8:53 a.m.
Author: klape
Date: 2013-09-13 02:53:02 -0400 (Fri, 13 Sep 2013)
New Revision: 17917
Modified:
thirdparty/cxf/branches/cxf-2.6.6.jbossorg-1-bz-1004624/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java
Log:
[BZ1004624] Fixing signed SAML assertion validation error w/ SupportingTokens only policy,
also adding some additional checks
Modified:
thirdparty/cxf/branches/cxf-2.6.6.jbossorg-1-bz-1004624/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java
===================================================================
---
thirdparty/cxf/branches/cxf-2.6.6.jbossorg-1-bz-1004624/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java 2013-09-13
06:44:16 UTC (rev 17916)
+++
thirdparty/cxf/branches/cxf-2.6.6.jbossorg-1-bz-1004624/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/SamlTokenInterceptor.java 2013-09-13
06:53:02 UTC (rev 17917)
@@ -23,6 +23,7 @@
import java.io.InputStream;
import java.net.URL;
import java.security.Principal;
+import java.security.cert.Certificate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@@ -45,6 +46,7 @@
import org.apache.cxf.message.MessageUtils;
import org.apache.cxf.resource.ResourceManager;
import org.apache.cxf.security.SecurityContext;
+import org.apache.cxf.security.transport.TLSSessionInfo;
import org.apache.cxf.ws.policy.AssertionInfo;
import org.apache.cxf.ws.policy.AssertionInfoMap;
import org.apache.cxf.ws.security.SecurityConstants;
@@ -113,6 +115,33 @@
}
assertTokens(message, SP12Constants.SAML_TOKEN, signed);
+ // Check version against policy
+ AssertionInfoMap aim = message.get(AssertionInfoMap.class);
+ for (AssertionInfo ai :
aim.getAssertionInfo(SP12Constants.SAML_TOKEN)) {
+ SamlToken samlToken = (SamlToken)ai.getAssertion();
+ for (WSSecurityEngineResult result : samlResults) {
+ AssertionWrapper assertionWrapper =
+
(AssertionWrapper)result.get(WSSecurityEngineResult.TAG_SAML_ASSERTION);
+
+ if (!checkVersion(samlToken, assertionWrapper)) {
+ ai.setNotAsserted("Wrong SAML Version");
+ }
+
+ TLSSessionInfo tlsInfo =
message.get(TLSSessionInfo.class);
+ Certificate[] tlsCerts = null;
+ if (tlsInfo != null) {
+ tlsCerts = tlsInfo.getPeerCertificates();
+ }
+ if (!SAMLUtils.checkHolderOfKey(assertionWrapper, null,
tlsCerts)) {
+ ai.setNotAsserted("Assertion fails holder-of-key
requirements");
+ continue;
+ }
+ if (!SAMLUtils.checkSenderVouches(assertionWrapper,
tlsCerts, null, null)) {
+ ai.setNotAsserted("Assertion fails
sender-vouches requirements");
+ continue;
+ }
+ }
+ }
Principal principal =
(Principal)samlResults.get(0).get(WSSecurityEngineResult.TAG_PRINCIPAL);
message.put(WSS4JInInterceptor.PRINCIPAL_RESULT, principal);
@@ -168,6 +197,8 @@
};
data.setWssConfig(WSSConfig.getNewInstance());
+ data.setSigCrypto(getCrypto(null, SecurityConstants.SIGNATURE_CRYPTO,
+ SecurityConstants.SIGNATURE_PROPERTIES, message));
SAMLTokenProcessor p = new SAMLTokenProcessor();
List<WSSecurityEngineResult> results =
p.handleToken(tokenElement, data, wsDocInfo);
@@ -339,4 +370,19 @@
return crypto;
}
+ /**
+ * Check the policy version against the received assertion
+ */
+ private boolean checkVersion(SamlToken samlToken, AssertionWrapper assertionWrapper)
{
+ if ((samlToken.isUseSamlVersion11Profile10()
+ || samlToken.isUseSamlVersion11Profile11())
+ && assertionWrapper.getSamlVersion() != SAMLVersion.VERSION_11) {
+ return false;
+ } else if (samlToken.isUseSamlVersion20Profile11()
+ && assertionWrapper.getSamlVersion() != SAMLVersion.VERSION_20) {
+ return false;
+ }
+ return true;
+ }
+
}