// get the key wrap algorithm.
URI keyWrapAlgo = request.getKeyWrapAlgorithm();
// create proof-of-possession token and server entropy (if needed).
RequestedProofTokenType requestedProofToken = null;
EntropyType serverEntropy = null;
if (WSTrustConstants.KEY_TYPE_SYMMETRIC.equalsIgnoreCase(keyType.toString())) {
// symmetric key case: if client entropy is found, compute a key. If not, generate a new key.
requestedProofToken = new RequestedProofTokenType();
byte[] serverSecret = WSTrustUtil.createRandomSecret((int) keySize / 8);
BinarySecretType serverBinarySecret = new BinarySecretType();
serverBinarySecret.setType(WSTrustConstants.BS_TYPE_NONCE);
serverBinarySecret.setValue(Base64.encodeBytes(serverSecret).getBytes());
byte[] clientSecret = null;
EntropyType clientEntropy = request.getEntropy();
if (clientEntropy != null) {
clientSecret = Base64.decode(new String(WSTrustUtil.getBinarySecret(clientEntropy)));
serverEntropy = new EntropyType();
serverEntropy.addAny(serverBinarySecret);
}
if (clientSecret != null && clientSecret.length != 0) {
// client secret has been specified - combine it with the sts secret.
requestedProofToken.add(new ComputedKeyType(WSTrustConstants.CK_PSHA1));
byte[] combinedSecret = null;
try {
if( base64EncodeSecretKey == true ) {
combinedSecret = Base64.encodeBytes(WSTrustUtil.P_SHA1(clientSecret, serverSecret, (int) keySize / 8))
.getBytes();
}
else {
combinedSecret = WSTrustUtil.P_SHA1(clientSecret, serverSecret, (int) keySize / 8);
}
} catch (Exception e) {
throw logger.wsTrustCombinedSecretKeyError(e);
}
requestContext.setProofTokenInfo(WSTrustUtil.createKeyInfo(combinedSecret, providerPublicKey, keyWrapAlgo, providerCertificate));
} else {
// client secret has not been specified - use the sts secret only.
requestedProofToken.add(serverBinarySecret);
requestContext.setProofTokenInfo(WSTrustUtil.createKeyInfo(serverSecret, providerPublicKey,
keyWrapAlgo, providerCertificate));
}
} else if (WSTrustConstants.KEY_TYPE_PUBLIC.equalsIgnoreCase(keyType.toString())) {
// try to locate the client cert in the keystore using the caller principal as the alias.