Package net.shibboleth.idp.saml.security.impl

Class MetadataPKIXValidationInformationResolver

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, Resolver<PKIXValidationInformation,CriteriaSet>, PKIXValidationInformationResolver

public class MetadataPKIXValidationInformationResolver
extends AbstractInitializableComponent
implements PKIXValidationInformationResolver

An implementation of PKIXValidationInformationResolver which resolves PKIXValidationInformation based on information stored in SAML 2 metadata. Validation information is retrieved from Shibboleth-specific metadata extensions to EntityDescriptor represented by instances of KeyAuthority, as well as instances of PKIXValidationInformation which have been previously populated within the data set available from XMLObject.getObjectMetadata(). Resolution of trusted names for an entity is also supported, based on KeyName information contained within the KeyInfo of a role descriptor's KeyDescriptor element.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT	Default value for Shibboleth KeyAuthority verify depth.
private final org.slf4j.Logger	log	Class logger.
private RoleDescriptorResolver	roleDescriptorResolver	Metadata RoleDescriptor resolver used to resolve metadata information.

Constructor Summary

Constructors

Constructor	Description
MetadataPKIXValidationInformationResolver(RoleDescriptorResolver resolver)	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	checkCriteriaRequirements(CriteriaSet criteriaSet)	Check that all necessary criteria are available.
protected void	extractPKIXInfo(Collection<PKIXValidationInformation> accumulator, KeyAuthority keyAuthority)	Retrieves validation information from the Shibboleth KeyAuthority resolver extension element.
RoleDescriptorResolver	getRoleDescriptorResolver()	Get the metadata RoleDescriptor resolver instance used by this resolver.
protected Iterable<RoleDescriptor>	getRoleDescriptors(CriteriaSet criteriaSet, String entityID, QName role, String protocol)	Get the list of resolver role descriptors which match the given entityID, role and protocol.
protected void	getTrustedNames(Set<String> accumulator, KeyInfo keyInfo)	Extract trusted names from a KeyInfo element.
protected boolean	matchUsage(UsageType metadataUsage, UsageType criteriaUsage)	Match usage enum type values from resolver KeyDescriptor and from specified resolution criteria.
Iterable<PKIXValidationInformation>	resolve(CriteriaSet criteriaSet)
protected void	resolvePKIXInfo(Collection<PKIXValidationInformation> accumulator, Extensions extensions)	Retrieves validation information from the resolver extension element.
protected void	resolvePKIXInfo(Collection<PKIXValidationInformation> accumulator, RoleDescriptor roleDescriptor)	Retrieves validation information from the provided role descriptor.
PKIXValidationInformation	resolveSingle(CriteriaSet criteriaSet)
Set<String>	resolveTrustedNames(CriteriaSet criteriaSet)
protected Collection<PKIXValidationInformation>	retrievePKIXInfoFromMetadata(CriteriaSet criteriaSet, String entityID, QName role, String protocol)	Retrieves validation information from the provided resolver.
protected Set<String>	retrieveTrustedNamesFromMetadata(CriteriaSet criteriaSet, String entityID, QName role, String protocol, UsageType usage)	Retrieves trusted name information from the provided resolver.
boolean	supportsTrustedNameResolution()

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT

public static final int KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT

Default value for Shibboleth KeyAuthority verify depth.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

roleDescriptorResolver

@Nonnull
private RoleDescriptorResolver roleDescriptorResolver

Metadata RoleDescriptor resolver used to resolve metadata information.

Constructor Details

MetadataPKIXValidationInformationResolver

public MetadataPKIXValidationInformationResolver(@Nonnull @ParameterName(name="resolver")
 RoleDescriptorResolver resolver)

Constructor.

Parameters:

resolver - role descriptor resolver

Method Details

getRoleDescriptorResolver

@Nonnull
public RoleDescriptorResolver getRoleDescriptorResolver()

Get the metadata RoleDescriptor resolver instance used by this resolver.

Returns:

the resolver's RoleDescriptor metadata resolver instance

resolveSingle

@Nullable
public PKIXValidationInformation resolveSingle(@Nullable
 CriteriaSet criteriaSet)
                                        throws ResolverException

Specified by:

resolveSingle in interface Resolver<PKIXValidationInformation,CriteriaSet>

Throws:

ResolverException

resolve

@Nonnull
public Iterable<PKIXValidationInformation> resolve(@Nullable
 CriteriaSet criteriaSet)
                                            throws ResolverException

Specified by:

resolve in interface Resolver<PKIXValidationInformation,CriteriaSet>

Throws:

ResolverException

resolveTrustedNames

@Nonnull
public Set<String> resolveTrustedNames(@Nullable
 CriteriaSet criteriaSet)
                                throws ResolverException

Specified by:

resolveTrustedNames in interface PKIXValidationInformationResolver

Throws:

ResolverException

supportsTrustedNameResolution

public boolean supportsTrustedNameResolution()

Specified by:

supportsTrustedNameResolution in interface PKIXValidationInformationResolver

checkCriteriaRequirements

protected void checkCriteriaRequirements(@Nonnull
 CriteriaSet criteriaSet)

Check that all necessary criteria are available.

