}
//search the root tokens and create new TokenSecurityEvents if not already there...
for (int i = 0; i < tokenSecurityEvents.size(); i++) {
TokenSecurityEvent<? extends InboundSecurityToken> tokenSecurityEvent = tokenSecurityEvents.get(i);
InboundSecurityToken securityToken = WSSUtils.getRootToken(tokenSecurityEvent.getSecurityToken());
if (!containsSecurityToken(supportingTokens, securityToken)) {
TokenSecurityEvent<? extends InboundSecurityToken> newTokenSecurityEvent =
WSSUtils.createTokenSecurityEvent(securityToken, tokenSecurityEvent.getCorrelationID());
supportingTokens = addTokenSecurityEvent(newTokenSecurityEvent, supportingTokens);
securityEventDeque.offer(newTokenSecurityEvent);
}
//remove old TokenSecurityEvent so that only root tokens are in the queue
securityEventDeque.remove(tokenSecurityEvent);
}
Iterator<TokenSecurityEvent<? extends InboundSecurityToken>> supportingTokensIterator = supportingTokens.iterator();
while (supportingTokensIterator.hasNext()) {
TokenSecurityEvent<? extends InboundSecurityToken> tokenSecurityEvent = supportingTokensIterator.next();
List<InboundSecurityToken> signingSecurityTokens = isSignedToken(tokenSecurityEvent, securityEventDeque, httpsTokenSecurityEvent);
List<QName> signatureElementPath = new ArrayList<QName>(4);
signatureElementPath.addAll(WSSConstants.WSSE_SECURITY_HEADER_PATH);
signatureElementPath.add(WSSConstants.TAG_dsig_Signature);
boolean signsSignature = signsElement(tokenSecurityEvent, signatureElementPath, securityEventDeque);
boolean encryptsSignature = encryptsElement(tokenSecurityEvent, signatureElementPath, securityEventDeque);
List<QName> signatureConfirmationElementPath = new ArrayList<QName>(4);
signatureConfirmationElementPath.addAll(WSSConstants.WSSE_SECURITY_HEADER_PATH);
signatureConfirmationElementPath.add(WSSConstants.TAG_wsse11_SignatureConfirmation);
boolean signsSignatureConfirmation = signsElement(tokenSecurityEvent, signatureConfirmationElementPath, securityEventDeque);
boolean encryptsSignatureConfirmation = encryptsElement(tokenSecurityEvent, signatureConfirmationElementPath, securityEventDeque);
List<QName> timestampElementPath = new ArrayList<QName>(4);
timestampElementPath.addAll(WSSConstants.WSSE_SECURITY_HEADER_PATH);
timestampElementPath.add(WSSConstants.TAG_wsu_Timestamp);
boolean signsTimestamp = signsElement(tokenSecurityEvent, timestampElementPath, securityEventDeque);
List<QName> usernameTokenElementPath = new ArrayList<QName>(4);
usernameTokenElementPath.addAll(WSSConstants.WSSE_SECURITY_HEADER_PATH);
usernameTokenElementPath.add(WSSConstants.TAG_wsse_UsernameToken);
boolean encryptsUsernameToken = encryptsElement(tokenSecurityEvent, usernameTokenElementPath, securityEventDeque);
boolean transportSecurityActive = Boolean.TRUE == get(WSSConstants.TRANSPORT_SECURITY_ACTIVE);
List<InboundSecurityToken> encryptingSecurityTokens = isEncryptedToken(tokenSecurityEvent, securityEventDeque, httpsTokenSecurityEvent);
boolean signatureUsage = tokenSecurityEvent.getSecurityToken().getTokenUsages().contains(WSSecurityTokenConstants.TokenUsage_Signature);
boolean encryptionUsage = tokenSecurityEvent.getSecurityToken().getTokenUsages().contains(WSSecurityTokenConstants.TokenUsage_Encryption);
if (!transportSecurityActive && signsSignatureConfirmation && signsTimestamp && !signsSignature) {
supportingTokensIterator.remove();
messageSignatureTokens = addTokenSecurityEvent(tokenSecurityEvent, messageSignatureTokens);
if (encryptionUsage) {
messageEncryptionTokens = addTokenSecurityEvent(tokenSecurityEvent, messageEncryptionTokens);
}
} else if (!transportSecurityActive && signsSignatureConfirmation && !signsSignature) {
supportingTokensIterator.remove();
messageSignatureTokens = addTokenSecurityEvent(tokenSecurityEvent, messageSignatureTokens);
if (encryptionUsage) {
messageEncryptionTokens = addTokenSecurityEvent(tokenSecurityEvent, messageEncryptionTokens);
}
} else if (!transportSecurityActive && signsTimestamp && !signsSignature) {
supportingTokensIterator.remove();
messageSignatureTokens = addTokenSecurityEvent(tokenSecurityEvent, messageSignatureTokens);
if (encryptionUsage) {
messageEncryptionTokens = addTokenSecurityEvent(tokenSecurityEvent, messageEncryptionTokens);
}
} else if (!transportSecurityActive &&
(encryptsSignature || encryptsSignatureConfirmation || encryptsUsernameToken)) {
supportingTokensIterator.remove();
messageEncryptionTokens = addTokenSecurityEvent(tokenSecurityEvent, messageEncryptionTokens);
} else if (signsSignature && signingSecurityTokens.size() > 0 && encryptingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
signedEndorsingEncryptedSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, signedEndorsingEncryptedSupportingTokens);
} else if (transportSecurityActive && signsTimestamp && signingSecurityTokens.size() > 0 && encryptingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
signedEndorsingEncryptedSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, signedEndorsingEncryptedSupportingTokens);
} else if (signsSignature && signingSecurityTokens.size() == 0 && encryptingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
endorsingEncryptedSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, endorsingEncryptedSupportingTokens);
} else if (signsSignature && signingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
signedEndorsingSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, signedEndorsingSupportingTokens);
} else if (signatureUsage && signingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
signedEndorsingSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, signedEndorsingSupportingTokens);
} else if (signsSignature) {
supportingTokensIterator.remove();
endorsingSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, endorsingSupportingTokens);
} else if (signingSecurityTokens.size() > 0 && encryptingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
signedEncryptedSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, signedEncryptedSupportingTokens);
} else if (signingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
signedSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, signedSupportingTokens);
} else if (encryptingSecurityTokens.size() > 0) {
supportingTokensIterator.remove();
encryptedSupportingTokens = addTokenSecurityEvent(tokenSecurityEvent, encryptedSupportingTokens);
}
}
if (messageSignatureTokens.isEmpty()) {
InboundSecurityToken messageSignatureToken = getSupportingTokenSigningToken(
signedSupportingTokens,
signedEndorsingSupportingTokens,
signedEncryptedSupportingTokens,
signedEndorsingEncryptedSupportingTokens,
securityEventDeque);