{"action":"created","comment":{"url":"https://api.github.com/repos/codice/ddf/pulls/comments/82085394","pull_request_review_id":2936396,"id":82085394,"diff_hunk":"@@ -0,0 +1,1255 @@\n+==== Securing REST\n+\n+[ditaa,security_architecture,png]\n+....\n++------------------------------------------------------------------------------------------------------------------------------------------------------------+\n+|                                                                                                                                                            |\n+|                       /----------\\          /----------------\\                                               /-------------------------------------------\\ |\n+| /-------=--\\          |          |          |          cDEF  |                                               |                 STS Server                | |\n+| | External | Request  |Delegating| Request  |    Web SSO     |                                   /-------\\   |  /----------\\  /----------\\  /----------\\ | |\n+| |   DDF    |--------->| Servlet  |--------->|     Filter     |                             /---->|       |-->|->|Validators|->|  Claims  |->|  Token   | | |\n+| |  Client  |          | Filter   |          |                |                             |     |  STS  |   |  |          |  | Handlers |  | Issuers  | | |\n+| \\----------/          |     cEEE |          | /------------\\ |                             |     | Realm |   |  \\----------/  \\----------/  \\----------/ | |\n+|       ^               \\----------/          | |Whitelisted?| |<-------\\                    |     |       |   |                                    |      | |\n+|       |                                     | \\------------/ |        |              /-----+ /---|       |<--|<-----=-----------------------------/      | |\n+|       |                   /-----------\\     |    |      |    |        v              |TOKEN| |   |  cDEF |   |                                           | |\n+|       |         Response  |   c5F5    |     |    |Yes   |No  |     /-----=-\\         \\-----+ |   \\-------/   |                                cDEF       | |\n+|       +-------------------|  Endpoint |<----|<-=-/      |    |     |Web Cxt|               | |               \\-------------------------------------------/ |\n+|       |                   \\-----------/     |           :    |  /->|Policy |               | |                                                             |\n+|       |                                     |           |    |  |  |Manager|               | +-------\\                                                     |\n+|       |                   /-----------\\     |           |    |  |  \\-------/               | |SUBJECT|                                                     |\n+|       |                   |Basic Auth.|<-\\  |           v    |  |  /---------\\   /-------\\ | +-------/                                                     |\n+|       |                   |  Handler  |  |  | /------------\\ |  |  |         |   | Shiro | | |                                                             |\n+|       |                   \\-----------/  \\--| |loop through| |  |  |    cDEF |   |       | | |                                                             |\n+|       |                         |           | | configured | |  |  |         |-->|----=->|-/ |                                                             |\n+|       |                         v        /->| |  handlers  | |  |  |  Login  |   |       |   |                                                             |\n+|       |                   /-----------\\  |  | \\------------/ |  |  |  Filter |   |       |   |                                                             |\n+|       |                   |PKI Handler|  |  |       |        |  |  |         |<--|<---=--|<--/                                                             |\n+|       |                   \\-----------/  |  |       \\---=--->|--|->|-=--\\    |   |       |                                                                 |\n+|       |                         |        |  |                |  |  |    |    |   |       |                                                                 |\n+|       |                         v        |  \\----------------/  |  |    v    |   |  c555 |                                                                 |\n+|       |                  /------------\\  |                      |  \\---------/   |       |                                                                 |\n+|       |                  |Anon Handler|  |                      |       |        |       |                                                                 |\n+|       |                  \\------------/  |                      |       v        |       |                                                                 |\n+|       |                         |        |                      |  /---------\\   |       |                                                                 |\n+|       |                         v        |                      |  |    |cDEF|   |       |                                                                 |\n+|       |                   /-----------\\  |                      |  |    :    |   |       |       /--------\\                                                |\n+|       |                   |SAML Assert|  |                      |  |  AuthZ  |   |       |       |cDEF    |   /=--------\\                                  |\n+|       |                   |  Handler  |  |                      \\->| Filter  |-->|----=->|------>|        |-->|         |                                  |\n+|       |   /--------\\      \\-----------/  |      /-----------\\      |/-------\\|   |       |       |  PDP   |   |Expansion|                                  |\n+|       |   | cF55   |            |        |      | cF55      |  No  || Has   ||   |       |       |        |   | Service |                                  |\n+|       |   | Not    |            v        |      | Not       |<-----|| Perm? ||   |       |       |        |   |         |                                  |\n+|       |   |Handled |      /-----------\\  |      | Authorized|      |\\-------/|<--|<----=-|<------|        |<--|         |                                  |\n+|       |   \\--------/      |   Other   |  |      \\-----------/      |    |Yes |   |       |       |        |   \\---------/                                  |\n+|       |       ^           | Handlers  |  |                         |    v    |   |       |       \\--------/                                                |\n+|       |       |           \\-----------/  |                         \\---------/   \\-------/                                                                 |\n+|       |       |               |   |      |                              |                                                                                  |\n+|       |       \\---------------/   \\------/                              v                                                                                  |\n+|       |                                       Response        /------------------\\                                                                         |\n+|       \\-------------------------------------------------------|c5F5 Endpoint     |                                                                         |\n+|                                                               \\------------------/                                                                         |\n++------------------------------------------------------------------------------------------------------------------------------------------------------------+\n+....\n+\n+The delegating servlet filter is topmost filter for all web contexts.\n+It loads in all security filters.\n+The first filter used is the Web SSO filter.\n+It reads from the web context policy manager and functions as the first decision point.\n+If the request is from a whitelisted context, no further authentication is needed and the request goes directly to the desired endpoint.\n+If the context is not on the whitelist, the filter will attempt to get a handler for the context.\n+The filter loops through all configured context handlers until one signals that it has found authentication information that it can use to build a token.\n+This configuration can be changed by modifying the web context policy manager configuration.\n+If unable to resolve the context, the filter will return an authentication error and the process stops.\n+If a handler is successfully found, an auth token is assigned and the request continues to the login filter.\n+The Login Filter receives a token and return a subject.\n+To retrieve the subject, the token is sent through Shiro to the STS Realm where the token will be exchanged for a SAML assertion through a SOAP call to an STS server.\n+If the Subject is returned, the request moves to the Authorization Filter to check permissions on the user.\n+If the user has the correct permissions to access that web context, the request is allowed to hit the endpoint.\n+\n+[NOTE]\n+====\n+This diagram does not yet include the SAML 2.0 Web SSO integration.\n+====\n+\n+==== Encryption Service\n+\n+The encryption service and encryption command, which are based on http://www.jasypt.org/[Jasypt], provide an easy way for developers to add encryption capabilities to ${branding}.\n+\n+===== Encryption Command\n+\n+An encrypt security command is provided with ${branding} that allows plain text to be encrypted.\n+This is useful when displaying password fields in a GUI.\n+\n+Below is an example of the security:encrypt command used to encrypt the plain text \"myPasswordToEncrypt\".