context.getSecurityContext().getProcessedSecurityHeaders().add(ut);
context.getInferredSecurityPolicy().append(ut.getPolicy());
if (context.isTrustMessage() && !context.isClient()) {
IssuedTokenContext ctx;
if (context.getTrustContext() == null) {
ctx = new IssuedTokenContextImpl();
if (context.isSecure()) {
ctx.setAuthnContextClass(MessageConstants.PASSWORD_PROTECTED_TRANSPORT_AUTHTYPE);
} else {
ctx.setAuthnContextClass(MessageConstants.PASSWORD_AUTH_TYPE);
}
context.setTrustContext(ctx);
} else {
ctx = context.getTrustContext();
if (ctx.getAuthnContextClass() != null) {
if (context.isSecure()) {
ctx.setAuthnContextClass(MessageConstants.PASSWORD_PROTECTED_TRANSPORT_AUTHTYPE);
} else {
ctx.setAuthnContextClass(MessageConstants.PASSWORD_AUTH_TYPE);
}
context.setTrustContext(ctx);
}
}
}
break;
}
case BINARYSECURITY_TOKEN_ELEMENT: {
String valueType = message.getAttributeValue(null, MessageConstants.WSE_VALUE_TYPE);
if (MessageConstants.KERBEROS_V5_GSS_APREQ_1510.equals(valueType)
|| MessageConstants.KERBEROS_V5_GSS_APREQ.equals(valueType)) {
KerberosBinarySecurityToken kbst = new KerberosBinarySecurityToken(message, creator, (HashMap) currentParentNS, staxIF);
WSSPolicy policy = kbst.getPolicy();
((TokenValidator) kbst).validate(context);
processedHeaders.add(kbst);
context.getInferredSecurityPolicy().append(kbst.getPolicy());
if (context.isTrustMessage() && !context.isClient()) {
IssuedTokenContext ctx;
if (context.getTrustContext() == null) {
ctx = new IssuedTokenContextImpl();
ctx.setAuthnContextClass(MessageConstants.KERBEROS_AUTH_TYPE);
context.setTrustContext(ctx);
} else {
ctx = context.getTrustContext();
if (ctx.getAuthnContextClass() != null) {
ctx.setAuthnContextClass(MessageConstants.KERBEROS_AUTH_TYPE);
context.setTrustContext(ctx);
}
}
}
} else if (MessageConstants.X509v3_NS.equals(valueType)
|| MessageConstants.X509v1_NS.equals(valueType)
|| valueType == null) /*null takes as X509 BST */ {
X509BinarySecurityToken bst = new X509BinarySecurityToken(message, creator, (HashMap) currentParentNS, staxIF);
WSSPolicy policy = bst.getPolicy();
((TokenValidator) bst).validate(context);
processedHeaders.add(bst);
context.getInferredSecurityPolicy().append(bst.getPolicy());
if (context.isTrustMessage() && !context.isClient()) {
IssuedTokenContext ctx;
if (context.getTrustContext() == null) {
ctx = new IssuedTokenContextImpl();
ctx.setAuthnContextClass(MessageConstants.X509_AUTH_TYPE);
context.setTrustContext(ctx);
} else {
ctx = context.getTrustContext();
if (ctx.getAuthnContextClass() != null) {
ctx.setAuthnContextClass(MessageConstants.X509_AUTH_TYPE);
context.setTrustContext(ctx);
}
}
}
} else {
//unrecognized valuetype
logger.log(Level.SEVERE, LogStringsMessages.WSS_1616_UNRECOGNIZED_BST_VALUETYPE(valueType));
throw new XWSSecurityException(LogStringsMessages.WSS_1616_UNRECOGNIZED_BST_VALUETYPE(valueType));
}
break;
}
case ENCRYPTED_KEY_ELEMENT: {
EncryptedKey ek = new EncryptedKey(message, context, (HashMap) currentParentNS);
ArrayList<String> list = (ArrayList) ek.getPendingReferenceList();
if (list != null) {
findAndReplaceED(list, ek);
if (ek.getPendingReferenceList().size() > 0) {
