1 /**
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19
20 package org.apache.ws.security.handler;
21
22 import org.apache.ws.security.WSConstants;
23
24 import java.util.HashMap;
25 import java.util.Map;
26
27 /**
28 * This class defines the names, actions, and other string for the deployment
29 * data of the WS handler.
30 *
31 * @author Werner Dittmann (werner@apache.org)
32 */
33 public final class WSHandlerConstants {
34
35 //
36 // Action configuration tags
37 //
38
39 private WSHandlerConstants() {
40 // Complete
41 }
42
43 /**
44 * The action parameter. The handlers use the value of this parameter to determine how
45 * to process the SOAP Envelope. It is a blank separated list of actions to perform.
46 * <p/>
47 * The application may set this parameter using the following method:
48 * <pre>
49 * call.setProperty(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);
50 * </pre>
51 */
52 public static final String ACTION = "action";
53
54 /**
55 * Perform no action.
56 */
57 public static final String NO_SECURITY = "NoSecurity";
58
59 /**
60 * Perform a UsernameToken action.
61 */
62 public static final String USERNAME_TOKEN = "UsernameToken";
63
64 /**
65 * Perform a UsernameToken action with no password.
66 */
67 public static final String USERNAME_TOKEN_NO_PASSWORD = "UsernameTokenNoPassword";
68
69 /**
70 * Perform an unsigned SAML Token action.
71 */
72 public static final String SAML_TOKEN_UNSIGNED = "SAMLTokenUnsigned";
73
74 /**
75 * Perform a signed SAML Token action.
76 */
77 public static final String SAML_TOKEN_SIGNED = "SAMLTokenSigned";
78
79 /**
80 * Perform a Signature action. The signature specific parameters define how
81 * to sign, which keys to use, and so on.
82 */
83 public static final String SIGNATURE = "Signature";
84
85 /**
86 * Perform an Encryption action. The encryption specific parameters define how
87 * to encrypt, which keys to use, and so on.
88 */
89 public static final String ENCRYPT = "Encrypt";
90
91 /**
92 * Add a timestamp to the security header.
93 */
94 public static final String TIMESTAMP = "Timestamp";
95
96 /**
97 * Use this to use a specific signature mechanism for .Net. This signature mechanism
98 * uses data from the username token and a well defined constant string and constructs
99 * a signature key. Please note that this action is NOT spec-compliant.
100 */
101 public static final String SIGN_WITH_UT_KEY = "UsernameTokenSignature";
102
103 //
104 // User properties
105 //
106
107 /**
108 * The actor or role name of the <code>wsse:Security</code> header. If this parameter
109 * is omitted, the actor name is not set.
110 * <p/>
111 * The value of the actor or role has to match the receiver's setting
112 * or may contain standard values.
113 * <p/>
114 * The application may set this parameter using the following method:
115 * <pre>
116 * call.setProperty(WSHandlerConstants.ACTOR, "ActorName");
117 * </pre>
118 */
119 public static final String ACTOR = "actor";
120
121 /**
122 * The user's name. It is used differently by each of the WS-Security functions.
123 * <ul>
124 * <li>The <i>UsernameToken</i> function sets this name in the
125 * <code>UsernameToken</code>.
126 * </li>
127 * <li>The <i>Signing</i> function uses this name as the alias name
128 * in the keystore to get user's certificate and private key to
129 * perform signing if {@link #SIGNATURE_USER} is not used.
130 * </li>
131 * <li>The <i>encryption</i>
132 * functions uses this parameter as fallback if {@link #ENCRYPTION_USER}
133 * is not used.
134 * </li>
135 * </ul>
136 */
137 public static final String USER = "user";
138
139 /**
140 * The user's name for encryption. The encryption functions use the public key of
141 * this user's certificate to encrypt the generated symmetric key.
142 * <p/>
143 * If this parameter is not set, then the encryption
144 * function falls back to the {@link #USER} parameter to get the
145 * certificate.
146 * <p/>
147 * If <b>only</b> encryption of the SOAP body data is requested,
148 * it is recommended to use this parameter to define the username.