\n+The output, `bR9mJpDVo8bTRwqGwIFxHJ5yFJzatKwjXjIo/8USWm8=`, is the encrypted value.\n+\n+[source%nowrap.java]\n+----\n+${ddf-branding-lowercase}@local>security:encrypt myPasswordToEncrypt\n+\n+bR9mJpDVo8bTRwqGwIFxHJ5yFJzatKwjXjIo/8USWm8=\n+----\n+\n+==== Filtering\n+\n+Metacard filtering is performed in a Access plugin that occurs after a query has been performed.\n+\n+===== How Filtering Works\n+\n+Each metacard result will contain security attributes that are populated by the CatalogFramework based on the PolicyPlugins (Not provided! You must create your own plugin for your specific metadata!) that populates this attribute.\n+The security attribute is a HashMap containing a set of keys that map to lists of values.\n+The metacard is then processed by a filter plugin that creates a `KeyValueCollectionPermission` from the metacard's security attribute.\n+This permission is then checked against the user subject to determine if the subject has the correct claims to view that metacard.\n+The decision to filter the metacard eventually relies on the PDP (`feature:install security-pdp-authz`).\n+The PDP returns a decision, and the metacard will either be filtered or allowed to pass through.\n+\n+The security attributes populated on the metacard are completely dependent on the type of the metacard.\n+Each type of metacard must have its own PolicyPlugin that reads the metadata being returned and returns the metacard's security attribute.\n+If the subject permissions are missing during filtering, all resources will be filtered.\n+\n+.Example (represented as simple XML for ease of understanding):\n+[source,xml,linenums]\n+----\n+<metacard>\n+    <security>\n+        <map>\n+            <entry key=\"entry1\" value=\"A,B\" />\n+            <entry key=\"entry2\" value=\"X,Y\" />\n+            <entry key=\"entry3\" value=\"USA,GBR\" />\n+            <entry key=\"entry4\" value=\"USA,AUS\" />\n+        </map>\n+    </security>\n+</metacard>\n+----\n+\n+[source,xml,linenums]\n+----\n+<user>\n+    <claim name=\"claim1\">\n+        <value>A</value>\n+        <value>B</value>\n+    </claim>\n+    <claim name=\"claim2\">\n+        <value>X</value>\n+        <value>Y</value>\n+    </claim>\n+    <claim name=\"claim3\">\n+        <value>USA</value>\n+    </claim>\n+    <claim name=\"claim4\">\n+        <value>USA</value>\n+    </claim>\n+</user>\n+----\n+\n+In the above example, the user's claims are represented very simply and are similar to how they would actually appear in a SAML 2 assertion.\n+Each of these user (or subject) claims will be converted to a KeyValuePermission object.\n+These permission objects will be implied against the permission object generated from the metacard record.\n+In this particular case, the metacard might be allowed if the policy is configured appropriately because all of the permissions line up correctly.\n+\n+==== Filter a New Type of Metacard\n+\n+To enable filtering on a new type of record, implement a PolicyPlugin that is able to read the string metadata contained within the metacard record.\n+Note that, in ${branding}, there is no default plugin that parses a metacard.\n+A plugin must be created to create a policy for the metacard.\n+\n+==== Security Token Service\n+\n+The Security Token Service (STS) is a service running in ${branding} that generates SAML v2.0 assertions.\n+These assertions are then used to authenticate a client allowing them to issue other requests, such as ingests or queries to ${branding} services.\n+\n+The STS is an extension of Apache CXF-STS.\n+It is a SOAP web service that utilizes WS-Trust.\n+The generated SAML assertions contain attributes about a user and is used by the Policy Enforcement Point (PEP) in the secure endpoints.\n+Specific configuration details on the bundles that come with ${branding} can be found on the Security STS application page.\n+This page details all of the STS components that come out of the box with ${branding}, along with configuration options, installation help, and which services they import and export.\n+\n+The STS server contains validators, claim handlers, and token issuers to process incoming requests.\n+When a request is received, the validators first ensure that it is valid.\n+The validators verifies authentication against configured services, such as LDAP, DIAS, PKI.\n+If the request is found to be invalid, the process ends and an error is returned.\n+Next, the claims handlers determine how to handle the request, adding user attributes or properties as configured.\n+The token issuer creates a SAML 2.0 assertion and associates it with the subject.\n+The STS server sends an assertion back to the requestor, which is used in both SOAP and REST cases.\n+\n+===== Using the Security Token Service (STS)\n+\n+The STS can be used to generate SAML v2.0 assertions via a SOAP web service request.\n+Out of the box, the STS supports authentication from existing SAML tokens, CAS proxy tickets, username/password, and x509 certificates.\n+It also supports retrieving claims using LDAP and properties files.\n+\n+===== STS Claims Handlers\n+\n+Claims handlers are classes that convert the incoming user credentials into a set of attribute claims that will be populated in the SAML assertion.\n+An example in action would be the LDAPClaimsHandler that takes in the user's credentials and retrieves the user's attributes from a backend LDAP server.\n+These attributes are then mapped and added to the SAML assertion being created.\n+Integrators and developers can add more claims handlers that can handle other types of external services that store user attributes.\n+\n+====== Add a Custom Claims Handler\n+\n+Develop a custom claims handler to retrieve attributes from an external attribute store.\n+\n+A claim is an additional piece of data about a subject that can be included in a token along with basic token data.\n+A claims manager provides hooks for a developer to plug in claims handlers to ensure that the STS includes the specified claims in the issued token.\n+\n+The following steps define the procedure for adding a custom claims handler to the STS.\n+\n+. The new claims handler must implement the `org.apache.cxf.sts.claims.ClaimsHander` interface.\n++\n+[source,java,linenums]\n+----\n+/**\n+ * Licensed to the Apache Software Foundation (ASF) under one\n+ * or more contributor license agreements. See the NOTICE file\n+ * distributed with this work for additional information\n+ * regarding copyright ownership. The ASF licenses this file\n+ * to you under the Apache License, Version 2.0 (the\n+ * \"License\"); you may not use this file except in compliance\n+ * with the License. You may obtain a copy of the License at\n+ *\n+ * http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing,\n+ * software distributed under the License is distributed on an\n+ * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n+ * KIND, either express or implied. See the License for the\n+ * specific language governing permissions and limitations\n+ * under the License.\n+ */\n+\n+package org.apache.cxf.sts.claims;\n+\n+import java.net.URI;\n+import java.util.List;\n+\n+/**\n+ * This interface provides a pluggable way to handle Claims.\n+ */\n+public interface ClaimsHandler {\n+\n+    List<URI> getSupportedClaimTypes();\n+\n+    ClaimCollection retrieveClaimValues(RequestClaimCollection claims, ClaimsParameters parameters);\n+\n+}\n+----\n++\n+.  Expose the new claims handler as an OSGi service under the `org.apache.cxf.sts.claims.ClaimsHandler` interface.\n++\n+[source,xml,linenums]\n+----\n+<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n+<blueprint xmlns=\"http://www.osgi.org/xmlns/blueprint/v1.0.0\">\n+\n+    <bean id=\"CustomClaimsHandler\" class=\"security.sts.claimsHandler.CustomClaimsHandler\" />\n+\n+    <service ref=\"customClaimsHandler\" interface=\"org.apache.cxf.sts.claims.ClaimsHandler\"/>\n+\n+</blueprint>\n+----\n+. Deploy the bundle.\n+\n+If the new claims handler is hitting an external service that is secured with SSL/TLS, a developer may need to add the root CA of the external site to the ${branding} trustStore and add a valid certificate into the ${branding} keyStore. For more information on certificates, refer to <<Configuring a Java Keystore for Secure Communications>>.\n+\n+===== STS WS-Trust WSDL Document\n+\n+[NOTE]\n+====\n+This XML file is found inside of the STS bundle and is named `ws-trust-1.4-service.wsdl`.\n+====\n+\n+[source,xml,linenums]\n+----\n+<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n+<wsdl:definitions xmlns:tns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/\" xmlns:wstrust=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/\" xmlns:wsdl=\"http://schemas.xmlsoap.org/wsdl/\" xmlns:soap=\"http://schemas.xmlsoap.org/wsdl/soap/\" xmlns:wsap10=\"http://www.w3.org/2006/05/addressing/wsdl\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" xmlns:wsp=\"http://www.w3.org/ns/ws-policy\" xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\" xmlns:xs=\"http://www.w3.org/2001/XMLSchema\" xmlns:wsam=\"http://www.w3.org/2007/05/addressing/metadata\" targetNamespace=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/\">\n+    <wsdl:types>\n+        <xs:schema elementFormDefault=\"qualified\" targetNamespace=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">\n+            <xs:element name=\"RequestSecurityToken\" type=\"wst:AbstractRequestSecurityTokenType\"/>\n+            <xs:element name=\"RequestSecurityTokenResponse\" type=\"wst:AbstractRequestSecurityTokenType\"/>\n+            <xs:complexType name=\"AbstractRequestSecurityTokenType\">\n+                <xs:sequence>\n+                    <xs:any namespace=\"##any\" processContents=\"lax\" minOccurs=\"0\" maxOccurs=\"unbounded\"/>\n+                </xs:sequence>\n+                <xs:attribute name=\"Context\" type=\"xs:anyURI\" use=\"optional\"/>\n+                <xs:anyAttribute namespace=\"##other\" processContents=\"lax\"/>\n+            </xs:complexType>\n+            <xs:element name=\"RequestSecurityTokenCollection\" type=\"wst:RequestSecurityTokenCollectionType\"/>\n+            <xs:complexType name=\"RequestSecurityTokenCollectionType\">\n+                <xs:sequence>\n+                    <xs:element name=\"RequestSecurityToken\" type=\"wst:AbstractRequestSecurityTokenType\" minOccurs=\"2\" maxOccurs=\"unbounded\"/>\n+                </xs:sequence>\n+            </xs:complexType>\n+            <xs:element name=\"RequestSecurityTokenResponseCollection\" type=\"wst:RequestSecurityTokenResponseCollectionType\"/>\n+            <xs:complexType name=\"RequestSecurityTokenResponseCollectionType\">\n+                <xs:sequence>\n+                    <xs:element ref=\"wst:RequestSecurityTokenResponse\" minOccurs=\"1\" maxOccurs=\"unbounded\"/>\n+                </xs:sequence>\n+                <xs:anyAttribute namespace=\"##other\" processContents=\"lax\"/>\n+            </xs:complexType>\n+        </xs:schema>\n+    </wsdl:types>\n+    <!