<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I want to understand better how trust is actually achieved using openSAML.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The documentation states using a Trust Engine to validate signature and establish trust.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below is the code I am using for trust engine and wanted to understand better how trust is actually established.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The xml signature in my research, shows the certificate within the KeyInfo portion of the xml signature which can be used by anyone receiving the xml. So using that value simply verifies the content was not changed but anyone can verify
signature since the certificate is in the xml?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Initially I assumed that the certificate in the KeyInfo was used to compare the certificate I supply to the one that was signed, however when I removed the certificate from the keyinfo portion and tried to validate, the trust engine still
validated. This leads me to believe it is establishing trust some other way and I would like to know that way. Within the SignatureValue of the xml is there a sha1 fingerprint of the certificate? I could see it comparing that to the sha1 fingerprint of
the certificate supplied within BasicCredential to establish that the certificate I have outside of the xml is the same as the one that signed it.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">CODE THAT VALIDATES SIGNATURE<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in;text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">ExplicitKeySignatureTrustEngine trustEngine = getTrustEngine(signatureVerificationCertificate);</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> CriteriaSet criteriaSet =
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> CriteriaSet();</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> criteriaSet.add(</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black">
EntityIDCriteria(</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">assertion</span><span style="font-size:10.0pt;font-family:Consolas;color:black">.getIssuer().getValue()));</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> criteriaSet.add(</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black">
UsageCriteria(UsageType.</span><i><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">SIGNING</span></i><span style="font-size:10.0pt;font-family:Consolas;color:black">));</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> criteriaSet.add(</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black">
MetadataCriteria(IDPSSODescriptor.</span><i><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">DEFAULT_ELEMENT_NAME</span></i><span style="font-size:10.0pt;font-family:Consolas;color:black">,SAMLConstants.</span><i><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">SAML20P_NS</span></i><span style="font-size:10.0pt;font-family:Consolas;color:black">));</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">if</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> (!trustEngine.validate(</span><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">response</span><span style="font-size:10.0pt;font-family:Consolas;color:black">.getSignature(),
criteriaSet)) {</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">throw</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> Exception(</span><span style="font-size:10.0pt;font-family:Consolas;color:#2A00FF">"Response signature
is not valid or is not trusted."</span><span style="font-size:10.0pt;font-family:Consolas;color:black">);</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black">CODE THAT CREATES THE TRUST ENGINE<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:.5in;text-autospace:none"><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">private</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> ExplicitKeySignatureTrustEngine getTrustEngine(</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> X509Certificate certificate) {</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> BasicX509Credential credential =
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> BasicX509Credential();</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> credential.setEntityCertificate(certificate);</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> StaticCredentialResolver credResolver =
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> StaticCredentialResolver(</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> credential);</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> KeyInfoCredentialResolver kiResolver = SecurityHelper.<i>buildBasicInlineKeyInfoResolver</i>();</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> ExplicitKeySignatureTrustEngine trustEngine =
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> ExplicitKeySignatureTrustEngine(</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> credResolver, kiResolver);</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">return</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> trustEngine;</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black"> }</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">CJ Binder<o:p></o:p></p>
<p class="MsoNormal">Sr Software Engineer<o:p></o:p></p>
<p class="MsoNormal">Ext 727<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>