Mercurial > dive4elements > river

annotate flys-client/src/main/java/de/intevation/flys/client/server/was/Signature.java @ 2943:7683d4e43afa

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Implement class representation of a Web Authentication Service (WAS) request and response. If the authentication is successful the WAS responses with a base64 encoded Security Assertion Markup Language. The current implementation of the saml response simplifies the protocol and misses validation. flys-client/trunk@4909 c6561f87-3c4e-4783-a992-168aeb5c3f6f
author Bjoern Ricks <bjoern.ricks@intevation.de>
date Tue, 10 Jul 2012 10:49:18 +0000
parents
children
rev   line source
2943
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
1 package de.intevation.flys.client.server.was;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
2
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
3 import java.io.ByteArrayInputStream;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
4 import java.security.cert.Certificate;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
5 import java.security.cert.CertificateException;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
6 import java.security.cert.CertificateFactory;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
7
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
8 import org.apache.commons.codec.binary.Base64;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
9 import org.apache.log4j.Logger;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
10
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
11 import org.jdom.Element;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
12
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
13 public class Signature {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
14
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
15 private static Logger logger = Logger.getLogger(Signature.class);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
16
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
17 private static final String XML_SIG_DIGEST_SHA1 =
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
18 "http://www.w3.org/2000/09/xmldsig#sha1";
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
19 private static final String XML_SIG_SIGNATURE_RSA_SHA1 =
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
20 "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
21
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
22 private Element signature;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
23 private Certificate cert;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
24 private byte[] value;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
25 private byte[] digestvalue;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
26 private String reference;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
27
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
28 public Signature(Element signature) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
29 this.signature = signature;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
30 this.parseSignatureInfo();
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
31 this.parseSignatureValue();
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
32 this.parseCertificate();
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
33 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
34
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
35 private void parseSignatureInfo() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
36 Element signatureinfo = this.signature.getChild("SignedInfo",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
37 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
38 if (signatureinfo != null) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
39 Element signaturemethod = signatureinfo.getChild("SignatureMethod",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
40 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
41 String algorithm = signaturemethod.getAttributeValue("Algorithm");
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
42 if (!algorithm.equals(XML_SIG_SIGNATURE_RSA_SHA1)) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
43 logger.warn("Unkown signature alorithm " + algorithm);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
44 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
45
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
46 // There could be several references in XML-Sig spec but for me it
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
47 // doesn't make sense to have more then one in a SAML Assertion
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
48 Element reference = signatureinfo.getChild("Reference",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
49 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
50 // reference must be present but its better to check
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
51 if (reference != null) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
52 String digestvalue = reference.getChildText("DigestValue",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
53 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
54 String digestmethod = reference.getChildText("DigestMethod",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
55 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
56 if (!digestmethod.equals(XML_SIG_DIGEST_SHA1)) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
57 logger.warn("Unknown digest method " + digestmethod);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
58 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
59 this.digestvalue = Base64.decodeBase64(digestvalue);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
60
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
61 String referenceuri = reference.getAttributeValue("URI");
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
62 if (referenceuri.startsWith("#")) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
63 this.reference = referenceuri.substring(1);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
64 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
65 else {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
66 logger.warn("Unkown reference type " + referenceuri);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
67 this.reference = referenceuri;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
68 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
69 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
70 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
71 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
72
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
73 private void parseSignatureValue() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
74 String signaturevalue = this.signature.getChildText("SignatureValue",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
75 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
76 this.value = Base64.decodeBase64(signaturevalue);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
77 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
78
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
79 private void parseCertificate() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
80 Element keyinfo = this.signature.getChild("KeyInfo",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
81 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
82 if (keyinfo != null) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
83 Element data = keyinfo.getChild("X509Data", Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
84 if (data != null) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
85 String base64cert = data.getChildText("X509Certificate",
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
86 Namespaces.XML_SIG_NS);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
87 if (base64cert != null) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
88 byte[] bytes = Base64.decodeBase64(base64cert);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
89 try {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
90 CertificateFactory cf = CertificateFactory.getInstance(
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
91 "X.509");
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
92 this.cert = cf.generateCertificate(
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
93 new ByteArrayInputStream(bytes));
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
94 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
95 catch(CertificateException e) {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
96 // should never occur
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
97 logger.error(e);
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
98 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
99 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
100 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
101 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
102 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
103
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
104 public Certificate getCertificate() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
105 return this.cert;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
106 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
107
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
108 public byte[] getValue() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
109 return this.value;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
110 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
111
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
112 public String getReference() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
113 // In theory there could be several references with digestvalues, ...
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
114 return this.reference;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
115 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
116
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
117 public byte[] getDigestValue() {
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
118 return this.digestvalue;
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
119 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
120 }
7683d4e43afa Implement class representation of a Web Authentication Service (WAS)
Bjoern Ricks <bjoern.ricks@intevation.de>
parents:
diff changeset
121 // vim: set si et fileencoding=utf-8 ts=4 sw=4 tw=80:
http://dive4elements.wald.intevation.org