import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Override
protected void configure() {
    bind(EncryptionKeyStore.class).to(HubEncryptionKeyStore.class).asEagerSingleton();
    bind(SigningKeyStore.class).annotatedWith(Names.named("authnRequestKeyStore")).to(AuthnRequestKeyStore.class).asEagerSingleton();
    bind(SigningKeyStore.class).annotatedWith(Names.named("samlResponseFromMatchingServiceKeyStore")).to(SamlResponseFromMatchingServiceKeyStore.class).asEagerSingleton();
    bind(X509CertificateFactory.class).toInstance(new X509CertificateFactory());
    bind(CertificateChainValidator.class);
    bind(PKIXParametersProvider.class).toInstance(new PKIXParametersProvider());
    bind(CertificatesConfigProxy.class);
    bind(TrustStoreForCertificateProvider.class);
    bind(EncryptionCredentialFactory.class);
    bind(KeyStoreCache.class);
    bind(KeyStoreLoader.class).toInstance(new KeyStoreLoader());
    bind(SignatureFactory.class);
    bind(IdaKeyStoreCredentialRetriever.class);
    bind(SamlResponseAssertionEncrypter.class);
    bind(AssertionBlobEncrypter.class);
    bind(EncrypterFactory.class).toInstance(new EncrypterFactory());
    bind(SignatureAlgorithm.class).toInstance(new SignatureRSASHA1());
    bind(DigestAlgorithm.class).toInstance(new DigestSHA256());
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
public ResponseToElementTransformer getResponseToElementTransformer(
        EncryptionKeyStore encryptionKeyStore,
        IdaKeyStore keyStore,
        EntityToEncryptForLocator entityToEnryptForLocator,
        MatchingServiceAdapterConfiguration configuration
) {
    SignatureFactory signatureFactory = new SignatureFactory(
        new IdaKeyStoreCredentialRetriever(keyStore),
        new SignatureRSASHA1(),
        new DigestSHA256()
    );
    SamlResponseAssertionEncrypter assertionEncrypter = new SamlResponseAssertionEncrypter(
            new EncryptionCredentialFactory(encryptionKeyStore),
            new EncrypterFactory(),
            entityToEnryptForLocator);
    return new ResponseToElementTransformer(
            new XmlObjectToElementTransformer<>(),
            new SamlSignatureSigner<>(),
            assertionEncrypter,
            new ResponseAssertionSigner(signatureFactory),
            new ResponseSignatureCreator(signatureFactory)
    );
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
public VerifyAttributeQueryToInboundMatchingServiceRequestTransformer getVerifyAttributeQueryToInboundMatchingServiceRequestTransformer(
    final MetadataResolver metaDataResolver,
    final IdaKeyStore keyStore,
    final MatchingServiceAdapterConfiguration matchingServiceAdapterConfiguration,
    final String hubEntityId,
    CertificateChainEvaluableCriterion certificateChainEvaluableCriterion) throws ComponentInitializationException {
    HubAssertionUnmarshaller hubAssertionTransformer = coreTransformersFactory.getAssertionToHubAssertionTransformer(hubEntityId);
    IdentityProviderAssertionUnmarshaller identityProviderAssertionTransformer = new IdentityProviderAssertionUnmarshaller(
            new MatchingDatasetUnmarshaller(new AddressFactory()),
            new IdentityProviderAuthnStatementUnmarshaller(new AuthnContextFactory()),
            hubEntityId
    );
    SignatureValidator signatureValidator = getMetadataBackedSignatureValidator(metaDataResolver, certificateChainEvaluableCriterion);
    return new VerifyAttributeQueryToInboundMatchingServiceRequestTransformer(
            new SamlAttributeQueryValidator(),
            new AttributeQuerySignatureValidator(new SamlMessageSignatureValidator(signatureValidator)),
            new SamlAssertionsSignatureValidator(new SamlMessageSignatureValidator(signatureValidator)),
            new InboundMatchingServiceRequestUnmarshaller(hubAssertionTransformer, identityProviderAssertionTransformer),
            new SamlAttributeQueryAssertionsValidator(getAssertionValidator(), getIdentityProviderAssertionValidator(), matchingServiceAdapterConfiguration, hubEntityId),
            new AssertionDecrypter(new IdaKeyStoreCredentialRetriever(keyStore), new EncryptionAlgorithmValidator(), new DecrypterFactory()),
            hubEntityId);
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
public static AttributeQueryToElementTransformer getAttributeQueryToElementTransformer(SignatureAlgorithm signatureAlgorithm, DigestAlgorithm digestAlgorithm, String hubEntityId) {
    PublicKeyFactory publicKeyFactory = new PublicKeyFactory(new X509CertificateFactory());
    PrivateKey privateKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.PRIVATE_SIGNING_KEYS.get(TestEntityIds.HUB_ENTITY_ID)));
    PublicKey publicKey = publicKeyFactory.createPublicKey(TestCertificateStrings.getPrimaryPublicEncryptionCert(TestEntityIds.HUB_ENTITY_ID));

