Author: anil.saldhana(a)jboss.com Date: 2009-01-22 15:38:25 -0500 (Thu, 22 Jan 2009) New Revision: 241 Added: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/interfaces/TrustKeyManager.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/KeyStoreKeyManager.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/SecurityActions.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/cert/SecurityActions.java identity-federation/trunk/identity-bindings/src/test/resources/config/test-config-3.xml Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/ObjectFactory.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/Provider.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/RedirectBindingSignatureUtil.java identity-federation/trunk/identity-bindings/src/main/resources/schema/config/jboss-identity-fed.xsd identity-federation/trunk/identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java Log: use config Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/ObjectFactory.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/ObjectFactory.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/ObjectFactory.java 2009-01-22 20:38:25 UTC (rev 241) @@ -33,6 +33,8 @@ private final static QName _JBossIDP_QNAME = new QName("urn:jboss:identity-federation:config:1.0", "JBossIDP"); + private final static QName _JBossSP_QNAME = new QName("urn:jboss:identity-federation:config:1.0", "JBossSP"); + /** * Create a new ObjectFactory that can be used to create new instances of schema derived classes for package: org.jboss.identity.federation.bindings.config * @@ -105,4 +107,12 @@ return new JAXBElement<IDP>(_JBossIDP_QNAME, IDP.class, null, value); } + /** + * Create an instance of {@link JAXBElement }{@code <}{@link SP }{@code >}} + * + */ + @XmlElementDecl(namespace = "urn:jboss:identity-federation:config:1.0", name = "JBossSP") + public JAXBElement<SP> createJBossSP(SP value) { + return new JAXBElement<SP>(_JBossSP_QNAME, SP.class, null, value); + } } Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/Provider.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/Provider.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/config/Provider.java 2009-01-22 20:38:25 UTC (rev 241) @@ -52,7 +52,7 @@ @XmlElement(name = "IdentityURL", required = true) protected String identityURL; - @XmlElement(name = "Trust", required = true) + @XmlElement(name = "Trust") protected Trust trust; @XmlElement(name = "KeyProvider") protected KeyProvider keyProvider; Added: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/interfaces/TrustKeyManager.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/interfaces/TrustKeyManager.java (rev 0) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/interfaces/TrustKeyManager.java 2009-01-22 20:38:25 UTC (rev 241) @@ -0,0 +1,41 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.bindings.interfaces; + +import java.security.PrivateKey; +import java.security.PublicKey; +import java.util.List; + +import org.jboss.identity.federation.bindings.config.AuthProperty; +import org.jboss.identity.federation.bindings.config.KeyValue; + +/** + * @author Anil.Saldhana(a)redhat.com + * @since Jan 22, 2009 + */ +public interface TrustKeyManager +{ + void setAuthProperties(List<AuthProperty> authList) throws Exception; + void setValidatingAlias(List<KeyValue> aliases) throws Exception; + PrivateKey getSigningKey() throws Exception; + PublicKey getValidatingKey(String domain) throws Exception; +} \ No newline at end of file Added: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/KeyStoreKeyManager.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/KeyStoreKeyManager.java (rev 0) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/KeyStoreKeyManager.java 2009-01-22 20:38:25 UTC (rev 241) @@ -0,0 +1,128 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.bindings.tomcat; + +import java.io.InputStream; +import java.security.KeyStore; +import java.security.PrivateKey; +import java.security.PublicKey; +import java.security.UnrecoverableKeyException; +import java.util.HashMap; +import java.util.List; + +import org.jboss.identity.federation.bindings.config.AuthProperty; +import org.jboss.identity.federation.bindings.config.KeyValue; +import