dataEncAlgo = context.getAlgorithmSuite().getEncryptionAlgorithm();
}
//HashMap tokenCache = context.getTokenCache();
SecurableSoapMessage secureMsg = context.getSecurableSoapMessage();
EncryptionPolicy inferredEncryptionPolicy = null;
boolean isWSITRecipient = (context.getMode()== FilterProcessingContext.WSDL_POLICY);
try{
if(isWSITRecipient){
int i = context.getInferredSecurityPolicy().size() - 1;
inferredEncryptionPolicy = (EncryptionPolicy)context.getInferredSecurityPolicy().get(i);
}
} catch(Exception e){
log.log(Level.SEVERE, LogStringsMessages.WSS_0247_FAILED_RESOLVE_DERIVED_KEY_TOKEN());
throw new XWSSecurityException(e);
}
SecurityTokenReference sectr = token.getDerivedKeyElement();
if (sectr == null) {
log.log(Level.SEVERE, LogStringsMessages.WSS_0248_NULL_STR());
throw new XWSSecurityException("Invalid DerivedKey Token encountered, no STR found");
}
ReferenceElement refElement = sectr.getReference();
Key encKey = null;
byte[] secret = null;
if (refElement instanceof DirectReference) {
String uri = ((DirectReference) refElement).getURI();
String valueType = ((DirectReference) refElement).getValueType();
String wsuId = secureMsg.getIdFromFragmentRef(uri);
SecurityToken secToken = SecurityUtil.locateBySCTId(context, wsuId);
if (secToken == null) {
secToken =resolveToken(wsuId,context,secureMsg);
//workaround for case where Reference does not have ValueType
if ((valueType == null) && (secToken instanceof EncryptedKeyToken)){
valueType = MessageConstants.EncryptedKey_NS;
}
}
if(MessageConstants.EncryptedKey_NS.equals(valueType)){
try{
Element cipherData = (Element)((EncryptedKeyToken)secToken).getAsSoapElement().getChildElements(new QName(MessageConstants.XENC_NS, "CipherData", MessageConstants.XENC_PREFIX)).next();
String cipherValue = cipherData.getElementsByTagNameNS(MessageConstants.XENC_NS, "CipherValue").item(0).getTextContent();
byte[] decodedCipher = Base64.decode(cipherValue);
byte[] ekSha1 = MessageDigest.getInstance("SHA-1").digest(decodedCipher);
String encEkSha1 = Base64.encode(ekSha1);
context.setExtraneousProperty(MessageConstants.EK_SHA1_VALUE, encEkSha1);
} catch(Exception e){
log.log(Level.SEVERE, LogStringsMessages.WSS_0241_UNABLETO_SET_EKSHA_1_ON_CONTEXT(), e);
throw new XWSSecurityException(e);
}
if(isWSITRecipient){
MLSPolicy inferredKB = inferredEncryptionPolicy.getKeyBinding();
SymmetricKeyBinding skBinding = new SymmetricKeyBinding();
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
skBinding.setKeyBinding(x509Binding);
//TODO: ReferenceType and ValueType not set on X509Binding
if(PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)){
if(((DerivedTokenKeyBinding)inferredKB).getOriginalKeyBinding() == null)
((DerivedTokenKeyBinding)inferredKB).setOriginalKeyBinding(skBinding);
}
}
KeyInfoHeaderBlock kiHB = ((EncryptedKeyToken)secToken).getKeyInfo();
encKey = ((EncryptedKeyToken)secToken).getSecretKey(getKey(kiHB, false, context), dataEncAlgo);
secret = encKey.getEncoded();
context.setExtraneousProperty(MessageConstants.SECRET_KEY_VALUE, encKey);
} else if (MessageConstants.SCT_VALUETYPE.equals(valueType) || MessageConstants.SCT_13_VALUETYPE.equals(valueType)) {
if (secToken instanceof SecurityContextToken) {
if(isWSITRecipient){
MLSPolicy inferredKB = inferredEncryptionPolicy.getKeyBinding();
SecureConversationTokenKeyBinding sctBinding = new SecureConversationTokenKeyBinding();
