package org.kuali.student.security.trust.service;

 import java.io.BufferedReader;

 import java.io.InputStreamReader;

 import java.io.StringWriter;

 import java.io.UnsupportedEncodingException;

 import java.net.HttpURLConnection;

 import java.net.URL;

 import java.net.URLEncoder;

 import java.util.HashMap;

 import java.util.List;

 import java.util.Map;

 import javax.jws.WebService;

 import javax.xml.bind.JAXBElement;

 import javax.xml.parsers.DocumentBuilder;

 import javax.xml.parsers.DocumentBuilderFactory;

 import javax.xml.transform.Transformer;

 import javax.xml.transform.TransformerFactory;

 import javax.xml.transform.dom.DOMSource;

 import javax.xml.transform.stream.StreamResult;

 import org.jasig.cas.client.util.CommonUtils;

 import org.jasig.cas.client.util.XmlUtils;

 import org.kuali.student.security.exceptions.KSSecurityException;

 import org.kuali.student.security.trust.dto.RequestSecurityTokenResponseCollectionType;

 import org.kuali.student.security.trust.dto.RequestSecurityTokenResponseType;

 import org.kuali.student.security.trust.dto.RequestSecurityTokenType;

 import org.kuali.student.security.util.SamlUtils;

 import org.opensaml.SAMLAssertion;

 import org.w3c.dom.Document;

 import org.w3c.dom.Element;

 import org.w3c.dom.Node;

 /**

  * This class was generated by Apache CXF 2.2.8

  * Thu Jun 03 14:08:34 EDT 2010

  * Generated source version: 2.2.8

  * 

  */

 @WebService(endpointInterface = "org.kuali.student.security.trust.service.SecurityTokenService", serviceName = "SecurityTokenService", 

             portName = "SecurityTokenService", targetNamespace = "http://schemas.xmlsoap.org/ws/2005/02/trust/wsdl")

 public class SecurityTokenServiceImpl implements SecurityTokenService {

     public static final String WST_NS_05_02 = "http://schemas.xmlsoap.org/ws/2005/02/trust";

     public static final String SAML_11_NS = "urn:oasis:names:tc:SAML:1.0:assertion";

     private String casServerUrl;

     private String samlIssuerForUser;

     private String proxyCallBackUrl;

     public RequestSecurityTokenResponseCollectionType requestSecurityToken2(RequestSecurityTokenType request) throws KSSecurityException

     {

         return null;

     }

     public RequestSecurityTokenResponseType requestSecurityToken(RequestSecurityTokenType request) throws KSSecurityException

     {

         // Parse the request

         String context = request.getContext();

         List<Object> objects = request.getAny();

         String tokenTypeUri = null;

         String requestTypeUri = null;

         String proxyTicketId = null;

         String proxyTargetService = null;

         for(Object o : objects){

             // if its being accessed as a SOAP service with JAXB.

             if(o instanceof JAXBElement){

                 JAXBElement<?> e = (JAXBElement<?>)o;

                 if( e.getName().getLocalPart().equalsIgnoreCase("TokenType")){

                     tokenTypeUri = (String)e.getValue();

                 }

                 else if(e.getName().getLocalPart().equalsIgnoreCase("RequestType")) {

                     requestTypeUri = (String)e.getValue();

                 }

                 else if(e.getName().getLocalPart().equalsIgnoreCase("CasProxyTicket")) {

                     proxyTicketId = (String)e.getValue();

                 }

                 else if(e.getName().getLocalPart().equalsIgnoreCase("CasProxyTargetService")) {

                     proxyTargetService = (String)e.getValue();

                 }

             // if its being accessed with a client impl, no SOAP.

             } else if(o instanceof Element){

                 Element e = (Element)o;

                 if( e.getLocalName().equalsIgnoreCase("TokenType")){

                     tokenTypeUri = e.getTextContent();

                 }

                 else if(e.getLocalName().equalsIgnoreCase("RequestType")) {

                     requestTypeUri = e.getTextContent();

                 }

                 else if(e.getLocalName().equalsIgnoreCase("CasProxyTicket")) {

                     proxyTicketId = e.getTextContent();

                 }

                 else if(e.getLocalName().equalsIgnoreCase("CasProxyTargetService")) {

                     proxyTargetService = e.getTextContent();

                 }

             }

         }

         // Create the Response

         RequestSecurityTokenResponseType rstr = new RequestSecurityTokenResponseType();

         if(requestTypeUri == null){ 

             throw new KSSecurityException("The element RequestType is required");

         }

         if(proxyTicketId == null || proxyTargetService == null){

             throw new KSSecurityException("The elements CasProxyTicket and CasProxyTargetService are required");

         }

         //This optional URI specifies the identifier from the original request.

