Skip to Content »

online discount medstore
advair diskus for sale
buy advair diskus without prescription
allegra for sale
buy allegra without prescription
aristocort for sale
buy aristocort without prescription
astelin for sale
buy astelin without prescription
atarax for sale
buy atarax without prescription
benadryl for sale
buy benadryl without prescription
buy clarinex without prescription
clarinex for sale
buy claritin without prescription
claritin for sale
buy flonase without prescription
flonase for sale
buy ventolin without prescription
ventolin for sale
amoxil for sale
buy amoxil without prescription
augmentin for sale
buy augmentin without prescription
bactrim for sale
buy bactrim without prescription
biaxin for sale
buy biaxin without prescription
buy cipro without prescription
cipro for sale
buy cleocin without prescription
cleocin for sale
buy dexone without prescription
dexone for sale
buy flagyl without prescription
flagyl for sale
buy levaquin without prescription
levaquin for sale
buy omnicef without prescription
omnicef for sale
amaryl for sale
buy amaryl without prescription
buy cozaar without prescription
cozaar for sale
buy diabecon without prescription
diabecon for sale
buy glucophage without prescription
glucophage for sale
buy glucotrol without prescription
glucotrol for sale
buy glucovance without prescription
glucovance for sale
buy micronase without prescription
micronase for sale
buy prandin without prescription
prandin for sale
buy precose without prescription
precose for sale
buy cialis professional without prescription
cialis professional for sale
buy cialis soft without prescription
cialis soft for sale
buy cialis super active without prescription
cialis super active for sale
buy cialis without prescription
cialis for sale
buy levitra without prescription
levitra for sale
buy viagra professional without prescription
viagra professional for sale
buy viagra soft without prescription
viagra soft for sale
buy viagra super active without prescription
viagra super active for sale
buy viagra super force without prescription
viagra super force for sale
buy viagra without prescription
viagra for sale
buy celebrex without prescription
celebrex for sale
buy colcrys without prescription
colcrys for sale
buy feldene without prescription
feldene for sale
buy imitrex without prescription
imitrex for sale
buy inderal without prescription
inderal for sale
buy indocin without prescription
indocin for sale
buy naprosyn without prescription
naprosyn for sale
buy pletal without prescription
pletal for sale
buy robaxin without prescription
robaxin for sale
buy voltaren without prescription
voltaren for sale

Tech Life of Recht » Building an STS with Metro

 Building an STS with Metro

  • January 4th, 2010
  • 10:25 pm

One of my recent tasks has been to see if it was possible to implement an OIO-Trust-compliant STS using the Metro stack from Sun. Metro contains WSIT, which has a number of classes for building an STS, so it’s not that hard. However, large portions of the code is quite undocumented, so I decided to write some of my findings down, hence this post (which is probably only interesing to a very few people).

First of all, OIO-Trust is a Danish WS-Trust profile, which basically says how Issue requests should look. The basic premise is that in order to invoke a SOAP service, you need a token. The STS issues the token based on some criteria using the WS-Trust protocol on top of SOAP.
In OIO-Trust, the Issue request must be signed, and it must contain a so-called bootstrap token. The bootstrap token is a SAML 2.0 assertion. Furthermore, the request must contain the X509 certificate which is used to sign the message. The token requested in the Issue request is a PublicKey (that is, asymmetric) of type SAML 2.0. So, the input is a SAML 2.0 assertion, and the output is also a SAML 2.0 token. More specifically, the output is a holder-of-key token, which has the requestors X509 certificate in the SubjectConfirmationData. The assertion is signed by the STS, and contains by default all the attributes from the input assertion.

In order to create an STS using Metro, you need to

  • Configure the Metro servlet in web.xml
  • Implement a simple STS endpoint class
  • Create a WSDL and a security policy
  • Create a number of services for handling attributes, configuration, etc

Configuring web.xml
This assumes that you’re using a simple servlet container. If the container supports JAX-WS, it shouldn’t be necessary.
When using Metro, all requests go through the same servlet, the WSServlet. The exact endpoint implementation used is then configured in another file, WEB-INF/sun-jaxws.xml. Therefore, simply add the following to web.xml:



This maps all requests to /services to Metro.

Implement the STS endpoint
Implementing the endpoint is quite simple, as it’s simply a question of extending a Metro class and injecting a resource. Here is a basic implementation:
import javax.annotation.Resource;
import javax.xml.transform.Source;


public class TokenService extends BaseSTSImpl implements Provider{
protected WebServiceContext context;

protected MessageContext getMessageContext() {
MessageContext msgCtx = context.getMessageContext();
return msgCtx;


No changes should be necessary, as the BaseSTSImpl class will handle all WS-Trust communication. What you need to do is to configure the base class according to the local requirements. More on that a little later.

In order to wire the STS endpoint into Metro, you need to create a WEB-INF/sun-jaxws.xml file. The file should contain something like this:



This binds the TokenService implementation to the url /services/sts using SOAP 1.1 (specified by the binding attribute).

Creating the WSDL and policy file
This is by far the hardest part of creating an STS for Metro. The WSDL should be pretty standard, and the same file can be used for all implementations. However, the WSDL file must also contain a security policy, as defined by WS-SecurityPolicy, and writing the policy can be pretty complicated. Netbeans has some support for writing policies, but I prefer to do it by hand because then you’re sure what you’ll get (once you understand WS-SecurityPolicy, that is).

The WSDL file tends to get somewhat large, so I won’t include it here – instead, you can download it if you want to see it. Basically, the WSDL is split into two parts: The regular WSDL stuff with types, messages, porttypes, bindings, and services, and the WS-SecurityPolicy stuff. Normally, the policy consists of 3 parts: The service policy which defined which tokens should be used, and how the security header layout should be, a policy which defines signature and encryption requirements for the request, and a policy for the response. These parts are then wired into the normal WSDL using PolicyReference elements.
In the example file, the service policy defines that we’re using an asymmetric binding (that is, the tokens should be different in the request and response – for example when using public/private keys). The policy also says something about the layout, and that the security header must contain a timestamp. Finally, it also enabled WS-Addressing.

Because this is an STS, the WSDL also contains a third part, namely static configuration of the STS. This includes configuring which certificates to use, how to validate incoming requests, and how tokens should be created.

Basically, this finishes the configuration of a very basic STS. However, there are some aspects which probably require some adjustments.

Checking if the requesting entity is allowed to access the requested service
When a client requests a new token, it includes a reference to the service in the AppliesTo element. Sometimes, there might be restrictions on who can access what. The Metro STS can check if the client is allowed to access a service by implementing the interface. The interface has one method, isAuthorized(subject, appliesTo, tokenType, keyType), which returns true or false:
package dk.itst.oiosaml.sts;


public class AutorizationProvider implements STSAuthorizationProvider {

public boolean isAuthorized(Subject subject, String appliesTo, String tokenType, String keyType) {
return true;

Metro uses the standard JDK service mechanism to discover implementations of this interface. That means that you should create the file /META-INF/services/ under your source directory and populate the file with the fully qualified classname of the implementation – in this example, create /META-INF/services/ with the contents dk.itst.oiosaml.sts.AuthorizationProvider.

Speficying attributes
Normally, you probably want to be able to configure the contents of the generated assertion, at the very least the attributes used, as well as the NameID of the subject. This is also done using a service implementation, this time using the interface.

The STSAttributeProvider interface has one method, getClaimedAttributes(subject, appliesTo, tokenType, claims), which returns a map of all the attributes and their values.

The subject contains information about the requesting client, in our example identified by a X509 certificate. The claims object contains any claims included in the request. It also holds any tokens included in OnBehalfOf or ActAs. These tokens are placed in claims.getSupportingProperties(), where they can be read as Subject objects. Here’s an example on reading an assertion, which has been included in ActAs:
private Assertion getSubject(Claims claims) {
Subject subject = null;
for (Object prop : claims.getSupportingProperties()) {
if (prop instanceof Subject) {
subject = (Subject) prop;
if (subject != null) {
Set creds = subject.getPublicCredentials(Element.class);
if (!creds.isEmpty()) {
Element assertion = creds.iterator().next();
try {
Assertion saml = SAMLAssertionFactory.newInstance(SAMLAssertionFactory.SAML2_0).createAssertion(assertion);
return saml;
} catch (Exception e) {
return null;

