@Test public void testVerifySignature() throws SAML2Exception { Document doc = XMLUtils.toDOMDocument(ClassLoader.getSystemResourceAsStream(SIGNED_XML_DOCUMENT), SAML2MetaUtils.debug); SAML2MetaSecurityUtils.verifySignature(doc); }
public static void verifySignature(Document doc) throws SAML2MetaException { NodeList sigElements = null; try { Element nscontext = com.sun.org.apache.xml.internal.security.utils.XMLUtils .createDSctx (doc,"ds", Constants.SignatureSpecNS); sigElements = XPathAPI.selectNodeList(doc, " } catch (Exception ex) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:", ex); throw new SAML2MetaException(ex.getMessage()); } } int numSigs = sigElements.getLength(); if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " # of signatures = " + numSigs); } if (numSigs == 0) { return; } doc.getDocumentElement().setIdAttribute(SAML2Constants.ID, true); initializeKeyStore(); for(int i = 0; i < numSigs; i++) { Element sigElement = (Element)sigElements.item(i); String sigParentName = sigElement.getParentNode().getLocalName(); Object[] objs = { sigParentName }; if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature: " + "verifying signature under " + sigParentName); } try { XMLSignature signature = new XMLSignature(sigElement, ""); signature.addResourceResolver ( new com.sun.identity.saml.xmlsig.OfflineResolver()); KeyInfo ki = signature.getKeyInfo (); X509Certificate x509cert = null; if (ki !=null && ki.containsX509Data()) { if (keyStore != null) { StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore)); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } if (x509cert == null) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " try to find cert in KeyDescriptor"); } String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]"; Node node = XPathAPI.selectSingleNode(sigElement, xpath); if (node != null) { Element kd = (Element)node; String use = kd.getAttributeNS(null, ATTR_USE); if ((use.length() == 0) || use.equals("signing")) { NodeList nl = kd.getChildNodes(); for(int j=0; j<nl.getLength(); j++) { Node child = nl.item(j); if (child.getNodeType() == Node.ELEMENT_NODE) { String localName = child.getLocalName(); String ns = child.getNamespaceURI(); if (TAG_KEY_INFO.equals(localName)&& NS_XMLSIG.equals(ns)){ ki = new KeyInfo((Element)child, ""); if (ki.containsX509Data()) { if (keyStore != null) { KeyStoreResolver ksr = new KeyStoreResolver(keyStore); StorageResolver sr = new StorageResolver(ksr); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } } break; } } } } } if (x509cert == null) { throw new SAML2MetaException("verify_no_cert", objs); } if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) { throw new SAML2MetaException("untrusted_cert", objs); } PublicKey pk = x509cert.getPublicKey(); if (!signature.checkSignatureValue(pk)) { throw new SAML2MetaException("verify_fail", objs); } } catch (SAML2MetaException sme) { throw sme; } catch (Exception ex) { debug.error("SAML2MetaSecurityUtils.verifySignature: ", ex); throw new SAML2MetaException( Locale.getString(SAML2MetaUtils.resourceBundle, "verify_fail", objs) + "\n" + ex.getMessage()); } } }
SAML2MetaSecurityUtils { public static void verifySignature(Document doc) throws SAML2MetaException { NodeList sigElements = null; try { Element nscontext = com.sun.org.apache.xml.internal.security.utils.XMLUtils .createDSctx (doc,"ds", Constants.SignatureSpecNS); sigElements = XPathAPI.selectNodeList(doc, " } catch (Exception ex) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:", ex); throw new SAML2MetaException(ex.getMessage()); } } int numSigs = sigElements.getLength(); if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " # of signatures = " + numSigs); } if (numSigs == 0) { return; } doc.getDocumentElement().setIdAttribute(SAML2Constants.ID, true); initializeKeyStore(); for(int i = 0; i < numSigs; i++) { Element sigElement = (Element)sigElements.item(i); String sigParentName = sigElement.getParentNode().getLocalName(); Object[] objs = { sigParentName }; if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature: " + "verifying signature under " + sigParentName); } try { XMLSignature signature = new XMLSignature(sigElement, ""); signature.addResourceResolver ( new com.sun.identity.saml.xmlsig.OfflineResolver()); KeyInfo ki = signature.getKeyInfo (); X509Certificate x509cert = null; if (ki !