Java WSConstants.SIGN属性代码示例

private WSPasswordCallback constructPasswordCallback(
        String username,
        int doAction
) throws WSSecurityException {

    int reason = WSPasswordCallback.UNKNOWN;

    switch (doAction) {
    case WSConstants.UT:
    case WSConstants.UT_SIGN:
        reason = WSPasswordCallback.USERNAME_TOKEN;
        break;
    case WSConstants.SIGN:
        reason = WSPasswordCallback.SIGNATURE;
        break;
    case WSConstants.ENCR:
        reason = WSPasswordCallback.KEY_NAME;
        break;
    }
    return new WSPasswordCallback(username, reason);
}
 

protected void doReceiverAction(int doAction, RequestData reqData)
    throws WSSecurityException {

    WSSConfig wssConfig = reqData.getWssConfig();
    if (wssConfig == null) {
        wssConfig = secEngine.getWssConfig();
    }
    boolean enableSigConf = decodeEnableSignatureConfirmation(reqData);
    wssConfig.setEnableSignatureConfirmation(
        enableSigConf || ((doAction & WSConstants.SC) != 0)
    );
    wssConfig.setTimeStampStrict(decodeTimestampStrict(reqData));
    wssConfig.setHandleCustomPasswordTypes(decodeCustomPasswordTypes(reqData));
    wssConfig.setPasswordsAreEncoded(decodeUseEncodedPasswords(reqData));
    wssConfig.setAllowNamespaceQualifiedPasswordTypes(
        decodeNamespaceQualifiedPasswordTypes(reqData)
    );
    wssConfig.setSecretKeyLength(reqData.getSecretKeyLength());
    reqData.setWssConfig(wssConfig);

    if ((doAction & WSConstants.SIGN) == WSConstants.SIGN) {
        decodeSignatureParameter2(reqData);
    }
    
    if ((doAction & WSConstants.ST_SIGNED) == WSConstants.ST_SIGNED) {
        decodeSignatureParameter2(reqData);
    }
    
    if ((doAction & WSConstants.ENCR) == WSConstants.ENCR) {
        decodeDecryptionParameter(reqData);
    }
    if ((doAction & WSConstants.NO_SERIALIZE) == WSConstants.NO_SERIALIZE) {
        reqData.setNoSerialization(true);
    }
}
 

private void handleSpecialUser(RequestData reqData) {
    if (!WSHandlerConstants.USE_REQ_SIG_CERT.equals(reqData.getEncUser())) {
        return;
    }
    Vector results = 
        (Vector) getProperty(reqData.getMsgContext(), WSHandlerConstants.RECV_RESULTS);
    if (results == null) {
        return;
    }
    /*
     * Scan the results for a matching actor. Use results only if the
     * receiving Actor and the sending Actor match.
     */
    for (int i = 0; i < results.size(); i++) {
        WSHandlerResult rResult =
            (WSHandlerResult) results.get(i);
        String hActor = rResult.getActor();
        if (!WSSecurityUtil.isActorEqual(reqData.getActor(), hActor)) {
            continue;
        }
        Vector wsSecEngineResults = rResult.getResults();
        /*
         * Scan the results for the first Signature action. Use the
         * certificate of this Signature to set the certificate for the
         * encryption action :-).
         */
        for (int j = 0; j < wsSecEngineResults.size(); j++) {
            WSSecurityEngineResult wser =
                (WSSecurityEngineResult) wsSecEngineResults.get(j);
            int wserAction = 
                ((java.lang.Integer)wser.get(WSSecurityEngineResult.TAG_ACTION)).intValue();
            if (wserAction == WSConstants.SIGN) {
                X509Certificate cert = 
                    (X509Certificate)wser.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
                reqData.setEncCert(cert);
                return;
            }
        }
    }
}
 

public static int decodeAction(String action, Vector actions) throws WSSecurityException {

