Examples with StorageResolver org.apache.xml.security.keys.storage.StorageResolver used on opensource projects

Example 1 with StorageResolver

use of org.apache.xml.security.keys.storage.StorageResolver in project OpenAM by OpenRock.

the class AMSignatureProvider method getX509PublicKey.

/**
     * Get the X509Certificate embedded in the KeyInfo
     * @param keyinfo KeyInfo
     * @return a X509Certificate
     */
protected PublicKey getX509PublicKey(Document doc, KeyInfo keyinfo) {
    PublicKey pk = null;
    try {
        if (keyinfo != null) {
            if (isJKSKeyStore) {
                StorageResolver storageResolver = new StorageResolver(new KeyStoreResolver(((JKSKeyProvider) keystore).getKeyStore()));
                keyinfo.addStorageResolver(storageResolver);
                keyinfo.registerInternalKeyResolver(new X509IssuerSerialResolver());
                keyinfo.registerInternalKeyResolver(new X509CertificateResolver());
                keyinfo.registerInternalKeyResolver(new X509SKIResolver());
                keyinfo.registerInternalKeyResolver(new X509SubjectNameResolver());
            }
            if (keyinfo.containsX509Data()) {
                if (SAMLUtilsCommon.debug.messageEnabled()) {
                    SAMLUtilsCommon.debug.message("Found X509Data" + " element in the KeyInfo");
                }
                X509Certificate certificate = keyinfo.getX509Certificate();
                // the validity of the cert. 
                if (checkCert) {
                    // validate the X509Certificate
                    if (keystore.getCertificateAlias(certificate) == null) {
                        SAMLUtilsCommon.debug.error("verifyXMLSignature:" + " certificate is not trusted.");
                        throw new XMLSignatureException(SAMLUtilsCommon.bundle.getString("untrustedCertificate"));
                    } else {
                        if (SAMLUtilsCommon.debug.messageEnabled()) {
                            SAMLUtilsCommon.debug.message("verifyXMLSignature:" + " certificate is trused.");
                        }
                    }
                } else {
                    if (SAMLUtilsCommon.debug.messageEnabled()) {
                        SAMLUtilsCommon.debug.message("Skip checking whether the" + " cert in the cert db.");
                    }
                }
                pk = getPublicKey(certificate);
            } else {
                // Do we need to check if the public key is in the
                // keystore!?
                pk = getWSSTokenProfilePublicKey(doc);
            }
        }
    } catch (Exception e) {
        SAMLUtilsCommon.debug.error("getX509Certificate(KeyInfo) Exception: ", e);
    }
    return pk;
}

Example 2 with StorageResolver

use of org.apache.xml.security.keys.storage.StorageResolver in project OpenAM by OpenRock.

the class WSFederationMetaSecurityUtils method verifySignature.

