryption mode defaults
* to {@code Content} if it is omitted. Example of a list:
* The encryption mode specifier is either {@code {Content}} or {@code {Element}}.
* Please refer to the W3C XML Encryption specification about the differences between
* Element and Content encryption. The encryption mode defaults to {@code Content} if
* it is omitted. Example of a list:
*
* <pre>
* &lt;property name="securementEncryptionParts"
@@ -265,31 +274,35 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
* {Element}{}UserName" />
* </pre>
*
* The first entry of the list identifies the element {@code CreditCard} in the namespace
* {@code http://example.org/paymentv2}, and will encrypt its content. Be aware that the element name, the namespace
* identifier, and the encryption modifier are case sensitive.
* The first entry of the list identifies the element {@code CreditCard} in the
* namespace {@code http://example.org/paymentv2}, and will encrypt its content. Be
* aware that the element name, the namespace identifier, and the encryption modifier
* are case sensitive.
* <p>
* The encryption modifier and the namespace identifier can be omitted. In this case the encryption mode defaults to
* {@code Content} and the namespace is set to the SOAP namespace.
* <p>
* An empty encryption mode defaults to {@code Content}, an empty namespace identifier defaults to the SOAP namespace.
* The second line of the example defines {@code Element} as encryption mode for an {@code UserName} element in the
* The encryption modifier and the namespace identifier can be omitted. In this case
* the encryption mode defaults to {@code Content} and the namespace is set to the
* SOAP namespace.
* <p>
* To specify an element without a namespace use the string {@code Null} as the namespace name (this is a case
* sensitive string)
* An empty encryption mode defaults to {@code Content}, an empty namespace identifier
* defaults to the SOAP namespace. The second line of the example defines
* {@code Element} as encryption mode for an {@code UserName} element in the SOAP
* namespace.
* <p>
* If no list is specified, the handler encrypts the SOAP Body in {@code Content} mode by default.
* To specify an element without a namespace use the string {@code Null} as the
* namespace name (this is a case sensitive string)
* <p>
* If no list is specified, the handler encrypts the SOAP Body in {@code Content} mode
* by default.
*/
public void setSecurementEncryptionParts(String securementEncryptionParts) {
handler.setOption(WSHandlerConstants.ENCRYPTION_PARTS, securementEncryptionParts);
}
/**
* Defines which symmetric encryption algorithm to use. WSS4J supports the following alorithms:
* {@link WSConstants#TRIPLE_DES}, {@link WSConstants#AES_128}, {@link WSConstants#AES_256}, and
* {@link WSConstants#AES_192}. Except for AES 192 all of these algorithms are required by the XML Encryption
* specification.
* Defines which symmetric encryption algorithm to use. WSS4J supports the following
* alorithms: {@link WSConstants#TRIPLE_DES}, {@link WSConstants#AES_128},
* {@link WSConstants#AES_256}, and {@link WSConstants#AES_192}. Except for AES 192
* all of these algorithms are required by the XML Encryption specification.
*/
public void setSecurementEncryptionSymAlgorithm(String securementEncryptionSymAlgorithm) {
this.handler.setOption(WSHandlerConstants.ENC_SYM_ALGO, securementEncryptionSymAlgorithm);
@@ -298,19 +311,24 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* The user's name for encryption.
* <p>
* The encryption functions uses the public key of this user's certificate to encrypt the generated symmetric key.
* The encryption functions uses the public key of this user's certificate to encrypt
* the generated symmetric key.
* <p>
* If this parameter is not set, then the encryption function falls back to the
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} parameter to get the certificate.
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} parameter to get the
* certificate.
* <p>
* If <b>only</b> encryption of the SOAP body data is requested, it is recommended to use this parameter to define the
* username. The application can then use the standard user and password functions (see example at
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} to enable HTTP authentication functions.
* If <b>only</b> encryption of the SOAP body data is requested, it is recommended to
* use this parameter to define the username. The application can then use the
* standard user and password functions (see example at
* {@link org.apache.ws.security.handler.WSHandlerConstants#USER} to enable HTTP
* authentication functions.
* <p>
* Encryption only does not authenticate a user / sender, therefore it does not need a password.
* Encryption only does not authenticate a user / sender, therefore it does not need a
* password.
* <p>
* Placing the username of the encryption certificate in the configuration file is not a security risk, because the
* public key of that certificate is used only.
* Placing the username of the encryption certificate in the configuration file is not
* a security risk, because the public key of that certificate is used only.
*/
public void setSecurementEncryptionUser(String securementEncryptionUser) {
handler.setOption(WSHandlerConstants.ENCRYPTION_USER, securementEncryptionUser);
@@ -323,7 +341,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Specific parameter for UsernameToken action to define the encoding of the passowrd.
* <p>
* The parameter can be set to either {@link WSConstants#PW_DIGEST} or to {@link WSConstants#PW_TEXT}.
* The parameter can be set to either {@link WSConstants#PW_DIGEST} or to
* {@link WSConstants#PW_TEXT}.
* <p>
* The default setting is PW_DIGEST.
*/
@@ -333,7 +352,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Defines which signature algorithm to use.
*
* @see WSConstants#RSA
* @see WSConstants#DSA
*/
@@ -353,10 +371,11 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Defines which key identifier type to use. The WS-Security specifications recommends to use the identifier type
* {@code IssuerSerial}. For possible signature key identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For signature {@code IssuerSerial} and
* {@code DirectReference} are valid only.
* Defines which key identifier type to use. The WS-Security specifications recommends
* to use the identifier type {@code IssuerSerial}. For possible signature key
* identifier types refer to
* {@link org.apache.ws.security.handler.WSHandlerConstants#keyIdentifier}. For
* signature {@code IssuerSerial} and {@code DirectReference} are valid only.
*/
public void setSecurementSignatureKeyIdentifier(String securementSignatureKeyIdentifier) {
handler.setOption(WSHandlerConstants.SIG_KEY_ID, securementSignatureKeyIdentifier);
@@ -365,27 +384,28 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Property to define which parts of the request shall be signed.
* <p>
* Refer to {@link #setSecurementEncryptionParts(String)} for a detailed description of the format of the value
* string.
* Refer to {@link #setSecurementEncryptionParts(String)} for a detailed description
* of the format of the value string.
* <p>
* If this property is not specified the handler signs the SOAP Body by default.
* <p>
* The WS Security specifications define several formats to transfer the signature tokens (certificates) or references
* to these tokens. Thus, the plain element name {@code Token} signs the token and takes care of the different
* formats.
* The WS Security specifications define several formats to transfer the signature
* tokens (certificates) or references to these tokens. Thus, the plain element name
* {@code Token} signs the token and takes care of the different formats.
* <p>
* To sign the SOAP body <b>and</b> the signature token the value of this parameter must contain:
* To sign the SOAP body <b>and</b> the signature token the value of this parameter
* must contain:
*
* <pre>
* &lt;property name="securementSignatureParts"
* value="{}{http://schemas.xmlsoap.org/soap/envelope/}Body; Token" />
* </pre>
*
* To specify an element without a namespace use the string {@code Null} as the namespace name (this is a case
* sensitive string)
* To specify an element without a namespace use the string {@code Null} as the
* namespace name (this is a case sensitive string)
* <p>
* If there is no other element in the request with a local name of {@code Body} then the SOAP namespace identifier
* can be empty ({@code {}}).
* If there is no other element in the request with a local name of {@code Body} then
* the SOAP namespace identifier can be empty ({@code {}}).
*/
public void setSecurementSignatureParts(String securementSignatureParts) {
handler.setOption(WSHandlerConstants.SIGNATURE_PARTS, securementSignatureParts);
@@ -394,16 +414,20 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* The user's name for signature.
* <p>
* This name is used as the alias name in the keystore to get user's certificate and private key to perform signing.
* This name is used as the alias name in the keystore to get user's certificate and
* private key to perform signing.
* <p>
* If this parameter is not set, then the signature function falls back to the alias specified by
* {@link #setSecurementUsername(String)}.
* If this parameter is not set, then the signature function falls back to the alias
* specified by {@link #setSecurementUsername(String)}.
*/
public void setSecurementSignatureUser(String securementSignatureUser) {
handler.setOption(WSHandlerConstants.SIGNATURE_USER, securementSignatureUser);
}
/** Sets the username for securement username token or/and the alias of the private key for securement signature */
/**
* Sets the username for securement username token or/and the alias of the private key
* for securement signature
*/
public void setSecurementUsername(String securementUsername) {
this.securementUsername = securementUsername;
}
@@ -418,7 +442,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Enables the derivation of keys as per the UsernameTokenProfile 1.1 spec. Default is {@code true}.
* Enables the derivation of keys as per the UsernameTokenProfile 1.1 spec. Default is
* {@code true}.
*/
public void setSecurementUseDerivedKey(boolean securementUseDerivedKey) {
this.securementUseDerivedKey = securementUseDerivedKey;
@@ -426,7 +451,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Sets the SAML Callback used for generating SAML tokens.
*
* @param samlCallback
*/
public void setSecurementSamlCallbackHandler(CallbackHandler samlCallbackHandler) {
@@ -448,7 +472,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
this.validationActions = actions;
try {
validationActionsVector = WSSecurityUtil.decodeAction(actions);
} catch (WSSecurityException ex) {
}
catch (WSSecurityException ex) {
throw new IllegalArgumentException(ex);
}
}
@@ -459,7 +484,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Sets the {@link CallbackHandler} to use when validating messages.
*
* @see #setValidationCallbackHandlers(CallbackHandler[])
*/
public void setValidationCallbackHandler(CallbackHandler callbackHandler) {
@@ -468,7 +492,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Sets the {@link CallbackHandler}s to use when validating messages.
*
* @see #setValidationCallbackHandler(CallbackHandler)
*/
public void setValidationCallbackHandlers(CallbackHandler[] callbackHandler) {
@@ -485,7 +508,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
this.validationSignatureCrypto = signatureCrypto;
}
/** Whether to enable signatureConfirmation or not. By default signatureConfirmation is enabled */
/**
* Whether to enable signatureConfirmation or not. By default signatureConfirmation is
* enabled
*/
public void setEnableSignatureConfirmation(boolean enableSignatureConfirmation) {
handler.setOption(WSHandlerConstants.ENABLE_SIGNATURE_CONFIRMATION, enableSignatureConfirmation);
@@ -497,27 +523,33 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
handler.setOption(WSHandlerConstants.TIMESTAMP_PRECISION, timestampPrecisionInMilliseconds);
}
/** Sets whether or not timestamp verification is done with the server-side time to live */
/**
* Sets whether or not timestamp verification is done with the server-side time to
* live
*/
public void setTimestampStrict(boolean timestampStrict) {
this.timestampStrict = timestampStrict;
}
/**
* Enables the {@code mustUnderstand} attribute on WS-Security headers on outgoing messages. Default is {@code true}.
* Enables the {@code mustUnderstand} attribute on WS-Security headers on outgoing
* messages. Default is {@code true}.
*/
public void setSecurementMustUnderstand(boolean securementMustUnderstand) {
handler.setOption(WSHandlerConstants.MUST_UNDERSTAND, securementMustUnderstand);
}
/**
* Sets whether or not a {@code Nonce} element is added to the {@code UsernameToken}s. Default is {@code false}.
* Sets whether or not a {@code Nonce} element is added to the {@code UsernameToken}s.
* Default is {@code false}.
*/
public void setSecurementUsernameTokenNonce(boolean securementUsernameTokenNonce) {
handler.setOption(ConfigurationConstants.ADD_USERNAMETOKEN_NONCE, securementUsernameTokenNonce);
}
/**
* Sets whether or not a {@code Created} element is added to the {@code UsernameToken}s. Default is {@code false}.
* Sets whether or not a {@code Created} element is added to the
* {@code UsernameToken}s. Default is {@code false}.
*/
public void setSecurementUsernameTokenCreated(boolean securementUsernameTokenCreated) {
handler.setOption(ConfigurationConstants.ADD_USERNAMETOKEN_CREATED, securementUsernameTokenCreated);
@@ -526,9 +558,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Sets the web service specification settings.
* <p>
* The default settings follow the latest OASIS and changing anything might violate the OASIS specs.
*
* @param config web service security configuration or {@code null} to use default settings
* The default settings follow the latest OASIS and changing anything might violate
* the OASIS specs.
* @param config web service security configuration or {@code null} to use default
* settings
*/
public void setWssConfig(WSSConfig config) {
@@ -553,8 +586,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets whether to add an InclusiveNamespaces PrefixList as a CanonicalizationMethod child when generating Signatures
* using WSConstants.C14N_EXCL_OMIT_COMMENTS. Default is {@code true}.
* Sets whether to add an InclusiveNamespaces PrefixList as a CanonicalizationMethod
* child when generating Signatures using WSConstants.C14N_EXCL_OMIT_COMMENTS. Default
* is {@code true}.
*/
public void setAddInclusivePrefixes(boolean addInclusivePrefixes) {
@@ -570,8 +604,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Sets the time in seconds in the future within which the Created time of an incoming Timestamp is valid. The default
* is 60 seconds.
* Sets the time in seconds in the future within which the Created time of an incoming
* Timestamp is valid. The default is 60 seconds.
*/
public void setFutureTimeToLive(int futureTimeToLive) {
@@ -614,7 +648,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
List<HandlerAction> securementActionsVector = new ArrayList<HandlerAction>();
try {
securementActionsVector = WSSecurityUtil.decodeHandlerAction(securementActions, wssConfig);
} catch (WSSecurityException ex) {
}
catch (WSSecurityException ex) {
throw new Wss4jSecuritySecurementException(ex.getMessage(), ex);
}
@@ -629,7 +664,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
Document envelopeAsDocument = soapMessage.getDocument();
try {
handler.doSenderAction(envelopeAsDocument, requestData, securementActionsVector, false);
} catch (WSSecurityException ex) {
}
catch (WSSecurityException ex) {
throw new Wss4jSecuritySecurementException(ex.getMessage(), ex);
}
@@ -638,7 +674,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Creates and initializes a request data for the given message context.
*
* @param messageContext the message context
* @return the request data
*/
@@ -651,7 +686,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
String contextUsername = (String) messageContext.getProperty(SECUREMENT_USER_PROPERTY_NAME);
if (StringUtils.hasLength(contextUsername)) {
requestData.setUsername(contextUsername);
} else {
}
else {
requestData.setUsername(securementUsername);
}
@@ -675,7 +711,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Creates and initializes a request data for the given message context.
*
* @param messageContext the message context
* @return the request data
*/
@@ -756,7 +791,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
verifyTimestamp(result);
processPrincipal(result);
} catch (WSSecurityException ex) {
}
catch (WSSecurityException ex) {
throw new Wss4jSecurityValidationException(ex.getMessage(), ex);
}
@@ -768,9 +804,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Checks whether the received headers match the configured validation actions. Subclasses could override this method
* for custom verification behavior.
*
* Checks whether the received headers match the configured validation actions.
* Subclasses could override this method for custom verification behavior.
* @param results the results of the validation function
* @param validationActions the decoded validation actions
* @throws Wss4jSecurityValidationException if the results are deemed invalid
@@ -784,27 +819,26 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
/**
* Puts the results of WS-Security headers processing in the message context. Some actions like Signature Confirmation
* require this.
* Puts the results of WS-Security headers processing in the message context. Some
* actions like Signature Confirmation require this.
*/
@SuppressWarnings("unchecked")
private void updateContextWithResults(MessageContext messageContext, List<WSSecurityEngineResult> results) {
List<WSHandlerResult> handlerResults;
if ((handlerResults = (List<WSHandlerResult>) messageContext
.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
.getProperty(WSHandlerConstants.RECV_RESULTS)) == null) {
handlerResults = new ArrayList<WSHandlerResult>();
messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults);
}
WSHandlerResult rResult = new WSHandlerResult(validationActor, results,
Collections.<Integer, List<WSSecurityEngineResult>> emptyMap());
Collections.<Integer, List<WSSecurityEngineResult>>emptyMap());
handlerResults.add(0, rResult);
messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults);
}
/**
* Verifies the trust of a certificate.
*
* @param result
*/
protected void verifyCertificateTrust(WSHandlerResult result) throws WSSecurityException {
@@ -813,7 +847,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
if (!CollectionUtils.isEmpty(results)) {
WSSecurityEngineResult actionResult = results.get(0);
X509Certificate returnCert = (X509Certificate) actionResult.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
X509Certificate returnCert = (X509Certificate) actionResult
.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
Credential credential = new Credential();
credential.setCertificates(new X509Certificate[] { returnCert });
@@ -828,7 +863,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
/**
* Verifies the timestamp.
*
* @param result
*/
protected void verifyTimestamp(WSHandlerResult result) throws WSSecurityException {
@@ -865,9 +899,11 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
UsernameTokenPrincipalCallback callback = new UsernameTokenPrincipalCallback(usernameTokenPrincipal);
try {
validationCallbackHandler.handle(new Callback[] { callback });
} catch (IOException ex) {
}
catch (IOException ex) {
logger.warn("Principal callback resulted in IOException", ex);
} catch (UnsupportedCallbackException ex) {
}
catch (UnsupportedCallbackException ex) {
// ignore
}
}
@@ -881,11 +917,14 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
try {
CleanupCallback cleanupCallback = new CleanupCallback();
validationCallbackHandler.handle(new Callback[] { cleanupCallback });
} catch (IOException ex) {
}
catch (IOException ex) {
logger.warn("Cleanup callback resulted in IOException", ex);
} catch (UnsupportedCallbackException ex) {
}
catch (UnsupportedCallbackException ex) {
// ignore
}
}
}
}

