multiple SAML tokens are not supported in security

[glassfishrobot]

when i add 2 SAML tokens in the security header :

• one as InitiatorToken (holder-of-key)
• second one as SignedSupportingToken (sender-vouch)

I see NPE on server, while creating a response. This is because, saml token(holder-of-key) will be used for encryption on server, so key from the saml token(holder-of-key) will be extracted. But in this particular case, saml token(sender-vouch) is getting processed instead of Holder-of-key. Hence, results to NPE.

STACK TRACE :

SEC2003: Container-auth: wss: Error securing response java.lang.NullPointerException at com.sun.xml.wss.impl.misc.PublicKeyCertSelector.match(PublicKeyCertSelector.java:34) at sun.security.provider.certpath.CollectionCertStore.engineGetCertificates(CollectionCertStore.java:113) at java.security.cert.CertStore.getCertificates(CertStore.java:125) at com.sun.xml.wss.impl.misc.WSITProviderSecurityEnvironment.getCertificate(WSITProviderSecurityEnvironment.java:1593) at com.sun.xml.ws.security.opt.impl.keyinfo.SamlTokenBuilder.process(SamlTokenBuilder.java:117) at com.sun.xml.ws.security.opt.impl.enc.TokenProcessor.process(TokenProcessor.java:210) at com.sun.xml.ws.security.opt.impl.enc.EncryptionProcessor.process(EncryptionProcessor.java:150) at com.sun.xml.wss.impl.filter.EncryptionFilter.encrypt(EncryptionFilter.java:367) at com.sun.xml.wss.impl.filter.EncryptionFilter.process(EncryptionFilter.java:328) at com.sun.xml.wss.impl.HarnessUtil.processWSSPolicy(HarnessUtil.java:81) at com.sun.xml.wss.impl.HarnessUtil.processDeep(HarnessUtil.java:249) at com.sun.xml.wss.impl.SecurityAnnotator.processMessagePolicy(SecurityAnnotator.java:172) at com.sun.xml.wss.impl.SecurityAnnotator.secureMessage(SecurityAnnotator.java:133) at com.sun.xml.wss.provider.wsit.WSITAuthContextBase.secureOutboundMessage(WSITAuthContextBase.java:1431) at com.sun.xml.wss.provider.wsit.WSITServerAuthContext.secureResponse(WSITServerAuthContext.java:396) at com.sun.xml.wss.provider.wsit.WSITServerAuthContext.secureResponse(WSITServerAuthContext.java:215) at com.sun.enterprise.webservice.CommonServerSecurityPipe.processResponse(CommonServerSecurityPipe.java:289) at com.sun.enterprise.webservice.CommonServerSecurityPipe.processRequest(CommonServerSecurityPipe.java:265) at com.sun.enterprise.webservice.CommonServerSecurityPipe.process(CommonServerSecurityPipe.java:129) at com.sun.xml.ws.api.pipe.helper.PipeAdapter.processRequest(PipeAdapter.java:115)

Environment

Operating System: All Platform: All

Affected Versions

[current]

[glassfishrobot]

Reported by shyam_rao@java.net

[glassfishrobot]

shyam_rao@java.net said: adding keyword as91-na

[glassfishrobot]

shyam_rao@java.net said: One more issue related to multiple SAML token in a message : "Symmetric Binding with SignedSupportingToken covering two SAML assertions"

In this case, only one saml token is getting added in security header. Though sample is working. I have added the same SamlToken assersion two times under the same SignedSupportingToken assertion. <sp:SamlToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">

I feel, these two similar tokens are getting merged into one. One more thing i observed : when i put different elements under two SamlToken policies (say WssSamlV11Token10 & WssSamlV11Token11) OR two different SignedSupportingToken assertions(each cover one saml token with same element WssSamlV11Token10). Then, i see "Could not find Reference #b4ef2108-3aa2-42f1-986d-85b90b1bf596 under Signature with ID1" on server. Server Side Stack Trace : ========================= Caused by: javax.xml.ws.WebServiceException: Could not find Reference #b4ef2108-3aa2-42f1-986d-85b90b1bf596 under Signature with ID1 at com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.handleSignature(SecurityRecipient.java:1064) at com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.processSecurityHeader(SecurityRecipient.java:959) at com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.createMessage(SecurityRecipient.java:658) at com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.validateMessage(SecurityRecipient.java:212) With this fix, user can send more than one SAML token(sender-vouches) in the message provided each SamlToken specified in a different SignedSupportingToken assertion.

[glassfishrobot]

kumarjayanti@java.net said: Made a Partial Fix which will remove the current NPE.

[glassfishrobot]

kumarjayanti@java.net said: Milestone 1.2

[glassfishrobot]

mmatula@java.net said: Setting target milestone to force a new evaluation as this issue was targeted for one of the past releases.

[glassfishrobot]

This issue was imported from java.net JIRA WSIT-633