net.shibboleth.metadata.dom

Class XMLSignatureValidationStage

java.lang.Object

net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

net.shibboleth.metadata.pipeline.BaseStage<T>

net.shibboleth.metadata.pipeline.BaseIteratingStage<Element>

net.shibboleth.metadata.dom.XMLSignatureValidationStage

All Implemented Interfaces:

Stage<Element>, net.shibboleth.utilities.java.support.component.Component, net.shibboleth.utilities.java.support.component.DestructableComponent, net.shibboleth.utilities.java.support.component.IdentifiableComponent, net.shibboleth.utilities.java.support.component.IdentifiedComponent, net.shibboleth.utilities.java.support.component.InitializableComponent

@ThreadSafe
public class XMLSignatureValidationStage
extends BaseIteratingStage<Element>

A pipeline stage which validates the XML digital signature found on DOM Elements.

This stage requires the following properties be set prior to initialization:

• verificationKey

If Element signatures are required, per signatureRequired, and an Element does not contain a signature than an ErrorStatus object is set on the Element. If Element signatures are required to be valid, per isValidSignatureRequired(), and an Element signature is found to be invalid than an ErrorStatus object is set on the element. If signatures are not required to be valid and an Element signature is found to be invalid than an WarningStatus is set on the Element.

Field Summary

Fields

Modifier and Type	Field and Description
private Set<String>	blacklistedDigests Set of blacklisted digest URIs.
private Set<String>	blacklistedSignatureMethods Set of blacklisted signature method URIs.
private Logger	log Class logger.
private boolean	permittingEmptyReferences Option to determine whether empty references are to be permitted.
private boolean	signatureRequired Whether Elements are required to be signed.
private XMLSignatureValidator	validator Validator used for all signatures validated by this stage instance.
private boolean	validSignatureRequired Whether the signature on a Elements is required to be valid.
private Certificate	verificationCertificate Certificate whose public key is used to verify the Element signature.
private PublicKey	verificationKey Public key used to verify the Element signature.

Constructor Summary

Constructors

Constructor and Description
XMLSignatureValidationStage()

Method Summary

Methods

Modifier and Type	Method and Description
protected void	doDestroy()
protected boolean	doExecute(Item<Element> item) Processes a given Item.
protected void	doInitialize()
Set<String>	getBlacklistedDigests() Gets the set of blacklisted digest algorithm identifiers.
Set<String>	getBlacklistedSignatureMethods() Gets the set of blacklisted signature method identifiers.
Certificate	getVerificationCertificate() Gets the certificate whose public key is used to verify the signed Element.
PublicKey	getVerificationKey() Gets the key used to verify the signature.
boolean	isPermittingEmptyReferences() Gets whether empty references are permitted.
boolean	isSignatureRequired() Gets whether the Element is required to be signed.
boolean	isValidSignatureRequired() Gets whether the signature on a Element element is required to be valid.
void	setBlacklistedDigests(Collection<String> identifiers) Set the collection of identifiers to be blacklisted as digest algorithms.
void	setBlacklistedSignatureMethods(Collection<String> identifiers) Set the collection of identifiers to be blacklisted as signature methods.
void	setPermittingEmptyReferences(boolean permit) Sets whether empty references are permitted.
void	setSignatureRequired(boolean required) Sets whether the Element is required to be signed.
void	setValidSignatureRequired(boolean isRequired) Sets whether the signature on a Element element is required to be valid.
void	setVerificationCertificate(Certificate certificate) Set the key, included in a certificate, used to verify the signature.
void	setVerificationKey(PublicKey key) Sets the key used to verify the signature.

Methods inherited from class net.shibboleth.metadata.pipeline.BaseIteratingStage

doExecute

Methods inherited from class net.shibboleth.metadata.pipeline.BaseStage

execute, getCollectionPredicate, setCollectionPredicate

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent

setId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

getId

Methods inherited from class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

destroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.utilities.java.support.component.DestructableComponent

destroy, isDestroyed

Methods inherited from interface net.shibboleth.utilities.java.support.component.IdentifiedComponent

getId

Methods inherited from interface net.shibboleth.utilities.java.support.component.InitializableComponent

initialize, isInitialized

Field Detail

log

private final Logger log

Class logger.

signatureRequired

private boolean signatureRequired

Whether Elements are required to be signed.

validSignatureRequired

private boolean validSignatureRequired

Whether the signature on a Elements is required to be valid. Default value: true

verificationCertificate

private Certificate verificationCertificate

Certificate whose public key is used to verify the Element signature.

