https://issues.shibboleth.net/jira/browse/SSPCPP-304
[shibboleth/cpp-opensaml.git] / saml / saml2 / metadata / impl / MetadataImpl.cpp
index f9e5547..0f99b22 100644 (file)
@@ -1,5 +1,5 @@
 /*
- *  Copyright 2001-2009 Internet2
+ *  Copyright 2001-2010 Internet2
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
 
 #include <xmltooling/AbstractComplexElement.h>
 #include <xmltooling/AbstractSimpleElement.h>
+#include <xmltooling/XMLToolingConfig.h>
 #include <xmltooling/encryption/Encryption.h>
 #include <xmltooling/impl/AnyElement.h>
 #include <xmltooling/io/AbstractXMLObjectMarshaller.h>
 #include <xmltooling/io/AbstractXMLObjectUnmarshaller.h>
+#include <xmltooling/security/CredentialCriteria.h>
+#include <xmltooling/security/CredentialResolver.h>
 #include <xmltooling/signature/KeyInfo.h>
 #include <xmltooling/signature/Signature.h>
 #include <xmltooling/util/DateTime.h>
@@ -77,8 +80,8 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_Lang=NULL;
-                m_LangPrefix=NULL;
+                m_Lang=nullptr;
+                m_LangPrefix=nullptr;
             }
 
         protected:
@@ -138,8 +141,8 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_Lang=NULL;
-                m_LangPrefix=NULL;
+                m_Lang=nullptr;
+                m_LangPrefix=nullptr;
             }
 
         protected:
@@ -319,10 +322,10 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_OrganizationURL;
 
             void init() {
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_Extensions=NULL;
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_Extensions=nullptr;
                 m_pos_Extensions=m_children.begin();
                 m_pos_OrganizationDisplayName=m_pos_Extensions;
                 ++m_pos_OrganizationDisplayName;
@@ -397,16 +400,16 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_TelephoneNumber;
 
             void init() {
-                m_ContactType=NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_Extensions=NULL;
-                m_Company=NULL;
-                m_GivenName=NULL;
-                m_SurName=NULL;
+                m_ContactType=nullptr;
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_Extensions=nullptr;
+                m_Company=nullptr;
+                m_GivenName=nullptr;
+                m_SurName=nullptr;
                 m_pos_Extensions=m_children.begin();
                 m_pos_Company=m_pos_Extensions;
                 ++m_pos_Company;
@@ -475,7 +478,7 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_STRING_ATTRIB(ContactType,CONTACTTYPE,NULL);
+                MARSHALL_STRING_ATTRIB(ContactType,CONTACTTYPE,nullptr);
                 marshallExtensionAttributes(domElement);
             }
 
@@ -501,7 +504,7 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_Namespace=NULL;
+                m_Namespace=nullptr;
             }
 
         public:
@@ -524,11 +527,11 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_STRING_ATTRIB(Namespace,NAMESPACE,NULL);
+                MARSHALL_STRING_ATTRIB(Namespace,NAMESPACE,nullptr);
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_STRING_ATTRIB(Namespace,NAMESPACE,NULL);
+                PROC_STRING_ATTRIB(Namespace,NAMESPACE,nullptr);
                 AbstractXMLObjectUnmarshaller::processAttribute(attribute);
             }
         };
@@ -540,9 +543,9 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
                void init() {
-                m_Use=NULL;
-                m_KeyInfo=NULL;
-                m_children.push_back(NULL);
+                m_Use=nullptr;
+                m_KeyInfo=nullptr;
+                m_children.push_back(nullptr);
                 m_pos_KeyInfo=m_children.begin();
            }
         public:
@@ -576,7 +579,7 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_STRING_ATTRIB(Use,USE,NULL);
+                MARSHALL_STRING_ATTRIB(Use,USE,nullptr);
             }
 
             void processChildElement(XMLObject* childXMLObject, const DOMElement* root) {
@@ -586,7 +589,7 @@ namespace opensaml {
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_STRING_ATTRIB(Use,USE,NULL);
+                PROC_STRING_ATTRIB(Use,USE,nullptr);
                 AbstractXMLObjectUnmarshaller::processAttribute(attribute);
             }
         };
@@ -599,7 +602,7 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_Binding=m_Location=m_ResponseLocation=NULL;
+                m_Binding=m_Location=m_ResponseLocation=nullptr;
             }
 
         protected:
@@ -656,9 +659,9 @@ namespace opensaml {
             }
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_STRING_ATTRIB(Binding,BINDING,NULL);
-                MARSHALL_STRING_ATTRIB(Location,LOCATION,NULL);
-                MARSHALL_STRING_ATTRIB(ResponseLocation,RESPONSELOCATION,NULL);
+                MARSHALL_STRING_ATTRIB(Binding,BINDING,nullptr);
+                MARSHALL_STRING_ATTRIB(Location,LOCATION,nullptr);
+                MARSHALL_STRING_ATTRIB(ResponseLocation,RESPONSELOCATION,nullptr);
                 marshallExtensionAttributes(domElement);
             }
 
