import org.opensaml.security.MetadataCriteria; //导入依赖的package包/类
/** {@inheritDoc} */
protected CriteriaSet buildCriteriaSet(String entityID, MessageContext messageContext)
    throws SecurityPolicyException {
    if (!(messageContext instanceof SAMLMessageContext)) {
        log.error("Supplied message context was not an instance of SAMLMessageContext, can not build criteria set from SAML metadata parameters");
        throw new SecurityPolicyException("Supplied message context was not an instance of SAMLMessageContext");
    }
    
    SAMLMessageContext samlContext = (SAMLMessageContext) messageContext;
    
    CriteriaSet criteriaSet = new CriteriaSet();
    if (! DatatypeHelper.isEmpty(entityID)) {
        criteriaSet.add(new EntityIDCriteria(entityID) );
    }
    
    MetadataCriteria mdCriteria = 
        new MetadataCriteria(samlContext.getPeerEntityRole(), samlContext.getInboundSAMLProtocol());
    criteriaSet.add(mdCriteria);
    
    criteriaSet.add( new UsageCriteria(UsageType.SIGNING) );
    
    return criteriaSet;
}
 

import org.opensaml.security.MetadataCriteria; //导入依赖的package包/类
/**
 * Build a criteria set suitable for input to the trust engine.
 * 
 * @param entityID the candidate issuer entity ID which is being evaluated
 * @param samlContext the message context which is being evaluated
 * @return a newly constructly set of criteria suitable for the configured trust engine
 * @throws SecurityPolicyException thrown if criteria set can not be constructed
 */
protected CriteriaSet buildCriteriaSet(String entityID, SAMLMessageContext samlContext)
        throws SecurityPolicyException {

    CriteriaSet criteriaSet = new CriteriaSet();
    if (!DatatypeHelper.isEmpty(entityID)) {
        criteriaSet.add(new EntityIDCriteria(entityID));
    }

    MetadataCriteria mdCriteria = new MetadataCriteria(samlContext.getPeerEntityRole(), samlContext
            .getInboundSAMLProtocol());
    criteriaSet.add(mdCriteria);

    criteriaSet.add(new UsageCriteria(UsageType.SIGNING));

    return criteriaSet;
}
 

import org.opensaml.security.MetadataCriteria; //导入依赖的package包/类
/** {@inheritDoc} */
protected CriteriaSet buildCriteriaSet(String entityID, MessageContext messageContext) 
    throws SecurityPolicyException {
    
    if (!(messageContext instanceof SAMLMessageContext)) {
        log.error("Supplied message context was not an instance of SAMLMessageContext, can not build criteria set from SAML metadata parameters");
        throw new SecurityPolicyException("Supplied message context was not an instance of SAMLMessageContext");
    }
    
    SAMLMessageContext samlContext = (SAMLMessageContext) messageContext;

    CriteriaSet criteriaSet = super.buildCriteriaSet(entityID, messageContext);
    MetadataCriteria mdCriteria = 
        new MetadataCriteria(samlContext.getPeerEntityRole(), samlContext.getInboundSAMLProtocol());
    criteriaSet.add(mdCriteria);

    return criteriaSet;
}
 

import org.opensaml.security.MetadataCriteria; //导入依赖的package包/类
/**
 * Build a criteria set suitable for input to the trust engine.
 *
 * @param entityID the candidate issuer entity ID which is being evaluated
 * @param samlContext the message context which is being evaluated
 * @return a newly constructly set of criteria suitable for the configured trust engine
 * @throws SecurityPolicyException thrown if criteria set can not be constructed
 */
protected CriteriaSet buildCriteriaSet(String entityID, SAMLMessageContext samlContext)
        throws SecurityPolicyException {

    CriteriaSet criteriaSet = new CriteriaSet();
    if (!DatatypeHelper.isEmpty(entityID)) {
        criteriaSet.add(new EntityIDCriteria(entityID));
    }

    MetadataCriteria mdCriteria = new MetadataCriteria(samlContext.getPeerEntityRole(), samlContext
            .getInboundSAMLProtocol());
    criteriaSet.add(mdCriteria);

    criteriaSet.add(new UsageCriteria(UsageType.SIGNING));

    return criteriaSet;
}
 

import org.opensaml.security.MetadataCriteria; //导入依赖的package包/类
/**
 * 09-03-2014(Milinda) - Copied from pac4j and modify to make it work in this code.
 * @param samlResponse
 * @param messageContext
 * @throws Exception
 */
private void validateResponseSignature(Response samlResponse, SAMLMessageContext messageContext) throws Exception {
    if (!samlResponse.isSigned()) {
        return;
    }

    SAMLSignatureProfileValidator signatureProfileValidator = new SAMLSignatureProfileValidator();

    try {
        signatureProfileValidator.validate(samlResponse.getSignature());
    } catch (ValidationException ve) {
        log.error("SAML response contains invalid signature profile.");
        throw new Exception("Invalid SAML response.", ve);
    }

    CriteriaSet criteriaSet = new CriteriaSet();
    criteriaSet.add(new UsageCriteria(UsageType.SIGNING));
    criteriaSet.add(new MetadataCriteria(IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS));
    criteriaSet.add(new EntityIDCriteria(messageContext.getPeerEntityId()));

    boolean valid;

    try {
        valid = trustEngine.validate(samlResponse.getSignature(), criteriaSet);
    } catch (Exception e) {
        throw new Exception("SAML response signature validation failed.", e);
    }

    if (!valid) {
        log.error("Invalid signature in SAML response.");
        throw new Exception("Invalid SAML response.");
    }

    messageContext.setInboundSAMLMessageAuthenticated(true);
}
 

import org.opensaml.security.MetadataCriteria; //导入依赖的package包/类
public static Credential getSpCredentials() throws SecurityException {
	MetadataCredentialResolverFactory credentialResolverFactory = MetadataCredentialResolverFactory.getFactory();
	MetadataCredentialResolver credentialResolver = credentialResolverFactory.getInstance(spMetaDataProvider);

	CriteriaSet criteriaSet = new CriteriaSet();
	criteriaSet.add(new MetadataCriteria(SPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS));
	criteriaSet.add(new EntityIDCriteria(MockIDPProperties.getSpEntityId()));

	return credentialResolver.resolveSingle(criteriaSet);
}