org.wso2.carbon.security.SecurityConfigException Java Examples

/**
 * This will return the policy path which is taken from registry. ie the original policy. It will be retrieved
 * from the policy which is attached to the service
 * @param serviceName name of the service.
 * @return Registry path to policy.
 */
private String getPolicyRegistryPath(String serviceName) {
    AxisService service = axisConfig.getServiceForActivation(serviceName);
    // Define an empty string. This will only get executed when a policy is picked from registry. Having an empty
    // string will avoid issues if something went wrong while adding policy path to carbonSecConfig
    String policyPath = "";
    try {
        OMElement carbonSecConfig = getCarbonSecConfigs(getCurrentPolicy(service));
        OMElement policyPathElement = carbonSecConfig.getFirstChildWithName(new QName(SecurityConstants
                .SECURITY_NAMESPACE, POLICY_PATH));
        if (policyPathElement != null) {
            policyPath = policyPathElement.getText();
        }
    } catch (SecurityConfigException e) {
        log.error("Error while retrieving current policy from service", e);
    }
    return policyPath;
}
 

public static InboundAuthenticationRequestConfig createWsTrustInbound(WSTrustConfiguration wsTrustConfiguration) {

        try {
            // Check if WS-Trust is deployed.
            if (ApplicationManagementServiceHolder.getInstance().getStsAdminService() != null) {
                ApplicationManagementServiceHolder.getInstance().getStsAdminService()
                        .addTrustedService(wsTrustConfiguration.getAudience(),
                                wsTrustConfiguration.getCertificateAlias());

                InboundAuthenticationRequestConfig wsTrustInbound = new InboundAuthenticationRequestConfig();
                wsTrustInbound.setInboundAuthType(WS_TRUST);
                wsTrustInbound.setInboundAuthKey(wsTrustConfiguration.getAudience());
                return wsTrustInbound;
            } else {
                // Throw 401 error since the WS-Trust connector is not available.
                throw buildBadRequestError(ERROR_DESCRIPTION);
            }

        } catch (SecurityConfigException e) {
            // Error while adding WS Trust, we can't continue.
            throw buildServerError("Error while adding WSTrust configuration. " + e.getMessage(), e);
        }
    }
 

/**
 * Pull WS Trust metadata from STSAdminServiceInterface and return.
 *
 * @return Populated WSTrustMetadata object.
 */
public WSTrustMetaData getWSTrustMetadata() {

    WSTrustMetaData wsTrustMetaData = new WSTrustMetaData();
    try {
        // Check if WS-Trust is deployed.
        if (ApplicationManagementServiceHolder.getInstance().getStsAdminService() != null) {
            wsTrustMetaData.setCertificateAlias(new MetadataProperty()
                    .defaultValue(null)
                    .options(Arrays.asList(ApplicationManagementServiceHolder.getInstance().getStsAdminService()
                            .getCertAliasOfPrimaryKeyStore())));
        } else {
            throw new SecurityConfigException(ERROR_WS_TRUST_METADATA_SERVICE_NOT_FOUND.getDescription());
        }
    } catch (SecurityConfigException e) {
        if (e.getMessage().equals(ERROR_WS_TRUST_METADATA_SERVICE_NOT_FOUND.getDescription())) {
            // Throw 404 error since the WS-Trust connector is not available.
            throw handleNotFoundError(e);
        } else {
            throw handleException(e);
        }
    }
    return wsTrustMetaData;
}
 

public static void deleteWSTrustConfiguration(InboundAuthenticationRequestConfig inbound) {

        try {
            String trustedServiceAudience = inbound.getInboundAuthKey();

            // Check if WS-Trust is deployed.
            if (ApplicationManagementServiceHolder.getInstance().getStsAdminService() != null) {
                ApplicationManagementServiceHolder.getInstance().getStsAdminService()
                        .removeTrustedService(trustedServiceAudience);
            } else {
                // Throw 404 error since the WS-Trust connector is not available.
                throw buildNotFoundError(ERROR_CODE, ERROR_MESSAGE, ERROR_DESCRIPTION);
            }

