Package org.opensaml.saml.common.binding.security.impl

# Class BaseSAMLSimpleSignatureSecurityHandler

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
org.opensaml.messaging.handler.AbstractMessageHandler
org.opensaml.messaging.handler.AbstractHttpServletRequestMessageHandler
org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler

All Implemented Interfaces:
  `Component`, `DestructableComponent`, `InitializableComponent`, `MessageHandler`

Direct Known Subclasses:
  `SAML2HTTPPostSimpleSignSecurityHandler`, `SAML2HTTPRedirectDeflateSignatureSecurityHandler`

public abstract class BaseSAMLSimpleSignatureSecurityHandler extends AbstractHttpServletRequestMessageHandler
Base class for security-oriented message handlers which verify simple "blob" signatures computed over some components of a request.

## Field Summary

Fields
Modifier and Type
Field
Description
`private final org.slf4j.Logger`
`log`
Logger.
`private SAMLPeerEntityContext`
`peerContext`
The context representing the SAML peer entity.
`private String`
`samlProtocol`
The SAML protocol in use.
`private QName`
`samlRole`
The SAML role in use.
`private SignatureValidationParameters`
`signatureValidationParameters`
Parameters for signature validation.
`private SignatureTrustEngine`
`trustEngine`
Signature trust engine used to validate raw signatures.

## Constructor Summary

Constructors
Constructor
Description
`BaseSAMLSimpleSignatureSecurityHandler()`

## Method Summary

Modifier and Type
Method
Description
`protected CriteriaSet`
`buildCriteriaSet(String entityID, MessageContext messageContext)`
Build a criteria set suitable for input to the trust engine.
`protected String`
`deriveSignerEntityID(MessageContext messageContext)`
Derive the signer's entity ID from the message context.
`private void`
`doEvaluate(byte[] signature, byte[] signedContent, String algorithmURI, MessageContext messageContext)`
Evaluate the simple signature based on information in the request and/or message context.
`protected void`
`doInvoke(MessageContext messageContext)`
Performs the handler logic.
`protected boolean`
`doPreInvoke(MessageContext messageContext)`
Called prior to execution, handlers may override this method to perform pre-processing for a request.
`protected List<Credential>`
`getRequestCredentials(MessageContext messageContext)`
Extract any candidate validation credentials from the request and/or message context.
`protected byte[]`
`getSignature()`
Extract the signature value from the request, in the form suitable for input into `SignatureTrustEngine.validate(byte[], byte[], String, CriteriaSet, Credential)`.
`protected String`
`getSignatureAlgorithm()`
Extract the signature algorithm URI value from the request.
`protected byte[]`
`getSignedContent(MessageContext messageContext)`
Get the content over which to validate the signature, in the form suitable for input into `SignatureTrustEngine.validate(byte[], byte[], String, CriteriaSet, Credential)`.
`protected SignatureTrustEngine`
`getTrustEngine()`
Gets the engine used to validate the signature.
`protected abstract boolean`
`ruleHandles(MessageContext messageContext)`
Determine whether the rule should handle the request, based on the unwrapped HTTP servlet request and/or message context.
`protected boolean`
`validateSignature(byte[] signature, byte[] signedContent, String algorithmURI, CriteriaSet criteriaSet, List<Credential> candidateCredentials)`
Validate the simple signature.

### Methods inherited from class org.opensaml.messaging.handler.AbstractHttpServletRequestMessageHandler

`doInitialize, getHttpServletRequest, getHttpServletRequestSupplier, isCheckDuringInit, setCheckDuringInit, setHttpServletRequestSupplier`

### Methods inherited from class org.opensaml.messaging.handler.AbstractMessageHandler

`doPostInvoke, doPostInvoke, getActivationCondition, getLogPrefix, invoke, isPreInvokeCalled, setActivationCondition`

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

`initialize, isInitialized`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Logger.

### peerContext

@Nullable private SAMLPeerEntityContext peerContext
The context representing the SAML peer entity.

### samlProtocol

@Nullable private String samlProtocol
The SAML protocol in use.

### samlRole

@Nullable private QName samlRole
The SAML role in use.

### signatureValidationParameters

@Nullable private SignatureValidationParameters signatureValidationParameters
Parameters for signature validation.

### trustEngine

@Nullable private SignatureTrustEngine trustEngine
Signature trust engine used to validate raw signatures.

## Constructor Details

### BaseSAMLSimpleSignatureSecurityHandler

public BaseSAMLSimpleSignatureSecurityHandler()

## Method Details

### getTrustEngine

@Nullable protected SignatureTrustEngine getTrustEngine()
Gets the engine used to validate the signature.

Returns:
  engine engine used to validate the signature

### doPreInvoke

protected boolean doPreInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
Called prior to execution, handlers may override this method to perform pre-processing for a request.

The default impl applies the `Predicate` set via the `AbstractMessageHandler.setActivationCondition(Predicate)`.

If false is returned, execution will not proceed.

Subclasses which override this method should generally invoke the super version of this method first, so that the activation condition will be applied up front, and immediately return false if the super version returns false. This avoids unnecessary execution of the remaining pre-invocation code if the handler ultimately will not execute.