    PrivateKey privateEncryptionKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.HUB_TEST_PRIVATE_ENCRYPTION_KEY));
    PublicKey publicEncryptionKey = publicKeyFactory.createPublicKey(TestCertificateStrings.HUB_TEST_PUBLIC_ENCRYPTION_CERT);

    KeyPair encryptionKeyPair = new KeyPair(publicEncryptionKey, privateEncryptionKey);

    KeyPair signingKeyPair = new KeyPair(publicKey, privateKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Collections.singletonList(encryptionKeyPair));

    IdaKeyStoreCredentialRetriever privateCredentialFactory = new IdaKeyStoreCredentialRetriever(keyStore);
    return new AttributeQueryToElementTransformer(
            new SigningRequestAbstractTypeSignatureCreator<>(new SignatureFactory(privateCredentialFactory, signatureAlgorithm, digestAlgorithm)),
            new SamlAttributeQueryAssertionSignatureSigner(privateCredentialFactory, new OpenSamlXmlObjectFactory(), hubEntityId),
            new SamlSignatureSigner<>(),
            new XmlObjectToElementTransformer<>(),
            new SamlAttributeQueryAssertionEncrypter(new EncryptionCredentialFactory(new HardCodedKeyStore(hubEntityId)), new EncrypterFactory(), requestId -> TEST_RP_MS)
    );
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Before
public void setup() throws Exception {
    PublicKeyFactory publicKeyFactory = new PublicKeyFactory(new X509CertificateFactory());
    PrivateKey privateKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.PRIVATE_SIGNING_KEYS.get(HUB_ENTITY_ID)));
    PublicKey publicKey = publicKeyFactory.createPublicKey(TestCertificateStrings.getPrimaryPublicEncryptionCert(HUB_ENTITY_ID));

    PrivateKey privateEncryptionKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.HUB_TEST_PRIVATE_ENCRYPTION_KEY));
    PublicKey publicEncryptionKey = publicKeyFactory.createPublicKey(TestCertificateStrings.HUB_TEST_PUBLIC_ENCRYPTION_CERT);

    KeyPair encryptionKeyPair = new KeyPair(publicEncryptionKey, privateEncryptionKey);

    KeyPair signingKeyPair = new KeyPair(publicKey, privateKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Collections.singletonList(encryptionKeyPair));

    assertionDecrypter = new AssertionDecrypter(new IdaKeyStoreCredentialRetriever(
            keyStore),
            new EncryptionAlgorithmValidator(),
            new DecrypterFactory());
    setUpMatchingService();
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Test
public void createResponse_shouldReturnValidSamlResponse() throws Exception {
    PublicKeyFactory publicKeyFactory = new PublicKeyFactory(new X509CertificateFactory());
    PrivateKey privateKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.PRIVATE_SIGNING_KEYS.get(TestEntityIds.STUB_IDP_ONE)));
    PublicKey publicKey = publicKeyFactory.createPublicKey(TestCertificateStrings.getPrimaryPublicEncryptionCert(TestEntityIds.HUB_ENTITY_ID));

