Package org.apache.poi.poifs.crypt.dsig
Class SignatureConfig
java.lang.Object
org.apache.poi.poifs.crypt.dsig.SignatureConfig
This class bundles the configuration options used for the existing
signature facets.
Apart of the thread local members (e.g. opc-package) most values will probably be constant, so
it might be configured centrally (e.g. by spring)
-
Nested Class Summary
Nested Classes -
Field Summary
Fields -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionvoid
addSignatureFacet
(SignatureFacet signatureFacet) static String
getDigestMethodUri
(HashAlgorithm digestAlgo) Converts the digest algorithm - currently only sha* and ripemd160 is supported.getKey()
This method tests the existence of xml signature provider in the following order: the class pointed to by the system property "jsr105Provider" the Santuario xmlsec provider the JDK xmlsec provider For signing the classes are linked against the Santuario xmlsec, so this might only work for validation (not tested).protected void
init
(boolean onlyValidation) Inits and checks the config object.boolean
boolean
boolean
boolean
boolean
boolean
Make sure the DN is encoded using the same order as present within the certificate.boolean
void
setCanonicalizationMethod
(String canonicalizationMethod) void
setDigestAlgo
(HashAlgorithm digestAlgo) void
setExecutionTime
(String executionTime) Sets the executionTime which is in standard format (SIGNATURE_TIME_FORMAT
)void
setExecutionTime
(Date executionTime) void
setIncludeEntireCertificateChain
(boolean includeEntireCertificateChain) void
setIncludeIssuerSerial
(boolean includeIssuerSerial) void
setIncludeKeyValue
(boolean includeKeyValue) void
setKey
(PrivateKey key) void
setKeyInfoFactory
(KeyInfoFactory keyInfoFactory) void
setNamespacePrefixes
(Map<String, String> namespacePrefixes) void
setOpcPackage
(OPCPackage opcPackage) void
setPackageSignatureId
(String packageSignatureId) void
setProxyUrl
(String proxyUrl) void
setRevocationDataService
(RevocationDataService revocationDataService) void
setSignatureDescription
(String signatureDescription) void
setSignatureFacets
(List<SignatureFacet> signatureFacets) void
setSignatureFactory
(XMLSignatureFactory signatureFactory) void
setSignatureMarshalListener
(EventListener signatureMarshalListener) void
setSignatureMethodFromUri
(String signatureMethodUri) Set the digest algorithm based on the method uri.void
setSignaturePolicyService
(SignaturePolicyService signaturePolicyService) void
setSigningCertificateChain
(List<X509Certificate> signingCertificateChain) void
setTspDigestAlgo
(HashAlgorithm tspDigestAlgo) void
setTspOldProtocol
(boolean tspOldProtocol) void
setTspPass
(String tspPass) void
setTspRequestPolicy
(String tspRequestPolicy) void
setTspService
(TimeStampService tspService) void
void
setTspUser
(String tspUser) void
setTspValidator
(TimeStampServiceValidator tspValidator) void
setUpdateConfigOnValidate
(boolean updateConfigOnValidate) The signature config can be updated if a document is succesful validated.void
setUriDereferencer
(URIDereferencer uriDereferencer) void
setUserAgent
(String userAgent) void
setXadesCanonicalizationMethod
(String xadesCanonicalizationMethod) void
setXadesDigestAlgo
(String xadesDigestAlgo) void
setXadesDigestAlgo
(HashAlgorithm xadesDigestAlgo) void
setXadesIssuerNameNoReverseOrder
(boolean xadesIssuerNameNoReverseOrder) void
setXadesRole
(String xadesRole) void
setXadesSignatureId
(String xadesSignatureId) void
setXadesSignaturePolicyImplied
(boolean xadesSignaturePolicyImplied)
-
Field Details
-
SIGNATURE_TIME_FORMAT
- See Also:
-
-
Constructor Details
-
SignatureConfig
public SignatureConfig()
-
-
Method Details
-
init
protected void init(boolean onlyValidation) Inits and checks the config object. If not set previously, complex configuration properties also get created/initialized via this initialization call.- Parameters:
onlyValidation
- if true, only a subset of the properties is initialized, which are necessary for validation. If false, also the other properties needed for signing are been taken care of
-
addSignatureFacet
- Parameters:
signatureFacet
- the signature facet is appended to facet list
-
getSignatureFacets
- Returns:
- the list of facets, may be empty when the config object is not initialized
-
setSignatureFacets
- Parameters:
signatureFacets
- the new list of facets
-
getDigestAlgo
- Returns:
- the main digest algorithm, defaults to sha256
-
setDigestAlgo
- Parameters:
digestAlgo
- the main digest algorithm
-
getOpcPackage
- Returns:
- the opc package to be used by this thread, stored as thread-local
-
setOpcPackage
- Parameters:
opcPackage
- the opc package to be handled by this thread, stored as thread-local
-
getKey
- Returns:
- the private key
-
setKey
- Parameters:
key
- the private key
-
getSigningCertificateChain
- Returns:
- the certificate chain, index 0 is usually the certificate matching the private key
-
setSigningCertificateChain
- Parameters:
signingCertificateChain
- the certificate chain, index 0 should be the certificate matching the private key
-
getExecutionTime
- Returns:
- the time at which the document is signed, also used for the timestamp service. defaults to now
-
setExecutionTime
- Parameters:
executionTime
- sets the time at which the document ought to be signed
-
formatExecutionTime
- Returns:
- the formatted execution time (
SIGNATURE_TIME_FORMAT
) - Since:
- POI 4.0.0
-
setExecutionTime
Sets the executionTime which is in standard format (SIGNATURE_TIME_FORMAT
)- Parameters:
executionTime
- the execution time- Since:
- POI 4.0.0
-
getSignaturePolicyService
- Returns:
- the service to be used for XAdES-EPES properties. There's no default implementation
-
setSignaturePolicyService
- Parameters:
signaturePolicyService
- the service to be used for XAdES-EPES properties
-
getUriDereferencer
- Returns:
- the dereferencer used for Reference/@URI attributes, defaults to
OOXMLURIDereferencer
-
setUriDereferencer
- Parameters:
uriDereferencer
- the dereferencer used for Reference/@URI attributes
-
getSignatureDescription
- Returns:
- Gives back the human-readable description of what the citizen will be signing. The default value is "Office OpenXML Document".
