Page Comparison

Ceptor PortalProtect has support for WS-Security meaning it can be used to sign/encrypt outgoing SOAP messages, and it can verify signatures / decrypt incoming SOAP messages.

...

package dk.itp.portalprotect.wss;
import java.util.Hashtable;
import java.util.Properties;

import dk.itp.portalprotect.wss.WSSAuthPluginSupport.Result;
import dk.itp.security.authentication.x509.AbstractX509CertificatePlugin;
import dk.itp.security.passticket.AuthTypes;
import dk.itp.security.passticket.PTException;
import dk.itp.security.passticket.User;
import dk.itp.security.passticket.server.AuthErrorCodes;

/**
 * SSL Cert plugin, which adds support for WSS
 * 
 * @author Kim Rasmussen
 * @version $Revision: 1.1 $
 * 
 * <pre>
 * PortalProtect - Security infrastructure
 * Copyrightoccurred 2007,
Asseco Denmark A/S, All rights reserved.
 * 
 * This source code is confidential.
 * </pre>
 */
public class WSSAuthenticationPlugin extends AbstractX509CertificatePlugin {
	WSSAuthPluginSupport wssauth;  
	public Object executeCommand(User user, String name, Object input)
			throws PTException {
		return wssauth.executeCommand(user, name, input);
	}
	public void setConfiguration(Properties props) {
		super.setConfiguration(props);
		
		wssauth = new WSSAuthPluginSupport(statistics, providers);
		wssauth.setConfiguration(props);
	}
	public String getStatusText(String action) {
		return super.getStatusText() + wssauth.getStatusText(this, action);
	}
	public String getName() {
		return "WebService Security";
	}
	public int getAuthenticationType() {
		return AuthTypes.AUTHTYPE_WSS;
	}
	public int getAuthenticationLevel() {
		return 3;
	}
	public void confirm(User user, String signtext, Object credentials) throws PTException {
		verifyCertificate(user, credentials.toString(), true, true, null, signtext);
	}
	public void login(User user, String userid, Object credentials) throws PTException {
		Result result = wssauth.logonValidateSignatureAndDecrypt(credentials.toString());
		try {
			if (user.stateVariables == null)
				user.stateVariables = new Hashtable();
			
			user.stateVariables.put("soap", result.xmlOutput);
			
			if (result.subject != null) {
				user.username = result.subject.getProperty("CN");
	
				// CPR might be in userid, but this plugin wants it in customerID
				user.customerID = user.userid;
				user.userid = result.subject.getSerialNumber();
				user.password = null;
				user.isLoggedOn = true;
				
				if (result.subject.getO() != null)
					user.stateVariables.put("subject_o", result.subject.getO());
				if (result.subject.getOu() != null)
					user.stateVariables.put("subject_ou", result.subject.getOu());
				user.stateVariables.put("subject_dn", result.subject.getOrderedSubjectDN());

				if (result.cvr != null)
					user.stateVariables.put("cvr", result.cvr);
				if (result.pid != null)
					user.stateVariables.put("pid", result.pid);
				if (result.rid != null)
					user.stateVariables.put("rid", result.rid);
				if (result.uid != null)
					user.stateVariables.put("uid", result.uid);
			} else {
				throw new PTException("No certificate or SOAP not signed", AuthErrorCodes.ERROR_USERNOTFOUND,
					"No certificate");				
			}
		} catch (Throwable t) {
			cat.warn("Problem authenticating", t);
			throw new PTException("unexpected error occurred while authenticating using X509 Certificate",
				(short) - 1, t.getMessage());
		}
	}
}

...

   </childtag>

</ns1:parenttag>

Xpath

...

Transformations

Some applications require Xpath transformations – this can be done with both the signXML and setWSDoSignXML methods.

...

Decryption just requires the xml and the alias of a private key loaded by portalprotect server, and it can then decrypt the xml message.

