se.swedenconnect.opensaml.xmlsec

Class ExtendedSAMLMetadataEncryptionParametersResolver

java.lang.Object

org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver<EncryptionParameters>

org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver

org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver

se.swedenconnect.opensaml.xmlsec.ExtendedSAMLMetadataEncryptionParametersResolver

All Implemented Interfaces:

Resolver<EncryptionParameters,CriteriaSet>, EncryptionParametersResolver

public class ExtendedSAMLMetadataEncryptionParametersResolver
extends SAMLMetadataEncryptionParametersResolver

An extension of SAMLMetadataEncryptionParametersResolver that also lets us resolve encryption parameters for key agreement algorithms.

Author:

Martin Lindström (martin@idsec.se), Stefan Santesson (stefan@idsec.se)

Constructor Summary

Constructors

Constructor and Description
ExtendedSAMLMetadataEncryptionParametersResolver(MetadataCredentialResolver resolver) Constructor.

Method Summary

Modifier and Type	Method and Description
protected void	resolveAndPopulateCredentialsAndAlgorithms(EncryptionParameters params, CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate) A copy of SAMLMetadataEncryptionParametersResolver's implementation with some changes for key agreement.
protected Pair<String,KeyDerivationMethod>	resolveKeyAgreementAlgorithm(Credential keyTransportCredential, CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, SAMLMDCredentialContext metadataCredContext) Resolves the key agreement algorithm to use.
protected se.swedenconnect.opensaml.xmlsec.ExtendedSAMLMetadataEncryptionParametersResolver.ResolvedKeyTransport	resolveKeyTransport(Credential keyTransportCredential, CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, String dataEncryptionAlgorithm, SAMLMDCredentialContext metadataCredContext) Resolver that handles both key transport algorithm and key agreement.
protected KeyInfoGenerator	resolveKeyTransportKeyInfoGenerator(CriteriaSet criteria, Credential keyTransportEncryptionCredential)
protected String	resolveKeyWrappingAlgorithm(Credential keyTransportCredential, CriteriaSet criteria, com.google.common.base.Predicate<String> whitelistBlacklistPredicate, SAMLMDCredentialContext metadataCredContext) Resolves the key wrapping algorithm to use.
void	setAlgorithmRegistry(AlgorithmRegistry registry)
void	setAutoGenerateDataEncryptionCredential(boolean flag)
void	setUseKeyAgreementDefaults(boolean flag) Tells whether we should rely on that we received an ExtendedEncryptionConfiguration object among the criteria.

Methods inherited from class org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver

credentialSupportsEncryptionMethod, evaluateEncryptionMethodChildren, evaluateRSAOAEPChildren, getMetadataCredentialResolver, isMergeMetadataRSAOAEPParametersWithConfig, populateRSAOAEPParamsFromEncryptionMethod, resolveAndPopulateRSAOAEPParams, resolveDataEncryptionAlgorithm, resolveKeyTransportAlgorithm, setMergeMetadataRSAOAEPParametersWithConfig

Methods inherited from class org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver

credentialSupportsAlgorithm, generateDataEncryptionCredential, getAlgorithmRegistry, getAlgorithmRuntimeSupportedPredicate, getEffectiveDataEncryptionAlgorithms, getEffectiveDataEncryptionCredentials, getEffectiveKeyTransportAlgorithms, getEffectiveKeyTransportCredentials, getWhitelistBlacklistPredicate, isAutoGenerateDataEncryptionCredential, isDataEncryptionAlgorithm, isKeyTransportAlgorithm, logResult, populateRSAOAEPParams, processDataEncryptionCredentialAutoGeneration, resolve, resolveAndPopulateRSAOAEPParams, resolveDataEncryptionAlgorithm, resolveDataEncryptionAlgorithm, resolveDataKeyInfoGenerator, resolveKeyTransportAlgorithm, resolveKeyTransportAlgorithm, resolveKeyTransportAlgorithmPredicate, resolveSingle, validate, validate

Methods inherited from class org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver

lookupKeyInfoGenerator, resolveAndPopulateWhiteAndBlacklists, resolveEffectiveBlacklist, resolveEffectiveWhitelist, resolveWhitelistBlacklistPrecedence, resolveWhitelistBlacklistPredicate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ExtendedSAMLMetadataEncryptionParametersResolver

public ExtendedSAMLMetadataEncryptionParametersResolver(MetadataCredentialResolver resolver)

Constructor.

