Question

我确实在阳光下尝试所有来获得基于令牌的WS-Trust Web服务，但无济于事。我可以从STS获得令牌，但是我的生活，我无法弄清楚如何使用令牌从外部保护WS服务器的安全性和可访问性。

所以我想知道的是，如果有人有这个在JBoss 7上工作的话。我对“这个和jboss 上的内容不应该给你一些信息”。去过那里 - 做不到。你能够让它工作吗？

Answer 1

我查看了使用SAML保护Web服务的picketlink，但它似乎是使用JAAS安全上下文公开SAML身份验证。所以我只是使用picketlink API编写了一个自定义处理程序来保护WS。处理程序基本上做同样的事情（即saml断言到期和数字签名验证检查），作为picketlink jar中可用的SAMLTokenCertValidatingCommonLoginModule，但是将SAML属性传递给WS消息上下文，而不是将其作为JAAS安全上下文传递。

在下面找到代码段。

请参阅org.picketlink.identity.federation.bindings.jboss.auth.SAMLTokenCertValidatingCommonLoginModule picketlink-jbas的类 - 用于实现自定义处理程序中使用的方法getX509Certificate，validateCertPath的公共源代码。

public class CustomSAML2Handler<C extends LogicalMessageContext> implements SOAPHandler {

protected boolean handleInbound(MessageContext msgContext) {
    logger.info("Handling Inbound Message");

    String assertionNS = JBossSAMLURIConstants.ASSERTION_NSURI.get();
    SOAPMessageContext ctx = (SOAPMessageContext) msgContext;


    SOAPMessage soapMessage = ctx.getMessage();

    if (soapMessage == null)
        throw logger.nullValueError("SOAP Message");

    // retrieve the assertion
    Document document = soapMessage.getSOAPPart();
    Element soapHeader = Util.findOrCreateSoapHeader(document.getDocumentElement());
    Element assertion = Util.findElement(soapHeader, new QName(assertionNS, "Assertion"));
    if (assertion != null) {
        AssertionType assertionType = null;
        try {
            assertionType = SAMLUtil.fromElement(assertion);
            if (AssertionUtil.hasExpired(assertionType))
                throw new RuntimeException(logger.samlAssertionExpiredError());
        } catch (Exception e) {
            logger.samlAssertionPasingFailed(e);
        }
        SamlCredential credential = new SamlCredential(assertion);
        if (logger.isTraceEnabled()) {
            logger.trace("Assertion included in SOAP payload: " + credential.getAssertionAsString());
        }

        try {
            validateSAMLCredential(credential, assertionType);
            ctx.put("roles",AssertionUtil.getRoles(assertionType, null));
            ctx.setScope("roles", MessageContext.Scope.APPLICATION);

        } catch (Exception e) {
            logger.error("Error: " + e);
            throw new RuntimeException(e);
        }
    } else {
        logger.trace("We did not find any assertion");
    }


    return true;
}

private void validateSAMLCredential(SamlCredential credential, AssertionType assertion) throws LoginException, ConfigurationException, CertificateExpiredException, CertificateNotYetValidException {


    // initialize xmlsec
    org.apache.xml.security.Init.init();

    X509Certificate cert = getX509Certificate(credential);

    // public certificate validation
    validateCertPath(cert);

    // check time validity of the certificate
    cert.checkValidity();

    boolean sigValid = false;
    try {
        sigValid = AssertionUtil.isSignatureValid(credential.getAssertionAsElement(), cert.getPublicKey());
    } catch (ProcessingException e) {
        logger.processingError(e);
    }
    if (!sigValid) {
        throw logger.authSAMLInvalidSignatureError();
    }
    if (AssertionUtil.hasExpired(assertion)) {
        throw logger.authSAMLAssertionExpiredError();
    }

}

}

有没有人让WS-Trust在JBoss 7中工作？

1 个答案: