import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * @param queryString
 * @param issuer
 * @param alias
 * @param domainName
 * @return
 * @throws SecurityException
 * @throws IdentitySAML2SSOException
 */
@Override
public boolean validateSignature(String queryString, String issuer, String alias,
                                 String domainName) throws SecurityException,
        IdentitySAML2SSOException {
    byte[] signature = getSignature(queryString);
    byte[] signedContent = getSignedContent(queryString);
    String algorithmUri = getSigAlg(queryString);
    CriteriaSet criteriaSet = buildCriteriaSet(issuer);

    // creating the SAML2HTTPRedirectDeflateSignatureRule
    X509CredentialImpl credential =
            SAMLSSOUtil.getX509CredentialImplForTenant(domainName,
                    alias);

    List<Credential> credentials = new ArrayList<Credential>();
    credentials.add(credential);
    CollectionCredentialResolver credResolver = new CollectionCredentialResolver(credentials);
    KeyInfoCredentialResolver kiResolver = SecurityHelper.buildBasicInlineKeyInfoResolver();
    SignatureTrustEngine engine = new ExplicitKeySignatureTrustEngine(credResolver, kiResolver);
    return engine.validate(signature, signedContent, algorithmUri, criteriaSet, null);
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/** {@inheritDoc} */
protected void setUp() throws Exception {
    super.setUp();
    
    // Trust engine setup
    issuer = "SomeCoolIssuer";
    
    trustedCredentials = new ArrayList<Credential>();
    trustedCredentials.add(otherCred1);
    
    credResolver = new CollectionCredentialResolver(trustedCredentials);
    
    KeyInfoCredentialResolver kiResolver = SecurityTestHelper.buildBasicInlineKeyInfoResolver();
    SignatureTrustEngine engine = new ExplicitKeySignatureTrustEngine(credResolver, kiResolver);
    
    rule = new SAML2HTTPRedirectDeflateSignatureRule(engine);
    
    messageContext.setInboundMessageIssuer(issuer);
    ((SAMLMessageContext) messageContext).setInboundSAMLMessageAuthenticated(false);
    messageContext.setPeerEntityRole(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/** {@inheritDoc} */
protected void setUp() throws Exception {
    super.setUp();
    
    // Trust engine setup
    issuer = "SomeCoolIssuer";
    
    trustedCredentials = new ArrayList<Credential>();
    trustedCredentials.add(otherCred1);
    
    credResolver = new CollectionCredentialResolver(trustedCredentials);
    
    KeyInfoCredentialResolver kiResolver = SecurityTestHelper.buildBasicInlineKeyInfoResolver();
    SignatureTrustEngine engine = new ExplicitKeySignatureTrustEngine(credResolver, kiResolver);
    
    rule = new SAML2HTTPPostSimpleSignRule(engine, parser, kiResolver);
    
    messageContext.setInboundMessageIssuer(issuer);
    ((SAMLMessageContext) messageContext).setInboundSAMLMessageAuthenticated(false);
    messageContext.setPeerEntityRole(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
public void testEntityDescriptor() throws UnmarshallingException, CertificateException, XMLParserException {
    X509Certificate cert = SecurityTestHelper.buildJavaX509Cert(openIDCertBase64);
    X509Credential cred = SecurityHelper.getSimpleCredential(cert, null);
    StaticCredentialResolver credResolver = new StaticCredentialResolver(cred);
    SignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(credResolver, 
            Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver());
    
    Document mdDoc = parser.parse(SignatureValidationFilterTest.class.getResourceAsStream(openIDFileValid));
    XMLObject xmlObject = 
        unmarshallerFactory.getUnmarshaller(mdDoc.getDocumentElement()).unmarshall(mdDoc.getDocumentElement());
    assertTrue(xmlObject instanceof EntityDescriptor);
    EntityDescriptor ed = (EntityDescriptor) xmlObject;
    assertTrue(ed.isSigned());
    assertNotNull("Signature was null", ed.getSignature());
    
    SignatureValidationFilter filter = new SignatureValidationFilter(trustEngine);
    try {
        filter.doFilter(ed);
    } catch (FilterException e) {
        fail("Filter failed validation, should have succeeded: " + e.getMessage());
    }
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
public void testEntityDescriptorInvalid() throws UnmarshallingException, CertificateException, XMLParserException {
    X509Certificate cert = SecurityTestHelper.buildJavaX509Cert(openIDCertBase64);
    X509Credential cred = SecurityHelper.getSimpleCredential(cert, null);
    StaticCredentialResolver credResolver = new StaticCredentialResolver(cred);
    SignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(credResolver, 
            Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver());
    
