@Override
public void handle(final InputProcessorChain inputProcessorChain, final XMLSecurityProperties securityProperties,
Deque<XMLSecEvent> eventQueue, Integer index) throws XMLSecurityException {
@SuppressWarnings("unchecked")
final UsernameTokenType usernameTokenType =
((JAXBElement<UsernameTokenType>) parseStructure(eventQueue, index, securityProperties)).getValue();
final List<XMLSecEvent> xmlSecEvents = getResponsibleXMLSecEvents(eventQueue, index);
checkBSPCompliance(inputProcessorChain, usernameTokenType, xmlSecEvents);
if (usernameTokenType.getId() == null) {
usernameTokenType.setId(IDGenerator.generateID(null));
}
// Verify Created
final WSSSecurityProperties wssSecurityProperties = (WSSSecurityProperties) securityProperties;
Date createdDate = verifyCreated(wssSecurityProperties, usernameTokenType);
ReplayCache replayCache = wssSecurityProperties.getNonceReplayCache();
final EncodedString encodedNonce =
XMLSecurityUtils.getQNameType(usernameTokenType.getAny(), WSSConstants.TAG_wsse_Nonce);
if (encodedNonce != null && replayCache != null) {
// Check for replay attacks
String nonce = encodedNonce.getValue();
if (replayCache.contains(nonce)) {
throw new WSSecurityException(WSSecurityException.ErrorCode.FAILED_AUTHENTICATION);
}
// If no Created, then just cache for the default time
// Otherwise, cache for the configured TTL of the UsernameToken Created time, as any
// older token will just get rejected anyway
int utTTL = wssSecurityProperties.getUtTTL();
if (createdDate == null || utTTL <= 0) {
replayCache.add(nonce);
} else {
replayCache.add(nonce, utTTL + 1L);
}
}
final WSInboundSecurityContext wsInboundSecurityContext = (WSInboundSecurityContext) inputProcessorChain.getSecurityContext();
final List<QName> elementPath = getElementPath(eventQueue);
final TokenContext tokenContext = new TokenContext(wssSecurityProperties, wsInboundSecurityContext, xmlSecEvents, elementPath);
UsernameTokenValidator usernameTokenValidator =
wssSecurityProperties.getValidator(WSSConstants.TAG_wsse_UsernameToken);
if (usernameTokenValidator == null) {
usernameTokenValidator = new UsernameTokenValidatorImpl();
}
//jdk 1.6 compiler bug? http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6302954
//type parameters of <T>T cannot be determined; no unique maximal instance exists for type variable T with
// upper bounds org.apache.wss4j.stax.securityToken.UsernameSecurityToken,
// org.apache.wss4j.stax.securityToken.UsernameSecurityToken,
// org.apache.xml.security.stax.ext.securityToken.InboundSecurityToken
//works fine on jdk 1.7
final UsernameSecurityToken usernameSecurityToken =
usernameTokenValidator.</*fake @see above*/UsernameSecurityTokenImpl>
validate(usernameTokenType, tokenContext);
SecurityTokenProvider<InboundSecurityToken> securityTokenProvider =
new SecurityTokenProvider<InboundSecurityToken>() {
@Override
public InboundSecurityToken getSecurityToken() throws XMLSecurityException {
return (InboundSecurityToken)usernameSecurityToken;
}
@Override
public String getId() {
return usernameTokenType.getId();
}
};
inputProcessorChain.getSecurityContext().registerSecurityTokenProvider(usernameTokenType.getId(), securityTokenProvider);
//fire a tokenSecurityEvent
UsernameTokenSecurityEvent usernameTokenSecurityEvent = new UsernameTokenSecurityEvent();
usernameTokenSecurityEvent.setSecurityToken((UsernameSecurityToken)securityTokenProvider.getSecurityToken());
// usernameTokenSecurityEvent.setUsernameTokenProfile(WSSConstants.NS_USERNAMETOKEN_PROFILE11);
usernameTokenSecurityEvent.setCorrelationID(usernameTokenType.getId());
inputProcessorChain.getSecurityContext().registerSecurityEvent(usernameTokenSecurityEvent);
}