Skip to Content »

online discount medstore
advair diskus for sale
buy advair diskus without prescription
allegra for sale
buy allegra without prescription
aristocort for sale
buy aristocort without prescription
astelin for sale
buy astelin without prescription
atarax for sale
buy atarax without prescription
benadryl for sale
buy benadryl without prescription
buy clarinex without prescription
clarinex for sale
buy claritin without prescription
claritin for sale
buy flonase without prescription
flonase for sale
buy ventolin without prescription
ventolin for sale
amoxil for sale
buy amoxil without prescription
augmentin for sale
buy augmentin without prescription
bactrim for sale
buy bactrim without prescription
biaxin for sale
buy biaxin without prescription
buy cipro without prescription
cipro for sale
buy cleocin without prescription
cleocin for sale
buy dexone without prescription
dexone for sale
buy flagyl without prescription
flagyl for sale
buy levaquin without prescription
levaquin for sale
buy omnicef without prescription
omnicef for sale
amaryl for sale
buy amaryl without prescription
buy cozaar without prescription
cozaar for sale
buy diabecon without prescription
diabecon for sale
buy glucophage without prescription
glucophage for sale
buy glucotrol without prescription
glucotrol for sale
buy glucovance without prescription
glucovance for sale
buy micronase without prescription
micronase for sale
buy prandin without prescription
prandin for sale
buy precose without prescription
precose for sale
buy cialis professional without prescription
cialis professional for sale
buy cialis soft without prescription
cialis soft for sale
buy cialis super active without prescription
cialis super active for sale
buy cialis without prescription
cialis for sale
buy levitra without prescription
levitra for sale
buy viagra professional without prescription
viagra professional for sale
buy viagra soft without prescription
viagra soft for sale
buy viagra super active without prescription
viagra super active for sale
buy viagra super force without prescription
viagra super force for sale
buy viagra without prescription
viagra for sale
buy celebrex without prescription
celebrex for sale
buy colcrys without prescription
colcrys for sale
buy feldene without prescription
feldene for sale
buy imitrex without prescription
imitrex for sale
buy inderal without prescription
inderal for sale
buy indocin without prescription
indocin for sale
buy naprosyn without prescription
naprosyn for sale
buy pletal without prescription
pletal for sale
buy robaxin without prescription
robaxin for sale
buy voltaren without prescription
voltaren for sale

Tech Life of Recht » Building an STS with Metro

 Building an STS with Metro

  • January 4th, 2010
  • 10:25 pm

One of my recent tasks has been to see if it was possible to implement an OIO-Trust-compliant STS using the Metro stack from Sun. Metro contains WSIT, which has a number of classes for building an STS, so it’s not that hard. However, large portions of the code is quite undocumented, so I decided to write some of my findings down, hence this post (which is probably only interesing to a very few people).

First of all, OIO-Trust is a Danish WS-Trust profile, which basically says how Issue requests should look. The basic premise is that in order to invoke a SOAP service, you need a token. The STS issues the token based on some criteria using the WS-Trust protocol on top of SOAP.
In OIO-Trust, the Issue request must be signed, and it must contain a so-called bootstrap token. The bootstrap token is a SAML 2.0 assertion. Furthermore, the request must contain the X509 certificate which is used to sign the message. The token requested in the Issue request is a PublicKey (that is, asymmetric) of type SAML 2.0. So, the input is a SAML 2.0 assertion, and the output is also a SAML 2.0 token. More specifically, the output is a holder-of-key token, which has the requestors X509 certificate in the SubjectConfirmationData. The assertion is signed by the STS, and contains by default all the attributes from the input assertion.

In order to create an STS using Metro, you need to

  • Configure the Metro servlet in web.xml
  • Implement a simple STS endpoint class
  • Create a WSDL and a security policy
  • Create a number of services for handling attributes, configuration, etc

Configuring web.xml
This assumes that you’re using a simple servlet container. If the container supports JAX-WS, it shouldn’t be necessary.
When using Metro, all requests go through the same servlet, the WSServlet. The exact endpoint implementation used is then configured in another file, WEB-INF/sun-jaxws.xml. Therefore, simply add the following to web.xml:
[code] com.sun.xml.ws.transport.http.servlet.WSServletContextListener
sts
com.sun.xml.ws.transport.http.servlet.WSServlet
1


sts
/services/*

[/code]

This maps all requests to /services to Metro.