org.jboss.identity.federation.bindings.interfaces.TrustKeyManager; +import org.jboss.identity.federation.bindings.util.ValveUtil; +import org.jboss.identity.federation.bindings.util.cert.KeyStoreUtil; + +/** + * KeyStore based Trust Key Manager + * @author Anil.Saldhana(a)redhat.com + * @since Jan 22, 2009 + */ +public class KeyStoreKeyManager implements TrustKeyManager +{ + private HashMap<String,String> domainAliasMap = new HashMap<String,String>(); + private HashMap<String,String> authPropsMap = new HashMap<String,String>(); + + private KeyStore ks = null; + + private String keyStoreURL; + private char[] signingKeyPass; + private String signingAlias; + private String keyStorePass; + + public static final String KEYSTORE_URL = "KeyStoreURL"; + public static final String KEYSTORE_PASS = "KeyStorePass"; + public static final String SIGNING_KEY_PASS = "SigningKeyPass"; + public static final String SIGNING_KEY_ALIAS = "SigningKeyAlias"; + + /** + * @see TrustKeyManager#getSigningKey() + */ + public PrivateKey getSigningKey() throws Exception + { + if(ks == null) + throw new IllegalStateException("KeyStore is null"); + return (PrivateKey) ks.getKey(this.signingAlias, this.signingKeyPass); + } + + /** + * @see TrustKeyManager#getValidatingKey(String) + */ + public PublicKey getValidatingKey(String domain) throws Exception + { + if(ks == null) + throw new IllegalStateException("KeyStore is null"); + String domainAlias = this.domainAliasMap.get(domain); + if(domainAlias == null) + throw new IllegalStateException("Domain Alias missing for "+ domain); + PublicKey publicKey = null; + try + { + publicKey = KeyStoreUtil.getPublicKey(ks, domainAlias, this.keyStorePass.toCharArray()); + } + catch(UnrecoverableKeyException urke) + { + //Try with the signing key pass + publicKey = KeyStoreUtil.getPublicKey(ks, domainAlias, this.signingKeyPass); + } + return publicKey; + } + + /** + * @see TrustKeyManager#setAuthProperties(List) + */ + public void setAuthProperties(List<AuthProperty> authList) throws Exception + { + for(AuthProperty auth: authList) + { + this.authPropsMap.put(auth.getKey(), auth.getValue()); + } + + this.keyStoreURL = this.authPropsMap.get(KEYSTORE_URL); + this.keyStorePass = this.authPropsMap.get(KEYSTORE_PASS); + + + this.signingAlias = this.authPropsMap.get(SIGNING_KEY_ALIAS); + + String keypass = this.authPropsMap.get(SIGNING_KEY_PASS); + if(keypass == null || keypass.length() == 0) + throw new RuntimeException("Signing Key Pass is null"); + this.signingKeyPass = keypass.toCharArray(); + + InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStoreURL); + ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); + } + + /** + * @see TrustKeyManager#setValidatingAlias(List) + */ + public void setValidatingAlias(List<KeyValue> aliases) + { + for(KeyValue alias: aliases) + { + domainAliasMap.put(alias.getKey(), alias.getValue()); + } + } +} \ No newline at end of file Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectValve.java 2009-01-22 20:38:25 UTC (rev 241) @@ -58,7 +58,7 @@ */ public class IDPRedirectValve extends ValveBase { - protected static Logger log = null; + private static Logger log = Logger.getLogger(IDPRedirectValve.class); ; private RoleGenerator rg = new TomcatRoleGenerator(); @@ -79,7 +79,6 @@ public IDPRedirectValve() { super(); - log = Logger.getLogger(IDPRedirectValve.class); } @Override Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/idp/IDPRedirectWithSignatureValve.java 2009-01-22 20:38:25 UTC (rev 241) @@ -21,17 +21,15 @@ */ package org.jboss.identity.federation.bindings.tomcat.idp; -import java.io.File; -import java.io.FileInputStream; import java.io.InputStream; -import java.net.URL; import java.security.KeyStore; import java.security.PrivateKey; import java.security.PublicKey; -import org.apache.catalina.connector.Request; +import org.apache.catalina.connector.Request; import org.apache.log4j.Logger; import org.jboss.identity.federation.bindings.util.RedirectBindingSignatureUtil; +import org.jboss.identity.federation.bindings.util.ValveUtil; import org.jboss.identity.federation.bindings.util.cert.KeyStoreUtil; import org.jboss.identity.federation.core.saml.v2.util.SignatureUtil; @@ -44,6 +42,7 @@ */ public class IDPRedirectWithSignatureValve extends IDPRedirectValve { + private static Logger log = Logger.getLogger(IDPRedirectWithSignatureValve.class); private String keyStore; private char[] keypass; private String alias; @@ -55,8 +54,7 @@ public IDPRedirectWithSignatureValve() { - super(); - log = Logger.getLogger(IDPRedirectWithSignatureValve.class); + super(); } public void setIgnoreSignature(String val) @@ -140,38 +138,12 @@ } } - private InputStream getKeyStoreInputStream() - { - InputStream is = null; - - try - { - //Try the file method - File file = new File(keyStore); - is = new FileInputStream(file); - } - catch(Exception e) - { - try - { - URL url = new URL(keyStore); - is = url.openStream(); - } - catch(Exception ex) - { - is = SecurityActions.getContextClassLoader().getResourceAsStream(keyStore); - } - } - if(is == null) - throw new RuntimeException("Keystore not located"); - return is; - } protected PrivateKey getSigningKey() throws Exception { if(ks == null) { - InputStream is = this.getKeyStoreInputStream(); + InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStore); ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); } return (PrivateKey) ks.getKey(alias, keypass); @@ -181,7 +153,7 @@ { if(ks == null) { - InputStream is = this.getKeyStoreInputStream(); + InputStream is = ValveUtil.getKeyStoreInputStream(this.keyStore); ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); } return KeyStoreUtil.getPublicKey(ks, alias, keypass); Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectFormAuthenticator.java 2009-01-22 20:38:25 UTC (rev 241) @@ -28,6 +28,7 @@ import javax.servlet.ServletException; +import org.apache.catalina.LifecycleException; import org.apache.catalina.Session; import org.apache.catalina.authenticator.Constants; import org.apache.catalina.authenticator.FormAuthenticator; @@ -40,10 +41,12 @@ import org.jboss.identity.federation.api.saml.v2.response.SAML2Response; import org.jboss.identity.federation.api.util.Base64; import org.jboss.identity.federation.api.util.DeflateUtil; +import org.jboss.identity.federation.bindings.config.SP; import org.jboss.identity.federation.bindings.jboss.DefaultJBossSubjectRegistration; import org.jboss.identity.federation.bindings.jboss.JBossSubjectRegistration; import org.jboss.identity.federation.bindings.util.HTTPRedirectUtil; import org.jboss.identity.federation.bindings.util.RedirectBindingUtil; +import org.jboss.identity.federation.bindings.util.ValveUtil; import org.jboss.identity.federation.core.saml.v2.exceptions.AssertionExpiredException; import org.jboss.identity.federation.saml.v2.protocol.AuthnRequestType; import org.jboss.identity.federation.saml.v2.protocol.ResponseType; @@ -56,10 +59,13 @@ * @author Anil.Saldhana(a)redhat.com * @since Dec 12, 2008 */ -public class SPRedirectFormAuthenticator extends FormAuthenticator +public class SPRedirectFormAuthenticator extends FormAuthenticator { - protected static Logger log = null; + + private static Logger log = Logger.getLogger(SPRedirectFormAuthenticator.class); + protected SP spConfiguration = null; + private String serviceURL = null; private String identityURL = null; @@ -68,20 +74,9 @@ public SPRedirectFormAuthenticator() { - super(); - log = Logger.getLogger(SPRedirectFormAuthenticator.class); - } + super(); + } - public void setIdentityURL(String url) - { - this.identityURL = url; - } - - public void setServiceURL(String url) - { - this.serviceURL = url; - } - /** * For JBoss Deployment, you can change the value of * the {@code}JBossSubjectRegistration class @@ -94,6 +89,27 @@ Class<?