The attribute provider can then be implemented – here’s an example where the attributes from the ActAs assertion are simply copied to the resulting assertion:
public Map> getClaimedAttributes(Subject subject, String appliesTo, String tokenType, Claims claims) {
Map> res = new HashMap>();
Assertion assertion = getSubject(claims);
if (assertion != null) {
AttributeStatement attrs = getAttributes(assertion);
for (Attribute attr : attrs.getAttributes()) {
List values = new ArrayList();
for (Object val : attr.getAttributes()) {
res.put(new QName(attr.getName()), values);

res.put(new QName(assertion.getSubject().getNameId().getNameQualifier(),
return res;

Notice the last statement, where the NameID is added. The Metro STS will check if an attribute with the name STSAttributeProvider.NAME_IDENTIFIER is present, and in that case use that as the NameID of the subject in the generated assertion.

Handling configuration
The Metro STS must be know all services for which it can issue tokens. These services can either be configured statically in the WSDL file, or they can be provided programmatically. The static configuration is probably only interesting when developing, in a production environment, you probably want to build a nice admin console where services can be added and removed at runtime.

Static configuration takes place in the STSConfiguration element in the WSDL file. It can contain a ServiceProviders tag, which can then contain a number of ServiceProvider tags. Each ServiceProvider must be configured with an endpoint (the AppliesTo value), a certificate, and a token type:





The static configuration also contains information about the STS’ own id (the Issuer element), as well as the lifetime of issued tokens. The CertAlias value of a ServiceProvider must point to an alias in the trust store.

Programmatic configuration
Controlling configuration programmatically is a question of providing a service implementation of This interface has a single method, getSTSConfiguration(), which returns a configuration object – either your own implementation or an instanceof DefaultSTSConfiguration.

That more or less concludes my findings for now. There are a number of details I haven’t covered here, but I’ll wait with that until another time.

12,836 People had this to say...


always i used to read smaller articles that as well clear their motive, and that is also happening with this paragraph which I am reading now.|


Tech Life of Recht » Blog Archive » Building an STS with Metro


naturally like your web site but you need to check the spelling on quite a few of your posts. Many of them are rife with spelling problems and I find it very troublesome to inform the reality on the other hand I’ll surely come back again.|


Let my agent workand see how far he has (advanced in the talks) or how close he is. By implementing the above ideas you will find that you will actually enjoy life more and become more conscious of the life you are living. Overall, In my opinion farmville is among the foremost fun games I’ve performed which i feel it is a valuable piece to the players collection. Start your day with a sense of gratitude and you’ll be amazed at how your life changes. Some people have said, that it is one of the most exciting and fun games to watch in the world.

  • JimzyKep
  • October 25th, 2016
  • 12:13 am

cialis website – generic cialis buy cialis online email e-mail
generic cialis – cialis coupon code last post
cialis testimonials


That includes keeping your dog on the appropriate length leash, cleaning up after him, and preventing Blue from lifting a leg on someones beach towel. This at random created world has numerous options, as an example distinctive biomes, many land options (for instance mountain tops, hillsides, rivers, and oceans), together with a completely random vary of useful ores and product below walk out.”I’m extremely optimistic,” Wright said of a longterm deal. Luckily it soon turns a lot more easy when you study 1st couple secrets and find out exactly what makes you younger. Whats more, you could also identify if popular anti aging products (read about Zsa Zsa luxe creme for example) really are as powerful as certain people believe they are.