if (pendingElement == null) {
pendingElement = ek;
}//else{
addSecurityHeader(ek);
//}
}
} else {
addSecurityHeader(ek);
}
if (ek.getPolicy() != null) {
context.getInferredSecurityPolicy().append(ek.getPolicy());
}
break;
}
case ENCRYPTED_DATA_ELEMENT: {
EncryptedData ed = new EncryptedData(message, context, currentParentNS);
handleEncryptedData(ed, currentParentNS);
break;
}
case ENCRYPTED_HEADER_ELEMENT: {
throw new XWSSecurityException("wsse11:EncryptedHeader not allowed inside SecurityHeader");
//break;
}
case REFERENCE_LIST_ELEMENT: {
ReferenceListHeader refList = new ReferenceListHeader(message, context);
if (pendingElement == null) {
pendingElement = refList;
} else {
addSecurityHeader(refList);
}
context.getInferredSecurityPolicy().append(refList.getPolicy());
break;
}
case SIGNATURE_ELEMENT: {
Signature sig = new Signature(context, currentParentNS, creator);
sig.process(message);
if (!sig.isValidated()) {
if (pendingElement == null) {
pendingElement = sig;
} else {
addSecurityHeader(sig);
}
} else {
if (!processedHeaders.contains(sig)) {
processedHeaders.add(sig);
}
}
context.getInferredSecurityPolicy().append(sig.getPolicy());
break;
}
case DERIVED_KEY_ELEMENT: {
DerivedKeyToken dkt = new DerivedKeyToken(message, context, (HashMap) currentParentNS);
processedHeaders.add(dkt);
break;
}
case SIGNATURE_CONFIRMATION_ELEMENT: {
SignatureConfirmation signConfirm = new SignatureConfirmation(message, creator, (HashMap) currentParentNS, staxIF);
WSSPolicy policy = signConfirm.getPolicy();
signConfirm.validate(context);
processedHeaders.add(signConfirm);
context.getInferredSecurityPolicy().append(signConfirm.getPolicy());
break;
}
case SECURITY_CONTEXT_TOKEN: {
SecurityContextToken sct = new SecurityContextToken(message, context, (HashMap) currentParentNS);
processedHeaders.add(sct);
break;
}
case SAML_ASSERTION_ELEMENT: {
SAMLAssertion samlAssertion = new SAMLAssertion(message, context, null, (HashMap) currentParentNS);
processedHeaders.add(samlAssertion);
if (samlAssertion.isHOK()) {
if (!samlAssertion.validateSignature()) {
logger.log(Level.SEVERE, LogStringsMessages.WSS_1614_SAML_SIGNATURE_INVALID());
throw SOAPUtil.newSOAPFaultException(MessageConstants.WSSE_FAILED_AUTHENTICATION,
LogStringsMessages.WSS_1614_SAML_SIGNATURE_INVALID(),
new Exception(LogStringsMessages.WSS_1614_SAML_SIGNATURE_INVALID()));
}
}
samlAssertion.validate(context);
samlAssertion.getKey();
// Set in the extraneous property only if not already set
// workaround in the case where there are two HOK assertions in the request
if (context.getExtraneousProperty(MessageConstants.INCOMING_SAML_ASSERTION) == null && samlAssertion.isHOK()) {
context.getExtraneousProperties().put(MessageConstants.INCOMING_SAML_ASSERTION, samlAssertion);
}
context.getInferredSecurityPolicy().append(samlAssertion.getPolicy());
if (context.isTrustMessage() && !context.isClient()) {
IssuedTokenContext ctx;
if (context.getTrustContext() == null) {
ctx = new IssuedTokenContextImpl();
ctx.setAuthnContextClass(MessageConstants.PREVIOUS_SESSION_AUTH_TYPE);
context.setTrustContext(ctx);
} else {
ctx = context.getTrustContext();
if (ctx.getAuthnContextClass() != null) {