Examples with SignedElementSecurityEvent org.apache.xml.security.stax.securityEvent.SignedElementSecurityEvent used on opensource projects

Example 1 with SignedElementSecurityEvent

use of org.apache.xml.security.stax.securityEvent.SignedElementSecurityEvent in project santuario-java by apache.

the class XMLSignatureReferenceVerifyInputProcessor method processElementPath.

@Override
protected void processElementPath(List<QName> elementPath, InputProcessorChain inputProcessorChain, XMLSecEvent xmlSecEvent, ReferenceType referenceType) throws XMLSecurityException {
    final DocumentContext documentContext = inputProcessorChain.getDocumentContext();
    SignedElementSecurityEvent signedElementSecurityEvent = new SignedElementSecurityEvent(getInboundSecurityToken(), true, documentContext.getProtectionOrder());
    signedElementSecurityEvent.setElementPath(elementPath);
    signedElementSecurityEvent.setXmlSecEvent(xmlSecEvent);
    signedElementSecurityEvent.setCorrelationID(referenceType.getId());
    inputProcessorChain.getSecurityContext().registerSecurityEvent(signedElementSecurityEvent);
}

Example 2 with SignedElementSecurityEvent

use of org.apache.xml.security.stax.securityEvent.SignedElementSecurityEvent in project testcases by coheigea.

the class SignatureUtils method verifyUsingStAX.

/**
 * Verify the document using the StAX API of Apache Santuario - XML Security for Java.
 */
public static void verifyUsingStAX(InputStream inputStream, List<QName> namesToSign, X509Certificate cert) throws Exception {
    // Set up the Configuration
    XMLSecurityProperties properties = new XMLSecurityProperties();
    List<XMLSecurityConstants.Action> actions = new ArrayList<XMLSecurityConstants.Action>();
    actions.add(XMLSecurityConstants.SIGNATURE);
    properties.setActions(actions);
    properties.setSignatureVerificationKey(cert.getPublicKey());
    InboundXMLSec inboundXMLSec = XMLSec.getInboundWSSec(properties);
    XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
    final XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(inputStream);
    TestSecurityEventListener eventListener = new TestSecurityEventListener();
    XMLStreamReader securityStreamReader = inboundXMLSec.processInMessage(xmlStreamReader, null, eventListener);
    while (securityStreamReader.hasNext()) {
        securityStreamReader.next();
    }
    xmlStreamReader.close();
    inputStream.close();
    // Check that what we were expecting to be signed was actually signed
    List<SignedElementSecurityEvent> signedElementEvents = eventListener.getSecurityEvents(SecurityEventConstants.SignedElement);
    Assert.assertNotNull(signedElementEvents);
    for (QName nameToSign : namesToSign) {
        boolean found = false;
        for (SignedElementSecurityEvent signedElement : signedElementEvents) {
            if (signedElement.isSigned() && nameToSign.equals(getSignedQName(signedElement.getElementPath()))) {
                found = true;
                break;
            }
        }
        Assert.assertTrue(found);
    }
    // Check Signing cert
    X509TokenSecurityEvent tokenEvent = (X509TokenSecurityEvent) eventListener.getSecurityEvent(SecurityEventConstants.X509Token);
    Assert.assertNotNull(tokenEvent);
    Assert.assertTrue(tokenEvent.getSecurityToken() instanceof X509SecurityToken);
    X509SecurityToken x509SecurityToken = (X509SecurityToken) tokenEvent.getSecurityToken();
    Assert.assertEquals(x509SecurityToken.getX509Certificates()[0], cert);
}