ws/security/SecurityUtils.java

a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster/**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * The contents of this file are subject to the terms
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * of the Common Development and Distribution License
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * (the License). You may not use this file except in
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * compliance with the License.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * You can obtain a copy of the License at
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * https://opensso.dev.java.net/public/CDDLv1.0.html or
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * opensso/legal/CDDLv1.0.txt
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * See the License for the specific language governing
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * permission and limitations under the License.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * When distributing Covered Code, include this CDDL
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * Header Notice in each file and include the License file
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * at opensso/legal/CDDLv1.0.txt.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * If applicable, add the following below the CDDL Header,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * with the fields enclosed by brackets [] replaced by
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * your own identifying information:
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * "Portions Copyrighted [year] [name of copyright owner]"
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * $Id: SecurityUtils.java,v 1.5 2009/06/08 23:42:33 madan_ranganath Exp $
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster *
272ac8a1a482b3baeff7293aac5de828cfd1ee69Mark de Reeper * Portions Copyrighted 2014 ForgeRock AS
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterpackage com.sun.identity.liberty.ws.security;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.debug.Debug;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.configuration.SystemPropertiesManager;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.xml.XMLUtils;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.shared.encode.Base64;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.common.wsse.BinarySecurityToken;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.common.wsse.WSSEConstants;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.liberty.ws.soapbinding.Message;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.assertion.AuthenticationStatement;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.assertion.Statement;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.assertion.Subject;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.assertion.SubjectConfirmation;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.common.SAMLConstants;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.common.SAMLUtils;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.xmlsig.KeyProvider;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.xmlsig.XMLSignatureException;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport com.sun.identity.saml.xmlsig.XMLSignatureManager;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
272ac8a1a482b3baeff7293aac5de828cfd1ee69Mark de Reeperimport org.apache.xml.security.exceptions.XMLSecurityException;
272ac8a1a482b3baeff7293aac5de828cfd1ee69Mark de Reeperimport org.apache.xml.security.keys.content.keyvalues.DSAKeyValue;
272ac8a1a482b3baeff7293aac5de828cfd1ee69Mark de Reeperimport org.apache.xml.security.keys.content.keyvalues.RSAKeyValue;
272ac8a1a482b3baeff7293aac5de828cfd1ee69Mark de Reeperimport org.apache.xml.security.utils.Constants;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.io.ByteArrayInputStream;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.math.BigInteger;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.security.cert.Certificate;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.security.cert.CertificateFactory;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.security.cert.X509Certificate;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.security.PublicKey;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Collection;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.HashMap;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.HashSet;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Iterator;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.List;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Map;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.Set;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport java.util.StringTokenizer;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport javax.xml.namespace.QName;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport org.w3c.dom.Document;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport org.w3c.dom.Element;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport org.w3c.dom.Node;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterimport org.w3c.dom.NodeList;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster/**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster * This class has common utility methods .
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Fosterpublic class SecurityUtils {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static SecurityUtils securityManager = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static XMLSignatureManager sm = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static Debug debug = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static String PROP_TRUSTED_CA_CERT_ALIASES =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            "com.sun.identity.liberty.ws.trustedca.certaliases";
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static Set trustedCACertAliases = new HashSet();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static Map issuerTrustedCACertAliases = new HashMap();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static KeyProvider keystore = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    static {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        debug = Debug.getInstance("libIDWSF");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        String tmpStr = SystemPropertiesManager.get(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            PROP_TRUSTED_CA_CERT_ALIASES);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.message("SecurityUtils.static: trusted ca certaliases = " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    tmpStr);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (tmpStr != null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            StringTokenizer stz = new StringTokenizer(tmpStr, "|");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            while(stz.hasMoreTokens()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                String aliasIssuer = stz.nextToken().trim();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                if (aliasIssuer.length() > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    int index = aliasIssuer.indexOf(":");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    if (index == -1) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        trustedCACertAliases.add(aliasIssuer);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            debug.message("SecurityUtils.static: add " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                    aliasIssuer + " to trustedCACertAliases");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        String alias = aliasIssuer.substring(0, index).trim();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (alias.length() > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            trustedCACertAliases.add(alias);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                debug.message("SecurityUtils.static: add " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                        alias +" to trustedCACertAliases");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            String issuer =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                    aliasIssuer.substring(index + 1).trim();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            if (issuer.length() > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                issuerTrustedCACertAliases.put(issuer, alias);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                    debug.message("SecurityUtils.static: add "+
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                            "[" + issuer + ", " + alias +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                            "] to issuerTrustedCACertAliases");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        sm = XMLSignatureManager.getInstance();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    if (sm != null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            keystore = sm.getKeyProvider();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /*
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Sign part of the Message object based on the Security Token
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * profile embedded in the object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param m Message object
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return Signature of Security Token Profile
