Signature Reference Algorithm

[Brent Putman]

On 5/8/17 5:17 AM, Massimiliano Masi wrote:
> Hi All, 
>
> In OpenSAMLv2, the Signature Reference Digest Algorithm was set using 
>
>   if( referenceDigestAlgorithm!=null) 
>         {
>         BasicSecurityConfiguration config =
> (BasicSecurityConfiguration)
> Configuration.getGlobalSecurityConfiguration();
>            
> config.setSignatureReferenceDigestMethod(this.referenceDigestAlgorithm);
>         }
>

So that is setting the global library security config.  The literal
equivalent in v3 would be, after the InitializationService.initialize()
call, obtain the global signing config via
org.opensaml.xmlsec.SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration(),
check and cast to BasicSignatureSigningConfiguration and set the various
options.

That's just storing the desired global config however.  By itself that's
not going to cause anything to happen.  Read on...



> While checking the source code of org.opensaml.xmlsec, I found these
> two ways
>
>         if( referenceDigestAlgorithm!=null) 
>         {
> //            SignatureSigningParameters ssp = new
> SignatureSigningParameters();
> //           
> ssp.setSignatureReferenceDigestMethod(referenceDigestAlgorithm);
>             BasicSignatureSigningConfiguration config =
> (BasicSignatureSigningConfiguration)
> DefaultSecurityConfigurationBootstrap.buildDefaultSignatureSigningConfiguration();
>             LinkedList<String> signatureReferenceDigestMethod = new
> LinkedList<>();
>            
> signatureReferenceDigestMethod.add(this.referenceDigestAlgorithm);
>            
> config.setSignatureReferenceDigestMethods(signatureReferenceDigestMethod);
>         }
>

In v3, the way you actually specify the runtime signing and encryption
parameters to the actual signing and encryption operations is via a
-Parameters instance, like above.  For signing, you'd use something like
the support method
org.opensaml.xmlsec.signature.support.SignatureSupport.prepareSignatureParams(...)
to marshal the various params onto the Signature instance, or use the
signObject(...) method on that same class to prepare params and sign all
in one operation.

A -Parameters instance can just be created and populated manually, or
whatever (e.g. from hard-coded values or properties file, etc).  But the
intended way to do it in a more realistic, complex system where you need
to have global library defaults + user configurability, etc, is that you
have 1 or more instances of the like-named -Configuration instance -
which are hierarchical and hence have an order-of precedence - and those
are then passed as criteria into a like-named instance of a -Resolver,
which produces the effective -Parameters instance. There are examples of
that usage in Shibboleth and also in the unit tests of
opensaml-xmlsec-impl.  The resolvers and their unit tests are generally
in package org.opensaml.xmlsec.impl.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170509/69cd82a1/attachment-0001.html>