Package net.shibboleth.oidc.security.jose.impl

Class BasicSignatureSigningParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<SignatureSigningParameters>

net.shibboleth.oidc.security.jose.impl.BasicSignatureSigningParametersResolver

All Implemented Interfaces:

SignatureSigningParametersResolver, Resolver<SignatureSigningParameters,CriteriaSet>

Direct Known Subclasses:

ClientInformationSignatureSigningParametersResolver, RelyingPartySigningParametersResolver

public class BasicSignatureSigningParametersResolver
extends AbstractSecurityParametersResolver<SignatureSigningParameters>
implements SignatureSigningParametersResolver

Basic implementation of an SignatureSigningParametersResolver.

The following Criterion inputs are supported:

• SignatureSigningConfigurationCriterion - required

The set of effective signature algorithms is filtered against those supported by the runtime and those configured by include/exclude policy.

Since:

2.2.0

Field Summary

Fields

Modifier and Type	Field	Description
private AlgorithmRegistry	algorithmRegistry	The AlgorithmRegistry used when processing algorithm URIs.
private org.slf4j.Logger	log	Class logger.

Constructor Summary

Constructors

Constructor	Description
BasicSignatureSigningParametersResolver()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected boolean	credentialSupportsSigningAlgorithm(Credential credential, String algorithm)	Evaluate whether the specified credential is supported for use with the specified signing algorithm.
protected void	findCompatibleAlgorithmAndCredential(List<String> algorithms, List<Credential> credentials, SignatureSigningParameters params)	Loop through the algorithms and find the first compatible credential.
AlgorithmRegistry	getAlgorithmRegistry()	Get the AlgorithmRegistry instance used when resolving algorithm URIs.
protected Predicate<String>	getAlgorithmRuntimeSupportedPredicate()	Get a predicate which evaluates whether a cryptographic algorithm is supported by the runtime environment.
protected List<String>	getEffectiveSignatureAlgorithms(CriteriaSet criteria, Predicate<String> includeExcludePredicate)	Get the effective list of signature algorithm URIs to consider, including application of include/exclude policy.
protected List<Credential>	getEffectiveSigningCredentials(CriteriaSet criteria)	Get the effective list of signing credentials to consider.
protected Predicate<String>	getIncludeExcludePredicate(CriteriaSet criteria)	Get a predicate which implements the effective configured include/exclude policy.
protected void	logResult(SignatureSigningParameters params)	Log the resolved parameters.
Iterable<SignatureSigningParameters>	resolve(CriteriaSet criteria)
protected void	resolveAndPopulateCredentialAndSignatureAlgorithm(SignatureSigningParameters params, CriteriaSet criteria, Predicate<String> includeExcludePredicate)	Resolve and populate the signing credential and signature method algorithm URI on the supplied parameters instance.
SignatureSigningParameters	resolveSingle(CriteriaSet criteria)
void	setAlgorithmRegistry(AlgorithmRegistry registry)	Set the AlgorithmRegistry instance used when resolving algorithm URIs.
protected boolean	validate(SignatureSigningParameters params)	Validate that the SignatureSigningParameters instance has all the required properties populated.

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateIncludesExcludes, resolveEffectiveExcludes, resolveEffectiveIncludes, resolveIncludeExcludePrecedence, resolveIncludeExcludePredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

private final org.slf4j.Logger log

Class logger.

algorithmRegistry

private AlgorithmRegistry algorithmRegistry

The AlgorithmRegistry used when processing algorithm URIs.

Constructor Detail

BasicSignatureSigningParametersResolver

public BasicSignatureSigningParametersResolver()

Constructor.

Method Detail

getAlgorithmRegistry

public AlgorithmRegistry getAlgorithmRegistry()

Get the AlgorithmRegistry instance used when resolving algorithm URIs. Defaults to the registry obtained via AlgorithmSupport.getGlobalAlgorithmRegistry().

Returns:

the algorithm registry instance

setAlgorithmRegistry

public void setAlgorithmRegistry(@Nonnull
                                 AlgorithmRegistry registry)

Set the AlgorithmRegistry instance used when resolving algorithm URIs. Defaults to the registry obtained via AlgorithmSupport.getGlobalAlgorithmRegistry().