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    public static Element signMessage(Message m) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Document doc = m.toDocument(true);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            int securityType = m.getSecurityProfileType();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Certificate cert = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            List ids = m.getSigningIds();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                debug.message("Security Type = " + securityType);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (securityType==m.X509_TOKEN) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                cert = m.getMessageCertificate();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            return sm.signWithWSSX509TokenProfile(doc, cert, "", ids,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                       m.getWSFVersion());
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            } else if (securityType==m.SAML_TOKEN) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                SecurityAssertion assertion = m.getAssertion();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                cert = m.getMessageCertificate();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                String assertionID = assertion.getAssertionID();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            return sm.signWithWSSSAMLTokenProfile(doc, cert, assertionID,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            "", ids, m.getWSFVersion());
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            } else if (securityType==m.ANONYMOUS) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                // Should be transportation layer encryption.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } catch (Exception e) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.error("Unable to sign Soap message!",e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Verify all the signatures of the of Message object passed
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * from Soap Binding.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param m Message object whose signature to be verified
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return true if the signature is verified.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    public static boolean verifyMessage(Message m){
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Document doc = m.toDocument(false);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Certificate clientCert = (Certificate) m.getPeerCertificate();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Certificate messageCert = (Certificate) m.getMessageCertificate();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            int securityProfileType = m.getSecurityProfileType();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (securityProfileType == Message.SAML_TOKEN ||
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    securityProfileType == Message.BEARER_TOKEN) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                SecurityAssertion assertion = m.getAssertion();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                String certAlias = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Certificate signingCert = getAssertionSigningCert(assertion);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                if (signingCert == null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    certAlias = (String)issuerTrustedCACertAliases
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            .get(assertion.getIssuer());
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    if (certAlias == null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        debug.error("SecurityUtils.verifyMessage: " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                "assertion doesn't have keyInfo and " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                "issuer is not in " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                "com.sun.identity.liberty.ws.trustedca.certalias" +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                " in AMConfig");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    certAlias = keystore.getCertificateAlias(signingCert);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    if (certAlias == null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        debug.error("SecurityUtils.verifyMessage: " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                "assertion is signed with a certificate that " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                " is not in the keystore");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    } else if (!trustedCACertAliases.contains(certAlias)) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        debug.error("SecurityUtils.verifyMessage: " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                "assertion is signed with a certificate that " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                " is in the keystore but not in " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                "com.sun.identity.liberty.ws.trustedca.certalias" +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                " in AMConfig");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                assertion.setVerifyingCertAlias(certAlias);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                if (!assertion.isSignatureValid()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    debug.error("SecurityUtils.verifyMessage: assertion " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            "signature invalid");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    debug.message("SecurityUtils.verifyMessage: Assertion " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            " signing cert alias = " + certAlias);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if ((clientCert!=null)&&(!clientCert.equals(messageCert))) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                debug.error("Client authentication certificate is not " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        "the same as the certificate inside the " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        "soap message");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (messageCert != null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                String messageCertAlias =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        keystore.getCertificateAlias(messageCert);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                return sm.verifyXMLSignature(m.getWSFVersion(),
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    messageCertAlias, doc);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            return true;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } catch (Exception e) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.error("Unable to verify Soap Message!", e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return false;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Get Certificate from X509 Security Token Profile document.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param binarySecurityToken the Security Token.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return X509 Certiticate object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    public static java.security.cert.Certificate getCertificate(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            BinarySecurityToken binarySecurityToken) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        java.security.cert.Certificate cert = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            String certString = binarySecurityToken.getTokenValue();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            StringBuffer xml = new StringBuffer(100);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            xml.append(WSSEConstants.BEGIN_CERT);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            xml.append(certString);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            xml.append(WSSEConstants.END_CERT);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            byte[] barr = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            barr = (xml.toString()).getBytes();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            CertificateFactory cf = CertificateFactory.getInstance("X.509");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            ByteArrayInputStream bais = new ByteArrayInputStream(barr);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            QName valueType = binarySecurityToken.getValueType();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (valueType.equals(BinarySecurityToken.PKCS7)) { // PKCS7 format
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Collection c = cf.generateCertificates(bais);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Iterator i = c.iterator();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                while (i.hasNext()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    cert = (java.security.cert.Certificate) i.next();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            } else { //X509:v3 format
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                while (bais.available() > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    cert = cf.generateCertificate(bais);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } catch (Exception e) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            // Certificate encoding error!
