public class MetadataPKIXValidationInformationResolver extends Object implements PKIXValidationInformationResolver
PKIXValidationInformationResolver
which resolves PKIXValidationInformation
based
on information stored in SAML 2 metadata. Validation information is retrieved from Shibboleth-specific metadata
extensions to EntityDescriptor
and EntitiesDescriptor
elements, represented by instances of
ShibbolethMetadataKeyAuthority
.
Resolution of trusted names for an entity is also supported, based on KeyName
information contained within
the KeyInfo
of a role descriptor's KeyDescriptor
element.Modifier and Type | Class and Description |
---|---|
protected class |
MetadataPKIXValidationInformationResolver.MetadataCacheKey
A class which serves as the key into the cache of information previously resolved.
|
protected class |
MetadataPKIXValidationInformationResolver.MetadataProviderObserver
An observer that clears the credential cache if the underlying metadata changes.
|
Modifier and Type | Field and Description |
---|---|
private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<Set<String>>> |
entityNamesCache
Cache of resolved info.
|
private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<List<PKIXValidationInformation>>> |
entityPKIXCache
Cache of resolved info.
|
private Map<Extensions,SoftReference<List<PKIXValidationInformation>>> |
extensionsCache
Cache of resolved info.
|
static int |
KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT
Default value for Shibboleth KeyAuthority verify depth.
|
private org.slf4j.Logger |
log
Class logger.
|
private MetadataProvider |
metadata
Metadata provider from which to fetch the credentials.
|
private ReadWriteLock |
rwlock
Lock used to synchronize access to the caches.
|
Constructor and Description |
---|
MetadataPKIXValidationInformationResolver(MetadataProvider metadataProvider)
Constructor.
|
Modifier and Type | Method and Description |
---|---|
protected void |
cacheExtensionsInfo(Extensions extensions,
List<PKIXValidationInformation> pkixInfo)
Adds resolved PKIX validation information to the cache.
|
protected void |
cachePKIXInfo(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey,
List<PKIXValidationInformation> pkixInfo)
Adds resolved PKIX validation information to the cache.
|
protected void |
cacheTrustedNames(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey,
Set<String> names)
Adds resolved trusted name information to the cache.
|
protected void |
checkCriteriaRequirements(CriteriaSet criteriaSet)
Check that all necessary criteria are available.
|
protected String |
getExtensionsParentName(Extensions extensions)
Get the name of the parent element of an
Extensions element in metadata, mostly
useful for logging purposes. |
protected ReadWriteLock |
getReadWriteLock()
Get the lock instance used to synchronize access to the caches.
|
protected List<RoleDescriptor> |
getRoleDescriptors(String entityID,
QName role,
String protocol)
Get the list of metadata role descriptors which match the given entityID, role and protocol.
|
protected Set<String> |
getTrustedNames(KeyInfo keyInfo)
Extract trusted names from a KeyInfo element.
|
protected List<X509Certificate> |
getX509Certificates(KeyInfo keyInfo)
Extract certificates from a KeyInfo element.
|
protected List<X509CRL> |
getX509CRLs(KeyInfo keyInfo)
Extract CRL's from a KeyInfo element.
|
protected boolean |
matchUsage(UsageType metadataUsage,
UsageType criteriaUsage)
Match usage enum type values from metadata KeyDescriptor and from specified resolution criteria.
|
Iterable<PKIXValidationInformation> |
resolve(CriteriaSet criteriaSet) |
protected List<PKIXValidationInformation> |
resolvePKIXInfo(Extensions extensions)
Retrieves validation information from the metadata extension element.
|
protected List<PKIXValidationInformation> |
resolvePKIXInfo(RoleDescriptor roleDescriptor)
Retrieves validation information from the provided role descriptor.
|
protected PKIXValidationInformation |
resolvePKIXInfo(ShibbolethMetadataKeyAuthority keyAuthority)
Retrieves validation information from the Shibboleth KeyAuthority metadata extension element.
|
PKIXValidationInformation |
resolveSingle(CriteriaSet criteriaSet) |
Set<String> |
resolveTrustedNames(CriteriaSet criteriaSet) |
protected List<PKIXValidationInformation> |
retrieveExtensionsInfoFromCache(Extensions extensions)
Retrieves pre-resolved PKIX validation information from the cache.
|
protected List<PKIXValidationInformation> |
retrievePKIXInfoFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey)
Retrieves pre-resolved PKIX validation information from the cache.
|
protected List<PKIXValidationInformation> |
retrievePKIXInfoFromMetadata(String entityID,
QName role,
String protocol,
UsageType usage)
Retrieves validation information from the provided metadata.
|
protected Set<String> |
retrieveTrustedNamesFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey)
Retrieves pre-resolved trusted names from the cache.
|
protected Set<String> |
retrieveTrustedNamesFromMetadata(String entityID,
QName role,
String protocol,
UsageType usage)
Retrieves trusted name information from the provided metadata.
