<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/8/17 5:17 AM, Massimiliano Masi
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:879267D5-7A86-4AF4-A373-66D805A9A889@mascanc.net">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
Hi All,
<div class=""><br class="">
</div>
<div class="">In OpenSAMLv2, the Signature Reference Digest
Algorithm was set using </div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; color: rgb(3, 38, 204);" class=""><span
style="color: #000000" class=""> </span><span style="color:
#931a68" class="">if</span><span style="color: #000000"
class=""> ( </span>referenceDigestAlgorithm<span
style="color: #000000" class="">!=</span><span style="color:
#931a68" class="">null</span><span style="color: #000000"
class=""> ) </span></div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> {</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> <span class="Apple-tab-span" style="white-space:pre"> </span><span
style="text-decoration: underline" class="">BasicSecurityConfiguration</span>
<span style="color: #7e504f" class="">config</span> = (<span
style="text-decoration: underline" class="">BasicSecurityConfiguration</span>)
Configuration.<span style="text-decoration: underline"
class="">getGlobalSecurityConfiguration</span>();</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> <span
style="color: #7e504f" class="">config</span>.setSignatureReferenceDigestMethod(<span
style="color: #931a68" class="">this</span>.<span
style="color: #0326cc" class="">referenceDigestAlgorithm</span>);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> }</div>
<div><br class="">
</div>
</div>
</blockquote>
<br>
So that is setting the global library security config. The literal
equivalent in v3 would be, after the
InitializationService.initialize() call, obtain the global signing
config via
org.opensaml.xmlsec.SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration(),
check and cast to BasicSignatureSigningConfiguration and set the
various options.<br>
<br>
That's just storing the desired global config however. By itself
that's not going to cause anything to happen. Read on...<br>
<br>
<br>
<br>
<blockquote type="cite"
cite="mid:879267D5-7A86-4AF4-A373-66D805A9A889@mascanc.net">
<div class="">
<div>While checking the source code of org.opensaml.xmlsec, I
found these two ways</div>
<div><br class="">
</div>
<div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; color: rgb(3, 38, 204);" class=""><span
style="color: #000000" class=""> </span><span
style="color: #931a68" class="">if</span><span
style="color: #000000" class=""> ( </span>referenceDigestAlgorithm<span
style="color: #000000" class="">!=</span><span
style="color: #931a68" class="">null</span><span
style="color: #000000" class=""> ) </span></div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> {</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; color: rgb(78, 144, 114);" class="">//
SignatureSigningParameters <span
style="text-decoration: underline" class="">ssp</span> =
new SignatureSigningParameters();</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; color: rgb(78, 144, 114);" class="">//
ssp.setSignatureReferenceDigestMethod(referenceDigestAlgorithm);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class="">
BasicSignatureSigningConfiguration <span style="color:
#7e504f" class="">config</span> =
(BasicSignatureSigningConfiguration)
DefaultSecurityConfigurationBootstrap.buildDefaultSignatureSigningConfiguration();</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class="">
LinkedList<String> <span style="color: #7e504f"
class="">signatureReferenceDigestMethod</span> = <span
style="color: #931a68" class="">new</span>
LinkedList<>();</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco; color: rgb(126, 80, 79);" class=""><span
style="color: #000000" class=""> </span>signatureReferenceDigestMethod<span
style="color: #000000" class="">.add(</span><span
style="color: #931a68" class="">this</span><span
style="color: #000000" class="">.</span><span
style="color: #0326cc" class="">referenceDigestAlgorithm</span><span
style="color: #000000" class="">);</span></div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> <span
style="color: #7e504f" class="">config</span>.setSignatureReferenceDigestMethods(<span
style="color: #7e504f" class="">signatureReferenceDigestMethod</span>);</div>
<div style="margin: 0px; font-size: 11px; line-height: normal;
font-family: Monaco;" class=""> }</div>
<br>
</div>
</div>
</blockquote>
<br>
In v3, the way you actually specify the runtime signing and
encryption parameters to the actual signing and encryption
operations is via a -Parameters instance, like above. For signing,
you'd use something like the support method
org.opensaml.xmlsec.signature.support.SignatureSupport.prepareSignatureParams(...)
to marshal the various params onto the Signature instance, or use
the signObject(...) method on that same class to prepare params and
sign all in one operation.<br>
<br>
A -Parameters instance can just be created and populated manually,
or whatever (e.g. from hard-coded values or properties file, etc).
But the intended way to do it in a more realistic, complex system
where you need to have global library defaults + user
configurability, etc, is that you have 1 or more instances of the
like-named -Configuration instance - which are hierarchical and
hence have an order-of precedence - and those are then passed as
criteria into a like-named instance of a -Resolver, which produces
the effective -Parameters instance. There are examples of that usage
in Shibboleth and also in the unit tests of opensaml-xmlsec-impl.
The resolvers and their unit tests are generally in package
org.opensaml.xmlsec.impl.<br>
<br>
</body>
</html>