public static Key resolveDirectReference(XMLCryptoContext context, String valueType,
String uri, Purpose purpose) throws KeySelectorException {
Key returnKey = null;
try {
JAXBFilterProcessingContext wssContext = (JAXBFilterProcessingContext) context.get(MessageConstants.WSS_PROCESSING_CONTEXT);
MLSPolicy inferredKB = wssContext.getSecurityContext().getInferredKB();
String wsuId = SOAPUtil.getIdFromFragmentRef(uri);
boolean isSymmetric = false;
if (MessageConstants.USERNAME_TOKEN_NS.equals(valueType) || MessageConstants.USERNAME_STR_REFERENCE_NS.equals(valueType)) {
UsernameTokenHeader token = null;
token = (UsernameTokenHeader) resolveToken(wsuId, context);
if (token == null) {
throw new KeySelectorException("Token with Id " + wsuId + " not found");
}
AuthenticationTokenPolicy.UsernameTokenBinding untBinding = new AuthenticationTokenPolicy.UsernameTokenBinding();
untBinding.setReferenceType(MessageConstants.DIRECT_REFERENCE_TYPE);
untBinding.setValueType(valueType);
untBinding.setUseNonce(((AuthenticationTokenPolicy.UsernameTokenBinding)token.getPolicy()).getUseNonce());
untBinding.setUseCreated(((AuthenticationTokenPolicy.UsernameTokenBinding)token.getPolicy()).getUseCreated());
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(untBinding);
if (wssContext.getExtraneousProperty("EncryptedKey") != null) {
isSymmetric = true;
}
} else if (PolicyTypeUtil.symmetricKeyBinding(inferredKB)) {
((SymmetricKeyBinding) inferredKB).setKeyBinding(untBinding);
isSymmetric = true;
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
DerivedTokenKeyBinding dktBind = (DerivedTokenKeyBinding) inferredKB;
if (dktBind.getOriginalKeyBinding() == null) {
dktBind.setOriginalKeyBinding(untBinding);
} else if (PolicyTypeUtil.symmetricKeyBinding(dktBind.getOriginalKeyBinding())) {
dktBind.getOriginalKeyBinding().setKeyBinding(untBinding);
isSymmetric = true;
}
}
returnKey = resolveUsernameToken(wssContext, token, purpose, isSymmetric);
} else if (MessageConstants.X509v3_NS.equals(valueType) || MessageConstants.X509v1_NS.equals(valueType)) {
// its an X509 Token
X509BinarySecurityToken token = null;
token = (X509BinarySecurityToken) resolveToken(wsuId, context);
if (token == null) {
throw new KeySelectorException("Token with Id " + wsuId + "not found");
}
// for policy verification
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
x509Binding.setReferenceType(MessageConstants.DIRECT_REFERENCE_TYPE);
x509Binding.setValueType(valueType);
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(x509Binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(inferredKB)) {
((SymmetricKeyBinding) inferredKB).setKeyBinding(x509Binding);
isSymmetric = true;
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
DerivedTokenKeyBinding dktBind = (DerivedTokenKeyBinding) inferredKB;
if (dktBind.getOriginalKeyBinding() == null) {
dktBind.setOriginalKeyBinding(x509Binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(dktBind.getOriginalKeyBinding())) {
dktBind.getOriginalKeyBinding().setKeyBinding(x509Binding);
isSymmetric = true;
}
}
returnKey = resolveX509Token(wssContext, token, purpose, isSymmetric);
} else if (MessageConstants.KERBEROS_V5_GSS_APREQ_1510.equals(valueType) ||
MessageConstants.KERBEROS_V5_GSS_APREQ.equals(valueType)) {
KerberosBinarySecurityToken token = (KerberosBinarySecurityToken) resolveToken(wsuId, context);
if (token == null) {
throw new KeySelectorException("Token with Id " + wsuId + "not found");
}
// for policy verification
SymmetricKeyBinding skBinding = new SymmetricKeyBinding();
AuthenticationTokenPolicy.KerberosTokenBinding ktBinding = new AuthenticationTokenPolicy.KerberosTokenBinding();
ktBinding.setReferenceType(MessageConstants.DIRECT_REFERENCE_TYPE);
ktBinding.setValueType(valueType);
skBinding.setKeyBinding(ktBinding);
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(skBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
DerivedTokenKeyBinding dktBind = (DerivedTokenKeyBinding) inferredKB;
if (dktBind.getOriginalKeyBinding() == null) {
dktBind.setOriginalKeyBinding(skBinding);
} else if (PolicyTypeUtil.symmetricKeyBinding(dktBind.getOriginalKeyBinding())) {
dktBind.getOriginalKeyBinding().setKeyBinding(ktBinding);
isSymmetric = true;
}
}
returnKey = resolveKerberosToken(wssContext, token);
} else if (MessageConstants.EncryptedKey_NS.equals(valueType)) {
EncryptedKey token = (EncryptedKey) resolveToken(wsuId, context);
if (token == null) {
throw new KeySelectorException("Token with Id " + wsuId + "not found");
}
// for policy verification
WSSPolicy skBinding = null;
boolean saml = wssContext.getSecurityContext().getIsSAMLKeyBinding();
if (saml) {
skBinding = new AuthenticationTokenPolicy.SAMLAssertionBinding();
//reset the property, but why ?. Currently Policy is being inferred for
// every ED, so reset here will screw up again
//wssContext.getSecurityContext().setIsSAMLKeyBinding(false);
} else {
// for policy verification
SymmetricKeyBinding symkBinding = new SymmetricKeyBinding();
//AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
//symkBinding.setKeyBinding(x509Binding);
skBinding = symkBinding;
}
//TODO: ReferenceType and ValueType not set on X509Binding
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(skBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
if (((DerivedTokenKeyBinding) inferredKB).getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(skBinding);
}
}
// TODO: where are EKSHA1 and and SECRET_KEY values being set
