Examples with X509Certificate org.opensaml.xmlsec.signature.X509Certificate used on opensource projects

Example 1 with X509Certificate

use of org.opensaml.xmlsec.signature.X509Certificate in project ddf by codice.

the class SamlProtocol method createIdpMetadata.

@SuppressWarnings("squid:S00107")
public static EntityDescriptor createIdpMetadata(String entityId, String signingCert, String encryptionCert, List<String> nameIds, String singleSignOnLocationRedirect, String singleSignOnLocationPost, String singleSignOnLocationSoap, String singleLogOutLocation) {
    EntityDescriptor entityDescriptor = entityDescriptorBuilder.buildObject();
    entityDescriptor.setEntityID(entityId);
    IDPSSODescriptor idpssoDescriptor = idpssoDescriptorBuilder.buildObject();
    // signing
    KeyDescriptor signingKeyDescriptor = keyDescriptorBuilder.buildObject();
    signingKeyDescriptor.setUse(UsageType.SIGNING);
    KeyInfo signingKeyInfo = keyInfoBuilder.buildObject(KeyInfo.DEFAULT_ELEMENT_NAME);
    X509Data signingX509Data = x509DataBuilder.buildObject(X509Data.DEFAULT_ELEMENT_NAME);
    X509Certificate signingX509Certificate = x509CertificateBuilder.buildObject(X509Certificate.DEFAULT_ELEMENT_NAME);
    signingX509Certificate.setValue(signingCert);
    signingX509Data.getX509Certificates().add(signingX509Certificate);
    signingKeyInfo.getX509Datas().add(signingX509Data);
    signingKeyDescriptor.setKeyInfo(signingKeyInfo);
    idpssoDescriptor.getKeyDescriptors().add(signingKeyDescriptor);
    // encryption
    KeyDescriptor encKeyDescriptor = keyDescriptorBuilder.buildObject();
    encKeyDescriptor.setUse(UsageType.ENCRYPTION);
    KeyInfo encKeyInfo = keyInfoBuilder.buildObject(KeyInfo.DEFAULT_ELEMENT_NAME);
    X509Data encX509Data = x509DataBuilder.buildObject(X509Data.DEFAULT_ELEMENT_NAME);
    X509Certificate encX509Certificate = x509CertificateBuilder.buildObject(X509Certificate.DEFAULT_ELEMENT_NAME);
    encX509Certificate.setValue(encryptionCert);
    encX509Data.getX509Certificates().add(encX509Certificate);
    encKeyInfo.getX509Datas().add(encX509Data);
    encKeyDescriptor.setKeyInfo(encKeyInfo);
    idpssoDescriptor.getKeyDescriptors().add(encKeyDescriptor);
    for (String nameId : nameIds) {
        NameIDFormat nameIDFormat = nameIdFormatBuilder.buildObject();
        nameIDFormat.setFormat(nameId);
        idpssoDescriptor.getNameIDFormats().add(nameIDFormat);
    }
    if (StringUtils.isNotBlank(singleSignOnLocationRedirect)) {
        SingleSignOnService singleSignOnServiceRedirect = singleSignOnServiceBuilder.buildObject();
        singleSignOnServiceRedirect.setBinding(REDIRECT_BINDING);
        singleSignOnServiceRedirect.setLocation(singleSignOnLocationRedirect);
        idpssoDescriptor.getSingleSignOnServices().add(singleSignOnServiceRedirect);
    }
    if (StringUtils.isNotBlank(singleSignOnLocationPost)) {
        SingleSignOnService singleSignOnServicePost = singleSignOnServiceBuilder.buildObject();
        singleSignOnServicePost.setBinding(POST_BINDING);
        singleSignOnServicePost.setLocation(singleSignOnLocationPost);
        idpssoDescriptor.getSingleSignOnServices().add(singleSignOnServicePost);
    }
    addSingleLogoutLocation(singleLogOutLocation, idpssoDescriptor.getSingleLogoutServices());
    if (StringUtils.isNotBlank(singleSignOnLocationSoap)) {
        SingleSignOnService singleSignOnServiceSoap = singleSignOnServiceBuilder.buildObject();
        singleSignOnServiceSoap.setBinding(SOAP_BINDING);
        singleSignOnServiceSoap.setLocation(singleSignOnLocationSoap);
        idpssoDescriptor.getSingleSignOnServices().add(singleSignOnServiceSoap);
    }
    idpssoDescriptor.setWantAuthnRequestsSigned(true);
    idpssoDescriptor.addSupportedProtocol(SUPPORTED_PROTOCOL);
    entityDescriptor.getRoleDescriptors().add(idpssoDescriptor);
    entityDescriptor.setCacheDuration(getCacheDuration().toMillis());
    return entityDescriptor;
}

