TokenWrapper wrapper,
SecurityToken securityTok) throws Exception {
Document doc = saaj.getSOAPPart();
//Get the issued token
SecurityToken secTok = securityTok;
if (secTok == null) {
secTok = getSecurityToken();
}
SPConstants.IncludeTokenType inclusion = token.getInclusion();
boolean tokenIncluded = false;
Vector<WSEncryptionPart> sigParts = new Vector<WSEncryptionPart>();
if (inclusion == SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS
|| ((inclusion == SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT
|| inclusion == SPConstants.IncludeTokenType.INCLUDE_TOKEN_ONCE)
&& isRequestor())) {
//Add the token
Element el = cloneElement(secTok.getToken());
if (securityTok != null) {
//do we need to sign this as well?
//String id = addWsuIdToElement(el);
//sigParts.add(new WSEncryptionPart(id));
}
addEncyptedKeyElement(el);
tokenIncluded = true;
}
if (timestampEl != null) {
sigParts.add(new WSEncryptionPart(timestampEl.getId()));
}
if (signdParts != null) {
if (signdParts.isBody()) {
sigParts.add(new WSEncryptionPart(addWsuIdToElement(saaj.getSOAPBody())));
}
if (secTok.getX509Certificate() != null
|| securityTok != null) {
//the "getX509Certificate" this is to workaround an issue in WCF
//In WCF, for TransportBinding, in most cases, it doesn't wan't any of
//the headers signed even if the policy sais so. HOWEVER, for KeyValue
//IssuedTokends, it DOES want them signed
for (Header header : signdParts.getHeaders()) {
WSEncryptionPart wep = new WSEncryptionPart(header.getName(),
header.getNamespace(),
"Content");
sigParts.add(wep);
}
}
}
//check for derived keys
AlgorithmSuite algorithmSuite = tbinding.getAlgorithmSuite();
if (token.isDerivedKeys()) {
//Do Signature with derived keys
WSSecDKSign dkSign = new WSSecDKSign();
//Setting the AttachedReference or the UnattachedReference according to the flag
Element ref;
if (tokenIncluded) {
ref = secTok.getAttachedReference();
} else {
ref = secTok.getUnattachedReference();
}
if (ref != null) {
dkSign.setExternalKey(secTok.getSecret(), cloneElement(ref));
} else {
dkSign.setExternalKey(secTok.getSecret(), secTok.getId());
}
// Set the algo info
dkSign.setSignatureAlgorithm(algorithmSuite.getSymmetricSignature());
dkSign.setDerivedKeyLength(algorithmSuite.getSignatureDerivedKeyLength() / 8);
if (token.getSPConstants() == SP12Constants.INSTANCE) {
dkSign.setWscVersion(ConversationConstants.VERSION_05_12);
}
dkSign.prepare(doc, secHeader);
addDerivedKeyElement(dkSign.getdktElement());
dkSign.setParts(sigParts);
dkSign.addReferencesToSign(sigParts, secHeader);
//Do signature
dkSign.computeSignature();
dkSign.appendSigToHeader(secHeader);
return dkSign.getSignatureValue();
} else {
WSSecSignature sig = new WSSecSignature();
if (secTok.getTokenType() == null) {
sig.setCustomTokenId(secTok.getId());
sig.setCustomTokenValueType(WSConstants.WSS_SAML_KI_VALUE_TYPE);
sig.setKeyIdentifierType(WSConstants.CUSTOM_KEY_IDENTIFIER);
} else {
String id = secTok.getWsuId();
if (id == null) {
sig.setCustomTokenId(secTok.getId());
sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING_DIRECT);
} else {
sig.setCustomTokenId(secTok.getWsuId());
sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
}
String tokenType = secTok.getTokenType();
if (WSS_SAML_TOKEN_TYPE.equals(tokenType)) {
sig.setCustomTokenValueType(WSConstants.WSS_SAML_KI_VALUE_TYPE);
} else if (WSS_SAML2_TOKEN_TYPE.equals(tokenType)) {
sig.setCustomTokenValueType(WSS_SAML2_KI_VALUE_TYPE);
} else {
sig.setCustomTokenValueType(tokenType);
}
sig.setKeyIdentifierType(WSConstants.CUSTOM_SYMM_SIGNING);
}
Crypto crypto = null;
if (secTok.getSecret() == null) {
sig.setX509Certificate(secTok.getX509Certificate());
crypto = secTok.getCrypto();
String uname = crypto.getKeyStore().getCertificateAlias(secTok.getX509Certificate());
String password = getPassword(uname, token, WSPasswordCallback.SIGNATURE);
if (password == null) {
password = "";
}
sig.setUserInfo(uname, password);
sig.setSignatureAlgorithm(binding.getAlgorithmSuite().getAsymmetricSignature());
} else {
crypto = getSignatureCrypto(wrapper);
sig.setSecretKey(secTok.getSecret());
sig.setSignatureAlgorithm(binding.getAlgorithmSuite().getSymmetricSignature());
}
sig.setSigCanonicalization(binding.getAlgorithmSuite().getInclusiveC14n());
sig.prepare(doc, crypto, secHeader);