Package org.opensaml.saml.security.impl

# Class SAMLSignatureProfileValidator

java.lang.Object
org.opensaml.saml.security.impl.SAMLSignatureProfileValidator

All Implemented Interfaces:
  `SignaturePrevalidator`

public class SAMLSignatureProfileValidator extends Object implements SignaturePrevalidator
A validator for instances of `Signature`, which validates that the signature meets security-related requirements indicated by the SAML profile of XML Signature.

## Field Summary

Fields
Modifier and Type
Field
Description
`private final org.slf4j.Logger`
`log`
Class logger.

## Constructor Summary

Constructors
Constructor
Description
`SAMLSignatureProfileValidator()`

## Method Summary

Modifier and Type
Method
Description
`void`
`validate(Signature signature)`
Validate the signature according to the requirements represented by the validator.
`protected void`
`validateObjectChildren(org.apache.xml.security.signature.XMLSignature apacheSig)`
Validate that the Signature instance does not contain any ds:Object children.
`protected org.apache.xml.security.signature.Reference`
`validateReference(org.apache.xml.security.signature.XMLSignature apacheSig)`
Validate the Signature's SignedInfo Reference.
`protected void`
`validateReferenceURI(String uri, String id)`
Validate the Reference URI and parent ID attribute values.
`protected void`
`validateReferenceURI(String uri, SignableSAMLObject signableObject)`
Validate the Signature's Reference URI.
`protected void`
`validateSignatureImpl(SignatureImpl sigImpl)`
Validate an instance of `SignatureImpl`, which is in turn based on underlying Apache XML Security `XMLSignature` instance.
`protected void`
`validateTransforms(org.apache.xml.security.signature.Reference reference)`
Validate the transforms included in the Signature Reference.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

## Constructor Details

### SAMLSignatureProfileValidator

public SAMLSignatureProfileValidator()

## Method Details

### validate

public void validate(@Nonnull Signature signature) throws SignatureException
Validate the signature according to the requirements represented by the validator.

Specified by:
  `validate` in interface `SignaturePrevalidator`
Parameters:
  `signature` - the signature to evaluate
Throws:
  `SignatureException` - if the signature does not meet the validator's requirements

### validateSignatureImpl

protected void validateSignatureImpl(@Nonnull SignatureImpl sigImpl) throws SignatureException
Validate an instance of `SignatureImpl`, which is in turn based on underlying Apache XML Security `XMLSignature` instance.

Parameters:
  `sigImpl` - the signature implementation object to validate
Throws:
  `SignatureException` - thrown if the signature is not valid with respect to the profile

### validateReference

@Nonnull protected org.apache.xml.security.signature.Reference validateReference(@Nonnull org.apache.xml.security.signature.XMLSignature apacheSig) throws SignatureException
Validate the Signature's SignedInfo Reference. The SignedInfo must contain exactly 1 Reference.

Parameters:
  `apacheSig` - the Apache XML Signature instance
Returns:
  the valid Reference contained within the SignedInfo
Throws:
  `SignatureException` - thrown if the Signature does not contain exactly 1 Reference, or if there is an error obtaining the Reference instance

### validateReferenceURI

protected void validateReferenceURI(String uri, @Nonnull SignableSAMLObject signableObject) throws SignatureException
Validate the Signature's Reference URI. First validate the Reference URI against the parent's ID itself. Then validate that the URI (if non-empty) resolves to the same Element node as is cached by the SignableSAMLObject.

Parameters:
  `uri` - the Signature Reference URI attribute value
  `signableObject` - the SignableSAMLObject whose signature is being validated
Throws:
  `SignatureException` - if the URI is invalid or doesn't resolve to the expected DOM node

### validateReferenceURI

protected void validateReferenceURI(@Nullable String uri, @Nullable String id) throws SignatureException
Validate the Reference URI and parent ID attribute values. The URI must either be null or empty (indicating that the entire enclosing document was signed), or else it must be a local document fragment reference and point to the SAMLObject parent via the latter's ID attribute value.

Parameters:
  `uri` - the Signature Reference URI attribute value
  `id` - the Signature parents ID attribute value
Throws:
  `SignatureException` - thrown if the URI or ID attribute values are invalid

### validateTransforms

protected void validateTransforms(@Nonnull org.apache.xml.security.signature.Reference reference) throws SignatureException
Validate the transforms included in the Signature Reference. The Reference may contain at most 2 transforms. One of them must be the Enveloped signature transform. An Exclusive Canonicalization transform (with or without comments) may also be present. No other transforms are allowed.

Parameters:
  `reference` - the Signature reference containing the transforms to evaluate
Throws:
  `SignatureException` - thrown if the set of transforms is invalid

### validateObjectChildren

protected void validateObjectChildren(@Nonnull org.apache.xml.security.signature.XMLSignature apacheSig) throws SignatureException
Validate that the Signature instance does not contain any ds:Object children.

Parameters:
  `apacheSig` - the Apache XML Signature instance
Throws:
  `SignatureException` - if the signature contains ds:Object children