Example usage for javax.xml.crypto.dsig XMLSignatureFactory unmarshalXMLSignature

List of usage examples for javax.xml.crypto.dsig XMLSignatureFactory unmarshalXMLSignature

  1. HOME
  2. Java
  3. javax
  4. javax.xml.crypto.dsig.*
  5. XMLSignatureFactory
  6. unmarshalXMLSignature

Introduction

In this page you can find the example usage for javax.xml.crypto.dsig XMLSignatureFactory unmarshalXMLSignature.

Prototype

public abstract XMLSignature unmarshalXMLSignature(XMLStructure xmlStructure) throws MarshalException;

Source Link

Document

Unmarshals a new XMLSignature instance from a mechanism-specific XMLStructure instance.

Usage

From source file:be.fedict.eid.dss.document.odf.ODFDSSDocumentService.java

@Override
public List<SignatureInfo> verifySignatures(byte[] document, byte[] originalDocument) throws Exception {
    List<SignatureInfo> signatureInfos = new LinkedList<SignatureInfo>();
    ZipInputStream odfZipInputStream = new ZipInputStream(new ByteArrayInputStream(document));
    ZipEntry zipEntry;/*from   w  w w .j  ava  2s .c  o  m*/
    while (null != (zipEntry = odfZipInputStream.getNextEntry())) {
        if (ODFUtil.isSignatureFile(zipEntry)) {
            Document documentSignatures = ODFUtil.loadDocument(odfZipInputStream);
            NodeList signatureNodeList = documentSignatures.getElementsByTagNameNS(XMLSignature.XMLNS,
                    "Signature");

            XAdESValidation xadesValidation = new XAdESValidation(this.documentContext);

            for (int idx = 0; idx < signatureNodeList.getLength(); idx++) {
                Element signatureElement = (Element) signatureNodeList.item(idx);

                //LOG.debug("signatureValue: "+signatureElement.getTextContent());

                xadesValidation.prepareDocument(signatureElement);
                KeyInfoKeySelector keySelector = new KeyInfoKeySelector();
                DOMValidateContext domValidateContext = new DOMValidateContext(keySelector, signatureElement);
                ODFURIDereferencer dereferencer = new ODFURIDereferencer(document);
                domValidateContext.setURIDereferencer(dereferencer);

                XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance();
                XMLSignature xmlSignature = xmlSignatureFactory.unmarshalXMLSignature(domValidateContext);
                boolean valid = xmlSignature.validate(domValidateContext);
                if (!valid) {
                    LOG.debug("invalid signature");
                    continue;
                }

                checkIntegrity(xmlSignature, document, originalDocument);

                X509Certificate signingCertificate = keySelector.getCertificate();
                SignatureInfo signatureInfo = xadesValidation.validate(documentSignatures, xmlSignature,
                        signatureElement, signingCertificate);
                signatureInfos.add(signatureInfo);
            }
            return signatureInfos;
        }
    }
    return signatureInfos;
}

From source file:be.fedict.eid.applet.service.signer.xps.XPSSignatureVerifier.java

public List<X509Certificate> getSigners(URL url) throws IOException, ParserConfigurationException, SAXException,
        TransformerException, MarshalException, XMLSignatureException, JAXBException {
    List<X509Certificate> signers = new LinkedList<X509Certificate>();
    List<String> signatureResourceNames = getSignatureResourceNames(url);
    for (String signatureResourceName : signatureResourceNames) {
        LOG.debug("signature resource name: " + signatureResourceName);
        Document signatureDocument = loadDocument(url, signatureResourceName);
        if (null == signatureDocument) {
            LOG.warn("signature resource not found: " + signatureResourceName);
            continue;
        }/*from   w ww  . ja v a2 s . c o  m*/

        NodeList signatureNodeList = signatureDocument.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
        if (0 == signatureNodeList.getLength()) {
            LOG.debug("no signature elements present");
            continue;
        }
        Node signatureNode = signatureNodeList.item(0);

        OPCKeySelector keySelector = new OPCKeySelector(url, signatureResourceName);
        DOMValidateContext domValidateContext = new DOMValidateContext(keySelector, signatureNode);
        domValidateContext.setProperty("org.jcp.xml.dsig.validateManifests", Boolean.TRUE);
        OOXMLURIDereferencer dereferencer = new OOXMLURIDereferencer(url);
        domValidateContext.setURIDereferencer(dereferencer);

        XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance();
        XMLSignature xmlSignature = xmlSignatureFactory.unmarshalXMLSignature(domValidateContext);
        boolean validity = xmlSignature.validate(domValidateContext);

        if (false == validity) {
            LOG.debug("not a valid signature");
            continue;
        }
        // TODO: check what has been signed.

