[java-opensaml] 03/11: Support optional eval of message signed state by presence of Signature.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=eae06fc7faea900473cfb325b791098b771be1b9

commit eae06fc7faea900473cfb325b791098b771be1b9
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Jan 29 18:10:39 2020 -0500

    Support optional eval of message signed state by presence of Signature.
---
 .../saml/common/binding/SAMLBindingSupport.java    | 36 +++++++++++++++++++---
 .../logic/InboundMessageSignedPredicate.java       | 14 ++++++++-
 2 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java
index 2c52b71..38fab86 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java
@@ -186,8 +186,9 @@ public final class SAMLBindingSupport {
      * Determine whether the SAML message represented by the message context is digitally signed.
      * 
      * <p>
-     * First the SAML protocol message is examined as to whether an XML signature is present.
-     * If not, then the presence of a binding signature is evaluated by looking at 
+     * First the SAML protocol message is examined as to whether an XML signature is present
+     * at the DOM level; if yes return true.
+     * Finally, the presence of a binding signature is evaluated by looking at 
      * {@link SAMLBindingContext#hasBindingSignature()}.
      * </p>
      * 
@@ -195,10 +196,37 @@ public final class SAMLBindingSupport {
      * @return true if the message is considered to be digitally signed, false otherwise
      */
     public static boolean isMessageSigned(@Nonnull final MessageContext messageContext) {
+        return isMessageSigned(messageContext, false);
+    }
+    
+    /**
+     * Determine whether the SAML message represented by the message context is digitally signed.
+     * 
+     * <p>
+     * First the SAML protocol message is examined as to whether an XML signature is present
+     * at the DOM level; if yes return true.
+     * Next if <code>presenceSatisfies</code> is true, then {@link SignableSAMLObject#getSignature()}
+     * is evaluated for a non-null value; if yes return true.
+     * Finally, the presence of a binding signature is evaluated by looking at 
+     * {@link SAMLBindingContext#hasBindingSignature()}.
+     * </p>
+     * 
+     * @param messageContext current message context
+     * @param presenceSatisfies whether the presence of a non-null {@link Signature} member satisfies the evaluation
+     * @return true if the message is considered to be digitally signed, false otherwise
+     */
+    public static boolean isMessageSigned(@Nonnull final MessageContext messageContext,
+            final boolean presenceSatisfies) {
         final Object samlMessage = Constraint.isNotNull(messageContext.getMessage(),
                 "SAML message was not present in message context");
-        if (samlMessage instanceof SignableSAMLObject && ((SignableSAMLObject)samlMessage).isSigned()) {
-            return true;
+        if (samlMessage instanceof SignableSAMLObject) {
+            final SignableSAMLObject signable = (SignableSAMLObject) samlMessage;
+            if (presenceSatisfies && signable.getSignature() != null) {
+                return true;
+            }
+            if (signable.isSigned()) {
+                return true;
+            }
         }
         
         final SAMLBindingContext bindingContext = messageContext.getSubcontext(SAMLBindingContext.class);
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/InboundMessageSignedPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/InboundMessageSignedPredicate.java
index 0f951ba..c86ba9b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/InboundMessageSignedPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/InboundMessageSignedPredicate.java
@@ -28,13 +28,25 @@ import org.opensaml.saml.common.binding.SAMLBindingSupport;
  * A predicate which evaluates whether an inbound SAML message is signed.
  */
 public class InboundMessageSignedPredicate implements Predicate<ProfileRequestContext> {
+    
+    /** Flag indicating whether the presence of a non-null {@link Signature} member satisfies the evaluation. */
+    private boolean presenceSatisfies;
+
+    /**
+     * Set whether the presence of a non-null {@link Signature} member satisfies the evaluation.
+     * 
+     * @param flag whether the presence of a non-null {@link Signature} is considered
+     */
+    public void setPresenceSatisfies(final boolean flag) {
+        presenceSatisfies = flag;
+    }
 
     /** {@inheritDoc} */
     public boolean test(@Nullable final ProfileRequestContext prc) {
         if (prc == null || prc.getInboundMessageContext() == null) {
             return false;
         }
-        return SAMLBindingSupport.isMessageSigned(prc.getInboundMessageContext());
+        return SAMLBindingSupport.isMessageSigned(prc.getInboundMessageContext(), presenceSatisfies);
     }
 
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.