org.opensaml.saml.security.impl

Class SAMLMetadataEncryptionParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<org.opensaml.xmlsec.EncryptionParameters>

org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver

org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver

All Implemented Interfaces:

net.shibboleth.utilities.java.support.resolver.Resolver<org.opensaml.xmlsec.EncryptionParameters,net.shibboleth.utilities.java.support.resolver.CriteriaSet>, org.opensaml.xmlsec.EncryptionParametersResolver

public class SAMLMetadataEncryptionParametersResolver
extends BasicEncryptionParametersResolver

A specialization of BasicEncryptionParametersResolver which resolves credentials and algorithm preferences against SAML metadata via a MetadataCredentialResolver.

In addition to the Criterion inputs documented in BasicEncryptionParametersResolver, the inputs and associated modes of operation documented for MetadataCredentialResolver are also supported and required.

The CriteriaSet instance passed to the configured metadata credential resolver will be a copy of the input criteria set, with the addition of a UsageCriterion containing the value UsageType.ENCRYPTION, which will replace any existing usage criterion instance.

Field Summary

Fields

Modifier and Type	Field and Description
private MetadataCredentialResolver	credentialResolver Metadata credential resolver.
private Logger	log Logger.
private boolean	mergeMetadataRSAOAEPParametersWithConfig Flag indicating whether the resolver should attempt to merge RSAOAEPParameters values resolved from metadata with additional parameters from supplied instances of EncryptionConfiguration.

Constructor Summary

Constructors

Constructor and Description
SAMLMetadataEncryptionParametersResolver(MetadataCredentialResolver resolver) Constructor.

Method Summary

Methods

Modifier and Type	Method and Description
protected boolean	credentialSupportsEncryptionMethod(org.opensaml.security.credential.Credential credential, EncryptionMethod encryptionMethod) Evaluate whether the specified credential is supported for use with the specified EncryptionMethod.
protected boolean	evaluateEncryptionMethodChildren(EncryptionMethod encryptionMethod, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate) Evaluate the child elements of an EncryptionMethod for acceptability based on for example whitelist/blacklist policy and algorithm runtime support.
protected boolean	evaluateRSAOAEPChildren(EncryptionMethod encryptionMethod, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate) Evaluate the child elements of an RSA OAEP EncryptionMethod for acceptability based on for example whitelist/blacklist policy and algorithm runtime support.
protected MetadataCredentialResolver	getMetadataCredentialResolver() Get the metadata credential resolver instance to use to resolve encryption credentials.
boolean	isMergeMetadataRSAOAEPParametersWithConfig() Determine whether the resolver should attempt to merge RSAOAEPParameters values resolved from metadata with additional parameters from supplied instances of EncryptionConfiguration.
protected void	populateRSAOAEPParamsFromEncryptionMethod(org.opensaml.xmlsec.encryption.support.RSAOAEPParameters params, EncryptionMethod encryptionMethod, com.google.common.base.Predicate<String> whitelistBlacklistPredicate) Extract DigestMethod, MGF and OAEPparams data present on the supplied instance of EncryptionMethod and populate it on the supplied instance of of RSAOAEPParameters.
protected void	resolveAndPopulateCredentialsAndAlgorithms(org.opensaml.xmlsec.EncryptionParameters params, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate)
protected void	resolveAndPopulateRSAOAEPParams(org.opensaml.xmlsec.EncryptionParameters params, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, EncryptionMethod encryptionMethod) Resolve and populate an instance of RSAOAEPParameters, if appropriate for the selected key transport encryption algorithm.
protected net.shibboleth.utilities.java.support.collection.Pair<String,EncryptionMethod>	resolveDataEncryptionAlgorithm(net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, SAMLMDCredentialContext metadataCredContext) Determine the data encryption algorithm URI to use, also returning the associated EncryptionMethod from metadata if relevant.
protected net.shibboleth.utilities.java.support.collection.Pair<String,EncryptionMethod>	resolveKeyTransportAlgorithm(org.opensaml.security.credential.Credential keyTransportCredential, net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, String dataEncryptionAlgorithm, SAMLMDCredentialContext metadataCredContext) Determine the key transport algorithm URI to use with the specified credential, also returning the associated EncryptionMethod from metadata if relevant.
void	setMergeMetadataRSAOAEPParametersWithConfig(boolean flag) Set whether the resolver should attempt to merge RSAOAEPParameters values resolved from metadata with additional parameters from supplied instances of EncryptionConfiguration.

