Package net.shibboleth.metadata.dom

Class XMLSignatureSigningStage

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.metadata.pipeline.AbstractStage<Element>
net.shibboleth.metadata.dom.XMLSignatureSigningStage
All Implemented Interfaces:
Stage<Element>, net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.IdentifiableComponent, net.shibboleth.shared.component.IdentifiedComponent, net.shibboleth.shared.component.InitializableComponent
@ThreadSafe public class XMLSignatureSigningStage extends AbstractStage<Element>
A pipeline stage that creates, and adds, an enveloped signature for each element in the given DOMElementItem collection.

This stage requires the following properties be set prior to initialization:

  • privateKey

  • Field Details

    • LOG

      @Nonnull private static final org.slf4j.Logger LOG
      Class logger.

    • shaVariant

      @Nonnull private XMLSignatureSigningStage.SHAVariant shaVariant
      SHA algorithm variant used in signature and digest algorithms. Default value: SHAVariant.SHA256

    • privKey

      @NonnullAfterInit private PrivateKey privKey
      Private key used to sign data.

    • publicKey

      @Nullable private PublicKey publicKey
      Public key associated with the given private key.

    • certificates

      @Nonnull @NonnullElements @Unmodifiable private List<X509Certificate> certificates
      Certificate chain, with end entity certificate as element 0, to be included with the signature. Default value: empty list

    • crls

      @Nonnull @NonnullElements @Unmodifiable private List<X509CRL> crls
      CRLs to be included with the signature. Default value: empty list

    • c14nExclusive

      private boolean c14nExclusive
      Whether to use exclusive canonicalization. Default value: true

    • c14nWithComments

      private boolean c14nWithComments
      Whether to include comments in the canonicalized data. Default value: false

    • removingCRsFromSignature

      private boolean removingCRsFromSignature
      Whether to remove CR characters from generated signatures. Default value: true.

    • inclusivePrefixList

      @Nonnull @NonnullElements @Unmodifiable private List<String> inclusivePrefixList
      Inclusive prefix list used with exclusive canonicalization. Default value: empty list

    • idAttributeNames

      @Nonnull @NonnullElements @Unmodifiable private List<QName> idAttributeNames
      Names of attributes to treat as ID attributes for signature referencing. Default value: list containing the non-namespace-qualified attributes 'ID', 'Id', 'id'

    • keyNames

      @Nonnull @NonnullElements @Unmodifiable private List<String> keyNames
      Explicit names to associate with the given signing key. Default value: empty list

    • includeKeyNames

      private boolean includeKeyNames
      Whether key names should be included in the signature's KeyInfo. Default value: true

    • includeKeyValue

      private boolean includeKeyValue
      Whether the public key should be included in the signature's KeyInfo. The public key can be sourced from either the publicKey property or from the first provided certificate. Default value: false

    • includeX509SubjectName

      private boolean includeX509SubjectName
      Whether the end-entity certificate's subject name should be included in the signature's KeyInfo. Default value: false

    • includeX509Certificates

      private boolean includeX509Certificates
      Whether the certificates chain should be included in the signature's KeyInfo. Default value: true

    • includeX509Crls

      private boolean includeX509Crls
      Whether the CRLs should be included in the signature's KeyInfo. Default value: false

    • includeX509IssuerSerial

      private boolean includeX509IssuerSerial
      Whether the end-entity certificate's issuer and serial number should be included in the signature's KeyInfo. Default value: false

    • debugPreDigest

      private boolean debugPreDigest
      Whether to debug digest operations by logging the pre-digest data stream. Default value: false

  • Constructor Details

    • XMLSignatureSigningStage

      public XMLSignatureSigningStage()

  • Method Details

    • getSHAVariant

      @Nonnull public final XMLSignatureSigningStage.SHAVariant getSHAVariant()
      Gets the SHA algorithm variant used when computing the signature and digest.
      Returns:
      SHA algorithm variant used when computing the signature and digest
      Since:
      0.10.0

    • setSHAVariant

      public void setSHAVariant(@Nonnull XMLSignatureSigningStage.SHAVariant variant)
      Sets the SHA algorithm variant used when computing the signature and digest.
      Parameters:
      variant - SHA algorithm variant used when computing the signature and digest
      Since:
      0.10.0

