How to use SAML 2.0 Sender Vouches?

[Marcelo Tataje]

Hello, I've been migrating a Web Service developed with METRO framework to an environment developed with IBM products only and I found a big problem when I try to use SAML 2.0 sender vouches assertion, because in my web service application using Metro I have a class which implements CallbackHandler, the code I have is the following:

public class SamlCallbackHandler implements CallbackHandler {

    public static String SENDER_ID = "SENDER_ID";
    public static String KEYSTORE_FILE = "TRUSTSTORE_URL";
    public static String KEYSTORE_PASSWORD = "TRUSTSTORE_PASSWORD";
    public static String SAML_TOKEN_ISSUER_NAME = "SAML_TOKEN_ISSUER_NAME";
    private int count = 0;

    private UnsupportedCallbackException unsupported =
            new UnsupportedCallbackException(null, "Unsupported Callback Type Encountered");

    public static void main(String[] args) {
        new SamlCallbackHandler().createSenderVouchesSAMLAssertion(null);
        
    }

    public final void handle(final Callback[] callbacks)
            throws IOException, UnsupportedCallbackException {

        for (int i = 0; i < callbacks.length; i++) {

            if (callbacks[i] instanceof SAMLCallback) {

                try {
                    SAMLCallback samlCallback = (SAMLCallback) callbacks[i];
                    if (samlCallback.getConfirmationMethod().equals(SAMLCallback.SV_ASSERTION_TYPE) && count == 0) {
                        samlCallback.setAssertionElement(createSenderVouchesSAMLAssertion(samlCallback));
                    }
                } catch (Exception ex) {
                    ex.printStackTrace();
                }

            } else {
                throw unsupported;
            }
        }
    }

    private Element createSenderVouchesSAMLAssertion(final SAMLCallback samlCallback) {


        String senderId = (String) samlCallback.getRuntimeProperties().get(SENDER_ID);
        String accesspointName = (String) samlCallback.getRuntimeProperties().get(SAML_TOKEN_ISSUER_NAME);
        String storeFilename = (String) samlCallback.getRuntimeProperties().get(KEYSTORE_FILE);
        String storePassword = (String) samlCallback.getRuntimeProperties().get(KEYSTORE_PASSWORD);

        Assertion assertion = null;

        try {
            String assertionID = "SamlID" + String.valueOf(System.currentTimeMillis()); //id must start with letters (WIF .NET)
            samlCallback.setAssertionId(assertionID); //neccesary to support <sp:ProtectTokens>

            GregorianCalendar c = new GregorianCalendar();
            long beforeTime = c.getTimeInMillis();

            // roll the time by one hour
            long offsetHours = 60 * 60 * 1000;
            c.setTimeInMillis(beforeTime - offsetHours);
            GregorianCalendar before = (GregorianCalendar) c.clone();

            c = new GregorianCalendar();
            long afterTime = c.getTimeInMillis();
            c.setTimeInMillis(afterTime + offsetHours);
            GregorianCalendar after = (GregorianCalendar) c.clone();
            GregorianCalendar issueInstant = new GregorianCalendar();

            List statements = new LinkedList();
            SAMLAssertionFactory factory = SAMLAssertionFactory.newInstance(SAMLAssertionFactory.SAML2_0);
            NameID senderNameID = factory.createNameID(senderId, null, "http://busdox.org/profiles/serviceMetadata/1.0/UniversalBusinessIdentifier/1.0/");
            NameID accessPointNameID = factory.createNameID(accesspointName, null, "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified");

            SubjectConfirmation scf = factory.createSubjectConfirmation(null, "urn:oasis:names:tc:SAML:2.0:cm:sender-vouches");
            Subject subj = factory.createSubject(senderNameID, scf);
            AuthnContext ctx = factory.createAuthnContext("urn:oasis:names:tc:SAML:2.0:ac:classes:X509", null);
            final AuthnStatement statement = factory.createAuthnStatement(issueInstant, null, ctx, null, null);
            statements.add(statement);
            String assuranceLevel = "3";
            statements.add(getAussuranceLevelStatement(assuranceLevel, factory));
            Conditions conditions = factory.createConditions(before, after, null, null, null, null);
            assertion = factory.createAssertion(assertionID, accessPointNameID, issueInstant, conditions, null, subj, statements);
            X509Certificate accessPointCertificate = getCertificate(storeFilename, storePassword);
            Element signedAssertion = sign(assertion, accessPointCertificate, getPrivateKey(storeFilename, storePassword));

            return signedAssertion;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    private AttributeStatement getAussuranceLevelStatement(final String assuranceLevel,
                    final SAMLAssertionFactory samlAssertFactory) throws SAMLException {

        List<Attribute> attrs = new ArrayList<Attribute>();
        List<String> values = new ArrayList<String>();
        values.add(assuranceLevel);
        Attribute attr = samlAssertFactory.createAttribute("urn:eu:busdox:attribute:assurance-level", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic", values);
        attrs.add(attr);
        AttributeStatement statement = samlAssertFactory.createAttributeStatement(attrs);

        return statement;
    }
    private AuthnStatement getAuthnStatement(final SAMLAssertionFactory samlAssertFactory,
            final GregorianCalendar issueInstant, final GregorianCalendar afterCal) throws SAMLException {

