[CXF-3928] Add token validation for OnBehalfOf element in TokenIssueOperation

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5
• Fix Version/s: 2.5.1
• Component/s: Services
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Oliver Wulff
• Created: 22/Nov/11 09:07
• Updated: 19/Dec/11 16:15
• Resolved: 29/Nov/11 17:04

Description

Tokens passed in OnBehalfOf element are not validated. It's the responsibility of the TokenProvider implementation to validate that.

A proposal has been discussed here:
http://cxf.547215.n5.nabble.com/STS-OnBehalfOf-token-validation-SAMLTokenProvider-td5003544.html

OnBehalfOf token validation is moved to the TokenIssueOperation and the ReceivedToken is enhanced with the following attributes:

• was it a token of ws-security header (like ReceivedToken), onbehalfof, actas
• successfully validated (it could be a token which depends on other constraints to be fully accepted)
• original DOM element
• transformed DOM element (used if the token is passed by ref, also supported by SAML spec)
• principal (mostly, you only need the principal to issue a new token)

Issue Links

• supercedes: CXF-3929 Present realm ignored by TokenValidateOperation for TokenValidator