@@ -680,7 +683,7 @@ namespace opensaml {
         class SAML_DLLLOCAL IndexedEndpointTypeImpl : public virtual IndexedEndpointType, public EndpointTypeImpl
         {
             void init() {
-                m_Index=NULL;
+                m_Index=nullptr;
                 m_isDefault=XML_BOOL_NULL;
             }
 
@@ -725,8 +728,8 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_INTEGER_ATTRIB(Index,INDEX,NULL);
-                MARSHALL_BOOLEAN_ATTRIB(isDefault,ISDEFAULT,NULL);
+                MARSHALL_INTEGER_ATTRIB(Index,INDEX,nullptr);
+                MARSHALL_BOOLEAN_ATTRIB(isDefault,ISDEFAULT,nullptr);
                 EndpointTypeImpl::marshallAttributes(domElement);
             }
         };
@@ -906,15 +909,15 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_ID=m_ProtocolSupportEnumeration=m_ErrorURL=NULL;
-                m_ValidUntil=m_CacheDuration=NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_Signature=NULL;
-                m_Extensions=NULL;
-                m_Organization=NULL;
+                m_ID=m_ProtocolSupportEnumeration=m_ErrorURL=nullptr;
+                m_ValidUntil=m_CacheDuration=nullptr;
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_Signature=nullptr;
+                m_Extensions=nullptr;
+                m_Organization=nullptr;
                 m_pos_Signature=m_children.begin();
                 m_pos_Extensions=m_pos_Signature;
                 ++m_pos_Extensions;
@@ -993,7 +996,7 @@ namespace opensaml {
                     m_Signature->setContentReference(new opensaml::ContentReference(*this));
             }
 
-            IMPL_ID_ATTRIB(ID);
+            IMPL_ID_ATTRIB_EX(ID,ID,nullptr);
             IMPL_STRING_ATTRIB(ProtocolSupportEnumeration);
             IMPL_STRING_ATTRIB(ErrorURL);
             IMPL_DATETIME_ATTRIB(ValidUntil,SAMLTIME_MAX);
@@ -1086,12 +1089,17 @@ namespace opensaml {
             }
 
         protected:
+            void prepareForMarshalling() const {
+                if (m_Signature)
+                    declareNonVisibleNamespaces();
+            }
+
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_ID_ATTRIB(ID,ID,NULL);
-                MARSHALL_STRING_ATTRIB(ProtocolSupportEnumeration,PROTOCOLSUPPORTENUMERATION,NULL);
-                MARSHALL_STRING_ATTRIB(ErrorURL,ERRORURL,NULL);
-                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,NULL);
-                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,NULL);
+                MARSHALL_ID_ATTRIB(ID,ID,nullptr);
+                MARSHALL_STRING_ATTRIB(ProtocolSupportEnumeration,PROTOCOLSUPPORTENUMERATION,nullptr);
+                MARSHALL_STRING_ATTRIB(ErrorURL,ERRORURL,nullptr);
+                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,nullptr);
+                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,nullptr);
                 marshallExtensionAttributes(domElement);
             }
 
@@ -1105,7 +1113,7 @@ namespace opensaml {
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_ID_ATTRIB(ID,ID,NULL);
+                PROC_ID_ATTRIB(ID,ID,nullptr);
                 unmarshallExtensionAttribute(attribute);
             }
         };
@@ -1141,10 +1149,10 @@ namespace opensaml {
         class SAML_DLLLOCAL SSODescriptorTypeImpl : public virtual SSODescriptorType, public RoleDescriptorImpl
         {
             void init() {
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
                 m_pos_ArtifactResolutionService=m_pos_ContactPerson;
                 ++m_pos_ArtifactResolutionService;
                 m_pos_SingleLogoutService=m_pos_ArtifactResolutionService;
@@ -1225,10 +1233,10 @@ namespace opensaml {
 
             void init() {
                 m_WantAuthnRequestsSigned=XML_BOOL_NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
                 m_pos_SingleSignOnService=m_pos_NameIDFormat;
                 ++m_pos_SingleSignOnService;
                 m_pos_NameIDMappingService=m_pos_SingleSignOnService;
@@ -1309,7 +1317,7 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_BOOLEAN_ATTRIB(WantAuthnRequestsSigned,WANTAUTHNREQUESTSSIGNED,NULL);
+                MARSHALL_BOOLEAN_ATTRIB(WantAuthnRequestsSigned,WANTAUTHNREQUESTSSIGNED,nullptr);
                 RoleDescriptorImpl::marshallAttributes(domElement);
             }
 
