/**
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* https://opensso.dev.java.net/public/CDDLv1.0.html or
* opensso/legal/CDDLv1.0.txt
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: EncryptedNameIdentifier.java,v 1.4 2008/06/25 05:46:46 qcheng Exp $
* Portions Copyrighted 2014 ForgeRock AS
*/
package com.sun.identity.federation.message.common;
import com.sun.identity.federation.common.FSException;
import com.sun.identity.federation.common.FSUtils;
import com.sun.identity.federation.common.IFSConstants;
import com.sun.identity.federation.jaxb.entityconfig.BaseConfigType;
import com.sun.identity.federation.key.EncInfo;
import com.sun.identity.federation.key.KeyUtil;
import com.sun.identity.federation.meta.IDFFMetaException;
import com.sun.identity.federation.meta.IDFFMetaManager;
import com.sun.identity.liberty.ws.meta.jaxb.ProviderDescriptorType;
import com.sun.identity.saml.assertion.NameIdentifier;
import com.sun.identity.saml.common.SAMLException;
import com.sun.identity.saml.common.SAMLUtils;
import com.sun.identity.shared.encode.Base64;
import com.sun.identity.shared.xml.XMLUtils;
import com.sun.identity.xmlenc.EncryptionException;
import com.sun.identity.xmlenc.XMLEncryptionManager;
import java.security.Key;
import java.security.PrivateKey;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
/**
* This class <code>EncryptedNameIdentifier</code> represents a
* <code>EncryptableNameIdentifier</code> in an encrypted form.
*
* @supported.all.api
* @deprecated since 12.0.0
*/
@Deprecated
public class EncryptedNameIdentifier {
/**
* Returns the encryptable XML document element.
*
* @param eni the <code>EncrytableNameIdentifier</code> object.
*
* @return the <code>EncryptedNameIdentifier</code> XML Document.
*/
private static Document getEncryptableDocument(
EncryptableNameIdentifier eni) {
StringBuffer xml = new StringBuffer(300);
String NS = IFSConstants.LIB_12_NAMESPACE_STRING;
String appendNS = IFSConstants.LIB_PREFIX;
xml.append("<").append(appendNS).append("EncryptedNameIdentifier")
.append(" ").append(NS).append(">").append(eni.toString())
.append("</").append(appendNS)
.append("EncryptedNameIdentifier").append(">");
if(FSUtils.debug.messageEnabled()) {
FSUtils.debug.message("EncryptedNameIdentifier.getEncryptable" +
"NameIdentifier: doc =" + xml.toString());
}
return XMLUtils.toDOMDocument(xml.toString(), FSUtils.debug);
}
/**
* Returns the <code>EncryptedNameIdentifier</code> for a given name
* identifier and the provider ID.
*
* @param ni the <code>NameIdentifier</code> object.
* @param realm The realm under which the entity resides.
* @param providerID the remote provider identifier.
* @return the <code>NameIdentifier</code> object.
* @throws FSException on error.
*/
public static NameIdentifier getEncryptedNameIdentifier(
NameIdentifier ni, String realm, String providerID)
throws FSException {
if(ni == null || providerID == null) {
FSUtils.debug.error("EncryptedNameIdentifier.construct: " +
"nullInputParameter");
throw new FSException("nullInputParameter", null);
}
ProviderDescriptorType providerDesc = null;
try {
IDFFMetaManager metaManager = FSUtils.getIDFFMetaManager();
if (metaManager != null) {
providerDesc = metaManager.getSPDescriptor(realm, providerID);
if (providerDesc == null) {
providerDesc = metaManager.getIDPDescriptor(
realm, providerID);
}
}
if (providerDesc == null) {
throw new IDFFMetaException((String) null);
}
} catch (IDFFMetaException ae) {
FSUtils.debug.error("EncryptedNameIdentifier.construct: Could" +
"not retrieve the meta for provider" + providerID);
throw new FSException(ae);
}
EncInfo encInfo = KeyUtil.getEncInfo(providerDesc, providerID, false);
return getEncryptedNameIdentifier(ni, providerID,
encInfo.getWrappingKey(), encInfo.getDataEncAlgorithm(),
encInfo.getDataEncStrength());
}
/**
* Gets then Encrypted NameIdentifier for a given name identifier
* and the provider ID.
* @param ni NameIdentifier.
* @param providerID Remote Provider ID.
* @param enckey Key Encryption Key
* @param dataEncAlgorithm Data encryption algorithm
* @param dataEncStrength Data encryption key size
*
* @return NameIdentifier EncryptedNameIdentifier.
* @exception FSException for failure.
