SecurityTokenReference.SECURITY_TOKEN_REFERENCE,
WSConstants.WSSE_NS
);
if (data.getWssConfig().isWsiBSPCompliant()) {
if (strElements.isEmpty()) {
throw new WSSecurityException(
WSSecurityException.INVALID_SECURITY, "noSecurityTokenReference"
);
} else if (strElements.size() > 1) {
throw new WSSecurityException(
WSSecurityException.INVALID_SECURITY, "badSecurityTokenReference"
);
}
}
if (strElements.isEmpty()) {
publicKey = parseKeyValue(keyInfoElement);
if (validator != null) {
Credential credential = new Credential();
credential.setPublicKey(publicKey);
principal = new PublicKeyPrincipal(publicKey);
credential.setPrincipal(principal);
validator.validate(credential, data);
}
} else {
STRParser strParser = new SignatureSTRParser();
Map<String, Object> parameters = new HashMap<String, Object>();
parameters.put(SignatureSTRParser.SIGNATURE_METHOD, signatureMethod);
parameters.put(
SignatureSTRParser.SECRET_KEY_LENGTH, new Integer(data.getWssConfig().getSecretKeyLength())
);
strParser.parseSecurityTokenReference(
strElements.get(0), data, wsDocInfo, parameters
);
principal = strParser.getPrincipal();
certs = strParser.getCertificates();
publicKey = strParser.getPublicKey();
secretKey = strParser.getSecretKey();
boolean trusted = strParser.isTrustedCredential();
if (trusted && LOG.isDebugEnabled()) {
LOG.debug("Direct Trust for SAML/BST credential");
}
if (!trusted && (publicKey != null || certs != null) && (validator != null)) {
Credential credential = new Credential();
credential.setPublicKey(publicKey);
credential.setCertificates(certs);
credential.setPrincipal(principal);
validator.validate(credential, data);
}
}
}
//
// Check that we have a certificate, a public key or a secret key with which to
// perform signature verification
//
if ((certs == null || certs.length == 0 || certs[0] == null)
&& secretKey == null
&& publicKey == null) {
throw new WSSecurityException(WSSecurityException.FAILED_CHECK);
}
XMLSignature xmlSignature =
verifyXMLSignature(elem, certs, publicKey, secretKey, signatureMethod, data, wsDocInfo);
byte[] signatureValue = xmlSignature.getSignatureValue().getValue();
String c14nMethod = xmlSignature.getSignedInfo().getCanonicalizationMethod().getAlgorithm();
// The c14n algorithm must be as specified by the BSP spec
if (data.getWssConfig().isWsiBSPCompliant()
&& !WSConstants.C14N_EXCL_OMIT_COMMENTS.equals(c14nMethod)) {
throw new WSSecurityException(
WSSecurityException.INVALID_SECURITY, "badC14nAlgo"
);
}
List<WSDataRef> dataRefs =
buildProtectedRefs(
elem.getOwnerDocument(), xmlSignature.getSignedInfo(), data.getWssConfig(), wsDocInfo
);
if (dataRefs.size() == 0) {
throw new WSSecurityException(WSSecurityException.FAILED_CHECK);
}
int actionPerformed = WSConstants.SIGN;
if (principal instanceof WSUsernameTokenPrincipal) {
actionPerformed = WSConstants.UT_SIGN;