149 * <p/>
150 * The application may set this parameter using the following method:
151 * <pre>
152 * call.setProperty(WSHandlerConstants.ENCRYPTION_USER, "encryptionUser");
153 * </pre>
154 */
155 public static final String ENCRYPTION_USER = "encryptionUser";
156
157 /**
158 * The user's name for signature. This name is used as the alias name in the keystore
159 * to get user's certificate and private key to perform signing.
160 * <p/>
161 * If this parameter is not set, then the signature
162 * function falls back to the {@link #USER} parameter.
163 * <p/>
164 * The application may set this parameter using the following method:
165 * <pre>
166 * call.setProperty(WSHandlerConstants.SIGNATURE_USER, "signatureUser");
167 * </pre>
168 */
169 public static final String SIGNATURE_USER = "signatureUser";
170
171 /**
172 * Specifying this name as {@link #ENCRYPTION_USER}
173 * triggers a special action to get the public key to use for encryption.
174 * <p/>
175 * The handler uses the public key of the sender's certificate. Using this
176 * way to define an encryption key simplifies certificate management to
177 * a large extend.
178 */
179 public static final String USE_REQ_SIG_CERT = "useReqSigCert";
180
181
182 //
183 // Callback class and property file properties
184 //
185
186 /**
187 * This tag refers to the CallbackHandler implementation class used to obtain passwords.
188 * The value of this tag must be the class name of a
189 * {@link javax.security.auth.callback.CallbackHandler} instance.
190 * </p>
191 * The callback function
192 * {@link javax.security.auth.callback.CallbackHandler#handle(
193 * javax.security.auth.callback.Callback[])} gets an array of
194 * {@link org.apache.ws.security.WSPasswordCallback} objects. Only the first entry of the
195 * array is used. This object contains the username/keyname as identifier. The callback
196 * handler must set the password or key associated with this identifier before it returns.
197 * <p/>
198 * The application may set this parameter using the following method:
199 * <pre>
200 * call.setProperty(WSHandlerConstants.PW_CALLBACK_CLASS, "PWCallbackClass");
201 * </pre>
202 */
203 public static final String PW_CALLBACK_CLASS = "passwordCallbackClass";
204
205 /**
206 * This tag refers to the CallbackHandler implementation object used to obtain
207 * passwords. The value of this tag must be a
208 * {@link javax.security.auth.callback.CallbackHandler} instance.
209 * </p>
210 * Refer to {@link #PW_CALLBACK_CLASS} for further information about password callback
211 * handling.
212 */
213 public static final String PW_CALLBACK_REF = "passwordCallbackRef";
214
215 /**
216 * This tag refers to the SAML CallbackHandler implementation class used to construct
217 * SAML Assertions. The value of this tag must be the class name of a
218 * {@link javax.security.auth.callback.CallbackHandler} instance.
219 */
220 public static final String SAML_CALLBACK_CLASS = "samlCallbackClass";
221
222 /**
223 * This tag refers to the SAML CallbackHandler implementation object used to construct
224 * SAML Assertions. The value of this tag must be a
225 * {@link javax.security.auth.callback.CallbackHandler} instance.
226 */
227 public static final String SAML_CALLBACK_REF = "samlCallbackRef";
228
229 /**
230 * This tag refers to the CallbackHandler implementation class used to get the key
231 * associated with a key name. The value of this tag must be the class name of a
232 * {@link javax.security.auth.callback.CallbackHandler} instance.
233 */
234 public static final String ENC_CALLBACK_CLASS = "embeddedKeyCallbackClass";
235
236 /**
237 * This tag refers to the CallbackHandler implementation object used to get the key
238 * associated with a key name. The value of this tag must be a
239 * {@link javax.security.auth.callback.CallbackHandler} instance.
240 */
241 public static final String ENC_CALLBACK_REF = "embeddedKeyCallbackRef";
242
243 /**
244 * The path of the crypto property file to use for Signature. The classloader loads this
245 * file. Therefore it must be accessible via the classpath.
