Package net.shibboleth.metadata.dom

Class XMLSignatureValidationStage

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent
net.shibboleth.metadata.pipeline.AbstractStage<Element>
net.shibboleth.metadata.dom.XMLSignatureValidationStage
All Implemented Interfaces:
Stage<Element>, net.shibboleth.shared.component.Component, net.shibboleth.shared.component.DestructableComponent, net.shibboleth.shared.component.IdentifiableComponent, net.shibboleth.shared.component.IdentifiedComponent, net.shibboleth.shared.component.InitializableComponent
@ThreadSafe public class XMLSignatureValidationStage extends AbstractStage<Element>
A pipeline stage which validates the XML digital signature found on DOM Elements.

This stage requires the following properties be set prior to initialization:

  • verificationKey

If Element signatures are required, per signatureRequired, and an Element does not contain a signature than an ErrorStatus object is set on the Element.

If Element signatures are required to be valid, per isValidSignatureRequired(), and an Element signature is found to be invalid than an ErrorStatus object is set on the element. If signatures are not required to be valid and an Element signature is found to be invalid than an WarningStatus is set on the Element.

  • Field Details

    • LOG

      @Nonnull private static final org.slf4j.Logger LOG
      Class logger.

    • signatureRequired

      private boolean signatureRequired
      Whether Elements are required to be signed.

    • validSignatureRequired

      private boolean validSignatureRequired
      Whether the signature on a Elements is required to be valid. Default value: true

    • verificationCertificate

      @Nullable private Certificate verificationCertificate
      Certificate whose public key is used to verify the Element signature.

    • verificationKey

      @NonnullAfterInit private PublicKey verificationKey
      Public key used to verify the Element signature.

    • disallowedDigests

      @Nonnull @NonnullElements @Unmodifiable private Set<String> disallowedDigests
      Set of disallowed digest URIs. Default value: empty set.

    • disallowedSignatureMethods

      @Nonnull @NonnullElements @Unmodifiable private Set<String> disallowedSignatureMethods
      Set of disallowed signature method URIs. Default value: empty set.

    • permittingEmptyReferences

      private boolean permittingEmptyReferences
      Option to determine whether empty references are to be permitted. Default value: true.

  • Constructor Details

    • XMLSignatureValidationStage

      public XMLSignatureValidationStage()

  • Method Details

    • isSignatureRequired

      public final boolean isSignatureRequired()
      Gets whether the Element is required to be signed.
      Returns:
      whether the Element is required to be signed

    • setSignatureRequired

      public void setSignatureRequired(boolean required)
      Sets whether the Element is required to be signed.
      Parameters:
      required - whether the Element is required to be signed

    • isValidSignatureRequired

      public final boolean isValidSignatureRequired()
      Gets whether the signature on a Element element is required to be valid.
      Returns:
      whether the signature on a Element element is required to be valid

    • setValidSignatureRequired

      public void setValidSignatureRequired(boolean isRequired)
      Sets whether the signature on a Element element is required to be valid.
      Parameters:
      isRequired - whether the signature on a Element element is required to be valid

    • getVerificationCertificate

      @Nullable public final Certificate getVerificationCertificate()
      Gets the certificate whose public key is used to verify the signed Element.
      Returns:
      certificate whose public key is used to verify the signed Element

    • setVerificationCertificate

      public void setVerificationCertificate(@Nonnull Certificate certificate)
      Set the key, included in a certificate, used to verify the signature. This method will also set verificationKey with the public key of the certificate.
      Parameters:
      certificate - certificate containing the key used to verify the signature

    • getVerificationKey

      @NonnullAfterInit public final PublicKey getVerificationKey()
      Gets the key used to verify the signature.
      Returns:
      key used to verify the signature

    • setVerificationKey

      public void setVerificationKey(@Nonnull PublicKey key)
      Sets the key used to verify the signature.
      Parameters:
      key - key used to verify the signature

