1 /**
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19
20 package org.apache.wss4j.dom.engine;
21
22 import org.apache.wss4j.common.saml.SamlAssertionWrapper;
23 import org.apache.wss4j.common.token.BinarySecurity;
24 import org.apache.wss4j.dom.WSDataRef;
25 import org.apache.wss4j.dom.message.token.SecurityContextToken;
26 import org.apache.wss4j.dom.message.token.SignatureConfirmation;
27 import org.apache.wss4j.dom.message.token.Timestamp;
28 import org.apache.wss4j.dom.message.token.UsernameToken;
29
30 import java.security.Principal;
31 import java.security.cert.X509Certificate;
32 import java.util.List;
33
34
35 public class WSSecurityEngineResult extends java.util.HashMap<String, Object> {
36
37 //
38 // Tokens
39 //
40
41 /**
42 *
43 */
44 private static final long serialVersionUID = 8877354445092724300L;
45
46 /**
47 * Tag denoting the SAML Assertion found, if applicable.
48 *
49 * The value under this tag is of type SamlAssertionWrapper.
50 */
51 public static final String TAG_SAML_ASSERTION = "saml-assertion";
52
53 /**
54 * Tag denoting the timestamp found, if applicable.
55 *
56 * The value under this tag is of type
57 * org.apache.wss4j.dom.message.token.Timestamp.
58 */
59 public static final String TAG_TIMESTAMP = "timestamp";
60
61 /**
62 * Tag denoting references to the DOM elements that have been
63 * cryptographically protected.
64 *
65 * The value under this tag is of type SecurityContextToken.
66 */
67 public static final String TAG_SECURITY_CONTEXT_TOKEN = "security-context-token";
68
69 /**
70 * Tag denoting a UsernameToken object
71 */
72 public static final String TAG_USERNAME_TOKEN = "username-token";
73
74 /**
75 * Tag denoting a DerivedKeyToken object
76 */
77 public static final String TAG_DERIVED_KEY_TOKEN = "derived-key-token";
78
79 /**
80 * Tag denoting the signature confirmation of a signed element,
81 * if applicable.
82 *
83 * The value under this tag is of type
84 * org.apache.wss4j.dom.message.token.SignatureConfirmation.
85 */
86 public static final String TAG_SIGNATURE_CONFIRMATION = "signature-confirmation";
87
88 /**
89 * Tag denoting the BinarySecurityToken found, if applicable.
90 *
91 * The value under this tag is of type BinarySecurity.
92 */
93 public static final String TAG_BINARY_SECURITY_TOKEN = "binary-security-token";
94
95 /**
96 * Tag denoting a Transformed Token. For certain tokens, the Validator may return
97 * an SamlAssertionWrapper instance which corresponds to a transformed version of the
98 * initial token. For example, a Username Token credential might be validated
99 * by an STS and transformed into a SAML Assertion. This tag then holds the
100 * transformed SamlAssertionWrapper instance, as a component of the Result corresponding
101 * to the Username Token.
102 *
103 * The value under this tag is of type SamlAssertionWrapper.
104 */
105 public static final String TAG_TRANSFORMED_TOKEN = "transformed-token";
106
107 /**
108 * Tag denoting that the TAG_*_TOKEN result has been validated by a Validator
109 * implementation. Some of the processors do not have a default validator implementation,
110 * and so this is not set. Note that this is set for the NoOpValidator if it is
111 * configured.
112 *
113 * For a Signature result this tag is only set when a trust decision was actually taken
114 * on the signing credential: either a Validator was invoked on it, or the credential
115 * carries its own trust (for example the key of a signed holder-of-key SAML assertion,
116 * or a previously validated BinarySecurityToken). It is deliberately NOT set when the
117 * signature was verified with a symmetric key, because a symmetric key carries no
118 * identity that a Validator could check. Such a signature establishes the integrity of
119 * the signed parts, not the identity of the sender - see the "False-friend properties"
120 * section of THREAT-MODEL.md.
121 *
122 * The value under this tag is a Boolean instance.
123 */
124 public static final String TAG_VALIDATED_TOKEN = "validated-token";
125
126 /**
127 * Tag denoting the DOM Element of the processed token (if a token has been processed).