        X509Certificate signer = keySelector.getCertificate();
        signers.add(signer);
    }
    return signers;
}

From source file:be.fedict.eid.dss.document.asic.ASiCDSSDocumentService.java

@Override
public List<SignatureInfo> verifySignatures(byte[] document, byte[] originalDocument) throws Exception {
    if (null != originalDocument) {
        throw new IllegalArgumentException("cannot perform original document verifications");
    }/*w  w  w.j ava  2s .  c  om*/
    ZipInputStream zipInputStream = new ZipInputStream(new ByteArrayInputStream(document));
    ZipEntry zipEntry;
    while (null != (zipEntry = zipInputStream.getNextEntry())) {
        if (ASiCUtil.isSignatureZipEntry(zipEntry)) {
            break;
        }
    }
    List<SignatureInfo> signatureInfos = new LinkedList<SignatureInfo>();
    if (null == zipEntry) {
        return signatureInfos;
    }
    XAdESValidation xadesValidation = new XAdESValidation(this.documentContext);
    Document documentSignaturesDocument = ODFUtil.loadDocument(zipInputStream);
    NodeList signatureNodeList = documentSignaturesDocument.getElementsByTagNameNS(XMLSignature.XMLNS,
            "Signature");
    for (int idx = 0; idx < signatureNodeList.getLength(); idx++) {
        Element signatureElement = (Element) signatureNodeList.item(idx);
        xadesValidation.prepareDocument(signatureElement);
        KeyInfoKeySelector keySelector = new KeyInfoKeySelector();
        DOMValidateContext domValidateContext = new DOMValidateContext(keySelector, signatureElement);
        ASiCURIDereferencer dereferencer = new ASiCURIDereferencer(document);
        domValidateContext.setURIDereferencer(dereferencer);

        XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance();
        XMLSignature xmlSignature = xmlSignatureFactory.unmarshalXMLSignature(domValidateContext);
        boolean valid = xmlSignature.validate(domValidateContext);
        if (!valid) {
            continue;
        }

        // check whether all files have been signed properly
        SignedInfo signedInfo = xmlSignature.getSignedInfo();
        @SuppressWarnings("unchecked")
        List<Reference> references = signedInfo.getReferences();
        Set<String> referenceUris = new HashSet<String>();
        for (Reference reference : references) {
            String referenceUri = reference.getURI();
            referenceUris.add(URLDecoder.decode(referenceUri, "UTF-8"));
        }
        zipInputStream = new ZipInputStream(new ByteArrayInputStream(document));
        while (null != (zipEntry = zipInputStream.getNextEntry())) {
            if (ASiCUtil.isSignatureZipEntry(zipEntry)) {
                continue;
            }
            if (false == referenceUris.contains(zipEntry.getName())) {
                LOG.warn("no ds:Reference for ASiC entry: " + zipEntry.getName());
                return signatureInfos;
            }
        }

        X509Certificate signer = keySelector.getCertificate();
        SignatureInfo signatureInfo = xadesValidation.validate(documentSignaturesDocument, xmlSignature,
                signatureElement, signer);
        signatureInfos.add(signatureInfo);
    }
    return signatureInfos;
}

From source file:gov.nih.nci.cacis.nav.DefaultNotificationValidator.java

@Override
public void validateDigitalSignature(Node sig, final XDSDocumentResolver resolver)
        throws NotificationValidationException {

    boolean valid = false;

    try {//ww  w .j a  va 2s .  c  o m
        final DOMValidateContext valContext = new DOMValidateContext(getKeySelector(), sig);
        final XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
        final XMLSignature signature = fac.unmarshalXMLSignature(valContext);

        // We cannot validate the References to documents in the XDS without
        // first retrieving them. So, for now, we can't do "core" validation.
        // We can only validate the Signature itself.
        valid = signature.getSignatureValue().validate(valContext);