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.error("WSSecurityManager:getX509Certificate", e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return cert;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Gets the  Certificate from the <code>Assertion</code>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param assertion the SAML <code>Assertion</code>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return <code>X509Certificate</code> object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    public static java.security.cert.Certificate getCertificate(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            SecurityAssertion assertion) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.message("SecurityAssertion = " + assertion.toString());
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Set statements = assertion.getStatement();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (statements !=null && !(statements.isEmpty())) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Iterator iterator =  statements.iterator();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                while (iterator.hasNext()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    Statement statement =(Statement)iterator.next();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    int stype = statement.getStatementType();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    Subject subject = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    if (stype == Statement.AUTHENTICATION_STATEMENT) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        subject =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            ((AuthenticationStatement)statement).getSubject();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    } else if (stype ==
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        ResourceAccessStatement.RESOURCEACCESS_STATEMENT) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        ResourceAccessStatement raStatement =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            (ResourceAccessStatement)statement;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        subject = raStatement.getProxySubject();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (subject == null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            subject = raStatement.getSubject();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    } else if (stype ==
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        SessionContextStatement.SESSIONCONTEXT_STATEMENT) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        SessionContextStatement scStatement =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            (SessionContextStatement)statement;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        subject = scStatement.getProxySubject();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (subject == null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            subject = scStatement.getSubject();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    if (subject != null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        SubjectConfirmation subConfirm =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            subject.getSubjectConfirmation();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (subConfirm.getConfirmationMethod().contains(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            SAMLConstants.CONFIRMATION_METHOD_HOLDEROFKEY)) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            Element keyinfo = subConfirm.getKeyInfo();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            return getCertificate(keyinfo);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                debug.error("Assertion does not contain any Statement.");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } catch (Exception e) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.error("getCertificate Exception: ", e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Returns the <code>X509Certificate</code> object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param keyinfo the <code>KeyInfo</code> Document Element.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return the <code>X509Certificate</code> object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static X509Certificate getCertificate(Element keyinfo) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        X509Certificate cert = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            debug.message("KeyInfo = " + XMLUtils.print(keyinfo));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        Element x509 = (Element) keyinfo.getElementsByTagNameNS(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Constants.SignatureSpecNS,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                SAMLConstants.TAG_X509CERTIFICATE).item(0);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (x509 == null) { // no cert found. try DSA/RSA key
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                PublicKey pk = getPublicKey(keyinfo);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                cert = (X509Certificate) keystore.getCertificate(pk);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            } catch (Exception e) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                debug.error("getCertificate Exception: ", e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            String certString = x509.getChildNodes().item(0).getNodeValue();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            cert = getCertificate(certString, null);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return cert;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Returns the <code>PublicKey</code>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static PublicKey getPublicKey(Element reference)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    throws XMLSignatureException {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        PublicKey pubKey = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        Document doc = reference.getOwnerDocument();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        Element dsaKey = (Element) reference.getElementsByTagNameNS(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Constants.SignatureSpecNS,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                SAMLConstants.TAG_DSAKEYVALUE).item(0);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (dsaKey != null) { // It's DSAKey
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            NodeList nodes = dsaKey.getChildNodes();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            int nodeCount = nodes.getLength();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (nodeCount > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                BigInteger p=null, q=null, g=null, y=null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                for (int i = 0; i < nodeCount; i++) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    Node currentNode = nodes.item(i);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    if (currentNode.getNodeType() == Node.ELEMENT_NODE) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        String tagName = currentNode.getLocalName();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        Node sub = currentNode.getChildNodes().item(0);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        String value = sub.getNodeValue();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        value = SAMLUtils.removeNewLineChars(value);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        BigInteger v = new BigInteger(Base64.decode(value));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (tagName.equals("P")) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            p = v;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        } else if (tagName.equals("Q")) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            q = v;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        } else if (tagName.equals("G")) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            g = v;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        } else if (tagName.equals("Y")) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            y = v;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            SAMLUtils.debug.error("Wrong tag name in DSA key.");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            throw new XMLSignatureException(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                    SAMLUtils.bundle.getString("errorObtainPK"));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                DSAKeyValue dsaKeyValue = new DSAKeyValue(doc, p, q, g, y);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    pubKey = dsaKeyValue.getPublicKey();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                } catch (XMLSecurityException xse) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    SAMLUtils.debug.error("Could not get Public Key from" +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            " DSA key value.");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    throw new XMLSignatureException(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            SAMLUtils.bundle.getString("errorObtainPK"));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            Element rsaKey =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    (Element) reference.getElementsByTagNameNS(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    Constants.SignatureSpecNS,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    SAMLConstants.TAG_RSAKEYVALUE).item(0);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (rsaKey != null) { // It's RSAKey
