import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
private String createAuthnRequest(String surl, 
                                          boolean fdeflate, String referer) 
        throws MarshallingException, IOException, SignatureException {
  AuthnRequest ar = createAuthnRequest(surl + "/saml2/consumer", 
        false, false, SAMLConstants.SAML2_POST_BINDING_URI, null, null);
  
  // Create signature and add to auth Request
  Signature sig = getSignature();
  ar.setSignature(sig);
  
  AuthnRequestMarshaller marshaller = new AuthnRequestMarshaller();
  Element arn = marshaller.marshall(ar);
  
  Signer.signObject(sig);
  
  byte[] res = XMLHelper.nodeToString(arn).getBytes();
  // System.out.println(new String(res));
  
  // Remember authentication request been sent
  String rid = ar.getID();
  SamlAbstractRequest sar = new SamlAbstractRequest(rid, referer);
  _rmap.put(rid, sar);
  
  return fdeflate ? deflate(res) : encode(res);
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
public LogoutRequest createLogoutRequest(Session session) 
           throws IOException, SignatureException, MarshallingException {
  if (_logout == null)
    return null;
  
  // Retrieve initial authn response
  Response resp = (Response)session.getCustomParams();
  LogoutRequest lr = createLogoutRequest(resp);
  
  // Create signature and add to auth Request
  LogoutRequestMarshaller marshaller = new LogoutRequestMarshaller();
  
  Signature sig = getSignature();
  lr.setSignature(sig);
  // Marshall object to prepare for signature
  marshaller.marshall(lr);
  Signer.signObject(sig);
  
  return lr;
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
/**
 * Marshall an opensaml SignableSAMLObject.
 * 
 * @param signableSamlObject the SignableSAMLObject
 * @return the marshalled XML.
 * @throws MarshallingException
 * 
 * @throws SignatureException 
 */
public static String marshallSignableSamlObject(final SignableSAMLObject signableSamlObject)
		throws MarshallingException, SignatureException {
	String xmlMessage = null;
	try {
		Marshaller marshaller = Configuration.getMarshallerFactory().getMarshaller(signableSamlObject);
		Element element = marshaller.marshall(signableSamlObject);

		// Sign the saml object
		Signature signature = signableSamlObject.getSignature();
		Assert.notNull(signature, "The request is not signed !");
		Signer.signObject(signature);

		StringWriter rspWrt = new StringWriter();
		XMLHelper.writeNode(element, rspWrt);
		xmlMessage = rspWrt.toString();

		// Logging XML Authn Response
		OpenSamlHelper.LOGGER.debug("Marshalled SAML Object: {}", xmlMessage);
	} catch (MarshallingException e) {
		OpenSamlHelper.LOGGER.warn("Error while marshalling SAML 2.0 Object !", e);
		throw e;
	}

	return xmlMessage;
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
@Override
public String authenticate(HttpServletRequest req, 
            String user, String password) throws WsSrvException {
  // Create AuthRequest
  try {
    return _login + "?" + URLEncoder.encode(createAuthnRequest(
                     getServiceLocation(req), getRefererUrl(req)), "UTF-8");
  } catch (MarshallingException | IOException | SignatureException e) {
    //-- 48
    throw new WsSrvException(48, e);
  }
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
/**
 * Signs the given metadata document root.
 * 
 * @param metadata metadata document
 * @param signingCredential credential used to sign the document
 */
private static void sign(SignableSAMLObject metadata, Credential signingCredential) {
    XMLObjectBuilder<Signature> sigBuilder = Configuration.getBuilderFactory().getBuilder(
            Signature.DEFAULT_ELEMENT_NAME);
    Signature signature = sigBuilder.buildObject(Signature.DEFAULT_ELEMENT_NAME);
    signature.setSigningCredential(signingCredential);
    metadata.setSignature(signature);

    try {
        Signer.signObject(signature);
    } catch (SignatureException e) {
        log.error("Error when attempting to sign object", e);
        System.exit(1);
    }
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
/**
 * Creates a simple Assertion, signs it and then verifies the signature.
 * 
 * @throws MarshallingException thrown if the Assertion can not be marshalled into a DOM
 * @throws ValidationException thrown if the Signature does not validate
 * @throws SignatureException 
 * @throws UnmarshallingException 
 * @throws SecurityException 
 */
public void testAssertionSignature() 
    throws MarshallingException, ValidationException, SignatureException, UnmarshallingException, SecurityException{
    DateTime now = new DateTime();
    
