Decrypter (Shibboleth Identity Provider 2.3.0 API)

java.lang.Object
- org.opensaml.xml.encryption.Decrypter

直系の既知のサブクラス:

Decrypter
```
public class Decrypter
extends Object
```
Supports decryption of XMLObjects which represent data encrypted according to the XML Encryption specification, version 20021210.
Details on the components specified as constructor options are as follows:
1. newResolver: This KeyInfoCredentialResolver instance is used to resolve keys (as Credentials) based on the KeyInfo of EncryptedData elements. While it could in theory be used to handle the complete process of resolving the data decryption key, including decrypting any necessary EncryptedKey's, it would typically be used in cases where encrypted key transport via an EncryptedKey is not being employed. This corresponds to scenarios where decryption is instead based on resolving the (presumably shared secret) symmetric data decryption key directly, based on either context or information present in the EncryptedData's KeyInfo. In cases where the data decryption key is to be resolved by decrypting an EncryptedKey, this resolver would typically not be used and may be null.
2. newKEKResolver: This KeyInfoCredentialResolver instance is used to resolve keys (as Credentials) used to decrypt EncryptedKey elements, based on the KeyInfo information contained within the EncryptedKey element (also known as a Key Encryption Key or KEK). For asymmetric key transport of encrypted keys, this would entail resolving the private key which corresponds to the public key which was used to encrypt the EncryptedKey.
3. newEncKeyResolver: This EncryptedKeyResolver instance is responsible for resolving the EncryptedKey element(s) which hold(s) the encrypted data decryption key which would be used to decrypt an EncryptedData element.
XML Encryption can encrypt either a single Element or the contents of an Element. The caller of this class must select the decryption method which is most appropriate for their specific use case.

Note that the type of plaintext data contained by an EncryptedData can be checked prior to decryption by examining that element's type attribute (EncryptedType.getType()). This (optional) attribute may contain one of the following two constant values to aid in the decryption process: EncryptionConstants.TYPE_ELEMENT or EncryptionConstants.TYPE_CONTENT.

By nature the fundamental output of XML decryption is a DOM DocumentFragment with 1 or more immediate top-level DOM Node children. This case is reflected in the method decryptDataToDOM(EncryptedData). It is up to the caller to properly process the DOM Nodes which are the children of this document fragment. The DocumentFragment and its Node children will be owned by the DOM Document which owned the original EncryptedData before decryption. Note, however, that the Node children will not be a part of the tree of Nodes rooted at that Document's document element.

A typical use case will be that the content which was encrypted contained solely Element nodes. For this use case a convenience method is provided as decryptDataToList(EncryptedData), which returns a list of XMLObject's which are the result of unmarshalling each of the child Elements of the decrypted DocumentFragment.

Another typical use case is that the content which was encrypted was a single Element. For this use case a convenience method is provided as decryptData(EncryptedData), which returns a single XMLObject which was the result of unmarshalling this decrypted Element.

In both of these cases the underlying DOM Element which is represented by each of the returned XMLObjects will be owned by the DOM Document which also owns the original EncrytpedData Element. However, note that these cached DOM Elements are not part of the tree of Nodes rooted at that Document's document element. If these returned XMLObjects are then inserted as the children of other XMLObjects, it is up to the caller to ensure that the XMLObject tree is then remarshalled if the relationship of the cached DOM nodes is important (e.g. resolution of ID-typed attributes via Document.getElementById(String)).

For some use cases where the returned XMLObjects will not necessarily be stored back as children of another parent XMLObject, it may still necessary for the DOM Elements of the resultant XMLObjects to exist within the tree of Nodes rooted at a DOM Document's document element (e.g. signature verification on the standalone decrypted XMLObject). For these cases these method variants may be used: decryptDataToList(EncryptedData, boolean) and decryptData(EncryptedData, boolean). The rootInNewDocument parameter is explained below. A default value for this parameter, for the overloaded convenience methods which do not take this parameter explicitly, may be set via setRootInNewDocument(boolean). This default value is initialized to false.

If the boolean option rootInNewDocument is true at the time of decryption, then for each top-level child Element of the decrypted DocumentFragment, the following will occur:
1. A new DOM Document will be created.
2. The Element will be adopted into that Document.
3. The Element will be made the root element of the Document.
4. The Element will be unmarshalled into an XMLObject as in the single argument variant.
Note that new Document creation, node adoption and rooting the new document element are potentially very expensive. This should only be done where the caller's use case really requires it.

コンストラクタの概要

コンストラクタ
コンストラクタと説明
`Decrypter(KeyInfoCredentialResolver newResolver, KeyInfoCredentialResolver newKEKResolver, EncryptedKeyResolver newEncKeyResolver)` Constructor.

