Package net.shibboleth.metadata.validate.x509

Class X509DSADetector

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.metadata.validate.BaseValidator
net.shibboleth.metadata.validate.x509.X509DSADetector
All Implemented Interfaces:
Validator<X509Certificate>, net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.IdentifiableComponent, net.shibboleth.shared.component.IdentifiedComponent, net.shibboleth.shared.component.InitializableComponent
@ThreadSafe public class X509DSADetector extends BaseValidator implements Validator<X509Certificate>
Validator class to check that X.509 certificates do not contain DSA public keys.

The original Digital Signature Algorithm (DSA) is very weak by modern standards, involving a 1024-bit key and the SHA-1 digest algorithm.

By default, this validator adds an ErrorStatus to an item containing a certificate wrapping a DSA public key, and returns Validator.Action.DONE on the basis that further processing of the certificate is unlikely to be desired.

The error property may be set to false to downgrade the ErrorStatus to a WarningStatus.

The action property may be set to Validator.Action.CONTINUE if there is a need to perform additional validation on a DSA certificate.

Since:
0.10.0

  • Nested Class Summary

    Nested classes/interfaces inherited from interface net.shibboleth.metadata.validate.Validator

    Validator.Action

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private Validator.Action
    action
    Validator.Action to return when a DSA key is detected.
    private boolean
    error
    Whether an ErrorStatus should be added on failure.

  • Constructor Summary

    Constructors
    Constructor
    Description
    X509DSADetector()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    final Validator.Action
    getAction()
    Returns the Validator.Action to be returned if a DSA key is detected.
    final boolean
    isError()
    Returns whether an ErrorStatus is being added on failure.
    void
    setAction(Validator.Action newAction)
    Sets the Validator.Action to be returned if a DSA key is detected.
    void
    setError(boolean newValue)
    Set whether an ErrorStatus should be added on failure.
    Validator.Action
    validate(X509Certificate cert, Item<?> item, String callerId)
    Apply the validator to a value in the context of the given Item.

    Methods inherited from class net.shibboleth.metadata.validate.BaseValidator

    addError, addErrorMessage, addErrorMessage, addErrorMessage, addStatus, addWarning, getMessage, makeComponentId, setMessage

    Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent

    setId

    Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

    doInitialize, ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

    Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

    checkComponentActive, checkSetterPreconditions, destroy, doDestroy, initialize, isDestroyed, isInitialized

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface net.shibboleth.shared.component.DestructableComponent

    destroy, isDestroyed

    Methods inherited from interface net.shibboleth.shared.component.IdentifiableComponent

    setId

    Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

    getId

    Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

    initialize, isInitialized

    Methods inherited from interface net.shibboleth.metadata.validate.Validator

    validate

  • Field Details

  • Constructor Details

    • X509DSADetector

      public X509DSADetector()

  • Method Details

    • getAction

      @Nonnull public final Validator.Action getAction()
      Returns the Validator.Action to be returned if a DSA key is detected.
      Returns:
      the Validator.Action to be returned

    • setAction

      public void setAction(@Nonnull Validator.Action newAction)
      Sets the Validator.Action to be returned if a DSA key is detected.
      Parameters:
      newAction - the Validator.Action to be returned

    • setError

      public void setError(boolean newValue)
      Set whether an ErrorStatus should be added on failure.
      Parameters:
      newValue - whether an ErrorStatus should be added on failure

    • isError

      public final boolean isError()
      Returns whether an ErrorStatus is being added on failure.
      Returns:
      true if an ErrorStatus is being added on failure.

    • validate

      @Nonnull public Validator.Action validate(@Nonnull X509Certificate cert, @Nonnull Item<?> item, @Nonnull String callerId)
      Description copied from interface: Validator
      Apply the validator to a value in the context of the given Item.

      The validator influences future processing by adding item metadata to the Item.

      A common case is that the validator will add a StatusMetadata to the Item, for example a ErrorStatus. In this case, the convention is that the componentId of the ErrorStatus would be created by combining the callerId with a / and the validator's own identifier. For example, a validator val called by a stage stage would normally use a componentId of stage/val.

      Specified by:
      validate in interface Validator<X509Certificate>
      Parameters:
      cert - the value to be validated
      item - the Item context for the validation
      callerId - a String identifying the caller
      Returns:
      an indication of whether to process additional validators