Implement the STS endpoint
Implementing the endpoint is quite simple, as it’s simply a question of extending a Metro class and injecting a resource. Here is a basic implementation:
[code]
import javax.annotation.Resource;
import javax.xml.transform.Source;
import javax.xml.ws.Provider;
import javax.xml.ws.Service;
import javax.xml.ws.ServiceMode;
import javax.xml.ws.WebServiceContext;
import javax.xml.ws.WebServiceProvider;
import javax.xml.ws.handler.MessageContext;

import com.sun.xml.ws.security.trust.sts.BaseSTSImpl;

@ServiceMode(value=Service.Mode.PAYLOAD)
@WebServiceProvider(wsdlLocation=”WEB-INF/wsdl/sts.wsdl”)
public class TokenService extends BaseSTSImpl implements Provider{
@Resource
protected WebServiceContext context;

protected MessageContext getMessageContext() {
MessageContext msgCtx = context.getMessageContext();
return msgCtx;
}
}

[/code]

No changes should be necessary, as the BaseSTSImpl class will handle all WS-Trust communication. What you need to do is to configure the base class according to the local requirements. More on that a little later.

In order to wire the STS endpoint into Metro, you need to create a WEB-INF/sun-jaxws.xml file. The file should contain something like this:

[code]



[/code]

This binds the TokenService implementation to the url /services/sts using SOAP 1.1 (specified by the binding attribute).

Creating the WSDL and policy file
This is by far the hardest part of creating an STS for Metro. The WSDL should be pretty standard, and the same file can be used for all implementations. However, the WSDL file must also contain a security policy, as defined by WS-SecurityPolicy, and writing the policy can be pretty complicated. Netbeans has some support for writing policies, but I prefer to do it by hand because then you’re sure what you’ll get (once you understand WS-SecurityPolicy, that is).

The WSDL file tends to get somewhat large, so I won’t include it here – instead, you can download it if you want to see it. Basically, the WSDL is split into two parts: The regular WSDL stuff with types, messages, porttypes, bindings, and services, and the WS-SecurityPolicy stuff. Normally, the policy consists of 3 parts: The service policy which defined which tokens should be used, and how the security header layout should be, a policy which defines signature and encryption requirements for the request, and a policy for the response. These parts are then wired into the normal WSDL using PolicyReference elements.
In the example file, the service policy defines that we’re using an asymmetric binding (that is, the tokens should be different in the request and response – for example when using public/private keys). The policy also says something about the layout, and that the security header must contain a timestamp. Finally, it also enabled WS-Addressing.

Because this is an STS, the WSDL also contains a third part, namely static configuration of the STS. This includes configuring which certificates to use, how to validate incoming requests, and how tokens should be created.

Basically, this finishes the configuration of a very basic STS. However, there are some aspects which probably require some adjustments.

Checking if the requesting entity is allowed to access the requested service
When a client requests a new token, it includes a reference to the service in the AppliesTo element. Sometimes, there might be restrictions on who can access what. The Metro STS can check if the client is allowed to access a service by implementing the com.sun.xml.ws.api.security.trust.STSAuthorizationProvider interface. The interface has one method, isAuthorized(subject, appliesTo, tokenType, keyType), which returns true or false:
[code]
package dk.itst.oiosaml.sts;

import javax.security.auth.Subject;
import com.sun.xml.ws.api.security.trust.STSAuthorizationProvider;

public class AutorizationProvider implements STSAuthorizationProvider {

public boolean isAuthorized(Subject subject, String appliesTo, String tokenType, String keyType) {
return true;
}
}
[/code]

Metro uses the standard JDK service mechanism to discover implementations of this interface. That means that you should create the file /META-INF/services/ under your source directory and populate the file with the fully qualified classname of the implementation – in this example, create /META-INF/services/com.sun.xml.ws.api.security.trust.STSAuthorizationProvider with the contents dk.itst.oiosaml.sts.AuthorizationProvider.

