[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src: main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKey...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Jun  5 13:52:09 2015
New Revision: 4286

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4286&view=rev
Log:
Add support for Holder-Of-Key subject confirmation via DEREncodedKeyValue.
Refactor for cyclomatic complexity.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidatorTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java?rev=4286&r1=4285&r2=4286&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidator.java	Fri Jun  5 13:52:09 2015
@@ -41,6 +41,7 @@
 import org.opensaml.saml.saml2.core.SubjectConfirmation;
 import org.opensaml.saml.saml2.core.SubjectConfirmationData;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
+import org.opensaml.xmlsec.signature.DEREncodedKeyValue;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.KeyValue;
 import org.opensaml.xmlsec.signature.X509Data;
@@ -54,10 +55,14 @@
  * A subject confirmation is considered confirmed if one of the
  * following checks has passed:
  * <ul>
- * <li>the presenter's public key (either given explicitly or extracted from the given certificate) matches a
- * {@link KeyValue} within one of the {@link KeyInfo} entries in the confirmation data</li>
- * <li>the presenter's public cert matches an {@link org.opensaml.xml.signature.X509Certificate} within one of the
- * {@link KeyInfo} entries in the confirmation data</li>
+ * <li>
+ * the presenter's public key (either given explicitly or extracted from the given certificate) matches a
+ * {@link KeyValue} or {@link DEREncodedKeyValue} within one of the {@link KeyInfo} entries in the confirmation data
+ * </li>
+ * <li>
+ * the presenter's public cert matches an {@link org.opensaml.xml.signature.X509Certificate} within one of the
+ * {@link KeyInfo} entries in the confirmation data
+ * </li>
  * </ul>
  * In both cases a "match" is determined via Java <code>equals()</code> comparison.
  * </p>
@@ -262,8 +267,17 @@
     }
 
     /**
-     * Checks to see if the DSA or RSA key (depending on what is used in the certificate) matches one of the keys in the
-     * given KeyInfo.
+     * Checks whether the supplied public key matches one of the keys in the given KeyInfo.
+     * 
+     * <p>
+     * Evaluates both {@link KeyValue} and {@link DEREncodedKeyValue} children of the KeyInfo.
+     * </p>
+     * 
+     * 
+     * <p>
+     * Matches are performed using Java <code>equals()</code> against {@link PublicKey}s decoded
+     * from the KeyInfo data.
+     * </p>
      * 
      * @param key public key presenter of the assertion
      * @param keyInfo key info from subject confirmation of the assertion
@@ -274,14 +288,43 @@
      */
     protected boolean matchesKeyValue(@Nullable final PublicKey key, @Nonnull final KeyInfo keyInfo) 
             throws AssertionValidationException {
+        
         if (key == null) {
             log.debug("Presenter PublicKey was null, skipping KeyValue match");
             return false;
         }
-
-        List<KeyValue> keyValues = keyInfo.getKeyValues();
+        
+        if (matchesKeyValue(key, keyInfo.getKeyValues())) {
+            return true;
+        }
+        
+        if (matchesDEREncodedKeyValue(key, keyInfo.getDEREncodedKeyValues())) {
+            return true;
+        }
+
+        log.debug("Failed to match either a KeyInfo KeyValue or DEREncodedKeyValue against supplied PublicKey param");
+        return false;
+    }
+    
+    /**
+     * Checks whether the supplied public key matches one of the supplied {@link KeyValue} elements.
+     * 
+     * <p>
+     * Matches are performed using Java <code>equals()</code> against {@link PublicKey}s decoded
+     * from the KeyInfo data.
+     * </p>
+     * 
+     * @param key public key presenter of the assertion
+     * @param keyValues candidate KeyValue elements
+     * 
+     * @return true if the public key in the certificate matches one of the key values, false otherwise
+     * 
+     * @throws AssertionValidationException thrown if there is a problem matching the key value
+     */
+    protected boolean matchesKeyValue(@Nonnull final PublicKey key, @Nullable final List<KeyValue> keyValues)  {
+        
         if (keyValues == null || keyValues.isEmpty()) {
-            log.debug("KeyInfo contained no KeyValue children, skipping KeyValue match");

[... 115 lines stripped ...]