1 files changed, 160 insertions, 0 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java
new file mode 100644
index 000000000..b78c2f264
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/protocols/pvp2x/verification/EntityVerifier.java
@@ -0,0 +1,160 @@
+package at.gv.egovernment.moa.id.protocols.pvp2x.verification;
+
+import java.util.Iterator;
+import java.util.List;
+
+import org.opensaml.saml2.metadata.EntitiesDescriptor;
+import org.opensaml.saml2.metadata.EntityDescriptor;
+import org.opensaml.security.SAMLSignatureProfileValidator;
+import org.opensaml.xml.security.credential.Credential;
+import org.opensaml.xml.signature.SignatureValidator;
+import org.opensaml.xml.validation.ValidationException;
+
+import at.gv.egovernment.moa.id.MOAIDException;
+import at.gv.egovernment.moa.id.commons.db.ConfigurationDBRead;
+import at.gv.egovernment.moa.id.commons.db.dao.config.OAPVP2;
+import at.gv.egovernment.moa.id.commons.db.dao.config.OnlineApplication;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NoCredentialsException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.SAMLRequestNotSignedException;
+import at.gv.egovernment.moa.id.protocols.pvp2x.signer.CredentialProvider;
+import at.gv.egovernment.moa.logging.Logger;
+
+public class EntityVerifier {
+
+	public static byte[] fetchSavedCredential(String entityID) {
+		List<OnlineApplication> oaList = ConfigurationDBRead
+				.getAllActiveOnlineApplications();
+		Iterator<OnlineApplication> oaIt = oaList.iterator();
+		while (oaIt.hasNext()) {
+			OnlineApplication oa = oaIt.next();
+			if (oa.getPublicURLPrefix().equals(entityID)) {
+				OAPVP2 pvp2Config = oa.getAuthComponentOA().getOAPVP2();
+				if (pvp2Config != null) {
+					return pvp2Config.getCertificate();
+				}
+			}
+		}
+		return null;
+	}
+
+	public static void verify(EntityDescriptor entityDescriptor)
+			throws MOAIDException {
+		if (entityDescriptor.getSignature() == null) {
+			throw new SAMLRequestNotSignedException();
+		}
+
+		try {
+			SAMLSignatureProfileValidator sigValidator = new SAMLSignatureProfileValidator();
+			sigValidator.validate(entityDescriptor.getSignature());
+		} catch (ValidationException e) {
+			Logger.error("Failed to validate Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+
+		Credential credential = CredentialProvider
+				.getSPTrustedCredential(entityDescriptor.getEntityID());
+		if (credential == null) {
+			throw new NoCredentialsException(entityDescriptor.getEntityID());
+		}
+
+		SignatureValidator sigValidator = new SignatureValidator(credential);
+		try {
+			sigValidator.validate(entityDescriptor.getSignature());
+		} catch (ValidationException e) {
+			Logger.error("Failed to verfiy Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+	}
+
+	public static void verify(EntityDescriptor entityDescriptor, Credential cred)
+			throws MOAIDException {
+		if (entityDescriptor.getSignature() == null) {
+			throw new SAMLRequestNotSignedException();
+		}
+
+		try {
+			SAMLSignatureProfileValidator sigValidator = new SAMLSignatureProfileValidator();
+			sigValidator.validate(entityDescriptor.getSignature());
+		} catch (ValidationException e) {
+			Logger.error("Failed to validate Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+
+		SignatureValidator sigValidator = new SignatureValidator(cred);
+		try {
+			sigValidator.validate(entityDescriptor.getSignature());
+		} catch (ValidationException e) {
+			Logger.error("Failed to verfiy Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+	}
+
+	public static void verify(EntitiesDescriptor entityDescriptor,
+			Credential cred) throws MOAIDException {
+		if (entityDescriptor.getSignature() == null) {
+			throw new SAMLRequestNotSignedException();
+		}
+
+		try {
+			SAMLSignatureProfileValidator sigValidator = new SAMLSignatureProfileValidator();
+			sigValidator.validate(entityDescriptor.getSignature());
+		} catch (ValidationException e) {
+			Logger.error("Failed to validate Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+
+		SignatureValidator sigValidator = new SignatureValidator(cred);
+		try {
+			sigValidator.validate(entityDescriptor.getSignature());
+
+		} catch (ValidationException e) {
+			Logger.error("Failed to verfiy Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+	}
+
+	public static void verify(EntitiesDescriptor entityDescriptor)
+			throws MOAIDException {
+		if (entityDescriptor.getSignature() == null) {
+			throw new SAMLRequestNotSignedException();
+		}
+
+		try {
+			SAMLSignatureProfileValidator sigValidator = new SAMLSignatureProfileValidator();
+			sigValidator.validate(entityDescriptor.getSignature());
+		} catch (ValidationException e) {
+			Logger.error("Failed to validate Signature", e);
+			throw new SAMLRequestNotSignedException(e);
+		}
+
+		List<EntityDescriptor> entities = entityDescriptor
+				.getEntityDescriptors();
+
+		if (entities.size() > 0) {
+
+			if (entities.size() > 1) {
+				Logger.warn("More then one EntityID in Metadatafile with Name "
+						+ entityDescriptor.getName()
+						+ " defined. Actually only the first"
+						+ " entryID is used to select the certificate to perform Metadata verification.");
+			}
+
+			Credential credential = CredentialProvider
+					.getSPTrustedCredential(entities.get(0).getEntityID());
+
+			if (credential == null) {
+				throw new NoCredentialsException("moaID IDP");
+			}
+
+			SignatureValidator sigValidator = new SignatureValidator(credential);
+			try {
+				sigValidator.validate(entityDescriptor.getSignature());
+
+			} catch (ValidationException e) {
+				Logger.error("Failed to verfiy Signature", e);
+				throw new SAMLRequestNotSignedException(e);
+			}
+		}
+	}
+
+}