2 * Copyright 2001-2006 Internet2
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 * @file saml/security/AbstractPKIXTrustEngine.h
20 * A trust engine that uses X.509 trust anchors and CRLs associated with a role
21 * to perform PKIX validation of signatures and certificates.
24 #ifndef __saml_pkixtrust_h__
25 #define __saml_pkixtrust_h__
27 #include <saml/security/X509TrustEngine.h>
28 #include <xmltooling/security/XSECCryptoX509CRL.h>
33 * A trust engine that uses X.509 trust anchors and CRLs associated with a role
34 * to perform PKIX validation of signatures and certificates.
36 class SAML_API AbstractPKIXTrustEngine : public X509TrustEngine
42 * If a DOM is supplied, the following XML content is supported:
45 * <li><KeyResolver> elements with a type attribute
48 * XML namespaces are ignored in the processing of this content.
50 * @param e DOM to supply configuration for provider
52 AbstractPKIXTrustEngine(const DOMElement* e=NULL);
55 * Checks that either the ID for the entity with the given role or the key names
56 * for the given role match the subject or subject alternate names
57 * of the entity's certificate.
59 * @param certEE the credential for the entity to validate
60 * @param role the descriptor of the role the entity is supposed to be acting in
62 * @return true the name check succeeds, false if not
64 bool checkEntityNames(XSECCryptoX509* certEE, const saml2md::RoleDescriptor& role) const;
66 /** An inline KeyResolver for extracting certificates out of a signature. */
67 xmlsignature::KeyResolver* m_inlineResolver;
70 virtual ~AbstractPKIXTrustEngine();
72 virtual bool validate(
73 xmlsignature::Signature& sig,
74 const saml2md::RoleDescriptor& role,
75 const xmlsignature::KeyResolver* keyResolver=NULL
78 virtual bool validate(
79 const XMLCh* sigAlgorithm,
81 xmlsignature::KeyInfo* keyInfo,
84 const saml2md::RoleDescriptor& role,
85 const xmlsignature::KeyResolver* keyResolver=NULL
88 virtual bool validate(
89 XSECCryptoX509* certEE,
90 const std::vector<XSECCryptoX509*>& certChain,
91 const saml2md::RoleDescriptor& role,
93 const xmlsignature::KeyResolver* keyResolver=NULL
97 * Stateful interface that supplies PKIX validation data to the trust engine.
98 * Applications can adapt this TrustEngine to their environment by returning
99 * implementations of this interface from the getPKIXValidationInfoIterator
102 class SAML_API PKIXValidationInfoIterator {
103 MAKE_NONCOPYABLE(PKIXValidationInfoIterator);
105 PKIXValidationInfoIterator() {}
107 virtual ~PKIXValidationInfoIterator() {}
110 * Advances to the next set of information, if any.
112 * @return true iff another set of information is available
114 virtual bool next()=0;
117 * Returns the allowable trust chain verification depth for the
118 * validation data in the current position.
120 * @return allowable trust chain verification depth
122 virtual int getVerificationDepth() const=0;
125 * Returns the set of trust anchors for the validation data in the
126 * current position. Keeping the certificates beyond the lifetime
127 * of the iterator or after advancing to the next position requires
130 * @return set of trust anchors
132 virtual const std::vector<XSECCryptoX509*>& getTrustAnchors() const=0;
135 * Returns the set of CRLs for the validation data in the
136 * current position. Keeping the CRLs beyond the lifetime
137 * of the iterator or after advancing to the next position requires
140 * @return set of CRLs
142 virtual const std::vector<xmltooling::XSECCryptoX509CRL*>& getCRLs() const=0;
146 * Provides access to the information necessary, for the given role, for
147 * PKIX validation of credentials. Each set of validation information returned
148 * will be tried, in turn, until one succeeds or no more remain.
149 * The caller must free the returned interface when finished with it.
151 * @return interface for obtaining validation data
153 virtual PKIXValidationInfoIterator* getPKIXValidationInfoIterator(const saml2md::RoleDescriptor& role) const=0;
157 #endif /* __saml_pkixtrust_h__ */