Last year I wrote a series of blog posts (starting here) documenting the Security Token Service (STS) implementation included as part of Apache CXF 2.5.0. Apache CXF 2.5.1 was released a few weeks ago, and includes a number of bug fixes and improvements to the STS. In this post I'll document the more important changes.
1) Support to configure keystores per SAML realm
In CXF 2.5.0 it was possible to sign an issued SAML Token using a
different private key per realm, by setting the "signatureAlias"
property of the SAMLRealm class. However, the signature alias is used with a single KeyStore, which is shared across all realms. This problem has been fixed in CXF 2.5.1, where it is now possible to also configure a keystore to use per-realm.
2) Support to handle claims per realm
In CXF 2.5.1 support has been added to handle claims per-realm. The ClaimsHandler
interface has been updated to so that the current realm and
WebServiceContext object are available when retrieving claim values.
This means that any custom ClaimsHandler implementation based on CXF
2.5.0 must be updated to reflect the changed method signature.
3) Support validating a token per realm
In CXF 2.5.0 the current realm is ignored when validating a token. In CXF 2.5.1, support has been added
to include the current realm when querying a TokenValidator
implementation to see if it can "handle" a given token. In addition, all
TokenValidator implementations that ship with the STS return a
Principal as part of the TokenValidatorResponse object, regardless of
whether validation was successful or not.
4) OnBehalfOf Token Validation
In CXF 2.5.0 the responsibility for validating "OnBehalfOf" tokens was delegated to the TokenProvider implementation. In CXF
2.5.1, OnBehalfOf Token Validation has been moved
to the TokenIssueOperation, and so OnBehalfOf Tokens are validated for
all subsequent TokenProviders. This validation is achieved by querying a
list of TokenValidator implementations to see if any can validate the
received token. If validation is successful, then the state of the
ReceivedToken (VALID, INVALID, NONE) is
updated to reflect this. If no TokenValidator implementation exists
that can validate the OnBehalfOf token, then the token has a state set
to INVALID. Identity Mapping also now applies to the (VALID) OnBehalfOf
5) Support for OnBehalfOf in the SAMLTokenProvider
In CXF 2.5.0, the SAMLTokenProvider can issue a SAML token based
on the authenticated principal associated with the request, e.g. the
principal associated with the security token in the WS-Security header.
It does not support the scenario that a client is requesting a SAML
token "OnBehalfOf" another SAML Token, in other words that the principal
name associated with the "OnBehalfOf" token is used as the subject name
of the issued SAML token. This functionality has been added in CXF 2.5.1.
6) Validate SAML Conditions against the current time
Support has been added to validate the Conditions of a received SAML Token against the current time.