    Document mdDoc = parser.parse(SignatureValidationFilterTest.class.getResourceAsStream(openIDFileInvalid));
    XMLObject xmlObject = 
        unmarshallerFactory.getUnmarshaller(mdDoc.getDocumentElement()).unmarshall(mdDoc.getDocumentElement());
    assertTrue(xmlObject instanceof EntityDescriptor);
    EntityDescriptor ed = (EntityDescriptor) xmlObject;
    assertTrue(ed.isSigned());
    assertNotNull("Signature was null", ed.getSignature());
    
    SignatureValidationFilter filter = new SignatureValidationFilter(trustEngine);
    try {
        filter.doFilter(xmlObject);
        fail("Filter passed validation, should have failed");
    } catch (FilterException e) {
        // do nothing, should fail
    }
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/** {@inheritDoc} */
public boolean validate(Signature token, CriteriaSet trustBasisCriteria) throws SecurityException {
    for (SignatureTrustEngine engine : engines) {
        if (engine.validate(token, trustBasisCriteria)) {
            log.debug("Signature was trusted by chain member: {}", engine.getClass().getName());
            return true;
        }
    }
    return false;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Validate the simple signature.
 * 
 * @param signature the signature value
 * @param signedContent the content that was signed
 * @param algorithmURI the signature algorithm URI which was used to sign the content
 * @param criteriaSet criteria used to describe and/or resolve the information which serves as the basis for trust
 *            evaluation
 * @param candidateCredentials the request-derived candidate credential(s) containing the validation key for the
 *            signature (optional)
 * @return true if signature can be verified successfully, false otherwise
 * 
 * @throws SecurityPolicyException thrown if there are errors during the signature validation process
 * 
 */
protected boolean validateSignature(byte[] signature, byte[] signedContent, String algorithmURI,
        CriteriaSet criteriaSet, List<Credential> candidateCredentials) throws SecurityPolicyException {

    SignatureTrustEngine engine = getTrustEngine();

    // Some bindings allow candidate signing credentials to be supplied (e.g. via ds:KeyInfo), some do not.
    // So have 2 slightly different cases.
    try {
        if (candidateCredentials == null || candidateCredentials.isEmpty()) {
            if (engine.validate(signature, signedContent, algorithmURI, criteriaSet, null)) {
                log.debug("Simple signature validation (with no request-derived credentials) was successful");
                return true;
            } else {
                log.warn("Simple signature validation (with no request-derived credentials) failed");
                return false;
            }
        } else {
            for (Credential cred : candidateCredentials) {
                if (engine.validate(signature, signedContent, algorithmURI, criteriaSet, cred)) {
                    log.debug("Simple signature validation succeeded with a request-derived credential");
                    return true;
                }
            }
            log.warn("Signature validation using request-derived credentials failed");
            return false;
        }
    } catch (SecurityException e) {
        log.warn("There was an error evaluating the request's simple signature using the trust engine", e);
        throw new SecurityPolicyException("Error during trust engine evaluation of the simple signature", e);
    }
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Constructor.
 * 
 * @param engine the trust engine used to validate signatures on incoming metadata.
 */
public SignatureValidationFilter(SignatureTrustEngine engine) {
    if (engine == null) {
        throw new IllegalArgumentException("Signature trust engine may not be null");
    }

    signatureTrustEngine = engine;
    sigValidator = new SAMLSignatureProfileValidator();
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Validate the simple signature.
 * 
 * @param signature the signature value
 * @param signedContent the content that was signed
 * @param algorithmURI the signature algorithm URI which was used to sign the content
 * @param criteriaSet criteria used to describe and/or resolve the information which serves as the basis for trust
 *            evaluation
 * @param candidateCredentials the request-derived candidate credential(s) containing the validation key for the
 *            signature (optional)
 * @return true if signature can be verified successfully, false otherwise
 * 
 * @throws SecurityPolicyException thrown if there are errors during the signature validation process
 * 
 */
protected boolean validateSignature(byte[] signature, byte[] signedContent, String algorithmURI,
        CriteriaSet criteriaSet, List<Credential> candidateCredentials) throws SecurityPolicyException {

    SignatureTrustEngine engine = getTrustEngine();

