Package org.opensaml.security.x509.impl
Class PKIXX509CredentialTrustEngine
- java.lang.Object
-
- org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine
-
- All Implemented Interfaces:
TrustEngine<X509Credential>,PKIXTrustEngine<X509Credential>
public class PKIXX509CredentialTrustEngine extends Object implements PKIXTrustEngine<X509Credential>
Trust engine implementation which evaluates anX509Credentialtoken based on PKIX validation processing using validation information from a trusted source.
-
-
Field Summary
Fields Modifier and Type Field Description private X509CredentialNameEvaluatorcredNameEvaluatorThe external credential name evaluator used to establish trusted name compliance.private org.slf4j.LoggerlogClass logger.private PKIXValidationInformationResolverpkixResolverResolver used for resolving trusted credentials.private PKIXTrustEvaluatorpkixTrustEvaluatorThe external PKIX trust evaluator used to establish trust.
-
Constructor Summary
Constructors Constructor Description PKIXX509CredentialTrustEngine(PKIXValidationInformationResolver resolver)Constructor.PKIXX509CredentialTrustEngine(PKIXValidationInformationResolver resolver, X509CredentialNameEvaluator nameEvaluator)Constructor.PKIXX509CredentialTrustEngine(PKIXValidationInformationResolver resolver, PKIXTrustEvaluator pkixEvaluator, X509CredentialNameEvaluator nameEvaluator)Constructor.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected booleancheckNames(Set<String> trustedNames, X509Credential untrustedCredential)Evaluate the credential against the set of trusted names.PKIXValidationInformationResolvergetPKIXResolver()PKIXTrustEvaluatorgetPKIXTrustEvaluator()Get thePKIXTrustEvaluatorinstance used to evaluate trust.X509CredentialNameEvaluatorgetX509CredentialNameEvaluator()Get theX509CredentialNameEvaluatorinstance used to evaluate a credential against trusted names.protected booleanvalidate(X509Credential untrustedX509Credential, Set<String> trustedNames, Iterable<PKIXValidationInformation> validationInfoSet)Perform PKIX validation on the untrusted credential, using PKIX validation information based on the supplied set of trusted credentials.booleanvalidate(X509Credential untrustedCredential, CriteriaSet trustBasisCriteria)
-
-
-
Field Detail
-
log
private final org.slf4j.Logger log
Class logger.
-
pkixResolver
private final PKIXValidationInformationResolver pkixResolver
Resolver used for resolving trusted credentials.
-
pkixTrustEvaluator
private final PKIXTrustEvaluator pkixTrustEvaluator
The external PKIX trust evaluator used to establish trust.
-
credNameEvaluator
private final X509CredentialNameEvaluator credNameEvaluator
The external credential name evaluator used to establish trusted name compliance.
-
-
Constructor Detail
-
PKIXX509CredentialTrustEngine
public PKIXX509CredentialTrustEngine(@Nonnull @ParameterName(name="resolver") PKIXValidationInformationResolver resolver)
Constructor.The PKIX trust evaluator used defaults to
CertPathPKIXTrustEvaluator.The X.509 credential name evaluator used defaults to
BasicX509CredentialNameEvaluator.- Parameters:
resolver- credential resolver used to resolve trusted credentials
-
PKIXX509CredentialTrustEngine
public PKIXX509CredentialTrustEngine(@Nonnull @ParameterName(name="resolver") PKIXValidationInformationResolver resolver, @Nullable @ParameterName(name="nameEvaluator") X509CredentialNameEvaluator nameEvaluator)
Constructor.- Parameters:
resolver- credential resolver used to resolve trusted credentialsnameEvaluator- the X.509 credential name evaluator to use (may be null)
-
PKIXX509CredentialTrustEngine
public PKIXX509CredentialTrustEngine(@Nonnull @ParameterName(name="resolver") PKIXValidationInformationResolver resolver, @Nonnull @ParameterName(name="pkixEvaluator") PKIXTrustEvaluator pkixEvaluator, @Nullable @ParameterName(name="nameEvaluator") X509CredentialNameEvaluator nameEvaluator)
Constructor.- Parameters:
resolver- credential resolver used to resolve trusted credentialspkixEvaluator- the PKIX trust evaluator to usenameEvaluator- the X.509 credential name evaluator to use (may be null)
-
-
Method Detail
-
getPKIXResolver
@Nonnull public PKIXValidationInformationResolver getPKIXResolver()
- Specified by:
getPKIXResolverin interfacePKIXTrustEngine<X509Credential>
-
getPKIXTrustEvaluator
@Nonnull public PKIXTrustEvaluator getPKIXTrustEvaluator()
Get thePKIXTrustEvaluatorinstance used to evaluate trust.The parameters of this evaluator may be modified to adjust trust evaluation processing.
- Returns:
- the PKIX trust evaluator instance that will be used
-
getX509CredentialNameEvaluator
@Nullable public X509CredentialNameEvaluator getX509CredentialNameEvaluator()
Get theX509CredentialNameEvaluatorinstance used to evaluate a credential against trusted names.The parameters of this evaluator may be modified to adjust trust evaluation processing.
- Returns:
- the PKIX trust evaluator instance that will be used
-
validate
public boolean validate(@Nonnull X509Credential untrustedCredential, @Nullable CriteriaSet trustBasisCriteria) throws SecurityException- Specified by:
validatein interfaceTrustEngine<X509Credential>- Throws:
SecurityException
-
validate
protected boolean validate(@Nonnull X509Credential untrustedX509Credential, @Nullable Set<String> trustedNames, @Nonnull Iterable<PKIXValidationInformation> validationInfoSet) throws SecurityExceptionPerform PKIX validation on the untrusted credential, using PKIX validation information based on the supplied set of trusted credentials.- Parameters:
untrustedX509Credential- the credential to evaluatetrustedNames- the set of trusted names for name checking purposesvalidationInfoSet- the set of validation information which serves as the basis for trust evaluation- Returns:
- true if PKIX validation of the untrusted credential is successful, otherwise false
- Throws:
SecurityException- thrown if there is an error validating the untrusted credential against trusted names or validation information
-
checkNames
protected boolean checkNames(@Nullable Set<String> trustedNames, @Nonnull X509Credential untrustedCredential) throws SecurityExceptionEvaluate the credential against the set of trusted names.Evaluates to true if no instance of
X509CredentialNameEvaluatoris configured.- Parameters:
trustedNames- set of trusted namesuntrustedCredential- the credential being evaluated- Returns:
- true if evaluation is successful, false otherwise
- Throws:
SecurityException- thrown if there is an error evaluation the credential
-
-