[java-metadata-aggregator] branch master updated: MDA-223 - remove algorithm identifiers from API
Ian Young
ian at iay.org.uk
Fri Sep 27 13:08:33 EDT 2019
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=bd7a5bcefefff2bcfc308ceb4f05a7652b8db3d2
The following commit(s) were added to refs/heads/master by this push:
new bd7a5bc MDA-223 - remove algorithm identifiers from API
bd7a5bc is described below
commit bd7a5bcefefff2bcfc308ceb4f05a7652b8db3d2
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Fri Sep 27 18:08:18 2019 +0100
MDA-223 - remove algorithm identifiers from API
https://issues.shibboleth.net/jira/browse/MDA-223
---
.../metadata/dom/XMLSignatureSigningStage.java | 94 +++++-----------------
.../metadata/dom/XMLSignatureValidator.java | 4 +-
.../metadata/dom/ds/X509ValidationStage.java | 3 +-
.../shibboleth/metadata/dom/ds/XMLDSIGSupport.java | 6 +-
.../metadata/dom/saml/SAMLMetadataSupport.java | 4 +-
.../metadata/dom/XMLSignatureSigningStageTest.java | 4 +-
6 files changed, 33 insertions(+), 82 deletions(-)
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java
index bd4976f..086cc18 100644
--- a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureSigningStage.java
@@ -66,6 +66,7 @@ import com.google.common.collect.Iterables;
import com.google.common.io.CharStreams;
import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.dom.ds.XMLDSIGSupport;
import net.shibboleth.metadata.pipeline.AbstractIteratingStage;
import net.shibboleth.metadata.pipeline.StageProcessingException;
import net.shibboleth.utilities.java.support.annotation.constraint.Live;
@@ -97,61 +98,6 @@ public class XMLSignatureSigningStage extends AbstractIteratingStage<Element> {
SHA1, SHA256, SHA384, SHA512
};
- /** XML Signature base URI: {@value} . */
- public static final String XML_SIG_NS_URI = "http://www.w3.org/2000/09/xmldsig#";
-
- /** QName of the Signature element. */
- public static final QName SIGNATURE_NAME = new QName(XML_SIG_NS_URI, "Signature");
-
- /** XML Encryption base URI: {@value} . */
- public static final String XML_ENC_NS_URI = "http://www.w3.org/2001/04/xmlenc#";
-
- /**
- * RFC4501 base URI: {@value} .
- *
- * @see <a href="http://tools.ietf.org/html/rfc4501">RFC 4501</a>
- */
- public static final String RFC4501_BASE_URI = "http://www.w3.org/2001/04/xmldsig-more";
-
- /** RSA-SHA1 signature algorithm ID: {@value} . */
- public static final String ALGO_ID_SIGNATURE_RSA_SHA1 = XML_SIG_NS_URI + "rsa-sha1";
-
- /** RSA-SHA256 signature algorithm ID: {@value} . */
- public static final String ALGO_ID_SIGNATURE_RSA_SHA256 = RFC4501_BASE_URI + "#rsa-sha256";
-
- /** RSA-SHA384 signature algorithm ID: {@value} . */
- public static final String ALGO_ID_SIGNATURE_RSA_SHA384 = RFC4501_BASE_URI + "#rsa-sha384";
-
- /** RSA-SHA512 signature algorithm ID: {@value} . */
- public static final String ALGO_ID_SIGNATURE_RSA_SHA512 = RFC4501_BASE_URI + "#rsa-sha512";
-
- /** SHA1 digest algorithm ID: {@value} . */
- public static final String ALGO_ID_DIGEST_SHA1 = XML_SIG_NS_URI + "sha1";
-
- /** SHA256 digest algorithm ID: {@value} . */
- public static final String ALGO_ID_DIGEST_SHA256 = XML_ENC_NS_URI + "sha256";
-
- /** SHA384 digest algorithm ID: {@value} . */
- public static final String ALGO_ID_DIGEST_SHA384 = RFC4501_BASE_URI + "#sha384";
-