    // Some bindings allow candidate signing credentials to be supplied (e.g. via ds:KeyInfo), some do not.
    // So have 2 slightly different cases.
    try {
        if (candidateCredentials == null || candidateCredentials.isEmpty()) {
            if (engine.validate(signature, signedContent, algorithmURI, criteriaSet, null)) {
                log.debug("Simple signature validation (with no request-derived credentials) was successful");
                return true;
            } else {
                log.error("Simple signature validation (with no request-derived credentials) failed");
                return false;
            }
        } else {
            for (Credential cred : candidateCredentials) {
                if (engine.validate(signature, signedContent, algorithmURI, criteriaSet, cred)) {
                    log.debug("Simple signature validation succeeded with a request-derived credential");
                    return true;
                }
            }
            log.error("Signature validation using request-derived credentials failed");
            return false;
        }
    } catch (SecurityException e) {
        log.error("There was an error evaluating the request's simple signature using the trust engine", e);
        throw new SecurityPolicyException("Error during trust engine evaluation of the simple signature", e);
    }
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Validate the simple signature.
 *
 * @param signature the signature value
 * @param signedContent the content that was signed
 * @param algorithmURI the signature algorithm URI which was used to sign the content
 * @param criteriaSet criteria used to describe and/or resolve the information which serves as the basis for trust
 *            evaluation
 * @param candidateCredentials the request-derived candidate credential(s) containing the validation key for the
 *            signature (optional)
 * @return true if signature can be verified successfully, false otherwise
 *
 * @throws SecurityPolicyException thrown if there are errors during the signature validation process
 *
 */
protected boolean validateSignature(byte[] signature, byte[] signedContent, String algorithmURI,
                                    CriteriaSet criteriaSet, List<Credential> candidateCredentials) throws SecurityPolicyException {

    SignatureTrustEngine engine = getTrustEngine();

    // Some bindings allow candidate signing credentials to be supplied (e.g. via ds:KeyInfo), some do not.
    // So have 2 slightly different cases.
    try {
        if (candidateCredentials == null || candidateCredentials.isEmpty()) {
            if (engine.validate(signature, signedContent, algorithmURI, criteriaSet, null)) {
                log.debug("Simple signature validation (with no request-derived credentials) was successful");
                return true;
            } else {
                log.warn("Simple signature validation (with no request-derived credentials) failed");
                return false;
            }
        } else {
            for (Credential cred : candidateCredentials) {
                if (engine.validate(signature, signedContent, algorithmURI, criteriaSet, cred)) {
                    log.debug("Simple signature validation succeeded with a request-derived credential");
                    return true;
                }
            }
            log.warn("Signature validation using request-derived credentials failed");
            return false;
        }
    } catch (org.opensaml.xml.security.SecurityException e) {
        log.warn("There was an error evaluating the request's simple signature using the trust engine", e);
        throw new SecurityPolicyException("Error during trust engine evaluation of the simple signature", e);
    }
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/** Constructor. */
public ChainingSignatureTrustEngine() {
    engines = new ArrayList<SignatureTrustEngine>();
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
public SAMLResponseValidator(SignatureTrustEngine trustEngine, Decrypter decrypter, String callbackUrl) {
    this.trustEngine = trustEngine;
    this.decrypter = decrypter;
    this.callbackUrl = callbackUrl;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
public SAML2HTTPRedirectDeflateSignatureRuleExtended(SignatureTrustEngine engine) {
    super(engine);
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
@Override
public SignatureTrustEngine getSignatureTrustEngine() {
	return this.signatureTrustEngine;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Constructor.
 * 
 * @param engine the trust engine to use
 * @param parserPool the parser pool used to parse the KeyInfo request parameter
 * @param keyInfoCredResolver the KeyInfo credential resovler to use to extract credentials from the KeyInfo request
 *            parameter
 */
public SAML2HTTPPostSimpleSignRule(SignatureTrustEngine engine, ParserPool parserPool,
        KeyInfoCredentialResolver keyInfoCredResolver) {
    super(engine);
    parser = parserPool;
    keyInfoResolver = keyInfoCredResolver;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Constructor.
 *
 * @param engine the trust engine to use
 * @param parserPool the parser pool used to parse the KeyInfo request parameter
 * @param keyInfoCredResolver the KeyInfo credential resovler to use to extract credentials from the KeyInfo request
 *            parameter
 */
public SAML2HTTPPostSimpleSignRuleExtended(SignatureTrustEngine engine, ParserPool parserPool,
                                           KeyInfoCredentialResolver keyInfoCredResolver) {
    super(engine);
    parser = parserPool;
    keyInfoResolver = keyInfoCredResolver;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Get the list of configured trust engines which constitute the trust evaluation chain.
 * 
 * @return the modifiable list of trust engines in the chain
 */
public List<SignatureTrustEngine> getChain() {
    return engines;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Constructor.
 * 
 * @param engine the signature trust engine to use for signature validataion
 */
protected BaseSAMLSimpleSignatureSecurityPolicyRule(SignatureTrustEngine engine) {
    trustEngine = engine;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Gets the engine used to validate the signature.
 * 
 * @return engine engine used to validate the signature
 */
protected SignatureTrustEngine getTrustEngine() {
    return trustEngine;
}
 

import org.opensaml.xml.signature.SignatureTrustEngine; //导入依赖的package包/类
/**
 * Constructor.
 * 
 * @param engine the trust engine to use
 */
public SAML2HTTPRedirectDeflateSignatureRule(SignatureTrustEngine engine) {
    super(engine);
}