* Licensed to the Apache Software Foundation (ASF) under one

* or more contributor license agreements. See the NOTICE file

* distributed with this work for additional information

* regarding copyright ownership. The ASF licenses this file

* to you under the Apache License, Version 2.0 (the

* "License"); you may not use this file except in compliance

* with the License. You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing,

* software distributed under the License is distributed on an

* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

* KIND, either express or implied. See the License for the

* specific language governing permissions and limitations

* under the License.

*/

* Some unit tests for the issue operation to issue SAML tokens.

*/

   

    public static final QName REQUESTED_SECURITY_TOKEN =

        QNameConstants.WS_TRUST_FACTORY.createRequestedSecurityToken(null).getName();

    public static final QName ATTACHED_REFERENCE =

        QNameConstants.WS_TRUST_FACTORY.createRequestedAttachedReference(null).getName();

    public static final QName UNATTACHED_REFERENCE =

        QNameConstants.WS_TRUST_FACTORY.createRequestedUnattachedReference(null).getName();

       

    private static boolean unrestrictedPoliciesInstalled;

       

    static {

        unrestrictedPoliciesInstalled = TestUtils.checkUnrestrictedPoliciesInstalled();

    };

   

    /**

     * Test to successfully issue a Saml 1.1 token.

     */

    @org.junit.Test

    public void testIssueSaml1Token() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML1Constants.CONF_BEARER));

    }

   

    /**

     * Test to successfully issue a Saml 2 token.

     */

    @org.junit.Test

    public void testIssueSaml2Token() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML2Constants.CONF_BEARER));

    }

   

    /**

     * Test to successfully issue a Saml 2 token, submitting an AppliesTo URI Element, instead

     * of the usual EPR one.

     */

    @org.junit.Test

    public void testIssueSaml2AppliesToURIToken() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToURIElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML2Constants.CONF_BEARER));

    }

   

    /**

     * Test to successfully issue multiple Saml tokens. It request a SAML 1.1 and SAML 2 token.

     */

    @org.junit.Test

    public void testIssueMultipleSamlTokens() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenCollectionType requestCollection =

            new RequestSecurityTokenCollectionType();

        // SAML 1.1 request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

        requestCollection.getRequestSecurityToken().add(request);

       

        // SAML 2 request

        request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType2 =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType2);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

        requestCollection.getRequestSecurityToken().add(request);

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(requestCollection, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertEquals(securityTokenResponse.size(), 2);

       

        // Test the generated tokens.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML1Constants.CONF_BEARER));

       

        for (Object tokenObject : securityTokenResponse.get(1).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML2Constants.CONF_BEARER));

    }

   

    /**

     * Test to successfully issue an encrypted Saml 2 token.

     */

    @org.junit.Test

    public void testIssueEncryptedSaml2Token() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

        issueOperation.setEncryptIssuedToken(true);

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        EncryptionProperties encryptionProperties = new EncryptionProperties();

        if (!unrestrictedPoliciesInstalled) {

            encryptionProperties.setEncryptionAlgorithm(WSConstants.AES_128);

        }

        service.setEncryptionProperties(encryptionProperties);

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertFalse(tokenString.contains("AttributeStatement"));

        assertFalse(tokenString.contains("alice"));

        assertTrue(tokenString.contains("EncryptedData"));

    }

   

    /**

     * Test to successfully issue a Saml 1.1 PublicKey token.

     */

    @org.junit.Test

    public void testIssueSaml1PublicKeyToken() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        JAXBElement<String> keyType =

            new JAXBElement<String>(

                QNameConstants.KEY_TYPE, String.class, STSConstants.PUBLIC_KEY_KEYTYPE

            );

        request.getAny().add(keyType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        try {

            issueOperation.issue(request, webServiceContext);

            fail("Failure expected on no certificate");

        } catch (STSException ex) {

            // expected failure on no certificate

        }

       

        // Now add UseKey

        UseKeyType useKey = createUseKey(crypto, "myclientkey");

        JAXBElement<UseKeyType> useKeyType =

            new JAXBElement<UseKeyType>(QNameConstants.USE_KEY, UseKeyType.class, useKey);

        request.getAny().add(useKeyType);

       

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertFalse(tokenString.contains(SAML1Constants.CONF_BEARER));

        assertTrue(tokenString.contains(SAML1Constants.CONF_HOLDER_KEY));

    }

   

    /**

     * Test to successfully issue a Saml2 SymmetricKey token.