verificationKey

private PublicKey verificationKey

Public key used to verify the Element signature.

blacklistedDigests

@Nonnull
private Set<String> blacklistedDigests

Set of blacklisted digest URIs. Default value: empty set.

blacklistedSignatureMethods

@Nonnull
private Set<String> blacklistedSignatureMethods

Set of blacklisted signature method URIs. Default value: empty set.

permittingEmptyReferences

private boolean permittingEmptyReferences

Option to determine whether empty references are to be permitted. Default value: true.

validator

private XMLSignatureValidator validator

Validator used for all signatures validated by this stage instance.

Constructor Detail

XMLSignatureValidationStage

public XMLSignatureValidationStage()

Method Detail

isSignatureRequired

public boolean isSignatureRequired()

Gets whether the Element is required to be signed.

Returns:

whether the Element is required to be signed

setSignatureRequired

public void setSignatureRequired(boolean required)

Sets whether the Element is required to be signed.

Parameters:

required - whether the Element is required to be signed

isValidSignatureRequired

public boolean isValidSignatureRequired()

Gets whether the signature on a Element element is required to be valid.

Returns:

whether the signature on a Element element is required to be valid

setValidSignatureRequired

public void setValidSignatureRequired(boolean isRequired)

Sets whether the signature on a Element element is required to be valid.

Parameters:

isRequired - whether the signature on a Element element is required to be valid

getVerificationKey

@Nullable
public PublicKey getVerificationKey()

Gets the key used to verify the signature.

Returns:

key used to verify the signature

setVerificationKey

public void setVerificationKey(@Nonnull
                      PublicKey key)

Sets the key used to verify the signature.

Parameters:

key - key used to verify the signature

getVerificationCertificate

@Nullable
public Certificate getVerificationCertificate()

Gets the certificate whose public key is used to verify the signed Element.

Returns:

certificate whose public key is used to verify the signed Element

setVerificationCertificate

public void setVerificationCertificate(@Nonnull
                              Certificate certificate)

Set the key, included in a certificate, used to verify the signature. This method will also set verificationKey with the public key of the certificate.

Parameters:

certificate - certificate containing the key used to verify the signature

setBlacklistedDigests

public void setBlacklistedDigests(@Nonnull@NonnullElements
                         Collection<String> identifiers)

Set the collection of identifiers to be blacklisted as digest algorithms.

Parameters:

identifiers - collection of identifiers to be blacklisted

getBlacklistedDigests

@Nonnull
@NonnullElements
public Set<String> getBlacklistedDigests()

Gets the set of blacklisted digest algorithm identifiers.

Returns:

the set of blacklisted digest algorithm identifiers

setBlacklistedSignatureMethods

public void setBlacklistedSignatureMethods(@Nonnull@NonnullElements
                                  Collection<String> identifiers)

Set the collection of identifiers to be blacklisted as signature methods.

Parameters:

identifiers - collection of identifiers to be blacklisted

getBlacklistedSignatureMethods

@Nonnull
@NonnullElements
public Set<String> getBlacklistedSignatureMethods()

Gets the set of blacklisted signature method identifiers.

Returns:

the set of blacklisted signature method identifiers

isPermittingEmptyReferences

public boolean isPermittingEmptyReferences()

Gets whether empty references are permitted.

Returns:

whether empty references are permitted

setPermittingEmptyReferences

public void setPermittingEmptyReferences(boolean permit)

Sets whether empty references are permitted.

Parameters:

permit - whether empty references are permitted

doExecute

protected boolean doExecute(@Nonnull
                Item<Element> item)
                     throws StageProcessingException

Processes a given Item.

Specified by:

doExecute in class BaseIteratingStage<Element>

Parameters:

item - Item on which to operate

Returns:

true if the Item should be retained in the collection, false if not

Throws:

StageProcessingException - thrown if there is a problem with the stage processing

doDestroy

protected void doDestroy()

Overrides:

doDestroy in class net.shibboleth.utilities.java.support.component.AbstractInitializableComponent

doInitialize

protected void doInitialize()
                     throws net.shibboleth.utilities.java.support.component.ComponentInitializationException

Overrides:

doInitialize in class net.shibboleth.utilities.java.support.component.AbstractIdentifiedInitializableComponent

Throws:

net.shibboleth.utilities.java.support.component.ComponentInitializationException