Refactor how we extract "IDs" from delegation tokens when used for caching
package org.apache.cxf.ws.security.trust;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
@@ -33,6 +36,7 @@ import org.apache.cxf.ws.security.tokenstore.TokenStore;
import org.apache.cxf.ws.security.tokenstore.TokenStoreUtils;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
+import org.apache.wss4j.common.util.XMLUtils;
import org.apache.wss4j.dom.WSConstants;
public class DefaultSTSTokenCacher implements STSTokenCacher {
@@ -163,16 +167,42 @@ public class DefaultSTSTokenCacher implements STSTokenCacher {
return false;
}
+ // Get an id from the token that is unique to that token
private static String getIdFromToken(Element token) {
if (token != null) {
- // Try to find the "Id" on the token.
- if (token.hasAttributeNS(WSConstants.WSU_NS, "Id")) {
- return token.getAttributeNS(WSConstants.WSU_NS, "Id");
- } else if (token.hasAttributeNS(null, "ID")) {
+ // For SAML tokens get the ID/AssertionID
+ if ("Assertion".equals(token.getLocalName())
+ && WSConstants.SAML2_NS.equals(token.getNamespaceURI())) {
return token.getAttributeNS(null, "ID");
- } else if (token.hasAttributeNS(null, "AssertionID")) {
+ } else if ("Assertion".equals(token.getLocalName())
+ && WSConstants.SAML_NS.equals(token.getNamespaceURI())) {
return token.getAttributeNS(null, "AssertionID");
}
+
+ // For UsernameTokens get the username
+ if (WSConstants.USERNAME_TOKEN_LN.equals(token.getLocalName())
+ && WSConstants.WSSE_NS.equals(token.getNamespaceURI())) {
+ Element usernameElement =
+ XMLUtils.getDirectChildElement(token, WSConstants.USERNAME_LN, WSConstants.WSSE_NS);
+ if (usernameElement != null) {
+ return XMLUtils.getElementText(usernameElement);
+ }
+ }
+
+ // For BinarySecurityTokens take the hash of the value
+ if (WSConstants.BINARY_TOKEN_LN.equals(token.getLocalName())
+ && WSConstants.WSSE_NS.equals(token.getNamespaceURI())) {
+ String text = XMLUtils.getElementText(token);
+ if (text != null && !"".equals(text)) {
+ try {
+ MessageDigest digest = MessageDigest.getInstance("SHA-256");
+ byte[] bytes = digest.digest(text.getBytes());
+ return Base64.getMimeEncoder().encodeToString(bytes);
+ } catch (NoSuchAlgorithmException e) {
+ // SHA-256 must be supported so not going to happen...
+ }
+ }
+ }
}
return "";
}