246 * <p/>
247 * To locate the implementation of the
248 * {@link org.apache.ws.security.components.crypto.Crypto Crypto}
249 * interface implementation the property file must contain the property
250 * <code>org.apache.ws.security.crypto.provider</code>. The value of
251 * this property is the classname of the implementation class.
252 * <p/>
253 * The following line defines the standard implementation:
254 * <pre>
255 * org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
256 * </pre>
257 * The other contents of the property file depend on the implementation
258 * of the {@link org.apache.ws.security.components.crypto.Crypto Crypto}
259 * interface. Please see the WSS4J website for more information on the Merlin property
260 * tags and values.
261 * </p>
262 * The application may set this parameter using the following method:
263 * <pre>
264 * call.setProperty(WSHandlerConstants.SIG_PROP_FILE, "myCrypto.properties");
265 * </pre>
266 */
267 public static final String SIG_PROP_FILE = "signaturePropFile";
268
269 /**
270 * The key that holds a reference to the object holding complete information about
271 * the signature Crypto implementation. This object can either be a Crypto instance or a
272 * <code>java.util.Properties</code> file, which should contain all information that
273 * would contain in an equivalent properties file which includes the Crypto implementation
274 * class name.
275 *
276 * Refer to documentation of {@link #SIG_PROP_FILE}.
277 */
278 public static final String SIG_PROP_REF_ID = "signaturePropRefId";
279
280 /**
281 * The path of the crypto property file to use for Decryption. The classloader loads this
282 * file. Therefore it must be accessible via the classpath. Refer to documentation of
283 * {@link #SIG_PROP_FILE} for more information about the contents of the Properties file.
284 * <p/>
285 * The application may set this parameter using the following method:
286 * <pre>
287 * call.setProperty(WSHandlerConstants.DEC_PROP_FILE, "myCrypto.properties");
288 * </pre>
289 */
290 public static final String DEC_PROP_FILE = "decryptionPropFile";
291
292 /**
293 * The key that holds a reference to the object holding complete information about
294 * the decryption Crypto implementation. This object can either be a Crypto instance or a
295 * <code>java.util.Properties</code> file, which should contain all information that
296 * would contain in an equivalent properties file which includes the Crypto implementation
297 * class name.
298 *
299 * Refer to documentation of {@link #DEC_PROP_FILE}.
300 */
301 public static final String DEC_PROP_REF_ID = "decryptionPropRefId";
302
303 /**
304 * The path of the crypto property file to use for Encryption. The classloader loads this
305 * file. Therefore it must be accessible via the classpath. Refer to documentation of
306 * {@link #SIG_PROP_FILE} for more information about the contents of the Properties file.
307 * <p/>
308 * The application may set this parameter using the following method:
309 * <pre>
310 * call.setProperty(WSHandlerConstants.ENC_PROP_FILE, "myCrypto.properties");
311 * </pre>
312 */
313 public static final String ENC_PROP_FILE = "encryptionPropFile";
314
315 /**
316 * The key that holds a reference to the object holding complete information about
317 * the encryption Crypto implementation. This object can either be a Crypto instance or a
318 * <code>java.util.Properties</code> file, which should contain all information that
319 * would contain in an equivalent properties file which includes the Crypto implementation
320 * class name.
321 *
322 * Refer to documentation of {@link #ENC_PROP_FILE}.
323 */
324 public static final String ENC_PROP_REF_ID = "encryptionPropRefId";
325
326 /**
327 * The name of the SAML Issuer factory property file.
328 * The classloader loads this file. Therefore it must be accessible
329 * via the classpath.
330 */
331 public static final String SAML_PROP_FILE = "samlPropFile";
332
333 //
334 // Boolean configuration tags, e.g. the value should be "true" or "false".
335 //
336
337 /**
338 * Whether to enable signatureConfirmation or not. The default value is "false".
339 */
340 public static final String ENABLE_SIGNATURE_CONFIRMATION = "enableSignatureConfirmation";
341
342 /**
343 * Whether to set the mustUnderstand flag on an outbound message or not. The default
344 * setting is "true".
