*/
public Credential validate(Credential credential, RequestData data) throws WSSecurityException {
if (credential == null || credential.getAssertion() == null) {
throw new WSSecurityException(WSSecurityException.FAILURE, "noCredential");
}
AssertionWrapper assertion = credential.getAssertion();
// Check HOK requirements
String confirmMethod = null;
List<String> methods = assertion.getConfirmationMethods();
if (methods != null && methods.size() > 0) {
confirmMethod = methods.get(0);
}
if (OpenSAMLUtil.isMethodHolderOfKey(confirmMethod)) {
if (assertion.getSubjectKeyInfo() == null) {
LOG.debug("There is no Subject KeyInfo to match the holder-of-key subject conf method");
throw new WSSecurityException(WSSecurityException.FAILURE, "noKeyInSAMLToken");
}
// The assertion must have been signed for HOK
if (!assertion.isSigned()) {
LOG.debug("A holder-of-key assertion must be signed");
throw new WSSecurityException(WSSecurityException.FAILURE, "invalidSAMLsecurity");
}
}
// Check conditions
checkConditions(assertion);
// Validate the assertion against schemas/profiles
validateAssertion(assertion);
// Verify trust on the signature
if (assertion.isSigned()) {
verifySignedAssertion(assertion, data);
}
return credential;
}