Speficying attributes
Normally, you probably want to be able to configure the contents of the generated assertion, at the very least the attributes used, as well as the NameID of the subject. This is also done using a service implementation, this time using the com.sun.xml.ws.api.security.trust.STSAttributeProvider interface.

The STSAttributeProvider interface has one method, getClaimedAttributes(subject, appliesTo, tokenType, claims), which returns a map of all the attributes and their values.

The subject contains information about the requesting client, in our example identified by a X509 certificate. The claims object contains any claims included in the request. It also holds any tokens included in OnBehalfOf or ActAs. These tokens are placed in claims.getSupportingProperties(), where they can be read as Subject objects. Here’s an example on reading an assertion, which has been included in ActAs:
[code]
private Assertion getSubject(Claims claims) {
Subject subject = null;
for (Object prop : claims.getSupportingProperties()) {
if (prop instanceof Subject) {
subject = (Subject) prop;
}
}
if (subject != null) {
Set creds = subject.getPublicCredentials(Element.class);
if (!creds.isEmpty()) {
Element assertion = creds.iterator().next();
try {
Assertion saml = SAMLAssertionFactory.newInstance(SAMLAssertionFactory.SAML2_0).createAssertion(assertion);
return saml;
} catch (Exception e) {
e.printStackTrace();
}
}
}
return null;
}
[/code]

The attribute provider can then be implemented – here’s an example where the attributes from the ActAs assertion are simply copied to the resulting assertion:
[code]
public Map> getClaimedAttributes(Subject subject, String appliesTo, String tokenType, Claims claims) {
Map> res = new HashMap>();
Assertion assertion = getSubject(claims);
if (assertion != null) {
AttributeStatement attrs = getAttributes(assertion);
for (Attribute attr : attrs.getAttributes()) {
List values = new ArrayList();
for (Object val : attr.getAttributes()) {
values.add(val.toString());
}
res.put(new QName(attr.getName()), values);
}
}

res.put(new QName(assertion.getSubject().getNameId().getNameQualifier(),
STSAttributeProvider.NAME_IDENTIFIER),
Collections.singletonList(assertion.getSubject().getNameId().getValue()));
return res;
}
[/code]

Notice the last statement, where the NameID is added. The Metro STS will check if an attribute with the name STSAttributeProvider.NAME_IDENTIFIER is present, and in that case use that as the NameID of the subject in the generated assertion.

Handling configuration
The Metro STS must be know all services for which it can issue tokens. These services can either be configured statically in the WSDL file, or they can be provided programmatically. The static configuration is probably only interesting when developing, in a production environment, you probably want to build a nice admin console where services can be added and removed at runtime.

Static configuration takes place in the STSConfiguration element in the WSDL file. It can contain a ServiceProviders tag, which can then contain a number of ServiceProvider tags. Each ServiceProvider must be configured with an endpoint (the AppliesTo value), a certificate, and a token type:

[code]

36000
com.sun.xml.ws.security.trust.impl.WSTrustContractImpl
urn:localtokenservice


poc-provider
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0



[/code]

The static configuration also contains information about the STS’ own id (the Issuer element), as well as the lifetime of issued tokens. The CertAlias value of a ServiceProvider must point to an alias in the trust store.

Programmatic configuration
Controlling configuration programmatically is a question of providing a service implementation of com.sun.xml.ws.api.security.trust.config.STSConfigurationProvider. This interface has a single method, getSTSConfiguration(), which returns a configuration object – either your own implementation or an instanceof DefaultSTSConfiguration.

That more or less concludes my findings for now. There are a number of details I haven’t covered here, but I’ll wait with that until another time.

12,836 People had this to say...