Parameters:

resolver - the metadata credential resolver instance to use to resolve encryption credentials

Method Detail

resolveAndPopulateCredentialsAndAlgorithms

protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull
                                                          EncryptionParameters params,
                                                          @Nonnull
                                                          CriteriaSet criteria,
                                                          @Nonnull
                                                          com.google.common.base.Predicate<String> whitelistBlacklistPredicate)

A copy of SAMLMetadataEncryptionParametersResolver's implementation with some changes for key agreement.

Overrides:

resolveAndPopulateCredentialsAndAlgorithms in class SAMLMetadataEncryptionParametersResolver

resolveKeyTransport

protected se.swedenconnect.opensaml.xmlsec.ExtendedSAMLMetadataEncryptionParametersResolver.ResolvedKeyTransport resolveKeyTransport(@Nonnull
                                                                                                                                     Credential keyTransportCredential,
                                                                                                                                     @Nonnull
                                                                                                                                     CriteriaSet criteria,
                                                                                                                                     @Nonnull
                                                                                                                                     com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                                                                                                                     @Nullable
                                                                                                                                     String dataEncryptionAlgorithm,
                                                                                                                                     @Nullable
                                                                                                                                     SAMLMDCredentialContext metadataCredContext)

Resolver that handles both key transport algorithm and key agreement.

Parameters:

keyTransportCredential - the peer credential

criteria - the criteria

whitelistBlacklistPredicate - the whitelist/blacklist predicate to use

dataEncryptionAlgorithm - the data encryption algorithm to use

metadataCredContext - the metadata credential context (EncryptionMethod elements)

Returns:

the algorithm and credential that is the result of the process

resolveKeyWrappingAlgorithm

protected String resolveKeyWrappingAlgorithm(@Nonnull
                                             Credential keyTransportCredential,
                                             @Nonnull
                                             CriteriaSet criteria,
                                             @Nonnull
                                             com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                             @Nullable
                                             SAMLMDCredentialContext metadataCredContext)

Resolves the key wrapping algorithm to use. The method first looks among the EncryptionMethod elements and if no suitable algorithm is found there the local configuration is used.

Parameters:

keyTransportCredential - the credential we are resolving for

criteria - the criteria

whitelistBlacklistPredicate - the whitelist/blacklist predicate to use

metadataCredContext - the metadata credential context

Returns:

the key wrapping algorithm to use (or null if none is found)

resolveKeyAgreementAlgorithm

protected Pair<String,KeyDerivationMethod> resolveKeyAgreementAlgorithm(@Nonnull
                                                                        Credential keyTransportCredential,
                                                                        @Nonnull
                                                                        CriteriaSet criteria,
                                                                        @Nonnull
                                                                        com.google.common.base.Predicate<String> whitelistBlacklistPredicate,
                                                                        @Nullable
                                                                        SAMLMDCredentialContext metadataCredContext)

Resolves the key agreement algorithm to use. The method first looks among the EncryptionMethod elements and if no suitable algorithm is found there the local configuration is used.

Parameters:

keyTransportCredential - the credential we are resolving for

criteria - the criteria

whitelistBlacklistPredicate - the whitelist/blacklist predicate to use

metadataCredContext - the metadata credential context

Returns:

the key wrapping agreement to use along with its derivation method (or null if none is found)

resolveKeyTransportKeyInfoGenerator

@Nullable
protected KeyInfoGenerator resolveKeyTransportKeyInfoGenerator(@Nonnull
                                                                         CriteriaSet criteria,
                                                                         @Nullable
                                                                         Credential keyTransportEncryptionCredential)

Overrides:

resolveKeyTransportKeyInfoGenerator in class BasicEncryptionParametersResolver

setAlgorithmRegistry

public void setAlgorithmRegistry(AlgorithmRegistry registry)

Overrides:

setAlgorithmRegistry in class BasicEncryptionParametersResolver

setAutoGenerateDataEncryptionCredential

public void setAutoGenerateDataEncryptionCredential(boolean flag)

Overrides:

setAutoGenerateDataEncryptionCredential in class BasicEncryptionParametersResolver

setUseKeyAgreementDefaults

public void setUseKeyAgreementDefaults(boolean flag)

Tells whether we should rely on that we received an ExtendedEncryptionConfiguration object among the criteria. If we want to function in an environment where the caller doesn't know anything about ExtendedEncryptionConfiguration we can set this property to true. In that case, our resolving will assume that default key agreement methods are available if no ExtendedEncryptionConfiguration is passed among the criteria.

Parameters:

flag - whether we should assume a set of key agreement methods (if no ExtendedEncryptionConfiguration is passed)