if(PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)){
if(((DerivedTokenKeyBinding)inferredKB).getOriginalKeyBinding() == null)
((DerivedTokenKeyBinding)inferredKB).setOriginalKeyBinding(sctBinding);
}
}
//handling for SecurityContext Token
secret = resolveSCT(context, (SecurityContextTokenImpl)secToken, false);
} else {
log.log(Level.SEVERE, LogStringsMessages.WSS_0243_INVALID_VALUE_TYPE_NON_SCT_TOKEN());
throw new XWSSecurityException("Incorrect ValueType: " + MessageConstants.SCT_VALUETYPE + ", specified for a Non SCT Token");
}
} else if (null == valueType) {
if (secToken instanceof SecurityContextToken) {
if(isWSITRecipient){
MLSPolicy inferredKB = inferredEncryptionPolicy.getKeyBinding();
SecureConversationTokenKeyBinding sctBinding = new SecureConversationTokenKeyBinding();
if(PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)){
((DerivedTokenKeyBinding)inferredKB).setOriginalKeyBinding(sctBinding);
}
}
//handling for SecurityContext Token
secret = resolveSCT(context, (SecurityContextTokenImpl)secToken, false);
} else {
log.log(Level.SEVERE, LogStringsMessages.WSS_0249_UNSUPPORTED_TOKEN_TYPE_DKT());
throw new XWSSecurityException("Unsupported TokenType " + secToken + " under DerivedKeyToken");
}
} else{
log.log(Level.SEVERE, LogStringsMessages.WSS_0249_UNSUPPORTED_TOKEN_TYPE_DKT());
throw new XWSSecurityException("Unsupported TokenType " + secToken + " under DerivedKeyToken");
}
} else if (refElement instanceof KeyIdentifier) {
KeyIdentifier keyId = (KeyIdentifier)refElement;
if(MessageConstants.EncryptedKeyIdentifier_NS.equals(keyId.getValueType())){
if(isWSITRecipient){
MLSPolicy inferredKB = inferredEncryptionPolicy.getKeyBinding();
SymmetricKeyBinding skBinding = new SymmetricKeyBinding();
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
x509Binding.setReferenceType(MessageConstants.KEY_INDETIFIER_TYPE);
skBinding.setKeyBinding(x509Binding);
//TODO: ReferenceType and ValueType not set on X509Binding
if(PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)){
if(((DerivedTokenKeyBinding)inferredKB).getOriginalKeyBinding() == null)
((DerivedTokenKeyBinding)inferredKB).setOriginalKeyBinding(skBinding);
}
}
String ekSha1RefValue = (String)context.getExtraneousProperty("EncryptedKeySHA1");
Key secretKey = (Key)context.getExtraneousProperty("SecretKey");
String keyRefValue = keyId.getReferenceValue();
if(ekSha1RefValue != null && secretKey != null){
if(ekSha1RefValue.equals(keyRefValue)){
encKey = secretKey;
secret = encKey.getEncoded();
} else{
log.log(Level.SEVERE, LogStringsMessages.WSS_0240_INVALID_ENCRYPTED_KEY_SHA_1_REFERENCE());
throw new XWSSecurityException("EncryptedKeySHA1 reference not correct");
}
} else{
log.log(Level.SEVERE, LogStringsMessages.WSS_0240_INVALID_ENCRYPTED_KEY_SHA_1_REFERENCE());
String message = "EncryptedKeySHA1 reference not correct";
throw new XWSSecurityException(message);
}
} else if (MessageConstants.WSSE_SAML_KEY_IDENTIFIER_VALUE_TYPE.equals(keyId.getValueType())
|| MessageConstants.WSSE_SAML_v2_0_KEY_IDENTIFIER_VALUE_TYPE.equals(keyId.getValueType())) {
if(isWSITRecipient){
MLSPolicy inferredKB = inferredEncryptionPolicy.getKeyBinding();
IssuedTokenKeyBinding itkBinding = new IssuedTokenKeyBinding();
if(PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)){
if(((DerivedTokenKeyBinding)inferredKB).getOriginalKeyBinding() == null)
((DerivedTokenKeyBinding)inferredKB).setOriginalKeyBinding(itkBinding);
}