128 *
129 * The value under this tag is of type org.w3c.dom.Element
130 */
131 public static final String TAG_TOKEN_ELEMENT = "token-element";
132
133 //
134 // Keys and certs
135 //
136
137 /**
138 * Tag denoting the X.509 certificate found, if applicable.
139 *
140 * The value under this tag is of type java.security.cert.X509Certificate.
141 */
142 public static final String TAG_X509_CERTIFICATE = "x509-certificate";
143
144 /**
145 * Tag denoting the signature value of a signed element, if applicable.
146 *
147 * The value under this tag is of type byte[].
148 */
149 public static final String TAG_SIGNATURE_VALUE = "signature-value";
150
151 /**
152 * Tag denoting the X.509 certificate chain found, if applicable.
153 *
154 * The value under this tag is of type java.security.cert.X509Certificate[].
155 */
156 public static final String TAG_X509_CERTIFICATES = "x509-certificates";
157
158 /**
159 * Tag denoting how the X.509 certificate (chain) was referenced, if applicable.
160 *
161 * The value under this tag is of type STRParser.REFERENCE_TYPE.
162 */
163 public static final String TAG_X509_REFERENCE_TYPE = "x509-reference-type";
164
165 /**
166 * Tag denoting the encrypted key bytes
167 *
168 * The value under this tag is a byte array
169 */
170 public static final String TAG_ENCRYPTED_EPHEMERAL_KEY = "encrypted-ephemeral-key-bytes";
171
172 /**
173 * Tag denoting a byte[] secret associated with this token
174 */
175 public static final String TAG_SECRET = "secret";
176
177 /**
178 * Tag denoting a PublicKey associated with this token
179 */
180 public static final String TAG_PUBLIC_KEY = "public-key";
181
182 //
183 // General tags
184 //
185
186 /**
187 * Tag denoting the cryptographic operation performed
188 *
189 * The value under this tag is of type java.lang.Integer
190 */
191 public static final String TAG_ACTION = "action";
192
193 /**
194 * Tag denoting the security principal found, if applicable.
195 *
196 * The value under this tag is of type java.security.Principal.
197 */
198 public static final String TAG_PRINCIPAL = "principal";
199
200 /**
201 * Tag denoting the security subject found, if applicable.
202 *
203 * The value under this tag is of type javax.security.auth.Subject.
204 */
205 public static final String TAG_SUBJECT = "subject";
206
207 /**
208 * Tag denoting references to a List of Data ref URIs.
209 *
210 * The value under this tag is of type List.
211 */
212 public static final String TAG_DATA_REF_URIS = "data-ref-uris";
213
214 /**
215 * Tag denoting the encrypted key transport algorithm.
216 *
217 * The value under this tag is of type String.
218 */
219 public static final String TAG_ENCRYPTED_KEY_TRANSPORT_METHOD = "encrypted-key-transport-method";
220
221 /**
222 * Tag denoting the algorithm that was used to sign the message
223 *
224 * The value under this tag is of type String.
225 */
226 public static final String TAG_SIGNATURE_METHOD = "signature-method";
227
228 /**
229 * Tag denoting the algorithm that was used to do canonicalization
230 *
231 * The value under this tag is of type String.
232 */
233 public static final String TAG_CANONICALIZATION_METHOD = "canonicalization-method";
234
235 /**
236 * Tag denoting a delegation credential found, if applicable.
237 *
238 * For Kerberos (if delegation is enabled), the value under this tag is of type GSSCredential
239 */
240 public static final String TAG_DELEGATION_CREDENTIAL = "delegation-credential";
241
242 /**
243 * The (wsu) Id of the token corresponding to this result.