String algo = wssContext.getAlgorithmSuite().getEncryptionAlgorithm();
returnKey = token.getKey(algo);
skBinding.setKeyBinding(token.getInferredKB());
} else if (MessageConstants.SCT_VALUETYPE.equals(valueType) || MessageConstants.SCT_13_VALUETYPE.equals(valueType)) {
// wsuId here could be wsuId or SCT Session Id
if (wssContext.isClient()) {
returnKey = resolveSCT(wssContext, wsuId, purpose);
}
if (returnKey == null) {
SecurityContextToken scToken = (SecurityContextToken) resolveToken(wsuId, context);
//wssContext.setExtraneousProperty(MessageConstants.INCOMING_SCT, scToken);
if (scToken == null) {
if (!wssContext.isClient()) {
// It will be executed on server-side when IncludeToken=Never
returnKey = resolveSCT(wssContext, wsuId, purpose);
} else {
throw new KeySelectorException("Token with Id " + wsuId + "not found");
}
} else {
returnKey = resolveSCT(wssContext, scToken.getSCId(), purpose);
}
}
SecureConversationTokenKeyBinding sctBinding = new SecureConversationTokenKeyBinding();
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(sctBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(sctBinding);
}
return returnKey;
} else if (MessageConstants.DKT_VALUETYPE.equals(valueType) ||
MessageConstants.DKT_13_VALUETYPE.equals(valueType)) {
DerivedKeyToken token = (DerivedKeyToken) resolveToken(wsuId, context);
if (token == null) {
throw new KeySelectorException("Token with Id " + wsuId + "not found");
}
returnKey = ((DerivedKeyToken) token).getKey();
DerivedTokenKeyBinding dtkBinding = new DerivedTokenKeyBinding();
dtkBinding.setOriginalKeyBinding(token.getInferredKB());
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(dtkBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
//already set - do nothing
} else {
//throw new XWSSecurityException("A derived Key Token should be a top level key binding");
}
//returnKey = ((DerivedKeyToken)token).getKey();
} else if (null == valueType) {
SecurityHeaderElement token = resolveToken(wsuId, context);
if (token == null) {
throw new KeySelectorException("Token with Id " + wsuId + " not found");
}
if (token instanceof X509BinarySecurityToken) {
// for policy verification
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
x509Binding.setReferenceType(MessageConstants.DIRECT_REFERENCE_TYPE);
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(x509Binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(inferredKB)) {
((SymmetricKeyBinding) inferredKB).setKeyBinding(x509Binding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
DerivedTokenKeyBinding dktBind = (DerivedTokenKeyBinding) inferredKB;
if (dktBind.getOriginalKeyBinding() == null) {
dktBind.setOriginalKeyBinding(x509Binding);
} else if (PolicyTypeUtil.symmetricKeyBinding(dktBind.getOriginalKeyBinding())) {
dktBind.getOriginalKeyBinding().setKeyBinding(x509Binding);
}
}
//
returnKey = resolveX509Token(wssContext, (X509BinarySecurityToken) token, purpose, isSymmetric);
} else if (token instanceof EncryptedKey) {
// for policy verification
SymmetricKeyBinding skBinding = new SymmetricKeyBinding();
AuthenticationTokenPolicy.X509CertificateBinding x509Binding = new AuthenticationTokenPolicy.X509CertificateBinding();
skBinding.setKeyBinding(x509Binding);
//TODO: ReferenceType and ValueType not set on X509Binding
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(skBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
if (((DerivedTokenKeyBinding) inferredKB).getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(skBinding);
}
}
//
String algo = wssContext.getAlgorithmSuite().getEncryptionAlgorithm();
returnKey = ((EncryptedKey) token).getKey(algo);
} else if (token instanceof DerivedKeyToken) {
// for policy verification
returnKey = ((DerivedKeyToken) token).getKey();
inferredKB = wssContext.getSecurityContext().getInferredKB();
DerivedTokenKeyBinding dtkBinding = new DerivedTokenKeyBinding();
dtkBinding.setOriginalKeyBinding(((DerivedKeyToken) token).getInferredKB());
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(dtkBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
//already set - do nothing
} else {
//throw new XWSSecurityException("A derived Key Token should be a top level key binding");
}
//
//returnKey = ((DerivedKeyToken)token).getKey();
} else if (token instanceof SecurityContextToken) {
// for policy verification
SecureConversationTokenKeyBinding sctBinding = new SecureConversationTokenKeyBinding();
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(sctBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(sctBinding);
}
//wssContext.setExtraneousProperty(MessageConstants.INCOMING_SCT, token);
returnKey = resolveSCT(wssContext, ((SecurityContextToken) token).getSCId(), purpose);
} else if (token instanceof UsernameToken) {
AuthenticationTokenPolicy.UsernameTokenBinding untBinding = new AuthenticationTokenPolicy.UsernameTokenBinding();
untBinding.setReferenceType(MessageConstants.DIRECT_REFERENCE_TYPE);
//SP13
if(((UsernameToken)token).getCreatedValue() != null) {
untBinding.setUseCreated(true);
}
if(((UsernameToken)token).getNonceValue() != null) {
untBinding.setUseNonce(true);
}
if (inferredKB == null) {
wssContext.getSecurityContext().setInferredKB(untBinding);
} else if (PolicyTypeUtil.derivedTokenKeyBinding(inferredKB)) {
if (((DerivedTokenKeyBinding) inferredKB).getOriginalKeyBinding() == null) {
((DerivedTokenKeyBinding) inferredKB).setOriginalKeyBinding(untBinding);
}
}