> clazz = tcl.loadClass(fqn); this.jbossRegistration = (JBossSubjectRegistration) clazz.newInstance(); } + + @Override + public void start() throws LifecycleException + { + String configFile = "WEB-INF/jboss-idfed.xml"; + super.start(); + InputStream is = context.getServletContext().getResourceAsStream(configFile); + if(is == null) + throw new RuntimeException(configFile + " missing"); + try + { + spConfiguration = ValveUtil.getSPConfiguration(is); + this.identityURL = spConfiguration.getIdentityURL(); + this.serviceURL = spConfiguration.getServiceURL(); + log.trace("Identity Provider URL=" + this.identityURL); + } + catch (Exception e) + { + throw new RuntimeException(e); + } + } @Override public boolean authenticate(Request request, Response response, LoginConfig loginConfig) throws IOException Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/tomcat/sp/SPRedirectSignatureFormAuthenticator.java 2009-01-22 20:38:25 UTC (rev 241) @@ -21,18 +21,15 @@ */ package org.jboss.identity.federation.bindings.tomcat.sp; -import java.io.File; -import java.io.FileInputStream; -import java.io.InputStream; -import java.net.URL; -import java.security.KeyStore; import java.security.PrivateKey; import java.security.PublicKey; +import org.apache.catalina.LifecycleException; import org.apache.catalina.connector.Request; import org.apache.log4j.Logger; +import org.jboss.identity.federation.bindings.config.KeyProvider; +import org.jboss.identity.federation.bindings.interfaces.TrustKeyManager; import org.jboss.identity.federation.bindings.util.RedirectBindingSignatureUtil; -import org.jboss.identity.federation.bindings.util.cert.KeyStoreUtil; import org.jboss.identity.federation.core.saml.v2.util.SignatureUtil; /** @@ -43,37 +40,40 @@ */ public class SPRedirectSignatureFormAuthenticator extends SPRedirectFormAuthenticator { - private String keyStore; - private char[] keypass; - private String alias; - private String keyStorePass; + private static Logger log = Logger.getLogger(SPRedirectSignatureFormAuthenticator.class); + + private TrustKeyManager keyManager; public SPRedirectSignatureFormAuthenticator() { - super(); - log = Logger.getLogger(SPRedirectSignatureFormAuthenticator.class); + super(); } - public void setKeyStore(String keyStore) + @Override + public void start() throws LifecycleException { - this.keyStore = keyStore; + super.start(); + KeyProvider keyProvider = this.spConfiguration.getKeyProvider(); + try + { + ClassLoader tcl = SecurityActions.getContextClassLoader(); + String keyManagerClassName = keyProvider.getClassName(); + if(keyManagerClassName == null) + throw new RuntimeException("KeyManager class name is null"); + + Class<?> clazz = tcl.loadClass(keyManagerClassName); + this.keyManager = (TrustKeyManager) clazz.newInstance(); + keyManager.setAuthProperties(keyProvider.getAuth()); + keyManager.setValidatingAlias(keyProvider.getValidatingAlias()); + } + catch(Exception e) + { + log.error("Exception reading configuration:",e); + throw new LifecycleException(e.getLocalizedMessage()); + } + log.trace("Key Provider=" + keyProvider.getClassName()); } - public void setKeyStorePass(String keyStorePass) - { - this.keyStorePass = keyStorePass; - } - - public void setKeyPass(String keypass) - { - this.keypass = keypass.toCharArray(); - } - - public void setAlias(String alias) - { - this.alias = alias; - } - protected boolean validate(Request request) throws Exception { boolean result = super.validate(request); @@ -100,7 +100,7 @@ } sb.append("&SigAlg=").append(sigAlgFromURL); - PublicKey validatingKey = getValidatingKey(); + PublicKey validatingKey = keyManager.getValidatingKey(request.getRemoteAddr()); boolean isValid = SignatureUtil.validate(sb.toString().getBytes("UTF-8"), sigValue, validatingKey); return isValid; } @@ -111,7 +111,7 @@ try { //Get the signing key - PrivateKey signingKey = getSigningKey(); + PrivateKey signingKey = keyManager.getSigningKey(); StringBuffer sb = new StringBuffer(); String url = RedirectBindingSignatureUtil.getSAMLRequestURLWithSignature(urlEncodedRequest, urlEncodedRelayState, signingKey); sb.append("?").append(url); @@ -122,45 +122,4 @@ throw new RuntimeException(e); } } - - private InputStream getKeyStoreInputStream() - { - InputStream is = null; - - try - { - //Try the file method - File file = new File(keyStore); - is = new FileInputStream(file); - } - catch(Exception e) - { - try - { - URL url = new URL(keyStore); - is = url.openStream(); - } - catch(Exception ex) - { - is = SecurityActions.getContextClassLoader().getResourceAsStream(keyStore); - } - } - if(is == null) - throw new RuntimeException("Keystore not located"); - return is; - } - - protected PrivateKey getSigningKey() throws Exception - { - InputStream is = this.getKeyStoreInputStream(); - KeyStore ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); - return (PrivateKey) ks.getKey(alias, keypass); - } - - protected PublicKey getValidatingKey() throws Exception - { - InputStream is = this.getKeyStoreInputStream(); - KeyStore ks = KeyStoreUtil.getKeyStore(is, keyStorePass.toCharArray()); - return KeyStoreUtil.getPublicKey(ks, alias, keypass); - } } \ No newline at end of file Modified: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/RedirectBindingSignatureUtil.