We stumbled over here from a different website and thought I should check things out. I like what I see so now i’m following you. Look forward to looking at your web page yet again.|


cartierbraceletlove Почему-то не люблю я такие книги 🙂
replica gold cartier bracelet

  • JimzyKep
  • October 25th, 2016
  • 2:58 am

cialis coupon free trial contact info – generic cialis cialis 20mg online you cannot post new topics in this forum
generic cialis – cialis 5mg dosage forum rules
cialis for women effects keywords


This site was… how do you say it? Relevant!! Finally I have found something which helped me. Kudos!|

Once a player has three strikes he loses his turn at bat. By voicing our feelings and what has caused us to be stressed we can become better aware at the cause of the stress and it may prove to show how insignificant it is or how over reacted we are to the situation. If he is unfit, out of shape, and could not even do the exercises that he is showing you, why would you be convinced that his training programs work?4. The slide tackle is banned on some youth soccer teams because it is dangerous. Keep in mind that the object is not kick or trip your opponent in anyway.


There’s nothing worse rather than 2 people getting mutually thinking they know people by their self proclamations, to finish up finding out the fact that they’re really not that individual and they’re not like-minded. Hopefully, at least one of you is strong and will keep you on task.The facilities of the alley should also be considered. Here are some accessories that should be considered:Bowling BallsBowling balls are the most important equipment in bowling.—————————————————————————Knut Holt is an internet consultant and marketer focusing on health items. Once more, you must find out yourself.Accountability can be as basic as telling your spouse, wife, mom and dad or your pals what you’re about to embark on.  In a corresponding move, the Royals recalled right-handed pitcher Yohan Pino from Triple-A Omaha. It consists for a great part of daily damages done on the macroscopic, tissue, cellular and genetic levels. The directory of ‘oh no no no’ would be similar to things over the ‘must have’ list, but might possibly be the opposite of what you long for.
Wholesale NFL Jerseys


Schoene Seite :D|


Long Island іѕ a favorite tourist spot оf mаnу individuals thе New York State. Kauai іѕ abоut 115 miles long, from west to east. Kauai іѕ home to golf courses, fine beaches, shopping venues, and luxury lifestyles. People planning to incorporate a vacation mау stay at a fеw of the luxury Long Island hotels. Such accommodations аrе popular aсrоѕѕ the isle.This year Australia hаѕ qualified intо Group Deborah. Australia will defіnitely bе playing Germany first. Ghana and Serbia arе alsо іn similar group аѕ Germany and Australia. I will certainly be wearing mу jersey and rooting for the best team all the way.The entire socks must be јust enough fоr it to cover уоur shinguards. The socks havе in which to stay up. They should not roll down after starting recreation. Many socks are cheap, though they tend to roll down the knees because your game moves on. The referee mау not аllоw the gamer tо play іf thе shinguards are subjected during video game.Men find a wау to take thіѕ very ѕerіouslу and will moѕt likеlу not еven let a girlfriend оr wife even look into washing thе jersey. Maybe it іs superstition or becoming neurotic who knows, but a soccer jersey cаn certainly bе a vеrу valuable possession to remedy male enthusiasts.Pre-natal nutritionists recommend that girls gain at the least 15 pounds during pregnancy, nо appear magliette their dimensions are prior tо pregnancy. The gain enables the give nutrients and important fat on the growing baby. These 15 pounds are the hardest tо shed post conception.As nations move furthеr and furthеr into morrison a pardon rounds on the cup event, thе talk in the air of a country whісh hаѕ progressed to such stages juѕt goeѕ over the top. Nations that for yоu to progress into the finals nеverthеleѕs end up viewing the incredible soccer finals matches and root to get a country they love.To travel frоm A tо Z require planning. You neеd to make it worse surе you could have time to organize. Why, a person do this, How a person goіng you want tо do it? What determines successfulness? How сan уou measure progression? Planning iѕ merely hammer absolutely no nails, if you find time to reflect, how arе you doing? So аre we аcсording tо plans? What actions should certainly bе completed? Make a time schedule if you neеd to positively.This is one of greatest and best-working ways to obtain ideas for your gifts. Should start by askіng very best friends or colleagues оr family, exactly what уоu give durіng Holiday party? What did you receive during your birthday? Exactly what thе bеѕt gifts уоu saw using a corporate nutritious meal? What gifts ought to be lіkе to obtain on valentine?


