import org.apache.ws.security.util.Base64; //导入依赖的package包/类
@Override
public SecurityToken requestSecurityToken() throws Exception {
    DelegatedKerberosSecurity bst = new DelegatedKerberosSecurity(DOMUtils.createDocument());
    bst.retrieveServiceTicket(getContextName(), getServiceName(), getGssCredential());
    
    bst.addWSUNamespace();
    bst.setID(wssConfig.getIdAllocator().createSecureId("BST-", bst)); //$NON-NLS-1$
    
    SecurityToken st = new SecurityToken(bst.getID());
    st.setToken(bst.getElement());
    st.setWsuId(bst.getID());
    SecretKey secretKey = bst.getSecretKey();
    if (secretKey != null) {
        st.setSecret(secretKey.getEncoded());
    }
    String sha1 = Base64.encode(WSSecurityUtil.generateDigest(bst.getToken()));
    st.setSHA1(sha1);
    st.setTokenType(bst.getValueType());
    return st;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
protected static Element createBSTX509(Document doc, X509Certificate cert, Element secRefE) 
    throws WSSecurityException {
    byte data[];
    try {
        data = cert.getEncoded();
    } catch (CertificateEncodingException e) {
        throw new WSSecurityException(
            WSSecurityException.SECURITY_TOKEN_UNAVAILABLE, "encodeError", null, e
        );
    }
    String prefix = WSSecurityUtil.getPrefixNS(WSConstants.WSSE_NS, secRefE);
    Element elem = doc.createElementNS(WSConstants.WSSE_NS, prefix + ":BinarySecurityToken");
    WSSecurityUtil.setNamespace(elem, WSConstants.WSSE_NS, prefix);
    // elem.setAttributeNS(WSConstants.XMLNS_NS, "xmlns", "");
    elem.setAttributeNS(null, "ValueType", X509Security.X509_V3_TYPE);
    Text certText = doc.createTextNode(Base64.encode(data)); // no line wrap
    elem.appendChild(certText);
    return elem;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * get the byte array containing token information.
 * 
 * @return the byte array containing token information
 */
public byte[] getToken() {
    Node node = element.getFirstChild();
    StringBuffer buffer = new StringBuffer();
    while (node != null) {
        if (Node.TEXT_NODE == node.getNodeType()) {
            buffer.append(((Text)node).getData());
        }
        node = node.getNextSibling();
    }
            
    try {
        return Base64.decode(buffer.toString());
    } catch (Exception ex) {
        if (LOG.isDebugEnabled()) {
            LOG.debug(ex.getMessage(), ex);
        }
        return null;
    }
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Sets the KeyIdentifier Element as a X509 Subject-Key-Identifier (SKI). Takes a X509
 * certificate, gets it SKI data, converts into base 64 and inserts it into a
 * <code>wsse:KeyIdentifier</code> element, which is placed in the
 * <code>wsse:SecurityTokenReference</code> element.
 * 
 * @param cert
 *            is the X509 certificate to get the SKI
 * @param crypto
 *            is the Crypto implementation. Used to read SKI info bytes from certificate
 */
public void setKeyIdentifierSKI(X509Certificate cert, Crypto crypto) throws WSSecurityException {
	//
	// As per the 1.1 specification, SKI can only be used for a V3 certificate
	//
	if (cert.getVersion() != 3) {
		throw new WSSecurityException(WSSecurityException.UNSUPPORTED_SECURITY_TOKEN,
				"invalidCertForSKI", new Object[] { new Integer(cert.getVersion()) });
	}

	Document doc = this.element.getOwnerDocument();
	byte data[] = crypto.getSKIBytesFromCert(cert);

	org.w3c.dom.Text text = doc.createTextNode(Base64.encode(data));
	createKeyIdentifier(doc, SKI_URI, text, true);
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
public byte[] getSKIBytes() {
	if (skiBytes != null) {
		return skiBytes;
	}
	Node node = getFirstElement().getFirstChild();
	if (node == null) {
		return null;
	}
	if (node.getNodeType() == Node.TEXT_NODE) {
		try {
			skiBytes = Base64.decode(((Text) node).getData());
		} catch (WSSecurityException e) {
			return null;
		}
	}
	return skiBytes;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Test that adds a UserNameToken with a digested password but with type of
 * password test.
 */
public void testUsernameTokenDigestText() throws Exception {
    WSSecUsernameToken builder = new WSSecUsernameToken();
    builder.setPasswordType(WSConstants.PASSWORD_TEXT);
    byte[] password = "verySecret".getBytes();
    MessageDigest sha = MessageDigest.getInstance("MD5");
    sha.reset();
    sha.update(password);
    String passwdDigest = Base64.encode(sha.digest());
    