=null && ki.containsX509Data()) { if (keyStore != null) { StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore)); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } if (x509cert == null) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " try to find cert in KeyDescriptor"); } String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]"; Node node = XPathAPI.selectSingleNode(sigElement, xpath); if (node != null) { Element kd = (Element)node; String use = kd.getAttributeNS(null, ATTR_USE); if ((use.length() == 0) || use.equals("signing")) { NodeList nl = kd.getChildNodes(); for(int j=0; j<nl.getLength(); j++) { Node child = nl.item(j); if (child.getNodeType() == Node.ELEMENT_NODE) { String localName = child.getLocalName(); String ns = child.getNamespaceURI(); if (TAG_KEY_INFO.equals(localName)&& NS_XMLSIG.equals(ns)){ ki = new KeyInfo((Element)child, ""); if (ki.containsX509Data()) { if (keyStore != null) { KeyStoreResolver ksr = new KeyStoreResolver(keyStore); StorageResolver sr = new StorageResolver(ksr); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } } break; } } } } } if (x509cert == null) { throw new SAML2MetaException("verify_no_cert", objs); } if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) { throw new SAML2MetaException("untrusted_cert", objs); } PublicKey pk = x509cert.getPublicKey(); if (!signature.checkSignatureValue(pk)) { throw new SAML2MetaException("verify_fail", objs); } } catch (SAML2MetaException sme) { throw sme; } catch (Exception ex) { debug.error("SAML2MetaSecurityUtils.verifySignature: ", ex); throw new SAML2MetaException( Locale.getString(SAML2MetaUtils.resourceBundle, "verify_fail", objs) + "\n" + ex.getMessage()); } } } }
SAML2MetaSecurityUtils { public static void verifySignature(Document doc) throws SAML2MetaException { NodeList sigElements = null; try { Element nscontext = com.sun.org.apache.xml.internal.security.utils.XMLUtils .createDSctx (doc,"ds", Constants.SignatureSpecNS); sigElements = XPathAPI.selectNodeList(doc, " } catch (Exception ex) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:", ex); throw new SAML2MetaException(ex.getMessage()); } } int numSigs = sigElements.getLength(); if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " # of signatures = " + numSigs); } if (numSigs == 0) { return; } doc.getDocumentElement().setIdAttribute(SAML2Constants.ID, true); initializeKeyStore(); for(int i = 0; i < numSigs; i++) { Element sigElement = (Element)sigElements.item(i); String sigParentName = sigElement.getParentNode().getLocalName(); Object[] objs = { sigParentName }; if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature: " + "verifying signature under " + sigParentName); } try { XMLSignature signature = new XMLSignature(sigElement, ""); signature.addResourceResolver ( new com.sun.identity.saml.xmlsig.OfflineResolver()); KeyInfo ki = signature.getKeyInfo (); X509Certificate x509cert = null; if (ki !=null && ki.containsX509Data()) { if (keyStore != null) { StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore)); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } if (x509cert == null) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " try to find cert in KeyDescriptor"); } String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]"; Node node = XPathAPI.selectSingleNode(sigElement, xpath); if (node != null) { Element kd = (Element)node; String use = kd.getAttributeNS(null, ATTR_USE); if ((use.length() == 0) || use.equals("signing")) { NodeList nl = kd.getChildNodes(); for(int j=0; j<nl.getLength(); j++) { Node child = nl.item(j); if (child.getNodeType() == Node.ELEMENT_NODE) { String localName = child.getLocalName(); String ns = child.getNamespaceURI(); if (TAG_KEY_INFO.equals(localName)&& NS_XMLSIG.equals(ns)){ ki = new KeyInfo((Element)child, ""); if (ki.containsX509Data()) { if (keyStore != null) { KeyStoreResolver ksr = new KeyStoreResolver(keyStore); StorageResolver sr = new StorageResolver(ksr); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } } break; } } } } } if (x509cert == null) { throw new SAML2MetaException("verify_no_cert", objs); } if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) { throw new SAML2MetaException("untrusted_cert", objs); } PublicKey pk = x509cert.getPublicKey(); if (!signature.checkSignatureValue(pk)) { throw new SAML2MetaException("verify_fail", objs); } } catch (SAML2MetaException sme) { throw sme; } catch (Exception ex) { debug.error("SAML2MetaSecurityUtils.verifySignature: ", ex); throw new SAML2MetaException( Locale.getString(SAML2MetaUtils.resourceBundle, "verify_fail", objs) + "\n" + ex.getMessage()); } } } private  SAML2MetaSecurityUtils(); }
SAML2MetaSecurityUtils { public static void verifySignature(Document doc) throws SAML2MetaException { NodeList sigElements = null; try { Element nscontext = com.sun.org.apache.xml.internal.security.utils.XMLUtils .createDSctx (doc,"ds", Constants.SignatureSpecNS); sigElements = XPathAPI.selectNodeList(doc, " } catch (Exception ex) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:", ex); throw new SAML2MetaException(ex.getMessage()); } } int numSigs = sigElements.getLength(); if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " # of signatures = " + numSigs); } if (numSigs == 0) { return; } doc.getDocumentElement().setIdAttribute(SAML2Constants.ID, true); initializeKeyStore(); for(int i = 0; i < numSigs; i++) { Element sigElement = (Element)sigElements.item(i); String sigParentName = sigElement.getParentNode().getLocalName(); Object[] objs = { sigParentName }; if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature: " + "verifying signature under " + sigParentName); } try { XMLSignature signature = new XMLSignature(sigElement, ""); signature.addResourceResolver ( new com.sun.identity.saml.xmlsig.OfflineResolver()); KeyInfo ki = signature.getKeyInfo (); X509Certificate x509cert = null; if (ki !=null && ki.containsX509Data()) { if (keyStore != null) { StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore)); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } if (x509cert == null) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " try to find cert in KeyDescriptor"); } String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]"; Node node = XPathAPI.selectSingleNode(sigElement, xpath); if (node != null) { Element kd = (Element)node; String use = kd.getAttributeNS(null, ATTR_USE); if ((use.length() == 0) || use.equals("signing")) { NodeList nl = kd.getChildNodes(); for(int j=0; j<nl.getLength(); j++) { Node child = nl.item(j); if (child.getNodeType() == Node.ELEMENT_NODE) { String localName = child.getLocalName(); String ns = child.getNamespaceURI(); if (TAG_KEY_INFO.equals(localName)&& NS_XMLSIG.equals(ns)){ ki = new KeyInfo((Element)child, ""); if (ki.containsX509Data()) { if (keyStore != null) { KeyStoreResolver ksr = new KeyStoreResolver(keyStore); StorageResolver sr = new StorageResolver(ksr); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } } break; } } } } } if (x509cert == null) { throw new SAML2MetaException("verify_no_cert", objs); } if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) { throw new SAML2MetaException("untrusted_cert", objs); } PublicKey pk = x509cert.getPublicKey(); if (!signature.checkSignatureValue(pk)) { throw new SAML2MetaException("verify_fail", objs); } } catch (SAML2MetaException sme) { throw sme; } catch (Exception ex) { debug.error("SAML2MetaSecurityUtils.verifySignature: ", ex); throw new SAML2MetaException( Locale.getString(SAML2MetaUtils.resourceBundle, "verify_fail", objs) + "\n" + ex.getMessage()); } } } private  SAML2MetaSecurityUtils(); static Document sign(String realm, EntityDescriptorElement descriptor); static void verifySignature(Document doc); static String formatBase64BinaryElement(String xmlstr); static String buildX509Certificate(String certAlias); static void updateProviderKeyInfo(String realm,