        } catch (SecurityConfigException e) {
            throw buildServerError("Error while trying to rollback WSTrust configuration. " + e.getMessage(), e);
        }
    }
 

public static InboundAuthenticationRequestConfig putWSTrustConfiguration(ServiceProvider application,
                                                                         WSTrustConfiguration wsTrustModel) {

    String inboundAuthKey = InboundFunctions.getInboundAuthKey(application, WS_TRUST);
    try {
        if (inboundAuthKey != null) {
            if (wsTrustAudienceChanged(wsTrustModel, inboundAuthKey)) {
                // We do not allow the inbound unique key to be changed during an update.
                throw buildBadRequestError("Invalid audience value provided for update.");
            }
            // Check if WS-Trust is deployed.
            if (ApplicationManagementServiceHolder.getInstance().getStsAdminService() != null) {
                ApplicationManagementServiceHolder.getInstance().getStsAdminService()
                        .removeTrustedService(inboundAuthKey);
            } else {
                // Throw 404 error since the WS-Trust connector is not available.
                throw buildNotFoundError(ERROR_CODE, ERROR_MESSAGE, ERROR_DESCRIPTION);
            }
        }

        return createWsTrustInbound(wsTrustModel);
    } catch (SecurityConfigException e) {
        String applicationId = application.getApplicationResourceId();
        throw buildServerError("Error while creating/updating WSTrust inbound of application: " + applicationId, e);
    }
}
 

public Key getPrivateKey(String alias, boolean isSuperTenant) throws SecurityConfigException {
    KeyStoreData[] keystores = getKeyStores(isSuperTenant);
    KeyStore keyStore = null;
    String privateKeyPassowrd = null;

    try {

        for (int i = 0; i < keystores.length; i++) {
            if (KeyStoreUtil.isPrimaryStore(keystores[i].getKeyStoreName())) {
                KeyStoreManager keyMan = KeyStoreManager.getInstance(tenantId);
                keyStore = keyMan.getPrimaryKeyStore();
                ServerConfiguration serverConfig = ServerConfiguration.getInstance();
                privateKeyPassowrd = serverConfig
                        .getFirstProperty(RegistryResources.SecurityManagement.SERVER_PRIVATE_KEY_PASSWORD);
                return keyStore.getKey(alias, privateKeyPassowrd.toCharArray());
            }
        }
    } catch (Exception e) {
        String msg = "Error has encounted while loading the key for the given alias " + alias;
        log.error(msg, e);
        throw new SecurityConfigException(msg);
    }
    return null;
}
 

@Override
public void setProofKeyType(String keyType) throws SecurityConfigException {
    try {
        AxisService service = getAxisConfig().getService(ServerConstants.STS_NAME);
        Parameter origParam = service.getParameter(SAMLTokenIssuerConfig.SAML_ISSUER_CONFIG
                .getLocalPart());
        if (origParam != null) {
            OMElement samlConfigElem = origParam.getParameterElement().getFirstChildWithName(
                    SAMLTokenIssuerConfig.SAML_ISSUER_CONFIG);
            SAMLTokenIssuerConfig samlConfig = new SAMLTokenIssuerConfig(samlConfigElem);
            samlConfig.setProofKeyType(keyType);
            setSTSParameter(samlConfig);
        } else {
            throw new AxisFault("missing parameter : "
                    + SAMLTokenIssuerConfig.SAML_ISSUER_CONFIG.getLocalPart());
        }

    } catch (Exception e) {
        log.error("Error setting proof key type", e);
        throw new SecurityConfigException(e.getMessage(), e);
    }
}
 

/**
 * This method will apply Kerberos security policy to a given service.
 *
 * @param serviceName              Name of the service that security policy is applied.
 * @param policyId                 The scenario id.
 * @param servicePrincipalName     Service principal name.
 * @param servicePrincipalPassword Service principal password.
 * @throws org.wso2.carbon.security.SecurityConfigException If unable to add kerberos attributes.
 */
public void applyKerberosSecurityPolicy(String serviceName, String policyId, String servicePrincipalName,
                                        String servicePrincipalPassword)
        throws SecurityConfigException {

    if (servicePrincipalName == null || StringUtils.equals("".trim(),servicePrincipalName)) {
        throw new SecurityConfigException("Please specify a valid service principal. " +
                "Service principal should not be null");
    }

    if (servicePrincipalPassword == null || StringUtils.equals("".trim(),servicePrincipalPassword)) {
        throw new SecurityConfigException("Please specify a valid service principal password. " +
                "Service principal password should not be null");
    }