    • getShaVariant

      @Deprecated(forRemoval=true) @Nonnull public final XMLSignatureSigningStage.SHAVariant getShaVariant()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Use getSHAVariant().
      Gets the SHA algorithm variant used when computing the signature and digest.
      Returns:
      SHA algorithm variant used when computing the signature and digest

    • setShaVariant

      @Deprecated(forRemoval=true) public void setShaVariant(@Nonnull XMLSignatureSigningStage.SHAVariant variant)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Use setSHAVariant(net.shibboleth.metadata.dom.XMLSignatureSigningStage.SHAVariant).
      Sets the SHA algorithm variant used when computing the signature and digest.
      Parameters:
      variant - SHA algorithm variant used when computing the signature and digest

    • getPrivateKey

      @Nullable public final PrivateKey getPrivateKey()
      Gets the private key used to sign the content.
      Returns:
      the privKey private key used to sign the content

    • setPrivateKey

      public void setPrivateKey(@Nonnull PrivateKey key)
      Sets the private key used to sign the content.
      Parameters:
      key - private key used to sign the content

    • getPublicKey

      @Nullable public final PublicKey getPublicKey()
      Gets the public key associated with private key used to sign the content.
      Returns:
      public key associated with private key used to sign the content

    • setPublicKey

      public void setPublicKey(@Nullable PublicKey key)
      Sets public key associated with private key used to sign the content.
      Parameters:
      key - public key associated with private key used to sign the content

    • getCertificates

      @Nonnull @NonnullElements @Unmodifiable public final List<X509Certificate> getCertificates()
      Gets the certificates associated with the key used to sign the content. The end-entity certificate is the first element in the list.
      Returns:
      certificates associated with the key used to sign the content

    • setCertificates

      public void setCertificates(@Nonnull @NonnullElements @Unmodifiable List<X509Certificate> certs)
      Sets the certificates associated with the key used to sign the content. The end-entity certificate must be the first element in the list.
      Parameters:
      certs - certificates associated with the key used to sign the content

    • getCrls

      @Nonnull @NonnullElements @Unmodifiable public final List<X509CRL> getCrls()
      Gets the CRLs associated with certificates.
      Returns:
      CRLs associated with certificates

    • setCrls

      public void setCrls(@Nonnull @NonnullElements @Unmodifiable List<X509CRL> revocationLists)
      Sets the CRLs associated with certificates.
      Parameters:
      revocationLists - CRLs associated with certificates

    • isC14nExclusive

      public final boolean isC14nExclusive()
      Gets whether exclusive canonicalization will be used.
      Returns:
      whether exclusive canonicalization will be used

    • setC14nExclusive

      public void setC14nExclusive(boolean isExclusive)
      Sets whether exclusive canonicalization will be used.
      Parameters:
      isExclusive - whether exclusive canonicalization will be used

    • isC14nWithComments

      public final boolean isC14nWithComments()
      Gets whether comments are canonicalized.
      Returns:
      whether comments are canonicalized

    • setC14nWithComments

      public void setC14nWithComments(boolean withComments)
      Sets whether comments are canonicalized.
      Parameters:
      withComments - whether comments are canonicalized

    • getInclusivePrefixList

      @Nonnull @NonnullElements @Unmodifiable public final List<String> getInclusivePrefixList()
      Gets the inclusive prefix list used during exclusive canonicalization.
      Returns:
      inclusive prefix list used during exclusive canonicalization

    • setInclusivePrefixList

      public void setInclusivePrefixList(@Nonnull @NonnullElements @Unmodifiable List<String> prefixList)
      Sets the inclusive prefix list used during exclusive canonicalization.
      Parameters:
      prefixList - inclusive prefix list used during exclusive canonicalization

    • getIdAttributeNames

      @Nonnull @NonnullElements @Unmodifiable public final List<QName> getIdAttributeNames()
      Gets the names of the attributes treated as reference IDs.
      Returns:
      names of the attributes treated as reference IDs

    • setIdAttributeNames

      public void setIdAttributeNames(@Nonnull @NonnullElements @Unmodifiable List<QName> names)
      Sets the names of the attributes treated as reference IDs.
      Parameters:
      names - names of the attributes treated as reference IDs

    • getKeyNames

      @Nonnull @NonnullElements @Unmodifiable public final List<String> getKeyNames()
      Gets the explicit key names added to the KeyInfo.
      Returns:
      explicit key names added to the KeyInfo