345 * <p/>
346 * The application may set this parameter using the following method:
347 * <pre>
348 * call.setProperty(WSHandlerConstants.MUST_UNDERSTAND, "false");
349 * </pre>
350 */
351 public static final String MUST_UNDERSTAND = "mustUnderstand";
352
353 /**
354 * Whether to ensure compliance with the Basic Security Profile (BSP) 1.1 or not. The
355 * default value is "true".
356 * <p/>
357 * The application may set this parameter using the following method:
358 * <pre>
359 * call.setProperty(WSHandlerConstants.IS_BSP_COMPLIANT, "false");
360 * </pre>
361 */
362 public static final String IS_BSP_COMPLIANT = "isBSPCompliant";
363
364 /**
365 * This variable controls whether types other than PasswordDigest or PasswordText
366 * are allowed when processing UsernameTokens. The default value is "false".
367 */
368 public static final String HANDLE_CUSTOM_PASSWORD_TYPES = "handleCustomPasswordTypes";
369
370 /**
371 * This variable controls whether a UsernameToken with no password element is allowed.
372 * The default value is "false". Set it to "true" to allow deriving keys from UsernameTokens
373 * or to support UsernameTokens for purposes other than authentication.
374 */
375 public static final String ALLOW_USERNAMETOKEN_NOPASSWORD = "allowUsernameTokenNoPassword";
376
377 /**
378 * Set the value of this parameter to true to enable strict Username Token password type
379 * handling. The default value is "false".
380 *
381 * If this parameter is set to true, it throws an exception if the password type of
382 * the Username Token does not match that of the configured PASSWORD_TYPE parameter.
383 */
384 public static final String PASSWORD_TYPE_STRICT = "passwordTypeStrict";
385
386 /**
387 * This variable controls whether (wsse) namespace qualified password types are
388 * accepted when processing UsernameTokens. The default value is "false".
389 */
390 public static final String ALLOW_NAMESPACE_QUALIFIED_PASSWORD_TYPES
391 = "allowNamespaceQualifiedPasswordTypes";
392
393 /**
394 * This variable controls whether to enable Certificate Revocation List (CRL) checking
395 * or not when verifying trust in a certificate. The default value is "false".
396 */
397 public static final String ENABLE_REVOCATION = "enableRevocation";
398
399 /**
400 * Set the value of this parameter to true to treat passwords as binary values
401 * for Username Tokens. The default value is "false".
402 *
403 * This is needed to properly handle password equivalence for UsernameToken
404 * passwords. Binary passwords are Base64 encoded so they can be treated as
405 * strings in most places, but when the password digest is calculated or a key
406 * is derived from the password, the password will be Base64 decoded before
407 * being used. This is most useful for hashed passwords as password equivalents.
408 */
409 public static final String USE_ENCODED_PASSWORDS = "useEncodedPasswords";
410
411 /**
412 * This parameter sets whether to use a single certificate or a whole certificate
413 * chain when constructing a BinarySecurityToken used for direct reference in
414 * signature. The default is "true", meaning that only a single certificate is used.
415 */
416 public static final String USE_SINGLE_CERTIFICATE = "useSingleCertificate";
417
418 /**
419 * This parameter sets whether to use UsernameToken Key Derivation, as defined
420 * in the UsernameTokenProfile 1.1 specification. The default is "true". If false,
421 * then it falls back to the old behaviour of WSE derived key functionality.
422 */
423 public static final String USE_DERIVED_KEY = "useDerivedKey";
424
425 /**
426 * This parameter sets whether to use the Username Token derived key for a MAC
427 * or not. The default is "true".
428 */
429 public static final String USE_DERIVED_KEY_FOR_MAC = "useDerivedKeyForMAC";
430
431 /**
432 * Set whether Timestamps have precision in milliseconds. This applies to the
433 * creation of Timestamps only. The default value is "true".
434 */
435 public static final String TIMESTAMP_PRECISION = "precisionInMilliseconds";
436
437 /**
438 * Set the value of this parameter to true to enable strict timestamp
439 * handling. The default value is "true".
440 *
441 * Strict Timestamp handling: throw an exception if a Timestamp contains
442 * an <code>Expires</code> element and the semantics of the request are
443 * expired, i.e. the current time at the receiver is past the expires time.