-- WS-Trust defines the following GEDs -->\n+    <wsdl:message name=\"RequestSecurityTokenMsg\">\n+        <wsdl:part name=\"request\" element=\"wst:RequestSecurityToken\"/>\n+    </wsdl:message>\n+    <wsdl:message name=\"RequestSecurityTokenResponseMsg\">\n+        <wsdl:part name=\"response\" element=\"wst:RequestSecurityTokenResponse\"/>\n+    </wsdl:message>\n+    <wsdl:message name=\"RequestSecurityTokenCollectionMsg\">\n+        <wsdl:part name=\"requestCollection\" element=\"wst:RequestSecurityTokenCollection\"/>\n+    </wsdl:message>\n+    <wsdl:message name=\"RequestSecurityTokenResponseCollectionMsg\">\n+        <wsdl:part name=\"responseCollection\" element=\"wst:RequestSecurityTokenResponseCollection\"/>\n+    </wsdl:message>\n+    <!-- This portType an example of a Requestor (or other) endpoint that\n+         Accepts SOAP-based challenges from a Security Token Service -->\n+    <wsdl:portType name=\"WSSecurityRequestor\">\n+        <wsdl:operation name=\"Challenge\">\n+            <wsdl:input message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+            <wsdl:output message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+        </wsdl:operation>\n+    </wsdl:portType>\n+    <!-- This portType is an example of an STS supporting full protocol -->\n+    <wsdl:portType name=\"STS\">\n+        <wsdl:operation name=\"Cancel\">\n+            <wsdl:input wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel\" message=\"tns:RequestSecurityTokenMsg\"/>\n+            <wsdl:output wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/CancelFinal\" message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"Issue\">\n+            <wsdl:input wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue\" message=\"tns:RequestSecurityTokenMsg\"/>\n+            <wsdl:output wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal\" message=\"tns:RequestSecurityTokenResponseCollectionMsg\"/>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"Renew\">\n+            <wsdl:input wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew\" message=\"tns:RequestSecurityTokenMsg\"/>\n+            <wsdl:output wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/RenewFinal\" message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"Validate\">\n+            <wsdl:input wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate\" message=\"tns:RequestSecurityTokenMsg\"/>\n+            <wsdl:output wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/ValidateFinal\" message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"KeyExchangeToken\">\n+            <wsdl:input wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KET\" message=\"tns:RequestSecurityTokenMsg\"/>\n+            <wsdl:output wsam:Action=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/KETFinal\" message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"RequestCollection\">\n+            <wsdl:input message=\"tns:RequestSecurityTokenCollectionMsg\"/>\n+            <wsdl:output message=\"tns:RequestSecurityTokenResponseCollectionMsg\"/>\n+        </wsdl:operation>\n+    </wsdl:portType>\n+    <!-- This portType is an example of an endpoint that accepts\n+         Unsolicited RequestSecurityTokenResponse messages -->\n+    <wsdl:portType name=\"SecurityTokenResponseService\">\n+        <wsdl:operation name=\"RequestSecurityTokenResponse\">\n+            <wsdl:input message=\"tns:RequestSecurityTokenResponseMsg\"/>\n+        </wsdl:operation>\n+    </wsdl:portType>\n+    <wsdl:binding name=\"STS_Binding\" type=\"wstrust:STS\">\n+        <wsp:PolicyReference URI=\"#STS_policy\"/>\n+        <soap:binding style=\"document\" transport=\"http://schemas.xmlsoap.org/soap/http\"/>\n+        <wsdl:operation name=\"Issue\">\n+            <soap:operation soapAction=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue\"/>\n+            <wsdl:input>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:input>\n+            <wsdl:output>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:output>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"Validate\">\n+            <soap:operation soapAction=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Validate\"/>\n+            <wsdl:input>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:input>\n+            <wsdl:output>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:output>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"Cancel\">\n+            <soap:operation soapAction=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Cancel\"/>\n+            <wsdl:input>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:input>\n+            <wsdl:output>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:output>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"Renew\">\n+            <soap:operation soapAction=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Renew\"/>\n+            <wsdl:input>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:input>\n+            <wsdl:output>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:output>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"KeyExchangeToken\">\n+            <soap:operation soapAction=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/KeyExchangeToken\"/>\n+            <wsdl:input>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:input>\n+            <wsdl:output>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:output>\n+        </wsdl:operation>\n+        <wsdl:operation name=\"RequestCollection\">\n+            <soap:operation soapAction=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/RequestCollection\"/>\n+            <wsdl:input>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:input>\n+            <wsdl:output>\n+                <soap:body use=\"literal\"/>\n+            </wsdl:output>\n+        </wsdl:operation>\n+    </wsdl:binding>\n+    <wsp:Policy wsu:Id=\"STS_policy\">\n+        <wsp:ExactlyOne>\n+            <wsp:All>\n+                <wsap10:UsingAddressing/>\n+                <wsp:ExactlyOne>\n+                    <sp:TransportBinding xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                        <wsp:Policy>\n+                            <sp:TransportToken>\n+                                <wsp:Policy>\n+                                    <sp:HttpsToken>\n+                                        <wsp:Policy/>\n+                                    </sp:HttpsToken>\n+                                </wsp:Policy>\n+                            </sp:TransportToken>\n+                            <sp:AlgorithmSuite>\n+                                <wsp:Policy>\n+                                    <sp:Basic128/>\n+                                </wsp:Policy>\n+                            </sp:AlgorithmSuite>\n+                            <sp:Layout>\n+                                <wsp:Policy>\n+                                    <sp:Lax/>\n+                                </wsp:Policy>\n+                            </sp:Layout>\n+                            <sp:IncludeTimestamp/>\n+                        </wsp:Policy>\n+                    </sp:TransportBinding>\n+                </wsp:ExactlyOne>\n+                <sp:Wss11 xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                    <wsp:Policy>\n+                        <sp:MustSupportRefKeyIdentifier/>\n+                        <sp:MustSupportRefIssuerSerial/>\n+                        <sp:MustSupportRefThumbprint/>\n+                        <sp:MustSupportRefEncryptedKey/>\n+                    </wsp:Policy>\n+                </sp:Wss11>\n+                <sp:Trust13 xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                    <wsp:Policy>\n+                        <sp:MustSupportIssuedTokens/>\n+                        <sp:RequireClientEntropy/>\n+                        <sp:RequireServerEntropy/>\n+                    </wsp:Policy>\n+                </sp:Trust13>\n+            </wsp:All>\n+        </wsp:ExactlyOne>\n+    </wsp:Policy>\n+    <wsp:Policy wsu:Id=\"Input_policy\">\n+        <wsp:ExactlyOne>\n+            <wsp:All>\n+                <sp:SignedParts xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                    <sp:Body/>\n+                    <sp:Header Name=\"To\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"From\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"FaultTo\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"ReplyTo\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"MessageID\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"RelatesTo\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"Action\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                </sp:SignedParts>\n+                <sp:EncryptedParts xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                    <sp:Body/>\n+                </sp:EncryptedParts>\n+            </wsp:All>\n+        </wsp:ExactlyOne>\n+    </wsp:Policy>\n+    <wsp:Policy wsu:Id=\"Output_policy\">\n+        <wsp:ExactlyOne>\n+            <wsp:All>\n+                <sp:SignedParts xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                    <sp:Body/>\n+                    <sp:Header Name=\"To\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"From\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"FaultTo\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"ReplyTo\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"MessageID\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"RelatesTo\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                    <sp:Header Name=\"Action\" Namespace=\"http://www.w3.org/2005/08/addressing\"/>\n+                </sp:SignedParts>\n+                <sp:EncryptedParts xmlns:sp=\"http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702\">\n+                    <sp:Body/>\n+                </sp:EncryptedParts>\n+            </wsp:All>\n+        </wsp:ExactlyOne>\n+    </wsp:Policy>\n+    <wsdl:service name=\"SecurityTokenService\">\n+        <wsdl:port name=\"STS_Port\" binding=\"tns:STS_Binding\">\n+            <soap:address location=\"${public_url}/services/SecurityTokenService\"/>\n+        </wsdl:port>\n+    </wsdl:service>\n+</wsdl:definitions>\n+----\n+\n+==== Example Request and Responses for a SAML Assertion\n+\n+A client performs a RequestSecurityToken operation against the STS to receive a SAML assertion.\n+The ${branding} STS offers several different ways to request a SAML assertion.\n+For help in understanding the various request and response formats, samples have been provided.\n+The samples are divided out into different request token types.\n+\n+Most endpoints that have been used in ${branding} require the X.509 PublicKey SAML assertion.\n+\n+==== BinarySecurityToken (CAS) SAML Security Token Request/Response\n+\n+===== BinarySecurityToken (CAS) Sample Request/Response\n+\n+====== Request\n+\n+.Sample Request\n+[source,xml,linenums]\n+----\n+<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n+    <soap:Header>\n+        <Action xmlns=\"http://www.w3.org/2005/08/addressing\">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</Action>\n+        <MessageID xmlns=\"http://www.w3.org/2005/08/addressing\">urn:uuid:60652909-faca-4e4a-a4a7-8a5ce243a7cb</MessageID>\n+        <To xmlns=\"http://www.w3.org/2005/08/addressing\">https://server:8993/services/SecurityTokenService</To>\n+        <ReplyTo xmlns=\"http://www.w3.org/2005/08/addressing\">\n+            <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>\n+        </ReplyTo>\n+        <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" soap:mustUnderstand=\"1\">\n+            <wsu:Timestamp wsu:Id=\"TS-1\">\n+                <wsu:Created>2013-04-29T18:35:10.688Z</wsu:Created>\n+                <wsu:Expires>2013-04-29T18:40:10.688Z</wsu:Expires>\n+            </wsu:Timestamp>\n+        </wsse:Security>\n+    </soap:Header>\n+    <soap:Body>\n+        <wst:RequestSecurityToken xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">\n+            <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>\n+            <wsp:AppliesTo xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\">\n+                <wsa:EndpointReference xmlns:wsa=\"http://www.w3.org/2005/08/addressing\">\n+                    <wsa:Address>https://server:8993/services/SecurityTokenService</wsa:Address>\n+                </wsa:EndpointReference>\n+            </wsp:AppliesTo>\n+            <wst:Claims xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\" Dialect=\"http://schemas.xmlsoap.org/ws/2005/05/identity\">\n+                <ic:ClaimType xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier\"/>\n+                <ic:ClaimType xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"/>\n+                <ic:ClaimType xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\"/>\n+                <ic:ClaimType xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\"/>\n+                <ic:ClaimType xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role\"/>\n+            </wst:Claims>\n+            <wst:OnBehalfOf>\n+                <BinarySecurityToken ValueType=\"#CAS\" EncodingType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary\" ns1:Id=\"CAS\" xmlns=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:ns1=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\">U1QtMTQtYUtmcDYxcFRtS0FxZG1pVDMzOWMtY2FzfGh0dHBzOi8vdG9rZW5pc3N1ZXI6ODk5My9zZXJ2aWNlcy9TZWN1cml0eVRva2VuU2VydmljZQ==</BinarySecurityToken>\n+            </wst:OnBehalfOf>\n+            <wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</wst:TokenType>\n+            <wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</wst:KeyType>\n+            <wst:UseKey>\n+                <ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n+                    <ds:X509Data>\n+                        <ds:X509Certificate>\n+MIIC5DCCAk2gAwIBAgIJAKj7ROPHjo1yMA0GCSqGSIb3DQEBCwUAMIGKMQswCQYDVQQGEwJVUzEQ\n+MA4GA1UECAwHQXJpem9uYTERMA8GA1UEBwwIR29vZHllYXIxGDAWBgNVBAoMD0xvY2toZWVkIE1h\n+cnRpbjENMAsGA1UECwwESTRDRTEPMA0GA1UEAwwGY2xpZW50MRwwGgYJKoZIhvcNAQkBFg1pNGNl\n+QGxtY28uY29tMB4XDTEyMDYyMDE5NDMwOVoXDTIyMDYxODE5NDMwOVowgYoxCzAJBgNVBAYTAlVT\n+MRAwDgYDVQQIDAdBcml6b25hMREwDwYDVQQHDAhHb29keWVhcjEYMBYGA1UECgwPTG9ja2hlZWQg\n+TWFydGluMQ0wCwYDVQQLDARJNENFMQ8wDQYDVQQDDAZjbGllbnQxHDAaBgkqhkiG9w0BCQEWDWk0\n+Y2VAbG1jby5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIpHxCBLYE7xfDLcITS9SsPG\n+4Q04Z6S32/+TriGsRgpGTj/7GuMG7oJ98m6Ws5cTYl7nyunyHTkZuP7rBzy4esDIHheyx18EgdSJ\n+vvACgGVCnEmHndkf9bWUlAOfNaxW+vZwljUkRUVdkhPbPdPwOcMdKg/SsLSNjZfsQIjoWd4rAgMB\n+AAGjUDBOMB0GA1UdDgQWBBQx11VLtYXLvFGpFdHnhlNW9+lxBDAfBgNVHSMEGDAWgBQx11VLtYXL\n+vFGpFdHnhlNW9+lxBDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAHYs2OI0K6yVXzyS\n+sKcv2fmfw6XCICGTnyA7BOdAjYoqq6wD+33dHJUCFDqye7AWdcivuc7RWJt9jnlfJZKIm2BHcDTR\n+Hhk6CvjJ14Gf40WQdeMHoX8U8b0diq7Iy5Ravx+zRg7SdiyJUqFYjRh/O5tywXRT1+freI3bwAN0\n+L6tQ\n+</ds:X509Certificate>\n+                    </ds:X509Data>\n+                </ds:KeyInfo>\n+            </wst:UseKey>\n+            <wst:Renewing/>\n+        </wst:RequestSecurityToken>\n+    </soap:Body>\n+</soap:Envelope>\n+----\n+\n+====== Response\n+\n+.Sample Response\n+[source,xml,linenums]\n+----\n+<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n+    <soap:Header>\n+        <Action xmlns=\"http://www.w3.org/2005/08/addressing\">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal</Action>\n+        <MessageID xmlns=\"http://www.w3.org/2005/08/addressing\">urn:uuid:7a6fde04-9013-41ef-b08b-0689ffa9c93e</MessageID>\n+        <To xmlns=\"http://www.w3.org/2005/08/addressing\">http://www.w3.org/2005/08/addressing/anonymous</To>\n+        <RelatesTo xmlns=\"http://www.w3.org/2005/08/addressing\">urn:uuid:60652909-faca-4e4a-a4a7-8a5ce243a7cb</RelatesTo>\n+        <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" soap:mustUnderstand=\"1\">\n+            <wsu:Timestamp wsu:Id=\"TS-2\">\n+                <wsu:Created>2013-04-29T18:35:11.459Z</wsu:Created>\n+                <wsu:Expires>2013-04-29T18:40:11.459Z</wsu:Expires>\n+            </wsu:Timestamp>\n+        </wsse:Security>\n+    </soap:Header>\n+    <soap:Body>\n+        <RequestSecurityTokenResponseCollection xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\" xmlns:ns2=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" xmlns:ns3=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:ns4=\"http://www.w3.org/2005/08/addressing\" xmlns:ns5=\"http://docs.oasis-open.org/ws-sx/ws-trust/200802\">\n+            <RequestSecurityTokenResponse>\n+                <TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</TokenType>\n+                <RequestedSecurityToken>\n+                    <saml2:Assertion xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:xs=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" ID=\"_BDC44EB8593F47D1B213672605113671\" IssueInstant=\"2013-04-29T18:35:11.370Z\" Version=\"2.0\" xsi:type=\"saml2:AssertionType\">\n+                        <saml2:Issuer>tokenissuer</saml2:Issuer>\n+                        <ds:Signature xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n+                            <ds:SignedInfo>\n+                                <ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\n+                                <ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/>\n+                                <ds:Reference URI=\"#_BDC44EB8593F47D1B213672605113671\">\n+                                    <ds:Transforms>\n+                                        <ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"/>\n+                                        <ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\">\n+                                            <ec:InclusiveNamespaces xmlns:ec=\"http://www.w3.org/2001/10/xml-exc-c14n#\" PrefixList=\"xs\"/>\n+                                        </ds:Transform>\n+                                    </ds:Transforms>\n+                                    <ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"/>\n+                                    <ds:DigestValue>6wnWbft6Pz5XOF5Q9AG59gcGwLY=</ds:DigestValue>\n+                                </ds:Reference>\n+                            </ds:SignedInfo>\n+                            <ds:SignatureValue>h+NvkgXGdQtca3/eKebhAKgG38tHp3i2n5uLLy8xXXIg02qyKgEP0FCowp2LiYlsQU9YjKfSwCUbH3WR6jhbAv9zj29CE+ePfEny7MeXvgNl3wId+vcHqti/DGGhhgtO2Mbx/tyX1BhHQUwKRlcHajxHeecwmvV7D85NMdV48tI=</ds:SignatureValue>\n+                            <ds:KeyInfo>\n+                                <ds:X509Data>\n+                                    <ds:X509Certificate>MIIDmjCCAwOgAwIBAgIBBDANBgkqhkiG9w0BAQQFADB1MQswCQYDVQQGEwJVUzEQMA4GA1UECBMH\n+QXJpem9uYTERMA8GA1UEBxMIR29vZHllYXIxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNVBAoTB0V4\n+YW1wbGUxEDAOBgNVBAsTB0V4YW1wbGUxCzAJBgNVBAMTAkNBMB4XDTEzMDQwOTE4MzcxMVoXDTIz\n+MDQwNzE4MzcxMVowgaYxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMREwDwYDVQQHEwhH\n+b29keWVhcjEQMA4GA1UEChMHRXhhbXBsZTEQMA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHRXhh\n+bXBsZTEUMBIGA1UEAxMLdG9rZW5pc3N1ZXIxJjAkBgkqhkiG9w0BCQEWF3Rva2VuaXNzdWVyQGV4\n+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDfktpA8Lrp9rTfRibKdgtxtN9\n+uB44diiIqq3JOzDGfDhGLu6mjpuHO1hrKItv42hBOhhmH7lS9ipiaQCIpVfgIG63MB7fa5dBrfGF\n+G69vFrU1Lfi7IvsVVsNrtAEQljOMmw9sxS3SUsRQX+bD8jq7Uj1hpoF7DdqpV8Kb0COOGwIDAQAB\n+o4IBBjCCAQIwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy\n+dGlmaWNhdGUwHQYDVR0OBBYEFD1mHviop2Tc4HaNu8yPXR6GqWP1MIGnBgNVHSMEgZ8wgZyAFBcn\n+en6/j05DzaVwORwrteKc7TZOoXmkdzB1MQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTER\n+MA8GA1UEBxMIR29vZHllYXIxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNVBAoTB0V4YW1wbGUxEDAO\n+BgNVBAsTB0V4YW1wbGUxCzAJBgNVBAMTAkNBggkAwXk7OcwO7gwwDQYJKoZIhvcNAQEEBQADgYEA\n+PiTX5kYXwdhmijutSkrObKpRbQkvkkzcyZlO6VrAxRQ+eFeN6NyuyhgYy5K6l/sIWdaGou5iJOQx\n+2pQYWx1v8Klyl0W22IfEAXYv/epiO89hpdACryuDJpioXI/X8TAwvRwLKL21Dk3k2b+eyCgA0O++\n+HM0dPfiQLQ99ElWkv/0=</ds:X509Certificate>\n+                                </ds:X509Data>\n+                            </ds:KeyInfo>\n+                        </ds:Signature>\n+                        <saml2:Subject>\n+                            <saml2:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\" NameQualifier=\"http://cxf.apache.org/sts\">srogers</saml2:NameID>\n+                            <saml2:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:holder-of-key\">\n+                                <saml2:SubjectConfirmationData xsi:type=\"saml2:KeyInfoConfirmationDataType\">\n+                                    <ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n+                                        <ds:X509Data>\n+                                            <ds:X509Certificate>MIIC5DCCAk2gAwIBAgIJAKj7ROPHjo1yMA0GCSqGSIb3DQEBCwUAMIGKMQswCQYDVQQGEwJVUzEQ\n+MA4GA1UECAwHQXJpem9uYTERMA8GA1UEBwwIR29vZHllYXIxGDAWBgNVBAoMD0xvY2toZWVkIE1h\n+cnRpbjENMAsGA1UECwwESTRDRTEPMA0GA1UEAwwGY2xpZW50MRwwGgYJKoZIhvcNAQkBFg1pNGNl\n+QGxtY28uY29tMB4XDTEyMDYyMDE5NDMwOVoXDTIyMDYxODE5NDMwOVowgYoxCzAJBgNVBAYTAlVT\n+MRAwDgYDVQQIDAdBcml6b25hMREwDwYDVQQHDAhHb29keWVhcjEYMBYGA1UECgwPTG9ja2hlZWQg\n+TWFydGluMQ0wCwYDVQQLDARJNENFMQ8wDQYDVQQDDAZjbGllbnQxHDAaBgkqhkiG9w0BCQEWDWk0\n+Y2VAbG1jby5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIpHxCBLYE7xfDLcITS9SsPG\n+4Q04Z6S32/+TriGsRgpGTj/7GuMG7oJ98m6Ws5cTYl7nyunyHTkZuP7rBzy4esDIHheyx18EgdSJ\n+vvACgGVCnEmHndkf9bWUlAOfNaxW+vZwljUkRUVdkhPbPdPwOcMdKg/SsLSNjZfsQIjoWd4rAgMB\n+AAGjUDBOMB0GA1UdDgQWBBQx11VLtYXLvFGpFdHnhlNW9+lxBDAfBgNVHSMEGDAWgBQx11VLtYXL\n+vFGpFdHnhlNW9+lxBDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAHYs2OI0K6yVXzyS\n+sKcv2fmfw6XCICGTnyA7BOdAjYoqq6wD+33dHJUCFDqye7AWdcivuc7RWJt9jnlfJZKIm2BHcDTR\n+Hhk6CvjJ14Gf40WQdeMHoX8U8b0diq7Iy5Ravx+zRg7SdiyJUqFYjRh/O5tywXRT1+freI3bwAN0\n+L6tQ</ds:X509Certificate>\n+                                        </ds:X509Data>\n+                                    </ds:KeyInfo>\n+                                </saml2:SubjectConfirmationData>\n+                            </saml2:SubjectConfirmation>\n+                        </saml2:Subject>\n+                        <saml2:Conditions NotBefore=\"2013-04-29T18:35:11.407Z\" NotOnOrAfter=\"2013-04-29T19:05:11.407Z\">\n+                            <saml2:AudienceRestriction>\n+                                <saml2:Audience>https://server:8993/services/SecurityTokenService</saml2:Audience>\n+                            </saml2:AudienceRestriction>\n+                        </saml2:Conditions>\n+                        <saml2:AuthnStatement AuthnInstant=\"2013-04-29T18:35:11.392Z\">\n+                            <saml2:AuthnContext>\n+                                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>\n+                            </saml2:AuthnContext>\n+                        </saml2:AuthnStatement>\n+                        <saml2:AttributeStatement>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">srogers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">srogers@example.com</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">srogers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">Steve Rogers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">avengers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">admin</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                        </saml2:AttributeStatement>\n+                    </saml2:Assertion>\n+                </RequestedSecurityToken>\n+                <RequestedAttachedReference>\n+                    <ns3:SecurityTokenReference xmlns:wsse11=\"http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd\" wsse11:TokenType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0\">\n+                        <ns3:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID\">_BDC44EB8593F47D1B213672605113671</ns3:KeyIdentifier>\n+                    </ns3:SecurityTokenReference>\n+                </RequestedAttachedReference>\n+                <RequestedUnattachedReference>\n+                    <ns3:SecurityTokenReference xmlns:wsse11=\"http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd\" wsse11:TokenType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0\">\n+                        <ns3:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID\">_BDC44EB8593F47D1B213672605113671</ns3:KeyIdentifier>\n+                    </ns3:SecurityTokenReference>\n+                </RequestedUnattachedReference>\n+                <wsp:AppliesTo xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\" xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">\n+                    <wsa:EndpointReference xmlns:wsa=\"http://www.w3.org/2005/08/addressing\">\n+                        <wsa:Address>https://server:8993/services/SecurityTokenService</wsa:Address>\n+                    </wsa:EndpointReference>\n+                </wsp:AppliesTo>\n+                <Lifetime>\n+                    <ns2:Created>2013-04-29T18:35:11.444Z</ns2:Created>\n+                    <ns2:Expires>2013-04-29T19:05:11.444Z</ns2:Expires>\n+                </Lifetime>\n+            </RequestSecurityTokenResponse>\n+        </RequestSecurityTokenResponseCollection>\n+    </soap:Body>\n+</soap:Envelope>\n+----\n+\n+===== UsernameToken Bearer SAML Security Token Request/Response\n+\n+To obtain a SAML assertion to use in secure communication to ${branding}, a RequestSecurityToken (RST) request has to be made to the STS.\n+\n+A Bearer SAML assertion is automatically trusted by the endpoint.\n+The client doesn't have to prove it can own that SAML assertion.\n+It is the simplest way to request a SAML assertion, but many endpoints won't accept a KeyType of Bearer.\n+\n+====== Request\n+\n+*Explanation*\n+\n+* WS-Addressing header with Action, To, and Message ID\n+* Valid, non-expired timestamp\n+* Username Token containing a username and password that the STS will authenticate\n+* Issued over HTTPS\n+* KeyType of http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer\n+* Claims (optional): Some endpoints may require that the SAML assertion include attributes of the user, such as an authenticated user's role, name identifier, email address, etc. If the SAML assertion needs those attributes, the `RequestSecurityToken` must specify which ones to include.\n+\n+.Sample Request\n+[source,xml,linenums]\n+----\n+<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n+    <soap:Header xmlns:wsa=\"http://www.w3.org/2005/08/addressing\">\n+        <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" soap:mustUnderstand=\"1\">\n+            <wsu:Timestamp wsu:Id=\"TS-1\">\n+                <wsu:Created>2013-04-29T17:47:37.817Z</wsu:Created>\n+                <wsu:Expires>2013-04-29T17:57:37.817Z</wsu:Expires>\n+            </wsu:Timestamp>\n+            <wsse:UsernameToken wsu:Id=\"UsernameToken-1\">\n+                <wsse:Username>srogers</wsse:Username>\n+                <wsse:Password Type=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText\">password1</wsse:Password>\n+            </wsse:UsernameToken>\n+        </wsse:Security>\n+        <wsa:Action>http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</wsa:Action>\n+        <wsa:MessageID>uuid:a1bba87b-0f00-46cc-975f-001391658cbe</wsa:MessageID>\n+        <wsa:To>https://server:8993/services/SecurityTokenService</wsa:To>\n+    </soap:Header>\n+    <soap:Body>\n+        <wst:RequestSecurityToken xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">\n+            <wst:SecondaryParameters>\n+                <t:TokenType xmlns:t=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType>\n+                <t:KeyType xmlns:t=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</t:KeyType>\n+                <t:Claims xmlns:ic=\"http://schemas.xmlsoap.org/ws/2005/05/identity\" xmlns:t=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\" Dialect=\"http://schemas.xmlsoap.org/ws/2005/05/identity\">\n+                    <!