@@ -1331,7 +1339,7 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_Name=m_NameFormat=m_FriendlyName=NULL;
+                m_Name=m_NameFormat=m_FriendlyName=nullptr;
                 m_isRequired=XML_BOOL_NULL;
             }
         public:
@@ -1397,10 +1405,10 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_STRING_ATTRIB(Name,NAME,NULL);
-                MARSHALL_STRING_ATTRIB(NameFormat,NAMEFORMAT,NULL);
-                MARSHALL_STRING_ATTRIB(FriendlyName,FRIENDLYNAME,NULL);
-                MARSHALL_BOOLEAN_ATTRIB(isRequired,ISREQUIRED,NULL);
+                MARSHALL_STRING_ATTRIB(Name,NAME,nullptr);
+                MARSHALL_STRING_ATTRIB(NameFormat,NAMEFORMAT,nullptr);
+                MARSHALL_STRING_ATTRIB(FriendlyName,FRIENDLYNAME,nullptr);
+                MARSHALL_BOOLEAN_ATTRIB(isRequired,ISREQUIRED,nullptr);
                 marshallExtensionAttributes(domElement);
             }
 
@@ -1423,10 +1431,10 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_RequestedAttribute;
 
                void init() {
-                m_Index=NULL;
+                m_Index=nullptr;
                 m_isDefault=XML_BOOL_NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
                 m_pos_ServiceDescription=m_children.begin();
                 m_pos_RequestedAttribute=m_pos_ServiceDescription;
                 ++m_pos_RequestedAttribute;
@@ -1476,8 +1484,8 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_INTEGER_ATTRIB(Index,INDEX,NULL);
-                MARSHALL_BOOLEAN_ATTRIB(isDefault,ISDEFAULT,NULL);
+                MARSHALL_INTEGER_ATTRIB(Index,INDEX,nullptr);
+                MARSHALL_BOOLEAN_ATTRIB(isDefault,ISDEFAULT,nullptr);
             }
 
             void processChildElement(XMLObject* childXMLObject, const DOMElement* root) {
@@ -1488,8 +1496,8 @@ namespace opensaml {
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_INTEGER_ATTRIB(Index,INDEX,NULL);
-                PROC_BOOLEAN_ATTRIB(isDefault,ISDEFAULT,NULL);
+                PROC_INTEGER_ATTRIB(Index,INDEX,nullptr);
+                PROC_BOOLEAN_ATTRIB(isDefault,ISDEFAULT,nullptr);
                 AbstractXMLObjectUnmarshaller::processAttribute(attribute);
             }
         };
@@ -1501,7 +1509,7 @@ namespace opensaml {
             void init() {
                 m_AuthnRequestsSigned=XML_BOOL_NULL;
                 m_WantAssertionsSigned=XML_BOOL_NULL;
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
                 m_pos_AssertionConsumerService=m_pos_NameIDFormat;
                 ++m_pos_AssertionConsumerService;
             }
@@ -1561,8 +1569,8 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_BOOLEAN_ATTRIB(AuthnRequestsSigned,AUTHNREQUESTSSIGNED,NULL);
-                MARSHALL_BOOLEAN_ATTRIB(WantAssertionsSigned,WANTASSERTIONSSIGNED,NULL);
+                MARSHALL_BOOLEAN_ATTRIB(AuthnRequestsSigned,AUTHNREQUESTSSIGNED,nullptr);
+                MARSHALL_BOOLEAN_ATTRIB(WantAssertionsSigned,WANTASSERTIONSSIGNED,nullptr);
                 RoleDescriptorImpl::marshallAttributes(domElement);
             }
 
@@ -1579,8 +1587,8 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_AssertionIDRequestService;
 
             void init() {
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
                 m_pos_AuthnQueryService=m_pos_ContactPerson;
                 ++m_pos_AuthnQueryService;
                 m_pos_AssertionIDRequestService=m_pos_AuthnQueryService;
@@ -1641,8 +1649,8 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_AssertionIDRequestService;
 
             void init() {
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
                 m_pos_AuthzService=m_pos_ContactPerson;
                 ++m_pos_AuthzService;
                 m_pos_AssertionIDRequestService=m_pos_AuthzService;
@@ -1705,10 +1713,10 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_AttributeProfile;
 
