/**
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2016 ForgeRock AS. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at legal/CDDLv1.0.txt.
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file at legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
*/
/**
* This class allows for the generation of SoapSTSInstanceConfig state used to publish soap-sts instances. It is intended
* to allow for the convenient generation of SoapSTSInstanceConfig instances used to publish soap-sts instances. It is
* guided by STSPublishContext state, but hard-codes many of the options for caller convenience. If any of the
* currently-hard-coded options need to be configurable, they can be added to the STSPublishContext class, and referenced
* from there. The point is to be able to generate a reasonably small set of SoapSTSInstanceConfig instances to be used
* in the functional tests, while encapsulating all of the myriad configuration options for caller convenience.
*
*/
public class SoapSTSInstanceConfigFactory {
/*
if you want to target a specific module or service for a particular token type, add it via the
addMapping call below. See org.forgerock.openam.forgerockrest.authn.core.AuthIndexType for the
list of valid authIndexType values (the second parameter in addMapping). The third parameter is
simply the name of the specified module, service, etc. If you want to target the default service,
don't add a mapping, or add a mapping corresponding to the default service, as below.
*/
if (x509MappingNecessary(wsdlFile)) {
/*
Build the context necessary for Cert validation. The value in the map must correspond to the
header which the Cert module will consult to obtain the client's Certificate.
*/
certContext.put(AMSTSConstants.X509_TOKEN_AUTH_TARGET_HEADER_KEY, CommonConstants.DEFAULT_CERT_MODULE_TOKEN_HEADER_NAME);
mappingBuilder.addMapping(TokenType.X509, "module", CommonConstants.DEFAULT_CERT_MODULE_NAME, certContext);
}
/*
If the clientCertHeader field is specified, this implies that the client cert for x509 transformations should
be specified in a header field. If this is the case, then the set of IP addrs corresponding to the
tls offload engines must also be specified. I will simply specify the ip addr of this client, as it will be
the one invoking token transformation functionality. If all hosts should be trusted, add 'any' to the list.
*/
}
.build();
//put in a faux mapping to see if it appears
if (publishOIDC(publishContext)) {
if (STSPublishContext.OIDCSigningAlgorithmType.RSA.equals(publishContext.getOidcSigningAlgorithmType())) {
} else {
}
}
/*
Note that the SAML2Config keystore state must reference a keystore available to the home OpenAM .war file,
as this keystore state will be referenced by the TokenGenerationService in order to generate a SAML2 assertion
on the OpenAM home server. To repeat: the soap-sts consumes the TokenGenerationService, hosted on OpenAM, in
order to obtain a SAML2 assertion. Thus the SAML2Config state must reference a keystore file available to the
consumed OpenAM deployment.
*/
if (publishSAML2(publishContext)) {
}
/*
Note that the SoapSTSKeystoreConfig will reference state deployed in the soap-sts .war file, remote
from the OpenAM home deployment. As such, it must reference a keystore available (via the classpath or
the filesystem) in the remote soap-sts deployment. Also note the mismatch between decryption and encryption.
The bottom line is that the CXF CallbackHandler registered with the CXF STSClient, or registered with a published
soap-sts instance, will identify a callback with a DECRYPT constant on both the STSClient and sts instance, sides.
This is because, in an asymmetric binding, messages between client and server are encrypted with the peer's public
key, and thus the recipient's private key must be used to decrypt this message. Thus the encryption fields in
SoapSTSKeystoreConfig should really be called decryption.
*/
.keystorePassword(soapSTSServerCryptoState.getKeystorePassword().getBytes(AMSTSConstants.UTF_8_CHARSET_ID))
.encryptionKeyPassword(soapSTSServerCryptoState.getDecryptionKeyPassword().getBytes(AMSTSConstants.UTF_8_CHARSET_ID))
.signatureKeyPassword(soapSTSServerCryptoState.getSignatureKeyPassword().getBytes(AMSTSConstants.UTF_8_CHARSET_ID))
.build();
TokenType securityPolicyTokenValidationTokenType = getSecurityPolicyTokenValidationConfigurationFromWsdlFile(wsdlFile);
if (publishSAML2(publishContext)) {
}
if (publishOIDC(publishContext)) {
}
}
} else if (UT_ASYM_WSDL.equals(wsdlFile) || UT_SYM_WSDL.equals(wsdlFile) || UT_TRANSPORT_WSDL.equals(wsdlFile)) {
}
}
}
private OpenIdConnectTokenConfig buildHMACTokenConfig(STSPublishContext publishContext, Map<String, String> claimMapping) {
return OpenIdConnectTokenConfig.builder()
.signatureAlgorithm("HS256")
.build();
}
private OpenIdConnectTokenConfig buildRSATokenConfig(STSPublishContext publishContext, Map<String, String> claimMapping) throws UnsupportedEncodingException {
return OpenIdConnectTokenConfig.builder()
.signatureKeyAlias("test")
.signatureAlgorithm("RS256")
//due to CREST-273, the JwtReconstruction class, used in functional test verification, will throw an exception when
//reconstituting an RSA-signed OIDC token which encapsulates a JWK reference to the key which can be used to verify the signature -
//so publish with a reference of NONE
.build();
}
private SAML2Config buildSAML2Config(STSPublishContext publishContext, Map<String, String> attributeMapping) throws IOException {
try {
return SAML2Config.builder()
.encryptionKeyAlias("test")
.signatureKeyAlias("test")
.signAssertion(true)
.encryptAssertion(false)
.encryptAttributes(false)
.encryptNameID(false)
.encryptionAlgorithm("http://www.w3.org/2001/04/xmlenc#aes128-cbc")
.nameIdFormat("urn:oasis:names:tc:SAML:2.0:nameid-format:persistent")
//custom statement providers could also be specified.
.build();
} catch (UnsupportedEncodingException e) {
throw new IOException(e);
}
}
}