Example 2 with X509Certificate

use of org.opensaml.xmlsec.signature.X509Certificate in project ddf by codice.

the class SamlProtocol method createSpMetadata.

public static EntityDescriptor createSpMetadata(String entityId, String signingCert, String encryptionCert, List<String> nameIds, String singleLogOutLocation, String assertionConsumerServiceLocationRedirect, String assertionConsumerServiceLocationPost, String assertionConsumerServiceLocationPaos) {
    EntityDescriptor entityDescriptor = entityDescriptorBuilder.buildObject();
    entityDescriptor.setEntityID(entityId);
    SPSSODescriptor spSsoDescriptor = spSsoDescriptorBuilder.buildObject();
    // signing
    KeyDescriptor signingKeyDescriptor = keyDescriptorBuilder.buildObject();
    signingKeyDescriptor.setUse(UsageType.SIGNING);
    KeyInfo signingKeyInfo = keyInfoBuilder.buildObject(KeyInfo.DEFAULT_ELEMENT_NAME);
    X509Data signingX509Data = x509DataBuilder.buildObject(X509Data.DEFAULT_ELEMENT_NAME);
    X509Certificate signingX509Certificate = x509CertificateBuilder.buildObject(X509Certificate.DEFAULT_ELEMENT_NAME);
    signingX509Certificate.setValue(signingCert);
    signingX509Data.getX509Certificates().add(signingX509Certificate);
    signingKeyInfo.getX509Datas().add(signingX509Data);
    signingKeyDescriptor.setKeyInfo(signingKeyInfo);
    spSsoDescriptor.getKeyDescriptors().add(signingKeyDescriptor);
    // encryption
    KeyDescriptor encKeyDescriptor = keyDescriptorBuilder.buildObject();
    encKeyDescriptor.setUse(UsageType.ENCRYPTION);
    KeyInfo encKeyInfo = keyInfoBuilder.buildObject(KeyInfo.DEFAULT_ELEMENT_NAME);
    X509Data encX509Data = x509DataBuilder.buildObject(X509Data.DEFAULT_ELEMENT_NAME);
    X509Certificate encX509Certificate = x509CertificateBuilder.buildObject(X509Certificate.DEFAULT_ELEMENT_NAME);
    encX509Certificate.setValue(encryptionCert);
    encX509Data.getX509Certificates().add(encX509Certificate);
    encKeyInfo.getX509Datas().add(encX509Data);
    encKeyDescriptor.setKeyInfo(encKeyInfo);
    spSsoDescriptor.getKeyDescriptors().add(encKeyDescriptor);
    for (String nameId : nameIds) {
        NameIDFormat nameIDFormat = nameIdFormatBuilder.buildObject();
        nameIDFormat.setFormat(nameId);
        spSsoDescriptor.getNameIDFormats().add(nameIDFormat);
    }
    addSingleLogoutLocation(singleLogOutLocation, spSsoDescriptor.getSingleLogoutServices());
    int acsIndex = 0;
    if (StringUtils.isNotBlank(assertionConsumerServiceLocationRedirect)) {
        AssertionConsumerService assertionConsumerService = assertionConsumerServiceBuilder.buildObject();
        assertionConsumerService.setBinding(REDIRECT_BINDING);
        assertionConsumerService.setIndex(acsIndex++);
        assertionConsumerService.setLocation(assertionConsumerServiceLocationRedirect);
        spSsoDescriptor.getAssertionConsumerServices().add(assertionConsumerService);
    }
    if (StringUtils.isNotBlank(assertionConsumerServiceLocationPost)) {
        AssertionConsumerService assertionConsumerService = assertionConsumerServiceBuilder.buildObject();
        assertionConsumerService.setBinding(POST_BINDING);
        assertionConsumerService.setIndex(acsIndex++);
        assertionConsumerService.setLocation(assertionConsumerServiceLocationPost);
        spSsoDescriptor.getAssertionConsumerServices().add(assertionConsumerService);
    }
    if (StringUtils.isNotBlank(assertionConsumerServiceLocationPaos)) {
        AssertionConsumerService assertionConsumerServicePaos = assertionConsumerServiceBuilder.buildObject();
        assertionConsumerServicePaos.setBinding(PAOS_BINDING);
        assertionConsumerServicePaos.setIndex(acsIndex);
        assertionConsumerServicePaos.setLocation(assertionConsumerServiceLocationPaos);
        spSsoDescriptor.getAssertionConsumerServices().add(assertionConsumerServicePaos);
    }
    spSsoDescriptor.addSupportedProtocol(SUPPORTED_PROTOCOL);
    entityDescriptor.getRoleDescriptors().add(spSsoDescriptor);
    entityDescriptor.setCacheDuration(getCacheDuration().toMillis());
    return entityDescriptor;
}

