[RAMPART-32] Processing of <Issuer> and <RequestSecurityTokenTemplate> in class org.apache.ws.secpolicy.builders.IssuedTokenBuilder is wrong.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1
• Fix Version/s: 1.3
• Component/s: rampart-policy
• Assignee: Unassigned
• Reporter: Uwe Kylau
• Created: 21/Apr/07 09:33
• Updated: 18/Dec/07 05:40
• Resolved: 18/Dec/07 05:40

Description

There is a bug in method build(...) of class org.apache.ws.secpolicy.builders.IssuedTokenBuilder,
which processes the <IssuedToken> assertion.

Instead of fetching the <RequestSecurityTokenTemplate> and calling issuedToken.setRstTemplate(...),
the <Issuer> element is fetched again and issuedToken.setIssuerEpr(...) is called a second time.

extract of the incorrect code:

public Assertion build(OMElement element, AssertionBuilderFactory factory)
throws IllegalArgumentException {
IssuedToken issuedToken = new IssuedToken();

// Extract Issuer
OMElement issuerElem = element.getFirstChildWithName(Constants.ISSUER);
if (issuerElem != null && issuerElem.getFirstElement() != null)

{ issuedToken.setIssuerEpr(issuerElem.getFirstElement()); }

// Extract RSTTemplate
OMElement rstTmplElem = element.getFirstChildWithName(Constants.ISSUER);
if (rstTmplElem != null)

{ issuedToken.setIssuerEpr(rstTmplElem); }

...
}

As can be seen, getFirstChildWithName(Constants.ISSUER) is called twice, as well as setIssuerEpr(...).

In result, the <RequestSecurityTokenTemplate> element will not be included in the policy of the deployed service.
A client must must obtain it locally (e.g. from a file) and cannot extract it from the response of a metadata exchange.
Moreover, the complete <Issuer> element will be stored, rather than just the endpoint reference that it contains.
This affects serialization of the element (<IssuedToken><Issuer><Issuer>...</Issuer></Issuer></IssuedToken>).

Thx in advance for fixing this issue.

Best regards,
Uwe Kylau