    SecurityConfigAdmin admin = new SecurityConfigAdmin(getUserRealm(), getConfigSystemRegistry(), getAxisConfig());

    KerberosConfigData kerberosConfigurations = new KerberosConfigData();
    kerberosConfigurations.setServicePrincipleName(servicePrincipalName);
    kerberosConfigurations.setServicePrinciplePassword(servicePrincipalPassword);

    admin.applySecurity(serviceName, policyId, kerberosConfigurations);

}
 

public SecurityScenarioDataWrapper getScenarios(String serviceName) throws SecurityConfigException {
    Collection<SecurityScenario> scenarios = SecurityScenarioDatabase.getAllScenarios();
    SecurityScenarioData[] scenarioData = new SecurityScenarioData[scenarios.size()];
    int count = 0;
    for (SecurityScenario scenario : scenarios) {
        if (scenario.getGeneralPolicy()) {
            SecurityScenarioData data = new SecurityScenarioData();
            data.setCategory(scenario.getCategory());
            data.setCurrentScenario(scenario.getIsCurrentScenario());
            data.setDescription(scenario.getDescription());
            data.setScenarioId(scenario.getScenarioId());
            data.setSummary(scenario.getSummary());
            data.setType(scenario.getType());
            scenarioData[count++] = data;
        }
    }
    SecurityScenarioDataWrapper scenarioDataWrapper = new SecurityScenarioDataWrapper();
    scenarioDataWrapper.setScenarios(scenarioData);
    scenarioDataWrapper.setCurrentScenario(getCurrentScenario(serviceName));
    return scenarioDataWrapper;
}
 

protected boolean engageModules(String scenarioId, String serviceName, AxisService axisService)
        throws SecurityConfigException {

    boolean isRahasEngaged = false;
    SecurityScenario securityScenario = SecurityScenarioDatabase.get(scenarioId);
    String[] moduleNames = (String[]) securityScenario.getModules()
            .toArray(new String[securityScenario.getModules().size()]);
    // handle each module required
    try {

        for (String modName : moduleNames) {
            AxisModule module = axisService.getAxisConfiguration().getModule(modName);
            // engage at axis2
            axisService.disengageModule(module);
            axisService.engageModule(module);
            if (SecurityConstants.TRUST_MODULE.equalsIgnoreCase(modName)) {
                isRahasEngaged = true;
            }
        }
        return isRahasEngaged;

    } catch (AxisFault e) {
        log.error(e);
        throw new SecurityConfigException("Error in engaging modules", e);
    }
}
 

protected void disableRESTCalls(String serviceName, String scenrioId)
        throws SecurityConfigException {

    if (scenrioId.equals(SecurityConstants.USERNAME_TOKEN_SCENARIO_ID)) {
        return;
    }

    try {
        AxisService service = axisConfig.getServiceForActivation(serviceName);
        if (service == null) {
            throw new SecurityConfigException("nullService");
        }

        Parameter param = new Parameter();
        param.setName(DISABLE_REST);
        param.setValue(Boolean.TRUE.toString());
        service.addParameter(param);

    } catch (AxisFault e) {
        log.error(e);
        throw new SecurityConfigException("disablingREST", e);
    }
}
 

@Override
public String[] getStoreEntries(String keyStoreName) throws SecurityConfigException {
    KeyStoreAdmin admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
            getGovernanceSystemRegistry());
    return admin.getStoreEntries(keyStoreName);

}
 

private String getEncryptedPassword(String password) throws SecurityConfigException {

        CryptoUtil cryptoUtil = CryptoUtil.getDefaultCryptoUtil();
        try {
            return cryptoUtil.encryptAndBase64Encode(password.getBytes());
        } catch (CryptoException e) {
            String msg = "Unable to encrypt and encode password string.";
            log.error(msg, e);
            throw new SecurityConfigException(msg, e);
        }
    }
 

private KerberosConfigData readKerberosConfigurations(OMElement carbonSecConfig) throws SecurityConfigException {