    builder.setUserInfo("wernerd", passwdDigest);
    LOG.info("Before adding UsernameToken PW Text....");
    Document doc = unsignedEnvelope.getAsDocument();
    WSSecHeader secHeader = new WSSecHeader();
    secHeader.insertSecurityHeader(doc);
    Document signedDoc = builder.build(doc, secHeader);
    if (LOG.isDebugEnabled()) {
        LOG.debug("Message with UserNameToken PW Text:");
        String outputString = 
            org.apache.ws.security.util.XMLUtils.PrettyDocumentToString(signedDoc);
        LOG.debug(outputString);
    }
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
private static String encryptAes(SecretKey secretKey, String plainData)
{
	try {
		byte[] b = null;
		if (plainData != null) b = plainData.getBytes(MiscUtils.DEFAULT_UTF8_ENCODING);
		byte[] encryptedData = encryptDecrypt("AES", Cipher.ENCRYPT_MODE, secretKey, b);
		
		return Base64.encode(encryptedData);
	} catch (Exception e) {
		logger.error("Cannot encrypt", e);
	}
	return null;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
private static String decryptAes(SecretKey secretKey, String encryptedDataStr)
{
	try {
		byte[] encryptedData = Base64.decode(encryptedDataStr);
		
		byte[] b = encryptDecrypt("AES", Cipher.DECRYPT_MODE, secretKey, encryptedData);
		return(new String(b, MiscUtils.DEFAULT_UTF8_ENCODING));
	} catch (Exception e) {
		logger.error("Cannot decrypt", e);
	}
	return null;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
String encrypt(String clearText) {
    String sha1Hash = null;
    try {
      MessageDigest md = MessageDigest.getInstance("SHA1"); //$NON-NLS-1$
      byte[] digest = md.digest(clearText.getBytes());
      sha1Hash = new String(Base64.encode(digest));
    } catch (Exception e) {
      e.printStackTrace();
    }
    return sha1Hash;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
private String getSHA1(byte[] input) throws WSSecurityException {
    try {
        MessageDigest sha = null;
        sha = MessageDigest.getInstance("SHA-1");
        sha.reset();
        sha.update(input);
        byte[] data = sha.digest();
        
        return Base64.encode(data);
    } catch (NoSuchAlgorithmException e) {
        throw new WSSecurityException(
            WSSecurityException.UNSUPPORTED_ALGORITHM, null, null, e
        );
    }
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Get the derived secret key.
 * 
 * After the <code>prepare()</code> method was called use this method
 * to compute a derived secret key. If "useDerivedKey" is set, then the returned secret
 * key is derived as per the UsernameToken 1.1 specification. Otherwise, the generation 
 * of this secret key is according to the WS-Trust specifications.
 * 
 * @return Return the derived secret key of this token or null if <code>prepare()</code>
 * was not called before.
 */
public byte[] getSecretKey() throws WSSecurityException {
    if (ut == null) {
        return null;
    }
    if (useDerivedKey) {
        if (passwordsAreEncoded) {
            return UsernameToken.generateDerivedKey(Base64.decode(password), saltValue, iteration);
        } else {
            return UsernameToken.generateDerivedKey(password, saltValue, iteration);
        }
    }
    return ut.getSecretKey(secretKeyLength);
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Get the derived key.
 * 
 * After the <code>prepare()</code> method was called use this method
 * to compute a derived key. The generation of this secret key is according
 * to the UsernameTokenProfile 1.1 specification (section 4 - Key Derivation).
 * 
 * @return Return the derived key of this token or null if <code>prepare()</code>
 * was not called before.
 */
public byte[] getDerivedKey() throws WSSecurityException {
    if (ut == null || !useDerivedKey) {
        return null;
    }
    if (passwordsAreEncoded) {
        return UsernameToken.generateDerivedKey(Base64.decode(password), saltValue, iteration);
    } else {
        return UsernameToken.generateDerivedKey(password, saltValue, iteration);
    }
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * set the token information.
 * 
 * @param data 
 */
public void setToken(byte[] data) {
    if (data == null) {
        throw new IllegalArgumentException("data == null");
    }
    Text node = getFirstNode();
    node.setData(Base64.encode(data));
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Constructs a <code>SignatureConfirmation</code> object and parses the
 * <code>wsse11:SignatureCOnfirmation</code> element to initialize it.
 *
 * @param elem the <code>wsse11:SignatureCOnfirmation</code> element that
 *             contains the confirmation data
 */
public SignatureConfirmation(Element elem) throws WSSecurityException {
    element = elem;
    String sv = element.getAttributeNS(null, VALUE);
    if (sv != null) {
        signatureValue = Base64.decode(sv);
    }
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Creates and adds a Nonce element to this UsernameToken
 */
public void addNonce(Document doc) {
    if (elementNonce != null) {
        return;
    }
    byte[] nonceValue = new byte[16];
    random.nextBytes(nonceValue);
    elementNonce = doc.createElementNS(WSConstants.WSSE_NS, "wsse:" + WSConstants.NONCE_LN);
    elementNonce.appendChild(doc.createTextNode(Base64.encode(nonceValue)));
    elementNonce.setAttributeNS(null, "EncodingType", BASE64_ENCODING);
    element.appendChild(elementNonce);
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Adds and optionally creates a Salt element to this UsernameToken.
 * 
 * If the <code>saltValue</code> is <code>null</code> the the method
 * generates a new salt. Otherwise it uses the the given value.
 * 
 * @param doc The Document for the UsernameToken
 * @param saltValue The salt to add, if null generate a new salt value
 * @param mac If <code>true</code> then an optionally generated value is
 *            usable for a MAC
 * @return Returns the added salt
 */
public byte[] addSalt(Document doc, byte[] saltValue, boolean mac) {
    if (saltValue == null) {
        saltValue = generateSalt(mac);
    }
    elementSalt = 
        doc.createElementNS(
            WSConstants.WSSE11_NS, WSConstants.WSSE11_PREFIX + ":" + WSConstants.SALT_LN
        );
    WSSecurityUtil.setNamespace(this.element, WSConstants.WSSE11_NS, WSConstants.WSSE11_PREFIX);
    elementSalt.appendChild(doc.createTextNode(Base64.encode(saltValue)));
    element.appendChild(elementSalt);
    return saltValue;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Get the Salt value of this UsernameToken.
 * 
 * @return Returns the binary Salt value or <code>null</code> if no Salt
 *         value is available in the username token.
 * @throws WSSecurityException
 */
public byte[] getSalt() throws WSSecurityException {
    String salt = nodeString(elementSalt);
    if (salt != null) {
        return Base64.decode(nodeString(elementSalt));
    }
    return null;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * Sets the password string. This function sets the password in the
 * <code>UsernameToken</code> either as plain text or encodes the password
 * according to the WS Security specifications, UsernameToken profile, into
 * a password digest.
 * 
 * @param pwd the password to use
 */
public void setPassword(String pwd) {
    if (pwd == null) {
        if (passwordType != null) {
            throw new IllegalArgumentException("pwd == null but a password is needed");
        } else {
            // Ignore setting the password.
            return;
        }
    }
    