444 */
445 public static final String TIMESTAMP_STRICT = "timestampStrict";
446
447 /**
448 * Defines whether to encrypt the symmetric encryption key or not. If true
449 * (the default), the symmetric key used for encryption is encrypted in turn,
450 * and inserted into the security header in an "EncryptedKey" structure. If
451 * set to false, no EncryptedKey structure is constructed.
452 * <p/>
453 * The application may set this parameter using the following method:
454 * <pre>
455 * call.setProperty(WSHandlerConstants.ENC_SYM_ENC_KEY, "false");
456 * </pre>
457 */
458 public static final String ENC_SYM_ENC_KEY = "encryptSymmetricEncryptionKey";
459
460 /**
461 * Whether the engine needs to enforce EncryptedData elements are
462 * in a signed subtree of the document. This can be used to prevent
463 * some wrapping based attacks when encrypt-before-sign token
464 * protection is selected.
465 */
466 public static final String REQUIRE_SIGNED_ENCRYPTED_DATA_ELEMENTS = "requireSignedEncryptedDataElements";
467
468 //
469 // (Non-boolean) Configuration parameters for the actions/processors
470 //
471
472 /**
473 * Text of the embedded key name to be sent in the KeyInfo for encryption.
474 */
475 public static final String ENC_KEY_NAME = "embeddedKeyName";
476
477 /**
478 * Specific parameter for UsernameToken action to define the encoding
479 * of the password.
480 * <p/>
481 * The parameter can be set to either {@link WSConstants#PW_DIGEST}
482 * or to {@link WSConstants#PW_TEXT}.
483 * <p/>
484 * The application may set this parameter using the following method:
485 * <pre>
486 * call.setProperty(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST);
487 * </pre>
488 * The default setting is PW_DIGEST.
489 */
490 public static final String PASSWORD_TYPE = "passwordType";
491
492 /**
493 * Parameter to generate additional elements (nonce and created) in a
494 * <code>UsernameToken</code>.
495 * <p/>
496 * The value of this parameter is a list of element names that are added
497 * to the UsernameToken. The names of the list a separated by spaces.
498 * <p/>
499 * The list may contain the names <code>nonce</code> and
500 * <code>created</code> only. Use this option if the password type is
501 * <code>passwordText</code> and the handler shall add the <code>Nonce</code>
502 * and/or <code>Created</code> elements.
503 */
504 public static final String ADD_UT_ELEMENTS = "addUTElements";
505
506 /**
507 * Defines which key identifier type to use for signature. The WS-Security specifications
508 * recommends to use the identifier type <code>IssuerSerial</code>. For possible signature
509 * key identifier types refer to {@link #getKeyIdentifier(String)}.
510 * For signature <code>IssuerSerial</code>, <code>DirectReference</code>,
511 * <code>X509KeyIdentifier</code>, <code>Thumbprint</code>, <code>SKIKeyIdentifier</code>
512 * and <code>KeyValue</code> are valid only.
513 * <p/>
514 * The default is <code>IssuerSerial</code>.
515 * <p/>
516 * The application may set this parameter using the following method:
517 * <pre>
518 * call.setProperty(WSHandlerConstants.SIG_KEY_ID, "DirectReference");
519 * </pre>
520 */
521 public static final String SIG_KEY_ID = "signatureKeyIdentifier";
522
523 /**
524 * Defines which signature algorithm to use. The default is set by the data in the
525 * certificate, i.e. one of the following:
526 *
527 * "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
528 * "http://www.w3.org/2000/09/xmldsig#dsa-sha1"
529 *
530 * <p/>
531 * The application may set this parameter using the following method:
532 * <pre>
533 * call.setProperty(
534 * WSHandlerConstants.SIG_ALGO,
535 * "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
536 * );
537 * </pre>
538 */
539 public static final String SIG_ALGO = "signatureAlgorithm";
540
541 /**
542 * Defines which signature digest algorithm to use. The default is:
543 *
544 * "http://www.w3.org/2000/09/xmldsig#sha1"
545 *
546 * <p/>
547 * The application may set this parameter using the following method:
548 * <pre>
549 * call.setProperty(
550 * WSHandlerConstants.SIG_DIGEST_ALGO, "http://www.w3.org/2001/04/xmlenc#sha256"
551 * );
552 * </pre>
553 */
554 public static final String SIG_DIGEST_ALGO = "signatureDigestAlgorithm";
555
556 /**
557 * Parameter to define which parts of the request shall be signed.