A WEBSITE IS BORNWhen I first conceived the idea of offering distance healing via a website, I became very excited.How someone is really like as a person is something you cannot decide until you get to spend some personal time with them, though, so that is beyond my scope to decide. For women, drinking two large glasses of wine a night would mean youve reached this level even before the weekend is over. The cheering conflict of interest aside, the make-believe General Manager can get a lot of insight from the roto world. Any PVA glue, which has spilled or oozed onto the boards can easily be wiped off a lacquered or oiled board, or sanded off an unfinished floor.
Cheap Jerseys


What’s Happening i’m new to this, I stumbled upon this I’ve discovered It positively helpful and it has helped me out loads. I hope to give a contribution & help different users like its aided me. Good job.|


CausesMedical science regards severe eye-strain or prolonged working under bad lighting conditions asthe chief causes of glaucoma. All of us because gamers may bring this kind of games towards the publics’ discover possibly by looking at the actual video games or requesting the friendfamily fellow member to experience and evaluation it.Alcohol dependentMore than one in 25 adults are dependent on alcohol. due to it’s location I would have never noticed a change in its appearance. For instance, if a bully calls a child ‘stupid’, the child could defuse the bullying by stating to the bully, hat’s nice? ow about that? h, well? and so forth.
Cheap Jerseys Free Shipping


Hello there, just became aware of your weblog through Google, and found that it is really informative. I am going to be careful for brussels. I’ll be grateful in the event you proceed this in future. A lot of people will likely be benefited from your writing. Cheers!|


When оnе interprets from thе soccer jersey it may be considered аs treason to some people who hold thеir jersey’s іn high regard if уоu do not cherish it. Even if you dоn’t follow thе sport, уоu рrоbablу knоw thаt soccer іѕ onе of thе most watched sports right.The Country haѕ stowed іn Group C for the 2010 world soccer cup. In Group C pursuing countries аre playing: Algeria, England, Slovenia аnd United states оf america. Of thе fоur countries in this group, I believe thе strongest оf theѕe 4 are England and USA. It has been sаіd by ѕоmе that England cоuld win the cup in in 2010.”El Terrible” Erik Morales – At first glance, advertising dоn’t precisely how tо translate Spanish you’ll think Erik Morales any terrible boxer. But thе fact іѕ ‘El Terrible” translates аѕ “one can be feared” in English. Morales wаѕ а 4-time world champion іn fоur diffеrent weight classes. Morales wаѕ аnythіng but terrible, actually hе lived through іnto ESPN’s 50 Greatest Boxers for now. In February 2000, “El Terrible” defeated Marco Antonio Barrera november 23 a Super Bantamweight title іn what mаny called the fight belonging tо the year for 2000. Morales would’ve bеen mоre popular in English speaking circles іf people асtually realized what hіs nickname translated to. Morales is сurrеntly retired and living іn Tijuana, The philipines. He іѕ thinking about a return on the ring between 2010. Let’s hope he’s got nоt serious.Messi was still young whеn discovered through man named Salvador Aparicio, who needed оne mоre player tо field hiѕ team, ѕo he asked if Leo соuld enjoy. That waѕ extremely time that this kid, 5yrs оld in the time, muсh younger than аll chats оf the participants wоuld wear a soccer jersey аnd play in a natural football nightclub. No onе at that time could thought thаt Messi was about to certainly key player аnd star of the earth Cup this year.jersey is a sign of support using a soccer workforce. During thе sport, mоѕt fans wear jersey nоt to be a means of fashion but the means to support theіr favorite team. Salvaging аvаilablе in а large amount sizes, styles аnd colors. As a fan уоu саn wear the uniform to get attention frоm fellow viewers. If yоu desire to hаvе authentic jersey many have them in sports store.Teams from the 2010 FIFA World Cup are sporting nеw outfits in South africa. There arе newly designed soccer jerseys fоr home аnd awау bouts. There are soccer jerseys avаilablе to your general public. People саn magliette support theіr nation of choice and get yourself a dvd high quality soccer jerseys made by popular manufacturers likе Nike and Adidas.Each these authentic 2010 world cup soccer jerseys hаve beеn crafted by thеir respective sponsors. Respected brands since Nike, Puma, аnd Adidas, amоng others, аll havе designs featured іn this years World Cup jerseys.Fans аrе welcomed to come оut early for tailgating and an opportunity to satisfy the team. Don’t forget thаt costume for halloween! Prizes wіll be awarded for your bеѕt costumes оf the night.


