// }
if (secRefToken == null) {
throw new WSSecurityException
(WSSecurityException.INVALID_SECURITY, "noSecTokRef");
}
SecurityTokenReference secRef = new SecurityTokenReference(secRefToken);
/*
* Well, at this point there are several ways to get the key.
* Try to handle all of them :-).
*/
alias = null;
/*
* handle X509IssuerSerial here. First check if all elements are available,
* get the appropriate data, check if all data is available.
* If all is ok up to that point, look up the certificate alias according
* to issuer name and serial number.
* This method is recommended by OASIS WS-S specification, X509 profile
*/
if (secRef.containsX509Data() || secRef.containsX509IssuerSerial()) {
alias = secRef.getX509IssuerSerialAlias(crypto);
if (log.isDebugEnabled()) {
log.debug("X509IssuerSerial alias: " + alias);
}
}
/*
* If wsse:KeyIdentifier found, then the public key of the attached cert was used to
* encrypt the session (symmetric) key that encrypts the data. Extract the certificate
* using the BinarySecurity token (was enhanced to handle KeyIdentifier too).
* This method is _not_ recommended by OASIS WS-S specification, X509 profile
*/
else if (secRef.containsKeyIdentifier()) {
X509Certificate[] certs = secRef.getKeyIdentifier(crypto);
if (certs == null || certs.length < 1 || certs[0] == null) {
throw new WSSecurityException(WSSecurityException.FAILURE,
"invalidX509Data", new Object[]{"for decryption (KeyId)"});
}
/*
* Here we have the certificate. Now find the alias for it. Needed to identify
* the private key associated with this certificate
*/
alias = crypto.getAliasForX509Cert(certs[0]);
if (log.isDebugEnabled()) {
log.debug("cert: " + certs[0]);
log.debug("KeyIdentifier Alias: " + alias);
}
} else if (secRef.containsReference()) {
Element bstElement = secRef.getTokenElement(doc, null);
// at this point ... check token type: Binary
QName el =
new QName(bstElement.getNamespaceURI(),
bstElement.getLocalName());