View Javadoc

1   /*
2    * Copyright [2006] [University Corporation for Advanced Internet Development, Inc.]
3    *
4    * Licensed under the Apache License, Version 2.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    *
8    * http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   */
16  
17  package org.opensaml.xml.security.trust;
18  
19  import org.opensaml.xml.security.CriteriaSet;
20  import org.opensaml.xml.security.SecurityException;
21  import org.opensaml.xml.security.credential.Credential;
22  import org.opensaml.xml.security.credential.CredentialResolver;
23  import org.opensaml.xml.security.x509.X509Credential;
24  import org.slf4j.Logger;
25  import org.slf4j.LoggerFactory;
26  
27  /**
28   * Trust engine that evaluates a credential's X.509 certificate against certificates expressed within a set of trusted
29   * credentials obtained from a credential resolver.
30   * 
31   * The credential being tested is valid if its entity certificate matches the entity certificate contained within any of
32   * the trusted credentials produced by the given credential resolver.
33   */
34  public class ExplicitX509CertificateTrustEngine implements TrustedCredentialTrustEngine<X509Credential> {
35  
36      /** Class logger. */
37      private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEngine.class);
38  
39      /** Resolver used for resolving trusted credentials. */
40      private CredentialResolver credentialResolver;
41  
42      /** Trust evaluator. */
43      private ExplicitX509CertificateTrustEvaluator trustEvaluator;
44  
45      /**
46       * Constructor.
47       * 
48       * @param resolver credential resolver which is used to resolve trusted credentials
49       */
50      public ExplicitX509CertificateTrustEngine(CredentialResolver resolver) {
51          if (resolver == null) {
52              throw new IllegalArgumentException("Credential resolver may not be null");
53          }
54          credentialResolver = resolver;
55  
56          trustEvaluator = new ExplicitX509CertificateTrustEvaluator();
57      }
58  
59      /** {@inheritDoc} */
60      public CredentialResolver getCredentialResolver() {
61          return credentialResolver;
62      }
63  
64      /** {@inheritDoc} */
65      public boolean validate(X509Credential untrustedCredential, CriteriaSet trustBasisCriteria)
66              throws SecurityException {
67  
68          checkParams(untrustedCredential, trustBasisCriteria);
69  
70          log.debug("Attempting to validate untrusted credential");
71          Iterable<Credential> trustedCredentials = getCredentialResolver().resolve(trustBasisCriteria);
72  
73          return trustEvaluator.validate(untrustedCredential, trustedCredentials);
74      }
75  
76      /**
77       * Check the parameters for required values.
78       * 
79       * @param untrustedCredential the signature to be evaluated
80       * @param trustBasisCriteria the set of trusted credential criteria
81       * @throws SecurityException thrown if required values are absent or otherwise invalid
82       */
83      protected void checkParams(X509Credential untrustedCredential, CriteriaSet trustBasisCriteria)
84              throws SecurityException {
85  
86          if (untrustedCredential == null) {
87              throw new SecurityException("Untrusted credential was null");
88          }
89          if (trustBasisCriteria == null) {
90              throw new SecurityException("Trust basis criteria set was null");
91          }
92          if (trustBasisCriteria.isEmpty()) {
93              throw new SecurityException("Trust basis criteria set was empty");
94          }
95      }
96  
97  }