     */

    @org.junit.Test

    public void testIssueSaml2SymmetricKeyToken() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        JAXBElement<String> keyType =

            new JAXBElement<String>(

                QNameConstants.KEY_TYPE, String.class, STSConstants.SYMMETRIC_KEY_KEYTYPE

            );

        request.getAny().add(keyType);

        JAXBElement<String> computedKey =

            new JAXBElement<String>(

                QNameConstants.COMPUTED_KEY_ALGORITHM, String.class, STSConstants.COMPUTED_KEY_PSHA1

            );

        request.getAny().add(computedKey);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Now add Entropy

        BinarySecretType binarySecretType = new BinarySecretType();

        binarySecretType.setType(STSConstants.NONCE_TYPE);

        binarySecretType.setValue(WSSecurityUtil.generateNonce(256 / 8));

        JAXBElement<BinarySecretType> binarySecretTypeJaxb =

            new JAXBElement<BinarySecretType>(

                QNameConstants.BINARY_SECRET, BinarySecretType.class, binarySecretType

            );

       

        EntropyType entropyType = new EntropyType();

        entropyType.getAny().add(binarySecretTypeJaxb);

        JAXBElement<EntropyType> entropyJaxbType =

            new JAXBElement<EntropyType>(QNameConstants.ENTROPY, EntropyType.class, entropyType);

        request.getAny().add(entropyJaxbType);

       

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertFalse(tokenString.contains(SAML2Constants.CONF_BEARER));

        assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));

    }

   

    /**

     * Test to successfully issue a Saml2 SymmetricKey token. Rather than using a Nonce as the

     * Entropy, a secret key is supplied by the client instead.

     */

    @org.junit.Test

    public void testIssueSaml2SymmetricKeyTokenSecretKey() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        JAXBElement<String> keyType =

            new JAXBElement<String>(

                QNameConstants.KEY_TYPE, String.class, STSConstants.SYMMETRIC_KEY_KEYTYPE

            );

        request.getAny().add(keyType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Now add Entropy

        BinarySecretType binarySecretType = new BinarySecretType();

        binarySecretType.setType(STSConstants.SYMMETRIC_KEY_TYPE);

        binarySecretType.setValue(WSSecurityUtil.generateNonce(256 / 8));

        JAXBElement<BinarySecretType> binarySecretTypeJaxb =

            new JAXBElement<BinarySecretType>(

                QNameConstants.BINARY_SECRET, BinarySecretType.class, binarySecretType

            );

       

        EntropyType entropyType = new EntropyType();

        entropyType.getAny().add(binarySecretTypeJaxb);

        JAXBElement<EntropyType> entropyJaxbType =

            new JAXBElement<EntropyType>(QNameConstants.ENTROPY, EntropyType.class, entropyType);

        request.getAny().add(entropyJaxbType);

       

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertFalse(tokenString.contains(SAML2Constants.CONF_BEARER));

        assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));

    }

   

    /**

     * Test to successfully issue a Saml2 SymmetricKey token. Rather than using a Nonce as the Entropy,

     * a secret key is supplied by the client instead in an EncryptedKey structure.

     */

    @org.junit.Test

    public void testIssueSaml2SymmetricKeyTokenEncryptedKey() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        JAXBElement<String> keyType =

            new JAXBElement<String>(

                QNameConstants.KEY_TYPE, String.class, STSConstants.SYMMETRIC_KEY_KEYTYPE

            );

        request.getAny().add(keyType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Now add Entropy

        WSSecEncryptedKey builder = new WSSecEncryptedKey();

        builder.setUserInfo("mystskey");

        builder.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);

        builder.setKeyEncAlgo(WSConstants.KEYTRANSPORT_RSAOEP);

       

        Document doc = DOMUtils.createDocument();

        builder.prepare(doc, stsProperties.getSignatureCrypto());

        Element encryptedKeyElement = builder.getEncryptedKeyElement();

        byte[] secret = builder.getEphemeralKey();

       

        EntropyType entropyType = new EntropyType();

        entropyType.getAny().add(encryptedKeyElement);