*/
public static NameIdentifier getEncryptedNameIdentifier(
NameIdentifier ni, String providerID, Key enckey,
String dataEncAlgorithm, int dataEncStrength) throws FSException {
if(ni == null || providerID == null) {
FSUtils.debug.error("EncryptedNameIdentifier.construct: " +
"nullInputParameter");
throw new FSException("nullInputParameter", null);
}
EncryptableNameIdentifier eni = new EncryptableNameIdentifier(ni);
Document encryptableDoc = getEncryptableDocument(eni);
Document encryptedDoc = null;
try {
Element encryptElement = (Element)encryptableDoc.
getElementsByTagNameNS(IFSConstants.FF_12_XML_NS,
"EncryptableNameIdentifier").item(0);
XMLEncryptionManager manager = XMLEncryptionManager.getInstance();
encryptedDoc = manager.encryptAndReplace(
encryptableDoc,
encryptElement,
dataEncAlgorithm,
dataEncStrength,
enckey,
0, // TODO: should we pick it up from extended meta?
providerID);
} catch (EncryptionException ee) {
FSUtils.debug.error("EncryptedNameIdentifier.construct: Unable" +
"to encrypt the xml doc", ee);
throw new FSException(ee);
}
if(encryptedDoc == null) {
throw new FSException("EncryptionFailed", null);
}
String encodedStr = Base64.encode(
SAMLUtils.stringToByteArray(
XMLUtils.print((Node)(encryptedDoc))));
try {
return new NameIdentifier(encodedStr, ni.getNameQualifier(),
IFSConstants.NI_ENCRYPTED_FORMAT_URI);
} catch(SAMLException se) {
throw new FSException(se);
}
}
/**
* Returns the decrypted <code>NameIdentifier</code> object.
*
* @param encNI the <code>EncryptedNameIdentifier</code> object.
* @param realm The realm under which the entity resides.
* @param providerID the Hosted Provider Identifer.
* @return the <code>NameIdentifier</code> object,
* the decrypted <code>NameIdentifier</code>.
* @throws FSException on error.
*/
public static NameIdentifier getDecryptedNameIdentifier(
NameIdentifier encNI, String realm, String providerID)
throws FSException
{
if(encNI == null || providerID == null) {
FSUtils.debug.error("EncryptedNameIdentifier.getDecryptedName" +
"Identifier: null values");
throw new FSException("nullInputParameter", null);
}
BaseConfigType providerConfig = null;
try {
providerConfig = FSUtils.getIDFFMetaManager().
getSPDescriptorConfig(realm, providerID);
if (providerConfig == null) {
providerConfig = FSUtils.getIDFFMetaManager().
getIDPDescriptorConfig(realm, providerID);
}
} catch (Exception ae) {
FSUtils.debug.error("EncryptedNameIdentifier.getDecryptedName" +
"Identifier: Unable to find provider", ae);
throw new FSException(ae);
}
if (providerConfig == null) {
FSUtils.debug.error("EncryptedNameIdentifier.getDecryptedName" +
"Identifier: Unable to find provider " + providerID);
throw new FSException("noProviderFound", null);
}
return getDecryptedNameIdentifier(encNI,
KeyUtil.getDecryptionKey(providerConfig));
}
/**
* Gets the decrypted NameIdentifier.
* @param encNI EncryptedNameIdentifier.
* @param decKey decryption key.
*
* @return NameIdentifier Decrypted NameIdentifier.
* @exception FSException for failures
*/
public static NameIdentifier getDecryptedNameIdentifier(
NameIdentifier encNI, PrivateKey decKey) throws FSException {
if(encNI.getFormat() == null ||
!encNI.getFormat().equals(
IFSConstants.NI_ENCRYPTED_FORMAT_URI)) {
throw new FSException("notValidFormat", null);
}
String name = encNI.getName();
name = FSUtils.removeNewLineChars(name);
String decodeStr = SAMLUtils.byteArrayToString(Base64.decode(name));
Document encryptedDoc =
XMLUtils.toDOMDocument(decodeStr, FSUtils.debug);
try {
XMLEncryptionManager manager = XMLEncryptionManager.getInstance();
Document doc = manager.decryptAndReplace(encryptedDoc, decKey);
Element element = (Element)doc.getElementsByTagNameNS(
IFSConstants.FF_12_XML_NS,
"EncryptableNameIdentifier").item(0);
EncryptableNameIdentifier eni =
new EncryptableNameIdentifier(element);
return new NameIdentifier(eni.getName(), eni.getNameQualifier(),
eni.getFormat());
} catch (EncryptionException ee) {
FSUtils.debug.error("EncryptedNameIdentifier.getDecryptedName" +
"Identifier: Decryption exception", ee);
throw new FSException(ee);
} catch (SAMLException se) {
throw new FSException(se);
}
}
}