edu.internet2.middleware.shibboleth.common.security

Class MetadataPKIXValidationInformationResolver

java.lang.Object

edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver

All Implemented Interfaces:

Resolver<PKIXValidationInformation,CriteriaSet>, PKIXValidationInformationResolver

public class MetadataPKIXValidationInformationResolver
extends Object
implements PKIXValidationInformationResolver

An implementation of PKIXValidationInformationResolver which resolves PKIXValidationInformation based on information stored in SAML 2 metadata. Validation information is retrieved from Shibboleth-specific metadata extensions to EntityDescriptor and EntitiesDescriptor elements, represented by instances of ShibbolethMetadataKeyAuthority. Resolution of trusted names for an entity is also supported, based on KeyName information contained within the KeyInfo of a role descriptor's KeyDescriptor element.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected class	MetadataPKIXValidationInformationResolver.MetadataCacheKey A class which serves as the key into the cache of information previously resolved.
protected class	MetadataPKIXValidationInformationResolver.MetadataProviderObserver An observer that clears the credential cache if the underlying metadata changes.

Field Summary

Fields

Modifier and Type	Field and Description
private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<Set<String>>>	entityNamesCache Cache of resolved info.
private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<List<PKIXValidationInformation>>>	entityPKIXCache Cache of resolved info.
private Map<Extensions,SoftReference<List<PKIXValidationInformation>>>	extensionsCache Cache of resolved info.
static int	KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT Default value for Shibboleth KeyAuthority verify depth.
private org.slf4j.Logger	log Class logger.
private MetadataProvider	metadata Metadata provider from which to fetch the credentials.
private ReadWriteLock	rwlock Lock used to synchronize access to the caches.

Constructor Summary

Constructors

Constructor and Description
MetadataPKIXValidationInformationResolver(MetadataProvider metadataProvider) Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
protected void	cacheExtensionsInfo(Extensions extensions, List<PKIXValidationInformation> pkixInfo) Adds resolved PKIX validation information to the cache.
protected void	cachePKIXInfo(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey, List<PKIXValidationInformation> pkixInfo) Adds resolved PKIX validation information to the cache.
protected void	cacheTrustedNames(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey, Set<String> names) Adds resolved trusted name information to the cache.
protected void	checkCriteriaRequirements(CriteriaSet criteriaSet) Check that all necessary criteria are available.
protected String	getExtensionsParentName(Extensions extensions) Get the name of the parent element of an Extensions element in metadata, mostly useful for logging purposes.
protected ReadWriteLock	getReadWriteLock() Get the lock instance used to synchronize access to the caches.
protected List<RoleDescriptor>	getRoleDescriptors(String entityID, QName role, String protocol) Get the list of metadata role descriptors which match the given entityID, role and protocol.
protected Set<String>	getTrustedNames(KeyInfo keyInfo) Extract trusted names from a KeyInfo element.
protected List<X509Certificate>	getX509Certificates(KeyInfo keyInfo) Extract certificates from a KeyInfo element.
protected List<X509CRL>	getX509CRLs(KeyInfo keyInfo) Extract CRL's from a KeyInfo element.
protected boolean	matchUsage(UsageType metadataUsage, UsageType criteriaUsage) Match usage enum type values from metadata KeyDescriptor and from specified resolution criteria.
Iterable<PKIXValidationInformation>	resolve(CriteriaSet criteriaSet)
protected List<PKIXValidationInformation>	resolvePKIXInfo(Extensions extensions) Retrieves validation information from the metadata extension element.
protected List<PKIXValidationInformation>	resolvePKIXInfo(RoleDescriptor roleDescriptor) Retrieves validation information from the provided role descriptor.
protected PKIXValidationInformation	resolvePKIXInfo(ShibbolethMetadataKeyAuthority keyAuthority) Retrieves validation information from the Shibboleth KeyAuthority metadata extension element.
PKIXValidationInformation	resolveSingle(CriteriaSet criteriaSet)
Set<String>	resolveTrustedNames(CriteriaSet criteriaSet)
protected List<PKIXValidationInformation>	retrieveExtensionsInfoFromCache(Extensions extensions) Retrieves pre-resolved PKIX validation information from the cache.
protected List<PKIXValidationInformation>	retrievePKIXInfoFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey) Retrieves pre-resolved PKIX validation information from the cache.
protected List<PKIXValidationInformation>	retrievePKIXInfoFromMetadata(String entityID, QName role, String protocol, UsageType usage) Retrieves validation information from the provided metadata.
protected Set<String>	retrieveTrustedNamesFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey) Retrieves pre-resolved trusted names from the cache.
protected Set<String>	retrieveTrustedNamesFromMetadata(String entityID, QName role, String protocol, UsageType usage) Retrieves trusted name information from the provided metadata.
boolean	supportsTrustedNameResolution()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT

public static final int KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT

Default value for Shibboleth KeyAuthority verify depth.