558 * <p/>
559 * Refer to {@link #ENCRYPTION_PARTS} for a detailed description of
560 * the format of the value string.
561 * <p/>
562 * If this parameter is not specified the handler signs the SOAP Body
563 * by default, i.e.:
564 * <pre>
565 * <parameter name="signatureParts"
566 * value="{}{http://schemas.xmlsoap.org/soap/envelope/}Body;" />
567 * </pre>
568 * To specify an element without a namespace use the string
569 * <code>Null</code> as the namespace name (this is a case sensitive
570 * string)
571 * <p/>
572 * If there is no other element in the request with a local name of
573 * <code>Body</code> then the SOAP namespace identifier can be empty
574 * (<code>{}</code>).
575 */
576 public static final String SIGNATURE_PARTS = "signatureParts";
577
578 /**
579 * This parameter sets the length of the secret (derived) key to use for the
580 * WSE UT_SIGN functionality.
581 *
582 * The default value is 16 bytes.
583 */
584 public static final String WSE_SECRET_KEY_LENGTH = "wseSecretKeyLength";
585
586 /**
587 * This parameter sets the number of iterations to use when deriving a key
588 * from a Username Token. The default is 1000.
589 */
590 public static final String DERIVED_KEY_ITERATIONS = "derivedKeyIterations";
591
592 /**
593 * Defines which key identifier type to use for encryption. The WS-Security specifications
594 * recommends to use the identifier type <code>IssuerSerial</code>. For
595 * possible encryption key identifier types refer to
596 * {@link #getKeyIdentifier(String)}. For encryption <code>IssuerSerial</code>,
597 * <code>DirectReference</code>, <code>X509KeyIdentifier</code>,
598 * <code>Thumbprint</code>, <code>SKIKeyIdentifier</code>, <code>EncryptedKeySHA1</code>
599 * and <code>EmbeddedKeyName</code> are valid only.
600 * <p/>
601 * The default is <code>IssuerSerial</code>.
602 * <p/>
603 * The application may set this parameter using the following method:
604 * <pre>
605 * call.setProperty(WSHandlerConstants.ENC_KEY_ID, "X509KeyIdentifier");
606 * </pre>
607 */
608 public static final String ENC_KEY_ID = "encryptionKeyIdentifier";
609
610 /**
611 * Defines which symmetric encryption algorithm to use. WSS4J supports the
612 * following algorithms: {@link WSConstants#TRIPLE_DES},
613 * {@link WSConstants#AES_128}, {@link WSConstants#AES_256},
614 * and {@link WSConstants#AES_192}. Except for AES 192 all of these
615 * algorithms are required by the XML Encryption specification.
616 * The default algorithm is:
617 *
618 * "http://www.w3.org/2001/04/xmlenc#aes128-cbc"
619 *
620 * <p/>
621 * The application may set this parameter using the following method:
622 * <pre>
623 * call.setProperty(WSHandlerConstants.ENC_SYM_ALGO, WSConstants.AES_256);
624 * </pre>
625 */
626 public static final String ENC_SYM_ALGO = "encryptionSymAlgorithm";
627
628 /**
629 * Defines which algorithm to use to encrypt the generated symmetric key.
630 * The default algorithm is:
631 *
632 * "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
633 *
634 * <p/>
635 * The application may set this parameter using the following method:
636 * <pre>
637 * call.setProperty(WSHandlerConstants.ENC_KEY_TRANSPORT, WSConstants.KEYTRANSPORT_RSA15);
638 * </pre>
639 */
640 public static final String ENC_KEY_TRANSPORT = "encryptionKeyTransportAlgorithm";
641
642 /**
643 * Parameter to define which parts of the request shall be encrypted.
