org.mule.soap.api.security

Class WssDecryptSecurityStrategy

java.lang.Object

org.mule.soap.api.security.WssDecryptSecurityStrategy

All Implemented Interfaces:

SecurityStrategy

public class WssDecryptSecurityStrategy
extends Object
implements SecurityStrategy

Decrypts an encrypted SOAP response, using the private key of the key-store in the provided TLS context.

FIPS mode is determined exclusively from mule.security.model (if it starts with fips140-). When FIPS is detected, this class sets fips.enabled=true so that WSS4J (WSS-711) and other components see the same mode. In FIPS mode, RSA 1.5 key transport is not allowed by default (only RSA-OAEP); this can be overridden by setting the system property mule.soap.security.allowRsa15InFips=true for legacy interoperability (not recommended).

Since:

1.0

Nested Class Summary

Nested classes/interfaces inherited from interface org.mule.soap.api.security.SecurityStrategy

SecurityStrategy.SecurityStrategyType

Field Summary

Fields

Modifier and Type	Field and Description
static String	ALLOW_RSA15_IN_FIPS_PROPERTY System property to allow RSA 1.5 key transport even in FIPS mode.

Constructor Summary

Constructors

Constructor and Description
WssDecryptSecurityStrategy(WssKeyStoreConfiguration keyStoreConfiguration) Creates a decrypt strategy.

Method Summary

Modifier and Type	Method and Description
Optional<WSPasswordCallbackHandler>	buildPasswordCallbackHandler() Gives the option to return a custom WSPasswordCallbackHandler instance allowing to compose many password handlers from different security strategies.
Map<String,Object>	buildSecurityProperties() Returns a set of properties to be set on the SOAP request interceptors (OUT interceptors) in order to applies this security strategy.
static boolean	isFIPSMode() Determines if the runtime is in FIPS mode.
static void	resetFIPSModeCache() Clears the cached FIPS mode so that the next construction of a WssDecryptSecurityStrategy will re-read mule.security.model.
String	securityAction() Returns the security action name that is going to be executed in the request phase (OUT interceptors).
SecurityStrategy.SecurityStrategyType	securityType() Returns the type of the security strategy, if applies for the request or the response.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ALLOW_RSA15_IN_FIPS_PROPERTY

public static final String ALLOW_RSA15_IN_FIPS_PROPERTY

System property to allow RSA 1.5 key transport even in FIPS mode. This is not FIPS 140-3 compliant and should only be used for legacy interoperability during migration. The underlying crypto provider may still reject the algorithm.

See Also:

Constant Field Values

Constructor Detail

WssDecryptSecurityStrategy

public WssDecryptSecurityStrategy(WssKeyStoreConfiguration keyStoreConfiguration)

Creates a decrypt strategy. RSA 1.5 key transport is allowed or not according to FIPS mode, which is determined exclusively from mule.security.model (prefix fips140-). In FIPS mode, RSA 1.5 is disabled by default but can be forced via ALLOW_RSA15_IN_FIPS_PROPERTY.

Method Detail

resetFIPSModeCache

public static void resetFIPSModeCache()

Clears the cached FIPS mode so that the next construction of a WssDecryptSecurityStrategy will re-read mule.security.model. Primarily for tests that need to simulate different environments (FIPS vs non-FIPS) in the same JVM.

isFIPSMode

public static boolean isFIPSMode()

Determines if the runtime is in FIPS mode. Uses mule.security.model as the single source of truth (values starting with fips140-). When FIPS is detected, also sets fips.enabled=true so WSS4J (WSS-711) and other libraries see the same mode. The fips.enabled property alone is not considered a valid source of truth for FIPS mode detection. Result is cached. No reflection; safe with any WSS4J version.

Returns:

true if FIPS mode is enabled, false otherwise

securityType

public SecurityStrategy.SecurityStrategyType securityType()

Description copied from interface: SecurityStrategy

Returns the type of the security strategy, if applies for the request or the response.

Specified by:

securityType in interface SecurityStrategy

Returns:

whether is the security strategy applies for the request or the response.

securityAction

public String securityAction()

Description copied from interface: SecurityStrategy

Returns the security action name that is going to be executed in the request phase (OUT interceptors).

Specified by:

securityAction in interface SecurityStrategy

Returns:

the request action name of this security strategy.

buildPasswordCallbackHandler

public Optional<WSPasswordCallbackHandler> buildPasswordCallbackHandler()

Description copied from interface: SecurityStrategy

Gives the option to return a custom WSPasswordCallbackHandler instance allowing to compose many password handlers from different security strategies.

Specified by:

buildPasswordCallbackHandler in interface SecurityStrategy

Returns:

an optional WSPasswordCallbackHandler to be added to the composite callback handler.

buildSecurityProperties

public Map<String,Object> buildSecurityProperties()

Description copied from interface: SecurityStrategy

Returns a set of properties to be set on the SOAP request interceptors (OUT interceptors) in order to applies this security strategy.

Specified by:

buildSecurityProperties in interface SecurityStrategy

Returns:

a Map with the properties required to apply the security strategy.