- // Pull the certificate chain out of the KeyInfo using an inline KeyResolver.
- KeyResolver::ResolvedCertificates certs;
- if (!keyInfo || 0==m_inlineResolver->resolveCertificates(keyInfo, certs)) {
+ if (!keyInfo) {
+ log.error("unable to perform PKIX validation, KeyInfo not present");
+ return false;
+ }
+
+ const KeyInfoResolver* inlineResolver = m_keyInfoResolver;
+ if (!inlineResolver)
+ inlineResolver = XMLToolingConfig::getConfig().getKeyInfoResolver();
+ if (!inlineResolver) {
+ log.error("unable to perform PKIX validation, no KeyInfoResolver available");
+ return false;
+ }
+
+ // Pull the certificate chain out of the signature.
+ X509Credential* x509cred;
+ auto_ptr<Credential> cred(inlineResolver->resolve(keyInfo,X509Credential::RESOLVE_CERTS));
+ if (!cred.get() || !(x509cred=dynamic_cast<X509Credential*>(cred.get()))) {
+ log.error("unable to perform PKIX validation, KeyInfo does not contain any certificates");
+ return false;
+ }
+ const vector<XSECCryptoX509*>& certs = x509cred->getEntityCertificateChain();
+ if (certs.empty()) {