/**
     * Verifies signatures in entity descriptor represented by the 
     * <code>Document</code>.
     * @param doc The document.
     * @throws WSFederationMetaException if unable to verify the entity 
     * descriptor. 
     */
public static void verifySignature(Document doc) throws WSFederationMetaException {
    String classMethod = "WSFederationMetaSecurityUtils.verifySignature: ";
    NodeList sigElements = null;
    try {
        Element nscontext = org.apache.xml.security.utils.XMLUtils.createDSctx(doc, "ds", Constants.SignatureSpecNS);
        sigElements = XPathAPI.selectNodeList(doc, "//ds:Signature", nscontext);
    } catch (Exception ex) {
        debug.error(classMethod, ex);
        throw new WSFederationMetaException(ex);
    }
    int numSigs = sigElements.getLength();
    if (debug.messageEnabled()) {
        debug.message(classMethod + "# of signatures = " + numSigs);
    }
    if (numSigs == 0) {
        return;
    }
    initializeKeyStore();
    for (int i = 0; i < numSigs; i++) {
        Element sigElement = (Element) sigElements.item(i);
        String sigParentName = sigElement.getParentNode().getLocalName();
        Object[] objs = { sigParentName };
        if (debug.messageEnabled()) {
            debug.message(classMethod + "verifying signature under " + sigParentName);
        }
        try {
            XMLSignature signature = new XMLSignature(sigElement, "");
            signature.addResourceResolver(new com.sun.identity.saml.xmlsig.OfflineResolver());
            KeyInfo ki = signature.getKeyInfo();
            X509Certificate x509cert = null;
            if (ki != null && ki.containsX509Data()) {
                if (keyStore != null) {
                    StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore));
                    ki.addStorageResolver(sr);
                }
                x509cert = ki.getX509Certificate();
            }
            if (x509cert == null) {
                if (debug.messageEnabled()) {
                    debug.message(classMethod + "" + "try to find cert in KeyDescriptor");
                }
                String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]";
                Node node = XPathAPI.selectSingleNode(sigElement, xpath);
                if (node != null) {
                    Element kd = (Element) node;
                    String use = kd.getAttributeNS(null, ATTR_USE);
                    if (use.equals("signing")) {
                        NodeList nl = kd.getChildNodes();
                        for (int j = 0; j < nl.getLength(); j++) {
                            Node child = nl.item(j);
                            if (child.getNodeType() == Node.ELEMENT_NODE) {
                                String localName = child.getLocalName();
                                String ns = child.getNamespaceURI();
                                if (TAG_KEY_INFO.equals(localName) && NS_XMLSIG.equals(ns)) {
                                    ki = new KeyInfo((Element) child, "");
                                    if (ki.containsX509Data()) {
                                        if (keyStore != null) {
                                            KeyStoreResolver ksr = new KeyStoreResolver(keyStore);
                                            StorageResolver sr = new StorageResolver(ksr);
                                            ki.addStorageResolver(sr);
                                        }
                                        x509cert = ki.getX509Certificate();
                                    }
                                }
                                break;
                            }
                        }
                    }
                }
            }
            if (x509cert == null) {
                throw new WSFederationMetaException("verify_no_cert", objs);
            }
            if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) {
                throw new WSFederationMetaException("untrusted_cert", objs);
            }
            PublicKey pk = x509cert.getPublicKey();
            if (!signature.checkSignatureValue(pk)) {
                throw new WSFederationMetaException("verify_fail", objs);
            }
        } catch (WSFederationMetaException sme) {
            throw sme;
        } catch (Exception ex) {
            debug.error(classMethod, ex);
            throw new WSFederationMetaException(Locale.getString(WSFederationMetaUtils.bundle, "verify_fail", objs) + "\n" + ex.getMessage());
        }
    }
}

Example 3 with StorageResolver

use of org.apache.xml.security.keys.storage.StorageResolver in project OpenAM by OpenRock.

the class AMEncryptionProvider method getPrivateKey.

/**
     * Returns the private key for X509Certificate embedded in the KeyInfo
     * @param keyinfo KeyInfo
     * @return a private key for X509Certificate
     */
protected java.security.PrivateKey getPrivateKey(KeyInfo keyinfo) {
    PrivateKey pk = null;
    try {
        if (keyinfo != null) {
            StorageResolver storageResolver = new StorageResolver(new KeyStoreResolver(keyProvider.getKeyStore()));
            keyinfo.addStorageResolver(storageResolver);
            keyinfo.registerInternalKeyResolver(new X509IssuerSerialResolver());
            keyinfo.registerInternalKeyResolver(new X509CertificateResolver());
            keyinfo.registerInternalKeyResolver(new X509SKIResolver());
            keyinfo.registerInternalKeyResolver(new X509SubjectNameResolver());
            if (keyinfo.containsX509Data()) {
                if (EncryptionUtils.debug.messageEnabled()) {
                    EncryptionUtils.debug.message("Found X509Data" + " element in the KeyInfo");
                }
                X509Certificate certificate = keyinfo.getX509Certificate();
                String certAlias = keyProvider.getCertificateAlias(certificate);
                pk = keyProvider.getPrivateKey(certAlias);
            }
        }
    } catch (Exception e) {
        EncryptionUtils.debug.error("getPrivateKey(KeyInfo) Exception: ", e);
    }
    return pk;
}

Example 4 with StorageResolver

use of org.apache.xml.security.keys.storage.StorageResolver in project OpenAM by OpenRock.

the class SAML2MetaSecurityUtils method verifySignature.

