Done implementing SWS-207

Author: poutsma

security/src/main/java/org/springframework/ws/soap/security/callback/CallbackHandlerChain.java

@@ -0,0 +1,59 @@
+/*
+ * Copyright 2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.callback;
+
+import java.io.IOException;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+
+/**
+ * Represents a chain of <code>CallbackHandler</code>s. For each callback, each of the handlers is called in term. If a
+ * handler throws a <code>UnsupportedCallbackException</code>, the next handler is tried.
+ *
+ * @author Arjen Poutsma
+ * @since 1.5.0
+ */
+public class CallbackHandlerChain extends AbstractCallbackHandler {
+
+    private final CallbackHandler[] callbackHandlers;
+
+    public CallbackHandlerChain(CallbackHandler[] callbackHandlers) {
+        this.callbackHandlers = callbackHandlers;
+    }
+
+    public CallbackHandler[] getCallbackHandlers() {
+        return callbackHandlers;
+    }
+
+    protected void handleInternal(Callback callback) throws IOException, UnsupportedCallbackException {
+        boolean allUnsupported = true;
+        for (int i = 0; i < callbackHandlers.length; i++) {
+            CallbackHandler callbackHandler = callbackHandlers[i];
+            try {
+                callbackHandler.handle(new Callback[]{callback});
+                allUnsupported = false;
+            }
+            catch (UnsupportedCallbackException ex) {
+                // if an UnsupportedCallbackException occurs, go to the next handler
+            }
+        }
+        if (allUnsupported) {
+            throw new UnsupportedCallbackException(callback);
+        }
+    }
+}

security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreFactoryBean.java

@@ -87,7 +87,7 @@ public void setType(String type) {
         this.type = type;
     }
 
-    public Object getObject() throws Exception {
+    public Object getObject() {
         return keyStore;
     }
 

security/src/main/java/org/springframework/ws/soap/security/support/KeyStoreUtils.java

@@ -0,0 +1,123 @@
+/*
+ * Copyright 2008 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.ws.soap.security.support;
+
+import java.io.File;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.util.StringUtils;
+
+/**
+ * Generic utility methods for dealing with {@link KeyStore} objects.
+ *
+ * @author Arjen Poutsma
+ * @since 1.5.0
+ */
+public abstract class KeyStoreUtils {
+
+    /**
+     * Loads the key store indicated by system properties. This method tries to load a key store by consulting the
+     * following system properties:<code>javax.net.ssl.keyStore</code>, <code>javax.net.ssl.keyStorePassword</code>, and
+     * <code>javax.net.ssl.keyStoreType</code>.
+     * <p/>
+     * If these properties specify a file with an appropriate password, the factory uses this file for the key store. If
+     * that file does not exist, then a default, empty keystore is created.
+     * <p/>
+     * This behavior corresponds to the standard J2SDK behavior for SSL key stores.
+     *
+     * @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509KeyManager">The
+     *      standard J2SDK SSL key store mechanism</a>
+     */
+    public static KeyStore loadDefaultKeyStore() throws GeneralSecurityException, IOException {
+        Resource location = null;
+        String type = null;
+        String password = null;
+        String locationProperty = System.getProperty("javax.net.ssl.keyStore");
+        if (StringUtils.hasLength(locationProperty)) {
+            File f = new File(locationProperty);
+            if (f.exists() && f.isFile() && f.canRead()) {
+                location = new FileSystemResource(f);
+            }
+            String passwordProperty = System.getProperty("javax.net.ssl.keyStorePassword");
+            if (StringUtils.hasLength(passwordProperty)) {
+                password = passwordProperty;
+            }
+            type = System.getProperty("javax.net.ssl.trustStore");
+        }
+        // use the factory bean here, easier to setup
+        KeyStoreFactoryBean factoryBean = new KeyStoreFactoryBean();
+        factoryBean.setLocation(location);
+        factoryBean.setPassword(password);
+        factoryBean.setType(type);
+        factoryBean.afterPropertiesSet();
+        return (KeyStore) factoryBean.getObject();
+    }
+
+    /**
+     * Loads a default trust store. This method uses the following algorithm: <ol> <li> If the system property
+     * <code>javax.net.ssl.trustStore</code> is defined, its value is loaded. If the
+     * <code>javax.net.ssl.trustStorePassword</code> system property is also defined, its value is used as a password.
+     * If the <code>javax.net.ssl.trustStoreType</code> system property is defined, its value is used as a key store
+     * type.
+     * <p/>
+     * If <code>javax.net.ssl.trustStore</code> is defined but the specified file does not exist, then a default, empty
+     * trust store is created. </li> <li> If the <code>javax.net.ssl.trustStore</code> system property was not
+     * specified, but if the file <code>$JAVA_HOME/lib/security/jssecacerts</code> exists, that file is used. </li>
+     * Otherwise, <li>If the file <code>$JAVA_HOME/lib/security/cacerts</code> exists, that file is used. </ol>
+     * <p/>
+     * This behavior corresponds to the standard J2SDK behavior for SSL trust stores.
+     *
+     * @see <a href="http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509TrustManager">The
+     *      standard J2SDK SSL trust store mechanism</a>
+     */
+    public static KeyStore loadDefaultTrustStore() throws GeneralSecurityException, IOException {
+        Resource location = null;
+        String type = null;
+        String password = null;
+        String locationProperty = System.getProperty("javax.net.ssl.trustStore");
+        if (StringUtils.hasLength(locationProperty)) {
+            File f = new File(locationProperty);
+            if (f.exists() && f.isFile() && f.canRead()) {
+                location = new FileSystemResource(f);
+            }
+            String passwordProperty = System.getProperty("javax.net.ssl.trustStorePassword");
+            if (StringUtils.hasLength(passwordProperty)) {
+                password = passwordProperty;
+            }
+            type = System.getProperty("javax.net.ssl.trustStoreType");
+        }
+        else {
+            String javaHome = System.getProperty("java.home");
+            location = new FileSystemResource(javaHome + "/lib/security/jssecacerts");
+            if (!location.exists()) {
+                location = new FileSystemResource(javaHome + "/lib/security/cacerts");
+            }
+        }
+        // use the factory bean here, easier to setup
+        KeyStoreFactoryBean factoryBean = new KeyStoreFactoryBean();
+        factoryBean.setLocation(location);
+        factoryBean.setPassword(password);
+        factoryBean.setType(type);
+        factoryBean.afterPropertiesSet();
+        return (KeyStore) factoryBean.getObject();
+    }
+
+}

