Package se.idsec.signservice.security.sign.xml.impl

Class DefaultXMLSignatureValidator

java.lang.Object

se.idsec.signservice.security.sign.xml.impl.DefaultXMLSignatureValidator

All Implemented Interfaces:

SignatureValidator<Document>, XMLSignatureValidator

public class DefaultXMLSignatureValidator
extends Object
implements XMLSignatureValidator

Default implementation of the XMLSignatureValidator interface.

Note that this implementation only supports validation of signatures that covers the supplied document.

Author:

Martin Lindström (martin@idsec.se), Stefan Santesson (stefan@idsec.se)

Field Summary

Fields

Modifier and Type	Field	Description
protected boolean	xadesProcessing	Flag that tells if the validator should handle XAdES signatures.

Constructor Summary

Constructors

Constructor	Description
DefaultXMLSignatureValidator()	Constructor setting up the validator so that no required certificates are configured and no certificate path validation is performed.
DefaultXMLSignatureValidator(X509Certificate acceptedSignerCertificate)	Constructor setting up the validator to require that the signature is signed using the supplied certificate.
DefaultXMLSignatureValidator(List<X509Certificate> acceptedSignerCertificates)	Constructor setting up the validator to require that the signature is signed using any of the supplied certificates.
DefaultXMLSignatureValidator(CertificateValidator certificateValidator)	Constructor setting up the validator to perform a certificate validation of the signer certificate using the supplied certificate validator instance.

Method Summary

Modifier and Type	Method	Description
protected List<X509Certificate>	getAdditionalCertificates(org.apache.xml.security.keys.KeyInfo keyInfo, X509Certificate signerCertificate)	Extracts all certificates from the supplied KeyInfo except for the actual signer certificate.
CertificateValidator	getCertificateValidator()
List<X509Certificate>	getRequiredSignerCertificates()
boolean	isSigned(Document document)
protected void	registerXadesIdNodes(Document document)	Looks for any xades:SignedProperties elements and registers an ID attribute for the elements that are found.
void	setXadesProcessing(boolean xadesProcessing)	Sets flag that tells whether this validator should handle XAdES processing.
List<SignatureValidationResult>	validate(Document document)
protected List<SignatureValidationResult>	validate(Document document, List<Element> signatures)	Validates the supplied signatures.
List<SignatureValidationResult>	validate(Document document, XMLSignatureLocation signatureLocation)	Validates the signature(s) of supplied document.
protected DefaultXMLSignatureValidationResult	validateSignature(Element signature, String signatureUriReference)	Validates the signature value and checks that the signer certificate is accepted.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

xadesProcessing

protected boolean xadesProcessing

Flag that tells if the validator should handle XAdES signatures.

Constructor Details

DefaultXMLSignatureValidator

public DefaultXMLSignatureValidator()

Constructor setting up the validator so that no required certificates are configured and no certificate path validation is performed. This means that no control of the signer certificate will be performed.

DefaultXMLSignatureValidator

public DefaultXMLSignatureValidator(X509Certificate acceptedSignerCertificate)

Constructor setting up the validator to require that the signature is signed using the supplied certificate.

Parameters:

acceptedSignerCertificate - required signer certificate

DefaultXMLSignatureValidator

public DefaultXMLSignatureValidator(List<X509Certificate> acceptedSignerCertificates)

Constructor setting up the validator to require that the signature is signed using any of the supplied certificates.

Parameters:

acceptedSignerCertificates - required signer certificates

DefaultXMLSignatureValidator

public DefaultXMLSignatureValidator(CertificateValidator certificateValidator)

Constructor setting up the validator to perform a certificate validation of the signer certificate using the supplied certificate validator instance.

Parameters:

certificateValidator - certificate validator instance

Method Details

validate

public List<SignatureValidationResult> validate(Document document)
                                         throws SignatureException

Specified by:

validate in interface SignatureValidator<Document>

Throws:

SignatureException

validate

public List<SignatureValidationResult> validate(Document document,
 XMLSignatureLocation signatureLocation)
                                         throws SignatureException

Validates the signature(s) of supplied document.

If the signatureLocation parameter is non null only that signature of the document will be validated, even if there are more signatures.

Specified by:

validate in interface XMLSignatureValidator

Parameters:

document - the document to validate

signatureLocation - tells where the signature can be found

Returns:

a validation result containing the details from a signature validation

Throws:

SignatureException - for errors during the validation process (pure signature validation errors are reported in the returned result)

validate

protected List<SignatureValidationResult> validate(Document document,
 List<Element> signatures)

Validates the supplied signatures.

Parameters:

document - the document containing the signatures

signatures - the signatures

Returns:

a list of result objects

validateSignature

protected DefaultXMLSignatureValidationResult validateSignature(Element signature,
 String signatureUriReference)

Validates the signature value and checks that the signer certificate is accepted.

Parameters:

signature - the signature element

signatureUriReference - the signature URI reference

Returns:

a validation result

getAdditionalCertificates

protected List<X509Certificate> getAdditionalCertificates(org.apache.xml.security.keys.KeyInfo keyInfo,
 X509Certificate signerCertificate)

Extracts all certificates from the supplied KeyInfo except for the actual signer certificate.

Parameters:

keyInfo - the KeyInfo

signerCertificate - the signer certificate

Returns:

a list of certificates

isSigned

public boolean isSigned(Document document)
                 throws IllegalArgumentException

Specified by:

isSigned in interface SignatureValidator<Document>

Throws:

IllegalArgumentException

getRequiredSignerCertificates

public List<X509Certificate> getRequiredSignerCertificates()

Specified by:

getRequiredSignerCertificates in interface SignatureValidator<Document>

getCertificateValidator

public CertificateValidator getCertificateValidator()

Specified by:

getCertificateValidator in interface SignatureValidator<Document>

setXadesProcessing

public void setXadesProcessing(boolean xadesProcessing)

Sets flag that tells whether this validator should handle XAdES processing. The default is true

Parameters:

xadesProcessing - whether to process XAdES

registerXadesIdNodes

protected void registerXadesIdNodes(Document document)

Looks for any xades:SignedProperties elements and registers an ID attribute for the elements that are found.

Parameters:

document - the document to manipulate