org.apache.cxf.ws.security.wss4j
Class CryptoCoverageChecker

java.lang.Object
  org.apache.cxf.phase.AbstractPhaseInterceptor<SoapMessage>
      org.apache.cxf.binding.soap.interceptor.AbstractSoapInterceptor
          org.apache.cxf.ws.security.wss4j.CryptoCoverageChecker

All Implemented Interfaces:

SoapInterceptor, Interceptor<SoapMessage>, PhaseInterceptor<SoapMessage>

Direct Known Subclasses:

DefaultCryptoCoverageChecker

public class CryptoCoverageChecker
extends AbstractSoapInterceptor

Utility to enable the checking of WS-Security signature/encryption coverage based on the results of the WSS4J processors. This interceptor provides an alternative to using WS-Policy based configuration for crypto coverage enforcement.

Note that the processor must properly address the Security Token Reference Dereference transform in the case of a signed security token such as a SAML assertion. Consequently, a version of WSS4J that properly addresses this transform must be used with this utility if you wish to check coverage over a message part referenced through the Security Token Reference Dereference transform. See WSS-222 for more details.

xPaths

protected List<CryptoCoverageChecker.XPathExpression> xPaths

The XPath expressions for locating elements in SOAP messages that must be covered. See prefixMap for namespace prefixes available.

prefixMap

protected Map<String,String> prefixMap

Mapping of namespace prefixes to namespace URIs.

CryptoCoverageChecker

public CryptoCoverageChecker()

Creates a new instance. See #setPrefixes() and #setXpaths() for providing configuration options.

CryptoCoverageChecker

public CryptoCoverageChecker(Map<String,String> prefixes,
                             List<CryptoCoverageChecker.XPathExpression> xPaths)

Creates a new instance that checks for signature coverage over matches to the provided XPath expressions making defensive copies of provided arguments.

Parameters:

prefixes - mapping of namespace prefixes to namespace URIs

xPaths - a list of XPath expressions

handleMessage

public void handleMessage(SoapMessage message)
                   throws Fault

Checks that the WSS4J results refer to the required signed/encrypted elements as defined by the XPath expressions in xPaths.

Parameters:

message - the SOAP message containing the signature

Throws:

SoapFault - if there is an error evaluating an XPath or an element is not covered by the required cryptographic operation

Fault

setXPaths

public final void setXPaths(List<CryptoCoverageChecker.XPathExpression> xpaths)

Sets the XPath expressions to check for, clearing all previously set expressions.

Parameters:

xPaths - the XPath expressions to check for

addXPaths

public final void addXPaths(List<CryptoCoverageChecker.XPathExpression> xpaths)

Adds the XPath expressions to check for, adding to any previously set expressions.

Parameters:

xPaths - the XPath expressions to check for

setPrefixes

public final void setPrefixes(Map<String,String> prefixes)

Sets the mapping of namespace prefixes to namespace URIs, clearing all previously set mappings.

Parameters:

prefixes - the mapping of namespace prefixes to namespace URIs

addPrefixes

public final void addPrefixes(Map<String,String> prefixes)

Adds the mapping of namespace prefixes to namespace URIs, adding to any previously set mappings.

Parameters:

prefixes - the mapping of namespace prefixes to namespace URIs