Generating KeyInfo for sigature

[Brent Putman]

On 7/16/15 2:13 PM, Cantor, Scott wrote:
> On 7/16/15, 7:57 AM, "dev on behalf of Stefan Rasmusson" <dev-bounces at shibboleth.net on behalf of rasmusson.stefan at gmail.com> wrote:
>
>> Im trying to add KeyInfo to my signature. I have tried using SecurityHelper.prepareSignatureParams(signature,
>> signingCredential, secConfig, keyInfoGeneratorProfile);but this does not add the x509 properties like issuer name etc.
>>
>> How can I generate a keyinfo with these properties?
> Brent question, I only know what the IdP does and it basically does what we wanted it to, which I think is just based on OpenSAML defaults:
>
> 	// Generator for X509Credentials
> 	X509KeyInfoGeneratorFactory x509Factory = new X509KeyInfoGeneratorFactory();
> 	x509Factory.setEmitEntityCertificate(true);
> 	x509Factory.setEmitEntityCertificateChain(true);
>


That's correct, what it emits is determined by the flags set on the
factory.  The X509 one has a lots of options, which are generally the
emit* methods.

This looks like v2 and presumably you are calling the above helper
method with null for both the secConfig and keyInfoGeneratorProfile
params?  In that case, what you effectively get is the default factory
from the global SecurityConfiguration, which essentially comes from here:

Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().getDefaultManager()


You can either 1) pass a custom instance of SecurityConfiguration there,
or 2) just augment the global instance with what you want.  #2 is
probably easier since you don't have to build up all the other stuff.

For #2, you can either:

A) globally change the settings on the registered default
X509KeyInfoGeneratorFactory on the default manager by finding the
Factory via this and changing it:

Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().getDefaultManager().getFactories();

Check and cast for the X509 one and then mutate it.  Be advised, that
will change what you emit for *all* X509Credentials.


B) register a new named factory in the manager using:

Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().registerFactory("yourName",
yourFactory);

And then when you call prepareSignatureParams, pass "yourName" as the
keyInfoGeneratorProfile param.


That's a pretty brief sketch.  Let me know if you have questions.

--Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150716/d3d2e05f/attachment-0001.html>