-
setSignatureDescription
- Parameters:
signatureDescription
- the human-readable description of what the citizen will be signing.
-
getCanonicalizationMethod
- Returns:
- the default canonicalization method, defaults to INCLUSIVE
-
setCanonicalizationMethod
- Parameters:
canonicalizationMethod
- the default canonicalization method
-
getPackageSignatureId
- Returns:
- The signature Id attribute value used to create the XML signature. Defaults to "idPackageSignature"
-
setPackageSignatureId
- Parameters:
packageSignatureId
- The signature Id attribute value used to create the XML signature. Anull
value will trigger an automatically generated signature Id.
-
getTspUrl
- Returns:
- the url of the timestamp provider (TSP)
-
setTspUrl
- Parameters:
tspUrl
- the url of the timestamp provider (TSP)
-
isTspOldProtocol
public boolean isTspOldProtocol()- Returns:
- if true, uses timestamp-request/response mimetype, if false, timestamp-query/reply mimetype
-
setTspOldProtocol
public void setTspOldProtocol(boolean tspOldProtocol) - Parameters:
tspOldProtocol
- defines the timestamp-protocol mimetype- See Also:
-
getTspDigestAlgo
- Returns:
- the hash algorithm to be used for the timestamp entry. Defaults to the hash algorithm of the main entry
-
setTspDigestAlgo
- Parameters:
tspDigestAlgo
- the algorithm to be used for the timestamp entry. ifnull
, the hash algorithm of the main entry
-
getProxyUrl
- Returns:
- the proxy url to be used for all communications. Currently this affects the timestamp service
-
setProxyUrl
- Parameters:
proxyUrl
- the proxy url to be used for all communications. Currently this affects the timestamp service
-
getTspService
- Returns:
- the timestamp service. Defaults to
TSPTimeStampService
-
setTspService
- Parameters:
tspService
- the timestamp service
-
getTspUser
- Returns:
- the user id for the timestamp service - currently only basic authorization is supported
-
setTspUser
- Parameters:
tspUser
- the user id for the timestamp service - currently only basic authorization is supported
-
getTspPass
- Returns:
- the password for the timestamp service
-
setTspPass
- Parameters:
tspPass
- the password for the timestamp service
-
getTspValidator
- Returns:
- the validator for the timestamp service (certificate)
-
setTspValidator
- Parameters:
tspValidator
- the validator for the timestamp service (certificate)
-
getRevocationDataService
- Returns:
- the optional revocation data service used for XAdES-C and XAdES-X-L.
When
null
the signature will be limited to XAdES-T only.
-
setRevocationDataService
- Parameters:
revocationDataService
- the optional revocation data service used for XAdES-C and XAdES-X-L. Whennull
the signature will be limited to XAdES-T only.
-
getXadesDigestAlgo
- Returns:
- hash algorithm used for XAdES. Defaults to the
getDigestAlgo()
-
setXadesDigestAlgo
- Parameters:
xadesDigestAlgo
- hash algorithm used for XAdES. Whennull
, defaults togetDigestAlgo()
-
setXadesDigestAlgo
- Parameters:
xadesDigestAlgo
- hash algorithm used for XAdES. Whennull
, defaults togetDigestAlgo()
- Since:
- POI 4.0.0
-
getUserAgent
- Returns:
- the user agent used for http communication (e.g. to the TSP)
-
setUserAgent
- Parameters:
userAgent
- the user agent used for http communication (e.g. to the TSP)
-
getTspRequestPolicy
- Returns:
- the asn.1 object id for the tsp request policy.
Defaults to
1.3.6.1.4.1.13762.3
-
setTspRequestPolicy
- Parameters:
tspRequestPolicy
- the asn.1 object id for the tsp request policy.
