ctx.setUnAttachedSecurityTokenReference(samlReference);
}
@SuppressWarnings("UnusedAssignment")
public void isValideToken(IssuedTokenContext ctx) throws WSTrustException {
WSTrustVersion wstVer = (WSTrustVersion)ctx.getOtherProperties().get(IssuedTokenContext.WS_TRUST_VERSION);
WSTrustElementFactory eleFac = WSTrustElementFactory.newInstance(wstVer);
// Get the token to be validated
Token token = ctx.getTarget();
// Validate the token and create the Status
// Only for SAML tokens for now: verify the signature and check
// the time stamp
Element element = eleFac.toElement(token.getTokenValue());
String code = wstVer.getValidStatusCodeURI();
String reason = "The Trust service successfully validate the input";
// Check if it is an SAML assertion
if (!isSAMLAssertion(element)){
code = wstVer.getInvalidStatusCodeURI();
reason = "The Trust service did not successfully validate the input";
}
//==============================
// validate the SAML asserttion
//==============================
// Get the STS's certificate and private key
final X509Certificate stsCert = (X509Certificate)ctx.getOtherProperties().get(IssuedTokenContext.STS_CERTIFICATE);
try{
boolean isValid = true;
// Verify the signature of the SAML assertion
isValid = SAMLUtil.verifySignature(element, stsCert.getPublicKey());
// validate time in Conditions
isValid = SAMLUtil.validateTimeInConditionsStatement(element);
if (!isValid){
code = wstVer.getInvalidStatusCodeURI();
reason = "The Trust service did not successfully validate the input";
}
}catch (XWSSecurityException ex){
throw new WSTrustException(ex.getMessage());
}
// Create the Status
Status status = eleFac.createStatus(code, reason);
// Get TokenType
String tokenType = ctx.getTokenType();
if (!wstVer.getValidateStatuesTokenType().equals(tokenType)){
// Todo: create a token of the required type
}
// populate the IssuedTokenContext
ctx.getOtherProperties().put(IssuedTokenContext.STATUS, status);