Author: alessio.soldano(a)jboss.com Date: 2010-12-13 17:26:58 -0500 (Mon, 13 Dec 2010) New Revision: 13479 Added: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/SecurityDomain.java stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/Hello.java stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/HelloJavaBean.java stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/JBWS3182TestCase.java stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-service.xml stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-client.xml stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-server.xml stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/wsse.keystore stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/wsse.truststore Modified: stack/native/branches/JBPAPP-5575/modules/core/pom.xml stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/SignatureOperation.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Encrypt.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Sign.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java stack/native/branches/JBPAPP-5575/modules/core/src/main/resources/schema/jboss-ws-security_1_0.xsd stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/scripts/build-jars-jaxws.xml stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxrpc/wsse/RoundTripTestCase.java Log: [JBPAPP-5575] Pushing temporary "v2" patch to svn; requires patches jbosssx for building Modified: stack/native/branches/JBPAPP-5575/modules/core/pom.xml =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/pom.xml 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/pom.xml 2010-12-13 22:26:58 UTC (rev 13479) @@ -20,6 +20,14 @@ <!-- Dependencies --> <dependencies> + + <!-- to be replaced, can't directly depend on AS specific stuff here --> + <dependency> + <groupId>org.jboss.jbossas</groupId> + <artifactId>jboss-as-security</artifactId> + <version>5.1.0.GA</version> + </dependency> + <!-- jbossws dependencies --> <dependency> <groupId>org.jboss.ws</groupId> Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/SecurityStore.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -47,11 +47,18 @@ import java.util.Enumeration; import java.util.HashMap; import java.util.List; +import java.util.Properties; import java.util.StringTokenizer; +import javax.naming.InitialContext; +import javax.naming.NamingException; + import org.jboss.logging.Logger; +import org.jboss.security.plugins.JaasSecurityDomain; import org.jboss.ws.extensions.security.exception.FailedAuthenticationException; import org.jboss.ws.extensions.security.exception.WSSecurityException; +import org.jboss.ws.metadata.wsse.SecurityDomain; +import org.jboss.ws.metadata.wsse.WSSecurityConfiguration; /** * <code>SecurityStore</code> holds and loads the keystore and truststore required for encyption and signing. @@ -74,26 +81,83 @@ private HashMap<String, String> keyPasswords; + private JaasSecurityDomain sd; + + private String securityDomainAuthToken; + + private boolean useSecurityDomainAliases; + public SecurityStore() throws WSSecurityException { - this(null, null, null, null, null, null, null); + loadKeyStore(null, null, null); + loadTrustStore(null, null, null); } - - public SecurityStore(URL keyStoreURL, String keyStoreType, String keyStorePassword, HashMap<String, String> keyPasswords) throws WSSecurityException + + public SecurityStore(WSSecurityConfiguration conf) throws WSSecurityException { - loadKeyStore(keyStoreURL, keyStoreType, keyStorePassword); - loadTrustStore(keyStoreURL, keyStoreType, keyStorePassword); - this.keyPasswords = keyPasswords; - } + if (conf == null) + { + return; + } - public SecurityStore(URL keyStoreURL, String keyStoreType, String keyStorePassword, HashMap<String, String> keyPasswords, URL trustStoreURL, String trustStoreType, String trustStorePassword) - throws WSSecurityException - { - loadKeyStore(keyStoreURL, keyStoreType, keyStorePassword); - loadTrustStore(trustStoreURL, trustStoreType, trustStorePassword); - this.keyPasswords = keyPasswords; + SecurityDomain securityDomainConf = conf.getSecurityDomain(); + if (securityDomainConf != null) + { + + String securityDomainJndiName = securityDomainConf.getJndi(); + // this takes precedence + InitialContext ic = null; + try + { + ic = new InitialContext(); + + Object o = ic.lookup(securityDomainJndiName); + + if (!