52
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/AbstractWsPasswordCallbackHandler.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -22,12 +22,13 @@ import javax.security.auth.callback.Callback;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.springframework.ws.soap.security.callback.AbstractCallbackHandler;
import org.springframework.ws.soap.security.callback.CleanupCallback;
/**
* Abstract base class for {@link javax.security.auth.callback.CallbackHandler} implementations that handle
* {@link WSPasswordCallback} callbacks.
* Abstract base class for {@link javax.security.auth.callback.CallbackHandler}
* implementations that handle {@link WSPasswordCallback} callbacks.
*
* @author Arjen Poutsma
* @author Jamin Hitchcock
@@ -36,9 +37,9 @@ import org.springframework.ws.soap.security.callback.CleanupCallback;
public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallbackHandler {
/**
* Handles {@link WSPasswordCallback} callbacks. Inspects the callback {@link WSPasswordCallback#getUsage() usage}
* code, and calls the various {@code handle*} template methods.
*
* Handles {@link WSPasswordCallback} callbacks. Inspects the callback
* {@link WSPasswordCallback#getUsage() usage} code, and calls the various
* {@code handle*} template methods.
* @param callback the callback
* @throws IOException in case of I/O errors
* @throws UnsupportedCallbackException when the callback is not supported
@@ -67,13 +68,17 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
handleSecretKey(passwordCallback);
break;
default:
throw new UnsupportedCallbackException(callback, "Unknown usage [" + passwordCallback.getUsage() + "]");
throw new UnsupportedCallbackException(callback,
"Unknown usage [" + passwordCallback.getUsage() + "]");
}
} else if (callback instanceof CleanupCallback) {
}
else if (callback instanceof CleanupCallback) {
handleCleanup((CleanupCallback) callback);
} else if (callback instanceof UsernameTokenPrincipalCallback) {
}
else if (callback instanceof UsernameTokenPrincipalCallback) {
handleUsernameTokenPrincipal((UsernameTokenPrincipalCallback) callback);
} else {
}
else {
throw new UnsupportedCallbackException(callback);
}
}
@@ -82,9 +87,10 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
* Invoked when the callback has a {@link WSPasswordCallback#DECRYPT} usage.
* <p>
* This method is invoked when WSS4J needs a password to get the private key of the
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* decrypt the session (symmetric) key. Because the encryption method uses the public key to encrypt the session key
* it needs no password (a public key is usually not protected by a password).
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore.
* WSS4J uses this private key to decrypt the session (symmetric) key. Because the
* encryption method uses the public key to encrypt the session key it needs no
* password (a public key is usually not protected by a password).
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -95,7 +101,8 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
/**
* Invoked when the callback has a {@link WSPasswordCallback#USERNAME_TOKEN} usage.
* <p>
* This method is invoked when WSS4J needs the password to fill in or to verify a UsernameToken.
* This method is invoked when WSS4J needs the password to fill in or to verify a
* UsernameToken.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -107,8 +114,9 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
* Invoked when the callback has a {@link WSPasswordCallback#SIGNATURE} usage.
* <p>
* This method is invoked when WSS4J needs the password to get the private key of the
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* produce a signature. The signature verfication uses the public key to verfiy the signature.
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore.
* WSS4J uses this private key to produce a signature. The signature verfication uses
* the public key to verfiy the signature.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -117,9 +125,11 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
}
/**
* Invoked when the callback has a {@link WSPasswordCallback#SECURITY_CONTEXT_TOKEN} usage.
* Invoked when the callback has a {@link WSPasswordCallback#SECURITY_CONTEXT_TOKEN}
* usage.
* <p>
* This method is invoked when WSS4J needs the key to to be associated with a SecurityContextToken.
* This method is invoked when WSS4J needs the key to to be associated with a
* SecurityContextToken.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -156,7 +166,8 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
}
/**
* Invoked when a {@link UsernameTokenPrincipalCallback} is passed to {@link #handle(Callback[])}.
* Invoked when a {@link UsernameTokenPrincipalCallback} is passed to
* {@link #handle(Callback[])}.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -164,4 +175,5 @@ public abstract class AbstractWsPasswordCallbackHandler extends AbstractCallback
throws IOException, UnsupportedCallbackException {
throw new UnsupportedCallbackException(callback);
}
}