    PrivateKey privateEncryptionKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.HUB_TEST_PRIVATE_ENCRYPTION_KEY));
    PublicKey publicEncryptionKey = publicKeyFactory.createPublicKey(TestCertificateStrings.HUB_TEST_PUBLIC_ENCRYPTION_CERT);

    KeyPair encryptionKeyPair = new KeyPair(publicEncryptionKey, privateEncryptionKey);

    KeyPair signingKeyPair = new KeyPair(publicKey, privateKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Arrays.asList(encryptionKeyPair));
    ExceptionResponseFactory exceptionResponseFactory = new ExceptionResponseFactory(new OpenSamlXmlObjectFactory(), new IdaKeyStoreCredentialRetriever(keyStore), new IdGenerator());

    String errorMessage = "some message";
    String requestId = UUID.randomUUID().toString();
    Element element = exceptionResponseFactory.createResponse(requestId, TEST_ENTITY_ID, errorMessage);

    Response attributeQueryResponse = (Response) XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(element).unmarshall(element);

    assertThat(attributeQueryResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.REQUESTER);
    assertThat(attributeQueryResponse.getStatus().getStatusMessage().getMessage()).isEqualTo(errorMessage);
    assertThat(attributeQueryResponse.getInResponseTo()).isEqualTo(requestId);
    assertThat(attributeQueryResponse.getIssuer().getValue()).isEqualTo(TEST_ENTITY_ID);
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Test
public void sendSignedJsonAuthnResponseFromHub_shouldRespondWithNextLocation() throws Exception {
    SessionId sessionId = SessionId.createNewSessionId();
    URI nextLocationUri = URI.create("http://blah");
    String requestId = UUID.randomUUID().toString();


    ResponseAssertionSigner responseAssertionSigner = new ResponseAssertionSigner(
            new SignatureFactory(new IdaKeyStoreCredentialRetriever(getKeyStore()), SIGNATURE_ALGORITHM, DIGEST_ALGORITHM)
    );
    Function<OutboundResponseFromHub, String> outboundResponseFromHubToStringTransformer = new HubTransformersFactory()
            .getOutboundResponseFromHubToStringTransformer(
                    new HardCodedKeyStore(HUB_ENTITY_ID),
                    getKeyStore(),
                    new IdpHardCodedEntityToEncryptForLocator(),
                    responseAssertionSigner,
                    SIGNATURE_ALGORITHM,
                    DIGEST_ALGORITHM
            );
    OutboundResponseFromHub authnResponseFromHub = anAuthnResponse()
            .withInResponseTo(requestId)
            .withIssuerId(HUB_ENTITY_ID)
            .withTransactionIdaStatus(TransactionIdaStatus.Success)
            .buildOutboundResponseFromHub();
    String samlString = outboundResponseFromHubToStringTransformer.apply(authnResponseFromHub);

    AuthnResponseFromHubContainerDto authnResponseFromHubContainerDto = new AuthnResponseFromHubContainerDto(
            samlString,
            nextLocationUri,
            com.google.common.base.Optional.absent(),
            authnResponseFromHub.getId());

    policyStubRule.anAuthnResponseFromHubToRp(sessionId, authnResponseFromHubContainerDto);