        KerberosConfigData kerberosConfigData = null;
        if (carbonSecConfig != null) {
            if (log.isDebugEnabled()) {
                log.debug("Reading kerberos configurations from carbonSecConfig : " + carbonSecConfig.toString());
            }
            OMElement kerberosElement = carbonSecConfig.getFirstChildWithName(new QName(SecurityConstants
                    .SECURITY_NAMESPACE, SecurityConstants.KERBEROS));
            if (kerberosElement != null) {
                kerberosConfigData = new KerberosConfigData();
                Map<String, String> kerberosProperties = getProperties(kerberosElement);
                if (kerberosProperties.get(KerberosConfig.SERVICE_PRINCIPLE_NAME) != null) {
                    kerberosConfigData.setServicePrincipleName(kerberosProperties.get(KerberosConfig
                            .SERVICE_PRINCIPLE_NAME));
                }
                if (kerberosProperties.get(KerberosConfig.SERVICE_PRINCIPLE_PASSWORD) != null) {
                    String encryptedString = kerberosProperties.get(KerberosConfig.SERVICE_PRINCIPLE_PASSWORD);
                    CryptoUtil cryptoUtil = CryptoUtil.getDefaultCryptoUtil();
                    try {
                        kerberosConfigData.setServicePrinciplePassword
                                (new String(cryptoUtil.base64DecodeAndDecrypt(encryptedString)));
                    } catch (CryptoException e) {
                        String msg = "Unable to decode and decrypt password string.";
                        log.warn(msg, e);
                    }
                }
            }
        }

        return kerberosConfigData;
    }
 

@Override
public void deleteCertificate(String tenantDomain, String alias) throws KeyStoreManagementException {

    try {
        getKeyStoreAdmin(tenantDomain).removeCertFromStore(alias, getKeyStoreName(tenantDomain));
    } catch (SecurityConfigException e) {
        throw handleServerException(ERROR_CODE_DELETE_CERTIFICATE, alias, e);
    }
}
 

private String getKeyStoreName(String tenantDomain) throws KeyStoreManagementException {

        KeyStoreData[] keyStoreDataArray = new KeyStoreData[0];
        try {
            keyStoreDataArray = getKeyStoreAdmin(tenantDomain).getKeyStores(isSuperTenant(tenantDomain));
        } catch (SecurityConfigException e) {
            throw handleServerException(ERROR_CODE_RETRIEVE_KEYSTORE, tenantDomain, e);
        }

        for (KeyStoreData keyStoreData : keyStoreDataArray) {
            if (keyStoreData == null) {
                break;
            }
            String keyStoreName = keyStoreData.getKeyStoreName();
            if (isSuperTenant(tenantDomain)) {
                if (KeyStoreUtil.isPrimaryStore(keyStoreName)) {
                    return keyStoreName;
                }
            } else {
                String tenantKeyStoreName = tenantDomain.trim().replace(".", "-") + ".jks";
                if (StringUtils.equals(keyStoreName, tenantKeyStoreName)) {
                    return keyStoreName;
                }
            }
        }
        throw handleServerException(ERROR_CODE_RETRIEVE_KEYSTORE, tenantDomain);
    }
 

private KeyStoreData getKeystoreData(String tenantDomain, String keyStoreName) throws KeyStoreManagementException {

        KeyStoreAdmin keyStoreAdmin = getKeyStoreAdmin(tenantDomain);
        KeyStoreData keyStoreData = null;
        keyStoreAdmin.setIncludeCert(true);
        try {
            keyStoreData = keyStoreAdmin.getKeystoreInfo(keyStoreName);
        } catch (SecurityConfigException e) {
            throw handleServerException(ERROR_CODE_RETRIEVE_KEYSTORE_INFORMATION, keyStoreName, e);
        }
        return keyStoreData;
    }
 

public SecurityScenarioData getSecurityScenario(String sceneId) throws SecurityConfigException {
    SecurityScenarioData data = null;
    SecurityScenario scenario = SecurityScenarioDatabase.get(sceneId);
    if (scenario != null) {
        data = new SecurityScenarioData();
        data.setCategory(scenario.getCategory());
        data.setDescription(scenario.getDescription());
        data.setScenarioId(scenario.getScenarioId());
        data.setSummary(scenario.getSummary());
    }
    return data;
}
 