(o instanceof JaasSecurityDomain)) + { + throw new WSSecurityException(securityDomainJndiName + " not bound to a JaasSecurityDomain but to a " + o.getClass().getName() + " instance"); + } + + sd = (JaasSecurityDomain)o; + } + catch (NamingException e) + { + throw new WSSecurityException("JNDI failure handling " + securityDomainJndiName, e); + } + finally + { + if (ic != null) + { + try + { + ic.close(); + } + catch (NamingException e) + { + log.warn(this + " failed to close InitialContext", e); + } + } + } + // if we reached this point, means we have a JNDI name pointing to a valid JAAS Security Domain + keyStore = sd.getKeyStore(); + trustStore = sd.getTrustStore(); + securityDomainAuthToken = securityDomainConf.getAuthToken(); + useSecurityDomainAliases = securityDomainConf.isUseSecurityDomainAliases(); + } + else + { + URL keyStoreURL = conf.getKeyStoreURL(); + String keyStoreType = conf.getKeyStoreType(); + String keyStorePassword = conf.getKeyStorePassword(); + URL trustStoreURL = conf.getTrustStoreURL(); + String trustStoreType = conf.getTrustStoreType(); + String trustStorePassword = conf.getTrustStorePassword(); + + loadKeyStore(keyStoreURL, keyStoreType, keyStorePassword); + loadTrustStore(trustStoreURL, trustStoreType, trustStorePassword); + } } - + private void loadKeyStore(URL keyStoreURL, String keyStoreType, String keyStorePassword) throws WSSecurityException { if (keyStorePassword == null) @@ -327,7 +391,7 @@ return identifier; } - public X509Certificate getCertificate(String alias) throws WSSecurityException + public X509Certificate getCertificate(String alias, String securityDomainAliasLabel) throws WSSecurityException { if (keyStore == null) { @@ -337,7 +401,7 @@ X509Certificate cert; try { - cert = (X509Certificate)keyStore.getCertificate(alias); + cert = (X509Certificate)keyStore.getCertificate(resolveAlias(alias, securityDomainAliasLabel)); } catch (Exception e) { @@ -350,6 +414,16 @@ return cert; } + private String resolveAlias(String alias, String label) + { + if (useSecurityDomainAliases && label != null) + { + Properties props = sd.getAdditionalOptions(); + return props.getProperty(label); + } + return alias; + } + public X509Certificate getCertificateByPublicKey(PublicKey key) throws WSSecurityException { if (key == null) @@ -449,20 +523,27 @@ return null; } - public PrivateKey getPrivateKey(String alias) throws WSSecurityException + public PrivateKey getPrivateKey(String alias, String securityDomainAliasLabel) throws WSSecurityException { if (keyStore == null) { throw new WSSecurityException("KeyStore not set."); } - + PrivateKey key; try { - String password = keyStorePassword; - if (keyPasswords != null && keyPasswords.containsKey(alias)) - password = keyPasswords.get(alias); - key = (PrivateKey)keyStore.getKey(alias, decryptPassword(password).toCharArray()); + if (sd == null) + { + String password = keyStorePassword; + if (keyPasswords != null && keyPasswords.containsKey(alias)) + password = keyPasswords.get(alias); + key = (PrivateKey)keyStore.getKey(alias, decryptPassword(password).toCharArray()); + } + else + { + key = (PrivateKey)sd.getKey(resolveAlias(alias, securityDomainAliasLabel), securityDomainAuthToken); + } } catch (Exception e) { @@ -485,7 +566,7 @@ try { String alias = keyStore.getCertificateAlias(cert); - return getPrivateKey(alias); + return getPrivateKey(alias, null); } catch (Exception e) { Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/WSSecurityDispatcher.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -117,8 +117,7 @@ private void decodeHeader(WSSecurityConfiguration configuration, Config config, SOAPMessage message, Element secHeaderElement) throws WSSecurityException { - SecurityStore securityStore = new SecurityStore(configuration.getKeyStoreURL(), configuration.getKeyStoreType(), configuration.getKeyStorePassword(), - configuration.getKeyPasswords(), configuration.getTrustStoreURL(), configuration.getTrustStoreType(), configuration.getTrustStorePassword()); + SecurityStore securityStore = new SecurityStore(configuration); NonceFactory factory = Util.loadFactory(NonceFactory.class, configuration.getNonceFactory(), DefaultNonceFactory.class); Authenticate authenticate = null; @@ -193,14 +192,15 @@ targets.add(new WsuIdTarget("timestamp")); } - operations.add(new SignatureOperation(targets, sign.getAlias(), sign.getTokenRefType())); + operations.add(new SignatureOperation(targets, sign.getAlias(), sign.getTokenRefType(), sign.getSecurityDomainAliasLabel())); } Encrypt encrypt = config.getEncrypt(); if (encrypt != null) { List<Target> targets = convertTargets(encrypt.getTargets()); - operations.add(new EncryptionOperation(targets, encrypt.getAlias(), encrypt.getAlgorithm(), encrypt.getWrap(), encrypt.getTokenRefType())); + operations.add(new EncryptionOperation(targets, encrypt.getAlias(), encrypt.getAlgorithm(), encrypt.getWrap(), encrypt.getTokenRefType(), encrypt + .getSecurityDomainAliasLabel())); } if (operations.size() == 0) @@ -211,8 +211,7 @@ try { - SecurityStore securityStore = new SecurityStore(configuration.getKeyStoreURL(), configuration.getKeyStoreType(), configuration.getKeyStorePassword(), - configuration.getKeyPasswords(), configuration.getTrustStoreURL(), configuration.getTrustStoreType(), configuration.getTrustStorePassword()); + SecurityStore securityStore = new SecurityStore(configuration); SecurityEncoder encoder = new SecurityEncoder(operations, securityStore); if ((sign != null || encrypt != null) && message instanceof SOAPMessageImpl) Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/EncryptionOperation.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -58,6 +58,7 @@ private String algorithm; private String wrap; private String tokenRefType; + private String securityDomainAliasLabel; private static class Algorithm { @@ -86,7 +87,7 @@ algorithms.put("tripledes", new Algorithm("TripleDes", XMLCipher.TRIPLEDES, 168)); } - public EncryptionOperation(List<Target> targets, String alias, String algorithm, String wrap, String tokenRefType) + public EncryptionOperation(List<Target> targets, String alias, String algorithm, String wrap, String tokenRefType, String securityDomainAliasLabel) { super(); this.targets = targets; @@ -94,6 +95,7 @@ this.algorithm = algorithm; this.wrap = wrap; this.tokenRefType = tokenRefType; + this.securityDomainAliasLabel = securityDomainAliasLabel; } private void processTarget(XMLCipher cipher, Document message, Target target, ReferenceList list, SecretKey key) throws WSSecurityException @@ -172,7 +174,7 @@ processTarget(cipher, message, target, list, secretKey); } - X509Certificate cert = getCertificate(store, alias); + X509Certificate cert = getCertificate(store, alias, securityDomainAliasLabel); X509Token token = (X509Token) header.getSharedToken(cert); // Can we reuse an existing token? @@ -188,12 +190,12 @@ } @SuppressWarnings("unchecked") - private X509Certificate getCertificate(SecurityStore store, String alias) throws WSSecurityException + private X509Certificate getCertificate(SecurityStore store, String alias, String secDomainLabel) throws WSSecurityException { X509Certificate cert = null; - if (alias != null) + if (alias != null || secDomainLabel != null) { - cert = store.getCertificate(alias); + cert = store.getCertificate(alias, secDomainLabel); if (cert == null) throw new WSSecurityException("Cannot load certificate from keystore; alias = " + alias); } Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/SignatureOperation.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/SignatureOperation.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/extensions/security/operation/SignatureOperation.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -55,13 +55,15 @@ private List<Target> targets; private String alias; private String tokenRefType; + private String securityDomainAliasLabel; - public SignatureOperation(List<Target> targets, String alias, String tokenRefType) + public SignatureOperation(List<Target> targets, String alias, String tokenRefType, String securityDomainAliasLabel) { super(); this.targets = targets; this.alias = alias; this.tokenRefType = tokenRefType; + this.securityDomainAliasLabel = securityDomainAliasLabel; } private void processTarget(XMLSignature sig, Document message, Target target) @@ -144,7 +146,7 @@ // For now we pass our resolver the root document because the signature