46
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/KeyStoreCallbackHandler.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -17,17 +17,23 @@
package org.springframework.ws.soap.security.wss4j2.callback;
import java.io.IOException;
import java.security.*;
import java.security.Key;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.ws.soap.security.support.KeyStoreUtils;
/**
* Callback handler that uses Java Security {@code KeyStore}s to handle cryptographic callbacks. Allows for specific key
* stores to be set for various cryptographic operations.
* Callback handler that uses Java Security {@code KeyStore}s to handle cryptographic
* callbacks. Allows for specific key stores to be set for various cryptographic
* operations.
*
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
@@ -47,9 +53,10 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
* Invoked when the callback has a {@link WSPasswordCallback#DECRYPT} usage.
* <p>
* This method is invoked when WSS4J needs a password to get the private key of the
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore. WSS4J uses this private key to
* decrypt the session (symmetric) key. Because the encryption method uses the public key to encrypt the session key
* it needs no password (a public key is usually not protected by a password).
* {@link WSPasswordCallback#getIdentifier() identifier} (username) from the keystore.
* WSS4J uses this private key to decrypt the session (symmetric) key. Because the
* encryption method uses the public key to encrypt the session key it needs no
* password (a public key is usually not protected by a password).
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -67,8 +74,10 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
Key key;
try {
key = keyStore.getKey(id, symmetricKeyPassword != null ? symmetricKeyPassword : privateKeyPassword.toCharArray());
} catch (UnrecoverableKeyException | KeyStoreException | NoSuchAlgorithmException e) {
key = keyStore.getKey(id,
symmetricKeyPassword != null ? symmetricKeyPassword : privateKeyPassword.toCharArray());
}
catch (UnrecoverableKeyException | KeyStoreException | NoSuchAlgorithmException e) {
throw new IOException("Could not get key", e);
}
@@ -81,8 +90,8 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
}
/**
* Sets the password used to retrieve private keys from the keystore. This property is required for decryption based
* on private keys, and signing.
* Sets the password used to retrieve private keys from the keystore. This property is
* required for decryption based on private keys, and signing.
*/
public void setPrivateKeyPassword(String privateKeyPassword) {
if (privateKeyPassword != null) {
@@ -91,9 +100,8 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
}
/**
* Sets the password used to retrieve keys from the symmetric keystore. If this property is not set, it defaults to
* the private key password.
*
* Sets the password used to retrieve keys from the symmetric keystore. If this
* property is not set, it defaults to the private key password.
* @see #setPrivateKeyPassword(String)
*/
public void setSymmetricKeyPassword(String symmetricKeyPassword) {
@@ -112,14 +120,18 @@ public class KeyStoreCallbackHandler extends AbstractWsPasswordCallbackHandler i
}
}
/** Loads the key store indicated by system properties. Delegates to {@link KeyStoreUtils#loadDefaultKeyStore()}. */
/**
* Loads the key store indicated by system properties. Delegates to
* {@link KeyStoreUtils#loadDefaultKeyStore()}.
*/
protected void loadDefaultKeyStore() {
try {
keyStore = KeyStoreUtils.loadDefaultKeyStore();
if (logger.isDebugEnabled()) {
logger.debug("Loaded default key store");
}
} catch (Exception ex) {
}
catch (Exception ex) {
logger.warn("Could not open default key store", ex);
}
}