--Add any additional claims you want to grab for the service-->\n+                    <ic:ClaimType Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uid\"/>\n+                    <ic:ClaimType Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role\"/>\n+                    <ic:ClaimType Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier\"/>\n+                    <ic:ClaimType Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\"/>\n+                    <ic:ClaimType Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\"/>\n+                    <ic:ClaimType Optional=\"true\" Uri=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\"/>\n+                </t:Claims>\n+            </wst:SecondaryParameters>\n+            <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>\n+            <wsp:AppliesTo xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\">\n+                <wsa:EndpointReference xmlns:wsa=\"http://www.w3.org/2005/08/addressing\">\n+                    <wsa:Address>https://server:8993/services/QueryService</wsa:Address>\n+                </wsa:EndpointReference>\n+            </wsp:AppliesTo>\n+            <wst:Renewing/>\n+        </wst:RequestSecurityToken>\n+    </soap:Body>\n+</soap:Envelope>\n+----\n+\n+====== Response\n+\n+This is the response from the STS containing the SAML assertion to be used in subsequent requests to QCRUD endpoints:\n+\n+The `saml2:Assertion` block contains the entire SAML assertion.\n+\n+The `Signature` block contains a signature from the STS's private key.\n+The endpoint receiving the SAML assertion will verify that it trusts the signer and ensure that the message wasn't tampered with.\n+\n+The `AttributeStatement` block contains all the Claims requested.\n+\n+The `Lifetime` block indicates the valid time interval in which the SAML assertion can be used.\n+\n+.Sample Response\n+[source,xml,linenums]\n+----\n+<soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">\n+    <soap:Header>\n+        <Action xmlns=\"http://www.w3.org/2005/08/addressing\">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal</Action>\n+        <MessageID xmlns=\"http://www.w3.org/2005/08/addressing\">urn:uuid:eee4c6ef-ac10-4cbc-a53c-13d960e3b6e8</MessageID>\n+        <To xmlns=\"http://www.w3.org/2005/08/addressing\">http://www.w3.org/2005/08/addressing/anonymous</To>\n+        <RelatesTo xmlns=\"http://www.w3.org/2005/08/addressing\">uuid:a1bba87b-0f00-46cc-975f-001391658cbe</RelatesTo>\n+        <wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" soap:mustUnderstand=\"1\">\n+            <wsu:Timestamp wsu:Id=\"TS-2\">\n+                <wsu:Created>2013-04-29T17:49:12.624Z</wsu:Created>\n+                <wsu:Expires>2013-04-29T17:54:12.624Z</wsu:Expires>\n+            </wsu:Timestamp>\n+        </wsse:Security>\n+    </soap:Header>\n+    <soap:Body>\n+        <RequestSecurityTokenResponseCollection xmlns=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\" xmlns:ns2=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" xmlns:ns3=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" xmlns:ns4=\"http://www.w3.org/2005/08/addressing\" xmlns:ns5=\"http://docs.oasis-open.org/ws-sx/ws-trust/200802\">\n+            <RequestSecurityTokenResponse>\n+                <TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</TokenType>\n+                <RequestedSecurityToken>\n+                    <saml2:Assertion xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:xs=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" ID=\"_7437C1A55F19AFF22113672577526132\" IssueInstant=\"2013-04-29T17:49:12.613Z\" Version=\"2.0\" xsi:type=\"saml2:AssertionType\">\n+                        <saml2:Issuer>tokenissuer</saml2:Issuer>\n+                        <ds:Signature xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n+                            <ds:SignedInfo>\n+                                <ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>\n+                                <ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"/>\n+                                <ds:Reference URI=\"#_7437C1A55F19AFF22113672577526132\">\n+                                    <ds:Transforms>\n+                                        <ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"/>\n+                                        <ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\">\n+                                            <ec:InclusiveNamespaces xmlns:ec=\"http://www.w3.org/2001/10/xml-exc-c14n#\" PrefixList=\"xs\"/>\n+                                        </ds:Transform>\n+                                    </ds:Transforms>\n+                                    <ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"/>\n+                                    <ds:DigestValue>ReOqEbGZlyplW5kqiynXOjPnVEA=</ds:DigestValue>\n+                                </ds:Reference>\n+                            </ds:SignedInfo>\n+                            <ds:SignatureValue>X5Kzd54PrKIlGVV2XxzCmWFRzHRoybF7hU6zxbEhSLMR0AWS9R7Me3epq91XqeOwvIDDbwmE/oJNC7vI0fIw/rqXkx4aZsY5a5nbAs7f+aXF9TGdk82x2eNhNGYpViq0YZJfsJ5WSyMtG8w5nRekmDMy9oTLsHG+Y/OhJDEwq58=</ds:SignatureValue>\n+                            <ds:KeyInfo>\n+                                <ds:X509Data>\n+                                    <ds:X509Certificate>MIIDmjCCAwOgAwIBAgIBBDANBgkqhkiG9w0BAQQFADB1MQswCQYDVQQGEwJVUzEQMA4GA1UECBMH\n+QXJpem9uYTERMA8GA1UEBxMIR29vZHllYXIxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNVBAoTB0V4\n+YW1wbGUxEDAOBgNVBAsTB0V4YW1wbGUxCzAJBgNVBAMTAkNBMB4XDTEzMDQwOTE4MzcxMVoXDTIz\n+MDQwNzE4MzcxMVowgaYxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMREwDwYDVQQHEwhH\n+b29keWVhcjEQMA4GA1UEChMHRXhhbXBsZTEQMA4GA1UEChMHRXhhbXBsZTEQMA4GA1UECxMHRXhh\n+bXBsZTEUMBIGA1UEAxMLdG9rZW5pc3N1ZXIxJjAkBgkqhkiG9w0BCQEWF3Rva2VuaXNzdWVyQGV4\n+YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDDfktpA8Lrp9rTfRibKdgtxtN9\n+uB44diiIqq3JOzDGfDhGLu6mjpuHO1hrKItv42hBOhhmH7lS9ipiaQCIpVfgIG63MB7fa5dBrfGF\n+G69vFrU1Lfi7IvsVVsNrtAEQljOMmw9sxS3SUsRQX+bD8jq7Uj1hpoF7DdqpV8Kb0COOGwIDAQAB\n+o4IBBjCCAQIwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2Vy\n+dGlmaWNhdGUwHQYDVR0OBBYEFD1mHviop2Tc4HaNu8yPXR6GqWP1MIGnBgNVHSMEgZ8wgZyAFBcn\n+en6/j05DzaVwORwrteKc7TZOoXmkdzB1MQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTER\n+MA8GA1UEBxMIR29vZHllYXIxEDAOBgNVBAoTB0V4YW1wbGUxEDAOBgNVBAoTB0V4YW1wbGUxEDAO\n+BgNVBAsTB0V4YW1wbGUxCzAJBgNVBAMTAkNBggkAwXk7OcwO7gwwDQYJKoZIhvcNAQEEBQADgYEA\n+PiTX5kYXwdhmijutSkrObKpRbQkvkkzcyZlO6VrAxRQ+eFeN6NyuyhgYy5K6l/sIWdaGou5iJOQx\n+2pQYWx1v8Klyl0W22IfEAXYv/epiO89hpdACryuDJpioXI/X8TAwvRwLKL21Dk3k2b+eyCgA0O++\n+HM0dPfiQLQ99ElWkv/0=</ds:X509Certificate>\n+                                </ds:X509Data>\n+                            </ds:KeyInfo>\n+                        </ds:Signature>\n+                        <saml2:Subject>\n+                            <saml2:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\" NameQualifier=\"http://cxf.apache.org/sts\">srogers</saml2:NameID>\n+                            <saml2:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\"/>\n+                        </saml2:Subject>\n+                        <saml2:Conditions NotBefore=\"2013-04-29T17:49:12.614Z\" NotOnOrAfter=\"2013-04-29T18:19:12.614Z\">\n+                            <saml2:AudienceRestriction>\n+                                <saml2:Audience>https://server:8993/services/QueryService</saml2:Audience>\n+                            </saml2:AudienceRestriction>\n+                        </saml2:Conditions>\n+                        <saml2:AuthnStatement AuthnInstant=\"2013-04-29T17:49:12.613Z\">\n+                            <saml2:AuthnContext>\n+                                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>\n+                            </saml2:AuthnContext>\n+                        </saml2:AuthnStatement>\n+                        <saml2:AttributeStatement>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">srogers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">srogers@example.com</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">srogers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">Steve Rogers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">avengers</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                            <saml2:Attribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role\" NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\">\n+                                <saml2:AttributeValue xsi:type=\"xs:string\">admin</saml2:AttributeValue>\n+                            </saml2:Attribute>\n+                        </saml2:AttributeStatement>\n+                    </saml2:Assertion>\n+                </RequestedSecurityToken>\n+                <RequestedAttachedReference>\n+                    <ns3:SecurityTokenReference xmlns:wsse11=\"http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd\" wsse11:TokenType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0\">\n+                        <ns3:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID\">_7437C1A55F19AFF22113672577526132</ns3:KeyIdentifier>\n+                    </ns3:SecurityTokenReference>\n+                </RequestedAttachedReference>\n+                <RequestedUnattachedReference>\n+                    <ns3:SecurityTokenReference xmlns:wsse11=\"http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd\" wsse11:TokenType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0\">\n+                        <ns3:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID\">_7437C1A55F19AFF22113672577526132</ns3:KeyIdentifier>\n+                    </ns3:SecurityTokenReference>\n+                </RequestedUnattachedReference>\n+                <wsp:AppliesTo xmlns:wsp=\"http://schemas.xmlsoap.org/ws/2004/09/policy\" xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\">\n+                    <wsa:EndpointReference xmlns:wsa=\"http://www.w3.org/2005/08/addressing\">\n+                        <wsa:Address>https://server:8993/services/QueryService</wsa:Address>\n+                    </wsa:EndpointReference>\n+                </wsp:AppliesTo>\n+                <Lifetime>\n+                    <ns2:Created>2013-04-29T17:49:12.620Z</ns2:Created>\n+                    <ns2:Expires>2013-04-29T18:19:12.620Z</ns2:Expires>\n+                </Lifetime>\n+            </RequestSecurityTokenResponse>\n+        </RequestSecurityTokenResponseCollection>\n+    </soap:Body>\n+</soap:Envelope>\n+----\n+\n+===== X.509 PublicKey SAML Security Token Request/Response\n+\n+In order to obtain a SAML assertion to use in secure communication to ${branding}, a `RequestSecurityToken` (RST) request has to be made to the STS.