security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java

@@ -46,39 +46,31 @@
 import org.springframework.ws.soap.security.AbstractWsSecurityInterceptor;
 import org.springframework.ws.soap.security.WsSecuritySecurementException;
 import org.springframework.ws.soap.security.WsSecurityValidationException;
+import org.springframework.ws.soap.security.callback.CallbackHandlerChain;
 
 /**
  * A WS-Security endpoint interceptor based on Apache's WSS4J. This inteceptor supports messages created by the {@link
  * org.springframework.ws.soap.axiom.AxiomSoapMessageFactory} and the {@link org.springframework.ws.soap.saaj.SaajSoapMessageFactory}.
  * <p/>
- * The validation and securement actions executed by this interceptor are configured via <code>validationActions</code> and
- * <code>securementActions</code> properties, respectively. Actions should be passed as a space-separated strings.
+ * The validation and securement actions executed by this interceptor are configured via <code>validationActions</code>
+ * and <code>securementActions</code> properties, respectively. Actions should be passed as a space-separated strings.
  * <p/>
  * Valid <strong>validation</strong> actions are:
- *
- * <blockquote><table>
- * <tr><th>Validation action</th><th>Description</th></tr>
- * <tr><td><code>UsernameToken</code></td><td>Validates username token</td></tr>
- * <tr><td><code>Timestamp</code></td><td>Validates the timestamp</td></tr>
- * <tr><td><code>Encrypt</code></td><td>Decrypts the message</td></tr>
- * <tr><td><code>Signature</code></td><td>Validates the signature</td></tr>
- * <tr><td><code>NoSecurity</code></td><td>No action performed</td></tr>
- * </table></blockquote>
  * <p/>
- * <strong>Securement</strong> actions are:
- * <blockquote><table>
- * <tr><th>Securement action</th><th>Description</th></tr>
- * <tr><td><code>UsernameToken</td></code><td>Adds a username token</td></tr>
- * <tr><td><code>UsernameTokenSignature</td></code><td>Adds a username token and a signature username token secrect key</td></tr>
- * <tr><td><code>Timestamp</td></code><td>Adds a timestamp</td></tr>
- * <tr><td><code>Encrypt</td></code><td>Encrypts the response</td></tr>
- * <tr><td><code>Signature</td></code><td>Signs the response</td></tr>
- * <tr><td><code>NoSecurity</td></code><td>No action performed</td></tr>
- * </table></blockquote>
+ * <blockquote><table> <tr><th>Validation action</th><th>Description</th></tr> <tr><td><code>UsernameToken</code></td><td>Validates
+ * username token</td></tr> <tr><td><code>Timestamp</code></td><td>Validates the timestamp</td></tr>
+ * <tr><td><code>Encrypt</code></td><td>Decrypts the message</td></tr> <tr><td><code>Signature</code></td><td>Validates
+ * the signature</td></tr> <tr><td><code>NoSecurity</code></td><td>No action performed</td></tr> </table></blockquote>
  * <p/>
- * The order of the actions that the client performed to secure the messages is significant and is
- * enforced by the interceptor.
- *
+ * <strong>Securement</strong> actions are: <blockquote><table> <tr><th>Securement action</th><th>Description</th></tr>
+ * <tr><td><code>UsernameToken</td></code><td>Adds a username token</td></tr> <tr><td><code>UsernameTokenSignature</td></code><td>Adds
+ * a username token and a signature username token secrect key</td></tr> <tr><td><code>Timestamp</td></code><td>Adds a
+ * timestamp</td></tr> <tr><td><code>Encrypt</td></code><td>Encrypts the response</td></tr>
+ * <tr><td><code>Signature</td></code><td>Signs the response</td></tr> <tr><td><code>NoSecurity</td></code><td>No action
+ * performed</td></tr> </table></blockquote>
+ * <p/>
+ * The order of the actions that the client performed to secure the messages is significant and is enforced by the
+ * interceptor.
  *
  * @author Tareq Abed Rabbo
  * @author Arjen Poutsma
@@ -89,8 +81,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 
     public static final String SECUREMENT_USER_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementUser";
 
