}
Element kiElem =
WSSecurityUtil.getDirectChildElement(elem, "KeyInfo", WSConstants.SIG_NS);
// KeyInfo cannot be null
if (kiElem == null) {
throw new WSSecurityException(
WSSecurityException.UNSUPPORTED_ALGORITHM, "noKeyinfo"
);
}
String symEncAlgo = X509Util.getEncAlgo(elem);
// Check BSP compliance
if (request.getWssConfig().isWsiBSPCompliant()) {
checkBSPCompliance(symEncAlgo);
}
// Get the Key either via a SecurityTokenReference or an EncryptedKey
Element secRefToken =
WSSecurityUtil.getDirectChildElement(
kiElem, "SecurityTokenReference", WSConstants.WSSE_NS
);
Element encryptedKeyElement =
WSSecurityUtil.getDirectChildElement(
kiElem, WSConstants.ENC_KEY_LN, WSConstants.ENC_NS
);
if (elem != null && request.isRequireSignedEncryptedDataElements()) {
WSSecurityUtil.verifySignedElement(elem, elem.getOwnerDocument(), wsDocInfo.getSecurityHeader());
}
SecretKey key = null;
List<WSSecurityEngineResult> encrKeyResults = null;
Principal principal = null;
if (secRefToken != null) {
STRParser strParser = new SecurityTokenRefSTRParser();
Map<String, Object> parameters = new HashMap<String, Object>();
parameters.put(SecurityTokenRefSTRParser.SIGNATURE_METHOD, symEncAlgo);
strParser.parseSecurityTokenReference(
secRefToken, request,
wsDocInfo, parameters
);
byte[] secretKey = strParser.getSecretKey();
principal = strParser.getPrincipal();
key = WSSecurityUtil.prepareSecretKey(symEncAlgo, secretKey);
} else if (encryptedKeyElement != null) {
EncryptedKeyProcessor encrKeyProc = new EncryptedKeyProcessor();
encrKeyResults = encrKeyProc.handleToken(encryptedKeyElement, request, wsDocInfo);
byte[] symmKey =
(byte[])encrKeyResults.get(0).get(WSSecurityEngineResult.TAG_SECRET);
key = WSSecurityUtil.prepareSecretKey(symEncAlgo, symmKey);
} else {
throw new WSSecurityException(
WSSecurityException.UNSUPPORTED_ALGORITHM, "noEncKey"
);
}
// Check for compliance against the defined AlgorithmSuite
AlgorithmSuite algorithmSuite = request.getAlgorithmSuite();
if (algorithmSuite != null) {
AlgorithmSuiteValidator algorithmSuiteValidator = new
AlgorithmSuiteValidator(algorithmSuite);
if (principal instanceof WSDerivedKeyTokenPrincipal) {
algorithmSuiteValidator.checkDerivedKeyAlgorithm(
((WSDerivedKeyTokenPrincipal)principal).getAlgorithm()
);
algorithmSuiteValidator.checkEncryptionDerivedKeyLength(
((WSDerivedKeyTokenPrincipal)principal).getLength()
);
}
algorithmSuiteValidator.checkSymmetricKeyLength(key.getEncoded().length);
algorithmSuiteValidator.checkSymmetricEncryptionAlgorithm(symEncAlgo);
}
// initialize Cipher ....
XMLCipher xmlCipher = null;
try {
xmlCipher = XMLCipher.getInstance(symEncAlgo);
xmlCipher.setSecureValidation(true);
xmlCipher.init(XMLCipher.DECRYPT_MODE, key);
} catch (XMLEncryptionException ex) {
throw new WSSecurityException(
WSSecurityException.UNSUPPORTED_ALGORITHM, null, null, ex
);
}
Node previousSibling = elem.getPreviousSibling();
Node parent = elem.getParentNode();
try {
xmlCipher.doFinal(elem.getOwnerDocument(), elem, false);
} catch (Exception e) {
throw new WSSecurityException(
WSSecurityException.FAILED_CHECK, null, null, e
);
}
WSDataRef dataRef = new WSDataRef();