             void init() {
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
                 m_pos_AttributeService=m_pos_ContactPerson;
                 ++m_pos_AttributeService;
                 m_pos_AssertionIDRequestService=m_pos_AttributeService;
@@ -1787,7 +1795,7 @@ namespace opensaml {
         {
             void init() {
                 m_WantAssertionsSigned=XML_BOOL_NULL;
-                m_children.push_back(NULL);
+                m_children.push_back(nullptr);
                 m_pos_NameIDFormat=m_pos_ContactPerson;
                 ++m_pos_NameIDFormat;
             }
@@ -1833,7 +1841,7 @@ namespace opensaml {
 
         protected:
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_BOOLEAN_ATTRIB(WantAssertionsSigned,WANTASSERTIONSSIGNED,NULL);
+                MARSHALL_BOOLEAN_ATTRIB(WantAssertionsSigned,WANTASSERTIONSSIGNED,nullptr);
                 RoleDescriptorImpl::marshallAttributes(domElement);
             }
 
@@ -1943,13 +1951,13 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_AffiliateMember;
 
             void init() {
-                m_ID=m_AffiliationOwnerID=NULL;
-                m_ValidUntil=m_CacheDuration=NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_Signature=NULL;
-                m_Extensions=NULL;
+                m_ID=m_AffiliationOwnerID=nullptr;
+                m_ValidUntil=m_CacheDuration=nullptr;
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_Signature=nullptr;
+                m_Extensions=nullptr;
                 m_pos_Signature=m_children.begin();
                 m_pos_Extensions=m_pos_Signature;
                 ++m_pos_Extensions;
@@ -2017,7 +2025,7 @@ namespace opensaml {
                     m_Signature->setContentReference(new opensaml::ContentReference(*this));
             }
 
-            IMPL_ID_ATTRIB(ID);
+            IMPL_ID_ATTRIB_EX(ID,ID,nullptr);
             IMPL_STRING_ATTRIB(AffiliationOwnerID);
             IMPL_DATETIME_ATTRIB(ValidUntil,SAMLTIME_MAX);
             IMPL_DURATION_ATTRIB(CacheDuration,0);
@@ -2048,11 +2056,16 @@ namespace opensaml {
             }
 
         protected:
+            void prepareForMarshalling() const {
+                if (m_Signature)
+                    declareNonVisibleNamespaces();
+            }
+
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_ID_ATTRIB(ID,ID,NULL);
-                MARSHALL_STRING_ATTRIB(AffiliationOwnerID,AFFILIATIONOWNERID,NULL);
-                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,NULL);
-                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,NULL);
+                MARSHALL_ID_ATTRIB(ID,ID,nullptr);
+                MARSHALL_STRING_ATTRIB(AffiliationOwnerID,AFFILIATIONOWNERID,nullptr);
+                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,nullptr);
+                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,nullptr);
                 marshallExtensionAttributes(domElement);
             }
 
@@ -2065,7 +2078,7 @@ namespace opensaml {
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_ID_ATTRIB(ID,ID,NULL);
+                PROC_ID_ATTRIB(ID,ID,nullptr);
                 unmarshallExtensionAttribute(attribute);
             }
         };
@@ -2081,17 +2094,17 @@ namespace opensaml {
             list<XMLObject*>::iterator m_pos_ContactPerson;
 
             void init() {
-                m_ID=m_EntityID=NULL;
-                m_ValidUntil=m_CacheDuration=NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_Signature=NULL;
-                m_Extensions=NULL;
-                m_AffiliationDescriptor=NULL;
-                m_Organization=NULL;
+                m_ID=m_EntityID=nullptr;
+                m_ValidUntil=m_CacheDuration=nullptr;
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_Signature=nullptr;
+                m_Extensions=nullptr;
+                m_AffiliationDescriptor=nullptr;
+                m_Organization=nullptr;
                 m_pos_Signature=m_children.begin();
                 m_pos_Extensions=m_pos_Signature;
                 ++m_pos_Extensions;
@@ -2225,7 +2238,7 @@ namespace opensaml {
                     m_Signature->setContentReference(new opensaml::ContentReference(*this));
             }
 
-            IMPL_ID_ATTRIB(ID);
+            IMPL_ID_ATTRIB_EX(ID,ID,nullptr);
             IMPL_STRING_ATTRIB(EntityID);
             IMPL_DATETIME_ATTRIB(ValidUntil,SAMLTIME_MAX);
             IMPL_DURATION_ATTRIB(CacheDuration,0);
@@ -2287,15 +2300,20 @@ namespace opensaml {
 
                 vector<RoleDescriptor*>::const_iterator i =
                     find_if(m_RoleDescriptors.begin(), m_RoleDescriptors.end(), ofTypeValidForProtocol(qname,protocol));
-                return (i!=m_RoleDescriptors.end()) ? *i : NULL;
+                return (i!=m_RoleDescriptors.end()) ? *i : nullptr;
             }
 
         protected:
+            void prepareForMarshalling() const {
+                if (m_Signature)
+                    declareNonVisibleNamespaces();
+            }
+
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_ID_ATTRIB(ID,ID,NULL);
-                MARSHALL_STRING_ATTRIB(EntityID,ENTITYID,NULL);
-                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,NULL);
-                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,NULL);
+                MARSHALL_ID_ATTRIB(ID,ID,nullptr);
+                MARSHALL_STRING_ATTRIB(EntityID,ENTITYID,nullptr);
+                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,nullptr);
+                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,nullptr);
                 marshallExtensionAttributes(domElement);
             }
 
