Package com.sun.xml.wss.impl.misc

Class DefaultSecurityEnvironmentImpl

    • Field Detail

      • log

        protected static final Logger log
        logger

    • Constructor Detail

      • DefaultSecurityEnvironmentImpl

        public DefaultSecurityEnvironmentImpl​(CallbackHandler cHandler)

      • DefaultSecurityEnvironmentImpl

        public DefaultSecurityEnvironmentImpl​(CallbackHandler cHandler,
                                      Properties confAssertions)

    • Method Detail

      • getSecretKey

        public SecretKey getSecretKey​(Map context,
                              String alias,
                              boolean encryptMode)
                       throws XWSSecurityException
        Specified by:
        getSecretKey in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        alias - the alias for identifying the SecretKey
        encryptMode - whether this request is for an Encrypt or Decrypt operation
        Returns:
        the SecretKey corresponding to the alias
        Throws:
        XWSSecurityException - if there was an error while trying to locate the SecretKey

      • getCertificate

        public X509Certificate getCertificate​(Map context,
                                      String alias,
                                      boolean forSigning)
                               throws XWSSecurityException
        Specified by:
        getCertificate in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        alias - the alias for identifying the certificate
        forSigning - whether this request is for a Sign operation or Encrypt
        Returns:
        the certificate corresponding to the alias
        Throws:
        XWSSecurityException - if there was an error while trying to locate the Cerificate

      • getCertificate

        public X509Certificate getCertificate​(Map context,
                                      PublicKey publicKey,
                                      boolean forSign)
                               throws XWSSecurityException
        Specified by:
        getCertificate in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        publicKey - the publicKey
        forSign - set to true if the public key is to be used for SignatureVerification
        Returns:
        the X509Certificate corresponding to a PublicKey
        Throws:
        XWSSecurityException - if there was an error while trying to locate the PublicKey

      • getPrivateKey

        public PrivateKey getPrivateKey​(Map context,
                                byte[] keyIdentifier)
                         throws XWSSecurityException
        Specified by:
        getPrivateKey in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        keyIdentifier - an Opaque identifier indicating the X509 certificate.
        Returns:
        the PrivateKey corresponding to a KeyIdentifier
        Throws:
        XWSSecurityException - if there was an error while trying to locate the PrivateKey

      • getPrivateKey

        public PrivateKey getPrivateKey​(Map context,
                                BigInteger serialNumber,
                                String issuerName)
                         throws XWSSecurityException
        Specified by:
        getPrivateKey in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        serialNumber - the serialNumber of the certificate
        issuerName - the issuerName of the certificate
        Returns:
        the PrivateKey corresponding to (serialNumber, issuerName)
        Throws:
        XWSSecurityException - if there was an error while trying to locate the PrivateKey

      • getPublicKey

        public PublicKey getPublicKey​(Map context,
                              byte[] keyIdentifier)
                       throws XWSSecurityException
        Specified by:
        getPublicKey in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        keyIdentifier - an Opaque identifier indicating the X509 certificate.
        Returns:
        the PublicKey corresponding to a KeyIdentifier
        Throws:
        XWSSecurityException - if there was an error while trying to locate the PublicKey

      • getCertificate

        public X509Certificate getCertificate​(Map context,
                                      byte[] identifier,
                                      String valueType)
                               throws XWSSecurityException
        Specified by:
        getCertificate in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        identifier - an Opaque identifier indicating the X509 certificate.
        Returns:
        the X509Certificate corresponding to a KeyIdentifier
        Throws:
        XWSSecurityException - if there was an error while trying to locate the X509Certificate

      • getCertificate

        public X509Certificate getCertificate​(Map context,
                                      byte[] keyIdentifier)
                               throws XWSSecurityException
        Specified by:
        getCertificate in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        keyIdentifier - an Opaque identifier indicating the X509 certificate.
        Returns:
        the X509Certificate corresponding to a KeyIdentifier
        Throws:
        XWSSecurityException - if there was an error while trying to locate the X509Certificate

      • getPublicKey

        public PublicKey getPublicKey​(Map context,
                              BigInteger serialNumber,
                              String issuerName)
                       throws XWSSecurityException
        Specified by:
        getPublicKey in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        serialNumber - the serialNumber of the certificate
        issuerName - the issuerName of the certificate
        Returns:
        the PublicKey corresponding to (serialNumber, issuerName)
        Throws:
        XWSSecurityException - if there was an error while trying to locate the PublicKey

