Custom BinarySecurityTokens are not used to set up the security context
@@ -40,10 +40,11 @@ import org.apache.cxf.rt.security.utils.SecurityUtils;
import org.apache.cxf.security.SecurityContext;
import org.apache.cxf.ws.security.SecurityConstants;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
+import org.apache.wss4j.common.token.PKIPathSecurity;
+import org.apache.wss4j.common.token.X509Security;
import org.apache.wss4j.dom.WSConstants;
import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
import org.apache.wss4j.dom.handler.WSHandlerResult;
-import org.apache.wss4j.dom.message.token.KerberosSecurity;
/**
* The default implementation to create a SecurityContext from a set of WSS4J processing results.
@@ -94,16 +95,8 @@ public class DefaultWSS4JSecurityContextCreator implements WSS4JSecurityContextC
List<WSSecurityEngineResult> foundResults = actionResults.get(resultPriority);
if (foundResults != null && !foundResults.isEmpty()) {
for (WSSecurityEngineResult result : foundResults) {
- final Object binarySecurity = result.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
- PublicKey publickey =
- (PublicKey)result.get(WSSecurityEngineResult.TAG_PUBLIC_KEY);
- X509Certificate cert =
- (X509Certificate)result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
- if ((resultPriority == WSConstants.BST && !(binarySecurity instanceof KerberosSecurity))
- || (resultPriority == WSConstants.SIGN && publickey == null && cert == null)) {
- continue;
- }
+ if (!skipResult(resultPriority, result)) {
SecurityContext context = createSecurityContext(msg, useJAASSubject, result);
if (context != null) {
msg.put(SecurityContext.class, context);
@@ -113,6 +106,19 @@ public class DefaultWSS4JSecurityContextCreator implements WSS4JSecurityContextC
}
}
}
+ }
+
+ private boolean skipResult(Integer resultPriority, WSSecurityEngineResult result) {
+ Object binarySecurity = result.get(WSSecurityEngineResult.TAG_BINARY_SECURITY_TOKEN);
+ PublicKey publickey =
+ (PublicKey)result.get(WSSecurityEngineResult.TAG_PUBLIC_KEY);
+ X509Certificate cert =
+ (X509Certificate)result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);
+
+ return resultPriority == WSConstants.BST
+ && (binarySecurity instanceof X509Security || binarySecurity instanceof PKIPathSecurity)
+ || resultPriority == WSConstants.SIGN && publickey == null && cert == null;
+ }
protected SecurityContext createSecurityContext(
SoapMessage msg, boolean useJAASSubject, WSSecurityEngineResult wsResult
