如何添加 KeyInfo &使用 Java 在 SAML 2.0 中签名下的 X509Data [英] How to add KeyInfo & X509Data under the Signature in SAML 2.0 using Java

问题描述

我是 SAML 的新手，我只是构建了 saml，但根据要求我还需要添加 KeyInfo 和 x509 证书节点，包括客户端的公共证书，我使用下面的代码来生成签名元素，但不知道如何添加密钥信息X509 签名内的数据.在这方面需要帮助吗?

I am completely new to SAML, I just build the saml but per requirement I also need to add KeyInfo and x509 certificate nodes including client’s public cert, I have used below code to generate the signature element, but dont know how to add KeyInfo & X509Data inside signature. needing help on this?

BasicX509Credential signingCredential = new BasicX509Credential();
    //Namespace nameSpaceSAML = new Namespace("http://www.w3.org/2000/09/xmldsig#","ds");
    KeyStore keyStore = getKeyStore( signingKeyStorePath,signingKeyStorePassword);
    PrivateKey privateKey = getPrivateKey(keyStore,signingKeyalias,signingKeyStorePassword );
    signingCredential.setPrivateKey(privateKey);
    signature = (Signature) Configuration.getBuilderFactory().getBuilder(Signature.DEFAULT_ELEMENT_NAME).buildObject(Signature.DEFAULT_ELEMENT_NAME);
    signature.setSigningCredential(signingCredential);
    signature.setSignatureAlgorithm(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
    signature.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS); 

推荐答案

如果你想要更少的代码，有一个签名的帮助类可以做到这一点.

If you want less code, there is a helper class for signatures that does this.

X509KeyInfoGeneratorFactory x509Factory = new X509KeyInfoGeneratorFactory();
x509Factory.setEmitEntityCertificate(true);
x509Factory.setEmitEntityCertificateChain(true);
x509Factory.setEmitX509IssuerSerial(true);
x509Factory.setEmitX509SubjectName(true);

Configuration.getGlobalSecurityConfiguration().getKeyInfoGeneratorManager().registerFactory("x509emitingKeyInfoGenerator", x509Factory);

SecurityHelper.prepareSignatureParams(signature, SPCredentials.getCredential(), null,  "x509emitingKeyInfoGenerator");

这会设置 KeyInfo、签名算法等.使用工厂的 setEmit 方法来设置应该添加到 KeyInfo 的内容

This sets KeyInfo, signing algorithms etc. Use the setEmit methods on the factory to set what should be added to the KeyInfo

有关详细信息，请阅读 我的博客文章它.我还写了一本 关于 OpenSAML 的书，其中解释了签名和加密功能以及更详细的信息.

For more information, read my blog post on it. I also wrote a book on OpenSAML where I explain signing and encryption functions and more in detail.

这篇关于如何添加 KeyInfo &使用 Java 在 SAML 2.0 中签名下的 X509Data的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！