/**
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
 *
 * The contents of this file are subject to the terms
 * of the Common Development and Distribution License
 * (the License). You may not use this file except in
 * compliance with the License.
 *
 * You can obtain a copy of the License at
 * https://opensso.dev.java.net/public/CDDLv1.0.html or
 * opensso/legal/CDDLv1.0.txt
 * See the License for the specific language governing
 * permission and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL
 * Header Notice in each file and include the License file
 * at opensso/legal/CDDLv1.0.txt.
 * If applicable, add the following below the CDDL Header,
 * with the fields enclosed by brackets [] replaced by
 * your own identifying information:
 * "Portions Copyrighted [year] [name of copyright owner]"
 *
 * $Id: SecurityTokenProvider.java,v 1.3 2008/06/25 05:47:21 qcheng Exp $
 *
 */


package com.sun.identity.liberty.ws.security;

import com.sun.identity.liberty.ws.common.wsse.BinarySecurityToken;
import com.sun.identity.liberty.ws.disco.EncryptedResourceID;

import com.sun.identity.saml.assertion.Assertion;
import com.sun.identity.saml.assertion.NameIdentifier;
import com.sun.identity.saml.common.SAMLException;

import java.security.cert.X509Certificate;

/**
 * The class <code>SecurityTokenProvider</code> is a provider interface 
 * for managing <code>WSS</code> security tokens.
 *
 * @supported.all.api
 */

public interface SecurityTokenProvider {

    /**
     * Initializes the <code>SecurityTokenProvider</code>.
     *
     * @param credential The credential of the caller used
     *        to see if access to this security token provider is allowed.
     * @param sigManager instance of XML digital
     *        signature manager class, used for accessing the certificate
     *        data store and digital signing of the assertion.
     * @throws SecurityTokenException if the caller does not have
     *         privilege to access the security authority manager.
     */
    public void initialize(java.lang.Object credential,
        com.sun.identity.saml.xmlsig.XMLSignatureManager sigManager)
        throws SecurityTokenException;

    /**
     * Sets the alias of the certificate used for issuing <code>WSS</code>
     * token, i.e. <code>WSS</code>  <code>X509</code> Token, <code>WSS</code>
     * SAML Token. If the <code>certAlias</code> is never set, a default
     * certificate will be used for issuing <code>WSS</code> tokens.
     *
     * @param certAlias String alias name for the certificate
     * @throws SecurityTokenException if certificate for the
     *            <code>certAlias</code> could not be found in key store.
     */
    public void setCertAlias(java.lang.String certAlias) 
        throws SecurityTokenException;

    /**
     * Sets the  certificate used for issuing <code>WSS</code> token, i.e.
     * <code>WSS X509</code> Token, <code>WSS</code> SAML Token.
     * If the certificate is never set, a default certificate will
     * be used for issuing <code>WSS</code> tokens.
     *
     * @param cert <code>X509Certificate</code> object.
     * @throws SecurityTokenException if the certificate could not be set.
     */
    public void setCertificate(X509Certificate cert)
        throws SecurityTokenException;

    /**
     * Gets the <code>X509</code> certificate Token.
     *
     * @return <code>X509</code> certificate Token.
     * @throws SecurityTokenException if the token could not be 
     *        obtained.
     */
    public BinarySecurityToken getX509CertificateToken() 
        throws SecurityTokenException;

    /**
     * Creates a SAML Assertion for message authentication.
     *
     * @param senderIdentity name identifier of the sender.
     * @return Assertion which contains an <code>AuthenticationStatement</code>.
     * @throws SecurityTokenException if the assertion could not be
     *        obtained.
     * @throws SAMLException
     */
    public SecurityAssertion getSAMLAuthenticationToken(
				NameIdentifier senderIdentity)
	throws SecurityTokenException, SAMLException;

    /**
     * Creates a SAML Assertion for message authorization, the assertion could
     * optionally contain an <code>AuthenticationStatement</code> which will be
     * used for message authentication.
     *
     * @param senderIdentity name identifier of the sender.
     * @param invocatorSession <code>SessionContext</code> of  the invocation
     *        identity, it is normally obtained by the credential reference in
     *        the SAML <code>AttributeDesignator<code> for discovery resource
     *        offering which is part of the liberty <code>ID-FF</code>
     *        <code>AuthenResponse</code>.
     * @param resourceID id for the resource to be accessed.
     * @param includeAuthN if true, include an
     *        <code>AutheticationStatement</code> in
     *        the Assertion which will be used for message
     *        authentication. if false, no <code>AuthenticationStatement</code>
     *        will be included.
     * @param includeResourceAccessStatement if true, a
     *        <code>ResourceAccessStatement</code> will be included in the
     *        Assertion (for <code>AuthorizeRequester</code> directive). If
     *        false, a <code>SessionContextStatement</code> will be included in
     *        the Assertion (for <code>AuthenticationSessionContext</code>
     *        directive). In the case when both <code>AuthorizeRequester</code>
     *        and <code>AuthenticationSessionContext</code> directive need to be
     *        handled, use "true" as parameter here since the
     *        <code>SessionContext</code> will always be included in the
     *        <code>ResourceAccessStatement</code>.
     * @param recipientProviderID recipient's provider ID.
     * @return <code>SecurityAssertion</code> object.
     * @throws SecurityTokenException if the assertion could not be obtained
     * @throws SAMLException
     */
    public SecurityAssertion getSAMLAuthorizationToken(
				NameIdentifier senderIdentity,
                                SessionContext invocatorSession,
                                String resourceID,
                                boolean includeAuthN,
                                boolean includeResourceAccessStatement,
                                String recipientProviderID)
	throws SecurityTokenException, SAMLException;