        // CHECKSTYLE:OFF
    } catch (Exception ex) {
        // CHECKSTYLE:ON
        throw new NotificationValidationException("Error validating digital signature: " + ex.getMessage(), ex);
    }
    if (!valid) {
        throw new NotificationValidationException(ERR_SIG_VALIDATION_FAILED_MSG);
    }

    validateDocReferences(sig, resolver);
}

From source file:no.difi.sdp.client.asice.signature.CreateSignatureTest.java

private boolean verify_signature(final Signature signature2) {
    try {/*from ww w. j a  v a 2 s.  c o  m*/
        signature2.getBytes();
        DocumentBuilderFactory fac = DocumentBuilderFactory.newInstance();
        fac.setNamespaceAware(true);
        DocumentBuilder builder = fac.newDocumentBuilder();
        final Document doc = builder.parse(new ByteArrayInputStream(signature2.getBytes()));
        //System.err.println(new String(signature2.getBytes()));
        NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
        DOMValidateContext valContext = new DOMValidateContext(
                noekkelpar.getSertifikat().getX509Certificate().getPublicKey(), nl.item(0));
        valContext.setURIDereferencer(new URIDereferencer() {
            @Override
            public Data dereference(final URIReference uriReference, final XMLCryptoContext context)
                    throws URIReferenceException {
                //System.out.println("$$$$ " + uriReference.getURI());
                for (AsicEAttachable file : files) {
                    if (file.getFileName().equals(uriReference.getURI().toString())) {
                        return new OctetStreamData(new ByteArrayInputStream(file.getBytes()));
                    }
                }
                uriReference.getURI().toString().replace("#", "");
                Node element = doc.getElementsByTagName("SignedProperties").item(0);
                return new DOMSubTreeData(element, false);

            }
        });
        XMLSignatureFactory fact = XMLSignatureFactory.getInstance("DOM");
        XMLSignature signature = fact.unmarshalXMLSignature(valContext);
        boolean coreValidity = signature.validate(valContext);
        if (coreValidity == false) {
            System.err.println("Signature failed core validation");
            boolean sv = signature.getSignatureValue().validate(valContext);
            System.out.println("signature validation status: " + sv);
            if (sv == false) {
                // Check the validation status of each Reference.
                Iterator i = signature.getSignedInfo().getReferences().iterator();
                for (int j = 0; i.hasNext(); j++) {
                    boolean refValid = ((javax.xml.crypto.dsig.Reference) i.next()).validate(valContext);
                    System.out.println("ref[" + j + "] validity status: " + refValid);
                }
            }
        }
        return coreValidity;
    } catch (Exception ex) {
        ex.printStackTrace(System.err);
        return false;
    }
}

From source file:be.fedict.eid.dss.document.zip.ZIPDSSDocumentService.java

@Override
public List<SignatureInfo> verifySignatures(byte[] document, byte[] originalDocument) throws Exception {
    ZipInputStream zipInputStream = new ZipInputStream(new ByteArrayInputStream(document));
    ZipEntry zipEntry;//w w w  .j  av  a2s.  c  om
    while (null != (zipEntry = zipInputStream.getNextEntry())) {
        if (ODFUtil.isSignatureFile(zipEntry)) {
            break;
        }
    }
    List<SignatureInfo> signatureInfos = new LinkedList<SignatureInfo>();
    if (null == zipEntry) {
        return signatureInfos;
    }
    XAdESValidation xadesValidation = new XAdESValidation(this.documentContext);
    Document documentSignaturesDocument = ODFUtil.loadDocument(zipInputStream);
    NodeList signatureNodeList = documentSignaturesDocument.getElementsByTagNameNS(XMLSignature.XMLNS,
            "Signature");
    for (int idx = 0; idx < signatureNodeList.getLength(); idx++) {
        Element signatureElement = (Element) signatureNodeList.item(idx);
        xadesValidation.prepareDocument(signatureElement);

        KeyInfoKeySelector keySelector = new KeyInfoKeySelector();
        DOMValidateContext domValidateContext = new DOMValidateContext(keySelector, signatureElement);
        ZIPURIDereferencer dereferencer = new ZIPURIDereferencer(document);
        domValidateContext.setURIDereferencer(dereferencer);

        XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance();
        XMLSignature xmlSignature = xmlSignatureFactory.unmarshalXMLSignature(domValidateContext);
        boolean valid = xmlSignature.validate(domValidateContext);
        if (!valid) {
            continue;
        }