/**
 * Check the policy to see whether the service should only be exposed in
 * HTTPS
 *
 * @param policy service policy
 * @return returns true if the service should only be exposed in HTTPS
 * @throws org.wso2.carbon.security.SecurityConfigException ex
 */
public boolean isHttpsTransportOnly(Policy policy) throws SecurityConfigException {

    // When there is a transport binding sec policy assertion,
    // the service should be exposed only via HTTPS
    boolean httpsRequired = false;

    try {
        Iterator alternatives = policy.getAlternatives();
        if (alternatives.hasNext()) {
            List it = (List) alternatives.next();
            RampartPolicyData rampartPolicyData = RampartPolicyBuilder.build(it);
            if (rampartPolicyData.isTransportBinding()) {
                httpsRequired = true;
            } else if (rampartPolicyData.isSymmetricBinding()) {
                Token encrToken = rampartPolicyData.getEncryptionToken();
                if (encrToken instanceof SecureConversationToken) {
                    Policy bsPol = ((SecureConversationToken) encrToken).getBootstrapPolicy();
                    Iterator alts = bsPol.getAlternatives();
                    List bsIt = (List) alts.next();
                    RampartPolicyData bsRampartPolicyData = RampartPolicyBuilder.build(bsIt);
                    httpsRequired = bsRampartPolicyData.isTransportBinding();
                }
            }
        }
    } catch (WSSPolicyException e) {
        log.error("Error in checking http transport only", e);
        throw new SecurityConfigException("Error in checking http transport only", e);
    }
    return httpsRequired;
}
 

@Override
public void deleteStore(String keyStoreName) throws SecurityConfigException {
    KeyStoreAdmin admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
            getGovernanceSystemRegistry());
    admin.deleteStore(keyStoreName);

}
 

@Override
public TrustedServiceData[] getTrustedServices() throws SecurityConfigException {
    try {
        AxisService service = getAxisConfig().getService(ServerConstants.STS_NAME);
        Parameter origParam = service.getParameter(SAMLTokenIssuerConfig.SAML_ISSUER_CONFIG
                .getLocalPart());
        if (origParam != null) {
            OMElement samlConfigElem = origParam.getParameterElement().getFirstChildWithName(
                    SAMLTokenIssuerConfig.SAML_ISSUER_CONFIG);
            SAMLTokenIssuerConfig samlConfig = new SAMLTokenIssuerConfig(samlConfigElem);
            Map trustedServicesMap = samlConfig.getTrustedServices();
            Set addresses = trustedServicesMap.keySet();

            List serviceBag = new ArrayList();
            for (Iterator iterator = addresses.iterator(); iterator.hasNext(); ) {
                String address = (String) iterator.next();
                String alias = (String) trustedServicesMap.get(address);
                TrustedServiceData data = new TrustedServiceData(address, alias);
                serviceBag.add(data);
            }
            return (TrustedServiceData[]) serviceBag.toArray(new TrustedServiceData[serviceBag
                    .size()]);
        } else {
            throw new SecurityConfigException("missing parameter : "
                    + SAMLTokenIssuerConfig.SAML_ISSUER_CONFIG.getLocalPart());
        }
    } catch (Exception e) {
        log.error("Error while retrieving trusted services", e);
        throw new SecurityConfigException(e.getMessage(), e);
    }
}
 

/**
 * @param keyStoreName
 * @return
 * @throws IdentityException
 */
private String[] getStoreEntries(String keyStoreName) throws IdentityException {
    KeyStoreAdmin admin;
    try {
        admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
                getGovernanceRegistry());
        return admin.getStoreEntries(keyStoreName);
    } catch (SecurityConfigException e) {
        log.error("Error reading entries from the key store : " + keyStoreName);
        throw IdentityException.error("Error reading entries from the keystore" + e);
    }
}
 

public SecurityConfigAdmin(UserRealm realm, Registry registry, AxisConfiguration config) throws SecurityConfigException {
    this.axisConfig = config;
    this.registry = registry;
    this.realm = realm;

    try {
        this.govRegistry = SecurityServiceHolder.getRegistryService().getGovernanceSystemRegistry(
                ((UserRegistry) registry).getTenantId());
    } catch (Exception e) {
        log.error("Error when obtaining the governance registry instance.");
        throw new SecurityConfigException(
                "Error when obtaining the governance registry instance.", e);
    }
}
 