-    private CallbackHandler validationCallbackHandler;
-
     private int securementAction;
 
     private String securementActions;
@@ -99,9 +89,7 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 
     private String securementUsername;
 
-    private boolean timestampStrict = true;
-
-    private int timeToLive = 300;
+    private CallbackHandler validationCallbackHandler;
 
     private int validationAction;
 
@@ -115,10 +103,14 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 
     private Crypto validationSignatureCrypto;
 
-    private Wss4jHandler handler = new Wss4jHandler();
+    private boolean timestampStrict = true;
 
     private boolean enableSignatureConfirmation;
 
+    private int timeToLive = 300;
+
+    private Wss4jHandler handler = new Wss4jHandler();
+
     public void setSecurementActions(String securementActions) {
         this.securementActions = securementActions;
         securementActionsVector = new Vector();
@@ -141,10 +133,24 @@ public void setSecurementActor(String securementActor) {
         handler.setOption(WSHandlerConstants.ACTOR, securementActor);
     }
 
+    /**
+     * Sets the {@link org.apache.ws.security.WSPasswordCallback} handler to use when securing messages.
+     *
+     * @see #setSecurementCallbackHandlers(CallbackHandler[])
+     */
     public void setSecurementCallbackHandler(CallbackHandler securementCallbackHandler) {
         handler.setSecurementCallbackHandler(securementCallbackHandler);
     }
 
+    /**
+     * Sets the {@link org.apache.ws.security.WSPasswordCallback} handlers to use when securing messages.
+     *
+     * @see #setSecurementCallbackHandler(CallbackHandler)
+     */
+    public void setSecurementCallbackHandlers(CallbackHandler[] securementCallbackHandler) {
+        handler.setSecurementCallbackHandler(new CallbackHandlerChain(securementCallbackHandler));
+    }
+
     public void setSecurementEncryptionCrypto(Crypto securementEncryptionCrypto) {
         handler.setSecurementEncryptionCrypto(securementEncryptionCrypto);
     }
@@ -333,10 +339,24 @@ public void setValidationActor(String validationActor) {
         this.validationActor = validationActor;
     }
 
+    /**
+     * Sets the {@link org.apache.ws.security.WSPasswordCallback} handler to use when validating messages.
+     *
+     * @see #setValidationCallbackHandlers(CallbackHandler[])
+     */
     public void setValidationCallbackHandler(CallbackHandler callbackHandler) {
         this.validationCallbackHandler = callbackHandler;
     }
 
+    /**
+     * Sets the {@link org.apache.ws.security.WSPasswordCallback} handlers to use when validating messages.
+     *
+     * @see #setValidationCallbackHandler(CallbackHandler)
+     */
+    public void setValidationCallbackHandlers(CallbackHandler[] callbackHandler) {
+        this.validationCallbackHandler = new CallbackHandlerChain(callbackHandler);
+    }
+
     /** Sets the Crypto to use to decrypt incoming messages */
     public void setValidationDecryptionCrypto(Crypto decryptionCrypto) {
         this.validationDecryptionCrypto = decryptionCrypto;
@@ -410,6 +430,9 @@ protected void secureMessage(SoapMessage soapMessage, MessageContext messageCont
         if (securementAction == WSConstants.NO_SECURITY && !enableSignatureConfirmation) {
             return;
         }
+        if (logger.isDebugEnabled()) {
+            logger.debug("Securing message [" + soapMessage + "] with actions [" + securementActions + "]");
+        }
         RequestData requestData = initializeRequestData(messageContext);
 
         Document envelopeAsDocument = toDocument(soapMessage);
@@ -450,7 +473,7 @@ private RequestData initializeRequestData(MessageContext messageContext) {
     protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
             throws WsSecurityValidationException {
         if (logger.isDebugEnabled()) {
-            logger.debug("Validating message [" + soapMessage + "] with actions " + validationActions);
+            logger.debug("Validating message [" + soapMessage + "] with actions [" + validationActions + "]");
         }
 
         if (validationAction == WSConstants.NO_SECURITY) {
@@ -508,11 +531,7 @@ private void updateContextWithResults(MessageContext messageContext, Vector resu
         messageContext.setProperty(WSHandlerConstants.RECV_RESULTS, handlerResults);
     }
 
-    /**
-     * Verifies the trust of a certificate.
-     * @param results
-     * @throws WSSecurityException
-     */
+    /** Verifies the trust of a certificate. */
     protected void verifyCertificateTrust(Vector results) throws WSSecurityException {
         RequestData requestData = new RequestData();
         requestData.setSigCrypto(validationSignatureCrypto);