Methods inherited from class org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver

credentialSupportsAlgorithm, generateDataEncryptionCredential, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveDataEncryptionAlgorithms, getEffectiveDataEncryptionCredentials, getEffectiveKeyTransportAlgorithms, getEffectiveKeyTransportCredentials, getWhitelistBlacklistPredicate, isAutoGenerateDataEncryptionCredential, isDataEncryptionAlgorithm, isKeyTransportAlgorithm, logResult, populateRSAOAEPParams, processDataEncryptionCredentialAutoGeneration, resolve, resolveAndPopulateRSAOAEPParams, resolveDataEncryptionAlgorithm, resolveDataEncryptionAlgorithm, resolveDataKeyInfoGenerator, resolveKeyTransportAlgorithm, resolveKeyTransportAlgorithm, resolveKeyTransportAlgorithmPredicate, resolveKeyTransportKeyInfoGenerator, resolveSingle, setAlgorithmRegistry, setAutoGenerateDataEncryptionCredential, validate, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateWhiteAndBlacklists, resolveEffectiveBlacklist, resolveEffectiveWhitelist, resolveWhitelistBlacklistPrecedence, resolveWhitelistBlacklistPredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

private Logger log

Logger.

credentialResolver

private MetadataCredentialResolver credentialResolver

Metadata credential resolver.

mergeMetadataRSAOAEPParametersWithConfig

private boolean mergeMetadataRSAOAEPParametersWithConfig

Flag indicating whether the resolver should attempt to merge RSAOAEPParameters values resolved from metadata with additional parameters from supplied instances of EncryptionConfiguration.

Constructor Detail

SAMLMetadataEncryptionParametersResolver

public SAMLMetadataEncryptionParametersResolver(@Nonnull@ParameterName(name="resolver")
                                        MetadataCredentialResolver resolver)

Constructor.

Parameters:

resolver - the metadata credential resolver instance to use to resolve encryption credentials

Method Detail

isMergeMetadataRSAOAEPParametersWithConfig

public boolean isMergeMetadataRSAOAEPParametersWithConfig()

Determine whether the resolver should attempt to merge RSAOAEPParameters values resolved from metadata with additional parameters from supplied instances of EncryptionConfiguration.

Defaults to: false

Returns:

true if should merge metadata parameters with configuration, false otherwise

setMergeMetadataRSAOAEPParametersWithConfig

public void setMergeMetadataRSAOAEPParametersWithConfig(boolean flag)

Set whether the resolver should attempt to merge RSAOAEPParameters values resolved from metadata with additional parameters from supplied instances of EncryptionConfiguration.

Defaults to: false

Parameters:

flag - true if should merge metadata parameters with configuration, false otherwise

getMetadataCredentialResolver

@Nonnull
protected MetadataCredentialResolver getMetadataCredentialResolver()

Get the metadata credential resolver instance to use to resolve encryption credentials.

Returns:

the configured metadata credential resolver instance

resolveAndPopulateCredentialsAndAlgorithms

protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull
                                              org.opensaml.xmlsec.EncryptionParameters params,
                                              @Nonnull
                                              net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                              @Nonnull
                                              com.google.common.base.Predicate<String> whitelistBlacklistPredicate)

Overrides:

resolveAndPopulateCredentialsAndAlgorithms in class BasicEncryptionParametersResolver

resolveAndPopulateRSAOAEPParams

protected void resolveAndPopulateRSAOAEPParams(@Nonnull
                                   org.opensaml.xmlsec.EncryptionParameters params,
                                   @Nonnull
                                   net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                   @Nonnull
                                   com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                   @Nullable
                                   EncryptionMethod encryptionMethod)

Resolve and populate an instance of RSAOAEPParameters, if appropriate for the selected key transport encryption algorithm.

This method itself resolves the parameters data from the metadata EncryptionMethod. If this results in a non-complete RSAOAEPParameters instance and if isMergeMetadataRSAOAEPParametersWithConfig() evaluates true, then the resolver will delegate to the local config resolution process via the superclass to attempt to resolve and merge any null parameter values. (see BasicEncryptionParametersResolver.resolveAndPopulateRSAOAEPParams(EncryptionParameters, CriteriaSet, Predicate)).