        JAXBElement<EntropyType> entropyJaxbType =

            new JAXBElement<EntropyType>(QNameConstants.ENTROPY, EntropyType.class, entropyType);

        request.getAny().add(entropyJaxbType);

       

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertFalse(tokenString.contains(SAML2Constants.CONF_BEARER));

        assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));

       

        // Test that the (encrypted) secret sent in Entropy was used in the SAML Subject KeyInfo

        SamlAssertionWrapper assertionWrapper = new SamlAssertionWrapper(assertion);

        RequestData data = new RequestData();

       

        Properties properties = new Properties();

        properties.put(

            "org.apache.wss4j.crypto.provider", "org.apache.wss4j.common.crypto.Merlin"

        );

        properties.put("org.apache.wss4j.crypto.merlin.keystore.password", "sspass");

        properties.put("org.apache.wss4j.crypto.merlin.keystore.file", "servicestore.jks");

       

        data.setDecCrypto(CryptoFactory.getInstance(properties));

        data.setCallbackHandler(new PasswordCallbackHandler());

        data.setWssConfig(WSSConfig.getNewInstance());

       

        assertionWrapper.parseSubject(

            new WSSSAMLKeyInfoProcessor(data, new WSDocInfo(assertion.getOwnerDocument())),

                                        data.getSigVerCrypto(), data.getCallbackHandler()

        );

       

        SAMLKeyInfo samlKeyInfo = assertionWrapper.getSubjectKeyInfo();

        assertTrue(Arrays.equals(secret, samlKeyInfo.getSecret()));

    }

   

   

    /**

     * Test to successfully issue a Saml 1.1 token with no References

     */

    @org.junit.Test

    public void testIssueSaml1TokenNoReference() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

        issueOperation.setReturnReferences(false);

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test that no references were returned

        boolean foundReference = false;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && (ATTACHED_REFERENCE.equals(((JAXBElement<?>)tokenObject).getName())

                || UNATTACHED_REFERENCE.equals(((JAXBElement<?>)tokenObject).getName()))) {

                foundReference = true;

                break;

            }

        }

       

        assertFalse(foundReference);

    }

   

    /**

     * Test to successfully issue a Saml 2 token using a specified C14n Algorithm.

     */

    @org.junit.Test

    public void testIssueSaml2DifferentC14nToken() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

       

        SignatureProperties sigProperties = new SignatureProperties();

        List<String> acceptedC14nAlgorithms = new ArrayList<String>();

        acceptedC14nAlgorithms.add(WSConstants.C14N_EXCL_OMIT_COMMENTS);

        acceptedC14nAlgorithms.add(WSConstants.C14N_EXCL_WITH_COMMENTS);

        sigProperties.setAcceptedC14nAlgorithms(acceptedC14nAlgorithms);

        stsProperties.setSignatureProperties(sigProperties);

       

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

        JAXBElement<String> c14nAlg =

            new JAXBElement<String>(

                QNameConstants.C14N_ALGORITHM, String.class, WSConstants.C14N_EXCL_WITH_COMMENTS

            );

        request.getAny().add(c14nAlg);

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML2Constants.CONF_BEARER));

        assertTrue(tokenString.contains(WSConstants.C14N_EXCL_WITH_COMMENTS));

    }

   

    /**

     * Test to successfully issue a Saml 2 token using a specified Signature Algorithm.

     */

    @org.junit.Test

    public void testIssueSaml2DifferentSignatureToken() throws Exception {

        if (!TestUtils.checkUnrestrictedPoliciesInstalled()) {

            return;

        }

       

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

       

        SignatureProperties sigProperties = new SignatureProperties();

        List<String> acceptedSignatureAlgorithms = new ArrayList<String>();

        String signatureAlgorithm = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";

        acceptedSignatureAlgorithms.add(signatureAlgorithm);

        acceptedSignatureAlgorithms.add(WSConstants.RSA_SHA1);

        sigProperties.setAcceptedSignatureAlgorithms(acceptedSignatureAlgorithms);

        stsProperties.setSignatureProperties(sigProperties);

       

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

        JAXBElement<String> signatureAlg =

            new JAXBElement<String>(

                QNameConstants.SIGNATURE_ALGORITHM, String.class, signatureAlgorithm

            );

        request.getAny().add(signatureAlg);

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

                break;

            }

        }

       

        assertNotNull(assertion);