        int doAction = 0;
        if (action == null) {
            return doAction;
        }
        String single[] = StringUtil.split(action, ' ');
        for (int i = 0; i < single.length; i++) {
            if (single[i].equals(WSHandlerConstants.NO_SECURITY)) {
                doAction = WSConstants.NO_SECURITY;
                return doAction;
            } else if (single[i].equals(WSHandlerConstants.USERNAME_TOKEN)) {
                doAction |= WSConstants.UT;
                actions.add(new Integer(WSConstants.UT));
            } else if (single[i].equals(WSHandlerConstants.SIGNATURE)) {
                doAction |= WSConstants.SIGN;
                actions.add(new Integer(WSConstants.SIGN));
            } else if (single[i].equals(WSHandlerConstants.ENCRYPT)) {
                doAction |= WSConstants.ENCR;
                actions.add(new Integer(WSConstants.ENCR));
            } else if (single[i].equals(WSHandlerConstants.SAML_TOKEN_UNSIGNED)) {
                doAction |= WSConstants.ST_UNSIGNED;
                actions.add(new Integer(WSConstants.ST_UNSIGNED));
            } else if (single[i].equals(WSHandlerConstants.SAML_TOKEN_SIGNED)) {
                doAction |= WSConstants.ST_SIGNED;
                actions.add(new Integer(WSConstants.ST_SIGNED));
            } else if (single[i].equals(WSHandlerConstants.TIMESTAMP)) {
                doAction |= WSConstants.TS;
                actions.add(new Integer(WSConstants.TS));
            } else if (single[i].equals(WSHandlerConstants.NO_SERIALIZATION)) {
                doAction |= WSConstants.NO_SERIALIZE;
                actions.add(new Integer(WSConstants.NO_SERIALIZE));
            } else if (single[i].equals(WSHandlerConstants.SIGN_WITH_UT_KEY)) {
                doAction |= WSConstants.UT_SIGN;
                actions.add(new Integer(WSConstants.UT_SIGN));
            } else if (single[i].equals(WSHandlerConstants.ENABLE_SIGNATURE_CONFIRMATION)) {
                doAction |= WSConstants.SC;
                actions.add(new Integer(WSConstants.SC));
            } else {
                throw new WSSecurityException(
                    "Unknown action defined: " + single[i]
                );
            }
        }
        return doAction;
    }
 

/**
 * Search through a WSS4J results vector for a single signature covering all
 * these elements.
 * 
 * NOTE: it is important that the given elements are those that are 
 * referenced using wsu:Id. When the signed element is referenced using a
 * transformation such as XPath filtering the validation is carried out 
 * in signature verification itself.
 * 
 * @param results results (e.g., as stored as WSHandlerConstants.RECV_RESULTS on
 *                an Axis MessageContext)
 * @param elements the elements to check
 * @return the identity of the signer
 * @throws WSSecurityException if no suitable signature could be found or if any element
 *                             didn't have a wsu:Id attribute
 */
public static X509Certificate ensureSignedTogether(Iterator results, Element[] elements) 
    throws WSSecurityException {
    log.debug("ensureSignedTogether()");

    if (results == null) {
        throw new IllegalArgumentException("No results vector");
    }
    if (elements == null || elements.length == 0) {
        throw new IllegalArgumentException("No elements to check!");
    }

    // Turn the list of required elements into a list of required wsu:Id
    // strings
    String[] requiredIDs = new String[elements.length];
    for (int i = 0; i < elements.length; i++) {
        Element e = (Element) elements[i];
        if (e == null) {
            throw new IllegalArgumentException("elements[" + i + "] is null!");
        }
        requiredIDs[i] = e.getAttributeNS(WSConstants.WSU_NS, "Id");
        if (requiredIDs[i] == null) {
            throw new WSSecurityException(
                WSSecurityException.FAILED_CHECK,
                "requiredElementNoID", 
                new Object[] {e.getNodeName()}
            );
        }
        log.debug("Required element " + e.getNodeName() + " has wsu:Id " + requiredIDs[i]);
    }

    WSSecurityException fault = null;

    // Search through the results for a SIGN result
    while (results.hasNext()) {
        WSHandlerResult result = (WSHandlerResult) results.next();
        Iterator actions = result.getResults().iterator();

        while (actions.hasNext()) {
            WSSecurityEngineResult resultItem = 
                (WSSecurityEngineResult) actions.next();
            int resultAction = 
                ((java.lang.Integer)resultItem.get(WSSecurityEngineResult.TAG_ACTION)).intValue();
            
            if (resultAction == WSConstants.SIGN) {
                try {
                    checkSignsAllElements(resultItem, requiredIDs);
                    return 
                        (X509Certificate)resultItem.get(
                            WSSecurityEngineResult.TAG_X509_CERTIFICATE
                        );
                } catch (WSSecurityException ex) {
                    // Store the exception but keep going... there may be a
                    // better signature later
                    log.debug("SIGN result does not sign all required elements", ex);
                    fault = ex;
                }
            }
        }
    }

    if (fault != null)
        throw fault;

    throw new WSSecurityException(WSSecurityException.FAILED_CHECK, "noSignResult");
}
 

