[utilities COMMIT] in /xmlsectool/trunk: doc/RELEASE-NOTES.txt src/main/java/edu/internet2/middleware/security/XmlSec...

[noreply at shibboleth.net]

Author: iay
Date: Fri Mar  8 06:31:57 2013
New Revision: 342

URL: http://svn.shibboleth.net/view/utilities?rev=342&view=rev
Log:
[XSTJ-14] - allow specification of Digest and Signature algorithms when signing

Modified:
    xmlsectool/trunk/doc/RELEASE-NOTES.txt
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
    xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java

Modified: xmlsectool/trunk/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/doc/RELEASE-NOTES.txt?rev=342&r1=341&r2=342&view=diff
==============================================================================
--- xmlsectool/trunk/doc/RELEASE-NOTES.txt (original)
+++ xmlsectool/trunk/doc/RELEASE-NOTES.txt Fri Mar  8 06:31:57 2013
@@ -6,6 +6,7 @@
 [XSTJ-17] - multiple errors in --help documentation
 [XSTJ-16] - misleading error message on failed schema validation
 [XSTJ-15] - XmlSecTool fails with String index out of range -1
+[XSTJ-14] - allow specification of Digest and Signature algorithms when signing
 
 Changes in Release 1.1.4
 =============================================

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java?rev=342&r1=341&r2=342&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecTool.java Fri Mar  8 06:31:57 2013
@@ -391,12 +391,38 @@
             System.exit(RC_SIG);
         }
 
+        /*
+         * Determine the signature algorithm:
+         * 
+         *    * if the CLI signatureAlgorithm has been used, it takes precedence.
+         *    * for RSA credentials, use an algorithm dependent on the digest algorithm chosen
+         *    * fall back to a signature algorithm based on the signing credential type.
+         */
         BasicX509Credential signingCredential = getCredential(cli);
-
         BasicSecurityConfiguration securityConfig = DefaultSecurityConfigurationBootstrap.buildDefaultConfig();
-        String signatureAlgorithm = securityConfig.getSignatureAlgorithmURI(signingCredential);
+        String signatureAlgorithm = cli.getSignatureAlgorithm();
+        if (signatureAlgorithm == null) {
+            final String credentialAlgorithm = signingCredential.getPublicKey().getAlgorithm();
+            if ("RSA".equals(credentialAlgorithm)) {
+                signatureAlgorithm = cli.getDigest().getRsaAlgorithm();
+            } else {
+                signatureAlgorithm = securityConfig.getSignatureAlgorithmURI(signingCredential);
+            }
+        }
         boolean hmac = SecurityHelper.isHMAC(signatureAlgorithm);
         Integer hmacOutputLength = securityConfig.getSignatureHMACOutputLength();
+        
+        /*
+         * Determine the digest algorithm:
+         * 
+         *    * if the CLI digestAlgorithm option has been used, it takes precedence.
+         *    * fall back to the shorthand digest choice.
+         */
+        String digestAlgorithm = cli.getDigestAlgorithm();
+        if (digestAlgorithm == null) {
+            digestAlgorithm = cli.getDigest().getDigestAlgorithm();
+        }
+        
         String c14nAlgorithm = SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS;
 
         try {
@@ -413,7 +439,7 @@
             contentTransforms.addTransform(SignatureConstants.TRANSFORM_ENVELOPED_SIGNATURE);
             contentTransforms.addTransform(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
             signature.addDocument(getSignatureReferenceUri(cli, documentRoot), contentTransforms,
-                    SignatureConstants.ALGO_ID_DIGEST_SHA1);
+                    digestAlgorithm);
 
             log.debug("Creating Signature DOM element");
             signatureElement = signature.getElement();

Modified: xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java
URL: http://svn.shibboleth.net/view/utilities/xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java?rev=342&r1=341&r2=342&view=diff
==============================================================================
--- xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java (original)
+++ xmlsectool/trunk/src/main/java/edu/internet2/middleware/security/XmlSecToolCommandLineArguments.java Fri Mar  8 06:31:57 2013
@@ -23,9 +23,113 @@
 import java.io.PrintStream;
 import java.util.List;
 
+import org.apache.xml.security.algorithms.MessageDigestAlgorithm;
+import org.apache.xml.security.signature.XMLSignature;
+
 /** Command line arguments for the {@link XmlSecTool} command line tool. */
 public class XmlSecToolCommandLineArguments {
 
+    /**

[... 238 lines stripped ...]