import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
/**
 * Build credential for metadata signature validation basic credential.
 *
 * @param resource the resource
 * @return the basic credential
 * @throws Exception the exception
 */
public static BasicCredential buildCredentialForMetadataSignatureValidation(final Resource resource) throws Exception {
    try {
        final BasicX509CredentialFactoryBean x509FactoryBean = new BasicX509CredentialFactoryBean();
        x509FactoryBean.setCertificateResource(resource);
        x509FactoryBean.afterPropertiesSet();
        return x509FactoryBean.getObject();
    } catch (final Exception e) {
        LOGGER.trace(e.getMessage(), e);

        LOGGER.debug("Credential cannot be extracted from [{}] via X.509. Treating it as a public key to locate credential...",
                resource);
        final BasicResourceCredentialFactoryBean credentialFactoryBean = new BasicResourceCredentialFactoryBean();
        credentialFactoryBean.setPublicKeyInfo(resource);
        credentialFactoryBean.afterPropertiesSet();
        return credentialFactoryBean.getObject();
    }
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
@Before
public void setUp() {
    IdaSamlBootstrap.bootstrap();
    reset(manifestReader);

    final BasicCredential basicCredential = createBasicCredential();
    encrypter = new uk.gov.ida.saml.security.EncrypterFactory().createEncrypter(basicCredential);
    decrypter = new DecrypterFactory().createDecrypter(ImmutableList.of(basicCredential));
    when(encrypterFactory.createEncrypter()).thenReturn(encrypter);
    factory = new AuthnRequestFactory(
        DESTINATION,
        new PrivateKeyStoreFactory().create(TestEntityIds.TEST_RP).getSigningPrivateKey(),
        manifestReader,
        encrypterFactory
    );
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
/**
 * Build signature validation filter if needed.
 *
 * @param signatureResourceLocation the signature resource location
 * @return the metadata filter
 * @throws Exception the exception
 */
public static SignatureValidationFilter buildSignatureValidationFilter(final Resource signatureResourceLocation) throws Exception {
    if (!ResourceUtils.doesResourceExist(signatureResourceLocation)) {
        LOGGER.warn("Resource [{}] cannot be located", signatureResourceLocation);
        return null;
    }

    final List<KeyInfoProvider> keyInfoProviderList = new ArrayList<>();
    keyInfoProviderList.add(new RSAKeyValueProvider());
    keyInfoProviderList.add(new DSAKeyValueProvider());
    keyInfoProviderList.add(new DEREncodedKeyValueProvider());
    keyInfoProviderList.add(new InlineX509DataProvider());

    LOGGER.debug("Attempting to resolve credentials from [{}]", signatureResourceLocation);
    final BasicCredential credential = buildCredentialForMetadataSignatureValidation(signatureResourceLocation);
    LOGGER.info("Successfully resolved credentials from [{}]", signatureResourceLocation);

    LOGGER.debug("Configuring credential resolver for key signature trust engine @ [{}]", credential.getCredentialType().getSimpleName());
    final StaticCredentialResolver resolver = new StaticCredentialResolver(credential);
    final BasicProviderKeyInfoCredentialResolver keyInfoResolver = new BasicProviderKeyInfoCredentialResolver(keyInfoProviderList);
    final ExplicitKeySignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(resolver, keyInfoResolver);

    LOGGER.debug("Adding signature validation filter based on the configured trust engine");
    final SignatureValidationFilter signatureValidationFilter = new SignatureValidationFilter(trustEngine);
    signatureValidationFilter.setRequireSignedRoot(false);
    LOGGER.debug("Added metadata SignatureValidationFilter with signature from [{}]", signatureResourceLocation);
    return signatureValidationFilter;
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
private Assertion decrypt(EncryptedAssertion encryptedAssertion) {
    Decrypter decrypter = new DecrypterFactory().createDecrypter(ImmutableList.of(new BasicCredential(publicKey, privateKey)));
    decrypter.setRootInNewDocument(true);
    try {
        return decrypter.decrypt(encryptedAssertion);
    } catch (DecryptionException e) {
        throw new RuntimeException(e);
    }
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
@Test
public void handleResponseFromIdp_shouldNotDecryptAssertionEncryptedWithIncorrectEncryptionCertificates() throws Exception {
    BasicCredential incorrectEncryptionKey = new BasicCredential(new HardCodedKeyStore(HUB_ENTITY_ID).getPrimaryEncryptionKeyForEntity(TEST_RP));

    SamlAuthnResponseTranslatorDto samlResponseDto = getSuccessSamlAuthnResponseTranslatorDto(incorrectEncryptionKey);

