org.opensaml.xml.security.trust.ExplicitX509CertificateTrustEvaluator Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of xmltooling Show documentation
XMLTooling-J is a low-level library that may be used to construct libraries that allow developers to work with XML in a Java beans manner.
There is a newer version: 1.4.2
Show newest version
/*
 * Licensed to the University Corporation for Advanced Internet Development, 
 * Inc. (UCAID) under one or more contributor license agreements.  See the 
 * NOTICE file distributed with this work for additional information regarding
 * copyright ownership. The UCAID licenses this file to You under the Apache 
 * License, Version 2.0 (the "License"); you may not use this file except in 
 * compliance with the License.  You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.opensaml.xml.security.trust;

import java.security.cert.X509Certificate;

import org.opensaml.xml.security.credential.Credential;
import org.opensaml.xml.security.x509.X509Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Auxillary trust evaluator for evaluating an untrusted X509 certificate or credential against a trusted certificate or
 * credential. Trust is established if the untrusted certificate supplied (or the certificate obtained from the
 * untrusted credential's {@link X509Credential#getEntityCertificate()}) matches one of the trusted certificates
 * supplied.
 */
public class ExplicitX509CertificateTrustEvaluator {

    /** Class logger. */
    private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEvaluator.class);

    /**
     * Evaluate trust.
     * 
     * @param untrustedCertificate the untrusted certificate to evaluate
     * @param trustedCertificate basis for trust
     * @return true if trust can be established, false otherwise
     */
    public boolean validate(X509Certificate untrustedCertificate, X509Certificate trustedCertificate) {
        return untrustedCertificate.equals(trustedCertificate);
    }

    /**
     * Evaluate trust.
     * 
     * @param untrustedCertificate the untrusted certificate to evaluate
     * @param trustedCertificates basis for trust
     * @return true if trust can be established, false otherwise
     */
    public boolean validate(X509Certificate untrustedCertificate, Iterable trustedCertificates) {
        for (X509Certificate trustedCertificate : trustedCertificates) {
            if (untrustedCertificate.equals(trustedCertificate)) {
                return true;
            }
        }
        return false;
    }

    /**
     * Evaluate trust.
     * 
     * @param untrustedCredential the untrusted X509Credential to evaluate
     * @param trustedCredential basis for trust
     * @return true if trust can be established, false otherwise
     */
    public boolean validate(X509Credential untrustedCredential, X509Credential trustedCredential) {

        X509Certificate untrustedCertificate = untrustedCredential.getEntityCertificate();
        X509Certificate trustedCertificate = trustedCredential.getEntityCertificate();
        if (untrustedCertificate == null) {
            log.debug("Untrusted credential contained no entity certificate, unable to evaluate");
            return false;
        } else if (trustedCertificate == null) {
            log.debug("Trusted credential contained no entity certificate, unable to evaluate");
            return false;
        }

        if (validate(untrustedCertificate, trustedCertificate)) {
            log.debug("Successfully validated untrusted credential against trusted certificate");
            return true;
        }
        
        log.debug("Failed to validate untrusted credential against trusted certificate");
        return false;
    }

    /**
     * Evaluate trust.
     * 
     * @param untrustedCredential the untrusted X509Credential to evaluate
     * @param trustedCredentials basis for trust
     * @return true if trust can be established, false otherwise
     */
    public boolean validate(X509Credential untrustedCredential, Iterable trustedCredentials) {

        for (Credential trustedCredential : trustedCredentials) {
            if (!(trustedCredential instanceof X509Credential)) {
                log.debug("Skipping evaluation against trusted, non-X509Credential");
                continue;
            }
            X509Credential trustedX509Credential = (X509Credential) trustedCredential;
            if (validate(untrustedCredential, trustedX509Credential)) {
                return true;
            }
        }

        return false;
    }

}