244 */
245 public static final String TAG_ID = "id";
246
247 public WSSecurityEngineResult(int act) {
248 put(TAG_ACTION, act);
249 }
250
251 public WSSecurityEngineResult(
252 int act,
253 SamlAssertionWrapper ass
254 ) {
255 put(TAG_ACTION, act);
256 put(TAG_SAML_ASSERTION, ass);
257 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
258 put(TAG_TOKEN_ELEMENT, ass.getElement());
259 }
260
261 public WSSecurityEngineResult(
262 int act,
263 Principal princ,
264 X509Certificate[] certs,
265 byte[] sv
266 ) {
267 put(TAG_ACTION, act);
268 put(TAG_PRINCIPAL, princ);
269 put(TAG_X509_CERTIFICATES, certs);
270 put(TAG_SIGNATURE_VALUE, sv);
271 if (certs != null && certs.length > 0) {
272 put(TAG_X509_CERTIFICATE, certs[0]);
273 }
274 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
275 }
276
277 public
278 WSSecurityEngineResult(
279 int act,
280 Principal princ,
281 X509Certificate[] certs,
282 List<WSDataRef> dataRefs,
283 byte[] sv
284 ) {
285 this(act, princ, certs, sv);
286 put(TAG_DATA_REF_URIS, dataRefs);
287 }
288
289 public WSSecurityEngineResult(
290 int act,
291 byte[] decryptedKey,
292 byte[] encryptedKeyBytes,
293 List<WSDataRef> dataRefUris
294 ) {
295 put(TAG_ACTION, act);
296 put(TAG_SECRET, decryptedKey);
297 put(TAG_ENCRYPTED_EPHEMERAL_KEY, encryptedKeyBytes);
298 put(TAG_DATA_REF_URIS, dataRefUris);
299 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
300 }
301
302 public WSSecurityEngineResult(
303 int act,
304 byte[] decryptedKey,
305 byte[] encryptedKeyBytes,
306 List<WSDataRef> dataRefUris,
307 X509Certificate[] certs
308 ) {
309 put(TAG_ACTION, act);
310 put(TAG_SECRET, decryptedKey);
311 put(TAG_ENCRYPTED_EPHEMERAL_KEY, encryptedKeyBytes);
312 put(TAG_DATA_REF_URIS, dataRefUris);
313 put(TAG_X509_CERTIFICATES, certs);
314 if (certs != null && certs.length > 0) {
315 put(TAG_X509_CERTIFICATE, certs[0]);
316 }
317 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
318 }
319
320 public WSSecurityEngineResult(int act, List<WSDataRef> dataRefUris) {
321 put(TAG_ACTION, act);
322 put(TAG_DATA_REF_URIS, dataRefUris);
323 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
324 }
325
326 public WSSecurityEngineResult(int act, Timestamp tstamp) {
327 put(TAG_ACTION, act);
328 put(TAG_TIMESTAMP, tstamp);
329 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
330 put(TAG_TOKEN_ELEMENT, tstamp.getElement());
331 }
332
333 public WSSecurityEngineResult(int act, SecurityContextToken sct) {
334 put(TAG_ACTION, act);
335 put(TAG_SECURITY_CONTEXT_TOKEN, sct);
336 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
337 put(TAG_TOKEN_ELEMENT, sct.getElement());
338 }
339
340 public WSSecurityEngineResult(int act, SignatureConfirmation sc) {
341 put(TAG_ACTION, act);
342 put(TAG_SIGNATURE_CONFIRMATION, sc);
343 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
344 put(TAG_TOKEN_ELEMENT, sc.getElement());
345 }
346
347 public WSSecurityEngineResult(int act, UsernameToken usernameToken) {
348 this(act, usernameToken, null);
349 }
350
351 public WSSecurityEngineResult(int act, UsernameToken usernameToken, Principal principal) {
352 put(TAG_ACTION, act);
353 put(TAG_USERNAME_TOKEN, usernameToken);
354 put(TAG_PRINCIPAL, principal);
355 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
356 put(TAG_TOKEN_ELEMENT, usernameToken.getElement());
357 }
358
359 public WSSecurityEngineResult(int act, BinarySecurity token, X509Certificate[] certs) {
360 put(TAG_ACTION, act);
361 put(TAG_BINARY_SECURITY_TOKEN, token);
362 put(TAG_X509_CERTIFICATES, certs);
363 if (certs != null && certs.length > 0) {
364 put(TAG_X509_CERTIFICATE, certs[0]);
365 }
366 put(TAG_VALIDATED_TOKEN, Boolean.FALSE);
367 put(TAG_TOKEN_ELEMENT, token.getElement());
368 }
369
370
371 }