    Assertion assertion = assertionBuilder.buildObject();
    assertion.setVersion(SAMLVersion.VERSION_20);
    assertion.setID(idGenerator.generateIdentifier());
    assertion.setIssueInstant(now);
    
    Issuer issuer = issuerBuilder.buildObject();
    issuer.setValue("urn:example.org:issuer");
    assertion.setIssuer(issuer);
    
    AuthnStatement authnStmt = authnStatementBuilder.buildObject();
    authnStmt.setAuthnInstant(now);
    assertion.getAuthnStatements().add(authnStmt);
    
    Signature signature = signatureBuilder.buildObject();
    signature.setSigningCredential(goodCredential);
    signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
    signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA);
    assertion.setSignature(signature);
    
    Marshaller marshaller = marshallerFactory.getMarshaller(assertion);
    marshaller.marshall(assertion);
    Signer.signObject(signature);
    
    
    // Unmarshall new tree around DOM to avoid side effects and Apache xmlsec bug.
    Assertion signedAssertion = 
        (Assertion) unmarshallerFactory.getUnmarshaller(assertion.getDOM()).unmarshall(assertion.getDOM());
    
    StaticCredentialResolver credResolver = new StaticCredentialResolver(goodCredential);
    KeyInfoCredentialResolver kiResolver = SecurityTestHelper.buildBasicInlineKeyInfoResolver();
    ExplicitKeySignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(credResolver, kiResolver);
    
    CriteriaSet criteriaSet = new CriteriaSet( new EntityIDCriteria("urn:example.org:issuer") );
    assertTrue("Assertion signature was not valid",
            trustEngine.validate(signedAssertion.getSignature(), criteriaSet));
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
/**
 * Prepare a new SAML 2.0 message to send to IdP.
 * 
 * @param samlObject
 *            the opensaml object to marshall
 * @param binding
 *            the binding to use
 * @param relayState
 * @return samlOutgoingMessage the outgoing message to send
 * @throws MarshallingException
 * @throws SignatureException
 */
protected SamlOutgoingMessage buildSamlOutgoingMessage(final IQuery samlQuery, final SAMLObject samlObject,
		final SamlBindingEnum binding, final String relayState, final String endpointUrl)
		throws MarshallingException, SignatureException {
	Assert.notNull(samlQuery, "No SAML Query provided !");
	Assert.notNull(samlObject, "No OpenSaml object provided !");
	Assert.notNull(binding, "No binding provided !");

	final SamlOutgoingMessage samlOutgoingMessage = new SamlOutgoingMessage(this.dataAdaptor);

	// SAML Query
	samlOutgoingMessage.setSamlQuery(samlQuery);

	// Relay State
	samlOutgoingMessage.setRelayState(relayState);
	if (this.logger.isDebugEnabled()) {
		this.logger.debug(String.format("Random RelayState: %s", relayState));
	}

	// MBD bug : Forgot to sign the SAML Object
	// Xml outgoing message
	final String xmlOutgoingMsg;
	if (SignableSAMLObject.class.isAssignableFrom(samlObject.getClass())) {
		final SignableSAMLObject signableSamlObject = (SignableSAMLObject) samlObject;
		xmlOutgoingMsg = OpenSamlHelper.marshallSignableSamlObject(signableSamlObject);
	} else {
		xmlOutgoingMsg = OpenSamlHelper.marshallXmlObject(samlObject);
	}

	samlOutgoingMessage.setSamlMessage(xmlOutgoingMsg);
	samlOutgoingMessage.setEndpointUrl(endpointUrl);

	return samlOutgoingMessage;
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
private Assertion buildAssertion() throws NoSuchAlgorithmException, IllegalAccessException, KeyStoreException, java.security.cert.CertificateException,
		SignatureException, MarshallingException, CertificateException, IOException, SecurityException, MetadataProviderException {
	SecureRandomIdentifierGenerator idGenerator = new SecureRandomIdentifierGenerator();