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML2Constants.CONF_BEARER));

        assertTrue(tokenString.contains(signatureAlgorithm));

    }

   

    /**

     * Test to UseKey validation

     */

    @org.junit.Test

    public void testUseKey() throws Exception {

        TokenIssueOperation issueOperation = new TokenIssueOperation();

       

        // Add Token Provider

        List<TokenProvider> providerList = new ArrayList<TokenProvider>();

        providerList.add(new SAMLTokenProvider());

        issueOperation.setTokenProviders(providerList);

       

        // Add Service

        ServiceMBean service = new StaticService();

        service.setEndpoints(Collections.singletonList("http://dummy-service.com/dummy"));

        issueOperation.setServices(Collections.singletonList(service));

       

        // Add STSProperties object

        STSPropertiesMBean stsProperties = new StaticSTSProperties();

        Crypto crypto = CryptoFactory.getInstance(getEncryptionProperties());

        stsProperties.setEncryptionCrypto(crypto);

        stsProperties.setSignatureCrypto(crypto);

        stsProperties.setEncryptionUsername("myservicekey");

        stsProperties.setSignatureUsername("mystskey");

        stsProperties.setCallbackHandler(new PasswordCallbackHandler());

        stsProperties.setIssuer("STS");

        issueOperation.setStsProperties(stsProperties);

       

        // Mock up a request

        RequestSecurityTokenType request = new RequestSecurityTokenType();

        JAXBElement<String> tokenType =

            new JAXBElement<String>(

                QNameConstants.TOKEN_TYPE, String.class, WSConstants.WSS_SAML2_TOKEN_TYPE

            );

        request.getAny().add(tokenType);

        JAXBElement<String> keyType =

            new JAXBElement<String>(

                QNameConstants.KEY_TYPE, String.class, STSConstants.PUBLIC_KEY_KEYTYPE

            );

        request.getAny().add(keyType);

       

        UseKeyType useKey = createUseKey(crypto, "myclientkey");

        JAXBElement<UseKeyType> useKeyType =

            new JAXBElement<UseKeyType>(QNameConstants.USE_KEY, UseKeyType.class, useKey);

        request.getAny().add(useKeyType);

       

        request.getAny().add(createAppliesToElement("http://dummy-service.com/dummy"));

       

        // Mock up message context

        MessageImpl msg = new MessageImpl();

        WrappedMessageContext msgCtx = new WrappedMessageContext(msg);

        msgCtx.put(

            SecurityContext.class.getName(),

            createSecurityContext(new CustomTokenPrincipal("alice"))

        );

        WebServiceContextImpl webServiceContext = new WebServiceContextImpl(msgCtx);

       

        // Issue a token

        RequestSecurityTokenResponseCollectionType response =

            issueOperation.issue(request, webServiceContext);

        List<RequestSecurityTokenResponseType> securityTokenResponse =

            response.getRequestSecurityTokenResponse();

        assertTrue(!securityTokenResponse.isEmpty());

       

        // Test the generated token.

        Element assertion = null;

        for (Object tokenObject : securityTokenResponse.get(0).getAny()) {

            if (tokenObject instanceof JAXBElement<?>

                && REQUESTED_SECURITY_TOKEN.equals(((JAXBElement<?>)tokenObject).getName())) {

                RequestedSecurityTokenType rstType =

                    (RequestedSecurityTokenType)((JAXBElement<?>)tokenObject).getValue();

                assertion = (Element)rstType.getAny();

            }

        }

       

        String tokenString = DOM2Writer.nodeToString(assertion);

        assertTrue(tokenString.contains("AttributeStatement"));

        assertTrue(tokenString.contains("alice"));

        assertTrue(tokenString.contains(SAML2Constants.CONF_HOLDER_KEY));

       

        // Now remove the UseKey + send a non-trusted UseKey certificate

        request.getAny().remove(useKeyType);

       

        Properties properties = new Properties();

        properties.put(

            "org.apache.wss4j.crypto.provider", "org.apache.wss4j.common.crypto.Merlin"

        );

        properties.put("org.apache.wss4j.crypto.merlin.keystore.password", "evespass");

        properties.put("org.apache.wss4j.crypto.merlin.keystore.file", "eve.jks");

       

        useKey = createUseKey(CryptoFactory.getInstance(properties), "eve");