HOWTO Create X509Credentials from public keys

[Misagh Moayyed]

Thanks. This actually led me to use "BasicResourceCredentialFactoryBean". 
Now for some reason, I am not able to actually read the public key, that is 
the incommon metadata signing key. To make sure it's not a config issue, I 
put together the following lines, taken from the above factory bean:

final UrlResource res = new 
UrlResource("https://ds.incommon.org/certs/inc-md-cert.pem");
final InputStream in = res.getInputStream();
KeyPairUtil.readPublicKey(in);

Which lead me to a "java.lang.IllegalArgumentException: Bad sequence size: 
3". I also tried manually downloading the file via curl, saving it some 
place and passing the file resource over to readPublicKey(); same result.

I must be missing something obvious, this being a late Friday afternoon isn’t 
exactly helping with that :)

> -----Original Message-----
> From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
> Sent: Thursday, June 11, 2015 5:44 PM
> To: Shib Dev
> Subject: Re: HOWTO Create X509Credentials from public keys
>
> On 6/11/15, 8:36 PM, "dev on behalf of Misagh Moayyed" <dev-
> bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:
>
> >What is the component that would allow me to create BasicX509Credential
> objects with just the public key? Or better yet, what is the right way to
> construct a “SignatureValidationFilter”?
>
> I believe an X509Credential has to have a certificate. A BasicCredential 
> (a
> supertype of that type) has just a PublicKey.
>
> As far as a filter goes, our Spring logic definitely supports constructing 
> a
> Sig filter now with only a public key (that's actually the example 
> metadata
> provider in the distribution now, oddly), so probably what you'd want to
> look at is the Spring parser for that metadata filter.
>
> net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.SignatureVali
> dationParser
>
> >
> >I see that the filter requires a trust engine, so I gave it
> “ExplicitKeySignatureTrustEngine”.
>
> Yes, check out the buildTrustEngine method(s) in that parser class. I tink
> that will point you at the right code.
>
> >For credentials, all I have is the public key and I don’t think I am able
> to use “BasicX509CredentialFactoryBean” since it needs the private key. 
> What
> would allow me to create that credential?
>
> I believe it's BasicInlineCredentialFactoryBean.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to dev-
> unsubscribe at shibboleth.net