@@ -2319,7 +2337,7 @@ namespace opensaml {
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_ID_ATTRIB(ID,ID,NULL);
+                PROC_ID_ATTRIB(ID,ID,nullptr);
                 unmarshallExtensionAttribute(attribute);
             }
         };
@@ -2332,12 +2350,12 @@ namespace opensaml {
             public AbstractXMLObjectUnmarshaller
         {
             void init() {
-                m_ID=m_Name=NULL;
-                m_ValidUntil=m_CacheDuration=NULL;
-                m_children.push_back(NULL);
-                m_children.push_back(NULL);
-                m_Signature=NULL;
-                m_Extensions=NULL;
+                m_ID=m_Name=nullptr;
+                m_ValidUntil=m_CacheDuration=nullptr;
+                m_children.push_back(nullptr);
+                m_children.push_back(nullptr);
+                m_Signature=nullptr;
+                m_Extensions=nullptr;
                 m_pos_Signature=m_children.begin();
                 m_pos_Extensions=m_pos_Signature;
                 ++m_pos_Extensions;
@@ -2405,7 +2423,7 @@ namespace opensaml {
                     m_Signature->setContentReference(new opensaml::ContentReference(*this));
             }
 
-            IMPL_ID_ATTRIB(ID);
+            IMPL_ID_ATTRIB_EX(ID,ID,nullptr);
             IMPL_STRING_ATTRIB(Name);
             IMPL_DATETIME_ATTRIB(ValidUntil,SAMLTIME_MAX);
             IMPL_DURATION_ATTRIB(CacheDuration,0);
@@ -2414,11 +2432,16 @@ namespace opensaml {
             IMPL_TYPED_CHILDREN(EntitiesDescriptor,m_children.end());
 
         protected:
+            void prepareForMarshalling() const {
+                if (m_Signature)
+                    declareNonVisibleNamespaces();
+            }
+
             void marshallAttributes(DOMElement* domElement) const {
-                MARSHALL_ID_ATTRIB(ID,ID,NULL);
-                MARSHALL_STRING_ATTRIB(Name,NAME,NULL);
-                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,NULL);
-                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,NULL);
+                MARSHALL_ID_ATTRIB(ID,ID,nullptr);
+                MARSHALL_STRING_ATTRIB(Name,NAME,nullptr);
+                MARSHALL_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,nullptr);
+                MARSHALL_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,nullptr);
             }
 
             void processChildElement(XMLObject* childXMLObject, const DOMElement* root) {
@@ -2430,10 +2453,10 @@ namespace opensaml {
             }
 
             void processAttribute(const DOMAttr* attribute) {
-                PROC_ID_ATTRIB(ID,ID,NULL);
-                PROC_STRING_ATTRIB(Name,NAME,NULL);
-                PROC_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,NULL);
-                PROC_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,NULL);
+                PROC_ID_ATTRIB(ID,ID,nullptr);
+                PROC_STRING_ATTRIB(Name,NAME,nullptr);
+                PROC_DATETIME_ATTRIB(ValidUntil,VALIDUNTIL,nullptr);
+                PROC_DATETIME_ATTRIB(CacheDuration,CACHEDURATION,nullptr);
             }
         };
 