      • getCertificate

        public X509Certificate getCertificate​(Map context,
                                      BigInteger serialNumber,
                                      String issuerName)
                               throws XWSSecurityException
        Specified by:
        getCertificate in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        serialNumber - the serialNumber of the certificate
        issuerName - the issuerName of the certificate
        Returns:
        the X509Certificate corresponding to (serialNumber, issuerName)
        Throws:
        XWSSecurityException - if there was an error while trying to locate the X509Certificate

      • validateCertificate

        public boolean validateCertificate​(X509Certificate cert,
                                   Map context)
                            throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Validate an X509Certificate.
        Specified by:
        validateCertificate in interface SecurityEnvironment
        Parameters:
        cert - the X509Certificate to be validated
        context - Map of application and integration-layer specific properties
        Returns:
        true, if the cert is a valid one, false otherwise.
        Throws:
        XWSSecurityException - if there is some problem during validation. public boolean validateCertificate(X509Certificate cert) throws XWSSecurityException; / /** Validate an X509Certificate.

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    String username,
                                    String password)
        Description copied from interface: SecurityEnvironment
        Update the public/private credentials of the subject of the party whose username password pair is given.
        Specified by:
        updateOtherPartySubject in interface SecurityEnvironment
        Parameters:
        subject - the Subject of the requesting party
        username - the username of the requesting party
        password - the password of the requesting party

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    X509Certificate cert)
        Description copied from interface: SecurityEnvironment
        Update the public credentials of the subject of the party whose certificate is given.
        Specified by:
        updateOtherPartySubject in interface SecurityEnvironment
        Parameters:
        subject - the Subject of the requesting party
        cert - the X509Certificate of the requesting party

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    Assertion assertion)
        Description copied from interface: SecurityEnvironment
        Update the public credentials of the subject of the party whose Assertion is given.
        Specified by:
        updateOtherPartySubject in interface SecurityEnvironment
        Parameters:
        subject - the Subject of the requesting party
        assertion - the SAML Assertion of the requesting party

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    Key secretKey)

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    String ek)

      • getSubject

        public static Subject getSubject​(Map context)

      • getPrivateKey

        public PrivateKey getPrivateKey​(Map context,
                                PublicKey publicKey,
                                boolean forSign)
                         throws XWSSecurityException
        Specified by:
        getPrivateKey in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        publicKey - the publicKey
        forSign - set to true if the purpose is Signature
        Returns:
        the PrivateKey corresponding to a PublicKey
        Throws:
        XWSSecurityException - if there was an error while trying to locate the PrivateKey

      • getSubject

        public Subject getSubject()
        Specified by:
        getSubject in interface SecurityEnvironment
        Returns:
        the host/sender Subject, null if subject is not available/initialized

      • authenticateUser

        public boolean authenticateUser​(Map context,
                                String username,
                                String passwordDigest,
                                String nonce,
                                String created)
                         throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Authenticate the user given the password digest.
        Specified by:
        authenticateUser in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        username - the username
        passwordDigest - the digested password
        nonce - the nonce which was part of the digest
        created - the creation time which was part of the digest
        Returns:
        true if the password digest is valid, false otherwise
        Throws:
        XWSSecurityException - if there was an error while trying to authenticate the username

      • authenticateUser

        public boolean authenticateUser​(Map context,
                                String username,
                                String password)
                         throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Authenticate the user against a list of known username-password pairs.
        Specified by:
        authenticateUser in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        username - the username
        password - the password
        Returns:
        true if the username-password pair is valid, false otherwise
        Throws:
        XWSSecurityException - if there was an error while trying to authenticate the username

      • validateCreationTime

        public void validateCreationTime​(Map context,
                                 String creationTime,
                                 long maxClockSkew,
                                 long timestampFreshnessLimit)
                          throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Validate the creation time. It is an error if the creation time is older than current local time minus TIMESTAMP_FRESHNESS_LIMIT minus MAX_CLOCK_SKEW
        Specified by:
        validateCreationTime in interface SecurityEnvironment
        Parameters:
        creationTime -
        context - a Map of application and integration-layer specific properties
        maxClockSkew - (in milliseconds) the maximum clockskew
        timestampFreshnessLimit - (in milliseconds) the limit for which timestamps are considered fresh
        Throws:
        XWSSecurityException

      • validateSamlIssuer

        public boolean validateSamlIssuer​(String issuer)

