Author: jim.ma Date: 2013-10-16 06:11:07 -0400 (Wed, 16 Oct 2013) New Revision: 18000 Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConfigProvider.java projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConstants.java projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthConfig.java projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthContext.java projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/SecurityActions.java projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/module/SOAPServerAuthModule.java projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/wss/validator/UsernameTokenValidator.java projects/jaspic-soap/trunk/src/test/java/org/jboss/ws/jaspic/container/config/JASPISoapTest.java projects/jaspic-soap/trunk/src/test/resources/usernametoken-soapmessage.xml Log: Refactor JASPISoapTest;Pass client subject to wss4j UserNameTokenValidator Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConfigProvider.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConfigProvider.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConfigProvider.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -30,6 +30,9 @@ import javax.security.auth.message.config.ClientAuthConfig; import javax.security.auth.message.config.ServerAuthConfig; +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ public class JBossWSAuthConfigProvider implements AuthConfigProvider { private Properties contextProperties; Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConstants.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConstants.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSAuthConstants.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -1,5 +1,28 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2013, Red Hat, Inc., and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ package org.jboss.ws.jaspic.container.config; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ public class JBossWSAuthConstants { public static final String WSS4J_CONFIG = "wss4j.config"; Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthConfig.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthConfig.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthConfig.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -44,13 +44,14 @@ import org.jboss.security.auth.login.AuthenticationInfo; import org.jboss.security.auth.login.BaseAuthenticationInfo; import org.jboss.security.auth.login.JASPIAuthenticationInfo; -import org.jboss.security.auth.message.config.JBossServerAuthContext; import org.jboss.security.config.ApplicationPolicy; import org.jboss.security.config.ControlFlag; import org.jboss.security.config.SecurityConfiguration; import org.jboss.security.plugins.ClassLoaderLocator; import org.jboss.security.plugins.ClassLoaderLocatorFactory; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ //TODO: Refactor JBossServerAuthConfig, this class should extend JBossServerAuthConfig, public class JBossWSServerAuthConfig implements ServerAuthConfig { private String layer; @@ -152,7 +153,7 @@ } } - JBossServerAuthContext serverAuthContext = new JBossServerAuthContext( + JBossWSServerAuthContext serverAuthContext = new JBossWSServerAuthContext( modules, mapOptionsByName, this.callbackHandler); serverAuthContext.setControlFlags(controlFlags); return serverAuthContext; Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthContext.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthContext.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/JBossWSServerAuthContext.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -20,7 +20,9 @@ * 02110-1301 USA, or see the FSF site: http://www.fsf.org. */ package org.jboss.ws.jaspic.container.config; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ import java.util.List; import java.util.Map; Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/SecurityActions.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/SecurityActions.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/config/SecurityActions.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -20,7 +20,9 @@ * 02110-1301 USA, or see the FSF site: http://www.fsf.org. */ package org.jboss.ws.jaspic.container.config; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ import java.security.AccessController; import java.security.PrivilegedAction; import java.security.PrivilegedActionException; Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/module/SOAPServerAuthModule.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/module/SOAPServerAuthModule.