メソッドの概要

メソッド
修飾子とタイプ	メソッドと説明
`protected void`	`checkAndMarshall(XMLObject xmlObject)` Ensure that the XMLObject is marshalled.
`XMLObject`	`decryptData(EncryptedData encryptedData)` This is a convenience method for calling `decryptData(EncryptedData, boolean)`, with the `rootInNewDocument` parameter value supplied by `isRootInNewDocument()`.
`XMLObject`	`decryptData(EncryptedData encryptedData, boolean rootInNewDocument)` Decrypts the supplied EncryptedData and returns the resulting XMLObject.
`DocumentFragment`	`decryptDataToDOM(EncryptedData encryptedData)` Decrypts the supplied EncryptedData and returns the resulting DOM `DocumentFragment`.
`DocumentFragment`	`decryptDataToDOM(EncryptedData encryptedData, Key dataEncKey)` Decrypts the supplied EncryptedData using the specified key, and returns the resulting DOM `DocumentFragment`.
`List<XMLObject>`	`decryptDataToList(EncryptedData encryptedData)` This is a convenience method for calling `decryptDataToList(EncryptedData, boolean)`, with the `rootInNewDocument` parameter value supplied by `isRootInNewDocument()`.
`List<XMLObject>`	`decryptDataToList(EncryptedData encryptedData, boolean rootInNewDocument)` Decrypts the supplied EncryptedData and returns the resulting list of XMLObjects.
`Key`	`decryptKey(EncryptedKey encryptedKey, String algorithm)` Attempts to decrypt the supplied EncryptedKey and returns the resulting Java security Key object.
`Key`	`decryptKey(EncryptedKey encryptedKey, String algorithm, Key kek)` Decrypts the supplied EncryptedKey and returns the resulting Java security Key object.
`EncryptedKeyResolver`	`getEncryptedKeyResolver()` Get the encrypted key resolver.
`String`	`getJCAProviderName()` Get the Java Cryptography Architecture (JCA) security provider name that should be used to provide the decryption support.
`KeyInfoCredentialResolver`	`getKEKResolver()` Get the key encryption key credential resolver.
`CriteriaSet`	`getKEKResolverCriteria()` Get the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedKey element.
`KeyInfoCredentialResolver`	`getKeyResolver()` Get the data encryption key credential resolver.
`boolean`	`isRootInNewDocument()` Get the flag which indicates whether by default the DOM Element which backs a decrypted SAML object will be the root of a new DOM document.
`protected void`	`preProcessEncryptedKey(EncryptedKey encryptedKey, String algorithm, Key kek)` Preprocess the EncryptedKey.
`void`	`setEncryptedKeyResolver(EncryptedKeyResolver newResolver)` Set a new encrypted key resolver.
`void`	`setJCAProviderName(String providerName)` Set the Java Cryptography Architecture (JCA) security provider name that should be used to provide the decryption support.
`void`	`setKEKResolver(KeyInfoCredentialResolver newKEKResolver)` Set a new key encryption key credential resolver.
`void`	`setKEKResolverCriteria(CriteriaSet newCriteria)` Set the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedKey element.
`void`	`setKeyResolver(KeyInfoCredentialResolver newResolver)` Set a new data encryption key credential resolver.
`CriteriaSet`	`setKeyResolverCriteria()` Get the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedData element.
`void`	`setKeyResolverCriteria(CriteriaSet newCriteria)` Set the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedData element.
`void`	`setRootInNewDocument(boolean flag)` Set the flag which indicates whether by default the DOM Element which backs a decrypted SAML object will be the root of a new DOM document.

クラスから継承されたメソッド java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- コンストラクタの詳細
  - Decrypter
```
public Decrypter(KeyInfoCredentialResolver newResolver,
         KeyInfoCredentialResolver newKEKResolver,
         EncryptedKeyResolver newEncKeyResolver)
```
    Constructor.
    
    パラメータ:
    newResolver - resolver for data encryption keys.
    newKEKResolver - resolver for key encryption keys.
    newEncKeyResolver - resolver for EncryptedKey elements
- メソッドの詳細
  - isRootInNewDocument
```
public boolean isRootInNewDocument()
```
    Get the flag which indicates whether by default the DOM Element which backs a decrypted SAML object will be the root of a new DOM document. Defaults to false.
    
    戻り値:
    the current value of the flag for this decrypter instance
  - setRootInNewDocument
```
public void setRootInNewDocument(boolean flag)
```
    Set the flag which indicates whether by default the DOM Element which backs a decrypted SAML object will be the root of a new DOM document. Defaults to false.
    
