org.opensaml.xml.signature.impl

クラス BaseSignatureTrustEngine<TrustBasisType>

java.lang.Object

org.opensaml.xml.signature.impl.BaseSignatureTrustEngine<TrustBasisType>

型パラメータ:

TrustBasisType - the type of trusted information which has been resolved and which will serve as the basis for trust evaluation

すべての実装されたインタフェース:

TrustEngine<Signature>, SignatureTrustEngine

直系の既知のサブクラス:

ExplicitKeySignatureTrustEngine, PKIXSignatureTrustEngine

public abstract class BaseSignatureTrustEngine<TrustBasisType>
extends Object
implements SignatureTrustEngine

A base implementation of SignatureTrustEngine which evaluates the validity and trustworthiness of XML and raw signatures.

When processing XML signatures, the supplied KeyInfoCredentialResolver will be used to resolve credential(s) containing the (advisory) signing key from the KeyInfo element of the Signature, if present. If any of these credentials do contain the valid signing key, they will be evaluated for trustworthiness against trusted information, which will be resolved in an implementation-specific manner.

Subclasses are required to implement evaluateTrust(Credential, Object) using an implementation-specific trust model.

コンストラクタの概要

コンストラクタ

コンストラクタと説明
BaseSignatureTrustEngine(KeyInfoCredentialResolver keyInfoResolver) Constructor.

メソッドの概要

メソッド

修飾子とタイプ	メソッドと説明
protected void	checkParams(Signature signature, CriteriaSet trustBasisCriteria) Check the signature and credential criteria for required values.
protected void	checkParamsRaw(byte[] signature, byte[] content, String algorithmURI, CriteriaSet trustBasisCriteria) Check the signature and credential criteria for required values.
protected abstract boolean	evaluateTrust(Credential untrustedCredential, TrustBasisType trustBasis) Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.
KeyInfoCredentialResolver	getKeyInfoResolver() Get the KeyInfoCredentialResolver instance used to resolve (advisory) signing credential information from KeyInfo elements contained within a Signature element.
protected boolean	validate(Signature signature, TrustBasisType trustBasis) Attempt to establish trust by resolving signature verification credentials from the Signature's KeyInfo.
protected boolean	verifySignature(Signature signature, Credential credential) Attempt to verify a signature using the key from the supplied credential.

クラスから継承されたメソッド java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

インタフェースから継承されたメソッド org.opensaml.xml.signature.SignatureTrustEngine

validate

インタフェースから継承されたメソッド org.opensaml.xml.security.trust.TrustEngine

validate

コンストラクタの詳細

BaseSignatureTrustEngine

public BaseSignatureTrustEngine(KeyInfoCredentialResolver keyInfoResolver)

Constructor.

パラメータ:

keyInfoResolver - KeyInfo credential resolver used to obtain the (advisory) signing credential from a Signature's KeyInfo element.

メソッドの詳細

getKeyInfoResolver

public KeyInfoCredentialResolver getKeyInfoResolver()

Get the KeyInfoCredentialResolver instance used to resolve (advisory) signing credential information from KeyInfo elements contained within a Signature element. Note that credential(s) obtained via this resolver are not themselves trusted. They must be evaluated against the trusted credential information obtained from the trusted credential resolver.

定義:

getKeyInfoResolver インタフェース内 SignatureTrustEngine

戻り値:

a KeyInfoCredentialResolver instance

validate

protected boolean validate(Signature signature,
               TrustBasisType trustBasis)
                    throws SecurityException

Attempt to establish trust by resolving signature verification credentials from the Signature's KeyInfo. If any credentials so resolved correctly verify the signature, attempt to establish trust using subclass-specific trust logic against trusted information as implemented in evaluateTrust(Credential, Object).

パラメータ:

signature - the Signature to evaluate

trustBasis - the information which serves as the basis for trust evaluation

戻り値:

true if the signature is verified by any KeyInfo-derived credential which can be established as trusted, otherwise false

例外:

SecurityException - if an error occurs during signature verification or trust processing

evaluateTrust

protected abstract boolean evaluateTrust(Credential untrustedCredential,
                    TrustBasisType trustBasis)
                                  throws SecurityException

Evaluate the untrusted KeyInfo-derived credential with respect to the specified trusted information.

パラメータ:

untrustedCredential - the untrusted credential being evaluated

trustBasis - the information which serves as the basis for trust evaluation

戻り値:

true if the trust can be established for the untrusted credential, otherwise false

例外:

SecurityException - if an error occurs during trust processing

verifySignature

protected boolean verifySignature(Signature signature,
                      Credential credential)

Attempt to verify a signature using the key from the supplied credential.

パラメータ:

signature - the signature on which to attempt verification

credential - the credential containing the candidate validation key

戻り値:

true if the signature can be verified using the key from the credential, otherwise false

checkParams

protected void checkParams(Signature signature,
               CriteriaSet trustBasisCriteria)
                    throws SecurityException

Check the signature and credential criteria for required values.

パラメータ:

signature - the signature to be evaluated

trustBasisCriteria - the set of trusted credential criteria

例外:

SecurityException - thrown if required values are absent or otherwise invalid

checkParamsRaw

protected void checkParamsRaw(byte[] signature,
                  byte[] content,
                  String algorithmURI,
                  CriteriaSet trustBasisCriteria)
                       throws SecurityException

Check the signature and credential criteria for required values.

パラメータ:

signature - the signature to be evaluated

content - the data over which the signature was computed

algorithmURI - the signing algorithm URI which was used

trustBasisCriteria - the set of trusted credential criteria

例外:

SecurityException - thrown if required values are absent or otherwise invalid