fix bug in eIDAS SAML-engine that does not allow SIGNATURE_RSA_SHAxxx_MGF1 algorithms for XML signatures

1 files changed, 64 insertions, 3 deletions

diff --git a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOASWSigner.java b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOASWSigner.java
index 302c12aaa..5cf5e83ec 100644
--- a/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOASWSigner.java
+++ b/id/server/modules/moa-id-module-eIDAS/src/main/java/at/gv/egovernment/moa/id/auth/modules/eidas/config/MOASWSigner.java
@@ -22,12 +22,22 @@
  */
 package at.gv.egovernment.moa.id.auth.modules.eidas.config;
 
+import java.util.Locale;
 import java.util.Map;
 
+import org.apache.commons.lang.StringUtils;
+import org.apache.xml.security.signature.XMLSignature;
+import org.opensaml.xml.signature.SignatureConstants;
+
+import com.google.common.collect.ImmutableSet;
+
 import at.gv.egovernment.moa.id.auth.modules.eidas.Constants;
+import at.gv.egovernment.moa.id.auth.modules.eidas.utils.MOAWhiteListConfigurator;
+import at.gv.egovernment.moaspss.logging.Logger;
 import eu.eidas.auth.engine.configuration.SamlEngineConfigurationException;
 import eu.eidas.auth.engine.configuration.dom.ConfigurationAdapter;
 import eu.eidas.auth.engine.configuration.dom.ConfigurationKey;
+import eu.eidas.auth.engine.configuration.dom.KeyStoreSignatureConfigurator;
 import eu.eidas.auth.engine.core.impl.KeyStoreProtocolSigner;
 import eu.eidas.samlengineconfig.CertificateConfigurationManager;
 
@@ -37,20 +47,71 @@ import eu.eidas.samlengineconfig.CertificateConfigurationManager;
  */
 public class MOASWSigner extends KeyStoreProtocolSigner {
 
+	private static Map<String, String> props;
+	private ImmutableSet<String> sigAlgWhiteList = null;
+	
+    private static final ImmutableSet<String> ALLOWED_ALGORITHMS_FOR_VERIFYING =
+            ImmutableSet.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256,
+                            SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384,
+                            SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512,
+                            // RIPEMD is allowed to verify
+                            SignatureConstants.ALGO_ID_SIGNATURE_RSA_RIPEMD160,
+                            SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256,
+                            SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA384,
+                            SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA512,
+
+                            //Set other algorithms which are not supported by openSAML in default 
+                            StringUtils.lowerCase(XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA1_MGF1, Locale.ENGLISH),
+                            StringUtils.lowerCase(XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA224_MGF1, Locale.ENGLISH),
+                            StringUtils.lowerCase(XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA256_MGF1, Locale.ENGLISH),
+                            StringUtils.lowerCase(XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA384_MGF1, Locale.ENGLISH),
+                            StringUtils.lowerCase(XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA512_MGF1, Locale.ENGLISH));
+
+    private static final ImmutableSet<String> DEFAULT_ALGORITHM_WHITE_LIST =
+            ImmutableSet.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256,
+                            SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384,
+                            SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512,
+                            // RIPEMD is not allowed to sign
+                            SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256,
+                            SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA384,
+                            SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA512,
+                            
+                            //Set other algorithms which are not supported by openSAML in default 
+                            StringUtils.lowerCase(XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA256_MGF1, Locale.ENGLISH));
+	
 	public MOASWSigner(Map<String, String> properties) throws SamlEngineConfigurationException {
 		super(properties);
-	
+		props = properties;
+			
 	}
 		
 	/**
 	 * @param configManager
 	 * @throws SamlEngineConfigurationException
 	 */
-	public MOASWSigner(CertificateConfigurationManager configManager) throws SamlEngineConfigurationException { 
-		super(ConfigurationAdapter.adapt(configManager).getInstances().get(Constants.eIDAS_SAML_ENGINE_NAME).getConfigurationEntries().get(ConfigurationKey.SIGNATURE_CONFIGURATION.getKey()).getParameters());
+	public MOASWSigner(CertificateConfigurationManager configManager) throws SamlEngineConfigurationException {
+		super(props = ConfigurationAdapter.adapt(configManager).getInstances().get(Constants.eIDAS_SAML_ENGINE_NAME).getConfigurationEntries().get(ConfigurationKey.SIGNATURE_CONFIGURATION.getKey()).getParameters());
 		
 	}
 
+	@Override
+    protected ImmutableSet<String> getSignatureAlgorithmWhiteList() {
+		try {
+			if (sigAlgWhiteList == null) {
+				sigAlgWhiteList = MOAWhiteListConfigurator.getAllowedAlgorithms(DEFAULT_ALGORITHM_WHITE_LIST,
+						ALLOWED_ALGORITHMS_FOR_VERIFYING,
+                           (new KeyStoreSignatureConfigurator().getSignatureConfiguration(props)).getSignatureAlgorithmWhiteList());
+        	
+			}
+        
+			return sigAlgWhiteList;
+			
+		} catch (SamlEngineConfigurationException e) {
+			Logger.warn("Can not parse eIDAS signing configuration." , e);
+			return DEFAULT_ALGORITHM_WHITE_LIST;
+			
+		}
+    }
 
 
 }