SecurityTokens

CXF defines a SecurityToken class which encapsulates all relevant information about a successful authentication event in the security runtime (as defined above). In particular, it contains the following items (among others):

• A String identifier of the token. This could be a SAML Assertion Id, the Identifier element of a SecurityContextToken, or the wsu:Id of a UsernameToken, etc.
• The DOM Element that represents that security token.
• Attached and Unattached reference elements for that token that might have been retrieved from an STS.
• A byte[] secret associated with the token.
• An expiration date after which the token is not valid.
• A String TokenType that categorizes the token.
• An X.509 Certificate associated with the token.
• The principal associated with the token.
• A hashcode that represents the security token (normally the hashcode of the underlying WSS4J object).
• An identifier of another SecurityToken that represents a transformed version of this token.