Parameters:

registry - the new algorithm registry instance

resolve

@Nonnull
public Iterable<SignatureSigningParameters> resolve(@Nonnull
                                                    CriteriaSet criteria)
                                             throws ResolverException

Specified by:

resolve in interface Resolver<SignatureSigningParameters,CriteriaSet>

Throws:

ResolverException

resolveSingle

@Nullable
public SignatureSigningParameters resolveSingle(@Nonnull
                                                CriteriaSet criteria)
                                         throws ResolverException

Specified by:

resolveSingle in interface Resolver<SignatureSigningParameters,CriteriaSet>

Throws:

ResolverException

logResult

protected void logResult(@Nonnull
                         SignatureSigningParameters params)

Log the resolved parameters.

Parameters:

params - the resolved param

validate

protected boolean validate(@Nonnull
                           SignatureSigningParameters params)

Validate that the SignatureSigningParameters instance has all the required properties populated.

Parameters:

params - the parameters instance to evaluate

Returns:

true if parameters instance passes validation, false otherwise

getIncludeExcludePredicate

@Nonnull
protected Predicate<String> getIncludeExcludePredicate(@Nonnull
                                                       CriteriaSet criteria)

Get a predicate which implements the effective configured include/exclude policy.

Parameters:

criteria - the input criteria being evaluated

Returns:

include/exclude predicate instance

resolveAndPopulateCredentialAndSignatureAlgorithm

protected void resolveAndPopulateCredentialAndSignatureAlgorithm(@Nonnull
                                                                 SignatureSigningParameters params,
                                                                 @Nonnull
                                                                 CriteriaSet criteria,
                                                                 Predicate<String> includeExcludePredicate)

Resolve and populate the signing credential and signature method algorithm URI on the supplied parameters instance.

Parameters:

params - the parameters instance being populated

criteria - the input criteria being evaluated

includeExcludePredicate - the include/exclude predicate with which to evaluate the candidate signing method algorithm URIs

findCompatibleAlgorithmAndCredential

protected void findCompatibleAlgorithmAndCredential(List<String> algorithms,
                                                    List<Credential> credentials,
                                                    @Nonnull
                                                    SignatureSigningParameters params)

Loop through the algorithms and find the first compatible credential. Add the compatible algorithm and credential to the signing parameters.

Parameters:

algorithms - the algorithms to find compatible from

credentials - the credentials to find compatibility with

params - the parameters to add a compatible algorithm and credential too.

getAlgorithmRuntimeSupportedPredicate

@Nonnull
protected Predicate<String> getAlgorithmRuntimeSupportedPredicate()

Get a predicate which evaluates whether a cryptographic algorithm is supported by the runtime environment.

Returns:

the predicate

credentialSupportsSigningAlgorithm

protected boolean credentialSupportsSigningAlgorithm(@Nonnull
                                                     Credential credential,
                                                     @Nonnull @NotEmpty
                                                     String algorithm)

Evaluate whether the specified credential is supported for use with the specified signing algorithm.

First, the key type is checked against the algorithm family, then the algorithm and key length are checked. If the key is an EC type, the curve is also checked against the algorithm. If the key is a MAC type, check the key length matches the MAC signing algorithm used.

Parameters:

credential - the credential to evaluate

algorithm - the algorithm URI to evaluate

Returns:

true if credential may be used with the supplied algorithm URI, false otherwise

getEffectiveSigningCredentials

@Nonnull
protected List<Credential> getEffectiveSigningCredentials(@Nonnull
                                                          CriteriaSet criteria)

Get the effective list of signing credentials to consider.

Parameters:

criteria - the input criteria being evaluated

Returns:

the list of credentials

getEffectiveSignatureAlgorithms

@Nonnull
protected List<String> getEffectiveSignatureAlgorithms(@Nonnull
                                                       CriteriaSet criteria,
                                                       @Nonnull
                                                       Predicate<String> includeExcludePredicate)

Get the effective list of signature algorithm URIs to consider, including application of include/exclude policy.

Parameters:

criteria - the input criteria being evaluated

includeExcludePredicate - the include/exclude predicate to use

Returns:

the list of effective algorithm URIs