1 files changed, 128 insertions, 0 deletions
diff --git a/id/server/stork-saml-engine/src/main/java/eu/stork/vidp/messages/validation/StorkSubjectConfirmationValidator.java b/id/server/stork-saml-engine/src/main/java/eu/stork/vidp/messages/validation/StorkSubjectConfirmationValidator.java
new file mode 100644
index 000000000..0f1fad295
--- /dev/null
+++ b/id/server/stork-saml-engine/src/main/java/eu/stork/vidp/messages/validation/StorkSubjectConfirmationValidator.java
@@ -0,0 +1,128 @@
+/*
+ * Copyright 2011 by Graz University of Technology, Austria
+ * The Austrian STORK Modules have been developed by the E-Government
+ * Innovation Center EGIZ, a joint initiative of the Federal Chancellery
+ * Austria and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package eu.stork.vidp.messages.validation;
+
+import java.util.List;
+
+import javax.xml.namespace.QName;
+
+import org.opensaml.saml2.core.SubjectConfirmation;
+import org.opensaml.saml2.core.SubjectConfirmationData;
+import org.opensaml.saml2.core.validator.SubjectConfirmationSchemaValidator;
+import org.opensaml.xml.XMLObject;
+import org.opensaml.xml.signature.X509Data;
+import org.opensaml.xml.validation.ValidationException;
+
+public class StorkSubjectConfirmationValidator extends
+		SubjectConfirmationSchemaValidator {
+
+	private static final String ALLOWED_METHOD_1 = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
+	private static final String ALLOWED_METHOD_2 = "oasis:names:tc:SAML:2.0:cm:holder-of-key";
+
+	/**
+	 * Constructor
+	 * 
+	 */
+	public StorkSubjectConfirmationValidator() {
+
+		super();
+	}
+
+	@Override
+	public void validate(SubjectConfirmation subjectConfirmation)
+			throws ValidationException {
+
+		super.validate(subjectConfirmation);
+		
+		String method = subjectConfirmation.getMethod();
+
+		if (!(method.equals(ALLOWED_METHOD_1) || method.equals(ALLOWED_METHOD_2))) {
+			throw new ValidationException("Method is invalid.");	
+		} 
+		
+		if (subjectConfirmation.getSubjectConfirmationData() == null) {
+			throw new ValidationException("SubjectConfirmationData required.");
+			
+		} 
+
+		SubjectConfirmationData confData = subjectConfirmation.getSubjectConfirmationData();
+		
+		
+		if (method.equals(ALLOWED_METHOD_1)) {
+			if (confData.getNotBefore() != null) {
+				throw new ValidationException("NotBefore in SubjectConfirmationData not allowed if confirmation method is \"bearer\".");
+			}
+
+		}
+
+		if (confData.getNotOnOrAfter() == null) {
+
+			throw new ValidationException("NotOnOrAfter is required.");
+		}
+
+		if (confData.getRecipient() == null) {
+
+			throw new ValidationException("Recipient is required.");
+		}
+
+		if (confData.getInResponseTo() == null) {
+
+			throw new ValidationException("InResponseTo is required.");
+		}
+				
+		if(method.equals(ALLOWED_METHOD_2)) {
+					
+			List<XMLObject> childrenKeyInfo =  confData.getUnknownXMLObjects(new QName("KeyInfo"));
+						
+			if(childrenKeyInfo.size() < 1) {
+						
+				throw new ValidationException("KeyInfo is required.");
+			}
+					
+			List<XMLObject> childrenKeyData = confData.getUnknownXMLObjects(new QName("X509Data"));
+					
+			if(childrenKeyData.size() != 1) {
+						
+				throw new ValidationException("Invalid number of X509Data elements.");
+			} else {
+						
+				X509Data data = (X509Data)childrenKeyData.get(0);
+						
+				if(data.getX509Certificates() == null || data.getX509Certificates().size() < 1 ) {
+							
+					throw new ValidationException("X509Certificate is required.");
+				}
+						
+			}
+				
+		}
+			
+		
+
+	}
+
+	
+}