Gravatar

Discover a system that will increase your MLM Sponsoring effectiveness! Learn how to not only explode your own mlm sponsoring efforts but also that of your team! Act now and see the power of a proven system!Grievance Over Dan Jennings Salary Settled In Nationals Favor – RealGM WiretapThe Miami Marlins filed a grievance with Major League Baseball this offseason over how much the Washington Nationals are paying Dan Jennings. You can discover more about these strategies here. Before you get started on a running program for losing weight, you should have some guidelines, so that you have the best approach.Article From Article Directory DatabaseReport Cueto Seeking $140 $160M Contract – RealGM WiretapJohnny Cueto is looking for a contract worth $140 million to $160 million, according to a report by ESPN’s Jerry Crasnick. Share costs by making a team advertising co-op.
Willie Cauley-Stein Jersey

Gravatar
  • mdbxgtc
  • January 15th, 2017
  • 12:12 am

Blood sway is determined, blink before moment, on the stabilize between heart productivity versus unmitigated superficial stubbornness and varies depending on berth, emotional shape, activity, and pertinent health/disease states. http://viagrawithoutdoctor.com/ viagra without a doctor prescription is regulated not later than the wisdom via both the distressed and endocrine systems.

Gravatar

Tech Life of Recht » Blog Archive » Building an STS with Metro
[url=http://www.g6ka98h3u9wi7wa2na7604fu2914xgu1s.org/]urffpxknb[/url]
rffpxknb http://www.g6ka98h3u9wi7wa2na7604fu2914xgu1s.org/
arffpxknb

Gravatar

Is that true? Ill spread this information. Anyway, nice posting.
李居明

Gravatar

Leidenschaftlich drückte und knetete ich meine beiden Lieblinge, schnappte mit den Lippen nach den Brustwarzen, drehte sie zwischen den Fingerspitzen, zog sie sinnlich die Länge und ließ sie wieder zurückschnippen.Schon der zweiten Nacht, als wir mit zwei jungen Männern auf Achse waren, fragte mich auf der Toilette, ob ich Lust hatte, den Jungs ein bisschen mehr zu gestatten.

Gravatar

It may be an insult for the look at if it’s offered in a smaller selling price.

  Clayton Kershaw To Pitch Simulated Game Tuesday – RealGM WiretapClayton Kershaw will face live hitters on Tuesday in a simulated game. A straightforward activity, running has many benefits including losing weight and getting in shape. A healthy meal that consists of carbohydrates that are complex should be eaten. You can discover more about these strategies here. The individuality of each specific piece is located in the wood materials takinged throughout the construction, the delicate platters, pins, dampers and sound boards too.
http://www.soccersshop.com/NETHERLAND-VINCENT-JANSSEN-JERSEY/

Gravatar

Whilst it could take you some extra time to cook the meals, you will help save a ton of money by not having to pay an additional business to make your food items. The third email should contain their first newsletter and their special offer.When fishing for trout or other freshwater fish remember that insects are their primary diet. It would be just so premature for us to talk about that. The amount of price to be spent and the efficiency of the technique depend on the choice of the promotional items that determines the fate of the respective company in terms of promotion.
Willy Caballero Jersey

Gravatar

Nice blog here! Also your site loads up fast!
Adidas Boost 350 Low Yeezy

Gravatar

After divine relaxed energy which creatively showered on her, cleansing and spiritually re patterning, she re gained confidence in herself and made necessary adjustments, finding peace.In regards to plus size dressing tips, there are simply no followed strong rules, this provides a chance for the creativity as well as innovation of larger women about the selection of their own clothes and accessories.Where you will wear a watch should be considered prior to buying it. For avid golfers, you will assume you died and went to heaven. Go to Charlotte for skyscrapers, Raleigh for museuEpstein Will Sit Down With Quade Admires Sandberg – RealGM WiretapNew Cubs president Theo Epstein plans to sit down with manager Mike Quade before making a decision on the future of the position.