@Override
public String[] getCertAliasOfPrimaryKeyStore() throws SecurityConfigException {

    KeyStoreData[] keyStores = getKeyStores();
    int tenantId = CarbonContext.getThreadLocalCarbonContext().getTenantId();
    KeyStoreData primaryKeystore = null;
    for (KeyStoreData keyStore : keyStores) {
        if (keyStore != null) {
            if (tenantId == MultitenantConstants.SUPER_TENANT_ID) {
                if (KeyStoreUtil.isPrimaryStore(keyStore.getKeyStoreName())) {
                    primaryKeystore = keyStore;
                    break;
                }
            } else {
                if (keyStore.getPrivateStore()) {
                    primaryKeystore = keyStore;
                    break;
                }
            }
        }
    }

    if (primaryKeystore != null) {
        return getStoreEntries(primaryKeystore.getKeyStoreName());
    }

    throw new SecurityConfigException("Primary Keystore cannot be found.");
}
 

private KeyStoreData[] getKeyStores() throws SecurityConfigException {
    KeyStoreAdmin admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
            getGovernanceSystemRegistry());
    boolean isSuperTenant = CarbonContext.getThreadLocalCarbonContext().getTenantId() ==
            MultitenantConstants.SUPER_TENANT_ID;
    return admin.getKeyStores(isSuperTenant);
}
 

private String getScenarioId(MessageContext msgCtx, AxisService service) throws SecurityConfigException {
    String scenarioID = null;
    try {
        scenarioID = (String) service.getParameter(SecurityConstants.SCENARIO_ID_PARAM_NAME).getValue();
    } catch (Exception e) {
    }//ignore

    if (scenarioID == null) {
        synchronized (this) {
            SecurityConfigAdmin securityAdmin = new SecurityConfigAdmin(msgCtx.
                    getConfigurationContext().getAxisConfiguration());
            SecurityScenarioData data = securityAdmin.getCurrentScenario(service.getName());
            if (data != null) {
                scenarioID = data.getScenarioId();
                try {
                    Parameter param = new Parameter();
                    param.setName(SecurityConstants.SCENARIO_ID_PARAM_NAME);
                    param.setValue(scenarioID);
                    service.addParameter(param);
                } catch (AxisFault axisFault) {
                    log.error("Error while adding Scenario ID parameter", axisFault);
                }
            }
        }
    }

    return scenarioID;
}
 

@Override
public void addKeyStore(String fileData, String filename, String password, String provider,
                        String type, String pvtkeyPass) throws SecurityConfigException {
    KeyStoreAdmin admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
            getGovernanceSystemRegistry());
    admin.addKeyStore(fileData, filename, password, provider, type, pvtkeyPass);
}
 

public SecurityConfigAdmin(AxisConfiguration config) throws SecurityConfigException {
    this.axisConfig = config;

    try {
        this.registry = SecurityServiceHolder.getRegistryService().getConfigSystemRegistry();
        this.govRegistry = SecurityServiceHolder.getRegistryService().getGovernanceSystemRegistry();
    } catch (Exception e) {
        String msg = "Error when retrieving a registry instance";
        log.error(msg);
        throw new SecurityConfigException(msg, e);
    }
}
 

@Override
public KeyStoreData getKeystoreInfo(String keyStoreName) throws SecurityConfigException {
    KeyStoreAdmin admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
            getGovernanceSystemRegistry());
    return admin.getKeystoreInfo(keyStoreName);

}
 

@Override
public KeyStoreData getKeystoreInfo(String keyStoreName) throws SecurityConfigException {
    KeyStoreAdmin admin = new KeyStoreAdmin(CarbonContext.getThreadLocalCarbonContext().getTenantId(),
            getGovernanceSystemRegistry());
    return admin.getKeystoreInfo(keyStoreName);

}