    • setDisallowedDigests

      public void setDisallowedDigests(@Nonnull @NonnullElements @Unmodifiable Collection<String> identifiers)
      Set the collection of identifiers to be disallowed as digest algorithms.
      Parameters:
      identifiers - collection of identifiers to be disallowed
      Since:
      0.10.0

    • getDisallowedDigests

      @Nonnull @NonnullElements @Unmodifiable public final Set<String> getDisallowedDigests()
      Gets the set of disallowed digest algorithm identifiers.
      Returns:
      the set of disallowed digest algorithm identifiers
      Since:
      0.10.0

    • setDisallowedSignatureMethods

      public void setDisallowedSignatureMethods(@Nonnull @NonnullElements @Unmodifiable Collection<String> identifiers)
      Set the collection of identifiers to be disallowed as signature methods.
      Parameters:
      identifiers - collection of identifiers to be disallowed
      Since:
      0.10.0

    • getDisallowedSignatureMethods

      @Nonnull @NonnullElements @Unmodifiable public final Set<String> getDisallowedSignatureMethods()
      Gets the set of disallowed signature method identifiers.
      Returns:
      the set of disallowed signature method identifiers
      Since:
      0.10.0

    • setBlacklistedDigests

      @Deprecated(since="0.10.0", forRemoval=true) public void setBlacklistedDigests(@Nonnull @NonnullElements @Unmodifiable Collection<String> identifiers)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Set the collection of identifiers to be disallowed as digest algorithms.
      Parameters:
      identifiers - collection of identifiers to be disallowed

    • getBlacklistedDigests

      @Deprecated(since="0.10.0", forRemoval=true) @Nonnull @NonnullElements @Unmodifiable public final Set<String> getBlacklistedDigests()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Gets the set of disallowed digest algorithm identifiers.
      Returns:
      the set of disallowed digest algorithm identifiers

    • setBlacklistedSignatureMethods

      @Deprecated(since="0.10.0", forRemoval=true) public void setBlacklistedSignatureMethods(@Nonnull @NonnullElements @Unmodifiable Collection<String> identifiers)
      Deprecated, for removal: This API element is subject to removal in a future version.
      Set the collection of identifiers to be disallowed as signature methods.
      Parameters:
      identifiers - collection of identifiers to be disallowed

    • getBlacklistedSignatureMethods

      @Deprecated(since="0.10.0", forRemoval=true) @Nonnull @NonnullElements @Unmodifiable public final Set<String> getBlacklistedSignatureMethods()
      Deprecated, for removal: This API element is subject to removal in a future version.
      Gets the set of disallowed signature method identifiers.
      Returns:
      the set of disallowed signature method identifiers

    • isPermittingEmptyReferences

      public final boolean isPermittingEmptyReferences()
      Gets whether empty references are permitted.
      Returns:
      whether empty references are permitted

    • setPermittingEmptyReferences

      public void setPermittingEmptyReferences(boolean permit)
      Sets whether empty references are permitted.
      Parameters:
      permit - whether empty references are permitted

    • validateItem

      protected void validateItem(@Nonnull Item<Element> item, @Nonnull XMLSignatureValidator validator)
      Validate an individual Item using the provided validator.
      Parameters:
      item - the Item to validate
      validator - XMLSignatureValidator to use for the validation

    • doExecute

      protected void doExecute(@Nonnull @NonnullElements List<Item<Element>> items)
      Description copied from class: AbstractStage
      Performs the stage processing on the given Item collection.

      The stage is guaranteed to be have been initialized and not destroyed when this is invoked.

      Specified by:
      doExecute in class AbstractStage<Element>
      Parameters:
      items - collection to be processed

    • doInitialize

      protected void doInitialize() throws net.shibboleth.shared.component.ComponentInitializationException
      Overrides:
      doInitialize in class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent
      Throws:
      net.shibboleth.shared.component.ComponentInitializationException