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/container/module/SOAPServerAuthModule.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -44,7 +44,9 @@ import org.jboss.security.auth.container.modules.AbstractServerAuthModule; import org.jboss.ws.jaspic.container.config.JBossWSAuthConstants; import org.jboss.ws.jaspic.wss.validator.UsernameTokenValidator; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ public class SOAPServerAuthModule extends AbstractServerAuthModule { private String securityDomainName = null; @@ -60,6 +62,13 @@ } @Override + public AuthStatus validateRequest(MessageInfo messageInfo, + Subject clientSubject, Subject serviceSubject) throws AuthException { + //TODO:look at what we need to do with options + return validate(clientSubject, messageInfo) ? AuthStatus.SUCCESS : AuthStatus.FAILURE; + } + + @Override protected boolean validate(Subject clientSubject, MessageInfo messageInfo) throws AuthException { @@ -86,7 +95,7 @@ WSSConfig wssConfig = WSSConfig.getNewInstance(); - setJASPICValidator(wssConfig); + setJASPICValidator(wssConfig, clientSubject); cxfSoapMessage.put(WSSConfig.class.getName(), wssConfig); //set the wss4j config from messageinfo @@ -98,7 +107,6 @@ } WSS4JInInterceptor wss4jInterceptor = new WSS4JInInterceptor(); - wss4jInterceptor.setIgnoreActions(true); wss4jInterceptor.handleMessage(cxfSoapMessage); return true; @@ -110,9 +118,9 @@ throw new UnsupportedOperationException(); } - protected void setJASPICValidator(WSSConfig wssconfig) { + protected void setJASPICValidator(WSSConfig wssconfig, Subject subject) { //TODO: add other validator - UsernameTokenValidator usernameTokenValidator = new UsernameTokenValidator(); + UsernameTokenValidator usernameTokenValidator = new UsernameTokenValidator(subject); usernameTokenValidator.setContextName(getSecurityDomainName()); wssconfig.setValidator(WSSecurityEngine.USERNAME_TOKEN, usernameTokenValidator); } Modified: projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/wss/validator/UsernameTokenValidator.java =================================================================== --- projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/wss/validator/UsernameTokenValidator.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/main/java/org/jboss/ws/jaspic/wss/validator/UsernameTokenValidator.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -21,10 +21,81 @@ */ package org.jboss.ws.jaspic.wss.validator; +import javax.security.auth.Subject; +import javax.security.auth.callback.CallbackHandler; +import javax.security.auth.login.LoginContext; +import javax.security.auth.login.LoginException; + +import org.apache.ws.security.WSConstants; +import org.apache.ws.security.WSSecurityException; +import org.apache.ws.security.handler.RequestData; +import org.apache.ws.security.message.token.UsernameToken; +import org.apache.ws.security.validate.Credential; import org.apache.ws.security.validate.JAASUsernameTokenValidator; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ public class UsernameTokenValidator extends JAASUsernameTokenValidator { + + private Subject subject; + + public UsernameTokenValidator(Subject subject) { + this.subject = subject; + } + //wss4j's JAASUsernameTokenValidator only supports plain text password //TODO: support other type password + private static org.apache.commons.logging.Log log = + org.apache.commons.logging.LogFactory.getLog(UsernameTokenValidator.class); + public Credential validate(Credential credential, RequestData data) throws WSSecurityException { + if (credential == null || credential.getUsernametoken() == null) { + throw new WSSecurityException(WSSecurityException.FAILURE, "noCredential"); + } + + String user = null; + String password = null; + + UsernameToken usernameToken = credential.getUsernametoken(); + + user = usernameToken.getName(); + String pwType = usernameToken.getPasswordType(); + if (log.isDebugEnabled()) { + log.debug("UsernameToken user " + usernameToken.getName()); + log.debug("UsernameToken password type " + pwType); + } + + if (usernameToken.isHashed()) { + log.warn("Authentication failed as hashed username token not supported"); + throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION); + } + + password = usernameToken.getPassword(); + + if (!WSConstants.PASSWORD_TEXT.equals(pwType)) { + log.warn("Password type " + pwType + " not supported"); + throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION); + } + + if (!