See Also:

Constant Field Values

log

private final org.slf4j.Logger log

Class logger.

metadata

private MetadataProvider metadata

Metadata provider from which to fetch the credentials.

entityPKIXCache

private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<List<PKIXValidationInformation>>> entityPKIXCache

Cache of resolved info. [MetadataCacheKey, Credentials]

extensionsCache

private Map<Extensions,SoftReference<List<PKIXValidationInformation>>> extensionsCache

Cache of resolved info. [Extensions, Credentials]

entityNamesCache

private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<Set<String>>> entityNamesCache

Cache of resolved info. [MetadataCacheKey, Strings(trusted key names)]

rwlock

private ReadWriteLock rwlock

Lock used to synchronize access to the caches.

Constructor Detail

MetadataPKIXValidationInformationResolver

public MetadataPKIXValidationInformationResolver(MetadataProvider metadataProvider)

Constructor.

Parameters:

metadataProvider - provider of the metadata

Throws:

IllegalArgumentException - thrown if the supplied provider is null

Method Detail

resolveSingle

public PKIXValidationInformation resolveSingle(CriteriaSet criteriaSet)
                                        throws SecurityException

Specified by:

resolveSingle in interface Resolver<PKIXValidationInformation,CriteriaSet>

Throws:

SecurityException

resolve

public Iterable<PKIXValidationInformation> resolve(CriteriaSet criteriaSet)
                                            throws SecurityException

Specified by:

resolve in interface Resolver<PKIXValidationInformation,CriteriaSet>

Throws:

SecurityException

resolveTrustedNames

public Set<String> resolveTrustedNames(CriteriaSet criteriaSet)
                                throws SecurityException,
                                       UnsupportedOperationException

Specified by:

resolveTrustedNames in interface PKIXValidationInformationResolver

Throws:

SecurityException

UnsupportedOperationException

supportsTrustedNameResolution

public boolean supportsTrustedNameResolution()

Specified by:

supportsTrustedNameResolution in interface PKIXValidationInformationResolver

getReadWriteLock

protected ReadWriteLock getReadWriteLock()

Get the lock instance used to synchronize access to the caches.

Returns:

a read-write lock instance

checkCriteriaRequirements

protected void checkCriteriaRequirements(CriteriaSet criteriaSet)

Check that all necessary criteria are available.

Parameters:

criteriaSet - the criteria set to evaluate

retrievePKIXInfoFromMetadata

protected List<PKIXValidationInformation> retrievePKIXInfoFromMetadata(String entityID,
                                                           QName role,
                                                           String protocol,
                                                           UsageType usage)
                                                                throws SecurityException

Retrieves validation information from the provided metadata.

Parameters:

entityID - entity ID for which to resolve validation information

role - role in which the entity is operating

protocol - protocol over which the entity is operating (may be null)

usage - usage specifier for role descriptor key descriptors to evaluate

Returns:

collection of resolved validation information, possibly empty

Throws:

SecurityException - thrown if the key, certificate, or CRL information is represented in an unsupported format

resolvePKIXInfo

protected List<PKIXValidationInformation> resolvePKIXInfo(RoleDescriptor roleDescriptor)
                                                   throws SecurityException

Retrieves validation information from the provided role descriptor.

Parameters:

roleDescriptor - the role descriptor from which to resolve information.

Returns:

collection of resolved validation information, possibly empty

Throws:

SecurityException - thrown if the key, certificate, or CRL information is represented in an unsupported format

resolvePKIXInfo

protected List<PKIXValidationInformation> resolvePKIXInfo(Extensions extensions)
                                                   throws SecurityException

Retrieves validation information from the metadata extension element.

Parameters:

extensions - the extension element from which to resolve information

Returns:

collection of resolved validation information, possibly empty

Throws:

SecurityException - thrown if the key, certificate, or CRL information is represented in an unsupported format

resolvePKIXInfo

protected PKIXValidationInformation resolvePKIXInfo(ShibbolethMetadataKeyAuthority keyAuthority)
                                             throws SecurityException

Retrieves validation information from the Shibboleth KeyAuthority metadata extension element.

