XML signature validation

[Brent Putman]

On 12/15/14 2:51 PM, Sandy wrote:
> Thank you Brent.
>
> The SP is built with OpenSAML Java(2.6.3). Like you correctly guessed,
> at the moment I am looking to resolve a Credential from KeyInfo.

We have a KeyInfoCredentialResolver exactly for that purpose.  That's an
interface.  For the signature validation processing case, the main impl
to look at is:
org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver.

You can get a basic instance of that with the typical providers already
wired in (suitable for your use case) from:
Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver()

The unit tests should give you usage examples.



>
> Thank you for the advise on establishing trust. I now understand how
> important it is and I would implement it. The more complex example at
> the bottom serves as a great resource for this.
>

That example illustrates the trust establishment using SAML metadata,
b/c that is the trusted CredentialResolver that is specified.  If you
wanted to use a different source of trusted Credentials for the
ExplicitKeySignatureTrustEngine, you would just swap out the
metadata-based one for a different one.  There are several
CredentialResolver impls.


> If there happen to be examples citing the usage of credential
> resolvers and a basic signature trust engine, it would be great to
> know them. I plan on using a local trust store at the SP for
> establishing the trust.

Well, that example in the wiki is pretty complete, as far as just using
the trust engine.  Other than that, there's just unit tests and the
Shibboleth IdP, which is built on top of all of this.  I don't know what
exactly you want to know, but if you have specific questions, just post
them here.

--Brent

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141215/783e22c2/attachment-0001.html