	Assertion assertion = buildXMLObjectDefaultName(Assertion.class);

	Issuer issuer = buildXMLObjectDefaultName(Issuer.class);
	issuer.setValue(MockIDPProperties.getIdpEntityId());
	assertion.setIssuer(issuer);
	assertion.setIssueInstant(new DateTime());

	assertion.setID(idGenerator.generateIdentifier());

	Subject subject = buildXMLObjectDefaultName(Subject.class);
	assertion.setSubject(subject);

	NameID nameID = buildXMLObjectDefaultName(NameID.class);
	nameID.setFormat(NameIDType.TRANSIENT);
	nameID.setValue("5VkzP/MZ1PMJ62o45/7DdFms9y7K");
	nameID.setSPNameQualifier("steras-openam");
	nameID.setNameQualifier("FakeIdP");

	subject.setNameID(nameID);

	subject.getSubjectConfirmations().add(buildSubjectConfirmation());

	assertion.setConditions(buildConditions());

	assertion.getAttributeStatements().add(buildAttributeStatement());

	assertion.getAuthnStatements().add(buildAuthnStatement());

	signSAMLObject(assertion, getIDPKeyFromKeystore());
	return assertion;
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
public static Element generateSAMLAssertion(PrivateKey privateKey, X509Certificate certificate, String issuerName,
		String subjectName)
		throws MarshallingException, SecurityException, SignatureException, NoSuchAlgorithmException {
	return generateSAMLAssertion(privateKey, certificate, issuerName, subjectName, null);
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
public static Element generateHOKSAMLAssertion(PrivateKey issuerPrivateKey, X509Certificate issuerCertificate,
		String issuerName, String subjectName, PublicKey hokPublicKey)
		throws MarshallingException, SecurityException, SignatureException {
	Assertion assertion = buildXMLObject(Assertion.class, Assertion.DEFAULT_ELEMENT_NAME);
	assertion.setVersion(SAMLVersion.VERSION_20);
	String assertionId = "assertion-" + UUID.randomUUID().toString();
	assertion.setID(assertionId);
	DateTime issueInstant = new DateTime();
	assertion.setIssueInstant(issueInstant);

	Issuer issuer = buildXMLObject(Issuer.class, Issuer.DEFAULT_ELEMENT_NAME);
	assertion.setIssuer(issuer);
	issuer.setValue(issuerName);

	Subject subject = buildXMLObject(Subject.class, Subject.DEFAULT_ELEMENT_NAME);
	assertion.setSubject(subject);
	NameID subjectNameId = buildXMLObject(NameID.class, NameID.DEFAULT_ELEMENT_NAME);
	subject.setNameID(subjectNameId);
	subjectNameId.setValue(subjectName);
	SubjectConfirmation subjectConfirmation = buildXMLObject(SubjectConfirmation.class,
			SubjectConfirmation.DEFAULT_ELEMENT_NAME);
	subject.getSubjectConfirmations().add(subjectConfirmation);
	subjectConfirmation.setMethod(SubjectConfirmation.METHOD_HOLDER_OF_KEY);
	KeyInfoConfirmationDataType keyInfoConfirmationData = new KeyInfoConfirmationDataTypeBuilder()
			.buildObject(KeyInfoConfirmationDataType.DEFAULT_ELEMENT_NAME, KeyInfoConfirmationDataType.TYPE_NAME);
	subjectConfirmation.setSubjectConfirmationData(keyInfoConfirmationData);
	BasicKeyInfoGeneratorFactory keyInfoGeneratorFactory = new BasicKeyInfoGeneratorFactory();
	keyInfoGeneratorFactory.setEmitPublicKeyValue(true);
	BasicX509Credential keyInfoCredential = new BasicX509Credential();
	keyInfoCredential.setPublicKey(hokPublicKey);
	KeyInfo keyInfo = keyInfoGeneratorFactory.newInstance().generate(keyInfoCredential);
	keyInfoConfirmationData.getKeyInfos().add(keyInfo);