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/RedirectBindingSignatureUtil.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/RedirectBindingSignatureUtil.java 2009-01-22 20:38:25 UTC (rev 241) @@ -151,7 +151,8 @@ public static byte[] getSignatureValueFromSignedURL(String signedURL) throws Exception { String sigValueTokenValue = getTokenValue(signedURL,"Signature"); - + if(sigValueTokenValue == null) + throw new IllegalArgumentException("Signature Token is not present"); return RedirectBindingUtil.urlBase64Decode(sigValueTokenValue); } Added: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/SecurityActions.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/SecurityActions.java (rev 0) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/SecurityActions.java 2009-01-22 20:38:25 UTC (rev 241) @@ -0,0 +1,48 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.bindings.util.cert; + +import java.security.AccessController; +import java.security.PrivilegedAction; + +/** + * Privileged Blocks + * @author Anil.Saldhana(a)redhat.com + * @since Dec 9, 2008 + */ +class SecurityActions +{ + /** + * Get the Thread Context ClassLoader + * @return + */ + static ClassLoader getContextClassLoader() + { + return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() + { + public ClassLoader run() + { + return Thread.currentThread().getContextClassLoader(); + } + }); + } +} Added: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java (rev 0) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/ValveUtil.java 2009-01-22 20:38:25 UTC (rev 241) @@ -0,0 +1,85 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.bindings.util; + +import java.io.File; +import java.io.FileInputStream; +import java.io.InputStream; +import java.net.URL; + +import javax.xml.bind.JAXBElement; +import javax.xml.bind.Unmarshaller; + +import org.jboss.identity.federation.bindings.config.SP; +import org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLBaseFactory; + +/** + * Util for tomcat valves + * @author Anil.Saldhana(a)redhat.com + * @since Jan 22, 2009 + */ +public class ValveUtil +{ + /** + * Seek the input stream to the KeyStore + * @param keyStore + * @return + */ + public static InputStream getKeyStoreInputStream(String keyStore) + { + InputStream is = null; + + try + { + //Try the file method + File file = new File(keyStore); + is = new FileInputStream(file); + } + catch(Exception e) + { + try + { + URL url = new URL(keyStore); + is = url.openStream(); + } + catch(Exception ex) + { + is = SecurityActions.getContextClassLoader().getResourceAsStream(keyStore); + } + } + if(is == null) + throw new RuntimeException("Keystore not located"); + return is; + } + + @SuppressWarnings("unchecked") + public static SP getSPConfiguration(InputStream is) throws Exception + { + if(is == null) + throw new IllegalArgumentException("inputstream is null"); + String schema = "schema/config/jboss-identity-fed.xsd"; + + Unmarshaller un = JBossSAMLBaseFactory.getValidatingUnmarshaller("org.jboss.identity.federation.bindings.config", schema); + JAXBElement<SP> jaxbSp = (JAXBElement<SP>) un.unmarshal(is); + return jaxbSp.getValue(); + } +} \ No newline at end of file Added: identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/cert/SecurityActions.java =================================================================== --- identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/cert/SecurityActions.java (rev 0) +++ identity-federation/trunk/identity-bindings/src/main/java/org/jboss/identity/federation/bindings/util/cert/SecurityActions.java 2009-01-22 20:38:25 UTC (rev 241) @@ -0,0 +1,48 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2008, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.identity.federation.bindings.util.cert; + +import