    パラメータ:
    flag - the current value of the flag for this decrypter instance
  - getJCAProviderName
```
public String getJCAProviderName()
```
    Get the Java Cryptography Architecture (JCA) security provider name that should be used to provide the decryption support. Defaults to null, which means that the first registered provider which supports the indicated encryption algorithm URI will be used.
    
    戻り値:
    the JCA provider name to use
  - setJCAProviderName
```
public void setJCAProviderName(String providerName)
```
    Set the Java Cryptography Architecture (JCA) security provider name that should be used to provide the decryption support. Defaults to null, which means that the first registered provider which supports the indicated encryption algorithm URI will be used.
    
    パラメータ:
    providerName - the JCA provider name to use
  - getKeyResolver
```
public KeyInfoCredentialResolver getKeyResolver()
```
    Get the data encryption key credential resolver.
    
    戻り値:
    the data encryption key resolver
  - setKeyResolver
```
public void setKeyResolver(KeyInfoCredentialResolver newResolver)
```
    Set a new data encryption key credential resolver.
    
    パラメータ:
    newResolver - the new data encryption key resolver
  - getKEKResolver
```
public KeyInfoCredentialResolver getKEKResolver()
```
    Get the key encryption key credential resolver.
    
    戻り値:
    the key encryption key resolver
  - setKEKResolver
```
public void setKEKResolver(KeyInfoCredentialResolver newKEKResolver)
```
    Set a new key encryption key credential resolver.
    
    パラメータ:
    newKEKResolver - the new key encryption key resolver
  - getEncryptedKeyResolver
```
public EncryptedKeyResolver getEncryptedKeyResolver()
```
    Get the encrypted key resolver.
    
    戻り値:
    the encrypted key resolver
  - setEncryptedKeyResolver
```
public void setEncryptedKeyResolver(EncryptedKeyResolver newResolver)
```
    Set a new encrypted key resolver.
    
    パラメータ:
    newResolver - the new encrypted key resolver
  - setKeyResolverCriteria
```
public CriteriaSet setKeyResolverCriteria()
```
    Get the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedData element.
    
    戻り値:
    the static criteria set to use
  - setKeyResolverCriteria
```
public void setKeyResolverCriteria(CriteriaSet newCriteria)
```
    Set the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedData element.
    
    パラメータ:
    newCriteria - the static criteria set to use
  - getKEKResolverCriteria
```
public CriteriaSet getKEKResolverCriteria()
```
    Get the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedKey element.
    
    戻り値:
    the static criteria set to use
  - setKEKResolverCriteria
```
public void setKEKResolverCriteria(CriteriaSet newCriteria)
```
    Set the optional static set of criteria used when resolving credentials based on the KeyInfo of an EncryptedKey element.
    
    パラメータ:
    newCriteria - the static criteria set to use
  - decryptData
```
public XMLObject decryptData(EncryptedData encryptedData)
                      throws DecryptionException
```
    This is a convenience method for calling decryptData(EncryptedData, boolean), with the rootInNewDocument parameter value supplied by isRootInNewDocument().
    
    パラメータ:
    encryptedData - encrypted data element containing the data to be decrypted
    
    戻り値:
    the decrypted XMLObject
    
    例外:
    
    DecryptionException - exception indicating a decryption error, possibly because the decrypted data contained more than one top-level Element, or some non-Element Node type.
  - decryptData
```
public XMLObject decryptData(EncryptedData encryptedData,
                    boolean rootInNewDocument)
                      throws DecryptionException
```
    Decrypts the supplied EncryptedData and returns the resulting XMLObject. This will only succeed if the decrypted EncryptedData contains exactly one DOM Node of type Element.
    
    パラメータ:
    encryptedData - encrypted data element containing the data to be decrypted
    rootInNewDocument - if true, root the underlying Element of the returned XMLObject in a new Document as described in Decrypter
    
    戻り値:
    the decrypted XMLObject
    
    例外:
    
    DecryptionException - exception indicating a decryption error, possibly because the decrypted data contained more than one top-level Element, or some non-Element Node type.
  - decryptDataToList
```
public List<XMLObject> decryptDataToList(EncryptedData encryptedData)
                                  throws DecryptionException
```
    This is a convenience method for calling decryptDataToList(EncryptedData, boolean), with the rootInNewDocument parameter value supplied by isRootInNewDocument().
    