15
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/SimplePasswordValidationCallbackHandler.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -24,12 +24,13 @@ import java.util.Properties;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
/**
* Simple callback handler that validates passwords against a in-memory {@code Properties} object. Password validation
* is done on a case-sensitive basis.
* Simple callback handler that validates passwords against a in-memory {@code Properties}
* object. Password validation is done on a case-sensitive basis.
*
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
@@ -42,7 +43,10 @@ public class SimplePasswordValidationCallbackHandler extends AbstractWsPasswordC
private Map<String, String> users = new HashMap<String, String>();
/** Sets the users to validate against. Property names are usernames, property values are passwords. */
/**
* Sets the users to validate against. Property names are usernames, property values
* are passwords.
*/
public void setUsers(Properties users) {
for (Map.Entry<Object, Object> entry : users.entrySet()) {
if (entry.getKey() instanceof String && entry.getValue() instanceof String) {
@@ -66,4 +70,5 @@ public class SimplePasswordValidationCallbackHandler extends AbstractWsPasswordC
String passwd = users.get(username);
callback.setPassword(passwd);
}
}

20
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/SpringSecurityPasswordValidationCallbackHandler.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -22,6 +22,7 @@ import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.dao.DataAccessException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -36,10 +37,12 @@ import org.springframework.ws.soap.security.callback.CleanupCallback;
import org.springframework.ws.soap.security.support.SpringSecurityUtils;
/**
* Callback handler that validates a plain text or digest password using an Spring Security {@code UserDetailsService}.
* Callback handler that validates a plain text or digest password using an Spring
* Security {@code UserDetailsService}.
* <p>
* An Spring Security {@link UserDetailsService} is used to load {@link UserDetails} from. The digest of the password
* contained in this details object is then compared with the digest in the message.
* An Spring Security {@link UserDetailsService} is used to load {@link UserDetails} from.
* The digest of the password contained in this details object is then compared with the
* digest in the message.
*
* @author Arjen Poutsma
* @author Jamin Hitchcock
@@ -70,7 +73,8 @@ public class SpringSecurityPasswordValidationCallbackHandler extends AbstractWsP
/**
* Invoked when the callback has a {@link WSPasswordCallback#USERNAME_TOKEN} usage.
* <p>
* This method is invoked when WSS4J needs the password to fill in or to verify a UsernameToken.
* This method is invoked when WSS4J needs the password to fill in or to verify a
* UsernameToken.
* <p>
* Default implementation throws an {@link UnsupportedCallbackException}.
*/
@@ -107,7 +111,8 @@ public class SpringSecurityPasswordValidationCallbackHandler extends AbstractWsP
if (user == null) {
try {
user = userDetailsService.loadUserByUsername(username);
} catch (UsernameNotFoundException notFound) {
}
catch (UsernameNotFoundException notFound) {
if (logger.isDebugEnabled()) {
logger.debug("Username '" + username + "' not found");
}
@@ -117,4 +122,5 @@ public class SpringSecurityPasswordValidationCallbackHandler extends AbstractWsP
}
return user;
}
}

10
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/callback/UsernameTokenPrincipalCallback.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,8 +23,9 @@ import javax.security.auth.callback.Callback;
import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
/**
* Underlying security services instantiate and pass a {@code UsernameTokenPrincipalCallback} to the {@code handle}
* method of a {@code CallbackHandler} to pass a security {@code WSUsernameTokenPrincipal}.
* Underlying security services instantiate and pass a
* {@code UsernameTokenPrincipalCallback} to the {@code handle} method of a
* {@code CallbackHandler} to pass a security {@code WSUsernameTokenPrincipal}.
*
* @author Arjen Poutsma
* @author Jamin Hitchcock
@@ -46,4 +47,5 @@ public class UsernameTokenPrincipalCallback implements Callback, Serializable {
public WSUsernameTokenPrincipalImpl getPrincipal() {
return principal;
}
}

73
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/support/CryptoFactoryBean.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -22,6 +22,7 @@ import java.util.Properties;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.crypto.Merlin;
import org.springframework.beans.factory.FactoryBean;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.core.io.ClassPathResource;
@@ -29,11 +30,11 @@ import org.springframework.core.io.Resource;
import org.springframework.util.Assert;
/**
* Spring factory bean for a WSS4J {@link Crypto}. Allows for strong-typed property configuration, or configuration
* through {@link Properties}.
* Spring factory bean for a WSS4J {@link Crypto}. Allows for strong-typed property
* configuration, or configuration through {@link Properties}.
* <p>
* Requires either individual properties, or the {@link #setConfiguration(java.util.Properties) configuration} property
* to be set.
* Requires either individual properties, or the
* {@link #setConfiguration(java.util.Properties) configuration} property to be set.
*
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
@@ -50,9 +51,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
private static final String CRYPTO_PROVIDER_PROPERTY = "org.apache.wss4j.crypto.provider";
/**
* Sets the configuration of the Crypto. Setting this property overrides all previously set configuration, through the
* type-safe properties
*
* Sets the configuration of the Crypto. Setting this property overrides all
* previously set configuration, through the type-safe properties
* @see org.apache.ws.security.components.crypto.CryptoFactory#getInstance(java.util.Properties)
*/
public void setConfiguration(Properties properties) {
@@ -61,11 +61,11 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the {@link org.apache.ws.security.components.crypto.Crypto} provider name. Defaults to
* {@link org.apache.ws.security.components.crypto.Merlin}.
* Sets the {@link org.apache.ws.security.components.crypto.Crypto} provider name.
* Defaults to {@link org.apache.ws.security.components.crypto.Merlin}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.provider} property.
*
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.provider}
* property.
* @param cryptoProviderClass the crypto provider class
*/
public void setCryptoProvider(Class<? extends Crypto> cryptoProviderClass) {
@@ -73,11 +73,11 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the location of the key store to be loaded in the {@link org.apache.ws.security.components.crypto.Crypto}
* instance.
* Sets the location of the key store to be loaded in the
* {@link org.apache.ws.security.components.crypto.Crypto} instance.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.file} property.
*
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.file}
* property.
* @param location the key store location
* @throws java.io.IOException when the resource cannot be opened
*/
@@ -89,11 +89,13 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
private String getResourcePath(Resource resource) throws IOException {
try {
return resource.getFile().getAbsolutePath();
} catch (IOException ex) {
}
catch (IOException ex) {
if (resource instanceof ClassPathResource) {
ClassPathResource classPathResource = (ClassPathResource) resource;
return classPathResource.getPath();
} else {
}
else {
throw ex;
}
}
@@ -102,8 +104,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the key store provider.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.provider} property.
*
* This property maps to the WSS4J
* {@code org.apache.ws.security.crypto.merlin.keystore.provider} property.
* @param provider the key store provider
*/
public void setKeyStoreProvider(String provider) {
@@ -113,8 +115,8 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the key store password. Defaults to {@code security}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.password} property.
*
* This property maps to the WSS4J
* {@code org.apache.ws.security.crypto.merlin.keystore.password} property.
* @param password the key store password
*/
public void setKeyStorePassword(String password) {
@@ -122,10 +124,11 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the key store type. Defaults to {@link java.security.KeyStore#getDefaultType()}.
* Sets the key store type. Defaults to
* {@link java.security.KeyStore#getDefaultType()}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.type} property.
*
* This property maps to the WSS4J
* {@code org.apache.ws.security.crypto.merlin.keystore.type} property.
* @param type the key store type
*/
public void setKeyStoreType(String type) {
@@ -135,10 +138,11 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
/**
* Sets the trust store password. Defaults to {@code changeit}.
* <p>
* WSS4J crypto uses the standard J2SE trust store, i.e. {@code $JAVA_HOME/lib/security/cacerts}.
* WSS4J crypto uses the standard J2SE trust store, i.e.
* {@code $JAVA_HOME/lib/security/cacerts}.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.cacerts.password} property.
*
* This property maps to the WSS4J
* {@code org.apache.ws.security.crypto.merlin.cacerts.password} property.
* @param password the trust store password
*/
public void setTrustStorePassword(String password) {
@@ -146,12 +150,13 @@ public class CryptoFactoryBean implements FactoryBean<Crypto>, InitializingBean
}
/**
* Sets the alias name of the default certificate which has been specified as a property. This should be the
* certificate that is used for signature and encryption. This alias corresponds to the certificate that should be
* used whenever KeyInfo is not present in a signed or an encrypted message.
* Sets the alias name of the default certificate which has been specified as a
* property. This should be the certificate that is used for signature and encryption.
* This alias corresponds to the certificate that should be used whenever KeyInfo is
* not present in a signed or an encrypted message.
* <p>
* This property maps to the WSS4J {@code org.apache.ws.security.crypto.merlin.keystore.alias} property.
*
* This property maps to the WSS4J
* {@code org.apache.ws.security.crypto.merlin.keystore.alias} property.
* @param defaultX509Alias alias name of the default X509 certificate
*/
public void setDefaultX509Alias(String defaultX509Alias) {

