treaty = Treaty.unmarshal(vr.document); Util.debug("(warning: this is a signed treaty, but using service space id from treaty and not cert)"); } else { StringReader reader = new StringReader(treatyXML); treaty = Treaty.unmarshal(reader); reader.close();
SignatureManager.VerificationResponse vr = signatureManager.verifyDocument(treatyDoc); treatyDoc = vr.document; requesterId = Util.parseInt(vr.alias); treaty.setClientServiceSpace(vr.alias);
    public String[] verifyTreaty(String treatyXML, boolean isSigned)            throws SecurityManagerException {        try {            if (treatyXML == null)                throw new SecurityManagerException("signedTreaty parameter is null");            // TODO: if necessary decrypt            // verify treaty document.            // from the verification we get the service space id            Treaty treaty = null;            if (isSigned) {                StringReader reader = new StringReader(treatyXML);                Document signedTreatyDoc = db.parse(new InputSource(reader));                SignatureManager.VerificationResponse vr = signatureManager.verifyDocument(signedTreatyDoc);                treaty = Treaty.unmarshal(vr.document);                Util.debug("(warning: this is a signed treaty, but using service space id from treaty and not cert)");            }            else {                StringReader reader = new StringReader(treatyXML);                treaty = Treaty.unmarshal(reader);                reader.close();            }            // TODO TODO TODO! For signed treaties, get the service space id based on the alias of            // the certificate, NOT just from the treaty!            int requesterId = Util.parseInt(treaty.getClientServiceSpace());            // now, for each service in the treaty, we get the authorized methods, and set            // the authorized flag for each method accordingly            ServiceInvokationPermissionDAO dao = new ServiceInvokationPermissionDAO(ds);            for (Enumeration e = treaty.enumerateServiceInfo(); e.hasMoreElements();) {                ServiceInfo serviceInfo = (ServiceInfo) e.nextElement();                ServiceInvokationPermission permission = dao.getPermissions(requesterId, serviceInfo.getServiceName());                for (Enumeration methods = serviceInfo.enumerateServiceMethod(); methods.hasMoreElements();) {                    ServiceMethod method = (ServiceMethod) methods.nextElement();                    MethodPermission mp = permission.getMethod(method.getMethodName(), method.getParameter());                    if (mp == null) {                        // method was not found in the permissions, set authorized to false                        method.setAuthorized(false);                    } else {                        // method with this parameters was found. set authorized to true, and fill in                        // the real methodImplementation                        method.setAuthorized(true);                        method.setMethodImplementation(mp.getMethodImplementation());                        method.setNumInvokations(method.getNumInvokations());                    }                }            }            // now, assign the treaty an id number and store in the database            treaty.setTreatyID(random.nextInt());            treatyDAO.addTreaty(treaty);            // finally, return the treaty inside a SecurityManagerResponse XML document            StringWriter writer = new StringWriter();            treaty.marshal(writer);            writer.close();            return new String[] { String.valueOf(STATUS_OK), writer.toString(), String.valueOf(requesterId) };        } catch (Exception e) {            return new String[] { String.valueOf(STATUS_ERROR), e.toString() };        }    }