    Response clientResponse = postToSamlEngine(samlResponseDto);

    assertThat(clientResponse.getStatus()).isEqualTo(Response.Status.BAD_REQUEST.getStatusCode());
    ErrorStatusDto errorStatusDto = clientResponse.readEntity(ErrorStatusDto.class);
    assertThat(errorStatusDto.getExceptionType()).isEqualTo(ExceptionType.INVALID_SAML_FAILED_TO_DECRYPT);
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
public ResponseBuilder aResponseFromIdpBuilder(String idpEntityId,
                                               String ipAddressSeenByIdp,
                                               DateTime issueInstant,
                                               String authnStatementAssertionId,
                                               String mdsStatementAssertionId,
                                               Optional<BasicCredential> basicCredential) throws Exception {
    String subjectPersistentIdentifier = generateId();
    return aResponseFromIdpBuilder(idpEntityId, ipAddressSeenByIdp, issueInstant, authnStatementAssertionId, subjectPersistentIdentifier, mdsStatementAssertionId, subjectPersistentIdentifier, basicCredential);
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
/**
 * Get a simple, minimal credential containing a secret (symmetric) key.
 *
 * @param secretKey the symmetric key to wrap
 * @return a credential containing the secret key specified
 */
private static BasicCredential getSimpleCredential(SecretKey secretKey) {
    if (secretKey == null) {
        throw new IllegalArgumentException("A secret key is required");
    }
    return new BasicCredential(secretKey);
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
private SamlAuthnResponseTranslatorDto getSuccessSamlAuthnResponseTranslatorDto(BasicCredential basicCredential) throws Exception {
    return getSuccessSamlAuthnResponseTranslatorDto(basicCredential, TEST_RP_MS);
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
public ResponseBuilder aResponseFromIdpBuilderWithIssuers(String idpEntityId, String authnAssertionIssuer, String mdsAssertionIssuer) throws Exception {
    String subjectPersistentIdentifier = generateId();
    return aResponseFromIdpBuilder(idpEntityId, "ipAddressSeenByIdp", DateTime.now(), UUID.randomUUID().toString(), subjectPersistentIdentifier, authnAssertionIssuer, UUID.randomUUID().toString(), subjectPersistentIdentifier, mdsAssertionIssuer, Optional.<BasicCredential>absent());
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
public ResponseBuilder aResponseFromIdpBuilderWithInResponseToValues(String idpEntityId, String requestId, String authnAssertionInResponseTo, String mdsAssertionInResponseTo) throws Exception {
    String subjectPersistentIdentifier = generateId();
    return aResponseFromIdpBuilder(idpEntityId, "ipAddressSeenByIdp", requestId, DateTime.now(), UUID.randomUUID().toString(), subjectPersistentIdentifier, idpEntityId, authnAssertionInResponseTo, UUID.randomUUID().toString(), subjectPersistentIdentifier, idpEntityId, mdsAssertionInResponseTo, Optional.<BasicCredential>absent());
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
public Encrypter createEncrypter() {
    BasicCredential credential = new BasicCredential(metadataPublicKeyExtractor.getEncryptionPublicKey());
    return super.createEncrypter(credential);
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
private BasicCredential createBasicCredential() {
    final PublicKey publicKey = new PublicKeyFactory(new X509CertificateFactory()).createPublicKey(HUB_TEST_PUBLIC_ENCRYPTION_CERT);
    PrivateKey privateKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(HUB_TEST_PRIVATE_ENCRYPTION_KEY));
    return new BasicCredential(publicKey, privateKey);
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
@Test
public void handleResponseFromIdp_shouldDecryptAssertionEncryptedWithPrimaryEncryptionCertificates() throws Exception {
    BasicCredential primaryEncryptionKey = new BasicCredential(new HardCodedKeyStore(HUB_ENTITY_ID).getPrimaryEncryptionKeyForEntity(HUB_ENTITY_ID));

    SamlAuthnResponseTranslatorDto samlResponseDto = getSuccessSamlAuthnResponseTranslatorDto(primaryEncryptionKey);

    Response clientResponse = postToSamlEngine(samlResponseDto);

    assertThat(clientResponse.getStatus()).isEqualTo(Response.Status.OK.getStatusCode());
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
@Test
public void handleResponseFromIdp_shouldDecryptAssertionEncryptedWithSecondaryEncryptionCertificates() throws Exception {
    BasicCredential secondaryEncryptionKey = new BasicCredential(new HardCodedKeyStore(HUB_ENTITY_ID).getSecondaryEncryptionKeyForEntity(HUB_ENTITY_ID));

    SamlAuthnResponseTranslatorDto samlResponseDto = getSuccessSamlAuthnResponseTranslatorDto(secondaryEncryptionKey);

    Response clientResponse = postToSamlEngine(samlResponseDto);

    assertThat(clientResponse.getStatus()).isEqualTo(Response.Status.OK.getStatusCode());
}
 

import org.opensaml.security.credential.BasicCredential; //导入依赖的package包/类
@Test
public void shouldEncryptTheMatchingDatasetAssertionWhenGivenMatchingServiceEntityId() throws Exception {
    BasicCredential primaryEncryptionKey = new BasicCredential(new HardCodedKeyStore(HUB_ENTITY_ID).getPrimaryEncryptionKeyForEntity(HUB_ENTITY_ID));

    SamlAuthnResponseTranslatorDto samlResponseDto = getSuccessSamlAuthnResponseTranslatorDto(primaryEncryptionKey);

    Response clientResponse = postToSamlEngine(samlResponseDto);

    assertThat(clientResponse.getStatus()).isEqualTo(Response.Status.OK.getStatusCode());
    InboundResponseFromIdpDto inboundResponseFromIdpDto = clientResponse.readEntity(InboundResponseFromIdpDto.class);
    assertThat(inboundResponseFromIdpDto.getEncryptedMatchingDatasetAssertion().isPresent()).isTrue();

}