39
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/X509AuthenticationProvider.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -20,6 +20,7 @@ import java.security.cert.X509Certificate;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.context.MessageSource;
import org.springframework.context.MessageSourceAware;
@@ -44,17 +45,23 @@ import org.springframework.ws.soap.security.x509.cache.X509UserCache;
* @version $Id: X509AuthenticationProvider.java 3256 2008-08-18 18:20:48Z luke_t $
*/
public class X509AuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
// ~ Static fields/initializers =====================================================================================
// ~ Static fields/initializers
// =====================================================================================
private static final Log logger = LogFactory.getLog(X509AuthenticationProvider.class);
// ~ Instance fields ================================================================================================
// ~ Instance fields
// ================================================================================================
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
private X509AuthoritiesPopulator x509AuthoritiesPopulator;
private X509UserCache userCache = new NullX509UserCache();
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
@Override
public void afterPropertiesSet() throws Exception {
@@ -64,18 +71,21 @@ public class X509AuthenticationProvider implements AuthenticationProvider, Initi
}
/**
* If the supplied authentication token contains a certificate then this will be passed to the configured
* {@link X509AuthoritiesPopulator} to obtain the user details and authorities for the user identified by the
* certificate.
* If the supplied authentication token contains a certificate then this will be
* passed to the configured {@link X509AuthoritiesPopulator} to obtain the user
* details and authorities for the user identified by the certificate.
* <p>
* If no certificate is present (for example, if the filter is applied to an HttpRequest for which client
* authentication hasn't been configured in the container) then a BadCredentialsException will be raised.
* If no certificate is present (for example, if the filter is applied to an
* HttpRequest for which client authentication hasn't been configured in the
* container) then a BadCredentialsException will be raised.
* </p>
*
* @param authentication the authentication request.
* @return an X509AuthenticationToken containing the authorities of the principal represented by the certificate.
* @throws AuthenticationException if the {@link X509AuthoritiesPopulator} rejects the certficate.
* @throws BadCredentialsException if no certificate was presented in the authentication request.
* @return an X509AuthenticationToken containing the authorities of the principal
* represented by the certificate.
* @throws AuthenticationException if the {@link X509AuthoritiesPopulator} rejects the
* certficate.
* @throws BadCredentialsException if no certificate was presented in the
* authentication request.
*/
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
@@ -128,4 +138,5 @@ public class X509AuthenticationProvider implements AuthenticationProvider, Initi
public boolean supports(Class<?> authentication) {
return X509AuthenticationToken.class.isAssignableFrom(authentication);
}
}

27
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/X509AuthenticationToken.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,18 +31,23 @@ import org.springframework.security.core.GrantedAuthority;
* @author Luke Taylor
*/
public class X509AuthenticationToken extends AbstractAuthenticationToken {
// ~ Instance fields ================================================================================================
// ~ Instance fields
// ================================================================================================
private static final long serialVersionUID = 1L;
private Object principal;
private X509Certificate credentials;
// ~ Constructors ===================================================================================================
// ~ Constructors
// ===================================================================================================
/**
* Used for an authentication request. The {@link org.springframework.security.core.Authentication#isAuthenticated()}
* will return {@code false}.
*
* Used for an authentication request. The
* {@link org.springframework.security.core.Authentication#isAuthenticated()} will
* return {@code false}.
* @param credentials the certificate
*/
public X509AuthenticationToken(X509Certificate credentials) {
@@ -52,8 +57,8 @@ public class X509AuthenticationToken extends AbstractAuthenticationToken {
/**
* Used for an authentication response object. The
* {@link org.springframework.security.core.Authentication#isAuthenticated()} will return {@code true}.
*
* {@link org.springframework.security.core.Authentication#isAuthenticated()} will
* return {@code true}.
* @param principal the principal, which is generally a {@code UserDetails}
* @param credentials the certificate
* @param authorities the authorities
@@ -66,7 +71,8 @@ public class X509AuthenticationToken extends AbstractAuthenticationToken {
setAuthenticated(true);
}
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
@Override
public Object getCredentials() {
@@ -77,4 +83,5 @@ public class X509AuthenticationToken extends AbstractAuthenticationToken {
public Object getPrincipal() {
return principal;
}
}

31
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/X509AuthoritiesPopulator.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -22,11 +22,14 @@ import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;
/**
* Populates the {@code UserDetails} associated with the X.509 certificate presented by a client.
* Populates the {@code UserDetails} associated with the X.509 certificate presented by a
* client.
* <p>
* Although the certificate will already have been validated by the web container, implementations may choose to perform
* additional application-specific checks on the certificate content here. If an implementation chooses to reject the
* certificate, it should throw a {@link org.springframework.security.authentication.BadCredentialsException}.
* Although the certificate will already have been validated by the web container,
* implementations may choose to perform additional application-specific checks on the
* certificate content here. If an implementation chooses to reject the certificate, it
* should throw a
* {@link org.springframework.security.authentication.BadCredentialsException}.
* </p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
@@ -35,18 +38,22 @@ import org.springframework.security.core.userdetails.UserDetails;
* @author Luke Taylor
*/
public interface X509AuthoritiesPopulator {
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
/**
* Obtains the granted authorities for the specified user.
* <p>
* May throw any {@code AuthenticationException} or return {@code null} if the authorities are unavailable.
* May throw any {@code AuthenticationException} or return {@code null} if the
* authorities are unavailable.
* </p>
*
* @param userCertificate the X.509 certificate supplied
* @return the details of the indicated user (at minimum the granted authorities and the username)
* @throws AuthenticationException if the user details are not available or the certificate isn't valid for the
* application's purpose.
* @return the details of the indicated user (at minimum the granted authorities and
* the username)
* @throws AuthenticationException if the user details are not available or the
* certificate isn't valid for the application's purpose.
*/
UserDetails getUserDetails(X509Certificate userCertificate) throws AuthenticationException;
}

34
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/EhCacheBasedX509UserCache.java vendored
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,21 +16,22 @@
package org.springframework.ws.soap.security.x509.cache;
import java.security.cert.X509Certificate;
import net.sf.ehcache.CacheException;
import net.sf.ehcache.Ehcache;
import net.sf.ehcache.Element;
import java.security.cert.X509Certificate;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.dao.DataRetrievalFailureException;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.Assert;
/**
* Caches {@code User} objects using a Spring IoC defined <a href="http://ehcache.sourceforge.net">EHCACHE</a>.
* Caches {@code User} objects using a Spring IoC defined
* <a href="http://ehcache.sourceforge.net">EHCACHE</a>.
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
@@ -38,20 +39,24 @@ import org.springframework.util.Assert;
* @author Luke Taylor
* @author Ben Alex
* @author Greg Turnquist
* @deprecated Migrate to {@link SpringBasedX509UserCache} and inject a platform neutral Spring-based
* {@link org.springframework.cache.Cache}.
* @deprecated Migrate to {@link SpringBasedX509UserCache} and inject a platform neutral
* Spring-based {@link org.springframework.cache.Cache}.
*/
@Deprecated
public class EhCacheBasedX509UserCache implements X509UserCache, InitializingBean {
// ~ Static fields/initializers =====================================================================================
// ~ Static fields/initializers
// =====================================================================================
private static final Log logger = LogFactory.getLog(EhCacheBasedX509UserCache.class);
// ~ Instance fields ================================================================================================
// ~ Instance fields
// ================================================================================================
private Ehcache cache;
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
@Override
public void afterPropertiesSet() throws Exception {
@@ -64,7 +69,8 @@ public class EhCacheBasedX509UserCache implements X509UserCache, InitializingBea
try {
element = cache.get(userCert);
} catch (CacheException cacheException) {
}
catch (CacheException cacheException) {
throw new DataRetrievalFailureException("Cache failure: " + cacheException.getMessage());
}
@@ -80,7 +86,8 @@ public class EhCacheBasedX509UserCache implements X509UserCache, InitializingBea
if (element == null) {
return null;
} else {
}
else {
return (UserDetails) element.getObjectValue();
}
}
@@ -108,4 +115,5 @@ public class EhCacheBasedX509UserCache implements X509UserCache, InitializingBea
public void setCache(Ehcache cache) {
this.cache = cache;
}
}

15
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/NullX509UserCache.java vendored
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -29,7 +29,9 @@ import org.springframework.security.core.userdetails.UserDetails;
* @author Luke Taylor
*/
public class NullX509UserCache implements X509UserCache {
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
@Override
public UserDetails getUserFromCache(X509Certificate certificate) {
@@ -37,8 +39,11 @@ public class NullX509UserCache implements X509UserCache {
}
@Override
public void putUserInCache(X509Certificate certificate, UserDetails user) {}
public void putUserInCache(X509Certificate certificate, UserDetails user) {
}
@Override
public void removeUserFromCache(X509Certificate certificate) {}
public void removeUserFromCache(X509Certificate certificate) {
}
}