(user != null && user.length() > 0 && password != null && password.length() > 0)) { + log.warn("User or password empty"); + throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION); + } + + try { + CallbackHandler handler = getCallbackHandler(user, password); + LoginContext ctx = new LoginContext(getContextName(), subject , handler); + ctx.login(); + Subject subject = ctx.getSubject(); + credential.setSubject(subject); + } catch (LoginException ex) { + log.info("Authentication failed", ex); + throw new WSSecurityException( + WSSecurityException.FAILED_AUTHENTICATION, null, null, ex + ); + } + + return credential; + + } } Modified: projects/jaspic-soap/trunk/src/test/java/org/jboss/ws/jaspic/container/config/JASPISoapTest.java =================================================================== --- projects/jaspic-soap/trunk/src/test/java/org/jboss/ws/jaspic/container/config/JASPISoapTest.java 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/test/java/org/jboss/ws/jaspic/container/config/JASPISoapTest.java 2013-10-16 10:11:07 UTC (rev 18000) @@ -50,7 +50,9 @@ import org.jboss.security.auth.message.GenericMessageInfo; import org.junit.BeforeClass; import org.junit.Test; - +/** + * @author <a href=&quot;ema(a)redhat.com&quot;&gt;Jim Ma</a> + */ public class JASPISoapTest extends TestCase { @BeforeClass @@ -87,12 +89,13 @@ MessageInfo messageInfo = new GenericMessageInfo(); Properties props = new Properties(); - props.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN); - props.put(WSHandlerConstants.TIMESTAMP_STRICT, "false"); + props.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN + " " + WSHandlerConstants.TIMESTAMP); messageInfo.getMap().put(JBossWSAuthConstants.WSS4J_CONFIG, props); messageInfo.setRequestMessage(prepareSOAPMessage("usernametoken-soapmessage.xml")); - AuthStatus authStatus = sctx.validateRequest(messageInfo, new Subject(), new Subject()); + Subject clientSubject = new Subject(); + Subject serviceSubject = new Subject(); + AuthStatus authStatus = sctx.validateRequest(messageInfo, clientSubject, serviceSubject); assertTrue(authStatus.equals(AuthStatus.SUCCESS)); } @@ -114,7 +117,7 @@ String content = readFile(fins); XmlSchemaDateFormat formater = new XmlSchemaDateFormat(); - String replaced = content.replaceAll("NOW", formater.format(new Date(System.currentTimeMillis()-10))); + String replaced = content.replaceAll("\\$NOW", formater.format(new Date())); ByteArrayInputStream bin = new ByteArrayInputStream(replaced.getBytes()); return factory.createMessage(null, bin); } Modified: projects/jaspic-soap/trunk/src/test/resources/usernametoken-soapmessage.xml =================================================================== --- projects/jaspic-soap/trunk/src/test/resources/usernametoken-soapmessage.xml 2013-10-16 06:29:47 UTC (rev 17999) +++ projects/jaspic-soap/trunk/src/test/resources/usernametoken-soapmessage.xml 2013-10-16 10:11:07 UTC (rev 18000) @@ -1 +1,24 @@ -<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><S... xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">&... xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-... xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-w... soap:mustUnderstand="1"><wsu:Timestamp wsu:Id="TS-96d29305-8a68-42a9-84a7-3f30a2a04e11"><wsu:Created>NOW</wsu:Created><wsu:Expires>NOW</wsu:Expires></wsu:Timestamp><wsse:UsernameToken wsu:Id="UsernameToken-4313b55e-cbcd-438f-8408-c19f1016b208"><wsse:Username>jbossws</wsse:Username><wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-userna... xmlns:ns2="http://www.example.org/schema/DoubleIt"><numbe... \ No newline at end of file +<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> + <SOAP-ENV:Header xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> + <wsse:Security + xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-... + xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-w... + soap:mustUnderstand="1"> + <wsu:Timestamp wsu:Id="TS-96d29305-8a68-42a9-84a7-3f30a2a04e11"> + <wsu:Created>$NOW</wsu:Created> + <wsu:Expires>2113-10-16T08:58:19.763Z</wsu:Expires> + </wsu:Timestamp> + <wsse:UsernameToken + wsu:Id="UsernameToken-4313b55e-cbcd-438f-8408-c19f1016b208"> + <wsse:Username>jbossws</wsse:Username> + <wsse:Password + Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-userna... + </wsse:UsernameToken> + </wsse:Security> + </SOAP-ENV:Header> + <soap:Body> + <ns2:DoubleIt xmlns:ns2="http://www.example.org/schema/DoubleIt"> + <numberToDouble>25</numberToDouble> + </ns2:DoubleIt> + </soap:Body> +</soap:Envelope> \ No newline at end of file