org.forgerock.openam.sts.soap.policy.am

Class OpenAMSessionAssertion

java.lang.Object

org.apache.wss4j.policy.model.AbstractSecurityAssertion

org.apache.wss4j.policy.model.AbstractToken

org.forgerock.openam.sts.soap.policy.am.OpenAMSessionAssertion

All Implemented Interfaces:

org.apache.neethi.Assertion, org.apache.neethi.PolicyComponent, org.apache.neethi.PolicyContainingAssertion

public class OpenAMSessionAssertion
extends org.apache.wss4j.policy.model.AbstractToken

Class which represents the Assertion corresponding to the custom OpenAMSessionToken SecurityPolicy binding. An assertion of this sort needs to be passed to the ISSUE operation which takes an OpenAMSession id. This will occur via the OpenAMSessionTokenClientAssertionBuilder registered with the org.apache.cxf.ws.policy.AssertionBuilderRegistry (obtained via the cxf Bus) in the STSClient instance used to consume the OpenAM soap sts.

Nested Class Summary

Nested classes/interfaces inherited from class org.apache.wss4j.policy.model.AbstractToken

org.apache.wss4j.policy.model.AbstractToken.DerivedKeys

Constructor Summary

Constructors

Constructor and Description
OpenAMSessionAssertion(org.apache.wss4j.policy.SPConstants.SPVersion version, org.apache.wss4j.policy.SPConstants.IncludeTokenType includeTokenType, Element nestedPolicy, String sessionId)

Method Summary

Modifier and Type	Method and Description
protected org.apache.wss4j.policy.model.AbstractSecurityAssertion	cloneAssertion(org.apache.neethi.Policy nestedPolicy)
QName	getName()
Element	getTokenElement() Called by the OpenAMSessionTokenClientInterceptor to obtain the xml defining the BinarySecurityToken encapsulating the OpenAMSessionToken to be included in the STS invocation.
void	serialize(XMLStreamWriter writer)

Methods inherited from class org.apache.wss4j.policy.model.AbstractToken

equals, getClaims, getDerivedKeys, getIncludeTokenType, getIssuer, getIssuerName, getParentAssertion, getPolicy, hashCode, normalize, setClaims, setDerivedKeys, setIncludeTokenType, setIssuer, setIssuerName, setParentAssertion

Methods inherited from class org.apache.wss4j.policy.model.AbstractSecurityAssertion

clone, equal, getType, getVersion, isAsserted, isIgnorable, isNormalized, isOptional, normalize, serialize, setIgnorable, setOptional

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.neethi.Assertion

isIgnorable, isOptional

Methods inherited from interface org.apache.neethi.PolicyComponent

equal, getType

Constructor Detail

OpenAMSessionAssertion

public OpenAMSessionAssertion(org.apache.wss4j.policy.SPConstants.SPVersion version,
                              org.apache.wss4j.policy.SPConstants.IncludeTokenType includeTokenType,
                              Element nestedPolicy,
                              String sessionId)

Parameters:

version - Constant indicating what SecurityPolicy version is being used(1.1 vs. 1.2). I believe that it is used to distinguish different QNames for different constructs in different versions

includeTokenType - The SecurityPolicy specification of when to include the token - e.g. always, never, always-to-recipient, etc.

nestedPolicy - The policy element nested within the OpenAM Session assertion. WS-SecurityPolicy nests policies within policies, and the nested policies qualify the enclosing policy. For the OpenAM session assertion, the nested policy is empty, but must be present in the SecurityPolicy binding, as the cxf runtime expects this nested policy element. Could be used to specify the version of the assertion, as is done for Username tokens.

sessionId - The OpenAM session id. When the OpenAMSessionAssertion builder constructs the OpenAMSessionAssertion, it will set the sessionId. This sessionId will be specified by the client and set by the OpenAMSessionTokenClientAssertionBuilder, and pulled from the BinarySecurityToken element which encapsulates this sessionId when it arrives at the targeted sts.

Method Detail

getName

public QName getName()

serialize

public void serialize(XMLStreamWriter writer)
               throws XMLStreamException

Specified by:

serialize in interface org.apache.neethi.Assertion

Specified by:

serialize in interface org.apache.neethi.PolicyComponent

Overrides:

serialize in class org.apache.wss4j.policy.model.AbstractToken

Throws:

XMLStreamException

See Also:

This method is not called as part of the OpenAMSessionTokenClientInterceptor to include this class' state in the xml infoset (getTokenElement below is called instead), but rather seems to be called by classes in the org.apache.cxf.ws.security.policy.model packages, such as InitiatorToken, ProtectionToken, SupportingToken(signed and/or encrypted incarnation), RecipientSignatureToken, etc. However, it does not appear that this method is ever called. See http://cxf.547215.n5.nabble.com/Custom-SecurityPolicy-Assertions-and-the-Symmetric-binding-td5754879.html#a5755303 for details. I will leave the current implementation as purpose/invocation seems to be somewhat unknown, even to the author of the cxf sts, and the wss4j lead. Note that it is not invoked to actually include a token in an XML infoset, but rather write the SecurityPolicy elements corresponding to this token type. It is (probably) not called because the SecurityPolicy in the wsdl is consulted directly.

getTokenElement

public Element getTokenElement()

Called by the OpenAMSessionTokenClientInterceptor to obtain the xml defining the BinarySecurityToken encapsulating the OpenAMSessionToken to be included in the STS invocation. Note that the various AbstractTokenInterceptor implementations in the cxf code-base define a builder or token class to obtain the Element representation of the token to-be-included in the soap security header. @see org.apache.cxf.ws.security.wss4j.UsernameTokenInterceptor#addToken for details. In other words, the org.apache.neethi.Assertion#serialize method which this class inherits via the Token superclass is not used by token-specific-interceptors to obtain the xml representation of the token.

Returns:

the Element defining the BinarySecurityToken with the encapsulated OpenAMSessionToken.

cloneAssertion

protected org.apache.wss4j.policy.model.AbstractSecurityAssertion cloneAssertion(org.apache.neethi.Policy nestedPolicy)

Specified by:

cloneAssertion in class org.apache.wss4j.policy.model.AbstractSecurityAssertion