Parameters:

criteriaSet - the criteria set to evaluate

retrievePKIXInfoFromMetadata

@Nonnull
protected Collection<PKIXValidationInformation> retrievePKIXInfoFromMetadata(@Nullable
 CriteriaSet criteriaSet,
 @Nonnull
 String entityID,
 @Nonnull
 QName role,
 @Nullable
 String protocol)
                                                                      throws ResolverException

Retrieves validation information from the provided resolver.

Parameters:

criteriaSet - the criteria set being processed

entityID - entity ID for which to resolve validation information

role - role in which the entity is operating

protocol - protocol over which the entity is operating (may be null)

Returns:

collection of resolved validation information, possibly empty

Throws:

ResolverException - thrown if the key, certificate, or CRL information is represented in an unsupported format

resolvePKIXInfo

protected void resolvePKIXInfo(@Nonnull
 Collection<PKIXValidationInformation> accumulator,
 @Nonnull
 RoleDescriptor roleDescriptor)
                        throws ResolverException

Retrieves validation information from the provided role descriptor.

Parameters:

roleDescriptor - the role descriptor from which to resolve information.

accumulator - accumulator of PKIX validation information to return

Throws:

ResolverException - thrown if the key, certificate, or CRL information is represented in an unsupported format

resolvePKIXInfo

protected void resolvePKIXInfo(@Nonnull
 Collection<PKIXValidationInformation> accumulator,
 @Nullable
 Extensions extensions)
                        throws ResolverException

Retrieves validation information from the resolver extension element.

Parameters:

extensions - the extension element from which to resolve information

accumulator - accumulator of PKIX validation information to return

Throws:

ResolverException - thrown if the key, certificate, or CRL information is represented in an unsupported format

extractPKIXInfo

protected void extractPKIXInfo(@Nonnull
 Collection<PKIXValidationInformation> accumulator,
 @Nonnull
 KeyAuthority keyAuthority)
                        throws ResolverException

Retrieves validation information from the Shibboleth KeyAuthority resolver extension element.

Parameters:

keyAuthority - the Shibboleth KeyAuthority element from which to resolve information

accumulator - accumulator of PKIX validation information to return

Throws:

ResolverException - thrown if the key, certificate, or CRL information is represented in an unsupported format

retrieveTrustedNamesFromMetadata

@Nonnull
@Live
protected Set<String> retrieveTrustedNamesFromMetadata(@Nullable
 CriteriaSet criteriaSet,
 @Nonnull
 String entityID,
 @Nonnull
 QName role,
 @Nullable
 String protocol,
 @Nonnull
 UsageType usage)
                                                throws ResolverException

Retrieves trusted name information from the provided resolver.

Parameters:

criteriaSet - the criteria set being processed

entityID - entity ID for which to resolve trusted names

role - role in which the entity is operating

protocol - protocol over which the entity is operating (may be null)

usage - usage specifier for role descriptor key descriptors to evaluate

Returns:

collection of resolved trusted name information, possibly empty

Throws:

SecurityException - thrown if there is an error extracting trusted name information

ResolverException - if we have an error getting the role descriptors

getTrustedNames

protected void getTrustedNames(@Nonnull
 Set<String> accumulator,
 @Nonnull
 KeyInfo keyInfo)

Extract trusted names from a KeyInfo element.

Parameters:

keyInfo - the KeyInfo instance from which to extract trusted names

accumulator - set of trusted names to return

matchUsage

protected boolean matchUsage(@Nonnull
 UsageType metadataUsage,
 @Nonnull
 UsageType criteriaUsage)

Match usage enum type values from resolver KeyDescriptor and from specified resolution criteria.

Parameters:

metadataUsage - the value from the 'use' attribute of a resolver KeyDescriptor element

criteriaUsage - the value from specified criteria

Returns:

true if the two usage specifiers match for purposes of resolving validation information, false otherwise

getRoleDescriptors

@Nonnull
protected Iterable<RoleDescriptor> getRoleDescriptors(@Nullable
 CriteriaSet criteriaSet,
 @Nonnull
 String entityID,
 @Nonnull
 QName role,
 @Nullable
 String protocol)
                                               throws ResolverException

Get the list of resolver role descriptors which match the given entityID, role and protocol.

Parameters:

criteriaSet - the criteria set being processed

entityID - entity ID of the resolver entity descriptor to resolve

role - role in which the entity is operating

protocol - protocol over which the entity is operating (may be null)

Returns:

a list of role descriptors matching the given parameters, or null

Throws:

ResolverException - thrown if there is an error retrieving role descriptors from the resolver provider