[java-opensaml] branch main updated: OSJ-374: AlgorithmRegistry indexes signing algorithms only by ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=6ff24ea0de533cd4d2dee5961879e758ff857db9

The following commit(s) were added to refs/heads/main by this push:
     new 6ff24ea0d OSJ-374: AlgorithmRegistry indexes signing algorithms only by ...
6ff24ea0d is described below

commit 6ff24ea0de533cd4d2dee5961879e758ff857db9
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Aug 3 23:37:35 2023 -0400

    OSJ-374: AlgorithmRegistry indexes signing algorithms only by ...
    
    AlgorithmRegistry indexes signing algorithms only by key type + digest
---
 .../xmlsec/algorithm/AlgorithmRegistry.java        | 21 +++++++++++++
 .../algorithm/tests/AlgorithmRegistryTest.java     | 35 ++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
index b7e2500a8..9f7e29fc7 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
@@ -192,7 +192,10 @@ public class AlgorithmRegistry {
      * @param digestMethod the JCA digest method ID.
      * 
      * @return the algorithm descriptor, or null
+     * 
+     * @deprecated Use instead {@link #getSignatureAlgorithms(String, String)}
      */
+    @Deprecated
     @Nullable public SignatureAlgorithm getSignatureAlgorithm(@Nonnull final String keyType, 
             @Nonnull final String digestMethod) {
         Constraint.isNotNull(keyType, "Key type was null");
@@ -200,6 +203,24 @@ public class AlgorithmRegistry {
         return signatureAlgorithms.get(new SignatureAlgorithmIndex(keyType, digestMethod));
     }
 
+    /**
+     * Lookup signature algorithm descriptors by the JCA key algorithm and digest method IDs.
+     * 
+     * @param keyType the JCA key algorithm ID.
+     * @param digestMethod the JCA digest method ID.
+     * 
+     * @return the list of matching algorithm descriptors, possibly empty
+     */
+    @Nonnull public Set<SignatureAlgorithm> getSignatureAlgorithms(@Nonnull final String keyType, 
+            @Nonnull final String digestMethod) {
+        Constraint.isNotNull(keyType, "Key type was null");
+        Constraint.isNotNull(digestMethod, "Digest type was null");
+        return getRegisteredByType(AlgorithmType.Signature).stream()
+                .map(SignatureAlgorithm.class::cast)
+                .filter(alg -> alg.getKey().equals(keyType) && alg.getDigest().equals(digestMethod))
+                .collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableSet())).get();
+    }
+
     /**
      * Get the set of algorithm URIs registered for the given type.
      *
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
index c126e2c73..70bb8bc10 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
@@ -16,6 +16,7 @@ package org.opensaml.xmlsec.algorithm.tests;
 
 import java.util.Objects;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.core.config.InitializationException;
@@ -24,9 +25,11 @@ import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.security.testing.SecurityProviderTestSupport;
 import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
 import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
 import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA256;
 import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA256;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA256_MGF1;
 import org.opensaml.xmlsec.config.GlobalAlgorithmRegistryInitializer;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
@@ -34,6 +37,8 @@ import org.testng.Assert;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Tests for the AlgorithmRegistry.
  */
@@ -97,6 +102,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
     }
     
     @Test
+    @SuppressWarnings("deprecation")
     public void testSignatureIndexing() {
         AlgorithmRegistry registry = new AlgorithmRegistry();
         Assert.assertNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
@@ -112,6 +118,35 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
         Assert.assertNull(registry.getSignatureAlgorithm(JCAConstants.KEY_ALGO_RSA, JCAConstants.DIGEST_SHA256));
     }
     
+    @Test
+    public void testGetSignatureAlgorithms() {
+        Set<String> algorithms;
+        AlgorithmRegistry registry = new AlgorithmRegistry();
+        Assert.assertNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+
+        algorithms = registry.getSignatureAlgorithms(JCAConstants.KEY_ALGO_RSA, JCAConstants.DIGEST_SHA256).stream().map(SignatureAlgorithm::getURI).collect(Collectors.toSet());
+        Assert.assertTrue(algorithms.isEmpty());
+        
+        registry.register(new SignatureRSASHA256());
+        Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        
+        algorithms = registry.getSignatureAlgorithms(JCAConstants.KEY_ALGO_RSA, JCAConstants.DIGEST_SHA256).stream().map(SignatureAlgorithm::getURI).collect(Collectors.toSet());
+        Assert.assertEquals(algorithms, CollectionSupport.setOf(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        
+        registry.register(new SignatureRSASSA_PSS_SHA256_MGF1());
+        Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+
+        algorithms = registry.getSignatureAlgorithms(JCAConstants.KEY_ALGO_RSA, JCAConstants.DIGEST_SHA256).stream().map(SignatureAlgorithm::getURI).collect(Collectors.toSet());
+        Assert.assertEquals(algorithms, CollectionSupport.setOf(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+        
+        registry.deregister(new SignatureRSASHA256());
+        registry.deregister(new SignatureRSASSA_PSS_SHA256_MGF1());
+        Assert.assertNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        Assert.assertNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+        algorithms = registry.getSignatureAlgorithms(JCAConstants.KEY_ALGO_RSA, JCAConstants.DIGEST_SHA256).stream().map(SignatureAlgorithm::getURI).collect(Collectors.toSet());
+        Assert.assertTrue(algorithms.isEmpty());
+    }
+    
     @Test
     public void testDigestIndexing() {
         AlgorithmRegistry registry = new AlgorithmRegistry();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.