	BasicX509Credential credential = new BasicX509Credential();
	credential.setPrivateKey(issuerPrivateKey);
	credential.setEntityCertificate(issuerCertificate);

	Signature signature = (Signature) Configuration.getBuilderFactory().getBuilder(Signature.DEFAULT_ELEMENT_NAME)
			.buildObject(Signature.DEFAULT_ELEMENT_NAME);
	signature.setSigningCredential(credential);
	SecurityConfiguration secConfig = Configuration.getGlobalSecurityConfiguration();
	SecurityHelper.prepareSignatureParams(signature, credential, secConfig, null);

	assertion.setSignature(signature);

	Element element = Configuration.getMarshallerFactory().getMarshaller(assertion).marshall(assertion);

	Signer.signObject(signature);

	return element;
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
private ArtifactResponse buildArtifactResponse() throws IllegalAccessException, NoSuchAlgorithmException, KeyStoreException,
		java.security.cert.CertificateException, CertificateException, IOException, SecurityException, EncryptionException, NoSuchProviderException,
		SignatureException, MarshallingException, MetadataProviderException {
	SecureRandomIdentifierGenerator idGenerator = new SecureRandomIdentifierGenerator();

	ArtifactResponse artifactResponse = buildXMLObjectDefaultName(ArtifactResponse.class);

	Issuer issuer = buildXMLObjectDefaultName(Issuer.class);
	issuer.setValue(MockIDPProperties.getIdpEntityId());
	artifactResponse.setIssuer(issuer);
	artifactResponse.setIssueInstant(new DateTime());
	artifactResponse.setDestination(MockIDPSPMetadata.getSpConsumerUrl());

	artifactResponse.setID(idGenerator.generateIdentifier());

	Status status = buildXMLObjectDefaultName(Status.class);
	StatusCode statusCode = buildXMLObjectDefaultName(StatusCode.class);
	statusCode.setValue(StatusCode.SUCCESS_URI);
	status.setStatusCode(statusCode);
	artifactResponse.setStatus(status);

	Response response = buildXMLObjectDefaultName(Response.class);
	response.setDestination(MockIDPSPMetadata.getSpConsumerUrl());
	response.setIssueInstant(new DateTime());
	response.setID(idGenerator.generateIdentifier());
	response.setInResponseTo(MockIDPAuthnReq.authnReqId);
	Issuer issuer2 = buildXMLObjectDefaultName(Issuer.class);
	issuer2.setValue(MockIDPProperties.getIdpEntityId());

	response.setIssuer(issuer2);

	Status status2 = buildXMLObjectDefaultName(Status.class);
	StatusCode statusCode2 = buildXMLObjectDefaultName(StatusCode.class);
	statusCode2.setValue(StatusCode.SUCCESS_URI);
	status2.setStatusCode(statusCode2);

	response.setStatus(status2);

	artifactResponse.setMessage(response);

	response.getEncryptedAssertions().add(encryptAssertion(buildAssertion()));
	return artifactResponse;
}
 

import org.opensaml.xml.signature.SignatureException; //导入依赖的package包/类
/**
 * Prepare a new SAML 2.0 outgoing request to send to IdP with a new generated relayState.
 * 
 * @param samlQuery
 *            SAML query object
 * @param request
 *            the opensaml object to marshall
 * @param binding
 *            the binding to use
 * @param relayState
 * @return samlOutgoingMessage the outgoing message to send
 * @throws MarshallingException
 * @throws SignatureException
 */
protected SamlOutgoingMessage buildSamlOutgoingRequest(final IRequestWaitingForResponse samlQuery,
		final RequestAbstractType request, final SamlBindingEnum binding, final String endpointUrl)
		throws MarshallingException, SignatureException {
	request.setID(samlQuery.getId());

	final String relayState = OpenSamlHelper.generateRelayState(this.getIdpConfig().getId(), binding);

	return this.buildSamlOutgoingMessage(samlQuery, request, binding, relayState, endpointUrl);
}