Parameters:

keyAuthority - the Shibboleth KeyAuthority element from which to resolve information

Returns:

an instance of resolved validation information

Throws:

SecurityException - thrown if the key, certificate, or CRL information is represented in an unsupported format

getX509Certificates

protected List<X509Certificate> getX509Certificates(KeyInfo keyInfo)
                                             throws SecurityException

Extract certificates from a KeyInfo element.

Parameters:

keyInfo - the KeyInfo instance from which to extract certificates

Returns:

a collection of X509 certificates, possibly empty

Throws:

SecurityException - thrown if the certificate information is represented in an unsupported format

getX509CRLs

protected List<X509CRL> getX509CRLs(KeyInfo keyInfo)
                             throws SecurityException

Extract CRL's from a KeyInfo element.

Parameters:

keyInfo - the KeyInfo instance from which to extract CRL's

Returns:

a collection of X509 CRL's, possibly empty

Throws:

SecurityException - thrown if the CRL information is represented in an unsupported format

retrieveTrustedNamesFromMetadata

protected Set<String> retrieveTrustedNamesFromMetadata(String entityID,
                                           QName role,
                                           String protocol,
                                           UsageType usage)
                                                throws SecurityException

Retrieves trusted name information from the provided metadata.

Parameters:

entityID - entity ID for which to resolve trusted names

role - role in which the entity is operating

protocol - protocol over which the entity is operating (may be null)

usage - usage specifier for role descriptor key descriptors to evaluate

Returns:

collection of resolved trusted name information, possibly empty

Throws:

SecurityException - thrown if there is an error extracting trusted name information

getTrustedNames

protected Set<String> getTrustedNames(KeyInfo keyInfo)

Extract trusted names from a KeyInfo element.

Parameters:

keyInfo - the KeyInfo instance from which to extract trusted names

Returns:

set of trusted names, possibly empty

matchUsage

protected boolean matchUsage(UsageType metadataUsage,
                 UsageType criteriaUsage)

Match usage enum type values from metadata KeyDescriptor and from specified resolution criteria.

Parameters:

metadataUsage - the value from the 'use' attribute of a metadata KeyDescriptor element

criteriaUsage - the value from specified criteria

Returns:

true if the two usage specifiers match for purposes of resolving validation information, false otherwise

getRoleDescriptors

protected List<RoleDescriptor> getRoleDescriptors(String entityID,
                                      QName role,
                                      String protocol)
                                           throws SecurityException

Get the list of metadata role descriptors which match the given entityID, role and protocol.

Parameters:

entityID - entity ID of the metadata entity descriptor to resolve

role - role in which the entity is operating

protocol - protocol over which the entity is operating (may be null)

Returns:

a list of role descriptors matching the given parameters, or null

Throws:

SecurityException - thrown if there is an error retrieving role descriptors from the metadata provider

retrievePKIXInfoFromCache

protected List<PKIXValidationInformation> retrievePKIXInfoFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey)

Retrieves pre-resolved PKIX validation information from the cache.

Parameters:

cacheKey - the key to the metadata cache

Returns:

the collection of cached info or null

retrieveExtensionsInfoFromCache

protected List<PKIXValidationInformation> retrieveExtensionsInfoFromCache(Extensions extensions)

Retrieves pre-resolved PKIX validation information from the cache.

Parameters:

extensions - the key to the metadata cache

Returns:

the collection of cached info or null

retrieveTrustedNamesFromCache

protected Set<String> retrieveTrustedNamesFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey)

Retrieves pre-resolved trusted names from the cache.

Parameters:

cacheKey - the key to the metadata cache

Returns:

the set of cached info or null

cachePKIXInfo

protected void cachePKIXInfo(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey,
                 List<PKIXValidationInformation> pkixInfo)

Adds resolved PKIX validation information to the cache.

Parameters:

cacheKey - the key for caching the information

pkixInfo - collection of PKIX information to cache

cacheExtensionsInfo

protected void cacheExtensionsInfo(Extensions extensions,
                       List<PKIXValidationInformation> pkixInfo)

Adds resolved PKIX validation information to the cache.

Parameters:

extensions - the key for caching the information

pkixInfo - collection of PKIX information to cache

cacheTrustedNames

protected void cacheTrustedNames(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey,
                     Set<String> names)

Adds resolved trusted name information to the cache.

Parameters:

cacheKey - the key for caching the information

names - collection of names to cache

getExtensionsParentName

protected String getExtensionsParentName(Extensions extensions)

Get the name of the parent element of an Extensions element in metadata, mostly useful for logging purposes. If the parent is an EntityDescriptor, return the entityID value. If an EntitiesDescriptor, return the name value.

Parameters:

extensions - the Extensions element

Returns:

the Extensions element's parent's name