6
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/SpringBasedX509UserCache.java vendored
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -20,6 +20,7 @@ import java.security.cert.X509Certificate;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.cache.Cache;
import org.springframework.security.core.userdetails.UserDetails;
@@ -86,4 +87,5 @@ public class SpringBasedX509UserCache implements X509UserCache, InitializingBean
public void setCache(Cache cache) {
this.cache = cache;
}
}

14
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/cache/X509UserCache.java vendored
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -24,8 +24,9 @@ import org.springframework.security.core.userdetails.UserDetails;
* Provides a cache of {@link UserDetails} objects for the
* {@link org.springframework.ws.soap.security.x509.X509AuthenticationProvider}.
* <p>
* Similar in function to the {@link org.springframework.security.core.userdetails.UserCache} used by the Dao provider,
* but the cache is keyed with the user's certificate rather than the user name.
* Similar in function to the
* {@link org.springframework.security.core.userdetails.UserCache} used by the Dao
* provider, but the cache is keyed with the user's certificate rather than the user name.
* </p>
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
@@ -34,11 +35,14 @@ import org.springframework.security.core.userdetails.UserDetails;
* @author Luke Taylor
*/
public interface X509UserCache {
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
UserDetails getUserFromCache(X509Certificate userCertificate);
void putUserInCache(X509Certificate key, UserDetails user);
void removeUserFromCache(X509Certificate key);
}

30
spring-ws-security/src/main/java/org/springframework/ws/soap/security/x509/populator/DaoX509AuthoritiesPopulator.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -34,7 +34,8 @@ import org.springframework.util.Assert;
import org.springframework.ws.soap.security.x509.X509AuthoritiesPopulator;
/**
* Populates the X509 authorities via an {@link org.springframework.security.core.userdetails.UserDetailsService}.
* Populates the X509 authorities via an
* {@link org.springframework.security.core.userdetails.UserDetailsService}.
* <p>
* Migrated from Spring Security 2 since it has been removed in Spring Security 3.
* </p>
@@ -44,14 +45,19 @@ import org.springframework.ws.soap.security.x509.X509AuthoritiesPopulator;
*/
public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, InitializingBean, MessageSourceAware {
// ~ Instance fields ================================================================================================
// ~ Instance fields
// ================================================================================================
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
private Pattern subjectDNPattern;
private String subjectDNRegex = "CN=(.*?),";
private UserDetailsService userDetailsService;
// ~ Methods ========================================================================================================
// ~ Methods
// ========================================================================================================
@Override
public void afterPropertiesSet() throws Exception {
@@ -94,16 +100,17 @@ public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, In
}
/**
* Sets the regular expression which will by used to extract the user name from the certificate's Subject DN.
* Sets the regular expression which will by used to extract the user name from the
* certificate's Subject DN.
* <p>
* It should contain a single group; for example the default expression "CN=(.?)," matches the common name field. So
* "CN=Jimi Hendrix, OU=..." will give a user name of "Jimi Hendrix".
* It should contain a single group; for example the default expression "CN=(.?),"
* matches the common name field. So "CN=Jimi Hendrix, OU=..." will give a user name
* of "Jimi Hendrix".
* </p>
* <p>
* The matches are case insensitive. So "emailAddress=(.?)," will match "EMAILADDRESS=jimi@hendrix.org, CN=..." giving
* a user name "jimi@hendrix.org"
* The matches are case insensitive. So "emailAddress=(.?)," will match
* "EMAILADDRESS=jimi@hendrix.org, CN=..." giving a user name "jimi@hendrix.org"
* </p>
*
* @param subjectDNRegex the regular expression to find in the subject
*/
public void setSubjectDNRegex(String subjectDNRegex) {
@@ -113,4 +120,5 @@ public class DaoX509AuthoritiesPopulator implements X509AuthoritiesPopulator, In
public void setUserDetailsService(UserDetailsService userDetailsService) {
this.userDetailsService = userDetailsService;
}
}

38
spring-ws-security/src/test/java/org/springframework/ws/soap/security/SkipValidationWsSecurityInterceptorTest.java
View File

@@ -1,16 +1,30 @@
/*
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.ws.soap.security;
import static org.assertj.core.api.Assertions.*;
import jakarta.xml.soap.MessageFactory;
import jakarta.xml.soap.MimeHeaders;
import jakarta.xml.soap.SOAPException;
import java.io.IOException;
import java.io.InputStream;
import jakarta.xml.soap.MessageFactory;
import jakarta.xml.soap.MimeHeaders;
import jakarta.xml.soap.SOAPException;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.ws.context.DefaultMessageContext;
@@ -19,10 +33,15 @@ import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;
public class SkipValidationWsSecurityInterceptorTest {
private MessageFactory messageFactory;
private AbstractWsSecurityInterceptor interceptor;
private SaajSoapMessageFactory soapMessageFactory;
@BeforeEach
@@ -40,10 +59,12 @@ public class SkipValidationWsSecurityInterceptorTest {
@Override
protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)
throws WsSecuritySecurementException {}
throws WsSecuritySecurementException {
}
@Override
protected void cleanUp() {}
protected void cleanUp() {
}
};
interceptor.setSkipValidationIfNoHeaderPresent(true);
}
@@ -83,4 +104,5 @@ public class SkipValidationWsSecurityInterceptorTest {
return new SaajSoapMessage(messageFactory.createMessage(mimeHeaders, is));
}
}
}

15
spring-ws-security/src/test/java/org/springframework/ws/soap/security/callback/CallbackHandlerChainTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,23 +16,25 @@
package org.springframework.ws.soap.security.callback;
import static org.assertj.core.api.Assertions.*;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.junit.jupiter.api.Test;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
public class CallbackHandlerChainTest {
private CallbackHandler supported = callbacks -> {};
private CallbackHandler supported = callbacks -> {
};
private CallbackHandler unsupported = callbacks -> {
throw new UnsupportedCallbackException(callbacks[0]);
};
private Callback callback = new Callback() {};
private Callback callback = new Callback() {
};
@Test
public void testSupported() throws Exception {
@@ -57,4 +59,5 @@ public class CallbackHandlerChainTest {
chain.handle(new Callback[] { callback });
});
}
}

9
spring-ws-security/src/test/java/org/springframework/ws/soap/security/support/KeyManagersFactoryBeanTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,12 +16,12 @@
package org.springframework.ws.soap.security.support;
import static org.assertj.core.api.Assertions.*;
import javax.net.ssl.KeyManager;
import org.junit.jupiter.api.Test;
import static org.assertj.core.api.Assertions.assertThat;
public class KeyManagersFactoryBeanTest {
@Test
@@ -46,4 +46,5 @@ public class KeyManagersFactoryBeanTest {
assertThat(keyManagers).isNotNull();
assertThat(keyManagers).hasSize(1);
}
}

9
spring-ws-security/src/test/java/org/springframework/ws/soap/security/support/TrustManagersFactoryBeanTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,12 +16,12 @@
package org.springframework.ws.soap.security.support;
import static org.assertj.core.api.Assertions.*;
import javax.net.ssl.TrustManager;
import org.junit.jupiter.api.Test;
import static org.assertj.core.api.Assertions.assertThat;
public class TrustManagersFactoryBeanTest {
@Test
@@ -46,4 +46,5 @@ public class TrustManagersFactoryBeanTest {
assertThat(trustManagers).isNotNull();
assertThat(trustManagers).hasSize(1);
}
}

27
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jMessageInterceptorSignTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,13 +16,6 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import jakarta.xml.soap.MimeHeaders;
import jakarta.xml.soap.SOAPHeader;
import jakarta.xml.soap.SOAPHeaderElement;
import jakarta.xml.soap.SOAPMessage;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.util.Iterator;
@@ -31,7 +24,12 @@ import javax.xml.namespace.QName;
import javax.xml.transform.Transformer;
import javax.xml.transform.dom.DOMResult;
import jakarta.xml.soap.MimeHeaders;
import jakarta.xml.soap.SOAPHeader;
import jakarta.xml.soap.SOAPHeaderElement;
import jakarta.xml.soap.SOAPMessage;
import org.junit.jupiter.api.Test;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
@@ -40,6 +38,8 @@ import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.xml.transform.StringSource;
import org.springframework.xml.transform.TransformerFactoryUtils;
import static org.assertj.core.api.Assertions.assertThat;
public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptorSignTestCase {
private static final String PAYLOAD = "<tru:StockSymbol xmlns:tru=\"http://fabrikam123.com/payloads\">QQQ</tru:StockSymbol>";
@@ -61,8 +61,8 @@ public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptor
interceptor.secureMessage(message, messageContext);
SOAPHeader header = ((SaajSoapMessage) message).getSaajMessage().getSOAPHeader();
Iterator<?> iterator = header.getChildElements(
new QName("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security"));
Iterator<?> iterator = header.getChildElements(new QName(
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security"));
assertThat(iterator.hasNext()).isTrue();
@@ -103,8 +103,8 @@ public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptor
interceptor.secureMessage(message, messageContext);
SOAPHeader header = ((SaajSoapMessage) message).getSaajMessage().getSOAPHeader();
Iterator<?> iterator = header.getChildElements(
new QName("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security"));
Iterator<?> iterator = header.getChildElements(new QName(
"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "Security"));
assertThat(iterator.hasNext()).isTrue();
@@ -126,4 +126,5 @@ public class SaajWss4jMessageInterceptorSignTest extends Wss4jMessageInterceptor
interceptor.validateMessage(message, messageContext);
}
}

