org.opensaml.saml.security.impl

Class SAMLMetadataEncryptionParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<org.opensaml.xmlsec.EncryptionParameters>

org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver

org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver

All Implemented Interfaces:

net.shibboleth.utilities.java.support.resolver.Resolver<org.opensaml.xmlsec.EncryptionParameters,net.shibboleth.utilities.java.support.resolver.CriteriaSet>, org.opensaml.xmlsec.EncryptionParametersResolver

public class SAMLMetadataEncryptionParametersResolver
extends BasicEncryptionParametersResolver

A specialization of BasicEncryptionParametersResolver which resolves credentials and algorithm preferences against SAML metadata via a MetadataCredentialResolver.

In addition to the Criterion inputs documented in BasicEncryptionParametersResolver, the inputs and associated modes of operation documented for MetadataCredentialResolver are also supported and required.

The CriteriaSet instance passed to the configured metadata credential resolver will be a copy of the input criteria set, with the addition of a UsageCriterion containing the value UsageType.ENCRYPTION, which will replace any existing usage criterion instance.

Field Summary

Fields

Modifier and Type	Field and Description
private MetadataCredentialResolver	credentialResolver Metadata credential resolver.
private Logger	log Logger.

Constructor Summary

Constructors

Constructor and Description
SAMLMetadataEncryptionParametersResolver(MetadataCredentialResolver resolver) Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
protected boolean	credentialSupportsEncryptionMethod(org.opensaml.security.credential.Credential credential, EncryptionMethod encryptionMethod) Evaluate whether the specified credential is supported for use with the specified EncryptionMethod.
protected MetadataCredentialResolver	getMetadataCredentialResolver() Get the metadata credential resolver instance to use to resolve encryption credentials.
protected void	resolveAndPopulateCredentialsAndAlgorithms(org.opensaml.xmlsec.EncryptionParameters params, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate)
protected String	resolveDataEncryptionAlgorithm(net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, SAMLMDCredentialContext metadataCredContext) Determine the data encryption algorithm URI to use.
protected String	resolveKeyTransportAlgorithm(org.opensaml.security.credential.Credential keyTransportCredential, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, String dataEncryptionAlgorithm, SAMLMDCredentialContext metadataCredContext) Determine the key transport algorithm URI to use with the specified credential.

Methods inherited from class org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver

credentialSupportsAlgorithm, generateDataEncryptionCredential, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveDataEncryptionAlgorithms, getEffectiveDataEncryptionCredentials, getEffectiveKeyTransportAlgorithms, getEffectiveKeyTransportCredentials, getWhitelistBlacklistPredicate, isAutoGenerateDataEncryptionCredential, isDataEncryptionAlgorithm, isKeyTransportAlgorithm, logResult, processDataEncryptionCredentialAutoGeneration, resolve, resolveDataEncryptionAlgorithm, resolveDataEncryptionAlgorithm, resolveDataKeyInfoGenerator, resolveKeyTransportAlgorithm, resolveKeyTransportAlgorithm, resolveKeyTransportKeyInfoGenerator, resolveSingle, setAlgorithmRegistry, setAutoGenerateDataEncryptionCredential, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateWhiteAndBlacklists, resolveEffectiveBlacklist, resolveEffectiveWhitelist, resolveWhitelistBlacklistPrecedence, resolveWhitelistBlacklistPredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

private Logger log

Logger.

credentialResolver

private MetadataCredentialResolver credentialResolver

Metadata credential resolver.

Constructor Detail

SAMLMetadataEncryptionParametersResolver

public SAMLMetadataEncryptionParametersResolver(@Nonnull
                                        MetadataCredentialResolver resolver)

Constructor.

Parameters:

resolver - the metadata credential resolver instance to use to resolve encryption credentials

Method Detail

getMetadataCredentialResolver

@Nonnull
protected MetadataCredentialResolver getMetadataCredentialResolver()

Get the metadata credential resolver instance to use to resolve encryption credentials.

Returns:

the configured metadata credential resolver instance

resolveAndPopulateCredentialsAndAlgorithms

protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull
                                              org.opensaml.xmlsec.EncryptionParameters params,
                                              @Nonnull
                                              net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                              @Nonnull
                                              com.google.common.base.Predicate<String> whitelistBlacklistPredicate)

Overrides:

resolveAndPopulateCredentialsAndAlgorithms in class BasicEncryptionParametersResolver

resolveKeyTransportAlgorithm

@Nullable
protected String resolveKeyTransportAlgorithm(@Nonnull
                                           org.opensaml.security.credential.Credential keyTransportCredential,
                                           @Nonnull
                                           net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                           @Nonnull
                                           com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                           @Nullable
                                           String dataEncryptionAlgorithm,
                                           @Nullable
                                           SAMLMDCredentialContext metadataCredContext)

Determine the key transport algorithm URI to use with the specified credential. Any algorithms specified in metadata via the passed SAMLMDCredentialContext are considered first, followed by locally configured algorithms.

Parameters:

keyTransportCredential - the key transport credential to evaluate

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

dataEncryptionAlgorithm - the optional data encryption algorithm URI to consider

metadataCredContext - the credential context extracted from metadata

Returns:

the selected algorithm URI

resolveDataEncryptionAlgorithm

@Nullable
protected String resolveDataEncryptionAlgorithm(@Nonnull
                                             net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                             @Nonnull
                                             com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                             @Nullable
                                             SAMLMDCredentialContext metadataCredContext)

Determine the data encryption algorithm URI to use. Any algorithms specified in metadata via the passed SAMLMDCredentialContext are considered first, followed by locally configured algorithms.

Parameters:

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

metadataCredContext - the credential context extracted from metadata

Returns:

the selected algorithm URI

credentialSupportsEncryptionMethod

protected boolean credentialSupportsEncryptionMethod(@Nonnull
                                         org.opensaml.security.credential.Credential credential,
                                         @Nonnull@NotEmpty
                                         EncryptionMethod encryptionMethod)

Evaluate whether the specified credential is supported for use with the specified EncryptionMethod.

Parameters:

credential - the credential to evaluate

encryptionMethod - the encryption method to evaluate

Returns:

true if credential may be used with the supplied encryption method, false otherwise