Building a Credential from a Signature

[Matthew Berry]

After parsing and unmarshalling an Assertion from XML, what is the
best approach for extracting a credential from the Assertion's
signature (assuming it is signed and that there is enough information
present to form a credential).

>From reading through the javadocs and code this is the approach that
seems to be used.

// Configure KeyInfoProviders (I'm only interested in RSA/X509)
ArrayList<KeyInfoProvider> providers = new ArrayList<KeyInfoProvider>();
providers.add(new RSAKeyValueProvider());
providers.add(new InlineX509DataProvider());

// Build a KeyInfoCredentialResolver with those providers
KeyInfoCredentialResolver resolver = new
BasicProviderKeyInfoCredentialResolver(providers);

// Assemble a simple CriteriaSet, since I don't really have any requirements
CriteriaSet set = new CriteriaSet();
set.add(new EvaluableKeyLengthCredentialCriteria(1024));
set.add(new KeyInfoCriteria(sig.getKeyInfo()));

// Attempt to extract a Credential
resolver.resolveSingle(set);


I keep hitting troubles deep in the bowels of
org.apache.commons.ssl.TrustMaterial which leads me to believe I'm on
the wrong track. The goal is simply to extract the Credential, if
present, or fail in a peaceful matter. This is a one-off JSP that
accepts HTTP-POST AuthnResponses and displays a bunch of diagnostic
information about them so it's not mission critical code. There's no
need to trust keys or CAs or anything.

Thanks in Advance,
-Matt