[java-opensaml COMMIT] in /trunk: opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescrip...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Oct 31 21:25:36 2014
New Revision: 4123

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4123&view=rev
Log:
Strawman approach for supporting PKIX-based signature validation on metadata.  Tests pending.

Added:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/BasicDynamicTrustedNamesStrategy.java   (with props)
    trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/TrustedNamesCriterion.java   (with props)
Modified:
    trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java

Modified: trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java?rev=4123&r1=4122&r2=4123&view=diff
==============================================================================
--- trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java (original)
+++ trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java Fri Oct 31 21:25:36 2014
@@ -54,7 +54,7 @@
     public static final String ID_ATTRIB_NAME = "ID";
 
     /**
-     * Gets the ID of the owner of this affiliation. The owner may, or may not, be a memeber of the affiliation.
+     * Gets the ID of the owner of this affiliation. The owner may, or may not, be a member of the affiliation.
      * 
      * @return the ID of the owner of this affiliation
      */

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java?rev=4123&r1=4122&r2=4123&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java Fri Oct 31 21:25:36 2014
@@ -19,6 +19,7 @@
 
 import java.util.HashSet;
 import java.util.Iterator;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -36,6 +37,7 @@
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
+import org.opensaml.security.x509.TrustedNamesCriterion;
 import org.opensaml.xmlsec.signature.SignableXMLObject;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.support.SignatureException;
@@ -44,6 +46,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.google.common.base.Function;
+
 /**
  * A metadata filter that validates XML signatures.
  */
@@ -63,6 +67,9 @@
     
     /** Prevalidator for XML Signature instances. */
     private SignaturePrevalidator signaturePrevalidator;
+    
+    /** Strategy function for extracting dynamic trusted names from signed metadata elements. */
+    private Function<XMLObject, Set<String>> dynamicTrustedNamesStrategy;
 
     /**
      * Constructor.
@@ -80,6 +87,24 @@
 
         signatureTrustEngine = engine;
         signaturePrevalidator = new SAMLSignatureProfileValidator();
+    }
+
+    /**
+     * Get the strategy function for extracting dynamic trusted names from signed metadata elements.
+     * 
+     * @return the function, or null
+     */
+    @Nullable public Function<XMLObject, Set<String>> getDynamicTrustedNamesStrategy() {
+        return dynamicTrustedNamesStrategy;
+    }
+
+    /**
+     * Get the strategy function for extracting dynamic trusted names from signed metadata elements.
+     * 
+     * @param strategy the function, may be null
+     */
+    public void setDynamicTrustedNamesStrategy(@Nullable final Function<XMLObject, Set<String>> strategy) {
+        dynamicTrustedNamesStrategy = strategy;
     }
 
     /**
@@ -398,17 +423,13 @@
             newCriteriaSet.add( new UsageCriterion(UsageType.SIGNING) );
         }
         
-        // TODO how to handle adding dynamic entity ID and/or other criteria for trust engine consumption?
-        //
-        // Have 4 signed metadata types:
-        // 1) EntitiesDescriptor
-        // 2) EntityDescriptor
-        // 3) RoleDescriptor
-        // 4) AffiliationDescriptor
-        //
-        // Logic will likely vary for how to specify criteria to trust engine for different types + specific use cases,
-        // e.g. for federation metadata publishers of EntitiesDescriptors vs. "self-signed" EntityDescriptors.

[... 88 lines stripped ...]