\n+\n+An endpoint's policy will specify the type of security token needed.\n+Most of the endpoints that have been used with ${branding} require a SAML v2.0 assertion with a required KeyType of http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey.\n+This means that the SAML assertion provided by the client to a ${branding} endpoint must contain a SubjectConfirmation block with a type of \"holder-of-key\" containing the client's public key.\n+This is used to prove that the client can possess the SAML assertion returned by the STS.\n+\n+====== Request\n+\n+*Explanation*","path":"distribution/docs/src/main/resources/_contents/_security-framework/security-rest-intro-contents.adoc","position":933,"original_position":933,"commit_id":"6dfd7230260d318d31a87edf5f2da09570458b15","original_commit_id":"6dfd7230260d318d31a87edf5f2da09570458b15","user":{"login":"shaundmorris","id":4359166,"avatar_url":"https://avatars.githubusercontent.com/u/4359166?v=3","gravatar_id":"","url":"https://api.github.com/users/shaundmorris","html_url":"https://github.com/shaundmorris","followers_url":"https://api.github.com/users/shaundmorris/followers","following_url":"https://api.github.com/users/shaundmorris/following{/other_user}","gists_url":"https://api.github.com/users/shaundmorris/gists{/gist_id}","starred_url":"https://api.github.com/users/shaundmorris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaundmorris/subscriptions","organizations_url":"https://api.github.com/users/shaundmorris/orgs","repos_url":"https://api.github.com/users/shaundmorris/repos","events_url":"https://api.github.com/users/shaundmorris/events{/privacy}","received_events_url":"https://api.github.com/users/shaundmorris/received_events","type":"User","site_admin":false},"body":"We should follow consistent formatting on `Explanation`. It was on a separate line here: https://github.com/codice/ddf/pull/1244/files#diff-347609d2d90dc52edb78eadf411c6d73R732","created_at":"2016-10-05T22:32:39Z","updated_at":"2016-10-05T22:55:02Z","html_url":"https://github.com/codice/ddf/pull/1244#discussion_r82085394","pull_request_url":"https://api.github.com/repos/codice/ddf/pulls/1244","_links":{"self":{"href":"https://api.github.com/repos/codice/ddf/pulls/comments/82085394"},"html":{"href":"https://github.com/codice/ddf/pull/1244#discussion_r82085394"},"pull_request":{"href":"https://api.github.com/repos/codice/ddf/pulls/1244"}}},"pull_request":{"url":"https://api.github.com/repos/codice/ddf/pulls/1244","id":84384370,"html_url":"https://github.com/codice/ddf/pull/1244","diff_url":"https://github.com/codice/ddf/pull/1244.diff","patch_url":"https://github.com/codice/ddf/pull/1244.patch","issue_url":"https://api.github.com/repos/codice/ddf/issues/1244","number":1244,"state":"open","locked":false,"title":"Ddf 2403 Added security framework to integrator docs","user":{"login":"ricklarsen","id":10619999,"avatar_url":"https://avatars.githubusercontent.com/u/10619999?v=3","gravatar_id":"","url":"https://api.github.com/users/ricklarsen","html_url":"https://github.com/ricklarsen","followers_url":"https://api.github.com/users/ricklarsen/followers","following_url":"https://api.github.com/users/ricklarsen/following{/other_user}","gists_url":"https://api.github.com/users/ricklarsen/gists{/gist_id}","starred_url":"https://api.github.com/users/ricklarsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricklarsen/subscriptions","organizations_url":"https://api.github.com/users/ricklarsen/orgs","repos_url":"https://api.github.com/users/ricklarsen/repos","events_url":"https://api.github.com/users/ricklarsen/events{/privacy}","received_events_url":"https://api.github.com/users/ricklarsen/received_events","type":"User","site_admin":false},"body":"#### What does this PR do?\r\n\r\nAdds integrator-focused docs on the security framework. \r\n\r\n#### Who is reviewing it?\r\n\r\n@ryeats @troymohl @brendan-hofmann @harrison-tarr \r\n\r\n#### Choose 2 committers to review/merge the PR.\r\n@pklinef\r\n@shaundmorris\r\n@stustison\r\n#### How should this be tested?\r\n\r\ndocs render correctly, build passes, info complete & up-to-date.\r\n\r\n#### Any background context you want to provide?\r\n\r\nsub task of https://codice.atlassian.net/browse/DDF-2309\r\n\r\n#### What are the relevant tickets?\r\n\r\nhttps://codice.atlassian.net/browse/DDF-2309\r\nhttps://codice.atlassian.net/browse/DDF-2403\r\n\r\n#### Screenshots (if appropriate)\r\n\r\n[draft-documentation.pdf](https://github.com/codice/ddf/files/460460/draft-documentation.pdf)\r\n\r\n\r\n#### Checklist:\r\n- [x] Documentation Updated\r\n- [ ] Update / Add Unit Tests\r\n- [ ] Update / Add Integration Tests\r\n","created_at":"2016-09-07T22:22:49Z","updated_at":"2016-10-05T22:55:02Z","closed_at":null,"merged_at":null,"merge_commit_sha":"eb933db3158a6b2d2ddbdd777a84a36414eecb7e","assignee":{"login":"pklinef","id":700518,"avatar_url":"https://avatars.githubusercontent.com/u/700518?v=3","gravatar_id":"","url":"https://api.github.com/users/pklinef","html_url":"https://github.com/pklinef","followers_url":"https://api.github.com/users/pklinef/followers","following_url":"https://api.github.com/users/pklinef/following{/other_user}","gists_url":"https://api.github.com/users/pklinef/gists{/gist_id}","starred_url":"https://api.github.com/users/pklinef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pklinef/subscriptions","organizations_url":"https://api.github.com/users/pklinef/orgs","repos_url":"https://api.github.com/users/pklinef/repos","events_url":"https://api.github.com/users/pklinef/events{/privacy}","received_events_url":"https://api.github.com/users/pklinef/received_events","type":"User","site_admin":false},"assignees":[{"login":"pklinef","id":700518,"avatar_url":"https://avatars.githubusercontent.com/u/700518?v=3","gravatar_id":"","url":"https://api.github.com/users/pklinef","html_url":"https://github.com/pklinef","followers_url":"https://api.github.com/users/pklinef/followers","following_url":"https://api.github.com/users/pklinef/following{/other_user}","gists_url":"https://api.github.com/users/pklinef/gists{/gist_id}","starred_url":"https://api.github.com/users/pklinef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pklinef/subscriptions","organizations_url":"https://api.github.com/users/pklinef/orgs","repos_url":"https://api.github.com/users/pklinef/repos","events_url":"https://api.github.com/users/pklinef/events{/privacy}","received_events_url":"https://api.github.com/users/pklinef/received_events","type":"User","site_admin":false},{"login":"shaundmorris","id":4359166,"avatar_url":"https://avatars.githubusercontent.com/u/4359166?v=3","gravatar_id":"","url":"https://api.github.com/users/shaundmorris","html_url":"https://github.com/shaundmorris","followers_url":"https://api.github.com/users/shaundmorris/followers","following_url":"https://api.github.com/users/shaundmorris/following{/other_user}","gists_url":"https://api.github.com/users/shaundmorris/gists{/gist_id}","starred_url":"https://api.github.com/users/shaundmorris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shaundmorris/subscriptions","organizations_url":"https://api.github.com/users/shaundmorris/orgs","repos_url":"https://api.github.com/users/shaundmorris/repos","events_url":"https://api.github.com/users/shaundmorris/events{/privacy}","received_events_url":"https://api.github.com/users/shaundmorris/received_events","type":"User","site_admin":false},{"login":"stustison","id":4391679,"avatar_url":"https://avatars.githubusercontent.com/u/4391679?v=3","gravatar_id":"","url":"https://api.github.com/users/stustison","html_url":"https://github.com/stustison","followers_url":"https://api.github.com/users/stustison/followers","following_url":"https://api.github.com/users/stustison/following{/other_user}","gists_url":"https://api.github.com/users/stustison/gists{/gist_id}","starred_url":"https://api.github.com/users/stustison/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stustison/subscriptions","organizations_url":"https://api.github.com/users/stustison/orgs","repos_url":"https://api.github.com/users/stustison/repos","events_url":"https://api.github.com/users/stustison/events{/privacy}","received_events_url":"https://api.github.com/users/stustison/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/codice/ddf/pulls/1244/commits","review_comments_url":"https://api.github.com/repos/codice/ddf/pulls/1244/comments","review_comment_url":"https://api.github.com/repos/codice/ddf/pulls/comments{/number}","comments_url":"https://api.github.com/repos/codice/ddf/issues/1244/comments","statuses_url":"https://api.github.com/repos/codice/ddf/statuses/6dfd7230260d318d31a87edf5f2da09570458b15","head":{"label":"ricklarsen:DDF-2403","ref":"DDF-2403","sha":"6dfd7230260d318d31a87edf5f2da09570458b15","user":{"login":"ricklarsen","id":10619999,"avatar_url":"https://avatars.githubusercontent.com/u/10619999?v=3","gravatar_id":"","url":"https://api.github.com/users/ricklarsen","html_url":"https://github.com/ricklarsen","followers_url":"https://api.github.com/users/ricklarsen/followers","following_url":"https://api.github.com/users/ricklarsen/following{/other_user}","gists_url":"https://api.github.com/users/ricklarsen/gists{/gist_id}","starred_url":"https://api.github.com/users/ricklarsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricklarsen/subscriptions","organizations_url":"https://api.github.com/users/ricklarsen/orgs","repos_url":"https://api.github.com/users/ricklarsen/repos","events_url":"https://api.github.com/users/ricklarsen/events{/privacy}","received_events_url":"https://api.github.com/users/ricklarsen/received_events","type":"User","site_admin":false},"repo":{"id":31686896,"name":"ddf","full_name":"ricklarsen/ddf","owner":{"login":"ricklarsen","id":10619999,"avatar_url":"https://avatars.githubusercontent.com/u/10619999?v=3","gravatar_id":"","url":"https://api.github.com/users/ricklarsen","html_url":"https://github.com/ricklarsen","followers_url":"https://api.github.com/users/ricklarsen/followers","following_url":"https://api.github.com/users/ricklarsen/following{/other_user}","gists_url":"https://api.github.com/users/ricklarsen/gists{/gist_id}","starred_url":"https://api.github.com/users/ricklarsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricklarsen/subscriptions","organizations_url":"https://api.github.com/users/ricklarsen/orgs","repos_url":"https://api.github.com/users/ricklarsen/repos","events_url":"https://api.github.com/users/ricklarsen/events{/privacy}","received_events_url":"https://api.github.com/users/ricklarsen/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/ricklarsen/ddf","description":"The