[WSS4J] Using wss4j from within a SecurityDomain

--Apple-Mail-18--645318966
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed

I am using wss4j from within an environment where a keystore and 
truststore are already available programatically, but aren't 
necessarily available to load from the filesystem.

My solution was to simply subclass some of the wss4j pieces to handle 
this situation, but this also required adding some hooks so that the 
private/package fields of these classes could be set.

First, in org.apache.ws.security.components.crypto.Merlin:
	I had to add a setKeyStore(KeyStore ks) method. This method could be 
called from anywhere the load(InputStream is) method would be called. 
It simply sets the keystore to the value supplied. This way a subclass 
of Merlin could just take its instance of keystore and feed it to 
setKeyStore().

Next, in org.apache.ws.axis.security.WSDoAllSender:
	I added a loadSignatureCrypto() and loadEncryptionCrypto() hook to 
allow subclasses to instantiate their Crypto implementations however 
they thought best. These hooks return a Crypto and are called from the 
decode...Parameter() method like so:
		sigCrypto = loadSignatureCrypto();
	The bits from WSDoAllSender that instantiate the Crypto instances were 
moved into these new protected methods.

Finally, in org.apache.ws.axis.security.WSDoAllReceiver:
	I added hooks similar to the ones in WSDoAllSender.  Since 
WSDoAllReceiver doesn't have much to do with decryption/signature 
parameters past loading the Crypto implementation for each, these hooks 
basically consumed all the code from the decode...Parameter() methods.

The patched version of wss4j was tested in an environment where the 
client side was basically Axis run from the command line, and the 
server side was Axis (from within JBoss.net). Everything performed as 
expected. And of course the patch doesn't cause any of the tests to 
fail.

Hopefully these changes have some use past the environment I am working 
in and will be applied to wss4j.


--Apple-Mail-18--645318966
Content-Transfer-Encoding: 7bit
Content-Type: application/octet-stream;
	x-unix-mode=0644;
	name="cryptoHooks.patch"
Content-Disposition: attachment;
	filename=cryptoHooks.patch

Index: src/org/apache/ws/axis/security/WSDoAllReceiver.java
===================================================================
RCS file: /cvsroot/wss4j/wss4j/src/org/apache/ws/axis/security/WSDoAllReceiver.java,v
retrieving revision 1.12
diff -u -r1.12 WSDoAllReceiver.java
--- src/org/apache/ws/axis/security/WSDoAllReceiver.java	10 Feb 2004 15:55:56 -0000	1.12
+++ src/org/apache/ws/axis/security/WSDoAllReceiver.java	10 Feb 2004 20:43:39 -0000
@@ -263,41 +263,67 @@
 		}
 	} 
 	
-	private void decodeSignatureParameter() throws AxisFault {
+	/**
+	 * Hook to allow subclasses to load their Signature Crypto however they see fit.
+	 */
+	protected Crypto loadSignatureCrypto() throws AxisFault {
+		Crypto crypto = null;
 		if ((sigPropFile = (String) getOption(WSDoAllConstants.SIG_PROP_FILE))
 			== null) {
 			sigPropFile =
 				(String) msgContext.getProperty(WSDoAllConstants.SIG_PROP_FILE);
 		}
 		if (sigPropFile != null) {
-			if ((sigCrypto = (Crypto) cryptos.get(sigPropFile)) == null) {
-				sigCrypto = CryptoFactory.getInstance(sigPropFile);
-				cryptos.put(sigPropFile, sigCrypto);
+			if ((crypto = (Crypto) cryptos.get(sigPropFile)) == null) {
+				crypto = CryptoFactory.getInstance(sigPropFile);
+				cryptos.put(sigPropFile, crypto);
 			}
 		} else {
 			throw new AxisFault("WSDoAllReceiver: Signature: no crypto property file");
 		}
+		return crypto;
 	}
 	
