Package org.mule.soap.api.security

Class WssDecryptSecurityStrategy

java.lang.Object
org.mule.soap.api.security.WssDecryptSecurityStrategy
All Implemented Interfaces:
SecurityStrategy
public class WssDecryptSecurityStrategy extends Object implements SecurityStrategy
Decrypts an encrypted SOAP response, using the private key of the key-store in the provided TLS context.

FIPS mode is determined exclusively from mule.security.model (if it starts with fips140-). When FIPS is detected, this class sets fips.enabled=true so that WSS4J (WSS-711) and other components see the same mode. In FIPS mode, RSA 1.5 key transport is not allowed by default (only RSA-OAEP); this can be overridden by setting the system property mule.soap.security.allowRsa15InFips=true for legacy interoperability (not recommended).

Since:
1.0

  • Field Details

    • ALLOW_RSA15_IN_FIPS_PROPERTY

      public static final String ALLOW_RSA15_IN_FIPS_PROPERTY
      System property to allow RSA 1.5 key transport even in FIPS mode. This is not FIPS 140-3 compliant and should only be used for legacy interoperability during migration. The underlying crypto provider may still reject the algorithm.
      See Also:

  • Constructor Details

    • WssDecryptSecurityStrategy

      public WssDecryptSecurityStrategy(WssKeyStoreConfiguration keyStoreConfiguration)
      Creates a decrypt strategy. RSA 1.5 key transport is allowed or not according to FIPS mode, which is determined exclusively from mule.security.model (prefix fips140-). In FIPS mode, RSA 1.5 is disabled by default but can be forced via ALLOW_RSA15_IN_FIPS_PROPERTY.

  • Method Details

    • resetFIPSModeCache

      public static void resetFIPSModeCache()
      Clears the cached FIPS mode so that the next construction of a WssDecryptSecurityStrategy will re-read mule.security.model. Primarily for tests that need to simulate different environments (FIPS vs non-FIPS) in the same JVM.

    • isFIPSMode

      public static boolean isFIPSMode()
      Determines if the runtime is in FIPS mode. Uses mule.security.model as the single source of truth (values starting with fips140-). When FIPS is detected, also sets fips.enabled=true so WSS4J (WSS-711) and other libraries see the same mode. The fips.enabled property alone is not considered a valid source of truth for FIPS mode detection. Result is cached. No reflection; safe with any WSS4J version.
      Returns:
      true if FIPS mode is enabled, false otherwise

    • securityType

      public SecurityStrategy.SecurityStrategyType securityType()
      Description copied from interface: SecurityStrategy
      Returns the type of the security strategy, if applies for the request or the response.
      Specified by:
      securityType in interface SecurityStrategy
      Returns:
      whether is the security strategy applies for the request or the response.

    • securityAction

      public String securityAction()
      Description copied from interface: SecurityStrategy
      Returns the security action name that is going to be executed in the request phase (OUT interceptors).
      Specified by:
      securityAction in interface SecurityStrategy
      Returns:
      the request action name of this security strategy.

    • buildPasswordCallbackHandler

      public Optional<WSPasswordCallbackHandler> buildPasswordCallbackHandler()
      Description copied from interface: SecurityStrategy
      Gives the option to return a custom WSPasswordCallbackHandler instance allowing to compose many password handlers from different security strategies.
      Specified by:
      buildPasswordCallbackHandler in interface SecurityStrategy
      Returns:
      an optional WSPasswordCallbackHandler to be added to the composite callback handler.

    • buildSecurityProperties

      public Map<String,Object> buildSecurityProperties()
      Description copied from interface: SecurityStrategy
      Returns a set of properties to be set on the SOAP request interceptors (OUT interceptors) in order to applies this security strategy.
      Specified by:
      buildSecurityProperties in interface SecurityStrategy
      Returns:
      a Map with the properties required to apply the security strategy.