Package net.shibboleth.metadata.dom.impl

Class XMLSignatureSigner

java.lang.Object
net.shibboleth.metadata.dom.impl.XMLSignatureSigner
@NotThreadSafe public class XMLSignatureSigner extends Object
A class that encapsulates the various stages in signing an XML document.

This implementation is not thread safe, but can be used sequentially to sign a number of different documents.

As an adjunct to an XMLSignatureSigningStage instance, it snapshots its parameters during construction so that they can be used without synchronization during operation.

  • Field Details

    • log

      @Nonnull private final org.slf4j.Logger log
      Logger provided by the calling class.

    • privKey

      @Nonnull private final PrivateKey privKey
      Private key used to sign data.

    • publicKey

      @Nullable private final PublicKey publicKey
      Public key associated with the given private key.

    • inclusivePrefixList

      @Nonnull @NonnullElements @Unmodifiable private final List<String> inclusivePrefixList
      Inclusive prefix list used with exclusive canonicalization.

    • idAttributeNames

      @Nonnull @NonnullElements @Unmodifiable private final List<QName> idAttributeNames
      Names of attributes to treat as ID attributes for signature referencing. Default value: list containing the non-namespace-qualified attributes 'ID', 'Id', 'id'

    • keyNames

      @Nonnull @NonnullElements @Unmodifiable private final List<String> keyNames
      Explicit names to associate with the given signing key.

    • certificates

      @Nonnull @NonnullElements @Unmodifiable private final List<X509Certificate> certificates
      Certificate chain, with end entity certificate as element 0, to be included with the signature.

    • crls

      @Nonnull @NonnullElements @Unmodifiable private final List<X509CRL> crls
      CRLs to be included with the signature.

    • includeKeyNames

      private final boolean includeKeyNames
      Whether key names should be included in the signature's KeyInfo.

    • includeKeyValue

      private final boolean includeKeyValue
      Whether the public key should be included in the signature's KeyInfo.

    • includeX509SubjectName

      private final boolean includeX509SubjectName
      Whether the end-entity certificate's subject name should be included in the signature's KeyInfo.

    • includeX509Certificates

      private final boolean includeX509Certificates
      Whether the certificates chain should be included in the signature's KeyInfo.

    • includeX509Crls

      private final boolean includeX509Crls
      Whether the CRLs should be included in the signature's KeyInfo.

    • includeX509IssuerSerial

      private final boolean includeX509IssuerSerial
      Whether the end-entity certificate's issuer and serial number should be included in the signature's KeyInfo.

    • debugPreDigest

      private final boolean debugPreDigest
      Whether to debug digest operations by logging the pre-digest data stream.

    • removingCRsFromSignature

      private final boolean removingCRsFromSignature
      Whether to remove CR characters from generated signatures.

    • c14nAlgo

      @Nonnull private final String c14nAlgo
      Canonicalization algorithm to use. This is determined from the c14nExclusive and c14nWithComments properties.

    • sigAlgo

      @Nonnull private final String sigAlgo
      Signature algorithm used.

    • digestAlgo

      @Nonnull private final String digestAlgo
      Digest algorithm used.

    • xmlSigFactory

      @Nonnull private final XMLSignatureFactory xmlSigFactory
      Factory used to create XML signature objects.

    • keyInfoFactory

      @Nonnull private final KeyInfoFactory keyInfoFactory
      Factory used to create KeyInfo objects.

  • Constructor Details

    • XMLSignatureSigner

      public XMLSignatureSigner(@Nonnull XMLSignatureSigningStage stage, @Nonnull org.slf4j.Logger logger)
      Constructor.
      Parameters:
      stage - the XMLSignatureSigningStage we are acting as an adjunct to
      logger - the logger for the calling stage

  • Method Details

    • sign

      public void sign(@Nonnull Item<Element> item) throws StageProcessingException
      Sign an individual item.
      Parameters:
      item - the Item to sign
      Throws:
      StageProcessingException - if an error occurs preventing the signature from being made

    • buildSignedInfo

      @Nonnull protected SignedInfo buildSignedInfo(@Nonnull Element target) throws StageProcessingException
      Gets the descriptor of signed content.
      Parameters:
      target - the element that will be signed
      Returns:
      signed content descriptor
      Throws:
      StageProcessingException - thrown if there is a problem creating the signed content descriptor

    • buildSignatureReference

      @Nonnull protected Reference buildSignatureReference(@Nonnull Element target) throws StageProcessingException
      Builds the references to the signed content.
      Parameters:
      target - the element to be signed
      Returns:
      reference to signed content
      Throws:
      StageProcessingException - thrown if there is a problem creating the reference to the element

    • getElementId

      @Nullable protected String getElementId(@Nonnull Element target)
      Determines the ID for the element to be signed. To determine the ID first, all the element attributes are inspected, if one matches the provided idAttributeNames then the value of the attribute is used as the ID value. If no ID attribute names are given, or none of the given ones match, and one or more of the attributes is marked as an ID attribute (i.e. Attr.isId() is true), then the value of one of those attributes is used.
      Parameters:
      target - an element to be referenced by the signature
      Returns:
      the ID value for the element, or null

    • buildKeyInfo

      @Nullable protected KeyInfo buildKeyInfo() throws StageProcessingException
      Builds the KeyInfo element to be included in the signature.
      Returns:
      KeyInfo element to be included in the signature
      Throws:
      StageProcessingException - thrown if there is a problem creating the KeyInfo descriptor

    • addKeyNames

      protected void addKeyNames(@Nonnull @NonnullElements @Live List<XMLStructure> keyInfoItems) throws StageProcessingException
      Adds key names to the KeyInfo, if key names are to be included.
      Parameters:
      keyInfoItems - collector for KeyInfo children
      Throws:
      StageProcessingException - thrown if there is a problem creating the KeyName content

    • addKeyValue

      protected void addKeyValue(@Nonnull @NonnullElements @Live List<XMLStructure> keyInfoItems) throws StageProcessingException
      Adds raw key values to the KeyInfo if key values are to be included.
      Parameters:
      keyInfoItems - collector for KeyInfo children
      Throws:
      StageProcessingException - thrown if there is a problem creating the KeyValue content

    • addX509Data

      protected void addX509Data(@Nonnull @NonnullElements @Live List<XMLStructure> keyInfoItems)
      Adds X509 data (subject names, certificates, CRLs, and Issuer/Serial) set to be included, into the key info.
      Parameters:
      keyInfoItems - collector for KeyInfo children

    • removeCRsFromNamedChildren

      private void removeCRsFromNamedChildren(@Nonnull Element signature, @Nonnull String elementName)
      Remove any CRs from the text content of named child elements.
      Parameters:
      signature - The Signature element to process.
      elementName - The element name within the XML DSIG namespace to look for.