saml/security/impl/ExplicitKeyTrustEngine.cpp

   1 /*
   2  *  Copyright 2001-2005 Internet2
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /**
  18  * ExplicitKeyTrustEngine.cpp
  19  *
  20  * TrustEngine based on explicit knowledge of peer key information.
  21  */
  22
  23 #include "internal.h"
  24 #include "exceptions.h"
  25 #include "security/MetadataKeyInfoIterator.h"
  26 #include "security/X509TrustEngine.h"
  27 #include "signature/SignatureProfileValidator.h"
  28
  29 #include <log4cpp/Category.hh>
  30 #include <xmltooling/security/X509TrustEngine.h>
  31 #include <xmltooling/util/NDC.h>
  32
  33 using namespace opensaml::saml2md;
  34 using namespace opensaml;
  35 using namespace xmlsignature;
  36 using namespace log4cpp;
  37 using namespace std;
  38
  39 namespace opensaml {
  40     class SAML_DLLLOCAL ExplicitKeyTrustEngine : public X509TrustEngine
  41     {
  42     public:
  43         ExplicitKeyTrustEngine(const DOMElement* e) : X509TrustEngine(e), m_engine(NULL) {
  44             auto_ptr<xmltooling::TrustEngine> engine(
  45                 xmltooling::XMLToolingConfig::getConfig().TrustEngineManager.newPlugin(EXPLICIT_KEY_TRUSTENGINE, e)
  46                 );
  47             if (m_engine=dynamic_cast<xmltooling::X509TrustEngine*>(engine.get()))
  48                 engine.release();
  49             else
  50                 throw xmltooling::UnknownExtensionException("Embedded trust engine does not support required interface.");
  51         }
  52
  53         virtual ~ExplicitKeyTrustEngine() {
  54             delete m_engine;
  55         }
  56
  57         virtual bool validate(
  58             Signature& sig,
  59             const RoleDescriptor& role,
  60             const KeyResolver* keyResolver=NULL
  61             ) const;
  62         virtual bool validate(
  63             XSECCryptoX509* certEE,
  64             const vector<XSECCryptoX509*>& certChain,
  65             const RoleDescriptor& role,
  66             bool checkName=true,
  67             const KeyResolver* keyResolver=NULL
  68             ) const;
  69
  70     private:
  71         xmltooling::X509TrustEngine* m_engine;
  72     };
  73
  74     TrustEngine* SAML_DLLLOCAL ExplicitKeyTrustEngineFactory(const DOMElement* const & e)
  75     {
  76         return new ExplicitKeyTrustEngine(e);
  77     }
  78 };
  79
  80 bool ExplicitKeyTrustEngine::validate(
  81     Signature& sig,
  82     const RoleDescriptor& role,
  83     const KeyResolver* keyResolver
  84     ) const
  85 {
  86 #ifdef _DEBUG
  87     xmltooling::NDC ndc("validate");
  88 #endif
  89     Category& log=Category::getInstance(SAML_LOGCAT".TrustEngine");
  90
  91     log.debug("attempting to validate signature profile");
  92     SignatureProfileValidator sigValidator;
  93     try {
  94         sigValidator.validate(&sig);
  95         log.debug("signature profile validated");
  96     }
  97     catch (xmltooling::ValidationException& e) {
  98         if (log.isDebugEnabled()) {
  99             log.debug("signature profile failed to validate: %s", e.what());
 100         }
 101         return false;
 102     }
 103
 104     MetadataKeyInfoIterator keys(role);
 105     return static_cast<xmltooling::TrustEngine*>(m_engine)->validate(sig,keys,keyResolver);
 106 }
 107
 108 bool ExplicitKeyTrustEngine::validate(
 109     XSECCryptoX509* certEE,
 110     const vector<XSECCryptoX509*>& certChain,
 111     const RoleDescriptor& role,
 112     bool checkName,
 113     const KeyResolver* keyResolver
 114     ) const
 115 {
 116     MetadataKeyInfoIterator keys(role);
 117     return m_engine->validate(certEE,certChain,keys,checkName,keyResolver);
 118 }