element isn't attached // to the evelope yet (no wsse header). Perhaps we should do this differently sig.addResourceResolver(new WsuIdResolver(message, header.getElement())); - PrivateKey key = store.getPrivateKey(alias); + PrivateKey key = store.getPrivateKey(alias, securityDomainAliasLabel); if (targets == null || targets.size() == 0) { @@ -169,7 +171,7 @@ throw new WSSecurityException("Error signing message: " + e.getMessage(), e); } - X509Certificate cert = store.getCertificate(alias); + X509Certificate cert = store.getCertificate(alias, securityDomainAliasLabel); X509Token token = (X509Token) header.getSharedToken(cert); // Can we reuse an existing token? Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Encrypt.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Encrypt.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Encrypt.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -38,14 +38,16 @@ private String algorithm; private String keyWrapAlgorithm; private String tokenRefType; + private String securityDomainAliasLabel; - public Encrypt(String type, String alias, String algorithm, String wrap, String tokenRefType) + public Encrypt(String type, String alias, String algorithm, String wrap, String tokenRefType, String securityDomainAliasLabel) { this.type = type; this.alias = alias; this.algorithm = algorithm; this.keyWrapAlgorithm = wrap; this.tokenRefType = tokenRefType; + this.securityDomainAliasLabel = securityDomainAliasLabel; } public String getAlias() @@ -97,4 +99,14 @@ { this.tokenRefType = tokenRefType; } + + public String getSecurityDomainAliasLabel() + { + return securityDomainAliasLabel; + } + + public void setSecurityDomainAliasLabel(String securityDomainAliasLabel) + { + this.securityDomainAliasLabel = securityDomainAliasLabel; + } } Added: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/SecurityDomain.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/SecurityDomain.java (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/SecurityDomain.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,76 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2006, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.ws.metadata.wsse; + +import java.io.Serializable; + +/** + * <code>SecurityDomain</code> allows for getting ws-security configuration + * from a centralized location being a JAAS security domain. + * + * @author <a href="mailto:alessio.soldano@jboss.com">Alessio Soldano</a> + */ +public class SecurityDomain implements Serializable +{ + private static final long serialVersionUID = -3366230588863800636L; + + private String jndi; + private String authToken; + private boolean useSecurityDomainAliases; + + public SecurityDomain(String jndi, String authToken, boolean useSecurityDomainAliases) + { + this.jndi = jndi; + this.authToken = authToken; + this.useSecurityDomainAliases = useSecurityDomainAliases; + } + + public String getJndi() + { + return jndi; + } + + public void setJndi(String jndi) + { + this.jndi = jndi; + } + + public String getAuthToken() + { + return authToken; + } + + public void setAuthToken(String authToken) + { + this.authToken = authToken; + } + + public boolean isUseSecurityDomainAliases() + { + return useSecurityDomainAliases; + } + + public void setUseSecurityDomainAliases(boolean useSecurityDomainAliases) + { + this.useSecurityDomainAliases = useSecurityDomainAliases; + } +} Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Sign.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Sign.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/Sign.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -35,13 +35,15 @@ private String alias; private boolean includeTimestamp; private String tokenRefType; + private String securityDomainAliasLabel; - public Sign(String type, String alias, boolean includeTimestamp, String tokenRefType) + public Sign(String type, String alias, boolean includeTimestamp, String tokenRefType, String securityDomainAliasLabel) { this.type = type; this.alias = alias; this.includeTimestamp = includeTimestamp; this.tokenRefType = tokenRefType; + this.securityDomainAliasLabel = securityDomainAliasLabel; } public String getAlias() @@ -83,4 +85,14 @@ { this.tokenRefType = tokenRefType; } + + public String getSecurityDomainAliasLabel() + { + return securityDomainAliasLabel; + } + + public void setSecurityDomainAliasLabel(String securityDomainAliasLabel) + { + this.securityDomainAliasLabel = securityDomainAliasLabel; + } } Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityConfiguration.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -47,6 +47,7 @@ private HashMap<String, String> keyPasswords = new HashMap<String, String>(); private String nonceFactory; private TimestampVerification timestampVerification; + private SecurityDomain securityDomain; public WSSecurityConfiguration() { @@ -186,5 +187,14 @@ { this.timestampVerification = timestampVerification; } + + public SecurityDomain getSecurityDomain() + { + return securityDomain; + } + public void setSecurityDomain(SecurityDomain securityDomain) + { + this.securityDomain = securityDomain; + } } Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/java/org/jboss/ws/metadata/wsse/WSSecurityOMFactory.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -38,7 +38,7 @@ import org.xml.sax.Attributes; /** - * A JBossXB Object Model Factory that represets a JBoss WS-Security + * A JBossXB Object Model Factory that represents a JBoss WS-Security * configuration. See the jboss-ws-security_1_0.xsd file for more info. * * @author <a href="mailto:jason.greene@jboss.com">Jason T. Greene</a> @@ -54,6 +54,7 @@ static { + options.put("security-domain", "setSecurityDomain"); options.put("key-store-file", "setKeyStoreFile"); options.put("key-store-type", "setKeyStoreType"); options.put("key-store-password", "setKeyStorePassword"); @@ -206,6 +207,16 @@ return new TimestampVerification(createdTolerance, warnCreated, expiresTolerance, warnExpires); } + if ("security-domain".equals(localName)) + { + String jndi = attrs.getValue("", "jndi"); + String authToken = attrs.getValue("", "authToken"); + String useSecurityDomainAliasesAttr = attrs.getValue("", "useSecurityDomainAliases"); + Boolean useSecurityDomainAliases = new Boolean(true); + if (useSecurityDomainAliasesAttr != null) + useSecurityDomainAliases = (Boolean)SimpleTypeBindings.unmarshal(SimpleTypeBindings.XS_BOOLEAN_NAME, useSecurityDomainAliasesAttr, null); + return new SecurityDomain(jndi, authToken, useSecurityDomainAliases); + } return null; } @@ -253,6 +264,16 @@ } /** + * Called when parsing SecurityDomain is complete. + */ + public void addChild(WSSecurityConfiguration configuration, SecurityDomain securityDomain, UnmarshallingContext navigator, String namespaceURI, + String localName) + { + log.trace("addChild: [obj=" + configuration + ",child=" + securityDomain + "]"); + configuration.setSecurityDomain(securityDomain); + } + + /** * Called when parsing of a new element started. */ public Object newChild(Config config, UnmarshallingContext navigator, String namespaceURI, String localName, Attributes attrs) @@ -266,12 +287,13 @@ if (timestamp != null) include = (Boolean)SimpleTypeBindings.unmarshal(SimpleTypeBindings.XS_BOOLEAN_NAME, timestamp, null); - return new Sign(attrs.getValue("", "type"), attrs.getValue("", "alias"), include.booleanValue(), attrs.getValue("", "tokenReference")); + return new Sign(attrs.getValue("", "type"), attrs.getValue("", "alias"), include.booleanValue(), attrs.getValue("", "tokenReference"), attrs.getValue("", + "securityDomainAliasLabel")); } else if ("encrypt".equals(localName)) { return new Encrypt(attrs.getValue("", "type"), attrs.getValue("", "alias"), attrs.getValue("", "algorithm"), attrs.getValue("", "keyWrapAlgorithm"), attrs - .getValue("", "tokenReference")); + .getValue("", "tokenReference"), attrs.getValue("", "securityDomainAliasLabel")); } else if ("timestamp".equals(localName)) { Modified: stack/native/branches/JBPAPP-5575/modules/core/src/main/resources/schema/jboss-ws-security_1_0.xsd =================================================================== --- stack/native/branches/JBPAPP-5575/modules/core/src/main/resources/schema/jboss-ws-security_1_0.xsd 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/core/src/main/resources/schema/jboss-ws-security_1_0.xsd 2010-12-13 22:26:58 UTC (rev 13479) @@ -3,6 +3,12 @@ <xs:element name="jboss-ws-security"> <xs:complexType> <xs:sequence> + <xs:element name="security-domain" type="securityDomainType" minOccurs="0"> + <xs:annotation> + <xs:documentation>JAAS security domain to be used for centralized security configuration; this overrides key-store-file, key-store-type, + key-store-password, trust-store-file, trust-store-type, trust-store-password.