|
boolean |
supportsTrustedNameResolution() |
public static final int KEY_AUTHORITY_VERIFY_DEPTH_DEFAULT
private final org.slf4j.Logger log
private MetadataProvider metadata
private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<List<PKIXValidationInformation>>> entityPKIXCache
private Map<Extensions,SoftReference<List<PKIXValidationInformation>>> extensionsCache
private Map<MetadataPKIXValidationInformationResolver.MetadataCacheKey,SoftReference<Set<String>>> entityNamesCache
private ReadWriteLock rwlock
public MetadataPKIXValidationInformationResolver(MetadataProvider metadataProvider)
metadataProvider
- provider of the metadataIllegalArgumentException
- thrown if the supplied provider is nullpublic PKIXValidationInformation resolveSingle(CriteriaSet criteriaSet) throws SecurityException
resolveSingle
in interface Resolver<PKIXValidationInformation,CriteriaSet>
SecurityException
public Iterable<PKIXValidationInformation> resolve(CriteriaSet criteriaSet) throws SecurityException
resolve
in interface Resolver<PKIXValidationInformation,CriteriaSet>
SecurityException
public Set<String> resolveTrustedNames(CriteriaSet criteriaSet) throws SecurityException, UnsupportedOperationException
resolveTrustedNames
in interface PKIXValidationInformationResolver
SecurityException
UnsupportedOperationException
public boolean supportsTrustedNameResolution()
supportsTrustedNameResolution
in interface PKIXValidationInformationResolver
protected ReadWriteLock getReadWriteLock()
protected void checkCriteriaRequirements(CriteriaSet criteriaSet)
criteriaSet
- the criteria set to evaluateprotected List<PKIXValidationInformation> retrievePKIXInfoFromMetadata(String entityID, QName role, String protocol, UsageType usage) throws SecurityException
entityID
- entity ID for which to resolve validation informationrole
- role in which the entity is operatingprotocol
- protocol over which the entity is operating (may be null)usage
- usage specifier for role descriptor key descriptors to evaluateSecurityException
- thrown if the key, certificate, or CRL information is represented in an unsupported
formatprotected List<PKIXValidationInformation> resolvePKIXInfo(RoleDescriptor roleDescriptor) throws SecurityException
roleDescriptor
- the role descriptor from which to resolve information.SecurityException
- thrown if the key, certificate, or CRL information is represented in an unsupported
formatprotected List<PKIXValidationInformation> resolvePKIXInfo(Extensions extensions) throws SecurityException
extensions
- the extension element from which to resolve informationSecurityException
- thrown if the key, certificate, or CRL information is represented in an unsupported
formatprotected PKIXValidationInformation resolvePKIXInfo(ShibbolethMetadataKeyAuthority keyAuthority) throws SecurityException
keyAuthority
- the Shibboleth KeyAuthority element from which to resolve informationSecurityException
- thrown if the key, certificate, or CRL information is represented in an unsupported
formatprotected List<X509Certificate> getX509Certificates(KeyInfo keyInfo) throws SecurityException
keyInfo
- the KeyInfo instance from which to extract certificatesSecurityException
- thrown if the certificate information is represented in an unsupported formatprotected List<X509CRL> getX509CRLs(KeyInfo keyInfo) throws SecurityException
keyInfo
- the KeyInfo instance from which to extract CRL'sSecurityException
- thrown if the CRL information is represented in an unsupported formatprotected Set<String> retrieveTrustedNamesFromMetadata(String entityID, QName role, String protocol, UsageType usage) throws SecurityException
entityID
- entity ID for which to resolve trusted namesrole
- role in which the entity is operatingprotocol
- protocol over which the entity is operating (may be null)usage
- usage specifier for role descriptor key descriptors to evaluateSecurityException
- thrown if there is an error extracting trusted name informationprotected Set<String> getTrustedNames(KeyInfo keyInfo)
keyInfo
- the KeyInfo instance from which to extract trusted namesprotected boolean matchUsage(UsageType metadataUsage, UsageType criteriaUsage)
metadataUsage
- the value from the 'use' attribute of a metadata KeyDescriptor elementcriteriaUsage
- the value from specified criteriaprotected List<RoleDescriptor> getRoleDescriptors(String entityID, QName role, String protocol) throws SecurityException
entityID
- entity ID of the metadata entity descriptor to resolverole
- role in which the entity is operatingprotocol
- protocol over which the entity is operating (may be null)SecurityException
- thrown if there is an error retrieving role descriptors from the metadata providerprotected List<PKIXValidationInformation> retrievePKIXInfoFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey)
cacheKey
- the key to the metadata cacheprotected List<PKIXValidationInformation> retrieveExtensionsInfoFromCache(Extensions extensions)
extensions
- the key to the metadata cacheprotected Set<String> retrieveTrustedNamesFromCache(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey)
cacheKey
- the key to the metadata cacheprotected void cachePKIXInfo(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey, List<PKIXValidationInformation> pkixInfo)
cacheKey
- the key for caching the informationpkixInfo
- collection of PKIX information to cacheprotected void cacheExtensionsInfo(Extensions extensions, List<PKIXValidationInformation> pkixInfo)
extensions
- the key for caching the informationpkixInfo
- collection of PKIX information to cacheprotected void cacheTrustedNames(MetadataPKIXValidationInformationResolver.MetadataCacheKey cacheKey, Set<String> names)
cacheKey
- the key for caching the informationnames
- collection of names to cacheprotected String getExtensionsParentName(Extensions extensions)
Extensions
element in metadata, mostly
useful for logging purposes.
If the parent is an EntityDescriptor, return the entityID value. If an EntitiesDescriptor,
return the name value.extensions
- the Extensions elementCopyright © 1999-2012. All Rights Reserved.