      • validateSamlUser

        public boolean validateSamlUser​(String user,
                                String domain,
                                String format)

      • validateTimestamp

        public void validateTimestamp​(Map context,
                              Timestamp timestamp,
                              long maxClockSkew,
                              long freshnessLimit)
                       throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Validate the creation time. It is an error if the creation time is older than current local time minus TIMESTAMP_FRESHNESS_LIMIT minus MAX_CLOCK_SKEW
        Specified by:
        validateTimestamp in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        timestamp - the Timestamp element
        maxClockSkew - (in milliseconds) the maximum clockskew
        freshnessLimit - (in milliseconds) the limit for which timestamps are considered fresh
        Throws:
        XWSSecurityException - if there was an error while trying validate the Timestamp

      • newSOAPFaultException

        public static WssSoapFaultException newSOAPFaultException​(QName faultCode,
                                                          String faultstring,
                                                          Throwable th)
        Create and initialize a WssSoapFaultException. This method is used in conjunction with generateClientFault.

      • validateSAMLAssertion

        public void validateSAMLAssertion​(Map context,
                                  Element assertion)
                           throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Validate the received SAML Assertion Validations can include validating the Issuer and the Saml User, SAML Version etc. Note: The SAML Condition (notBefore, notOnOrAfter) is validated by the XWS runtime
        Specified by:
        validateSAMLAssertion in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        assertion - the Assertion to be validated
        Throws:
        XWSSecurityException - if there was an error while validating the SAML Assertion

      • locateSAMLAssertion

        public Element locateSAMLAssertion​(Map context,
                                   Element binding,
                                   String assertionId,
                                   Document ownerDoc)
                            throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Locate and return a SAML Assertion, given the Authority binding and assertionId
        Specified by:
        locateSAMLAssertion in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        binding - an org.w3c.dom.Element representing the SAML AuthorityBinding
        assertionId - the Assertion ID of the SAML Assertion
        ownerDoc - the owner document into which the returned SAML Assertion should be imported to
        Throws:
        XWSSecurityException - if there was an error while trying to locate the SAML Assertion

      • validateSAMLAssertion

        public void validateSAMLAssertion​(Map context,
                                  XMLStreamReader assertion)
                           throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Validate the received SAML Assertion Validations can include validating the Issuer and the Saml User, SAML Version etc. Note: The SAML Condition (notBefore, notOnOrAfter) is validated by the XWS runtime In case HOK SAML Assertion the enveloped signature is removed from this SAML Assertion and verified. (i,e one will not find Signature element under this SAMLAssertion)
        Specified by:
        validateSAMLAssertion in interface SecurityEnvironment
        Parameters:
        context - a Map of application and integration-layer specific properties
        assertion - the Assertion to be validated
        Throws:
        XWSSecurityException - if there was an error while validating the SAML Assertion

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    XMLStreamReader assertion)
        Description copied from interface: SecurityEnvironment
        Update the public credentials of the subject of the party whose Assertion is given.
        Specified by:
        updateOtherPartySubject in interface SecurityEnvironment
        Parameters:
        subject - the Subject of the requesting party
        assertion - the SAML Assertion of the requesting party

      • updateOtherPartySubject

        public void updateOtherPartySubject​(Subject subject,
                                    Subject bootStrapSubject)
        Description copied from interface: SecurityEnvironment
        Update the principal/credentials of the requesting party subject
        Specified by:
        updateOtherPartySubject in interface SecurityEnvironment
        Parameters:
        subject - the Subject of the requesting party
        bootStrapSubject - the bootstrap Credentials (during a SecureConversation Bootstrap) of the requesting party

      • validateAndCacheNonce

        public boolean validateAndCacheNonce​(Map context,
                                     String nonce,
                                     String created,
                                     long nonceAge)
                              throws XWSSecurityException
        Description copied from interface: SecurityEnvironment
        Validate the given nonce. It is an error if the nonce matches any stored nonce values on the server if there is no error then the nonce is Cached.
        Specified by:
        validateAndCacheNonce in interface SecurityEnvironment
        Parameters:
        context - a context containing runtime properties
        nonce - the encoded nonce value
        created - the creation time value
        nonceAge - the time in milliseconds for which this nonce will be stored on the receiver.
        Returns:
        true if this nonce is valid
        Throws:
        XWSSecurityException - if there was an error while trying to validate the Nonce