        String entityID, String certAlias, boolean isSigning, boolean isIDP,
        String encAlgo, int keySize); }
SAML2MetaSecurityUtils { public static void verifySignature(Document doc) throws SAML2MetaException { NodeList sigElements = null; try { Element nscontext = com.sun.org.apache.xml.internal.security.utils.XMLUtils .createDSctx (doc,"ds", Constants.SignatureSpecNS); sigElements = XPathAPI.selectNodeList(doc, " } catch (Exception ex) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:", ex); throw new SAML2MetaException(ex.getMessage()); } } int numSigs = sigElements.getLength(); if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " # of signatures = " + numSigs); } if (numSigs == 0) { return; } doc.getDocumentElement().setIdAttribute(SAML2Constants.ID, true); initializeKeyStore(); for(int i = 0; i < numSigs; i++) { Element sigElement = (Element)sigElements.item(i); String sigParentName = sigElement.getParentNode().getLocalName(); Object[] objs = { sigParentName }; if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature: " + "verifying signature under " + sigParentName); } try { XMLSignature signature = new XMLSignature(sigElement, ""); signature.addResourceResolver ( new com.sun.identity.saml.xmlsig.OfflineResolver()); KeyInfo ki = signature.getKeyInfo (); X509Certificate x509cert = null; if (ki !=null && ki.containsX509Data()) { if (keyStore != null) { StorageResolver sr = new StorageResolver(new KeyStoreResolver(keyStore)); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } if (x509cert == null) { if (debug.messageEnabled()) { debug.message("SAML2MetaSecurityUtils.verifySignature:" + " try to find cert in KeyDescriptor"); } String xpath = "following-sibling::*[local-name()=\"" + TAG_KEY_DESCRIPTOR + "\" and namespace-uri()=\"" + NS_META + "\"]"; Node node = XPathAPI.selectSingleNode(sigElement, xpath); if (node != null) { Element kd = (Element)node; String use = kd.getAttributeNS(null, ATTR_USE); if ((use.length() == 0) || use.equals("signing")) { NodeList nl = kd.getChildNodes(); for(int j=0; j<nl.getLength(); j++) { Node child = nl.item(j); if (child.getNodeType() == Node.ELEMENT_NODE) { String localName = child.getLocalName(); String ns = child.getNamespaceURI(); if (TAG_KEY_INFO.equals(localName)&& NS_XMLSIG.equals(ns)){ ki = new KeyInfo((Element)child, ""); if (ki.containsX509Data()) { if (keyStore != null) { KeyStoreResolver ksr = new KeyStoreResolver(keyStore); StorageResolver sr = new StorageResolver(ksr); ki.addStorageResolver(sr); } x509cert = ki.getX509Certificate(); } } break; } } } } } if (x509cert == null) { throw new SAML2MetaException("verify_no_cert", objs); } if (checkCert && ((keyProvider == null) || (keyProvider.getCertificateAlias(x509cert) == null))) { throw new SAML2MetaException("untrusted_cert", objs); } PublicKey pk = x509cert.getPublicKey(); if (!signature.checkSignatureValue(pk)) { throw new SAML2MetaException("verify_fail", objs); } } catch (SAML2MetaException sme) { throw sme; } catch (Exception ex) { debug.error("SAML2MetaSecurityUtils.verifySignature: ", ex); throw new SAML2MetaException( Locale.getString(SAML2MetaUtils.resourceBundle, "verify_fail", objs) + "\n" + ex.getMessage()); } } } private  SAML2MetaSecurityUtils(); static Document sign(String realm, EntityDescriptorElement descriptor); static void verifySignature(Document doc); static String formatBase64BinaryElement(String xmlstr); static String buildX509Certificate(String certAlias); static void updateProviderKeyInfo(String realm,
        String entityID, String certAlias, boolean isSigning, boolean isIDP,
        String encAlgo, int keySize); static final String NS_META; static final String NS_XMLSIG; static final String NS_XMLENC; static final String NS_MD_QUERY; static final String PREFIX_XMLSIG; static final String PREFIX_XMLENC; static final String PREFIX_MD_QUERY; static final String TAG_KEY_INFO; static final String TAG_KEY_DESCRIPTOR; static final String TAG_ENTITY_DESCRIPTOR; static final String TAG_SP_SSO_DESCRIPTOR; static final String TAG_IDP_SSO_DESCRIPTOR; static final String ATTR_USE; static final String ATTR_ID; }