Question on Trust Engine

[CJ Binder]

I want to understand better how trust is actually achieved using openSAML.

The documentation states using a Trust Engine to validate signature and establish trust.

Below is the code I am using for trust engine and wanted to understand better how trust is actually established.

The xml signature in my research, shows the certificate within the KeyInfo portion of the xml signature which can be used by anyone receiving the xml.  So using that value simply verifies the content was not changed but anyone can verify signature since the certificate is in the xml?

Initially I assumed that the certificate in the KeyInfo was used to compare the certificate I supply to the one that was signed, however when I removed the certificate from the keyinfo portion and tried to validate, the trust engine still validated.  This leads me to believe it is establishing trust some other way and I would like to know that way.   Within the SignatureValue of the xml is there a sha1 fingerprint of the certificate?  I could see it comparing that to the sha1 fingerprint of the certificate supplied within BasicCredential to establish that the certificate I have outside of the xml is the same as the one that signed it.

CODE THAT VALIDATES SIGNATURE
ExplicitKeySignatureTrustEngine trustEngine = getTrustEngine(signatureVerificationCertificate);
       CriteriaSet criteriaSet = new CriteriaSet();
       criteriaSet.add(new EntityIDCriteria(
       assertion.getIssuer().getValue()));
       criteriaSet.add(new UsageCriteria(UsageType.SIGNING));
       criteriaSet.add(new MetadataCriteria(IDPSSODescriptor.DEFAULT_ELEMENT_NAME,SAMLConstants.SAML20P_NS));
       if (!trustEngine.validate(response.getSignature(), criteriaSet)) {
              throw new Exception("Response signature is not valid or is not trusted.");
       }

CODE THAT CREATES THE TRUST ENGINE
private ExplicitKeySignatureTrustEngine getTrustEngine(
              X509Certificate certificate) {
              BasicX509Credential credential = new BasicX509Credential();
              credential.setEntityCertificate(certificate);

              StaticCredentialResolver credResolver = new StaticCredentialResolver(
                     credential);
              KeyInfoCredentialResolver kiResolver = SecurityHelper.buildBasicInlineKeyInfoResolver();
              ExplicitKeySignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(
                     credResolver, kiResolver);
              return trustEngine;

       }

CJ Binder
Sr Software Engineer
Ext 727

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140319/253bec4c/attachment.html