-	/*
-	 * Set and check the decryption specific parameters, if necessary
-	 * take over signatur crypto instance.
-	 */ 
-
-	private void decodeDecryptionParameter() throws AxisFault {
+	/**
+	 * Hook to allow subclasses to load their Decryption Crypto however they see fit.
+	 */
+	protected Crypto loadDecryptionCrypto() throws AxisFault {
+		Crypto crypto = null;
 		if ((decPropFile = (String) getOption(WSDoAllConstants.DEC_PROP_FILE))
 			== null) {
 			decPropFile =
 				(String) msgContext.getProperty(WSDoAllConstants.DEC_PROP_FILE);
 		}
 		if (decPropFile != null) {
-			if ((decCrypto = (Crypto) cryptos.get(decPropFile)) == null) {
-				decCrypto = CryptoFactory.getInstance(decPropFile);
-				cryptos.put(decPropFile, decCrypto);
+			if ((crypto = (Crypto) cryptos.get(decPropFile)) == null) {
+				crypto = CryptoFactory.getInstance(decPropFile);
+				cryptos.put(decPropFile, crypto);
 			}
-		} else if ((decCrypto = sigCrypto) == null) {
+		} else if ((crypto = sigCrypto) == null) {
 			throw new AxisFault("WSDoAllReceiver: Encryption: no crypto property file");
 		}
+		return crypto;
+	}
+	
+	private void decodeSignatureParameter() throws AxisFault {
+		sigCrypto = loadSignatureCrypto();
+		/* There are currently no other signature parameters that need to be handled 
+		 * here, but we call the load crypto hook rather than just changing the visibility
+		 * of this method to maintain parity with WSDoAllSender.
+		 */
+	}
+	
+	/*
+	 * Set and check the decryption specific parameters, if necessary
+	 * take over signatur crypto instance.
+	 */ 
+
+	private void decodeDecryptionParameter() throws AxisFault {
+		decCrypto = loadDecryptionCrypto();
+		/* There are currently no other decryption parameters that need to be handled 
+		 * here, but we call the load crypto hook rather than just changing the visibility
+		 * of this method to maintain parity with WSDoAllSender.
+		 */
 	}
 
 	/**
Index: src/org/apache/ws/axis/security/WSDoAllSender.java
===================================================================
RCS file: /cvsroot/wss4j/wss4j/src/org/apache/ws/axis/security/WSDoAllSender.java,v
retrieving revision 1.20
diff -u -r1.20 WSDoAllSender.java
--- src/org/apache/ws/axis/security/WSDoAllSender.java	21 Jan 2004 12:14:42 -0000	1.20
+++ src/org/apache/ws/axis/security/WSDoAllSender.java	10 Feb 2004 20:43:39 -0000
@@ -362,6 +362,7 @@
 					break;
 			}
 		}
+      
 		/*
 		 * If required convert the resulting document into a message first. 
 		 * The outputDOM() method performs the necessary c14n call. After 
@@ -399,6 +400,58 @@
 		}
 	}
 	
+	/**
+	 * Hook to allow subclasses to load their Signature Crypto however they see fit.
+	 */
+	protected Crypto loadSignatureCrypto() throws AxisFault {
+		Crypto crypto = null;
+		/*
+		 * Get crypto property file for signature. If none specified
+		 * throw fault, otherwise get a crypto instance.
+		 */
+		String sigPropFile = null;
+		if ((sigPropFile = (String) getOption(WSDoAllConstants.SIG_PROP_FILE))
+		== null) {
+			sigPropFile =
+				(String) msgContext.getProperty(WSDoAllConstants.SIG_PROP_FILE);
+		}
+		if (sigPropFile != null) {
+			if ((crypto = (Crypto) cryptos.get(sigPropFile)) == null) {
+				crypto = CryptoFactory.getInstance(sigPropFile);
+				cryptos.put(sigPropFile, crypto);
+			}
+		} else {
+			throw new AxisFault("WSDoAllSender: Signature: no crypto property file");
+		}
+		return crypto;
+	}
+	
+	/**
+	 * Hook to allow subclasses to load their Encryption Crypto however they see fit.
+	 */
+	protected Crypto loadEncryptionCrypto() throws AxisFault {
+		Crypto crypto = null;
+		/*
+		 * Get encryption crypto property file. If non specified
+		 * take crypto instance from signature, if that fails: throw fault
+		 */
+		String encPropFile = null;
+		if ((encPropFile = (String) getOption(WSDoAllConstants.ENC_PROP_FILE))
+		== null) {
+			encPropFile =
+				(String) msgContext.getProperty(WSDoAllConstants.ENC_PROP_FILE);
+		}
+		if (encPropFile != null) {
+			if ((crypto = (Crypto) cryptos.get(encPropFile)) == null) {
+				crypto = CryptoFactory.getInstance(encPropFile);
+				cryptos.put(encPropFile, crypto);
+			}
+		} else if ((crypto = sigCrypto) == null) {
+			throw new AxisFault("WSDoAllSender: Encryption: no crypto property file");
+		}
+		return crypto;
+	}
+	
 	private void decodeUTParameter() throws AxisFault {
 		if ((pwType = (String) getOption(WSDoAllConstants.PASSWORD_TYPE))
 			== null) {
@@ -417,25 +470,8 @@
 	}
 