java.security.AccessController; +import java.security.PrivilegedAction; + +/** + * Privileged Blocks + * @author Anil.Saldhana(a)redhat.com + * @since Dec 9, 2008 + */ +class SecurityActions +{ + /** + * Get the Thread Context ClassLoader + * @return + */ + static ClassLoader getContextClassLoader() + { + return AccessController.doPrivileged(new PrivilegedAction<ClassLoader>() + { + public ClassLoader run() + { + return Thread.currentThread().getContextClassLoader(); + } + }); + } +} Modified: identity-federation/trunk/identity-bindings/src/main/resources/schema/config/jboss-identity-fed.xsd =================================================================== --- identity-federation/trunk/identity-bindings/src/main/resources/schema/config/jboss-identity-fed.xsd 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/main/resources/schema/config/jboss-identity-fed.xsd 2009-01-22 20:38:25 UTC (rev 241) @@ -88,7 +88,7 @@ minOccurs="1"> </element> <element name="Trust" type="tns:Trust" maxOccurs="1" - minOccurs="1"> + minOccurs="0"> </element> <element name="KeyProvider" type="tns:KeyProvider" maxOccurs="1" minOccurs="0"> @@ -114,4 +114,6 @@ <extension base="tns:KeyValue"></extension> </complexContent> </complexType> + + <element name="JBossSP" type="tns:SP"></element> </schema> \ No newline at end of file Modified: identity-federation/trunk/identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java =================================================================== --- identity-federation/trunk/identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java 2009-01-22 18:14:45 UTC (rev 240) +++ identity-federation/trunk/identity-bindings/src/test/java/org/jboss/test/identity/federation/bindings/config/ConfigUnitTestCase.java 2009-01-22 20:38:25 UTC (rev 241) @@ -33,6 +33,7 @@ import org.jboss.identity.federation.bindings.config.IDP; import org.jboss.identity.federation.bindings.config.KeyProvider; import org.jboss.identity.federation.bindings.config.KeyValue; +import org.jboss.identity.federation.bindings.config.SP; import org.jboss.identity.federation.bindings.config.Trust; import org.jboss.identity.federation.core.saml.v2.factories.JBossSAMLBaseFactory; @@ -94,7 +95,28 @@ assertTrue("jboss.com trusted", domains.indexOf("jboss.com") > -1); } + public void test03() throws Exception + { + SP sp = getSP(config + "3.xml"); + assertEquals("http://localhost:8080/idp", sp.getIdentityURL()); + assertEquals("http://localhost:8080/sales", sp.getServiceURL()); + } + @SuppressWarnings("unchecked") + private SP getSP(String configFile) throws Exception + { + String schema = "schema/config/jboss-identity-fed.xsd"; + + ClassLoader tcl = Thread.currentThread().getContextClassLoader(); + InputStream is = tcl.getResourceAsStream(configFile); + assertNotNull("Inputstream not null", is); + + Unmarshaller un = JBossSAMLBaseFactory.getValidatingUnmarshaller("org.jboss.identity.federation.bindings.config", schema); + JAXBElement<SP> jaxbSp = (JAXBElement<SP>) un.unmarshal(is); + assertNotNull("SP is not null", jaxbSp); + return jaxbSp.getValue(); + } + @SuppressWarnings("unchecked") private IDP getIDP(String configFile) throws Exception { String schema = "schema/config/jboss-identity-fed.xsd"; Added: identity-federation/trunk/identity-bindings/src/test/resources/config/test-config-3.xml =================================================================== --- identity-federation/trunk/identity-bindings/src/test/resources/config/test-config-3.xml (rev 0) +++ identity-federation/trunk/identity-bindings/src/test/resources/config/test-config-3.xml 2009-01-22 20:38:25 UTC (rev 241) @@ -0,0 +1,14 @@ +<JBossSP xmlns="urn:jboss:identity-federation:config:1.0"> +<IdentityURL>http://localhost:8080/idp</IdentityURL> +<Trust> + <Domains>localhost,jboss.com,jboss.org</Domains> +</Trust> +<KeyProvider ClassName="SomeClass"> + <Auth Key="SomeKey" Value="SomeValue" /> + <Auth Key="DBURL" Value="SomeDBURL" /> + <ValidatingAlias Key="localhost" Value="localhostalias"/> + <ValidatingAlias Key="jboss.com" Value="jbossalias"/> +</KeyProvider> + +<ServiceURL>http://localhost:8080/sales</ServiceURL> +</JBossSP> \ No newline at end of file