    • setKeyNames

      public void setKeyNames(@Nonnull @NonnullElements @Unmodifiable List<String> names)
      Sets the explicit key names added to the KeyInfo.
      Parameters:
      names - explicit key names added to the KeyInfo

    • isIncludeKeyNames

      public final boolean isIncludeKeyNames()
      Gets whether key names are included in the KeyInfo.
      Returns:
      whether key names are included in the KeyInfo

    • setIncludeKeyNames

      public void setIncludeKeyNames(boolean include)
      Sets whether key names are included in the KeyInfo.
      Parameters:
      include - whether key names are included in the KeyInfo

    • isIncludeKeyValue

      public final boolean isIncludeKeyValue()
      Gets whether key values are included in the KeyInfo.
      Returns:
      whether key values are included in the KeyInfo

    • setIncludeKeyValue

      public void setIncludeKeyValue(boolean included)
      Sets whether key values are included in the KeyInfo.
      Parameters:
      included - whether key values are included in the KeyInfo

    • isIncludeX509SubjectName

      public final boolean isIncludeX509SubjectName()
      Gets whether end-entity certifcate's subject name is included in the KeyInfo.
      Returns:
      whether end-entity certifcate's subject name is included in the KeyInfo

    • setIncludeX509SubjectName

      public void setIncludeX509SubjectName(boolean include)
      Sets whether end-entity certifcate's subject name is included in the KeyInfo.
      Parameters:
      include - whether end-entity certifcate's subject name is included in the KeyInfo

    • isIncludeX509Certificates

      public final boolean isIncludeX509Certificates()
      Gets whether X509 certificates are included in the KeyInfo.
      Returns:
      whether X509 certificates are included in the KeyInfo

    • setIncludeX509Certificates

      public void setIncludeX509Certificates(boolean include)
      Sets whether X509 certificates are included in the KeyInfo.
      Parameters:
      include - whether X509 certificates are included in the KeyInfo

    • isIncludeX509Crls

      public final boolean isIncludeX509Crls()
      Gets whether CRLs are included in the KeyInfo.
      Returns:
      whether CRLs are included in the KeyInfo

    • setIncludeX509Crls

      public void setIncludeX509Crls(boolean include)
      Sets whether CRLs are included in the KeyInfo.
      Parameters:
      include - whether CRLs are included in the KeyInfo

    • isIncludeX509IssuerSerial

      public final boolean isIncludeX509IssuerSerial()
      Gets whether the end-entity certificate's issuer and serial number are included in the KeyInfo.
      Returns:
      whether the end-entity certificate's issuer and serial number are included in the KeyInfo

    • setIncludeX509IssuerSerial

      public void setIncludeX509IssuerSerial(boolean include)
      Sets whether the end-entity certificate's issuer and serial number are included in the KeyInfo.
      Parameters:
      include - whether the end-entity certificate's issuer and serial number are included in the KeyInfo

    • isDebugPreDigest

      public final boolean isDebugPreDigest()
      Gets whether logging of the pre-digest data stream is enabled.
      Returns:
      whether logging of the pre-digest data stream is enabled

    • setDebugPreDigest

      public void setDebugPreDigest(boolean debug)
      Sets whether logging of the pre-digest data stream is enabled.
      Parameters:
      debug - whether logging of the pre-digest data stream is enabled

    • isRemovingCRsFromSignature

      public final boolean isRemovingCRsFromSignature()
      Gets whether CR characters will be removed from generated signatures.
      Returns:
      true if CR characters will be removed from generated signatures.

    • setRemovingCRsFromSignature

      public final void setRemovingCRsFromSignature(boolean newValue)
      Sets whether to remove CR characters from generated signatures.
      Parameters:
      newValue - whether to remove CR characters from generated signatures.

    • doExecute

      protected void doExecute(@Nonnull @NonnullElements List<Item<Element>> items) throws StageProcessingException
      Description copied from class: AbstractStage
      Performs the stage processing on the given Item collection.

      The stage is guaranteed to be have been initialized and not destroyed when this is invoked.

      Specified by:
      doExecute in class AbstractStage<Element>
      Parameters:
      items - collection to be processed
      Throws:
      StageProcessingException - thrown if there is an unrecoverable problem when processing the stage

    • doInitialize

      protected void doInitialize() throws net.shibboleth.shared.component.ComponentInitializationException
      Overrides:
      doInitialize in class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
      Throws:
      net.shibboleth.shared.component.ComponentInitializationException