8
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jMessageInterceptorX509Test.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,7 +16,9 @@
package org.springframework.ws.soap.security.wss4j2;
/** @author tareq */
/**
* @author tareq
*/
public class SaajWss4jMessageInterceptorX509Test extends Wss4jMessageInterceptorX509TestCase {
}

19
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/SaajWss4jSecurityInterceptorDefaultsTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,19 +16,15 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.test.util.AssertionErrors.assertEquals;
import jakarta.xml.soap.SOAPException;
import jakarta.xml.soap.SOAPMessage;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
import javax.xml.transform.dom.DOMResult;
import jakarta.xml.soap.SOAPException;
import jakarta.xml.soap.SOAPMessage;
import org.apache.wss4j.dom.handler.RequestData;
import org.junit.jupiter.api.Test;
import org.springframework.test.util.ReflectionTestUtils;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
@@ -38,6 +34,10 @@ import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.xml.transform.StringSource;
import org.springframework.xml.transform.TransformerFactoryUtils;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.springframework.test.util.AssertionErrors.assertEquals;
public class SaajWss4jSecurityInterceptorDefaultsTest extends Wss4jTestCase {
private static final String PAYLOAD = "<tru:StockSymbol xmlns:tru=\"http://fabrikam123.com/payloads\">QQQ</tru:StockSymbol>";
@@ -92,4 +92,5 @@ public class SaajWss4jSecurityInterceptorDefaultsTest extends Wss4jTestCase {
assertFalse(validationData.isAddInclusivePrefixes());
}
}

11
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jInterceptorTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,10 +16,9 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import org.apache.wss4j.dom.engine.WSSecurityEngine;
import org.junit.jupiter.api.Test;
import org.springframework.test.util.ReflectionTestUtils;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
@@ -27,6 +26,9 @@ import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.WsSecuritySecurementException;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;
public abstract class Wss4jInterceptorTestCase extends Wss4jTestCase {
@Test
@@ -98,4 +100,5 @@ public abstract class Wss4jInterceptorTestCase extends Wss4jTestCase {
assertThat(ReflectionTestUtils.getField(interceptor, "securityEngine")).isEqualTo(engine);
}
}

8
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorEncryptionTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -19,12 +19,13 @@ package org.springframework.ws.soap.security.wss4j2;
import java.util.Properties;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.KeyStoreCallbackHandler;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorEncryptionTestCase extends Wss4jTestCase {
@@ -85,4 +86,5 @@ public abstract class Wss4jMessageInterceptorEncryptionTestCase extends Wss4jTes
assertXpathExists("Encryption error", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/xenc:EncryptedKey",
document);
}
}

23
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorHeaderTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,8 +16,6 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import java.io.ByteArrayOutputStream;
import java.nio.charset.StandardCharsets;
import java.util.Iterator;
@@ -26,6 +24,7 @@ import java.util.Properties;
import javax.xml.namespace.QName;
import org.junit.jupiter.api.Test;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapHeaderElement;
@@ -33,6 +32,10 @@ import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.springframework.ws.soap.security.wss4j2.callback.SimplePasswordValidationCallbackHandler;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.assertj.core.api.Assertions.fail;
/**
* @author Arjen Poutsma
* @author Tareq Abedrabbo
@@ -41,6 +44,7 @@ import org.springframework.ws.soap.security.wss4j2.callback.SimplePasswordValida
public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCase {
private Wss4jSecurityInterceptor interceptor;
private Wss4jSecurityInterceptor interceptorThatKeepsSecurityHeader;
@Override
@@ -76,12 +80,13 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
assertThat(result).isNotNull();
for (Iterator<SoapHeaderElement> i = message.getEnvelope().getHeader().examineAllHeaderElements(); i.hasNext();) {
for (Iterator<SoapHeaderElement> i = message.getEnvelope().getHeader().examineAllHeaderElements(); i
.hasNext();) {
SoapHeaderElement element = i.next();
QName name = element.getName();
if (name.getNamespaceURI()
.equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) {
.equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) {
fail("Security Header not removed");
}
}
@@ -103,12 +108,13 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
assertThat(result).isNotNull();
boolean foundSecurityHeader = false;
for (Iterator<SoapHeaderElement> i = message.getEnvelope().getHeader().examineAllHeaderElements(); i.hasNext();) {
for (Iterator<SoapHeaderElement> i = message.getEnvelope().getHeader().examineAllHeaderElements(); i
.hasNext();) {
SoapHeaderElement element = i.next();
QName name = element.getName();
if (name.getNamespaceURI()
.equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) {
.equals("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")) {
foundSecurityHeader = true;
}
@@ -170,4 +176,5 @@ public abstract class Wss4jMessageInterceptorHeaderTestCase extends Wss4jTestCas
assertXpathEvaluatesTo("Header 2 does not exist", "test2", "/SOAP-ENV:Envelope/SOAP-ENV:Header/test:header2",
document);
}
}

21
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSamlTestCase.java
View File

@@ -1,3 +1,19 @@
/*
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.ws.soap.security.wss4j2;
import java.security.cert.X509Certificate;
@@ -14,11 +30,12 @@ import org.apache.wss4j.common.saml.bean.SubjectBean;
import org.apache.wss4j.common.saml.bean.Version;
import org.apache.wss4j.common.saml.builder.SAML2Constants;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorSamlTestCase extends Wss4jTestCase {
@@ -103,5 +120,7 @@ public abstract class Wss4jMessageInterceptorSamlTestCase extends Wss4jTestCase
}
}
}
}
}

12
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSignTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,17 +16,18 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import java.util.Properties;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.ws.WebServiceMessage;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
import static org.assertj.core.api.Assertions.assertThat;
public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase {
@@ -121,4 +122,5 @@ public abstract class Wss4jMessageInterceptorSignTestCase extends Wss4jTestCase
assertXpathExists("Absent SignatureConfirmation element",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/ds:Signature", document);
}
}

10
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSoapActionTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,18 +16,19 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import java.util.Properties;
import org.apache.wss4j.dom.WSConstants;
import org.junit.jupiter.api.Test;
import org.springframework.ws.WebServiceMessageFactory;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.SimplePasswordValidationCallbackHandler;
import static org.assertj.core.api.Assertions.assertThat;
public abstract class Wss4jMessageInterceptorSoapActionTestCase extends Wss4jTestCase {
private static final String SOAP_ACTION = "\"http://test\"";
@@ -101,4 +102,5 @@ public abstract class Wss4jMessageInterceptorSoapActionTestCase extends Wss4jTes
assertThat(message.getSoapAction()).isNotNull();
assertThat(message.getSoapAction()).isEqualTo(SOAP_ACTION);
}
}

20
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,14 +16,12 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import static org.easymock.EasyMock.*;
import java.util.Properties;
import org.apache.wss4j.dom.WSConstants;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.Test;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -33,6 +31,11 @@ import org.springframework.ws.server.EndpointInterceptor;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.SpringSecurityPasswordValidationCallbackHandler;
import static org.assertj.core.api.Assertions.assertThat;
import static org.easymock.EasyMock.createMock;
import static org.easymock.EasyMock.replay;
import static org.easymock.EasyMock.verify;
public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCase extends Wss4jTestCase {
private Properties users = new Properties();
@@ -112,7 +115,8 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
if (validating) {
interceptor.setValidationActions(actions);
} else {
}
else {
interceptor.setSecurementActions(actions);
}
@@ -122,7 +126,8 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
if (digest) {
interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
} else {
}
else {
interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
}
@@ -132,4 +137,5 @@ public abstract class Wss4jMessageInterceptorSpringSecurityCallbackHandlerTestCa
return interceptor;
}
}