@@ -2481,6 +2504,107 @@ namespace opensaml {
                 AbstractXMLObjectUnmarshaller::processChildElement(childXMLObject,root);
             }
         };
+
+        class SAML_DLLLOCAL DigestMethodImpl : public virtual DigestMethod,
+            public AbstractComplexElement,
+            public AbstractDOMCachingXMLObject,
+            public AbstractXMLObjectMarshaller,
+            public AbstractXMLObjectUnmarshaller
+        {
+        public:
+            virtual ~DigestMethodImpl() {
+                XMLString::release(&m_Algorithm);
+            }
+
+            DigestMethodImpl(const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix, const xmltooling::QName* schemaType)
+                : AbstractXMLObject(nsURI, localName, prefix, schemaType) {
+                m_Algorithm = nullptr;
+            }
+
+            DigestMethodImpl(const DigestMethodImpl& src)
+                    : AbstractXMLObject(src), AbstractComplexElement(src), AbstractDOMCachingXMLObject(src) {
+                setAlgorithm(src.getAlgorithm());
+                VectorOf(XMLObject) v=getUnknownXMLObjects();
+                for (vector<XMLObject*>::const_iterator i=src.m_UnknownXMLObjects.begin(); i!=src.m_UnknownXMLObjects.end(); ++i)
+                    v.push_back((*i)->clone());
+            }
+
+            IMPL_STRING_ATTRIB(Algorithm);
+
+            IMPL_XMLOBJECT_CLONE(DigestMethod);
+            IMPL_XMLOBJECT_CHILDREN(UnknownXMLObject,m_children.end());
+
+        protected:
+            void marshallAttributes(DOMElement* domElement) const {
+                MARSHALL_STRING_ATTRIB(Algorithm,ALGORITHM,nullptr);
+            }
+
+            void processChildElement(XMLObject* childXMLObject, const DOMElement* root) {
+                // Unknown child.
+                getUnknownXMLObjects().push_back(childXMLObject);
+            }
+
+            void processAttribute(const DOMAttr* attribute) {
+                PROC_STRING_ATTRIB(Algorithm,ALGORITHM,nullptr);
+            }
+        };
+
+        class SAML_DLLLOCAL SigningMethodImpl : public virtual SigningMethod,
+            public AbstractComplexElement,
+            public AbstractDOMCachingXMLObject,
+            public AbstractXMLObjectMarshaller,
+            public AbstractXMLObjectUnmarshaller
+        {
+        public:
+            virtual ~SigningMethodImpl() {
+                XMLString::release(&m_Algorithm);
+                XMLString::release(&m_MinKeySize);
+                XMLString::release(&m_MaxKeySize);
+            }
+
+            SigningMethodImpl(const XMLCh* nsURI, const XMLCh* localName, const XMLCh* prefix, const xmltooling::QName* schemaType)
+                : AbstractXMLObject(nsURI, localName, prefix, schemaType) {
+                m_Algorithm = nullptr;
+                m_MinKeySize = nullptr;
+                m_MaxKeySize = nullptr;
+            }
+
+            SigningMethodImpl(const SigningMethodImpl& src)
+                    : AbstractXMLObject(src), AbstractComplexElement(src), AbstractDOMCachingXMLObject(src) {
+                setAlgorithm(src.getAlgorithm());
+                setMinKeySize(src.m_MinKeySize);
+                setMaxKeySize(src.m_MaxKeySize);
+                VectorOf(XMLObject) v=getUnknownXMLObjects();
+                for (vector<XMLObject*>::const_iterator i=src.m_UnknownXMLObjects.begin(); i!=src.m_UnknownXMLObjects.end(); ++i)
+                    v.push_back((*i)->clone());
+            }
+
+            IMPL_XMLOBJECT_CLONE(SigningMethod);
+            IMPL_XMLOBJECT_CHILDREN(UnknownXMLObject,m_children.end());
+
+            IMPL_STRING_ATTRIB(Algorithm);
+            IMPL_INTEGER_ATTRIB(MinKeySize);
+            IMPL_INTEGER_ATTRIB(MaxKeySize);
+
+        protected:
+            void marshallAttributes(DOMElement* domElement) const {
+                MARSHALL_STRING_ATTRIB(Algorithm,ALGORITHM,nullptr);
+                MARSHALL_INTEGER_ATTRIB(MinKeySize,MINKEYSIZE,nullptr);
+                MARSHALL_INTEGER_ATTRIB(MaxKeySize,MAXKEYSIZE,nullptr);
+            }
+
+            void processChildElement(XMLObject* childXMLObject, const DOMElement* root) {
+                // Unknown child.
+                getUnknownXMLObjects().push_back(childXMLObject);
+            }
+
+            void processAttribute(const DOMAttr* attribute) {
+                PROC_STRING_ATTRIB(Algorithm,ALGORITHM,nullptr);
+                PROC_INTEGER_ATTRIB(MinKeySize,MINKEYSIZE,nullptr);
+                PROC_INTEGER_ATTRIB(MaxKeySize,MAXKEYSIZE,nullptr);
+            }
+        };
+
     };
 };
 
@@ -2548,6 +2672,8 @@ IMPL_XMLOBJECTBUILDER(TelephoneNumber);
 IMPL_XMLOBJECTBUILDER(ActionNamespace);
 IMPL_XMLOBJECTBUILDER(SourceID);
 IMPL_XMLOBJECTBUILDER(EntityAttributes);
+IMPL_XMLOBJECTBUILDER(DigestMethod);
+IMPL_XMLOBJECTBUILDER(SigningMethod);
 