    パラメータ:
    encryptedData - encrypted data element containing the data to be decrypted
    
    戻り値:
    the list decrypted top-level XMLObjects
    
    例外:
    
    DecryptionException - exception indicating a decryption error, possibly because the decrypted data contained DOM nodes other than type of Element
  - decryptDataToList
```
public List<XMLObject> decryptDataToList(EncryptedData encryptedData,
                                boolean rootInNewDocument)
                                  throws DecryptionException
```
    Decrypts the supplied EncryptedData and returns the resulting list of XMLObjects. This will succeed only if the decrypted EncryptedData contains at the top-level only DOM Elements (not other types of DOM Nodes).
    
    パラメータ:
    encryptedData - encrypted data element containing the data to be decrypted
    rootInNewDocument - if true, root the underlying Elements of the returned XMLObjects in a new Document as described in Decrypter
    
    戻り値:
    the list decrypted top-level XMLObjects
    
    例外:
    
    DecryptionException - exception indicating a decryption error, possibly because the decrypted data contained DOM nodes other than type of Element
  - decryptDataToDOM
```
public DocumentFragment decryptDataToDOM(EncryptedData encryptedData)
                                  throws DecryptionException
```
    Decrypts the supplied EncryptedData and returns the resulting DOM DocumentFragment.
    
    パラメータ:
    encryptedData - encrypted data element containing the data to be decrypted
    
    戻り値:
    the decrypted DOM DocumentFragment
    
    例外:
    
    DecryptionException - exception indicating a decryption error
  - decryptDataToDOM
```
public DocumentFragment decryptDataToDOM(EncryptedData encryptedData,
                                Key dataEncKey)
                                  throws DecryptionException
```
    Decrypts the supplied EncryptedData using the specified key, and returns the resulting DOM DocumentFragment.
    
    パラメータ:
    encryptedData - encrypted data element containing the data to be decrypted
    dataEncKey - Java Key with which to attempt decryption of the encrypted data
    
    戻り値:
    the decrypted DOM DocumentFragment
    
    例外:
    
    DecryptionException - exception indicating a decryption error
  - decryptKey
```
public Key decryptKey(EncryptedKey encryptedKey,
             String algorithm)
               throws DecryptionException
```
    Attempts to decrypt the supplied EncryptedKey and returns the resulting Java security Key object. The algorithm of the decrypted key must be supplied by the caller based on knowledge of the associated EncryptedData information.
    
    パラメータ:
    encryptedKey - encrypted key element containing the encrypted key to be decrypted
    algorithm - the algorithm associated with the decrypted key
    
    戻り値:
    the decrypted key
    
    例外:
    
    DecryptionException - exception indicating a decryption error
  - decryptKey
```
public Key decryptKey(EncryptedKey encryptedKey,
             String algorithm,
             Key kek)
               throws DecryptionException
```
    Decrypts the supplied EncryptedKey and returns the resulting Java security Key object. The algorithm of the decrypted key must be supplied by the caller based on knowledge of the associated EncryptedData information.
    
    パラメータ:
    encryptedKey - encrypted key element containing the encrypted key to be decrypted
    algorithm - the algorithm associated with the decrypted key
    kek - the key encryption key with which to attempt decryption of the encrypted key
    
    戻り値:
    the decrypted key
    
    例外:
    
    DecryptionException - exception indicating a decryption error
  - preProcessEncryptedKey
```
protected void preProcessEncryptedKey(EncryptedKey encryptedKey,
                          String algorithm,
                          Key kek)
                               throws DecryptionException
```
    Preprocess the EncryptedKey. For example, check for supported algorithms.
    
    パラメータ:
    encryptedKey - encrypted key element containing the encrypted key to be decrypted
    algorithm - the algorithm associated with the decrypted key
    kek - the key encryption key with which to attempt decryption of the encrypted key
    
    例外:
    
    DecryptionException - exception indicating a decryption error
  - checkAndMarshall
```
protected void checkAndMarshall(XMLObject xmlObject)
                         throws DecryptionException
```
    Ensure that the XMLObject is marshalled.
    
    パラメータ:
    xmlObject - the object to check and marshall
    
    例外:
    
    DecryptionException - thrown if there is an error when marshalling the XMLObject

クラス Decrypter

コンストラクタの概要

メソッドの概要

クラスから継承されたメソッド java.lang.Object

コンストラクタの詳細

Decrypter

メソッドの詳細

isRootInNewDocument

setRootInNewDocument

getJCAProviderName

setJCAProviderName

getKeyResolver

setKeyResolver

getKEKResolver

setKEKResolver

getEncryptedKeyResolver

setEncryptedKeyResolver

setKeyResolverCriteria

setKeyResolverCriteria

getKEKResolverCriteria

setKEKResolverCriteria

decryptData

decryptData

decryptDataToList

decryptDataToList

decryptDataToDOM

decryptDataToDOM

decryptKey

decryptKey

preProcessEncryptedKey

checkAndMarshall