Package org.apache.wss4j.stax.setup

Class InboundWSSec

java.lang.Object

org.apache.wss4j.stax.setup.InboundWSSec

public class InboundWSSec
extends Object

Inbound Streaming-WebService-Security An instance of this class can be retrieved over the WSSec class

Security note - streaming hands out content before verification completes: the XMLStreamReader returned by processInMessage delivers decrypted content and the events of signed elements to the application as they are read from the wire. The digest of a signed part is only compared when the corresponding END element is reached, and message-level verdicts (for example the WS-SecurityPolicy decision at the operation event) also complete only as the stream is consumed. This is inherent to streaming XML security. Applications MUST therefore treat all message content as unverified until the returned stream has been consumed to completion without a security exception: buffer-then-dispatch (as, for example, Apache CXF does), and never commit side effects (database writes, outbound calls, acknowledgements) incrementally while the stream is still being read.

Field Summary

Fields

Modifier and Type	Field	Description
protected static final org.slf4j.Logger	LOG

Constructor Summary

Constructors

Constructor	Description
InboundWSSec(WSSSecurityProperties securityProperties)
InboundWSSec(WSSSecurityProperties securityProperties, boolean initiator, boolean returnSecurityError)

Method Summary

Modifier and Type	Method	Description
XMLStreamReader	processInMessage(XMLStreamReader xmlStreamReader)	Warning: configure your xmlStreamReader correctly.
XMLStreamReader	processInMessage(XMLStreamReader xmlStreamReader, List<org.apache.xml.security.stax.securityEvent.SecurityEvent> requestSecurityEvents)	Warning: configure your xmlStreamReader correctly.
XMLStreamReader	processInMessage(XMLStreamReader xmlStreamReader, List<org.apache.xml.security.stax.securityEvent.SecurityEvent> requestSecurityEvents, List<org.apache.xml.security.stax.securityEvent.SecurityEventListener> securityEventListeners)	Warning: configure your xmlStreamReader correctly.
XMLStreamReader	processInMessage(XMLStreamReader xmlStreamReader, List<org.apache.xml.security.stax.securityEvent.SecurityEvent> requestSecurityEvents, org.apache.xml.security.stax.securityEvent.SecurityEventListener securityEventListener)	Warning: configure your xmlStreamReader correctly.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

protected static final transient org.slf4j.Logger LOG

Constructor Details

InboundWSSec

public InboundWSSec(WSSSecurityProperties securityProperties)

InboundWSSec

public InboundWSSec(WSSSecurityProperties securityProperties,
 boolean initiator,
 boolean returnSecurityError)

Method Details

processInMessage

public XMLStreamReader processInMessage(XMLStreamReader xmlStreamReader)
                                 throws XMLStreamException,
org.apache.wss4j.common.ext.WSSecurityException

Warning: configure your xmlStreamReader correctly. Otherwise you can create a security hole. At minimum configure the following properties: xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));

This method is the entry point for the incoming security-engine. Hand over the original XMLStreamReader and use the returned one for further processing

Parameters:

xmlStreamReader - The original XMLStreamReader

Returns:

A new XMLStreamReader which does transparently the security processing.

Throws:

XMLStreamException - thrown when a streaming error occurs

org.apache.wss4j.common.ext.WSSecurityException

processInMessage

public XMLStreamReader processInMessage(XMLStreamReader xmlStreamReader,
 List<org.apache.xml.security.stax.securityEvent.SecurityEvent> requestSecurityEvents)
                                 throws XMLStreamException,
org.apache.wss4j.common.ext.WSSecurityException

Warning: configure your xmlStreamReader correctly. Otherwise you can create a security hole. At minimum configure the following properties: xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));

This method is the entry point for the incoming security-engine. Hand over the original XMLStreamReader and use the returned one for further processing

Parameters:

xmlStreamReader - The original XMLStreamReader

Returns:

A new XMLStreamReader which does transparently the security processing.

Throws:

XMLStreamException - thrown when a streaming error occurs

org.apache.wss4j.common.ext.WSSecurityException

processInMessage

public XMLStreamReader processInMessage(XMLStreamReader xmlStreamReader,
 List<org.apache.xml.security.stax.securityEvent.SecurityEvent> requestSecurityEvents,
 org.apache.xml.security.stax.securityEvent.SecurityEventListener securityEventListener)
                                 throws XMLStreamException,
org.apache.wss4j.common.ext.WSSecurityException

Warning: configure your xmlStreamReader correctly. Otherwise you can create a security hole. At minimum configure the following properties: xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));

This method is the entry point for the incoming security-engine. Hand over the original XMLStreamReader and use the returned one for further processing

Parameters:

xmlStreamReader - The original XMLStreamReader

securityEventListener - A SecurityEventListener to receive security-relevant events.

Returns:

A new XMLStreamReader which does transparently the security processing.

Throws:

XMLStreamException - thrown when a streaming error occurs

org.apache.wss4j.common.ext.WSSecurityException

processInMessage

public XMLStreamReader processInMessage(XMLStreamReader xmlStreamReader,
 List<org.apache.xml.security.stax.securityEvent.SecurityEvent> requestSecurityEvents,
 List<org.apache.xml.security.stax.securityEvent.SecurityEventListener> securityEventListeners)
                                 throws XMLStreamException,
org.apache.wss4j.common.ext.WSSecurityException

Warning: configure your xmlStreamReader correctly. Otherwise you can create a security hole. At minimum configure the following properties: xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(8192));

This method is the entry point for the incoming security-engine. Hand over the original XMLStreamReader and use the returned one for further processing

Parameters:

xmlStreamReader - The original XMLStreamReader

securityEventListeners - A list of SecurityEventListeners to receive security-relevant events.

Returns:

A new XMLStreamReader which does transparently the security processing. Note that content read from it is only fully verified once the stream has been consumed to completion without a security exception - do not commit side effects based on partially-read content (see the class-level security note).

Throws:

XMLStreamException - thrown when a streaming error occurs

org.apache.wss4j.common.ext.WSSecurityException