</xs:documentation> + </xs:annotation> + </xs:element> <xs:element name="key-store-file" type="xs:string" minOccurs="0"> <xs:annotation> <xs:documentation>The key store file that will be used for all operations. This file is relative to the deployment. For example, WEB-INF/foo.keystore </xs:documentation> @@ -61,6 +67,23 @@ </xs:sequence> </xs:complexType> </xs:element> + <xs:complexType name="securityDomainType"> + <xs:attribute name="jndi" type="xs:string" use="required"> + <xs:annotation> + <xs:documentation>The JNDI location of a JAAS security domain.</xs:documentation> + </xs:annotation> + </xs:attribute> + <xs:attribute name="authToken" type="xs:string" use="optional"> + <xs:annotation> + <xs:documentation>The shared token for authenticating to the security domain.</xs:documentation> + </xs:annotation> + </xs:attribute> + <xs:attribute name="useSecurityDomainAliases" type="xs:boolean" use="optional" default="true"> + <xs:annotation> + <xs:documentation>When true allows the security domain configuration to override selection of aliases for signature and encryption.</xs:documentation> + </xs:annotation> + </xs:attribute> + </xs:complexType> <xs:complexType name="passwordsType"> <xs:sequence> <xs:element name="key-password" type="passwordType" minOccurs="0" maxOccurs="unbounded"> @@ -260,6 +283,11 @@ <xs:documentation>Specify the token reference type to be used; default direct reference to the token.</xs:documentation> </xs:annotation> </xs:attribute> + <xs:attribute name="securityDomainAliasLabel" type="xs:string"> + <xs:annotation> + <xs:documentation>The label the ws-security engine needs for looking up (in the security domain) the alias that is to be used for encryption</xs:documentation> + </xs:annotation> + </xs:attribute> </xs:complexType> <xs:complexType name="signType"> <xs:sequence> @@ -279,6 +307,11 @@ <xs:documentation>Specify the token reference type to be used; default direct reference to the token.</xs:documentation> </xs:annotation> </xs:attribute> + <xs:attribute name="securityDomainAliasLabel" type="xs:string"> + <xs:annotation> + <xs:documentation>The label the ws-security engine needs for looking up (in the security domain) the alias that is to be used for signing</xs:documentation> + </xs:annotation> + </xs:attribute> </xs:complexType> <xs:simpleType name="tokenReferenceType"> <xs:restriction base="xs:string"> Modified: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/scripts/build-jars-jaxws.xml =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/scripts/build-jars-jaxws.xml 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/scripts/build-jars-jaxws.xml 2010-12-13 22:26:58 UTC (rev 13479) @@ -695,6 +695,30 @@ </classes> </war> + <!-- jaxws-jbws3182 --> + <jar destfile="${tests.output.dir}/test-libs/jaxws-jbws3182.jar"> + <fileset dir="${tests.output.dir}/test-classes"> + <include name="org/jboss/test/ws/jaxws/jbws3182/*.class" /> + <exclude name="org/jboss/test/ws/jaxws/jbws3182/*TestCase.class" /> + </fileset> + <metainf dir="${tests.output.dir}/test-resources/jaxws/jbws3182/META-INF"> + <include name="jboss-wsse-server.xml" /> + </metainf> + </jar> + <jar jarfile="${tests.output.dir}/test-libs/jaxws-jbws3182.sar"> + <metainf dir="${tests.output.dir}/test-resources/jaxws/jbws3182/META-INF"> + <include name="jboss-service.xml" /> + <include name="wsse.keystore" /> + <include name="wsse.truststore" /> + </metainf> + </jar> + <jar jarfile="${tests.output.dir}/test-libs/jaxws-jbws3182-client.jar"> + <metainf dir="${tests.output.dir}/test-resources/jaxws/jbws3182/META-INF"> + <include name="wsse.truststore" /> + <include name="wsse.keystore" /> + </metainf> + </jar> + <!-- jaxws-webserviceref --> <war warfile="${tests.output.dir}/test-libs/jaxws-webserviceref.war" webxml="${tests.output.dir}/test-resources/jaxws/webserviceref/WEB-INF/web.xml"> <classes dir="${tests.output.dir}/test-classes"> Modified: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxrpc/wsse/RoundTripTestCase.