- /** SHA512 digest algorithm ID: {@value} . */
- public static final String ALGO_ID_DIGEST_SHA512 = XML_ENC_NS_URI + "sha512";
-
- /** Inclusive canonicalization, <strong>WITHOUT</strong> comments, algorithm ID: {@value} . */
- public static final String ALGO_ID_C14N_OMIT_COMMENTS = "http://www.w3.org/TR/2001/REC-xml-c14n-20010315";
-
- /** Inclusive canonicalization, <strong>WITH</strong> comments, algorithm ID: {@value} . */
- public static final String ALGO_ID_C14N_WITH_COMMENTS = ALGO_ID_C14N_OMIT_COMMENTS + "#WithComments";
-
- /** Exclusive canonicalization, <strong>WITHOUT</strong> comments, algorithm ID: {@value} . */
- public static final String ALGO_ID_C14N_EXCL_OMIT_COMMENTS = "http://www.w3.org/2001/10/xml-exc-c14n#";
-
- /** Exclusive canonicalization, <strong>WITH</strong> comments, algorithm ID: {@value} . */
- public static final String ALGO_ID_C14N_EXCL_WITH_COMMENTS = ALGO_ID_C14N_EXCL_OMIT_COMMENTS + "WithComments";
-
- /** Enveloped signature transform ID: {@value} . */
- public static final String TRANSFORM_ENVELOPED_SIGNATURE = XML_SIG_NS_URI + "enveloped-signature";
-
/** Class logger. */
private final Logger log = LoggerFactory.getLogger(XMLSignatureSigningStage.class);
@@ -681,7 +627,7 @@ public class XMLSignatureSigningStage extends AbstractIteratingStage<Element> {
* @param elementName The element name within the XML DSIG namespace to look for.
*/
private void removeCRsFromNamedChildren(@Nonnull final Element signature, @Nonnull final String elementName) {
- final NodeList nodes = signature.getElementsByTagNameNS(XML_SIG_NS_URI, elementName);
+ final NodeList nodes = signature.getElementsByTagNameNS(XMLSignature.XMLNS, elementName);
for (int i = 0; i < nodes.getLength(); i++) {
final Node node = nodes.item(i);
final String text = node.getTextContent();
@@ -708,7 +654,8 @@ public class XMLSignatureSigningStage extends AbstractIteratingStage<Element> {
// Remove any CRs from selected signature elements.
if (isRemovingCRsFromSignature()) {
- final Element signatureElement = ElementSupport.getFirstChildElement(element, SIGNATURE_NAME);
+ final Element signatureElement = ElementSupport.getFirstChildElement(element,
+ XMLDSIGSupport.SIGNATURE_NAME);
removeCRsFromNamedChildren(signatureElement, "SignatureValue");
removeCRsFromNamedChildren(signatureElement, "X509Certificate");
}
@@ -737,7 +684,7 @@ public class XMLSignatureSigningStage extends AbstractIteratingStage<Element> {
*/
@Nonnull protected SignedInfo buildSignedInfo(@Nonnull final Element target) throws StageProcessingException {
C14NMethodParameterSpec c14nMethodSpec = null;
- if (c14nAlgo.startsWith(ALGO_ID_C14N_EXCL_OMIT_COMMENTS) && inclusivePrefixList != null
+ if (c14nAlgo.startsWith(CanonicalizationMethod.EXCLUSIVE) && inclusivePrefixList != null
&& !inclusivePrefixList.isEmpty()) {
c14nMethodSpec = new ExcC14NParameterSpec(inclusivePrefixList);
}
@@ -799,15 +746,15 @@ public class XMLSignatureSigningStage extends AbstractIteratingStage<Element> {
try {
transformSpec = null;
- transforms.add(xmlSigFactory.newTransform(TRANSFORM_ENVELOPED_SIGNATURE, transformSpec));
+ transforms.add(xmlSigFactory.newTransform(Transform.ENVELOPED, transformSpec));
} catch (final Exception e) {
- final String errMsg = "Unable to create transform " + TRANSFORM_ENVELOPED_SIGNATURE;
+ final String errMsg = "Unable to create transform " + Transform.ENVELOPED;
