saml/security/impl/ExplicitKeyTrustEngine.cpp

   1 /*\r
   2  *  Copyright 2001-2005 Internet2\r
   3  * \r
   4  * Licensed under the Apache License, Version 2.0 (the "License");\r
   5  * you may not use this file except in compliance with the License.\r
   6  * You may obtain a copy of the License at\r
   7  *\r
   8  *     http://www.apache.org/licenses/LICENSE-2.0\r
   9  *\r
  10  * Unless required by applicable law or agreed to in writing, software\r
  11  * distributed under the License is distributed on an "AS IS" BASIS,\r
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  13  * See the License for the specific language governing permissions and\r
  14  * limitations under the License.\r
  15  */\r
  16 \r
  17 /**\r
  18  * ExplicitKeyTrustEngine.cpp\r
  19  * \r
  20  * TrustEngine based on explicit knowledge of peer key information.\r
  21  */\r
  22 \r
  23 #include "internal.h"\r
  24 #include "exceptions.h"\r
  25 #include "security/MetadataKeyInfoIterator.h"\r
  26 #include "security/X509TrustEngine.h"\r
  27 #include "signature/SignatureProfileValidator.h"\r
  28 \r
  29 #include <log4cpp/Category.hh>\r
  30 #include <xmltooling/security/X509TrustEngine.h>\r
  31 #include <xmltooling/util/NDC.h>\r
  32 \r
  33 using namespace opensaml::saml2md;\r
  34 using namespace opensaml;\r
  35 using namespace xmlsignature;\r
  36 using namespace log4cpp;\r
  37 using namespace std;\r
  38 \r
  39 namespace opensaml {\r
  40     class SAML_DLLLOCAL ExplicitKeyTrustEngine : public X509TrustEngine\r
  41     {\r
  42     public:\r
  43         ExplicitKeyTrustEngine(const DOMElement* e) : X509TrustEngine(e), m_engine(NULL) {\r
  44             auto_ptr<xmltooling::TrustEngine> engine(\r
  45                 xmltooling::XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(EXPLICIT_KEY_TRUSTENGINE, e)\r
  46                 );\r
  47             if (m_engine=dynamic_cast<xmltooling::X509TrustEngine*>(engine.get()))\r
  48                 engine.release();\r
  49             else\r
  50                 throw xmltooling::UnknownExtensionException("Embedded trust engine does not support required interface.");\r
  51         }\r
  52         \r
  53         virtual ~ExplicitKeyTrustEngine() {\r
  54             delete m_engine;\r
  55         }\r
  56 \r
  57         virtual bool validate(\r
  58             Signature& sig,\r
  59             RoleDescriptor& role,\r
  60             const KeyResolver* keyResolver=NULL\r
  61             );\r
  62         virtual bool validate(\r
  63             XSECCryptoX509* certEE,\r
  64             const vector<XSECCryptoX509*>& certChain,\r
  65             RoleDescriptor& role,\r
  66             bool checkName=true,\r
  67             const KeyResolver* keyResolver=NULL\r
  68             );\r
  69 \r
  70     private:\r
  71         xmltooling::X509TrustEngine* m_engine;\r
  72     };\r
  73 \r
  74     TrustEngine* SAML_DLLLOCAL ExplicitKeyTrustEngineFactory(const DOMElement* const & e)\r
  75     {\r
  76         return new ExplicitKeyTrustEngine(e);\r
  77     }\r
  78 };\r
  79 \r
  80 bool ExplicitKeyTrustEngine::validate(\r
  81     Signature& sig,\r
  82     RoleDescriptor& role,\r
  83     const KeyResolver* keyResolver\r
  84     )\r
  85 {\r
  86 #ifdef _DEBUG\r
  87     xmltooling::NDC ndc("validate");\r
  88 #endif\r
  89     Category& log=Category::getInstance(SAML_LOGCAT".TrustEngine");\r
  90     \r
  91     log.debug("attempting to validate signature profile");\r
  92     SignatureProfileValidator sigValidator;\r
  93     try {\r
  94         sigValidator.validate(&sig);\r
  95         log.debug("signature profile validated");\r
  96     }\r
  97     catch (xmltooling::ValidationException& e) {\r
  98         if (log.isDebugEnabled()) {\r
  99             log.debug("signature profile failed to validate: %s", e.what());\r
 100         }\r
 101         return false;\r
 102     }\r
 103 \r
 104     MetadataKeyInfoIterator keys(role);\r
 105     return static_cast<xmltooling::TrustEngine*>(m_engine)->validate(sig,keys,keyResolver);\r
 106 }\r
 107 \r
 108 bool ExplicitKeyTrustEngine::validate(\r
 109     XSECCryptoX509* certEE,\r
 110     const vector<XSECCryptoX509*>& certChain,\r
 111     RoleDescriptor& role,\r
 112     bool checkName,\r
 113     const KeyResolver* keyResolver\r
 114     )\r
 115 {\r
 116     MetadataKeyInfoIterator keys(role);\r
 117     return m_engine->validate(certEE,certChain,keys,checkName,keyResolver);\r
 118 }\r