Parameters:

params - the current encryption parameters instance being resolved

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

encryptionMethod - the method encryption method that was resolved along with the key transport encryption algorithm URI, if any. May be null.

populateRSAOAEPParamsFromEncryptionMethod

protected void populateRSAOAEPParamsFromEncryptionMethod(@Nonnull
                                             org.opensaml.xmlsec.encryption.support.RSAOAEPParameters params,
                                             @Nonnull
                                             EncryptionMethod encryptionMethod,
                                             @Nonnull
                                             com.google.common.base.Predicate<String> whitelistBlacklistPredicate)

Extract DigestMethod, MGF and OAEPparams data present on the supplied instance of EncryptionMethod and populate it on the supplied instance of of RSAOAEPParameters.

Whitelist/blacklist evaluation is applied to the digest method and MGF algorithm URIs.

Parameters:

params - the existing RSAOAEPParameters instance being populated

encryptionMethod - the method encryption method that was resolved along with the key transport encryption algorithm URI, if any. May be null.

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

resolveKeyTransportAlgorithm

@Nonnull
protected net.shibboleth.utilities.java.support.collection.Pair<String,EncryptionMethod> resolveKeyTransportAlgorithm(@Nonnull
                                                                                                                  org.opensaml.security.credential.Credential keyTransportCredential,
                                                                                                                  @Nonnull
                                                                                                                  net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                                                                                                  @Nonnull
                                                                                                                  com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                                                                                                  @Nullable
                                                                                                                  String dataEncryptionAlgorithm,
                                                                                                                  @Nullable
                                                                                                                  SAMLMDCredentialContext metadataCredContext)

Determine the key transport algorithm URI to use with the specified credential, also returning the associated EncryptionMethod from metadata if relevant.

Any algorithms specified in metadata via the passed SAMLMDCredentialContext are considered first, followed by locally configured algorithms.

Parameters:

keyTransportCredential - the key transport credential to evaluate

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

dataEncryptionAlgorithm - the optional data encryption algorithm URI to consider

metadataCredContext - the credential context extracted from metadata

Returns:

the selected algorithm URI and the associated encryption method from metadata, if any.

resolveDataEncryptionAlgorithm

@Nonnull
protected net.shibboleth.utilities.java.support.collection.Pair<String,EncryptionMethod> resolveDataEncryptionAlgorithm(@Nonnull
                                                                                                                    net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                                                                                                    @Nonnull
                                                                                                                    com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                                                                                                    @Nullable
                                                                                                                    SAMLMDCredentialContext metadataCredContext)

Determine the data encryption algorithm URI to use, also returning the associated EncryptionMethod from metadata if relevant.

Any algorithms specified in metadata via the passed SAMLMDCredentialContext are considered first, followed by locally configured algorithms.

Parameters:

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

metadataCredContext - the credential context extracted from metadata

Returns:

the selected algorithm URI and the associated encryption method from metadata, if any

evaluateEncryptionMethodChildren

protected boolean evaluateEncryptionMethodChildren(@Nonnull
                                       EncryptionMethod encryptionMethod,
                                       @Nonnull
                                       net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                                       @Nonnull
                                       com.google.common.base.Predicate<String> whitelistBlacklistPredicate)

Evaluate the child elements of an EncryptionMethod for acceptability based on for example whitelist/blacklist policy and algorithm runtime support.

Parameters:

encryptionMethod - the EncryptionMethod being evaluated

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

Returns:

true if the EncryptionMethod children are acceptable

evaluateRSAOAEPChildren

protected boolean evaluateRSAOAEPChildren(@Nonnull
                              EncryptionMethod encryptionMethod,
                              @Nonnull
                              net.shibboleth.utilities.java.support.resolver.CriteriaSet criteria,
                              @Nonnull
                              com.google.common.base.Predicate<String> whitelistBlacklistPredicate)

Evaluate the child elements of an RSA OAEP EncryptionMethod for acceptability based on for example whitelist/blacklist policy and algorithm runtime support.

Parameters:

encryptionMethod - the EncryptionMethod being evaluated

criteria - the criteria instance being evaluated

whitelistBlacklistPredicate - the whitelist/blacklist predicate with which to evaluate the candidate data encryption and key transport algorithm URIs

Returns:

true if the EncryptionMethod children are acceptable

credentialSupportsEncryptionMethod

protected boolean credentialSupportsEncryptionMethod(@Nonnull
                                         org.opensaml.security.credential.Credential credential,
                                         @Nonnull@NotEmpty
                                         EncryptionMethod encryptionMethod)

Evaluate whether the specified credential is supported for use with the specified EncryptionMethod.

Parameters:

credential - the credential to evaluate

encryptionMethod - the encryption method to evaluate

Returns:

true if credential may be used with the supplied encryption method, false otherwise