Page History
...
Et typisk request vil have nogenlunde følgende struktur:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<?xml version="1.0" encoding="UTF-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wst14="http://docs.oasis-open.org/ws-sx/ws-trust/200802" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<soapenv:Header>
<wsa:Action wsu:Id="action">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</wsa:Action>
<wsa:MessageID wsu:Id="messageID">urn:uuid:1c2818b8-9ab3-4898-9730-dab518020b05</wsa:MessageID>
<wsse:Security mustUnderstand="1" wsu:Id="security">
<wsu:Timestamp wsu:Id="ts"><wsu:Created>2018-05-24T09:17:40Z</wsu:Created></wsu:Timestamp>
<ds:Signature>
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#messageID"> ... </ds:Reference>
<ds:Reference URI="#action"> ...</ds:Reference>
<ds:Reference URI="#ts">...</ds:Reference>
<ds:Reference URI="#body">...</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>...</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
<!-- FOCES certifikat i base64-encodet form til signering af -->
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body wsu:Id="body">
<wst:RequestSecurityToken Context="urn:uuid:f637dd3e-fad4-4f5e-ac55-baa504560772">
<wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</wst:TokenType>
<wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>
<wst14:ActAs>
<!-- nemlogin bootstrap token in cleartext -->
</saml:Assertion>
</wst14:ActAs>
<wsp:AppliesTo>
<wsa:EndpointReference>
<wsa:Address>http://audience/clear</wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
<wst:Claims Dialect="http://docs.oasis-open.org/wsfed/authorization/200706/authclaims">
<auth:ClaimType Uri="dk:gov:saml:attribute:CprNumberIdentifier">
<auth:Value>0501792275</auth:Value>
</auth:ClaimType>
<auth:ClaimType Uri="dk:healthcare:saml:attribute:OnBehalfOf">
<auth:Value>urn:dk:healthcare:saml:actThroughProcurationBy:cprNumberIdentifier:1111111118</auth:Value>
</auth:ClaimType>
</wst:Claims>
</wst:RequestSecurityToken>
</soapenv:Body>
</soapenv:Envelope> |
...
// bootstrap token dom is normally fetched by the citizen authenticating himself with NemLog-in
OIOBootstrapToken bootstrapToken = new OIOBootstrapToken(this.bootstrapTokenDom);
OIOSAMLFactory oiosamlFactory = new OIOSAMLFactory();
OIOBootstrapToIdentityTokenRequestDOMBuilder requestBuilder = oiosamlFactory.createOIOBootstrapToIdentityTokenRequestDOMBuilder();
requestBuilder.setOIOBootstrapToken(bootstrapToken);
// Hvis man ønsker at bygge et request med certifikat i BinarySecurityToken, så kaldes:
// requestBuilder.setSigningVault(getValidWhitelistedVault(), true);
requestBuilder.setSigningVault(getValidWhitelistedVault());
requestBuilder.setAudience("http://audience/clear");
requestBuilder.setCPRNumberClaim("0501792275");
requestBuilder.setProcurationByCprClaim("1111111118");
Document requestDocument = requestBuilder.build();
final String requestString = XmlUtil.node2String(requestDocument, false, false);
final Document responseDoc = soapClient.execute(requestString);
OIOBootstrapToIdentityTokenResponse response = oiosamlFactory.createOIOBootstrapToIdentityTokenResponseModelBuilder().build(responseDoc);
assertFalse(response.getFaultString(), response.isFault());
response.validateSignature();
response.validateSignatureAndTrust(federation);
final IdentityToken identityToken = response.getIdentityToken();
// identity token can be used to authenticate against backend service
// below we just inspect the result
...