/**
     * Verifies signatures in entity descriptor represented by the 
     * <code>Document</code>.
     * @param doc The document.
     * @throws SAML2MetaException if unable to verify the entity descriptor. 
     */
public static void verifySignature(Document doc) throws SAML2MetaException {
    NodeList sigElements = null;
    try {
        Element nscontext = org.apache.xml.security.utils.XMLUtils.createDSctx(doc, "ds", Constants.SignatureSpecNS);
        sigElements = XPathAPI.selectNodeList(doc, "//ds:Signature", nscontext);
    } catch (Exception ex) {
        if (debug.messageEnabled()) {
            debug.message("SAML2MetaSecurityUtils.verifySignature:", ex);
            throw new SAML2MetaException(ex.getMessage());
        }
    }
    int numSigs = sigElements.getLength();
    if (debug.messageEnabled()) {
        debug.message("SAML2MetaSecurityUtils.verifySignature:" + " # of signatures = " + numSigs);
    }
    if (numSigs == 0) {
        return;
    }
    // If there are signatures then explicitly identify the ID Attribute, See comments section of
    // http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8017265
    doc.getDocumentElement().setIdAttribute(SAML2Constants.ID, true);
    initializeKeyStore();
    for (int i = 0; i < numSigs; i++) {
        Element sigElement = (Element) sigElements.item(i);
        String sigParentName = sigElement.getParentNode().getLocalName();
        Object[] objs = { sigParentName };
        if (debug.messageEnabled()) {
            debug.message("SAML2MetaSecurityUtils.verifySignature: " + "verifying signature under " + sigParentName);
        }
        try {
            XMLSignature signature = new XMLSignature(sigElement, "");
            signature.addResourceResolver(new com.sun.identity.saml.xmlsig.OfflineResolver());
            KeyInfo ki = signature.getKeyInfo();
            X509Certificate x509cert = null;
            if (ki != null && ki.containsX509Data()) {
                if (keyStore != null) {
                    StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore));
                    ki.addStorageResolver(sr);
                }
                x509cert = ki.getX509Certificate();
            }
            if (x509cert == null) {
                if (debug.messageEnabled()) {
                    debug.message("SAML2MetaSecurityUtils.verifySignature:" + " try to find cert in KeyDescriptor");
                }
                String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]";
                Node node = XPathAPI.selectSingleNode(sigElement, xpath);
                if (node != null) {
                    Element kd = (Element) node;
                    String use = kd.getAttributeNS(null, ATTR_USE);
                    if ((use.length() == 0) || use.equals("signing")) {
                        NodeList nl = kd.getChildNodes();
                        for (int j = 0; j < nl.getLength(); j++) {
                            Node child = nl.item(j);
                            if (child.getNodeType() == Node.ELEMENT_NODE) {
                                String localName = child.getLocalName();
                                String ns = child.getNamespaceURI();
                                if (TAG_KEY_INFO.equals(localName) && NS_XMLSIG.equals(ns)) {
                                    ki = new KeyInfo((Element) child, "");
                                    if (ki.containsX509Data()) {
                                        if (keyStore != null) {
                                            KeyStoreResolver ksr = new KeyStoreResolver(keyStore);
                                            StorageResolver sr = new StorageResolver(ksr);
                                            ki.addStorageResolver(sr);
                                        }
                                        x509cert = ki.getX509Certificate();
                                    }
                                }
                                break;
                            }
                        }
                    }
                }
            }
            if (x509cert == null) {
                throw new SAML2MetaException("verify_no_cert", objs);
            }
            if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) {
                throw new SAML2MetaException("untrusted_cert", objs);
            }
            PublicKey pk = x509cert.getPublicKey();
            if (!signature.checkSignatureValue(pk)) {
                throw new SAML2MetaException("verify_fail", objs);
            }
        } catch (SAML2MetaException sme) {
            throw sme;
        } catch (Exception ex) {
            debug.error("SAML2MetaSecurityUtils.verifySignature: ", ex);
            throw new SAML2MetaException(Locale.getString(SAML2MetaUtils.resourceBundle, "verify_fail", objs) + "\n" + ex.getMessage());
        }
    }
}