 #ifdef HAVE_COVARIANT_RETURNS
 RoleDescriptor* RoleDescriptorBuilder::buildObject(
@@ -2560,6 +2686,101 @@ xmltooling::XMLObject* RoleDescriptorBuilder::buildObject(
     return new RoleDescriptorTypeImpl(nsURI,localName,prefix,schemaType);
 }
 
+const DigestMethod* RoleDescriptor::getDigestMethod() const
+{
+    bool roleLevel = false;
+    XMLToolingConfig& conf = XMLToolingConfig::getConfig();
+
+    if (getExtensions()) {
+        const vector<XMLObject*>& exts = const_cast<const Extensions*>(getExtensions())->getUnknownXMLObjects();
+        for (vector<XMLObject*>::const_iterator i = exts.begin(); i != exts.end(); ++i) {
+            const opensaml::saml2md::DigestMethod* dm = dynamic_cast<opensaml::saml2md::DigestMethod*>(*i);
+            if (dm) {
+                if (dm->getAlgorithm() && conf.isXMLAlgorithmSupported(dm->getAlgorithm()))
+                    return dm;
+                roleLevel = true;
+            }
+        }
+    }
+
+    if (!roleLevel) {
+        const EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(getParent());
+        if (entity && entity->getExtensions()) {
+            const vector<XMLObject*>& exts = const_cast<const Extensions*>(entity->getExtensions())->getUnknownXMLObjects();
+            for (vector<XMLObject*>::const_iterator i = exts.begin(); i != exts.end(); ++i) {
+                const opensaml::saml2md::DigestMethod* dm = dynamic_cast<opensaml::saml2md::DigestMethod*>(*i);
+                if (dm && dm->getAlgorithm() && conf.isXMLAlgorithmSupported(dm->getAlgorithm()))
+                    return dm;
+            }
+        }
+    }
+
+    return nullptr;
+}
+
+pair<const SigningMethod*,const Credential*> RoleDescriptor::getSigningMethod(const CredentialResolver& resolver, CredentialCriteria& cc) const
+{
+    bool roleLevel = false;
+    XMLToolingConfig& conf = XMLToolingConfig::getConfig();
+
+    if (getExtensions()) {
+        const vector<XMLObject*>& exts = const_cast<const Extensions*>(getExtensions())->getUnknownXMLObjects();
+        for (vector<XMLObject*>::const_iterator i = exts.begin(); i != exts.end(); ++i) {
+            const SigningMethod* sm = dynamic_cast<SigningMethod*>(*i);
+            if (sm) {
+                roleLevel = true;
+                if (sm->getAlgorithm() && conf.isXMLAlgorithmSupported(sm->getAlgorithm())) {
+                    cc.setXMLAlgorithm(sm->getAlgorithm());
+                    pair<bool,int> minsize = sm->getMinKeySize(), maxsize = sm->getMaxKeySize();
+                    if (minsize.first || maxsize.first) {
+                        cc.setKeySize(minsize.first ? minsize.second : 0);
+                        cc.setMaxKeySize(maxsize.first ? maxsize.second : UINT_MAX);
+                    }
+                    else {
+                        cc.setKeySize(0);
+                        cc.setMaxKeySize(0);
+                    }
+                    const Credential* cred = resolver.resolve(&cc);
+                    if (cred)
+                        return make_pair(sm, cred);
+                }
+            }
+        }
+    }
+
+    if (!roleLevel) {
+        const EntityDescriptor* entity = dynamic_cast<EntityDescriptor*>(getParent());
+        if (entity && entity->getExtensions()) {
+            const vector<XMLObject*>& exts = const_cast<const Extensions*>(entity->getExtensions())->getUnknownXMLObjects();
+            for (vector<XMLObject*>::const_iterator i = exts.begin(); i != exts.end(); ++i) {
+                const SigningMethod* sm = dynamic_cast<SigningMethod*>(*i);
+                if (sm) {
+                    if (sm->getAlgorithm() && conf.isXMLAlgorithmSupported(sm->getAlgorithm())) {