644 * <p/>
645 * The value of this parameter is a list of semi-colon separated
646 * element names that identify the elements to encrypt. An encryption mode
647 * specifier and a namespace identification, each inside a pair of curly
648 * brackets, may preceed each element name.
649 * <p/>
650 * The encryption mode specifier is either <code>{Content}</code> or
651 * <code>{Element}</code>. Please refer to the W3C XML Encryption
652 * specification about the differences between Element and Content
653 * encryption. The encryption mode defaults to <code>Content</code>
654 * if it is omitted. Example of a list:
655 * <pre>
656 * <parameter name="encryptionParts"
657 * value="{Content}{http://example.org/paymentv2}CreditCard;
658 * {Element}{}UserName" />
659 * </pre>
660 * The the first entry of the list identifies the element
661 * <code>CreditCard</code> in the namespace
662 * <code>http://example.org/paymentv2</code>, and will encrypt its content.
663 * Be aware that the element name, the namespace identifier, and the
664 * encryption modifier are case sensitive.
665 * <p/>
666 * The encryption modifier and the namespace identifier can be ommited.
667 * In this case the encryption mode defaults to <code>Content</code> and
668 * the namespace is set to the SOAP namespace.
669 * <p/>
670 * An empty encryption mode defaults to <code>Content</code>, an empty
671 * namespace identifier defaults to the SOAP namespace.
672 * The second line of the example defines <code>Element</code> as
673 * encryption mode for an <code>UserName</code> element in the SOAP
674 * namespace.
675 * <p/>
676 * To specify an element without a namespace use the string
677 * <code>Null</code> as the namespace name (this is a case sensitive
678 * string)
679 * <p/>
680 * If no list is specified, the handler encrypts the SOAP Body in
681 * <code>Content</code> mode by default.
682 */
683 public static final String ENCRYPTION_PARTS = "encryptionParts";
684
685 /**
686 * Defines which encryption digest algorithm to use with the RSA OAEP Key Transport
687 * algorithm for encryption. The default is SHA-1.
688 * <p/>
689 * The application may set this parameter using the following method:
690 * <pre>
691 * call.setProperty(
692 * WSHandlerConstants.ENC_DIGEST_ALGO, "http://www.w3.org/2001/04/xmlenc#sha256"
693 * );
694 * </pre>
695 */
696 public static final String ENC_DIGEST_ALGO = "encryptionDigestAlgorithm";
697
698 /**
699 * Time-To-Live is the time difference between creation and expiry time in
700 * seconds of the UsernameToken Created value. After this time the SOAP request
701 * is invalid (at least the security data shall be treated this way).
702 * <p/>
703 * If this parameter is not defined, contains a value less or equal
704 * zero, or an illegal format the handlers use a default TTL of
705 * 300 seconds (5 minutes).
706 */
707 public static final String TTL_USERNAMETOKEN = "utTimeToLive";
708
709 /**
710 * This configuration tag specifies the time in seconds in the future within which
711 * the Created time of an incoming UsernameToken is valid. The default value is "60",
712 * to avoid problems where clocks are slightly askew. To reject all future-created
713 * UsernameTokens, set this value to "0".
714 */
715 public static final String TTL_FUTURE_USERNAMETOKEN = "utFutureTimeToLive";
716
717 /**
718 * This configuration tag is a comma separated String of regular expressions which
719 * will be applied to the subject DN of the certificate used for signature
720 * validation, after trust verification of the certificate chain associated with the
721 * certificate. These constraints are not used when the certificate is contained in
722 * the keystore (direct trust).
723 */
724 public static final String SIG_SUBJECT_CERT_CONSTRAINTS = "sigSubjectCertConstraints";
725
726 /**
727 * Time-To-Live is the time difference between creation and expiry time in
728 * seconds in the WSS Timestamp. After this time the SOAP request is
729 * invalid (at least the security data shall be treated this way).
730 * <p/>
731 * If this parameter is not defined, contains a value less or equal
732 * zero, or an illegal format the handlers use a default TTL of
733 * 300 seconds (5 minutes).