Distributed Data Framework - Distribution, SDK, and Test","fork":true,"url":"https://api.github.com/repos/ricklarsen/ddf","forks_url":"https://api.github.com/repos/ricklarsen/ddf/forks","keys_url":"https://api.github.com/repos/ricklarsen/ddf/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ricklarsen/ddf/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ricklarsen/ddf/teams","hooks_url":"https://api.github.com/repos/ricklarsen/ddf/hooks","issue_events_url":"https://api.github.com/repos/ricklarsen/ddf/issues/events{/number}","events_url":"https://api.github.com/repos/ricklarsen/ddf/events","assignees_url":"https://api.github.com/repos/ricklarsen/ddf/assignees{/user}","branches_url":"https://api.github.com/repos/ricklarsen/ddf/branches{/branch}","tags_url":"https://api.github.com/repos/ricklarsen/ddf/tags","blobs_url":"https://api.github.com/repos/ricklarsen/ddf/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ricklarsen/ddf/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ricklarsen/ddf/git/refs{/sha}","trees_url":"https://api.github.com/repos/ricklarsen/ddf/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ricklarsen/ddf/statuses/{sha}","languages_url":"https://api.github.com/repos/ricklarsen/ddf/languages","stargazers_url":"https://api.github.com/repos/ricklarsen/ddf/stargazers","contributors_url":"https://api.github.com/repos/ricklarsen/ddf/contributors","subscribers_url":"https://api.github.com/repos/ricklarsen/ddf/subscribers","subscription_url":"https://api.github.com/repos/ricklarsen/ddf/subscription","commits_url":"https://api.github.com/repos/ricklarsen/ddf/commits{/sha}","git_commits_url":"https://api.github.com/repos/ricklarsen/ddf/git/commits{/sha}","comments_url":"https://api.github.com/repos/ricklarsen/ddf/comments{/number}","issue_comment_url":"https://api.github.com/repos/ricklarsen/ddf/issues/comments{/number}","contents_url":"https://api.github.com/repos/ricklarsen/ddf/contents/{+path}","compare_url":"https://api.github.com/repos/ricklarsen/ddf/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ricklarsen/ddf/merges","archive_url":"https://api.github.com/repos/ricklarsen/ddf/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ricklarsen/ddf/downloads","issues_url":"https://api.github.com/repos/ricklarsen/ddf/issues{/number}","pulls_url":"https://api.github.com/repos/ricklarsen/ddf/pulls{/number}","milestones_url":"https://api.github.com/repos/ricklarsen/ddf/milestones{/number}","notifications_url":"https://api.github.com/repos/ricklarsen/ddf/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ricklarsen/ddf/labels{/name}","releases_url":"https://api.github.com/repos/ricklarsen/ddf/releases{/id}","deployments_url":"https://api.github.com/repos/ricklarsen/ddf/deployments","created_at":"2015-03-05T00:10:16Z","updated_at":"2016-01-11T23:35:02Z","pushed_at":"2016-10-05T21:05:30Z","git_url":"git://github.com/ricklarsen/ddf.git","ssh_url":"git@github.com:ricklarsen/ddf.git","clone_url":"https://github.com/ricklarsen/ddf.git","svn_url":"https://github.com/ricklarsen/ddf","homepage":"","size":275104,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"codice:master","ref":"master","sha":"e407f3d8f66a34f5aee5c088b5a2e25b81a838cd","user":{"login":"codice","id":2386734,"avatar_url":"https://avatars.githubusercontent.com/u/2386734?v=3","gravatar_id":"","url":"https://api.github.com/users/codice","html_url":"https://github.com/codice","followers_url":"https://api.github.com/users/codice/followers","following_url":"https://api.github.com/users/codice/following{/other_user}","gists_url":"https://api.github.com/users/codice/gists{/gist_id}","starred_url":"https://api.github.com/users/codice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codice/subscriptions","organizations_url":"https://api.github.com/users/codice/orgs","repos_url":"https://api.github.com/users/codice/repos","events_url":"https://api.github.com/users/codice/events{/privacy}","received_events_url":"https://api.github.com/users/codice/received_events","type":"Organization","site_admin":false},"repo":{"id":15173563,"name":"ddf","full_name":"codice/ddf","owner":{"login":"codice","id":2386734,"avatar_url":"https://avatars.githubusercontent.com/u/2386734?v=3","gravatar_id":"","url":"https://api.github.com/users/codice","html_url":"https://github.com/codice","followers_url":"https://api.github.com/users/codice/followers","following_url":"https://api.github.com/users/codice/following{/other_user}","gists_url":"https://api.github.com/users/codice/gists{/gist_id}","starred_url":"https://api.github.com/users/codice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codice/subscriptions","organizations_url":"https://api.github.com/users/codice/orgs","repos_url":"https://api.github.com/users/codice/repos","events_url":"https://api.github.com/users/codice/events{/privacy}","received_events_url":"https://api.github.com/users/codice/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/codice/ddf","description":"Distributed Data Framework - an open source, modular integration framework.","fork":false,"url":"https://api.github.com/repos/codice/ddf","forks_url":"https://api.github.com/repos/codice/ddf/forks","keys_url":"https://api.github.com/repos/codice/ddf/keys{/key_id}","collaborators_url":"https://api.github.com/repos/codice/ddf/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/codice/ddf/teams","hooks_url":"https://api.github.com/repos/codice/ddf/hooks","issue_events_url":"https://api.github.com/repos/codice/ddf/issues/events{/number}","events_url":"https://api.github.com/repos/codice/ddf/events","assignees_url":"https://api.github.com/repos/codice/ddf/assignees{/user}","branches_url":"https://api.github.com/repos/codice/ddf/branches{/branch}","tags_url":"https://api.github.com/repos/codice/ddf/tags","blobs_url":"https://api.github.com/repos/codice/ddf/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/codice/ddf/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/codice/ddf/git/refs{/sha}","trees_url":"https://api.github.com/repos/codice/ddf/git/trees{/sha}","statuses_url":"https://api.github.com/repos/codice/ddf/statuses/{sha}","languages_url":"https://api.github.com/repos/codice/ddf/languages","stargazers_url":"https://api.github.com/repos/codice/ddf/stargazers","contributors_url":"https://api.github.com/repos/codice/ddf/contributors","subscribers_url":"https://api.github.com/repos/codice/ddf/subscribers","subscription_url":"https://api.github.com/repos/codice/ddf/subscription","commits_url":"https://api.github.com/repos/codice/ddf/commits{/sha}","git_commits_url":"https://api.github.com/repos/codice/ddf/git/commits{/sha}","comments_url":"https://api.github.com/repos/codice/ddf/comments{/number}","issue_comment_url":"https://api.github.com/repos/codice/ddf/issues/comments{/number}","contents_url":"https://api.github.com/repos/codice/ddf/contents/{+path}","compare_url":"https://api.github.com/repos/codice/ddf/compare/{base}...{head}","merges_url":"https://api.github.com/repos/codice/ddf/merges","archive_url":"https://api.github.com/repos/codice/ddf/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/codice/ddf/downloads","issues_url":"https://api.github.com/repos/codice/ddf/issues{/number}","pulls_url":"https://api.github.com/repos/codice/ddf/pulls{/number}","milestones_url":"https://api.github.com/repos/codice/ddf/milestones{/number}","notifications_url":"https://api.github.com/repos/codice/ddf/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/codice/ddf/labels{/name}","releases_url":"https://api.github.com/repos/codice/ddf/releases{/id}","deployments_url":"https://api.github.com/repos/codice/ddf/deployments","created_at":"2013-12-13T20:38:28Z","updated_at":"2016-09-16T18:40:56Z","pushed_at":"2016-10-05T22:24:58Z","git_url":"git://github.com/codice/ddf.git","ssh_url":"git@github.com:codice/ddf.git","clone_url":"https://github.com/codice/ddf.git","svn_url":"https://github.com/codice/ddf","homepage":"http://ddf.codice.org","size":287502,"stargazers_count":46,"watchers_count":46,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":95,"mirror_url":null,"open_issues_count":25,"forks":95,"open_issues":25,"watchers":46,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/codice/ddf/pulls/1244"},"html":{"href":"https://github.com/codice/ddf/pull/1244"},"issue":{"href":"https://api.github.com/repos/codice/ddf/issues/1244"},"comments":{"href":"https://api.github.com/repos/codice/ddf/issues/1244/comments"},"review_comments":{"href":"https://api.github.com/repos/codice/ddf/pulls/1244/comments"},"review_comment":{"href":"https://api.github.com/repos/codice/ddf/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/codice/ddf/pulls/1244/commits"},"statuses":{"href":"https://api.github.com/repos/codice/ddf/statuses/6dfd7230260d318d31a87edf5f2da09570458b15"}}}}
{"actor":{"display_login":"shaundmorris"}}