/**
* @file xmltooling/security/AbstractPKIXTrustEngine.h
*
- * A trust engine that uses X.509 trust anchors and CRLs associated with a KeyInfoSource
- * to perform PKIX validation of signatures and certificates.
+ * A trust engine that uses X.509 trust anchors and CRLs associated with a peer
+ * to perform PKIX validation of signatures and credentials.
*/
#if !defined(__xmltooling_pkixtrust_h__) && !defined(XMLTOOLING_NO_XMLSEC)
namespace xmltooling {
/**
- * A trust engine that uses X.509 trust anchors and CRLs associated with a KeyInfoSource
- * to perform PKIX validation of signatures and certificates.
+ * A trust engine that uses X.509 trust anchors and CRLs associated with a peer
+ * to perform PKIX validation of signatures and credentials.
*/
class XMLTOOL_API AbstractPKIXTrustEngine : public OpenSSLTrustEngine
{
* If a DOM is supplied, the following XML content is supported:
*
* <ul>
- * <li><KeyResolver> elements with a type attribute
+ * <li><KeyInfoResolver> elements with a type attribute
* </ul>
*
* XML namespaces are ignored in the processing of this content.
*
* @param e DOM to supply configuration for provider
*/
- AbstractPKIXTrustEngine(const DOMElement* e=NULL);
+ AbstractPKIXTrustEngine(const xercesc::DOMElement* e=NULL) : OpenSSLTrustEngine(e) {}
/**
- * Checks that either the ID for the entity with the given role or the key names
- * for the given role match the subject or subject alternate names
- * of the entity's certificate.
+ * Checks that either the name of the peer with the given credentials or the names
+ * of the credentials match the subject or subject alternate names of the certificate.
*
* @param certEE the credential for the entity to validate
- * @param keyInfoSource supplies KeyInfo objects to the TrustEngine
+ * @param credResolver source of credentials
+ * @param criteria criteria for selecting credentials, including the peer name
*
* @return true the name check succeeds, false if not
*/
- bool checkEntityNames(X509* certEE, const KeyInfoSource& keyInfoSource) const;
-
- /** An inline KeyResolver for extracting certificates out of a signature. */
- KeyResolver* m_inlineResolver;
+ bool checkEntityNames(X509* certEE, const CredentialResolver& credResolver, const CredentialCriteria& criteria) const;
public:
- virtual ~AbstractPKIXTrustEngine();
+ virtual ~AbstractPKIXTrustEngine() {}
- virtual bool validate(
+ bool validate(
xmlsignature::Signature& sig,
- const KeyInfoSource& keyInfoSource,
- const KeyResolver* keyResolver=NULL
+ const CredentialResolver& credResolver,
+ CredentialCriteria* criteria=NULL
) const;
- virtual bool validate(
+ bool validate(
const XMLCh* sigAlgorithm,
const char* sig,
xmlsignature::KeyInfo* keyInfo,
const char* in,
unsigned int in_len,
- const KeyInfoSource& keyInfoSource,
- const KeyResolver* keyResolver=NULL
+ const CredentialResolver& credResolver,
+ CredentialCriteria* criteria=NULL
) const;
- virtual bool validate(
+ bool validate(
XSECCryptoX509* certEE,
const std::vector<XSECCryptoX509*>& certChain,
- const KeyInfoSource& keyInfoSource,
- bool checkName=true,
- const KeyResolver* keyResolver=NULL
+ const CredentialResolver& credResolver,
+ CredentialCriteria* criteria=NULL
) const;
- virtual bool validate(
+ bool validate(
X509* certEE,
STACK_OF(X509)* certChain,
- const KeyInfoSource& keyInfoSource,
- bool checkName=true,
- const KeyResolver* keyResolver=NULL
+ const CredentialResolver& credResolver,
+ CredentialCriteria* criteria=NULL
) const;
/**
class XMLTOOL_API PKIXValidationInfoIterator {
MAKE_NONCOPYABLE(PKIXValidationInfoIterator);
protected:
- /** Reference to KeyResolver to use. */
- const KeyResolver& m_keyResolver;
-
- /**
- * Constructor
- *
- * @param keyResolver reference to KeyResolver to use
- */
- PKIXValidationInfoIterator(const KeyResolver& keyResolver) : m_keyResolver(keyResolver) {}
+ PKIXValidationInfoIterator() {}
public:
virtual ~PKIXValidationInfoIterator() {}
};
/**
- * Provides access to the information necessary, for the given key source, for
+ * Provides access to the information necessary, for the given credential source, for
* PKIX validation of credentials. Each set of validation information returned
* will be tried, in turn, until one succeeds or no more remain.
* The caller must free the returned interface when finished with it.
*
- * @param pkixSource the peer for which validation rules are required
- * @param keyResolver reference to KeyResolver to use for any KeyInfo operations
+ * @param pkixSource the peer for which validation rules are required
+ * @param criteria criteria for selecting validation rules
* @return interface for obtaining validation data
*/
virtual PKIXValidationInfoIterator* getPKIXValidationInfoIterator(
- const KeyInfoSource& pkixSource,
- const KeyResolver& keyResolver
+ const CredentialResolver& pkixSource, CredentialCriteria* criteria=NULL
) const=0;
};
};