17
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorTimestampTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,17 +16,19 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.WsSecurityValidationException;
import org.w3c.dom.Document;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTestCase {
@@ -41,8 +43,8 @@ public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTest
interceptor.secureMessage(message, context);
Document document = getDocument(message);
assertXpathExists("timestamp header not found", "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp",
document);
assertXpathExists("timestamp header not found",
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsu:Timestamp", document);
}
@Test
@@ -128,4 +130,5 @@ public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTest
return message;
}
}

8
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenSignatureTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -17,9 +17,10 @@
package org.springframework.ws.soap.security.wss4j2;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorUsernameTokenSignatureTestCase extends Wss4jTestCase {
@@ -43,4 +44,5 @@ public abstract class Wss4jMessageInterceptorUsernameTokenSignatureTestCase exte
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest']/text()",
doc);
}
}

23
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,17 +16,18 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import java.util.Properties;
import org.apache.wss4j.dom.WSConstants;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.callback.SimplePasswordValidationCallbackHandler;
import org.w3c.dom.Document;
import static org.assertj.core.api.Assertions.assertThat;
public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4jTestCase {
@@ -104,7 +105,7 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
interceptor.secureMessage(message, messageContext);
assertAddUsernameTokenPlainText(message, "Bibo","Elmo");
assertAddUsernameTokenPlainText(message, "Bibo", "Elmo");
}
@Test
@@ -130,7 +131,8 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
getDocument(message));
}
protected void assertAddUsernameTokenPlainText(SoapMessage message, String expectedUsername, String expectedPassword) {
protected void assertAddUsernameTokenPlainText(SoapMessage message, String expectedUsername,
String expectedPassword) {
Object result = getMessage(message);
@@ -164,14 +166,16 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
if (validating) {
interceptor.setValidationActions(actions);
} else {
}
else {
interceptor.setSecurementActions(actions);
}
SimplePasswordValidationCallbackHandler callbackHandler = new SimplePasswordValidationCallbackHandler();
callbackHandler.setUsers(users);
if (digest) {
interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
} else {
}
else {
interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
}
interceptor.setValidationCallbackHandler(callbackHandler);
@@ -181,4 +185,5 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
interceptor.afterPropertiesSet();
return interceptor;
}
}

8
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorX509TestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -18,11 +18,12 @@ package org.springframework.ws.soap.security.wss4j2;
import org.apache.wss4j.common.crypto.Merlin;
import org.junit.jupiter.api.Test;
import org.w3c.dom.Document;
import org.springframework.core.io.ClassPathResource;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j2.support.CryptoFactoryBean;
import org.w3c.dom.Document;
public abstract class Wss4jMessageInterceptorX509TestCase extends Wss4jTestCase {
@@ -65,4 +66,5 @@ public abstract class Wss4jMessageInterceptorX509TestCase extends Wss4jTestCase
// lets verify the signature that we've just generated
interceptor.validateMessage(message, messageContext);
}
}

38
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jTestCase.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,20 +16,20 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.assertj.core.api.Assertions.*;
import jakarta.xml.soap.MessageFactory;
import jakarta.xml.soap.MimeHeaders;
import jakarta.xml.soap.SOAPConstants;
import jakarta.xml.soap.SOAPMessage;
import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
import javax.xml.transform.dom.DOMSource;
import jakarta.xml.soap.MessageFactory;
import jakarta.xml.soap.MimeHeaders;
import jakarta.xml.soap.SOAPConstants;
import jakarta.xml.soap.SOAPMessage;
import org.junit.jupiter.api.BeforeEach;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.ws.WebServiceMessage;
@@ -42,8 +42,8 @@ import org.springframework.ws.soap.saaj.SaajSoapMessage;
import org.springframework.ws.soap.saaj.SaajSoapMessageFactory;
import org.springframework.xml.transform.StringSource;
import org.springframework.xml.xpath.Jaxp13XPathTemplate;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import static org.assertj.core.api.Assertions.assertThat;
public abstract class Wss4jTestCase {
@@ -89,7 +89,8 @@ public abstract class Wss4jTestCase {
assertThat(actualValue).isEqualTo(expectedValue);
}
protected void assertXpathEvaluatesTo(String message, String expectedValue, String xpathExpression, String document) {
protected void assertXpathEvaluatesTo(String message, String expectedValue, String xpathExpression,
String document) {
String actualValue = xpathTemplate.evaluateAsString(xpathExpression, new StringSource(document));
@@ -125,7 +126,8 @@ public abstract class Wss4jTestCase {
assertThat(resource.exists()).isTrue();
try (InputStream is = resource.getInputStream()) {
return new SaajSoapMessage(saajSoap11MessageFactory.createMessage(mimeHeaders, is), saajSoap11MessageFactory);
return new SaajSoapMessage(saajSoap11MessageFactory.createMessage(mimeHeaders, is),
saajSoap11MessageFactory);
}
}
@@ -138,7 +140,8 @@ public abstract class Wss4jTestCase {
assertThat(resource.exists()).isTrue();
try (InputStream is = resource.getInputStream()) {
return new SaajSoapMessage(saajSoap12MessageFactory.createMessage(mimeHeaders, is), saajSoap12MessageFactory);
return new SaajSoapMessage(saajSoap12MessageFactory.createMessage(mimeHeaders, is),
saajSoap12MessageFactory);
}
}
@@ -161,7 +164,8 @@ public abstract class Wss4jTestCase {
throw new IllegalArgumentException("Illegal message: " + message);
}
protected void onSetup() throws Exception {}
protected void onSetup() throws Exception {
}
protected SoapMessage loadSoap11Message(String fileName) throws Exception {
@@ -195,7 +199,8 @@ public abstract class Wss4jTestCase {
SoapMessageFactory messageFactory;
if (saajTest) {
messageFactory = new SaajSoapMessageFactory(saajSoap12MessageFactory);
} else
}
else
throw new IllegalArgumentException();
messageFactory.setSoapVersion(SoapVersion.SOAP_12);
return messageFactory;
@@ -230,4 +235,5 @@ public abstract class Wss4jTestCase {
}
};
}
}

24
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/callback/SpringSecurityPasswordValidationCallbackHandlerTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,9 +16,6 @@
package org.springframework.ws.soap.security.wss4j2.callback;
import static org.assertj.core.api.Assertions.*;
import static org.easymock.EasyMock.*;
import java.util.Collection;
import java.util.Collections;
@@ -26,6 +23,7 @@ import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.principal.WSUsernameTokenPrincipalImpl;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -36,7 +34,15 @@ import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
/** @author tareq */
import static org.assertj.core.api.Assertions.assertThat;
import static org.easymock.EasyMock.createMock;
import static org.easymock.EasyMock.expect;
import static org.easymock.EasyMock.replay;
import static org.easymock.EasyMock.verify;
/**
* @author tareq
*/
public class SpringSecurityPasswordValidationCallbackHandlerTest {
private SpringSecurityPasswordValidationCallbackHandler callbackHandler;
@@ -51,7 +57,8 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
@BeforeEach
public void setUp() {
// add clearContext() at the beginning of each method in case {@code SecurityContextHolder} isn't clean
// add clearContext() at the beginning of each method in case {@code
// SecurityContextHolder} isn't clean
SecurityContextHolder.clearContext();
callbackHandler = new SpringSecurityPasswordValidationCallbackHandler();
@@ -89,7 +96,7 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
callbackHandler.setUserDetailsService(userDetailsService);
expect(userDetailsService.loadUserByUsername("Ernie"))
.andThrow(new UsernameNotFoundException("User 'Ernie' not found"));
.andThrow(new UsernameNotFoundException("User 'Ernie' not found"));
replay(userDetailsService);
@@ -129,4 +136,5 @@ public class SpringSecurityPasswordValidationCallbackHandlerTest {
verify(userDetailsService);
}
}

10
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/support/CryptoFactoryBeanTest.java
View File

@@ -1,11 +1,11 @@
/*
* Copyright 2005-2022 the original author or authors.
* Copyright 2005-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
@@ -16,15 +16,16 @@
package org.springframework.ws.soap.security.wss4j2.support;
import static org.assertj.core.api.Assertions.*;
import java.util.Properties;
import org.apache.wss4j.common.crypto.Merlin;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.core.io.ClassPathResource;
import static org.assertj.core.api.Assertions.assertThat;
public class CryptoFactoryBeanTest {
private CryptoFactoryBean factoryBean;
@@ -65,4 +66,5 @@ public class CryptoFactoryBeanTest {
assertThat(result).isNotNull();
assertThat(result).isInstanceOf(Merlin.class);
}
}