1 files changed, 128 insertions, 0 deletions
diff --git a/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java
new file mode 100644
index 00000000..286c1999
--- /dev/null
+++ b/eaaf_modules/eaaf_module_pvp2_core/src/main/java/at/gv/egiz/eaaf/modules/pvp2/impl/validation/metadata/AbstractMetadataSignatureFilter.java
@@ -0,0 +1,128 @@
+/*******************************************************************************
+ *******************************************************************************/
+package at.gv.egiz.eaaf.modules.pvp2.impl.validation.metadata;
+
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+
+import org.opensaml.saml2.metadata.EntitiesDescriptor;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml2.metadata.provider.MetadataFilter;
+import org.opensaml.xml.XMLObject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import at.gv.egiz.eaaf.core.exceptions.EAAFException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.PVP2MetadataException;
+import at.gv.egiz.eaaf.modules.pvp2.exception.SignatureValidationException;
+
+public abstract class AbstractMetadataSignatureFilter implements MetadataFilter {
+	private static final Logger log = LoggerFactory.getLogger(AbstractMetadataSignatureFilter.class);
+		
+	public void doFilter(XMLObject metadata) throws SignatureValidationException {
+		try {
+			if (metadata instanceof EntitiesDescriptor) {
+				EntitiesDescriptor entitiesDescriptor = (EntitiesDescriptor) metadata;
+				if(entitiesDescriptor.getSignature() == null) {
+					throw new PVP2MetadataException("Root element of metadata file has to be signed", null);
+				}
+				processEntitiesDescriptor(entitiesDescriptor);
+				
+				
+				if (entitiesDescriptor.getEntityDescriptors().size() == 0) {
+					throw new PVP2MetadataException("No valid entity in metadata "
+							+ entitiesDescriptor.getName() + ". Metadata is not loaded.", null);
+				}
+				
+				
+			} else if (metadata instanceof EntityDescriptor) {
+				EntityDescriptor entityDescriptor = (EntityDescriptor) metadata;
+				processEntityDescriptorr(entityDescriptor);
+				
+			} else {
+				throw new PVP2MetadataException("Invalid Metadata file Root element is no EntitiesDescriptor", null);
+			}
+			
+			
+			
+			log.info("Metadata signature policy check done OK");
+		} catch (EAAFException e) {
+			log.warn("Metadata signature policy check FAILED.", e);
+			throw new SignatureValidationException(e);
+		}
+	}
+	
+	/**
+	 * Signature verification of a SAML2 EntityDescriptor element
+	 * 
+	 * @param desc 
+	 * @throws PVP2MetadataException if the signature is not valid or can not verified
+	 */
+	protected abstract void verify(EntityDescriptor desc) throws PVP2MetadataException;
+	
+	/**
+	 * Signature verification of a SAML2 EntitiesDescriptor element
+	 * 
+	 * @param desc
+	 * @throws PVP2MetadataException if the signature is not valid or can not verified
+	 */
+	protected abstract void verify(EntitiesDescriptor desc) throws PVP2MetadataException;
+	
+	/**
+	 * Verify a EntityDescriptor element of an EntitiesDescriptor
+	 * 
+	 * @param entity EntityDescriptor to verify
+	 * @param desc Full EntitiesDescriptor  that contains the EntityDescriptor
+	 * @throws PVP2MetadataException
+	 */
+	protected abstract void verify(EntityDescriptor entity, EntitiesDescriptor desc) throws PVP2MetadataException;
+	
+	
+	private void processEntityDescriptorr(EntityDescriptor desc) throws EAAFException {				
+		verify(desc);
+		
+	}
+	
+	private void processEntitiesDescriptor(EntitiesDescriptor desc) throws EAAFException {
+		Iterator<EntitiesDescriptor> entID = desc.getEntitiesDescriptors().iterator();
+		
+		if(desc.getSignature() != null) {
+			verify(desc);
+			
+		}
+		
+		while(entID.hasNext()) {
+			processEntitiesDescriptor(entID.next());
+		}
+				
+		Iterator<EntityDescriptor> entIT = desc.getEntityDescriptors().iterator();
+		List<EntityDescriptor> verifiedEntIT = new ArrayList<EntityDescriptor>();
+		
+		//check every Entity		
+		while(entIT.hasNext()) {			
+			EntityDescriptor entity = entIT.next();
+			log.debug("Validate metadata for entityID: " + entity.getEntityID() + " ..... ");
+			try {
+				verify(entity, desc);
+				
+				//add entity to verified entity-list					
+				verifiedEntIT.add(entity);
+				log.debug("Metadata for entityID: " + entity.getEntityID() + " valid");
+				
+				
+			} catch (Exception e) {
+				//remove entity of signature can not be verified.
+				log.info("Entity " + entity.getEntityID() + " is removed from metadata " 
+						+ desc.getName() + ". Entity verification error: " + e.getMessage());
+
+			}
+			
+		}		
+		
+		//set only verified entity elements
+		desc.getEntityDescriptors().clear();
+		desc.getEntityDescriptors().addAll(verifiedEntIT);
+	}
+
+}