 	private void decodeSignatureParameter() throws AxisFault {
-		/*
-		 * Get crypto property file for signature. If none specified
-		 * throw fault, otherwise get a crypto instance.
-		 */
-		String sigPropFile = null;
-		if ((sigPropFile = (String) getOption(WSDoAllConstants.SIG_PROP_FILE))
-			== null) {
-			sigPropFile =
-				(String) msgContext.getProperty(WSDoAllConstants.SIG_PROP_FILE);
-		}
-		if (sigPropFile != null) {
-			if ((sigCrypto = (Crypto) cryptos.get(sigPropFile)) == null) {
-				sigCrypto = CryptoFactory.getInstance(sigPropFile);
-				cryptos.put(sigPropFile, sigCrypto);
-			}
-		} else {
-			throw new AxisFault("WSDoAllSender: Signature: no crypto property file");
-		}
 
+		sigCrypto = loadSignatureCrypto();
 		String tmpS = null;
 		if ((tmpS = (String) getOption(WSDoAllConstants.SIG_KEY_ID)) == null) {
 			tmpS = (String) msgContext.getProperty(WSDoAllConstants.SIG_KEY_ID);
@@ -468,25 +504,7 @@
 	}
 	
 	private void decodeEncryptionParameter() throws AxisFault {
-		/*
-		 * Get encryption crypto property file. If non specified
-		 * take crypto instance from signature, if that fails: throw fault
-		 */
-		String encPropFile = null;
-		if ((encPropFile = (String) getOption(WSDoAllConstants.ENC_PROP_FILE))
-			== null) {
-			encPropFile =
-				(String) msgContext.getProperty(WSDoAllConstants.ENC_PROP_FILE);
-		}
-		if (encPropFile != null) {
-			if ((encCrypto = (Crypto) cryptos.get(encPropFile)) == null) {
-				encCrypto = CryptoFactory.getInstance(encPropFile);
-				cryptos.put(encPropFile, encCrypto);
-			}
-		} else if ((encCrypto = sigCrypto) == null) {
-			throw new AxisFault("WSDoAllSender: Encryption: no crypto property file");
-		}
-
+		encCrypto = loadEncryptionCrypto();
 		if ((encUser = (String) getOption(WSDoAllConstants.ENCRYPTION_USER))
 			== null) {
 			encUser =
Index: src/org/apache/ws/security/components/crypto/Merlin.java
===================================================================
RCS file: /cvsroot/wss4j/wss4j/src/org/apache/ws/security/components/crypto/Merlin.java,v
retrieving revision 1.9
diff -u -r1.9 Merlin.java
--- src/org/apache/ws/security/components/crypto/Merlin.java	5 Feb 2004 18:28:34 -0000	1.9
+++ src/org/apache/ws/security/components/crypto/Merlin.java	10 Feb 2004 20:43:40 -0000
@@ -337,6 +337,16 @@
     }
 
     /**
+     * A Hook for subclasses to set the keystore without having to 
+     * load it from an <code>InputStream</code>.
+     * @param ks existing keystore
+     */
+    public void setKeyStore(KeyStore ks)
+    {
+        keystore = ks;
+    }
+    
+    /**
      * Loads the the keystore from an <code>InputStream </code>.
      * <p/>
      * 

--Apple-Mail-18--645318966
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed



Jason Essington
jaessing-0ehoRKBSFavH/[email protected]
--Apple-Mail-18--645318966--



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn