// object as well.
public RequestSecurityTokenResponse exchange(RequestSecurityToken tokenRequest) throws AxisFault {
if (tokenRequest != null) {
// Check the request type, this service only understands requests for token issue
if (TrustConstants.REQUEST_ISSUE.equals(tokenRequest.getRequestType())) {
SecurityTokenOrReference requestedToken = null;
Document doc = tokenRequest.getDocument();
// Check the token type being requested, this service returns only X509 certs or UsernameTokens
if (TokenTypes.X509.equals(tokenRequest.getTokenType())) {
try {
// Construct an arbitrary x509 certificate (certificate content is hard-coded) any x509 request returns the same certificate
// A real service would do something more intelligent
InputStream inputStream = new ByteArrayInputStream("-----BEGIN CERTIFICATE-----\nMIICTTCCAbagAwIBAgIDC6tXMA0GCSqGSIb3DQEBBAUAMGExCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZCYXllcm4xDzANBgNVBAcTBk11bmljaDEPMA0GA1UEChMGQXBhY2hlMQ4wDAYDVQQLEwVXU1M0SjEPMA0GA1UEAxMGV2VybmVyMB4XDTA0MDUxMDA2MjgzMloXDTA0MDUxMDE4MzMzMlowdjELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJheWVybjEPMA0GA1UEBxMGTXVuaWNoMQ8wDQYDVQQKEwZBcGFjaGUxDjAMBgNVBAsTBVdTUzRKMQ8wDQYDVQQDEwZXZXJuZXIxEzARBgNVBAMTCjEzNDU1MDc0NzQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJbir9ayJesk3Yj+L1gDlS8TbtEj5DYLMhIYDA/Ycef2WEQ+pNIPTpeZ27SYEgf8Kmxpt4HHE5WJ8M9wnpB6EDQwi8vIQLTkaemJHGuWH8rbFY4CwFtQKEro63+agiSzbWZkpOFX4RFyX/Y5lOgZcW0q0yhumG2ZdMKViS81gx4BAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAPxYMCzAIoe0/DhT2NPpfl8+3vHV33YIbzlaejoV47KeR9IjPvKNS3PK0Mke3eKgJo/11DplnVpx9inKYaatPT/ZRz0eJ1+oTPe1kRYMDhO/OWCZhvVWQZPA9M8TWrDWJKwa6HlEmsbZGMnoGwEQ+7S3eD9TsqFf83CD+6Yr8wkM=\n-----END CERTIFICATE-----".getBytes());
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) cf.generateCertificate(inputStream);
// Add the cert to a <BinarySecurityToken> element
X509Security binaryToken = new X509Security(WSSConfig.getDefaultWSConfig(),doc);
binaryToken.setX509Certificate(cert);
// Set the <BinarySecurityToken> as the <RequestedToken> in our response
requestedToken = new SecurityTokenOrReference(binaryToken);
} catch (Exception e) {
throw new AxisFault("Could not create X.509 Security Token: " + e.getMessage());
}
} else if (TokenTypes.USERNAME.equals(tokenRequest.getTokenType())) {
// Create an arbitrary, fixed UsernameToken to return if the client requests one
// A real security token service would do something more intelligent
UsernameToken userToken = new UsernameToken(WSSConfig.getDefaultWSConfig(),doc);
userToken.setName("bob");
userToken.setPassword("bobspass");
// Create a new SecurityTokenOrReference object to use for the <RequestedToken> element
// As the class name implies SecurityTokenOrReference objects can hold either a real security token element
// or a <SecurityTokenReference> element to a security token found elsewhere
requestedToken = new SecurityTokenOrReference(userToken);
}
// Create our response object, giving it an XML document object to use for element creation, along with our requestedToken object
RequestSecurityTokenResponse tokenResponse = new RequestSecurityTokenResponse(doc, requestedToken);