+                        cc.setXMLAlgorithm(sm->getAlgorithm());
+                        pair<bool,int> minsize = sm->getMinKeySize(), maxsize = sm->getMaxKeySize();
+                        if (minsize.first || maxsize.first) {
+                            cc.setKeySize(minsize.first ? minsize.second : 0);
+                            cc.setMaxKeySize(maxsize.first ? maxsize.second : UINT_MAX);
+                        }
+                        else {
+                            cc.setKeySize(0);
+                            cc.setMaxKeySize(0);
+                        }
+                        const Credential* cred = resolver.resolve(&cc);
+                        if (cred)
+                            return make_pair(sm, cred);
+                    }
+                }
+            }
+        }
+    }
+
+    cc.setKeySize(0);
+    cc.setMaxKeySize(0);
+    cc.setXMLAlgorithm(nullptr);
+    return pair<const SigningMethod*,const Credential*>(nullptr, resolver.resolve(&cc));
+}
+
 const XMLCh ActionNamespace::LOCAL_NAME[] =             UNICODE_LITERAL_15(A,c,t,i,o,n,N,a,m,e,s,p,a,c,e);
 const XMLCh AdditionalMetadataLocation::LOCAL_NAME[] =  UNICODE_LITERAL_26(A,d,d,i,t,i,o,n,a,l,M,e,t,a,d,a,t,a,L,o,c,a,t,i,o,n);
 const XMLCh AdditionalMetadataLocation::TYPE_NAME[] =   UNICODE_LITERAL_30(A,d,d,i,t,i,o,n,a,l,M,e,t,a,d,a,t,a,L,o,c,a,t,i,o,n,T,y,p,e);
@@ -2600,6 +2821,9 @@ const XMLCh ContactPerson::CONTACT_SUPPORT[] =          UNICODE_LITERAL_7(s,u,p,
 const XMLCh ContactPerson::CONTACT_ADMINISTRATIVE[] =   UNICODE_LITERAL_14(a,d,m,i,n,i,s,t,r,a,t,i,v,e);
 const XMLCh ContactPerson::CONTACT_BILLING[] =          UNICODE_LITERAL_7(b,i,l,l,i,n,g);
 const XMLCh ContactPerson::CONTACT_OTHER[] =            UNICODE_LITERAL_5(o,t,h,e,r);
+const XMLCh DigestMethod::LOCAL_NAME[] =                UNICODE_LITERAL_12(D,i,g,e,s,t,M,e,t,h,o,d);
+const XMLCh DigestMethod::TYPE_NAME[] =                 UNICODE_LITERAL_16(D,i,g,e,s,t,M,e,t,h,o,d,T,y,p,e);
+const XMLCh DigestMethod::ALGORITHM_ATTRIB_NAME[] =     UNICODE_LITERAL_9(A,l,g,o,r,i,t,h,m);
 const XMLCh EmailAddress::LOCAL_NAME[] =                UNICODE_LITERAL_12(E,m,a,i,l,A,d,d,r,e,s,s);
 const XMLCh EndpointType::LOCAL_NAME[] =                {chNull};
 const XMLCh EndpointType::TYPE_NAME[] =                 UNICODE_LITERAL_12(E,n,d,p,o,i,n,t,T,y,p,e);
@@ -2659,6 +2883,11 @@ const XMLCh RoleDescriptor::PROTOCOLSUPPORTENUMERATION_ATTRIB_NAME[] =  UNICODE_
 const XMLCh RoleDescriptor::ERRORURL_ATTRIB_NAME[] =    UNICODE_LITERAL_8(e,r,r,o,r,U,R,L);
 const XMLCh ServiceDescription::LOCAL_NAME[] =          UNICODE_LITERAL_18(S,e,r,v,i,c,e,D,e,s,c,r,i,p,t,i,o,n);
 const XMLCh ServiceName::LOCAL_NAME[] =                 UNICODE_LITERAL_11(S,e,r,v,i,c,e,N,a,m,e);
+const XMLCh SigningMethod::LOCAL_NAME[] =               UNICODE_LITERAL_13(S,i,g,n,i,n,g,M,e,t,h,o,d);
+const XMLCh SigningMethod::TYPE_NAME[] =                UNICODE_LITERAL_17(S,i,g,n,i,n,g,M,e,t,h,o,d,T,y,p,e);
+const XMLCh SigningMethod::ALGORITHM_ATTRIB_NAME[] =    UNICODE_LITERAL_9(A,l,g,o,r,i,t,h,m);
+const XMLCh SigningMethod::MINKEYSIZE_ATTRIB_NAME[] =   UNICODE_LITERAL_10(M,i,n,K,e,y,S,i,z,e);
+const XMLCh SigningMethod::MAXKEYSIZE_ATTRIB_NAME[] =   UNICODE_LITERAL_10(M,a,x,K,e,y,S,i,z,e);
 const XMLCh SingleLogoutService::LOCAL_NAME[] =         UNICODE_LITERAL_19(S,i,n,g,l,e,L,o,g,o,u,t,S,e,r,v,i,c,e);
 const XMLCh SingleSignOnService::LOCAL_NAME[] =         UNICODE_LITERAL_19(S,i,n,g,l,e,S,i,g,n,O,n,S,e,r,v,i,c,e);
 const XMLCh SourceID::LOCAL_NAME[] =                    UNICODE_LITERAL_8(S,o,u,r,c,e,I,D);