Overrides:
  `doPreInvoke` in class `AbstractMessageHandler`
Parameters:
  `messageContext` - the message context on which to invoke the handler
Returns:
  true iff execution should proceed
Throws:
  `MessageHandlerException` - if there is a problem executing the handler pre-routine

### doInvoke

protected void doInvoke(@Nonnull MessageContext messageContext) throws MessageHandlerException
Performs the handler logic.

Specified by:
  `doInvoke` in class `AbstractMessageHandler`
Parameters:
  `messageContext` - the message context on which to invoke the handler
Throws:
  `MessageHandlerException` - if there is an error invoking the handler on the message context

### doEvaluate

private void doEvaluate(@Nonnull @NotEmpty byte[] signature, @Nonnull @NotEmpty byte[] signedContent, @Nonnull @NotEmpty String algorithmURI, @Nonnull MessageContext messageContext) throws MessageHandlerException
Evaluate the simple signature based on information in the request and/or message context.

Parameters:
  `signature` - the signature value
  `signedContent` - the content that was signed
  `algorithmURI` - the signature algorithm URI which was used to sign the content
  `messageContext` - the SAML message context being processed
Throws:
  `MessageHandlerException` - thrown if there are errors during the signature validation process

### validateSignature

protected boolean validateSignature(@Nonnull @NotEmpty byte[] signature, @Nonnull @NotEmpty byte[] signedContent, @Nonnull @NotEmpty String algorithmURI, @Nonnull CriteriaSet criteriaSet, @Nonnull List<Credential> candidateCredentials) throws MessageHandlerException
Validate the simple signature.

Parameters:
  `signature` - the signature value
  `signedContent` - the content that was signed
  `algorithmURI` - the signature algorithm URI which was used to sign the content
  `criteriaSet` - criteria used to describe and/or resolve the information which serves as the basis for trust evaluation
  `candidateCredentials` - the request-derived candidate credential(s) containing the validation key for the signature (optional)
Returns:
  true if signature can be verified successfully, false otherwise
Throws:
  `MessageHandlerException` - thrown if there are errors during the signature validation process

### getRequestCredentials

@Nonnull @Unmodifiable @NotLive protected List<Credential> getRequestCredentials(@Nonnull MessageContext messageContext) throws MessageHandlerException
Extract any candidate validation credentials from the request and/or message context. Some bindings allow validataion keys for the simple signature to be supplied, and others do not.

Parameters:
  `messageContext` - the SAML message context being processed
Returns:
  a list of candidate validation credentials in the request, or null if none were present
Throws:
  `MessageHandlerException` - thrown if there is an error during request processing

### getSignature

@Nullable protected byte[] getSignature() throws MessageHandlerException
Extract the signature value from the request, in the form suitable for input into `SignatureTrustEngine.validate(byte[], byte[], String, CriteriaSet, Credential)`. Defaults to the Base64-decoded value of the HTTP request parameter named `Signature`.

Returns:
  the signature value
Throws:
  `MessageHandlerException` - thrown if there is an error during request processing

### getSignatureAlgorithm

@Nullable protected String getSignatureAlgorithm() throws MessageHandlerException
Extract the signature algorithm URI value from the request. Defaults to the HTTP request parameter named `SigAlg`.

Returns:
  the signature algorithm URI value
Throws:
  `MessageHandlerException` - thrown if there is an error during request processing

### deriveSignerEntityID

@Nullable protected String deriveSignerEntityID(@Nonnull MessageContext messageContext) throws MessageHandlerException
Derive the signer's entity ID from the message context. This is implementation-specific and there is no default. This is primarily an extension point for subclasses.

Parameters:
  `messageContext` - the SAML message context being processed
Returns:
  the signer's derived entity ID
Throws:
  `MessageHandlerException` - thrown if there is an error during request processing

### buildCriteriaSet

@Nonnull protected CriteriaSet buildCriteriaSet(@Nullable String entityID, @Nonnull MessageContext messageContext) throws MessageHandlerException
Build a criteria set suitable for input to the trust engine.

Parameters:
  `entityID` - the candidate issuer entity ID which is being evaluated
  `messageContext` - the message context which is being evaluated
Returns:
  a newly constructly set of criteria suitable for the configured trust engine
Throws:
  `MessageHandlerException` - thrown if criteria set can not be constructed

### getSignedContent

@Nullable protected byte[] getSignedContent(@Nonnull MessageContext messageContext) throws MessageHandlerException
Get the content over which to validate the signature, in the form suitable for input into `SignatureTrustEngine.validate(byte[], byte[], String, CriteriaSet, Credential)`.

Parameters:
  `messageContext` - the message context which is being evaluated
Returns:
  the signed content extracted from the request, in the format suitable for input to the trust engine.
Throws:
  `MessageHandlerException` - thrown if there is an error during request processing

### ruleHandles

protected abstract boolean ruleHandles(@Nonnull MessageContext messageContext) throws MessageHandlerException
Determine whether the rule should handle the request, based on the unwrapped HTTP servlet request and/or message context.

Parameters:
  `messageContext` - the SAML message context being processed
Returns:
  true if the rule should attempt to process the request, otherwise false
Throws:
  `MessageHandlerException` - thrown if there is an error during request processing