hsm_client/java/_j_c_a_w_s_s4_j_8java-example.html

package doxy.examples;


import java.io.File;

import java.io.FileInputStream;

import java.security.KeyStore;

import java.security.Provider;

import java.security.Security;

import java.util.Enumeration;


import javax.crypto.KeyGenerator;

import javax.crypto.SecretKey;

import javax.xml.parsers.DocumentBuilderFactory;

import javax.xml.transform.Transformer;

import javax.xml.transform.TransformerException;

import javax.xml.transform.TransformerFactory;

import javax.xml.transform.dom.DOMSource;

import javax.xml.transform.stream.StreamResult;


import org.apache.xml.security.Init;

import org.apache.wss4j.common.crypto.Merlin;

import org.apache.wss4j.common.ext.WSPasswordCallback;

import org.apache.wss4j.common.WSEncryptionPart;

import org.apache.wss4j.dom.WSConstants;

import org.apache.wss4j.dom.engine.WSSConfig;

import org.apache.wss4j.dom.engine.WSSecurityEngine;

import org.apache.wss4j.dom.handler.RequestData;

import org.apache.wss4j.dom.message.WSSecTimestamp;

import org.apache.wss4j.dom.message.WSSecEncrypt;

import org.apache.wss4j.dom.message.WSSecHeader;

import org.apache.wss4j.dom.message.WSSecSignature;

import org.apache.wss4j.dom.util.WSSecurityUtil;

import org.w3c.dom.Document;


public class JCAWSS4J {


    // Inicialização da Apache XML Security

    static {

        Init.init();

    }


    static void writeDocumentToFile(Document doc, String filePath) throws TransformerException {

        TransformerFactory transformerFactory = TransformerFactory.newInstance();

        Transformer transformer = transformerFactory.newTransformer();


        DOMSource source = new DOMSource(doc);

        StreamResult result = new StreamResult(new File(filePath));

        transformer.transform(source, result);

    }


    static Document outbound(Document doc, Merlin merlin,

                             String signatureAlias, String encryptionAlias) throws Exception {


        // Cria e insere o cabeçalho <wsse:Security> na mensagem SOAP.

        WSSecHeader header = new WSSecHeader(doc);

        header.insertSecurityHeader();


        // Adiciona um timestamp de segurança (<wsu:Timestamp>).

        WSSecTimestamp timestamp = new WSSecTimestamp(header);

        timestamp.setTimeToLive(60);

        timestamp.build();


        // Define as partes da mensagem que serão assinadas e/ou criptografadas.

        WSEncryptionPart timestampPart = new WSEncryptionPart("Timestamp", WSConstants.WSU_NS, "");

        String soapNs = WSSecurityUtil.getSOAPNamespace(doc.getDocumentElement());

        WSEncryptionPart bodyPart = new WSEncryptionPart(WSConstants.ELEM_BODY, soapNs, "Content");


        // Configura a assinatura.

        WSSecSignature signature = new WSSecSignature(header);

        signature.setUserInfo(signatureAlias, ""); // alias da chave de assinatura

        signature.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);

        signature.setSignatureAlgorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");

        signature.setSigCanonicalization(WSConstants.C14N_EXCL_OMIT_COMMENTS);

        signature.setDigestAlgo(WSConstants.SHA256);


        // partes que devem ser assinadas (Corpo e Timestamp).

        signature.getParts().add(bodyPart);

        signature.getParts().add(timestampPart);


        // Executa a assinatura

        signature.build(merlin);


        // Configura a CRIPTOGRAFIA.

        WSSecEncrypt encrypt = new WSSecEncrypt(header);

        encrypt.setUserInfo(encryptionAlias, ""); // alias da chave publica usada para o transporte

        encrypt.setKeyIdentifierType(WSConstants.ISSUER_SERIAL);

        encrypt.setSymmetricEncAlgorithm(WSConstants.TRIPLE_DES); // algoritmo de criptografia simétrica do corpo

        encrypt.setKeyEncAlgo(WSConstants.KEYTRANSPORT_RSAOAEP); // algoritmo de transporte da chave simétrica

        encrypt.getParts().add(bodyPart);


        // 6. Gera uma chave simétrica (chave de sessão) para criptografar os dados.

        KeyGenerator keyGen = KeyGenerator.getInstance("DESede", merlin.getCryptoProvider());

        keyGen.init(168);

        SecretKey symmetricKey = keyGen.generateKey();

        // Executa a criptografia

        encrypt.build(merlin, symmetricKey);


        return doc;

    }


    static Document inbound(Document doc, Merlin merlin)

            throws Exception {

        WSSConfig wssConfig = WSSConfig.getNewInstance();

        RequestData requestData = new RequestData();

        requestData.setDecCrypto(merlin);

        requestData.setSigVerCrypto(merlin);

        requestData.setWssConfig(wssConfig);


        requestData.setCallbackHandler(callbacks -> {

            for (Object _cb : callbacks) {

                if (_cb instanceof WSPasswordCallback) {

                    WSPasswordCallback pc = (WSPasswordCallback) _cb;

                    if (pc.getUsage() == WSPasswordCallback.DECRYPT || pc.getUsage() == WSPasswordCallback.SIGNATURE) {

                        System.out.println("Callback for: " + pc.getIdentifier());

                        pc.setPassword("");

                    }

                }

            }

        });


        WSSecurityEngine engine = new WSSecurityEngine();

        engine.processSecurityHeader(doc, requestData);


        return doc;

    }


    public static void main(String[] args) {

        try {

            // Configuração do provider e keystore

            Security.addProvider(new br.com.trueaccess.provider.netdfence.ND());

            Provider provider = Security.getProvider("ND");

            String pin = "user:password@hsm.local";

            FileInputStream fis = null;

            KeyStore keystore = KeyStore.getInstance("TACCON", provider);

            keystore.load(fis, pin.toCharArray());

            String signatureAlias = "C3HMO";

            String encryptionAlias = "CIPHMO";


            //String signatureAlias = "cnpj";

            //String encryptionAlias = "cnpj";

            //KeyStore keystore = KeyStore.getInstance("TACV", "ND");

            //keystore.load(null);


            // Configuração de crypto do WSS4J

            Merlin merlin = new Merlin();

            merlin.setKeyStore(keystore);

            merlin.setTrustStore(keystore);

            merlin.setCryptoProvider("ND");


            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

            dbf.setNamespaceAware(true);


           {

                // leitura da mensagem original do arquivo

                Document doc = dbf.newDocumentBuilder().parse(new File("message.xml"));

                // processamento da mensagem

                Document processedDoc = outbound(doc, merlin, signatureAlias, encryptionAlias);

                // escreve a mensagem processada para o arquivo

                writeDocumentToFile(processedDoc, "output.xml");

            }


            {

                // leitura da mensagem criptografada do arquivo

                Document doc = dbf.newDocumentBuilder().parse(new File("output.xml"));

                // processamento da mensagem

                Document decodedDoc = inbound(doc, merlin);

                writeDocumentToFile(decodedDoc, "decrypted.xml");

            }


        } catch (Exception e) {

            e.printStackTrace();

        }

    }

}