734 */
735 public static final String TTL_TIMESTAMP = "timeToLive";
736
737 /**
738 * This configuration tag specifies the time in seconds in the future within which
739 * the Created time of an incoming Timestamp is valid. The default value is "60",
740 * to avoid problems where clocks are slightly askew. To reject all future-created
741 * Timestamps, set this value to "0".
742 */
743 public static final String TTL_FUTURE_TIMESTAMP = "futureTimeToLive";
744
745
746 //
747 // Internal storage constants
748 //
749
750 /**
751 * The WSHandler stores a result <code>List</code> in this property.
752 */
753 public static final String RECV_RESULTS = "RECV_RESULTS";
754
755 /**
756 * internally used property names to store values inside the message context
757 * that must have the same lifetime as a message (request/response model).
758 */
759 public static final String SEND_SIGV = "_sendSignatureValues_";
760
761 /**
762 *
763 */
764 public static final String SIG_CONF_DONE = "_sigConfDone_";
765
766
767 /**
768 * Define the parameter values to set the key identifier types. These are:
769 * <ul>
770 * <li><code>DirectReference</code> for {@link WSConstants#BST_DIRECT_REFERENCE}
771 * </li>
772 * <li><code>IssuerSerial</code> for {@link WSConstants#ISSUER_SERIAL}
773 * </li>
774 * <li><code>X509KeyIdentifier</code> for {@link WSConstants#X509_KEY_IDENTIFIER}
775 * </li>
776 * <li><code>SKIKeyIdentifier</code> for {@link WSConstants#SKI_KEY_IDENTIFIER}
777 * </li>
778 * <li><code>EmbeddedKeyName</code> for {@link WSConstants#EMBEDDED_KEYNAME}
779 * </li>
780 * <li><code>Thumbprint</code> for {@link WSConstants#THUMBPRINT}
781 * </li>
782 * <li><code>EncryptedKeySHA1</code> for {@link WSConstants#ENCRYPTED_KEY_SHA1_IDENTIFIER}
783 * </li>
784 * </ul>
785 * See {@link #SIG_KEY_ID} {@link #ENC_KEY_ID}.
786 */
787 private static Map<String, Integer> keyIdentifier = new HashMap<String, Integer>();
788
789 static {
790 keyIdentifier.put("DirectReference",
791 Integer.valueOf(WSConstants.BST_DIRECT_REFERENCE));
792 keyIdentifier.put("IssuerSerial",
793 Integer.valueOf(WSConstants.ISSUER_SERIAL));
794 keyIdentifier.put("X509KeyIdentifier",
795 Integer.valueOf(WSConstants.X509_KEY_IDENTIFIER));
796 keyIdentifier.put("SKIKeyIdentifier",
797 Integer.valueOf(WSConstants.SKI_KEY_IDENTIFIER));
798 keyIdentifier.put("EmbeddedKeyName",
799 Integer.valueOf(WSConstants.EMBEDDED_KEYNAME));
800 keyIdentifier.put("Thumbprint",
801 Integer.valueOf(WSConstants.THUMBPRINT_IDENTIFIER));
802 keyIdentifier.put("EncryptedKeySHA1",
803 Integer.valueOf(WSConstants.ENCRYPTED_KEY_SHA1_IDENTIFIER));
804 keyIdentifier.put("KeyValue",
805 Integer.valueOf(WSConstants.KEY_VALUE));
806 }
807
808 /**
809 * Get the key identifier type corresponding to the parameter. This is intended for internal
810 * use only. Valid values for "parameter" are:
811 * - "IssuerSerial"
812 * - "DirectReference"
813 * - "X509KeyIdentifier"
814 * - "Thumbprint"
815 * - "SKIKeyIdentifier"
816 * - "KeyValue"
817 * - "EmbeddedKeyName"
818 * - "EncryptedKeySHA1"
819 *
820 * @param parameter
821 * @return the key identifier type corresponding to the parameter
822 */
823 public static Integer getKeyIdentifier(String parameter) {
824 return keyIdentifier.get(parameter);
825 }
826 }
827