log.error(errMsg, e);
throw new StageProcessingException(errMsg, e);
}
try {
- if (c14nAlgo.startsWith(ALGO_ID_C14N_EXCL_OMIT_COMMENTS) && inclusivePrefixList != null
+ if (c14nAlgo.startsWith(CanonicalizationMethod.EXCLUSIVE) && inclusivePrefixList != null
&& !inclusivePrefixList.isEmpty()) {
transformSpec = new ExcC14NParameterSpec(inclusivePrefixList);
}
@@ -1004,37 +951,38 @@ public class XMLSignatureSigningStage extends AbstractIteratingStage<Element> {
switch (shaVariant) {
case SHA1:
- sigAlgo = ALGO_ID_SIGNATURE_RSA_SHA1;
- digestAlgo = ALGO_ID_DIGEST_SHA1;
+ sigAlgo = SignatureMethod.RSA_SHA1;
+ digestAlgo = DigestMethod.SHA1;
break;
+
case SHA384:
- sigAlgo = ALGO_ID_SIGNATURE_RSA_SHA384;
- digestAlgo = ALGO_ID_DIGEST_SHA384;
+ sigAlgo = SignatureMethod.RSA_SHA384;
+ digestAlgo = DigestMethod.SHA384;
break;
case SHA512:
- sigAlgo = ALGO_ID_SIGNATURE_RSA_SHA512;
- digestAlgo = ALGO_ID_DIGEST_SHA512;
+ sigAlgo = SignatureMethod.RSA_SHA512;
+ digestAlgo = DigestMethod.SHA512;
break;
case SHA256:
default:
- sigAlgo = ALGO_ID_SIGNATURE_RSA_SHA256;
- digestAlgo = ALGO_ID_DIGEST_SHA256;
+ sigAlgo = SignatureMethod.RSA_SHA256;
+ digestAlgo = DigestMethod.SHA256;
break;
}
if (c14nExclusive) {
if (c14nWithComments) {
- c14nAlgo = ALGO_ID_C14N_EXCL_WITH_COMMENTS;
+ c14nAlgo = CanonicalizationMethod.EXCLUSIVE_WITH_COMMENTS;
} else {
- c14nAlgo = ALGO_ID_C14N_EXCL_OMIT_COMMENTS;
+ c14nAlgo = CanonicalizationMethod.EXCLUSIVE;
}
} else {
if (c14nWithComments) {
- c14nAlgo = ALGO_ID_C14N_WITH_COMMENTS;
+ c14nAlgo = CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS;
} else {
- c14nAlgo = ALGO_ID_C14N_OMIT_COMMENTS;
+ c14nAlgo = CanonicalizationMethod.INCLUSIVE;
}
}
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java
index d72dd6c..19c8105 100644
--- a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/XMLSignatureValidator.java
@@ -26,6 +26,7 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.metadata.dom.ds.XMLDSIGSupport;
import net.shibboleth.utilities.java.support.codec.Base64Support;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.xml.AttributeSupport;
@@ -425,8 +426,7 @@ final class XMLSignatureValidator {
*/
@Nullable public Element getSignatureElement(@Nonnull final Element docElement) throws ValidationException {
final List<Element> sigElements =
- ElementSupport.getChildElementsByTagNameNS(docElement,
- XMLSignatureSigningStage.XML_SIG_NS_URI, "Signature");
+ ElementSupport.getChildElements(docElement, XMLDSIGSupport.SIGNATURE_NAME);
if (sigElements.isEmpty()) {
return null;
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/X509ValidationStage.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/X509ValidationStage.java
index 117ded2..6aea5de 100644
--- a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/X509ValidationStage.java
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/X509ValidationStage.java
@@ -25,6 +25,7 @@ import java.util.HashMap;
import java.util.Map;
import javax.annotation.Nonnull;
+import javax.xml.crypto.dsig.XMLSignature;
import org.w3c.dom.Element;
@@ -97,7 +98,7 @@ public class X509ValidationStage extends AbstractDOMValidationStage<X509Certific
@Override
protected boolean applicable(@Nonnull final Element e) {
- return XMLDSIGSupport.XML_DSIG_NS.equals(e.getNamespaceURI()) &&