    javax.ws.rs.core.Response response = getResponseFromSamlProxy(Urls.SamlProxyUrls.SEND_RESPONSE_FROM_HUB_API_RESOURCE, sessionId);
    assertThat(response.readEntity(SamlMessageSenderHandler.SamlMessage.class).getPostEndpoint()).isEqualTo(nextLocationUri.toASCIIString());
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Provides
@Named("AES256DecrypterWithGCM")
private AssertionDecrypter getAES256WithGCMAssertionDecrypter(IdaKeyStore keyStore) {
    return new AssertionDecrypter(
            new IdaKeyStoreCredentialRetriever(keyStore), new EncryptionAlgorithmValidator(ImmutableSet.of(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM)), new DecrypterFactory()
    );
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
public List<Assertion> decryptAssertions(Response response) {
    KeyPair encryptionKeyPair = new KeyPair(publicKey, privateKey);
    KeyPair signingKeyPair = new KeyPair(publicKey, privateKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Collections.singletonList(encryptionKeyPair));
    uk.gov.ida.saml.security.AssertionDecrypter assertionDecrypter = new uk.gov.ida.saml.security.AssertionDecrypter(
            new IdaKeyStoreCredentialRetriever(keyStore), new EncryptionAlgorithmValidator(ImmutableSet.of(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM)), new DecrypterFactory()
    );
    return assertionDecrypter.decryptAssertions(new ValidatedResponse(response));
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
private Signature createSignature() {
    KeyPair signingKeyPair = new KeyPair(publicKeyFromPrivateKey(signingKey), signingKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Collections.emptyList());
    IdaKeyStoreCredentialRetriever keyStoreCredentialRetriever = new IdaKeyStoreCredentialRetriever(keyStore);
    SignatureRSASHA256 signatureAlgorithm = new SignatureRSASHA256();
    DigestSHA256 digestAlgorithm = new DigestSHA256();
    SignatureFactory signatureFactory = new SignatureFactory(keyStoreCredentialRetriever, signatureAlgorithm, digestAlgorithm);
    return signatureFactory.createSignature();
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
public AssertionDecrypter createAssertionDecrypter() {
    return new AssertionDecrypter(
        new IdaKeyStoreCredentialRetriever(createEncryptionKeyStore()),
        encryptionAlgorithmValidator,
        decrypterFactory
    );
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Override
protected void configure() {

    bind(PKIXParametersProvider.class).toInstance(new PKIXParametersProvider());
    bind(SoapMessageManager.class).toInstance(new SoapMessageManager());
    bind(X509CertificateFactory.class);
    bind(KeyStoreLoader.class);
    bind(IdGenerator.class);
    bind(IdaKeyStoreCredentialRetriever.class);
    bind(ExpiredCertificateMetadataFilter.class);
    bind(ExceptionResponseFactory.class);
    bind(InboundMatchingServiceRequestToMatchingServiceRequestDtoMapper.class);
    bind(MatchingServiceResponseDtoToOutboundResponseFromMatchingServiceMapper.class);
    bind(MatchingServiceAdapterMetadataRepository.class);
    bind(DocumentToInboundMatchingServiceRequestMapper.class);
    bind(IdGenerator.class);
    bind(MatchingServiceAssertionFactory.class);
    bind(UserAccountCreationAttributeExtractor.class);
    bind(UnknownUserAttributeQueryHandler.class);

    bind(SigningKeyStore.class).to(MetadataPublicKeyStore.class).in(Singleton.class);
    bind(EncryptionKeyStore.class).to(MetadataPublicKeyStore.class).in(Singleton.class);
    bind(PublicKeyInputStreamFactory.class).to(PublicKeyFileInputStreamFactory.class).in(Singleton.class);
    bind(AssertionLifetimeConfiguration.class).to(MatchingServiceAdapterConfiguration.class).in(Singleton.class);
    bind(MatchingServiceProxy.class).to(MatchingServiceProxyImpl.class).in(Singleton.class);
    bind(ManifestReader.class).toInstance(new ManifestReader());
    bind(MatchingDatasetToMatchingDatasetDtoMapper.class).toInstance(new MatchingDatasetToMatchingDatasetDtoMapper());
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Inject
public ExceptionResponseFactory(OpenSamlXmlObjectFactory factory, IdaKeyStoreCredentialRetriever credentialFactory, IdGenerator idGenerator) {
    this.factory = factory;
    this.credentialFactory = credentialFactory;
    this.idGenerator = idGenerator;
}
 

import uk.gov.ida.saml.security.IdaKeyStoreCredentialRetriever; //导入依赖的package包/类
@Provides
public AssertionDecrypter getAssertionDecrypter(IdaKeyStore eidasKeystore) {
    return new AssertionDecrypter(new IdaKeyStoreCredentialRetriever(eidasKeystore), new EncryptionAlgorithmValidator(), new DecrypterFactory());
}