Gravatar

The sneakers need to become sturdy adequately to support household names. Another option you have is actually to hire a specialist to catch and transfer the squirrel for you. There are installed heating methods and humidifying systems that may provide the exact amount of heat needed to heat and light-weight the crops during winter season where sunlight is limited. Remember to keep some of these ideas in your memory as you go on the hunt for a watch.sacs hermes had been created popular by way of higher-profile clientele which contain a bag called “the Kelly bag”, named following Grace Kelly she has built some of her appearances with it, and the Constance shoulder bag.
Dwayne Harris Jersey

If you don't make the right selection when it comes to your gear, you could find that it can not deal with the fish you are attempting to catch.”I can’t say there’s a relationship there or a good relationship there. If the water is murky, attempt to use light coloured bait so it is tangible to the fish. It is important is to keep in mind not to sacrifice comfort with respect to design. You’ll discover several lighthouses within the region, lots of that are impressive.
http://www.worldnhlshop.com/Dallas-Stars-Alex-Goligoski-Jersey/

Gravatar

With all the golf programs in Pinehurst and the encircling areas, you may find an abundance of outstanding golf properties on fairways. The flies should be extremely small due to the scale of the mouths of most trout.Sandy was able to gain a different perspective on her situation and find resolution to her quest. Sand color and turmeric, red ochre tone and saffron color, and amber, tan, and brown leather, arouse our QiuJing reminiscences of gaudy. At the female little one and handsome woman is.
Giancarlo Stanton Jersey

Gravatar

The with greatest satisfaction support indicates that expensive blood problems does not originator headaches or nosebleeds, except in the case of hypertensive calamity, a medical predicament when blood pressure is 180/110 mm Hg or higher. If your blood make is unusually soprano http://viagrawithoutadrprescription.com/ viagra without a doctor prescription you get headache or nosebleed and are inkling unwell, wait five minutes and retest. If your reading remains at 180/110 mm Hg or higher, bid 9-1-1.

Gravatar

1780 Napoleon Pfeife rauchend auf zwei Stühlen.

Gravatar

If You’re Having Trouble With Personal Finance, Follow These Suggestions.He underwent left knee surgery the day after the regular season ended, and he is in the process of building up his running routine. These options will give you a wide assortment from the movies which you love at a great far better price on your spending budget. She found it is possible for her to open up to accepting others as they are, and possibly even accepting herself as she is. From the other standpoint, if the water is clear, make efforts to use darker colored bait.
Michael Jordan Jersey

Gravatar

When you first begin running, you may not be able to get very far; so, rather than call it quits for the day, do some walking. This is past the middle finger is drilled to finger tip depth, where the ring is drilled to the conventional depth. When you first begin running, you may not be able to get very far; so, rather than call it quits for the day, do some walking. A five pin bowling ball has no finger holes and is more sick so that the bowler can retain the ball in the palm of his or her hand.The Rockies traded Fowler to the Houston Astros this winter.
Manchester United jersey

Gravatar

Die Temperaturen sind auf -20 °C gesunken.

Gravatar

Why numerous view addicts fhead to reproduction Cartier timepieces which make a terrific imitation of the first styles that’s likewise.
cheap rolex watches

Gravatar

brazilian body wav glance excellent. I really like them so significantly, if I could sleep in them I would. I’m by now b 360 frontaling my husband for a different pair! A++++++

Gravatar

Für die Müller herausgegebene Sammlung Sacred Books of the East übersetzte er die Gesetzbücher des Apastamba, Gautama, Vasischtha, Baudhāyana .

Gravatar

Heart attacks hit on a split second, but they normally result from long-standing consideration disease. Typically, http://sildenafilcoupons.accountant/ 100 mg viagra lowest price a waxy marker builds up on the walls within your blood vessels that thrive on the spirit muscle. Occasionally a chunk of the medal, called a blood clot, breaks elsewhere and prevents blood from passing through the vessel to your heart muscle, http://genericviagrausa.accountant/#46866 generic viagra resulting in a nerve attack. Less commonly, something like stress, true exertion, or unmoving stand causes the blood ship to contract or paroxysm, which decreases the http://vardenafil20mg.accountant/ levitra amount of blood that can put over to your heartlessness muscle.

Gravatar

As a result, nodules will not become so small which they hinder breathing and start expanding.8.BENEFITSWhat if you could productively use the knowledge received from your eternal super soul, integrate it into your life, begin projects, learn things that you always wanted. So , fish at dawn and dusk to enhance your percentages of a good catch.7.

Want your say?

* Required fields. Your e-mail address will not be published on this site

You can use the following XHTML tags:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>