    /**
     * Creates a SAML Assertion for message authorization, the assertion could
     * optionally contain an <code>AuthenticationStatement</code> which will be
     * used for message authentication.
     *
     * @param senderIdentity name identifier of the sender.
     * @param invocatorSession <code>SessionContext</code> of the invocation
     *        identity, it is normally obtained by the credential reference in
     *        the SAML <code>AttributeDesignator</code> for discovery resource
     *        offering which is part of the liberty <code>ID-FF</code>
     *        <code>AuthenResponse</code>.
     * @param encResourceID Encrypted ID for the resource to be accessed.
     * @param includeAuthN if true, include an
     *        <code>AutheticationStatement</code> in the Assertion which will be
     *        used for message authentication. if false, no
     *        <code>AuthenticationStatement</code> will be included.
     * @param includeResourceAccessStatement if true, a
     *        <code>ResourceAccessStatement</code> will be included in the
     *        Assertion (for <code>AuthorizeRequester</code> directive). If
     *        false, a <code>SessionContextStatement</code> will be included i
     *        the Assertion (for <code>AuthenticationSessionContext</code>
     *        directive). In the case when both <code>AuthorizeRequester</code
     *        and <code>AuthenticationSessionContext</code> directive need to be
     *        handled, use "true" as parameter here since the
     *        <code>SessionContext</code> will always be included in the
     *        <code>ResourceAccessStatement</code>.
     * @param recipientProviderID recipient's provider ID.
     * @return <code>SecurityAssertion</code> object.
     * @throws SecurityTokenException if the assertion could not be obtained
     */
    public SecurityAssertion getSAMLAuthorizationToken(
				NameIdentifier senderIdentity,
                                SessionContext invocatorSession,
                                EncryptedResourceID encResourceID,
                                boolean includeAuthN,
                                boolean includeResourceAccessStatement,
                                String recipientProviderID)
	throws SecurityTokenException;


    /**
     * Creates a SAML assertion. The <code>confirmationMethod</code> will be
     * set to <code>urn:oasis:names:tc:SAML:1.0:cm:bearer</code>.
     *
     * @param senderIdentity name identifier of the sender.
     * @param invocatorSession <code>SessionContext</code> of the invocation
     *        identity, it is normally obtained by the credential reference in
     *        the SAML <code>AttributeDesignator</code> for discovery resource
     *        offering which is part of the liberty <code>ID-FF</code>
     *        <code>AuthenResponse</code>.
     * @param resourceID id for the resource to be accessed.
     * @param includeAuthN if true, include an
     *        <code>AutheticationStatement</code> in the Assertion which will
     *        be used for message authentication. if false, no
     *	      <code>AuthenticationStatement</code> will be included.
     * @param includeResourceAccessStatement if true, a
     *        <code>ResourceAccessStatement</code> will be included in the
     *        Assertion (for <code>AuthorizeRequester</code> directive). If
     *        false, a <code>SessionContextStatement</code> will be included in
     *        the Assertion (for <code>AuthenticationSessionContext</code>
     *        directive). In the case when both <code>AuthorizeRequester</code>
     *        and <code>AuthenticationSessionContext</code> directive need to be
     *	      handled, use "true" as parameter here since the
     *        <code>SessionContext</code> will always be included in the
     *	      <code>ResourceAccessStatement</code>.
     * @param recipientProviderID recipient's provider ID.
     * @return <code>SecurityAssertion</code> object.
     * @throws SecurityTokenException if the assertion could not be obtained
     * @throws SAMLException if the assertion could not be obtained
     */
    public SecurityAssertion getSAMLBearerToken(
				NameIdentifier senderIdentity,
                                SessionContext invocatorSession,
                                String resourceID,
                                boolean includeAuthN,
                                boolean includeResourceAccessStatement,
                                String recipientProviderID)
	throws SecurityTokenException, SAMLException;


    /**
     * Creates a SAML assertion. The <code>confirmationMethod</code> will be
     * set to <code>urn:oasis:names:tc:SAML:1.0:cm:bearer</code>.
     *
     * @param senderIdentity name identifier of the sender.
     * @param invocatorSession <code>SessionContext</code> of the invocation
     *        identity, it is normally obtained by the credential reference in
     *        the SAML <code>AttributeDesignator</code> for discovery resource
     *        offering which is part of the liberty <code>ID-FF</code>
     *        <code>AuthenResponse</code>.
     * @param encResourceID Encrypted ID for the resource to be accessed.
     * @param includeAuthN if true, include an
     *        <code>AutheticationStatement</code> in the Assertion which will
     *        be used for message authentication. if false, no
     *        <code>AuthenticationStatement</code> will be included.
     * @param includeResourceAccessStatement if true, a
     *        <code>ResourceAccessStatement</code> will be included in the
     *        Assertion (for <code>AuthorizeRequester</code> directive). If
     *        false, a <code>SessionContextStatement</code> will be included
     *        in the Assertion (for <code>AuthenticationSessionContext</code>
     *        directive). In the case when both <code>AuthorizeRequester</code>
     *        and <code>AuthenticationSessionContext/code> directive need to be
     *	      handled, use "true" as parameter here since the
     *	      <code>SessionContext</code> will always be included in the
     *	      <code>ResourceAccessStatement</code>.
     * @param recipientProviderID recipient's provider ID.
     * @return <code>SecurityAssertion</code> object.
     * @throws SecurityTokenException if the assertion could not be obtained
     */
    public SecurityAssertion getSAMLBearerToken(
				NameIdentifier senderIdentity,
                                SessionContext invocatorSession,
                                EncryptedResourceID encResourceID,
                                boolean includeAuthN,
                                boolean includeResourceAccessStatement,
                                String recipientProviderID)
	throws SecurityTokenException;

}