Publicclass WSSAgent {

     /**

      *SignandEncryptaSOAPmessage

      *@paramsessionIDSessionIDofuserdoingthesigning

      *@paramxmlXML–SOAPrequestorresponsetosignandencrypt

      *@paramsignerIDofsigner–mustbealiasofkeyregisteredatPPserver

      *@paramreceipientIDofreceiver,eitheraliasofpublickey/certificate,oremailaddressorserialwhichcanbelookedupinTDC’sLDAPserver.

      *@returnSignedandencryptedSOAP.

      *@throwsPTException

      */

    publicstatic String signAndEncryptSOAP(String sessionID, String xml, String signer, String receipient) throws PTException;

     /**

      *SignandEncryptaSOAPmessage

      *@paramsessionIDSessionIDofuserdoingthesigning

      *@paramxmlXML–SOAPrequestorresponsetosignandencrypt

      *@paramsignerIDofsigner–mustbealiasofkeyregisteredatPPserver

      *@paramreceipientIDofreceiver,eitheraliasofpublickey/certificate,oremailaddressorserialwhichcanbelookedupinTDC’sLDAPserver.

      *@parampartsDefinitionDefineswhichpartstosign–e.g.“Body;{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}BinarySecurityToken”

      *@returnSignedandencryptedSOAP.

      *@throwsPTException

      */

    publicstatic String signAndEncryptSOAP(String sessionID, String xml, String signer, String receipient, String partsDefinition) throws PTException;

     /**

      *SignaSOAPmessage

      *@paramsessionIDSessionIDofuserdoingthesigning

      *@paramxmlSOAPrequestorresponsetosignandencrypt

      *@paramsignerIDofsigner–mustbealiasofkeyregisteredatPPserver

      *@returnSignedSOAP.

      *@throwsPTException

      */

    publicstatic String signSOAP(String sessionID, String xml, String signer) throws PTException;

     /**

      *SignaSOAPmessage

      *@paramsessionIDSessionIDofuserdoingthesigning

      *@paramxmlSOAPrequestorresponsetosignandencrypt

      *@paramsignerIDofsigner–mustbealiasofkeyregisteredatPPserver

      *@parampartsDefinitionDefineswhichpartstosign–e.g.“Body;{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}BinarySecurityToken”

      *@returnSignedSOAP.

      *@throwsPTException

      */

    publicstatic String signSOAP(String sessionID, String xml, String signer,String partsDefinition) throws PTException;

    /**

     *Validatesanddecryptsanlusteredsignedand/orencryptedSOAPmessage

     *@paramsessionIDSessionIDofuserdoingthevalidation

     *@paramxmlSOAPtodecrypt/checksignaturefor.

     *@returnDecryptedSOAPmessage

     *@throwsPTException

     */

    publicstatic String validateSignatureAndDecryptSOAP(String sessionID, String xml) throws PTException;

    /**

     *LogonwithasignedXMLmessage–thecertificatewhichsignedthemessagewillbeusedforloggingin.

     *@paramsessionIDSessiontologinto

     *@paramxmlSOAPtodecrypt/checksignaturefor.

     *@returnDecryptedSOAPmessage

     *@throwsPTException

     */

    publicstatic String logonWithSOAP(String sessionID, String xml) throws PTException;

    /**

     *SignsaparticularpieceofXML(notSOAP)usingXMLDSIG

     *@paramsessionIDSessionIDtouseforsigning

     *@paramxmlXMLtosign

     *@paramsignerIDofsigner–mustmatchaliasornameofcertificateconfiguredonPPserver

     *@paramreferenceIDsListofreferencestosign

     *@paramsignatureDestinationPlacetoputthesignatureintheXML–listoftokenslusteredby/

     *@returnSignedXML

     *@throwsPTException

     */

     publicstatic String signXML(String sessionID, String xml, String signer, String[] referenceIDs, String signatureDestination) throws PTException;

     /**

      *ValidatesanXMLDSIGsigneddocument.

      *

      *@paramsessionIDSessionIDtouseforvalidating

      *@paramxmlSignedXML

      *@returnList of certificates which signed this XML

      *@throwsPTException

      */

     publicstatic X509Certificate[] validateXMLSignature(String sessionID, String xml) throws PTException;