-
isIncludeEntireCertificateChain
public boolean isIncludeEntireCertificateChain()- Returns:
- true, if the whole certificate chain is included in the signature. When false, only the signer cert will be included
-
setIncludeEntireCertificateChain
public void setIncludeEntireCertificateChain(boolean includeEntireCertificateChain) - Parameters:
includeEntireCertificateChain
- if true, include the whole certificate chain. If false, only include the signer cert
-
isIncludeIssuerSerial
public boolean isIncludeIssuerSerial()- Returns:
- if true, issuer serial number is included
-
setIncludeIssuerSerial
public void setIncludeIssuerSerial(boolean includeIssuerSerial) - Parameters:
includeIssuerSerial
- if true, issuer serial number is included
-
isIncludeKeyValue
public boolean isIncludeKeyValue()- Returns:
- if true, the key value of the public key (certificate) is included
-
setIncludeKeyValue
public void setIncludeKeyValue(boolean includeKeyValue) - Parameters:
includeKeyValue
- if true, the key value of the public key (certificate) is included
-
getXadesRole
- Returns:
- the xades role element. If
null
the claimed role element is omitted. Defaults tonull
-
setXadesRole
- Parameters:
xadesRole
- the xades role element. Ifnull
the claimed role element is omitted.
-
getXadesSignatureId
- Returns:
- the Id for the XAdES SignedProperties element.
Defaults to
idSignedProperties
-
setXadesSignatureId
- Parameters:
xadesSignatureId
- the Id for the XAdES SignedProperties element. Whennull
defaults toidSignedProperties
-
isXadesSignaturePolicyImplied
public boolean isXadesSignaturePolicyImplied()- Returns:
- when true, include the policy-implied block.
Defaults to
true
-
setXadesSignaturePolicyImplied
public void setXadesSignaturePolicyImplied(boolean xadesSignaturePolicyImplied) - Parameters:
xadesSignaturePolicyImplied
- when true, include the policy-implied block
-
isXadesIssuerNameNoReverseOrder
public boolean isXadesIssuerNameNoReverseOrder()Make sure the DN is encoded using the same order as present within the certificate. This is an Office2010 work-around. Should be reverted back. XXX: not correct according to RFC 4514.- Returns:
- when true, the issuer DN is used instead of the issuer X500 principal
-
setXadesIssuerNameNoReverseOrder
public void setXadesIssuerNameNoReverseOrder(boolean xadesIssuerNameNoReverseOrder) - Parameters:
xadesIssuerNameNoReverseOrder
- when true, the issuer DN instead of the issuer X500 prinicpal is used
-
getSignatureMarshalListener
- Returns:
- the event listener which is active while xml structure for
the signature is created.
Defaults to
SignatureMarshalListener
-
setSignatureMarshalListener
- Parameters:
signatureMarshalListener
- the event listener watching the xml structure generation for the signature
-
getNamespacePrefixes
- Returns:
- the map of namespace uri (key) to prefix (value)
-
setNamespacePrefixes
- Parameters:
namespacePrefixes
- the map of namespace uri (key) to prefix (value)
-
getSignatureMethodUri
- Returns:
- the uri for the signature method, i.e. currently only rsa is supported, so it's the rsa variant of the main digest
-
getDigestMethodUri
- Returns:
- the uri for the main digest
-
getDigestMethodUri
Converts the digest algorithm - currently only sha* and ripemd160 is supported. MS Office only supports sha1, sha256, sha384, sha512.- Parameters:
digestAlgo
- the digest algorithm- Returns:
- the uri for the given digest
-
setSignatureMethodFromUri
Set the digest algorithm based on the method uri. This is used when a signature was successful validated and the signature configuration is updated- Parameters:
signatureMethodUri
- the method uri- Since:
- POI 4.0.0
-
setSignatureFactory
- Parameters:
signatureFactory
- the xml signature factory, saved as thread-local
-
getSignatureFactory
- Returns:
- the xml signature factory (thread-local)
-
setKeyInfoFactory
- Parameters:
keyInfoFactory
- the key factory, saved as thread-local
-
getKeyInfoFactory
- Returns:
- the key factory (thread-local)
-
getProvider
This method tests the existence of xml signature provider in the following order:- the class pointed to by the system property "jsr105Provider"
- the Santuario xmlsec provider
- the JDK xmlsec provider
- Returns:
- the xml dsig provider
-
getXadesCanonicalizationMethod
- Returns:
- the cannonicalization method for XAdES-XL signing.
Defaults to
EXCLUSIVE
- See Also:
-
setXadesCanonicalizationMethod
- Parameters:
xadesCanonicalizationMethod
- the cannonicalization method for XAdES-XL signing- See Also:
-
isUpdateConfigOnValidate
public boolean isUpdateConfigOnValidate()- Returns:
- true, if the signature config is to be updated based on the successful validated document
- Since:
- POI 4.0.0
-
setUpdateConfigOnValidate
public void setUpdateConfigOnValidate(boolean updateConfigOnValidate) The signature config can be updated if a document is succesful validated. This flag is used for activating this modifications. Defaults tofalse
- Parameters:
updateConfigOnValidate
- if true, update config on validate- Since:
- POI 4.0.0
-