Examples with SAMLSignatureProfileValidator org.opensaml.saml.security.impl.SAMLSignatureProfileValidator used on opensource projects

Example 1 with SAMLSignatureProfileValidator

use of org.opensaml.saml.security.impl.SAMLSignatureProfileValidator in project cas by apereo.

the class WsFederationHelper method validateSignature.

/**
     * validateSignature checks to see if the signature on an assertion is valid.
     *
     * @param assertion                 a provided assertion
     * @param wsFederationConfiguration WS-Fed configuration provided.
     * @return true if the assertion's signature is valid, otherwise false
     */
public boolean validateSignature(final Assertion assertion, final WsFederationConfiguration wsFederationConfiguration) {
    if (assertion == null) {
        LOGGER.warn("No assertion was provided to validate signatures");
        return false;
    }
    boolean valid = false;
    if (assertion.getSignature() != null) {
        final SignaturePrevalidator validator = new SAMLSignatureProfileValidator();
        try {
            validator.validate(assertion.getSignature());
            final CriteriaSet criteriaSet = new CriteriaSet();
            criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
            criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));
            criteriaSet.add(new ProtocolCriterion(SAMLConstants.SAML20P_NS));
            criteriaSet.add(new EntityIdCriterion(wsFederationConfiguration.getIdentityProviderIdentifier()));
            try {
                final SignatureTrustEngine engine = buildSignatureTrustEngine(wsFederationConfiguration);
                valid = engine.validate(assertion.getSignature(), criteriaSet);
            } catch (final SecurityException e) {
                LOGGER.warn(e.getMessage(), e);
            } finally {
                if (!valid) {
                    LOGGER.warn("Signature doesn't match any signing credential.");
                }
            }
        } catch (final SignatureException e) {
            LOGGER.warn("Failed to validate assertion signature", e);
        }
    }
    SamlUtils.logSamlObject(this.configBean, assertion);
    return valid;
}

Example 2 with SAMLSignatureProfileValidator

use of org.opensaml.saml.security.impl.SAMLSignatureProfileValidator in project cas by apereo.

the class SamlObjectSignatureValidator method validateSignatureOnProfileRequest.

private void validateSignatureOnProfileRequest(final RequestAbstractType profileRequest, final Signature signature, final RoleDescriptorResolver roleDescriptorResolver) throws Exception {
    final SAMLSignatureProfileValidator validator = new SAMLSignatureProfileValidator();
    LOGGER.debug("Validating profile signature for [{}] via [{}]...", profileRequest.getIssuer(), validator.getClass().getSimpleName());
    validator.validate(signature);
    LOGGER.debug("Successfully validated profile signature for [{}].", profileRequest.getIssuer());
    final Credential credential = getSigningCredential(roleDescriptorResolver, profileRequest);
    if (credential == null) {
        throw new SamlException("Signing credential for validation could not be resolved");
    }
    LOGGER.debug("Validating signature using credentials for [{}]", credential.getEntityId());
    SignatureValidator.validate(signature, credential);
    LOGGER.info("Successfully validated the request signature.");
}

Example 3 with SAMLSignatureProfileValidator

use of org.opensaml.saml.security.impl.SAMLSignatureProfileValidator in project ddf by codice.

the class SimpleSign method validateSignatureAndSamlKey.

private void validateSignatureAndSamlKey(Signature signature, SAMLKeyInfo samlKeyInfo) throws SignatureException {
    SAMLSignatureProfileValidator validator = new SAMLSignatureProfileValidator();
    try {
        validator.validate(signature);
    } catch (org.opensaml.xmlsec.signature.support.SignatureException e) {
        throw new SignatureException("Error validating the SAMLKey signature", e);
    }
    BasicX509Credential credential = null;
    if (samlKeyInfo.getCerts() != null) {
        credential = new BasicX509Credential(samlKeyInfo.getCerts()[0]);
    } else {
        throw new SignatureException("Can't get X509Certificate or PublicKey to verify signature.");
    }
    ClassLoader threadLoader = null;
    try {
        threadLoader = Thread.currentThread().getContextClassLoader();
        Thread.currentThread().setContextClassLoader(ApacheSantuarioSignatureValidationProviderImpl.class.getClassLoader());
        SignatureValidator.validate(signature, credential);
    } catch (org.opensaml.xmlsec.signature.support.SignatureException e) {
        throw new SignatureException("Error validating the XML signature", e);
    } finally {
        if (threadLoader != null) {
            Thread.currentThread().setContextClassLoader(threadLoader);
        }
    }
}