        //TODO an use for this method will be found

        AuthnContext ctx = samlAssertFactory.createAuthnContext();
        SubjectLocality subjectLocality = null;
        AuthnStatement authnStatement =
                samlAssertFactory.createAuthnStatement(issueInstant, subjectLocality, ctx, null, afterCal);

        return authnStatement;
    }

    private void placeSignatureAfterIssuer(final Element assertionElement) throws DOMException {
        //TODO analyse if it's suitable an unchecked exception in the throws declaration

        NodeList nodes = assertionElement.getChildNodes();
        List<Node> movingNodes = new ArrayList<Node>();

        for (int i = 1; i < nodes.getLength() - 1; i++) {
            movingNodes.add(nodes.item(i));
            System.out.println(nodes.item(i).getNodeName());
        }

        for (Node node : movingNodes) {
            assertionElement.removeChild(node);
        }

        for (Node node : movingNodes) {
            assertionElement.appendChild(node);
        }
    }

    public static PrivateKey getPrivateKey(final String storeUrl, final String storePassword)
            throws KeyStoreException, NoSuchAlgorithmException, IOException,
                    CertificateException, NoSuchProviderException,
                    UnrecoverableKeyException {

        PrivateKey privateKey = null;
        KeyStore keystore = getKeyStore(storeUrl, storePassword);
        String alias = keystore.aliases().nextElement();
        Key key = keystore.getKey(alias, storePassword.toCharArray());

        if (key instanceof PrivateKey) {
            Certificate cert = keystore.getCertificate(alias);
            PublicKey publicKey = cert.getPublicKey();
            KeyPair keyPair = new KeyPair(publicKey, (PrivateKey) key);
            privateKey = keyPair.getPrivate();
        }

        return privateKey;
    }

    public final Element sign(final Assertion assertion, final X509Certificate cert,
            final PrivateKey privKey) throws SAMLException {

        try {
            XMLSignatureFactory fac = WSSPolicyConsumerImpl.getInstance().getSignatureFactory();

            return sign(assertion, fac.newDigestMethod(DigestMethod.SHA1, null),
                            SignatureMethod.RSA_SHA1, cert, privKey);
        } catch (Exception ex) {
            throw new SAMLException(ex);
        }
    }

    public final Element sign(final Assertion assertion, final DigestMethod digestMethod,
            final String signatureMethod, final X509Certificate cert,
            final PrivateKey privKey) throws SAMLException {

        try {
            XMLSignatureFactory fac = WSSPolicyConsumerImpl.getInstance().getSignatureFactory();
            ArrayList transformList = new ArrayList();

            Transform tr1 = fac.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null);
            Transform tr2 = fac.newTransform(CanonicalizationMethod.EXCLUSIVE, (TransformParameterSpec) null);
            transformList.add(tr1);
            transformList.add(tr2);

            String uri = "#" + assertion.getID();
            Reference ref = fac.newReference(uri, digestMethod,
                    transformList, null, null);

            // Create the SignedInfo
            SignedInfo si =
                    fac.newSignedInfo(fac.newCanonicalizationMethod(CanonicalizationMethod.EXCLUSIVE, (C14NMethodParameterSpec) null),
                                        fac.newSignatureMethod(signatureMethod, null),
                                        Collections.singletonList(ref));

            /* Document to be signed */
            Document doc = MessageFactory.newInstance().createMessage().getSOAPPart();
            KeyInfoFactory kif = fac.getKeyInfoFactory();
            javax.xml.crypto.dsig.keyinfo.KeyInfo ki = null;

            X509Data x509Data = kif.newX509Data(Collections.singletonList(cert));
            ki = kif.newKeyInfo(Collections.singletonList(x509Data));

            Element assertionElement = assertion.toElement(doc);
            DOMSignContext dsc = new DOMSignContext(privKey, assertionElement);
            HashMap map = new HashMap();
            map.put(assertion.getID(), assertionElement);

            XMLSignature signature = fac.newXMLSignature(si, ki);
            dsc.putNamespacePrefix("http://www.w3.org/2000/09/xmldsig#", "ds");

            signature.sign(dsc);
            placeSignatureAfterIssuer(assertionElement);

            return assertionElement;
        } catch (XWSSecurityException ex) {
            throw new SAMLException(ex);
        } catch (MarshalException ex) {
            throw new SAMLException(ex);
        } catch (NoSuchAlgorithmException ex) {
            throw new SAMLException(ex);
        } catch (SOAPException ex) {
            throw new SAMLException(ex);
        } catch (XMLSignatureException ex) {
            throw new SAMLException(ex);
        } catch (InvalidAlgorithmParameterException ex) {
            throw new SAMLException(ex);
        }
    }

But then I have no idea how to begin implementing SAML 2.0 Sender Vouches using just IBM libraries and APIs, because I'm not allowed to use METRO or any other framework, can somebody please help me? I will be really grateful. Thanks in advance

[Marcin Rembisz]

Did you get that working in WebSphere?