/**
 * Ensure that this signature covers all required elements (identified by
 * their wsu:Id attributes).
 * 
 * @param resultItem the signature to check
 * @param requiredIDs the list of wsu:Id values that must be covered
 * @throws WSSecurityException if any required element is not included
 */
private static void checkSignsAllElements(
    WSSecurityEngineResult resultItem, 
    String[] requiredIDs
) throws WSSecurityException {
    int resultAction = 
        ((java.lang.Integer)resultItem.get(WSSecurityEngineResult.TAG_ACTION)).intValue();
    if (resultAction != WSConstants.SIGN) {
        throw new IllegalArgumentException("Not a SIGN result");
    }

    Set sigElems = (Set)resultItem.get(WSSecurityEngineResult.TAG_SIGNED_ELEMENT_IDS);
    if (sigElems == null) {
        throw new RuntimeException(
            "Missing signedElements set in WSSecurityEngineResult!"
        );
    }

    log.debug("Found SIGN result...");
    for (Iterator i = sigElems.iterator(); i.hasNext();) {
        Object sigElement = i.next();
        if(sigElement instanceof String) {
            log.debug("Signature includes element with ID " + sigElement);
        } else {
            log.debug("Signature includes element with null uri " + sigElement.toString());
        }
    }

    log.debug("Checking required elements are in the signature...");
    for (int i = 0; i < requiredIDs.length; i++) {
        if (!sigElems.contains(requiredIDs[i])) {
            throw new WSSecurityException(
                WSSecurityException.FAILED_CHECK,
                "requiredElementNotSigned",
                new Object[] {requiredIDs[i]}
            );
        }
        log.debug("Element with ID " + requiredIDs[i] + " was correctly signed");
    }
    log.debug("All required elements are signed");
}
 

/**
 * A test for "SignatureAction does not set DigestAlgorithm on WSSecSignature instance"
 */
public void testMultipleCertsWSHandler() throws Exception {
    final WSSConfig cfg = WSSConfig.getNewInstance();
    final int action = WSConstants.SIGN;
    final RequestData reqData = new RequestData();
    reqData.setWssConfig(cfg);
    reqData.setUsername("wss40");
    java.util.Map config = new java.util.TreeMap();
    config.put(WSHandlerConstants.SIG_PROP_FILE, "wss40.properties");
    config.put("password", "security");
    config.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference");
    config.put(WSHandlerConstants.USE_SINGLE_CERTIFICATE, "false");
    reqData.setMsgContext(config);
    
    final java.util.Vector actions = new java.util.Vector();
    actions.add(new Integer(action));
    Document doc = unsignedEnvelope.getAsDocument();
    MyHandler handler = new MyHandler();
    handler.send(
        action, 
        doc, 
        reqData, 
        actions,
        true
    );
    
    //
    // Verify the signature
    //
    Vector results = verify(doc, cryptoCA);
    WSSecurityEngineResult result = 
        WSSecurityUtil.fetchActionResult(results, WSConstants.SIGN);
    X509Certificate cert = 
        (X509Certificate)result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
    assertTrue (cert != null);
    X509Certificate[] certs = 
        (X509Certificate[])result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATES);
    assertTrue (certs != null && certs.length == 2);
    
    assertTrue(handler.verifyTrust(certs, reqData));
}
 

/**
 * A test for "SignatureAction does not set DigestAlgorithm on WSSecSignature instance"
 */
public void
testWSS170() throws Exception {
    final WSSConfig cfg = WSSConfig.getNewInstance();
    final int action = WSConstants.SIGN;
    final RequestData reqData = new RequestData();
    reqData.setWssConfig(cfg);
    reqData.setUsername("16c73ab6-b892-458f-abf5-2f875f74882e");
    java.util.Map config = new java.util.TreeMap();
    config.put(WSHandlerConstants.SIG_PROP_FILE, "crypto.properties");
    config.put("password", "security");
    config.put(
        WSHandlerConstants.SIG_ALGO, 
        "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
    );
    config.put(
        WSHandlerConstants.SIG_DIGEST_ALGO, 
        "http://www.w3.org/2001/04/xmlenc#sha256"
    );
    reqData.setMsgContext(config);
    
    final java.util.Vector actions = new java.util.Vector();
    actions.add(new Integer(action));
    final Document doc = unsignedEnvelope.getAsDocument();
    MyHandler handler = new MyHandler();
    handler.doit(
        action, 
        doc, 
        reqData, 
        actions
    );
    String outputString = 
        org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(doc);
    if (LOG.isDebugEnabled()) {
        LOG.debug("Signed message:");
        LOG.debug(outputString);
    }
    assertTrue(
        outputString.indexOf("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256") != -1
    );
    assertTrue(
        outputString.indexOf("http://www.w3.org/2001/04/xmlenc#sha256") != -1
    );
    
    verify(doc);
}