        // That is, if a context URI is specified on a RST, then it MUST be echoed on the corresponding RSTRs.

         if(context != null){

             rstr.setContext(context);

         }

         if(tokenTypeUri == null){

             //default to SAML

             tokenTypeUri = SAML_11_NS;

         }

         // We are just handling request for tokens of type SAML and for new token issuing, so this is just one BAD mother IF.

         if(tokenTypeUri.equals(SAML_11_NS) && requestTypeUri.endsWith("/Issue") ){

             // create the TokenType and RequestedSecurityToken Elements

             Element tokenType = null;

             Element requestedSecurityToken = null;

             Document signedSAMLDoc = null;

             try{

                 DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

                 //XML Signature needs to be namespace aware -- not sure if I need this here

                 dbf.setNamespaceAware(true);

                 DocumentBuilder db = dbf.newDocumentBuilder();

                 Document doc = db.newDocument();

                 tokenType = doc.createElementNS(WST_NS_05_02, "TokenType");

                 tokenType.setTextContent(tokenTypeUri);

                 requestedSecurityToken = doc.createElementNS(WST_NS_05_02, "RequestedSecurityToken");

                 String testProperty = System.getProperty("ks.test.securityTokenService.useCas", "true");

                 if(Boolean.valueOf(testProperty)){

                     signedSAMLDoc = validateCasProxyTicket(proxyTicketId, proxyTargetService);

                 } else {

                     // Create TEST SAML

                     signedSAMLDoc = getSamlPrincipal("WS Trust Service is in test mode");

                 }

                 Node signedSAMLAssertion = signedSAMLDoc.getDocumentElement();

                 requestedSecurityToken.appendChild(doc.importNode(signedSAMLAssertion, true));

             } catch(Exception e){

                 throw new KSSecurityException(e);

             }

             rstr.getAny().add(tokenType);

             rstr.getAny().add(requestedSecurityToken);

         }

         return rstr;

     }

     private Document validateCasProxyTicket(String proxyTicketId, String proxyTargetService) throws KSSecurityException{

         String url = constructUrl(proxyTicketId, proxyTargetService);

         HttpURLConnection conn = null;

         try {

             URL constructedUrl = new URL(url);

             conn = (HttpURLConnection) constructedUrl.openConnection();

             BufferedReader in = new BufferedReader(new InputStreamReader(conn.getInputStream()));

             String line;

             StringBuffer stringBuffer = new StringBuffer(255);

             String response;

             while ((line = in.readLine()) != null) {

                 stringBuffer.append(line);

             }

             response = stringBuffer.toString();

             String error = XmlUtils.getTextForElement(response, "authenticationFailure");

             if (CommonUtils.isNotEmpty(error)) {

                 //return error;

                 throw new KSSecurityException(error);

             }

             String user = XmlUtils.getTextForElement(response, "user");

             String pgt  = XmlUtils.getTextForElement(response, "proxyGrantingTicket");

             String proxies = XmlUtils.getTextForElement(response, "proxies");

             Map<String,String> samlProperties = new HashMap<String,String>();

             samlProperties.put("user", user.trim());

             samlProperties.put("proxyGrantingTicket", pgt.trim());

             samlProperties.put("proxies", proxies.trim());

             samlProperties.put("samlIssuerForUser", samlIssuerForUser.trim());

             SamlUtils.setSamlProperties(samlProperties);

             SAMLAssertion samlAssertion = SamlUtils.createAssertion();

             Document signedSAML = SamlUtils.signAssertion(samlAssertion);

             return signedSAML;

             // transform the saml DOM into a writer, and return as a string response

             /*DOMSource domSource = new DOMSource(signedSAML);

             StringWriter writer = new StringWriter();

             StreamResult result = new StreamResult(writer);

             TransformerFactory tf = TransformerFactory.newInstance();

             Transformer transformer;

             transformer = tf.newTransformer();

             transformer.transform(domSource, result);

             writer.flush();

             return writer.toString();*/

         } catch (final Exception e) {

             throw new KSSecurityException(e);

         } finally {

             if (conn != null) {

                 conn.disconnect();

             }

         }

     }

     private String constructUrl(String proxyTicketId, String proxyTargetService) throws KSSecurityException{

         try {

             return this.casServerUrl + (this.casServerUrl.endsWith("/") ? "" : "/") + "proxyValidate" + "?ticket=" 

             + proxyTicketId + "&service=" + URLEncoder.encode(proxyTargetService, "UTF-8") 

             + "&pgtUrl=" + URLEncoder.encode(proxyCallBackUrl, "UTF-8");

         } catch (UnsupportedEncodingException e) {

             throw new KSSecurityException(e);

         }

     }

     private Document getSamlPrincipal(String principal) throws KSSecurityException{

         try {      

             Map<String,String> samlProperties = new HashMap<String,String>();

             samlProperties.put("user", principal);

             samlProperties.put("proxyGrantingTicket", "");

             samlProperties.put("proxies", "");

             if(samlIssuerForUser == null){

                 samlProperties.put("samlIssuerForUser", "org.kuali.student.trust.sts");

             }else{

                 samlProperties.put("samlIssuerForUser", samlIssuerForUser.trim());

             }

             SamlUtils.setSamlProperties(samlProperties);

             SAMLAssertion samlAssertion = SamlUtils.createAssertion();

             Document signedSAML = SamlUtils.signAssertion(samlAssertion);

             return signedSAML;

         } catch (final Exception e) {

             throw new KSSecurityException(e);

         } 

     }

     public String getCasServerUrl() {

         return casServerUrl;

     }

     public void setCasServerUrl(String casServerUrl) {

         this.casServerUrl = casServerUrl;

     }

     public String getSamlIssuerForUser() {

         return samlIssuerForUser;

     }

     public void setSamlIssuerForUser(String samlIssuerForUser) {

         this.samlIssuerForUser = samlIssuerForUser;

     }

     public String getProxyCallBackUrl() {

         return proxyCallBackUrl;

     }

     public void setProxyCallBackUrl(String proxyCallBackUrl) {

         this.proxyCallBackUrl = proxyCallBackUrl;

     }

 }