Example 3 with X509Certificate

use of org.opensaml.xmlsec.signature.X509Certificate in project verify-hub by alphagov.

the class HubIdentityProviderMetadataDtoToEntityDescriptorTransformerTest method assertCertificateCorrect.

private void assertCertificateCorrect(KeyDescriptor keyDescriptor, String issuerId, Certificate certificateValue) {
    final KeyInfo keyInfo = keyDescriptor.getKeyInfo();
    final List<KeyName> keyNames = keyInfo.getKeyNames();
    Assertions.assertThat(keyNames.size()).isEqualTo(1);
    Assertions.assertThat(keyNames.get(0).getValue()).isEqualTo(issuerId);
    Assertions.assertThat(keyInfo.getX509Datas().size()).isEqualTo(1);
    final List<X509Data> x509Datas = keyInfo.getX509Datas();
    final List<X509Certificate> x509Certificates = x509Datas.get(0).getX509Certificates();
    Assertions.assertThat(x509Certificates.size()).isEqualTo(1);
    Assertions.assertThat(x509Certificates.get(0).getValue()).isEqualTo(certificateValue.getCertificate());
}

Example 4 with X509Certificate

use of org.opensaml.xmlsec.signature.X509Certificate in project verify-hub by alphagov.

the class IdpMetadataPublicKeyStore method getPublicKey.

private PublicKey getPublicKey(X509Certificate x509Certificate) {
    try {
        byte[] derValue = Base64.decode(x509Certificate.getValue());
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
        Certificate certificate = certificateFactory.generateCertificate(new ByteArrayInputStream(derValue));
        return certificate.getPublicKey();
    } catch (Base64DecodingException | CertificateException e) {
        throw propagate(e);
    }
}

Example 5 with X509Certificate

use of org.opensaml.xmlsec.signature.X509Certificate in project verify-hub by alphagov.

the class SamlEntityDescriptorValidator method validateRoleDescriptor.

private void validateRoleDescriptor(EntityDescriptor descriptor) {
    if (descriptor.getRoleDescriptors().isEmpty()) {
        SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.missingRoleDescriptor();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
    }
    RoleDescriptor roleDescriptor = descriptor.getRoleDescriptors().get(0);
    if (roleDescriptor.getKeyDescriptors().isEmpty()) {
        SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.missingKeyDescriptor();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
    }
    KeyInfo keyInfo = roleDescriptor.getKeyDescriptors().get(0).getKeyInfo();
    if (keyInfo == null) {
        SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.missingKeyInfo();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
    }
    if (keyInfo.getX509Datas().isEmpty()) {
        SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.missingX509Data();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
    }
    X509Data x509Data = keyInfo.getX509Datas().get(0);
    if (x509Data.getX509Certificates().isEmpty()) {
        SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.missingX509Certificate();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
    }
    X509Certificate x509Certificate = x509Data.getX509Certificates().get(0);
    if (StringUtils.isEmpty(x509Certificate.getValue())) {
        SamlValidationSpecificationFailure failure = SamlTransformationErrorFactory.emptyX509Certificiate();
        throw new SamlTransformationErrorException(failure.getErrorMessage(), failure.getLogLevel());
    }
}