+ return XMLSignature.XMLNS.equals(e.getNamespaceURI()) &&
"X509Certificate".equals(e.getLocalName());
}
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/XMLDSIGSupport.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/XMLDSIGSupport.java
index 1ae133c..6463733 100644
--- a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/XMLDSIGSupport.java
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/ds/XMLDSIGSupport.java
@@ -18,13 +18,15 @@
package net.shibboleth.metadata.dom.ds;
import javax.annotation.concurrent.ThreadSafe;
+import javax.xml.crypto.dsig.XMLSignature;
+import javax.xml.namespace.QName;
/** Support class for dealing with the XML DSIG specification. */
@ThreadSafe
public final class XMLDSIGSupport {
- /** Namespace URI for the XML DSIG specification. */
- public static final String XML_DSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+ /** Signature element name. */
+ public static final QName SIGNATURE_NAME = new QName(XMLSignature.XMLNS, "Signature");
/** Constructor. */
private XMLDSIGSupport() {
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java
index e2b6af7..43ff651 100644
--- a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/dom/saml/SAMLMetadataSupport.java
@@ -27,7 +27,7 @@ import javax.xml.namespace.QName;
import org.w3c.dom.Element;
-import net.shibboleth.metadata.dom.XMLSignatureSigningStage;
+import net.shibboleth.metadata.dom.ds.XMLDSIGSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.xml.ElementSupport;
@@ -162,7 +162,7 @@ public final class SAMLMetadataSupport {
extensionsElement = ElementSupport.constructElement(descriptor.getOwnerDocument(), EXTENSIONS_NAME);
Element insertExtensionsElementBefore = null;
- final List<Element> signatureElements = descriptorChildren.get(XMLSignatureSigningStage.SIGNATURE_NAME);
+ final List<Element> signatureElements = descriptorChildren.get(XMLDSIGSupport.SIGNATURE_NAME);
if (!signatureElements.isEmpty()) {
final Element lastSignatureElement = signatureElements.get(signatureElements.size() - 1);
insertExtensionsElementBefore = ElementSupport.getNextSiblingElement(lastSignatureElement);
diff --git a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java
index cda31a3..1c3bb42 100644
--- a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java
+++ b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/dom/XMLSignatureSigningStageTest.java
@@ -39,6 +39,7 @@ import org.xmlunit.input.NormalizedSource;
import net.shibboleth.metadata.AssertSupport;
import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.dom.ds.XMLDSIGSupport;
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
import net.shibboleth.utilities.java.support.testing.TestSupport;
import net.shibboleth.utilities.java.support.xml.ElementSupport;
@@ -305,8 +306,7 @@ public class XMLSignatureSigningStageTest extends BaseDOMTest {
}
private Element extractKeyInfo(@Nonnull final Element root) {
- final var signature = ElementSupport.getFirstChildElement(root,
- new QName(XMLSignature.XMLNS, "Signature"));
+ final var signature = ElementSupport.getFirstChildElement(root, XMLDSIGSupport.SIGNATURE_NAME);
final var keyInfos = signature.getElementsByTagNameNS(XMLSignature.XMLNS, "KeyInfo");
Assert.assertNotNull(keyInfos);
if (keyInfos.getLength() != 0) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list