HOWTO Create X509Credentials from public keys

[Cantor, Scott]

On 6/11/15, 8:36 PM, "dev on behalf of Misagh Moayyed" <dev-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:

>What is the component that would allow me to create BasicX509Credential objects with just the public key? Or better yet, what is the right way to construct a “SignatureValidationFilter”?

I believe an X509Credential has to have a certificate. A BasicCredential (a supertype of that type) has just a PublicKey.

As far as a filter goes, our Spring logic definitely supports constructing a Sig filter now with only a public key (that's actually the example metadata provider in the distribution now, oddly), so probably what you'd want to look at is the Spring parser for that metadata filter.

net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.SignatureValidationParser

> 
>I see that the filter requires a trust engine, so I gave it “ExplicitKeySignatureTrustEngine”.

Yes, check out the buildTrustEngine method(s) in that parser class. I tink that will point you at the right code.

>For credentials, all I have is the public key and I don’t think I am able to use “BasicX509CredentialFactoryBean” since it needs the private key. What would allow me to create that credential?

I believe it's BasicInlineCredentialFactoryBean.

-- Scott