org.opensaml.common.binding.security
Class SAMLProtocolMessageXMLSignatureSecurityPolicyRule

java.lang.Object
  extended by org.opensaml.ws.security.provider.BaseTrustEngineRule<org.opensaml.xml.signature.Signature>
      extended by org.opensaml.common.binding.security.BaseSAMLXMLSignatureSecurityPolicyRule
          extended by org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule
All Implemented Interfaces:
org.opensaml.ws.security.SecurityPolicyRule

public class SAMLProtocolMessageXMLSignatureSecurityPolicyRule
extends BaseSAMLXMLSignatureSecurityPolicyRule

SAML security policy rule which validates the signature (if present) on the SAMLObject which represents the SAML protocol message being processed.

If the message is not an instance of SignableSAMLObject, then no processing is performed. If signature validation is successful, and the SAML message context issuer was not previously authenticated, then the context's issuer authentication state will be set to true.

If an optional Validator for Signature objects is supplied, this validator will be used to validate the XML Signature element prior to the actual cryptographic validation of the signature. This might for example be used to enforce certain signature profile requirements or to detect signatures upon which it would be unsafe to attempt cryptographic processing. When using the single argument constructuor form, the validator will default to SAMLSignatureProfileValidator.


Constructor Summary
SAMLProtocolMessageXMLSignatureSecurityPolicyRule(org.opensaml.xml.security.trust.TrustEngine<org.opensaml.xml.signature.Signature> engine)
          Constructor.
SAMLProtocolMessageXMLSignatureSecurityPolicyRule(org.opensaml.xml.security.trust.TrustEngine<org.opensaml.xml.signature.Signature> engine, org.opensaml.xml.validation.Validator<org.opensaml.xml.signature.Signature> signatureValidator)
          Constructor.
 
Method Summary
protected  void doEvaluate(org.opensaml.xml.signature.Signature signature, SignableSAMLObject signableObject, SAMLMessageContext samlMsgCtx)
          Perform cryptographic validation and trust evaluation on the Signature token using the configured Signature trust engine.
 void evaluate(org.opensaml.ws.message.MessageContext messageContext)
          
protected  org.opensaml.xml.validation.Validator<org.opensaml.xml.signature.Signature> getSignaturePrevalidator()
          Get the validator used to perform pre-validation on Signature tokens.
protected  void performPreValidation(org.opensaml.xml.signature.Signature signature)
          Perform pre-validation on the Signature token.
 
Methods inherited from class org.opensaml.common.binding.security.BaseSAMLXMLSignatureSecurityPolicyRule
buildCriteriaSet
 
Methods inherited from class org.opensaml.ws.security.provider.BaseTrustEngineRule
evaluate, evaluate, getTrustEngine
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

SAMLProtocolMessageXMLSignatureSecurityPolicyRule

public SAMLProtocolMessageXMLSignatureSecurityPolicyRule(org.opensaml.xml.security.trust.TrustEngine<org.opensaml.xml.signature.Signature> engine)
Constructor. Signature pre-validator defaults to SAMLSignatureProfileValidator.

Parameters:
engine - Trust engine used to verify the signature

SAMLProtocolMessageXMLSignatureSecurityPolicyRule

public SAMLProtocolMessageXMLSignatureSecurityPolicyRule(org.opensaml.xml.security.trust.TrustEngine<org.opensaml.xml.signature.Signature> engine,
                                                         org.opensaml.xml.validation.Validator<org.opensaml.xml.signature.Signature> signatureValidator)
Constructor.

Parameters:
engine - Trust engine used to verify the signature
signatureValidator - optional pre-validator used to validate Signature elements prior to the actual cryptographic validation operation
Method Detail

evaluate

public void evaluate(org.opensaml.ws.message.MessageContext messageContext)
              throws org.opensaml.ws.security.SecurityPolicyException

Throws:
org.opensaml.ws.security.SecurityPolicyException

doEvaluate

protected void doEvaluate(org.opensaml.xml.signature.Signature signature,
                          SignableSAMLObject signableObject,
                          SAMLMessageContext samlMsgCtx)
                   throws org.opensaml.ws.security.SecurityPolicyException
Perform cryptographic validation and trust evaluation on the Signature token using the configured Signature trust engine.

Parameters:
signature - the signature which is being evaluated
signableObject - the signable object which contained the signature
samlMsgCtx - the SAML message context being processed
Throws:
org.opensaml.ws.security.SecurityPolicyException - thrown if the signature fails validation

getSignaturePrevalidator

protected org.opensaml.xml.validation.Validator<org.opensaml.xml.signature.Signature> getSignaturePrevalidator()
Get the validator used to perform pre-validation on Signature tokens.

Returns:
the configured Signature validator, or null

performPreValidation

protected void performPreValidation(org.opensaml.xml.signature.Signature signature)
                             throws org.opensaml.ws.security.SecurityPolicyException
Perform pre-validation on the Signature token.

Parameters:
signature - the signature to evaluate
Throws:
org.opensaml.ws.security.SecurityPolicyException - thrown if the signature element fails pre-validation


Copyright © 2006-2013 Internet2. All Rights Reserved.