Populate signature validation parameters in SecurityParametersContext from peer metadata

[Anshul Sirur]

Hi,

I'm currently porting some code to OS3's MessageHandler framework. I
want to validate a SAML Response using the X509 credential in the
sender's metadata.

Is it possible/recommended to populate the
SignatureValidationParameters of a SecurityParametersContext using the
SAMLMetadataContext+SAMLPeerEntityContext? Both are subcontexts of the
same MessageContext and I want to validate the signature of a SAML
Response using a SAMLProtocolMessageXMLSignatureSecurityHandler. Here
is some example code:

 1    HTTPPostDecoder decoder = new HTTPPostDecoder();
 2    decoder.setHttpServletRequest(httpServletRequest);
 3    decoder.initialize();
 4    decoder.decode();
 5
 6    MessageContext<SAMLObject> messageContext = decoder.getMessageContext();
 7    SAMLPeerEntityContext senderEntityContext =
messageContext.getSubcontext(SAMLPeerEntityContext.class, true);
 8    senderEntityContext.setRole(IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
 9
10    SAMLMetadataLookupHandler metadataLookupHandler = new
SAMLMetadataLookupHandler();
11    metadataLookupHandler.setRoleDescriptorResolver(
12        senderMetadata.getMetadataCredentialResolver().getRoleDescriptorResolver()
13    );
14
15    PopulateSignatureValidationParametersHandler
signatureValidationParametersHandler = new
PopulateSignatureValidationParametersHandler();
16
17    // *** Is there a better way of doing this? ***
18    signatureValidationParametersHandler.setConfigurationLookupStrategy(msgCtx
-> {
19        SAMLMetadataContext metadataCtx =
msgCtx.getSubcontext(SAMLMetadataContext.class);
20        BasicSignatureValidationConfiguration
signatureValidationConfiguration =
(BasicSignatureValidationConfiguration)
ConfigurationService.get(SignatureValidationConfiguration.class);
21        signatureValidationConfiguration.setSignatureTrustEngine(senderMetadata.getSignatureTrustEngine());
22        return List.of(signatureValidationConfiguration);
23    });
24    signatureValidationParametersHandler.setSignatureValidationParametersResolver(new
BasicSignatureValidationParametersResolver());
25
26    SAMLProtocolMessageXMLSignatureSecurityHandler
signatureSecurityHandler = new
SAMLProtocolMessageXMLSignatureSecurityHandler();

There don't seem to be any Handlers in the current OS3 API that do the
job of lines 19-22. Validating a message signature using the X509
credential presented in the peer metadata seems like something that
would happen frequently so this might be useful functionality to
implement.

-- 
Anshul Sirur
Senior Developer, GOV.UK Verify
Government Digital Service