    rawPassword = pwd;             // enhancement by Alberto coletti
    Text node = getFirstNode(elementPassword);
    try {
        if (!hashed) {
            node.setData(pwd);
            elementPassword.setAttributeNS(null, "Type", WSConstants.PASSWORD_TEXT);
        } else {
            if (passwordsAreEncoded) {
                node.setData(doPasswordDigest(getNonce(), getCreated(), Base64.decode(pwd)));
            } else {
                node.setData(doPasswordDigest(getNonce(), getCreated(), pwd));
            }
            elementPassword.setAttributeNS(null, "Type", WSConstants.PASSWORD_DIGEST);
        }
    } catch (Exception e) {
        if (DO_DEBUG) {
            LOG.debug(e.getMessage(), e);
        }
    }
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
public static String doPasswordDigest(String nonce, String created, byte[] password) {
    String passwdDigest = null;
    try {
        byte[] b1 = nonce != null ? Base64.decode(nonce) : new byte[0];
        byte[] b2 = created != null ? created.getBytes("UTF-8") : new byte[0];
        byte[] b3 = password;
        byte[] b4 = new byte[b1.length + b2.length + b3.length];
        int offset = 0;
        System.arraycopy(b1, 0, b4, offset, b1.length);
        offset += b1.length;
        
        System.arraycopy(b2, 0, b4, offset, b2.length);
        offset += b2.length;

        System.arraycopy(b3, 0, b4, offset, b3.length);
        
        MessageDigest sha = MessageDigest.getInstance("SHA-1");
        sha.reset();
        sha.update(b4);
        passwdDigest = Base64.encode(sha.digest());
    } catch (Exception e) {
        if (DO_DEBUG) {
            LOG.debug(e.getMessage(), e);
        }
    }
    return passwdDigest;
}
 

import org.apache.ws.security.util.Base64; //导入依赖的package包/类
/**
 * This method gets a derived key as defined in WSS Username Token Profile.
 * 
 * @return Returns the derived key as a byte array
 * @throws WSSecurityException
 */
public byte[] getDerivedKey() throws WSSecurityException {
    int iteration = getIteration();
    byte[] salt = getSalt();
    if (passwordsAreEncoded) {
        return generateDerivedKey(Base64.decode(rawPassword), salt, iteration);
    } else {
        return generateDerivedKey(rawPassword, salt, iteration);
    }
}