If some one desires to be updated with latest technologies afterward he must be pay a visit this website and be up to date every day.|


By doing this, understanding each others thoughts will also took place. The naturaltreatment for glaucoma is same as that for any other condition associated with high toxicity andis directed towards preserving whatever sight remains.Your niece says she uniform did her back-to-school shopping there.Author’s Resource Box back to school games printable 伜 back to school games for middle school Article Source:Free Online ArticlesDirectory- Unique Self Publishing Articles-Article DirectoryNapoli Dealing With Plantar Fasciitis – RealGM WiretapMike Napoli is dealing with plantar fasciitis in his left foot. A great defense, whose strength is stopping the run, may force the opponent to take more risks.
Wholesale Jerseys


Bist du wirklich blöd, das du meinen Text nicht verstanden hast und noch aus diesem Missverstehen heraus versuchst dich darüber lustig zu machen?


I mean which the bogus some might be truly worth your thought.


How does a team run around the baseball diamond? The player may run to first base immediately after hitting the baseball.comArticle Source: ?Once you have an understanding of hitting the ball and running, it is helpful to know all the rules of the baseball game. Live with it. La tuvo mi esposa ?.com/my.

For best training experience and safety, please refer to the following selection Long Beach PeninsulaLong Beach, Wash. Ojal? mis a?os transcurrieran al paso cansino en que lo hacen sus c?lculos m?dicos.. Minecraft has two kinds of game play, Singleplayer and Multiplayer.




Be sure you document all information if your collector are illegal. Water to drink maintains pores and skin hydrated. Make sure each person knows where these things are before you leave. Stretch exercises and some of the strength building exercises can definitely increase the power in your golf swing and help you to play the game better as well as more consistently. She has enjoyed a rewarding career in the board room of market leading global companies within the Fashion, Retail, Leisure and Healthcare industries.
Wholesale Jerseys


The worst thing that the child could do is respond by telling the bully that he or she is stupid or make any other negative, many members endure found that CyberShoppers of the islands fatigue of the ultimate places in the world on the way to wine glass or form a contrast shop.Alcohol dependentMore than one in 25 adults are dependent on alcohol.146 for the Athletics this year but put up good numbers for the Cubs after joining the team as a spring invitee before the 2014 season. FEET AND DOUBTA few years ago I had a painful bone spur and serious joint damage to my left foot.
Cheap NFL Jerseys China


Bowling may be a form of relaxation to many or a way to bond with families and friends. Going cold turkey on breaking a habit can be awful and put you in a horrible mood 247.What if you really don’t have any person close by that desires to training with you?Ok this means you just cannot obtain virtually anyone crazy ample to Insanity along with you, or if almost everyone is concerned of P90X.”It’s really nice to be 12-0,” said Scherzer, who allowed three runs,four hits, walked one and struck out nine in seven innings to becomethe first pitcher in Tigers history to win his first 12 decisions. If the alley is not clean and properly maintained, bowlers will not be comfortable. Surely, you could have other individuals that aren’t within which mentioned list, those are only examples and a starting point. We contain the electrical power toward repair service one of a kind photos, for instance, aged relatives images, or strengthen the distinction or obtain rid of an obvious historical past. They are the weight, size of the ball holes, and whether the balls are designed for right-handed or left-handed persons.”Scherzer First 12 0 Starter Since 1986 – RealGM WiretapMax Scherzer helped the Tigers defeat the Rays on Friday night, improving to 12-0 this season. Totally not; in particular as soon as by yourself can identify financial state flight coupon codes that can be applied in direction of knock down the charge of your ticket dramatically.
Cheap NFL Jerseys


Thank you a lot for sharing this with all of us you actually understand what you are speaking about! Bookmarked. Please additionally seek advice from my website =). We could have a link trade contract among us
coach ghuman

Want your say?

* Required fields. Your e-mail address will not be published on this site

You can use the following XHTML tags:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>