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                NodeList nodes = rsaKey.getChildNodes();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                int nodeCount = nodes.getLength();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                BigInteger m=null, e=null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                if (nodeCount > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    for (int i = 0; i < nodeCount; i++) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        Node currentNode = nodes.item(i);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        if (currentNode.getNodeType() == Node.ELEMENT_NODE) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            String tagName = currentNode.getLocalName();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            Node sub = currentNode.getChildNodes().item(0);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            String value = sub.getNodeValue();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            value = SAMLUtils.removeNewLineChars(value);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            BigInteger v =new BigInteger(Base64.decode(value));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            if (tagName.equals("Exponent")) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                e = v;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            } else if (tagName.equals("Modulus")){
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                m = v;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            } else {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                SAMLUtils.debug.error("Wrong tag name from " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                        "RSA key element.");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                throw new XMLSignatureException(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                                        SAMLUtils.bundle.getString("errorObtainPK"));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                RSAKeyValue rsaKeyValue =
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        new RSAKeyValue(doc,m, e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    pubKey = rsaKeyValue.getPublicKey();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                } catch (XMLSecurityException ex) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    SAMLUtils.debug.error("Could not get Public Key from" +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            " RSA key value.");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    throw new XMLSignatureException(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                            SAMLUtils.bundle.getString("errorObtainPK"));
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return pubKey;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Returns the <code>X509Certificate</code> object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param certString the Certificate String.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param format the Certificate's format.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return the <code>X509Certificate</code> object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static X509Certificate getCertificate(String certString,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            String format) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        X509Certificate cert = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        try {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if (SAMLUtils.debug.messageEnabled()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                SAMLUtils.debug.message("getCertificate(Assertion) : " +
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                        certString);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            StringBuffer xml = new StringBuffer(100);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            xml.append(SAMLConstants.BEGIN_CERT);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            xml.append(certString);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            xml.append(SAMLConstants.END_CERT);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            byte[] barr = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            barr = (xml.toString()).getBytes();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            CertificateFactory cf = CertificateFactory.getInstance("X.509");
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            ByteArrayInputStream bais = new ByteArrayInputStream(barr);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            if ((format !=null) &&
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    format.equals(SAMLConstants.TAG_PKCS7)) { // PKCS7 format
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Collection c = cf.generateCertificates(bais);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Iterator i = c.iterator();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                while (i.hasNext()) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    cert = (java.security.cert.X509Certificate) i.next();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            } else { //X509:v3 format
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                while (bais.available() > 0) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    cert = (java.security.cert.X509Certificate)
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                    cf.generateCertificate(bais);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        } catch (Exception e) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            SAMLUtils.debug.error("getCertificate Exception: ", e);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return cert;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Returns the <code>X509Certificate</code> in the <code>Assertion</code>.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     *
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @param assertion the SAML <code>Assertion</code>
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * @return the <code>X509Certificate</code> object.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    private static X509Certificate getAssertionSigningCert(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            SecurityAssertion assertion) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        X509Certificate cert = null;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        Element signature = assertion.getSignature();
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        Element keyInfo = (Element) signature.getElementsByTagNameNS(
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                Constants.SignatureSpecNS,
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster                SAMLConstants.TAG_KEYINFO).item(0);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        if (keyInfo != null) {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster            cert = (X509Certificate) getCertificate(keyInfo);
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return cert;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    /**
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     * Returns XML Signature instance.
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster     */
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    public static XMLSignatureManager getSignatureManager() {
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster        return sm;
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster    }
a688bcbb4bcff5398fdd29b86f83450257dc0df4Allan Foster}