Support WSS4J subject cert constraints

[runeflobakk]

If no Subject DN Certificate Constraint has been configured for the case described here http://koenserneels.blogspot.com/2013/09/ws-security-using-binarysecuritytoken.html WSS4J emits the following warning:

WARN - org.apache.wss4j.common.crypto.CryptoBase - No Subject DN Certificate Constraints were defined. This could be a security issue

CryptoBase.java

This PR is a work-in-progress for adding support for configuring Subject DN Certificate Constraint for WSS4J (SIG_SUBJECT_CERT_CONSTRAINTS ).

More info in JIRA-issue: https://jira.spring.io/browse/SWS-1058
Issue: #1124

[pivotal-issuemaster]

@runeflobakk Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@runeflobakk Thank you for signing the Contributor License Agreement!

[runeflobakk]

Is it something I can do to enable some progress on this pull request? Thank you.

[free-ice]

Not affiliated with Spring but it looks like you could add test cases.
In particual there should be one test to verify that changes do not change defaults when option is not set by user, and then a test to verify behavior when set.
FYI:ws-proxy is a real asset, thanks ! FYI: wss4j 2.4.0 adds MS compatability for IssuerSerial DN

[snicoll]

@runeflobakk sorry for the delay in reviewing this PR. Test cases that demonstrates the warning is gone with the change would be good (i.e. reverting the main code and running the tests would issue the warning). Also, is this still relevant?

[runeflobakk]

@snicoll It looks like this has been fixed in #1419 ? (thanks @wandi34 )
I am fine with closing this old pull-request, and the referred issue #1124. Thanks for following up!

[snicoll]

@runeflobakk thank you very much for following-up so quickly. Let's continue the review in #1124. As I mentioned in #1456, I had to reset main to 4.0.x to clean things up and the PR you've referenced has been temporarily removed. I hope to be able to restore that for an upcoming 4.1.0-M1 release.