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxrpc/wsse/RoundTripTestCase.java 2010-12-13 22:21:47 UTC (rev 13478) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxrpc/wsse/RoundTripTestCase.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -197,7 +197,7 @@ LinkedList operations = new LinkedList(); operations.add(new TimestampOperation("300")); - operations.add(new SignatureOperation(targets, "wsse", null)); + operations.add(new SignatureOperation(targets, "wsse", null, null)); name = new QName("http://org.jboss.ws/2004", "someHeader"); target = new QNameTarget(name); @@ -208,7 +208,7 @@ target = new QNameTarget(name, true); targets.add(target); - operations.add(new EncryptionOperation(targets, "wsse", null, null, null)); + operations.add(new EncryptionOperation(targets, "wsse", null, null, null, null)); operations.add(new SendUsernameOperation("hi", "there", false, false, false, null)); return operations; Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/Hello.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/Hello.java (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/Hello.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,34 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2006, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.test.ws.jaxws.jbws3182; + +import javax.jws.WebMethod; +import javax.jws.WebService; +import javax.jws.soap.SOAPBinding; + +@WebService(name = "Hello", targetNamespace = "http://org.jboss.ws/jbws3182") +@SOAPBinding(style = SOAPBinding.Style.RPC) +public interface Hello +{ + @WebMethod + public String echo(String par); +} Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/HelloJavaBean.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/HelloJavaBean.java (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/HelloJavaBean.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,48 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2006, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.test.ws.jaxws.jbws3182; + +import javax.ejb.Stateless; +import javax.jws.WebMethod; +import javax.jws.WebService; +import javax.jws.soap.SOAPBinding; + +import org.jboss.logging.Logger; +import org.jboss.ws.annotation.EndpointConfig; +import org.jboss.wsf.spi.annotation.WebContext; + + +@Stateless +@WebService(name = "Hello", serviceName = "HelloService", targetNamespace = "http://org.jboss.ws/jbws3182") +@SOAPBinding(style = SOAPBinding.Style.RPC) +@WebContext(contextRoot = "/jaxws-jbws3182", urlPattern = "/*") +@EndpointConfig(configName = "Standard WSSecurity Endpoint") +public class HelloJavaBean +{ + private Logger log = Logger.getLogger(HelloJavaBean.class); + @WebMethod + public String echo(String par) + { + log.info("Echo: " + par); + return par; + } +} Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/JBWS3182TestCase.java =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/JBWS3182TestCase.java (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/java/org/jboss/test/ws/jaxws/jbws3182/JBWS3182TestCase.java 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,76 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2006, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.test.ws.jaxws.jbws3182; + +import java.net.URL; + +import javax.xml.namespace.QName; +import javax.xml.ws.Service; + +import junit.framework.Test; + +import org.jboss.ws.core.StubExt; +import org.jboss.wsf.test.JBossWSTest; +import org.jboss.wsf.test.JBossWSTestSetup; + +/** + * http://jira.jboss.org/jira/browse/JBWS-3182 + * + * @author alessio.soldano(a)jboss.com + * @since 11-Dec-2010 + */ +public class JBWS3182TestCase extends JBossWSTest +{ + private String TARGET_ENDPOINT_ADDRESS = "http://" + getServerHost() + ":8080/jaxws-jbws3182"; + + public static Test suite() throws Exception + { + return new JBossWSTestSetup(JBWS3182TestCase.class, "jaxws-jbws3182-client.jar jaxws-jbws3182.sar jaxws-jbws3182.jar"); + } + + public void testCall() throws Exception + { + Hello port = getPort(); + String msg = "Hi!"; + try + { + String result = port.echo(msg); + assertEquals(msg, result); + } + catch (Exception e) + { + e.printStackTrace(); + fail(); + } + } + + private Hello getPort() throws Exception + { + URL wsdlURL = new URL(TARGET_ENDPOINT_ADDRESS + "?wsdl"); + QName serviceName = new QName("http://org.jboss.ws/jbws3182", "HelloService"); + Hello port = Service.create(wsdlURL, serviceName).getPort(Hello.class); + URL securityURL = getResourceURL("jaxws/jbws3182/META-INF/jboss-wsse-client.xml"); + ((StubExt)port).setSecurityConfig(securityURL.toExternalForm()); + ((StubExt)port).setConfigName("Standard WSSecurity Client"); + return port; + } +} Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-service.xml =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-service.xml (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-service.xml 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,20 @@ +<?xml version="1.0" encoding="UTF-8"?> +<server> + <mbean code="org.jboss.security.plugins.JaasSecurityDomain" name="jboss.security:service=JBWS3182SecurityDomain"> + <constructor> + <arg type="java.lang.String" value="jbws3182-security-domain"/> + </constructor> + <attribute name="KeyStoreURL">META-INF/wsse.keystore</attribute> + <attribute name="KeyStoreType">JKS</attribute> + <attribute name="KeyStorePass">jbossws</attribute> + <attribute name="TrustStoreURL">META-INF/wsse.truststore</attribute> + <attribute name="TrustStoreType">JKS</attribute> + <attribute name="TrustStorePass">jbossws</attribute> + <attribute name="AdditionalOptions"> + sign-alias=wsse + encrypt-alias=wsse + </attribute> + <attribute name="ServiceAuthToken">jbws3182</attribute> + <depends>jboss.security:service=JaasSecurityManager</depends> + </mbean> +</server> \ No newline at end of file Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-client.xml =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-client.xml (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-client.xml 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,17 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<jboss-ws-security xmlns="http://www.jboss.com/ws-security/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://www.jboss.com/ws-security/config http://www.jboss.com/ws-security/schema/jboss-ws-security_1_0.xsd"> + <key-store-file>META-INF/wsse.keystore</key-store-file> + <key-store-password>jbossws</key-store-password> + <trust-store-file>META-INF/wsse.truststore</trust-store-file> + <trust-store-password>jbossws</trust-store-password> + <config> + <sign type="x509v3" alias="wsse"/> + <encrypt type="x509v3" alias="wsse"/> + <requires> + <signature/> + <encryption/> + </requires> + </config> +</jboss-ws-security> \ No newline at end of file Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-server.xml =================================================================== --- stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-server.xml (rev 0) +++ stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/jboss-wsse-server.xml 2010-12-13 22:26:58 UTC (rev 13479) @@ -0,0 +1,14 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<jboss-ws-security xmlns="http://www.jboss.com/ws-security/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://www.jboss.com/ws-security/config http://www.jboss.com/ws-security/schema/jboss-ws-security_1_0.xsd"> + <security-domain jndi="java:/jaas/jbws3182-security-domain" authToken="jbws3182"/> + <config> + <sign securityDomainAliasLabel="sign-alias"/> + <encrypt securityDomainAliasLabel="encrypt-alias"/> + <requires> + <signature/> + <encryption/> + </requires> + </config> +</jboss-ws-security> \ No newline at end of file Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/wsse.keystore =================================================================== (Binary files differ) Property changes on: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/wsse.keystore ___________________________________________________________________ Name: svn:mime-type + application/octet-stream Added: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/wsse.truststore =================================================================== (Binary files differ) Property changes on: stack/native/branches/JBPAPP-5575/modules/testsuite/native-tests/src/test/resources/jaxws/jbws3182/META-INF/wsse.truststore ___________________________________________________________________ Name: svn:mime-type + application/octet-stream