        // check whether all files have been signed properly
        SignedInfo signedInfo = xmlSignature.getSignedInfo();
        @SuppressWarnings("unchecked")
        List<Reference> references = signedInfo.getReferences();
        Set<String> referenceUris = new HashSet<String>();
        for (Reference reference : references) {
            String referenceUri = reference.getURI();
            referenceUris.add(URLDecoder.decode(referenceUri, "UTF-8"));
        }
        zipInputStream = new ZipInputStream(new ByteArrayInputStream(document));
        while (null != (zipEntry = zipInputStream.getNextEntry())) {
            if (ODFUtil.isSignatureFile(zipEntry)) {
                continue;
            }
            if (!referenceUris.contains(zipEntry.getName())) {
                LOG.warn("no ds:Reference for ZIP entry: " + zipEntry.getName());
                return signatureInfos;
            }
        }

        if (null != originalDocument) {
            for (Reference reference : references) {
                if (null != reference.getType()) {
                    /*
                       * We skip XAdES and eID identity ds:Reference.
                       */
                    continue;
                }
                String digestAlgo = reference.getDigestMethod().getAlgorithm();
                LOG.debug("ds:Reference digest algo: " + digestAlgo);
                String referenceUri = reference.getURI();
                LOG.debug("ds:Reference URI: " + referenceUri);
                byte[] digestValue = reference.getDigestValue();

                org.apache.xml.security.signature.XMLSignature xmldsig = new org.apache.xml.security.signature.XMLSignature(
                        documentSignaturesDocument, "",
                        org.apache.xml.security.signature.XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA512,
                        Canonicalizer.ALGO_ID_C14N_EXCL_WITH_COMMENTS);
                xmldsig.addDocument(referenceUri, null, digestAlgo);
                ResourceResolverSpi zipResourceResolver = new ZIPResourceResolver(originalDocument);
                xmldsig.addResourceResolver(zipResourceResolver);
                org.apache.xml.security.signature.SignedInfo apacheSignedInfo = xmldsig.getSignedInfo();
                org.apache.xml.security.signature.Reference apacheReference = apacheSignedInfo.item(0);
                apacheReference.generateDigestValue();
                byte[] originalDigestValue = apacheReference.getDigestValue();
                if (!Arrays.equals(originalDigestValue, digestValue)) {
                    throw new RuntimeException("not original document");
                }
            }
            /*
             * So we already checked whether no files were changed, and that
             * no files were added compared to the original document. Still
             * have to check whether no files were removed.
             */
            ZipInputStream originalZipInputStream = new ZipInputStream(
                    new ByteArrayInputStream(originalDocument));
            ZipEntry originalZipEntry;
            Set<String> referencedEntryNames = new HashSet<String>();
            for (Reference reference : references) {
                if (null != reference.getType()) {
                    continue;
                }
                referencedEntryNames.add(reference.getURI());
            }
            while (null != (originalZipEntry = originalZipInputStream.getNextEntry())) {
                if (ODFUtil.isSignatureFile(originalZipEntry)) {
                    continue;
                }
                if (!referencedEntryNames.contains(originalZipEntry.getName())) {
                    LOG.warn("missing ds:Reference for ZIP entry: " + originalZipEntry.getName());
                    throw new RuntimeException(
                            "missing ds:Reference for ZIP entry: " + originalZipEntry.getName());
                }
            }
        }

        X509Certificate signer = keySelector.getCertificate();
        SignatureInfo signatureInfo = xadesValidation.validate(documentSignaturesDocument, xmlSignature,
                signatureElement, signer);
        signatureInfos.add(signatureInfo);
    }
    return signatureInfos;
}

From source file:be.fedict.eid.dss.document.xml.XMLDSSDocumentService.java

@Override
public List<SignatureInfo> verifySignatures(byte[] documentData, byte[] originalDocument) throws Exception {
    Document document = this.documentBuilder.parse(new ByteArrayInputStream(documentData));

    List<SignatureInfo> signatureInfos = new LinkedList<SignatureInfo>();
    NodeList signatureNodeList = document.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
    if (0 == signatureNodeList.getLength()) {
        LOG.debug("no XML signature found");
        return signatureInfos;
    }//from   w w  w .j  a  v a  2  s . co  m

    XAdESValidation xadesValidation = new XAdESValidation(this.context);

    for (int signatureNodeIdx = 0; signatureNodeIdx < signatureNodeList.getLength(); signatureNodeIdx++) {
        /*
         * Check signature.
         */
        Element signatureElement = (Element) signatureNodeList.item(signatureNodeIdx);
        xadesValidation.prepareDocument(signatureElement);

        KeyInfoKeySelector keyInfoKeySelector = new KeyInfoKeySelector();
        DOMValidateContext domValidateContext = new DOMValidateContext(keyInfoKeySelector, signatureElement);
        XMLSignatureFactory xmlSignatureFactory = XMLSignatureFactory.getInstance("DOM",
                new org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI());
        XMLSignature xmlSignature;
        try {
            xmlSignature = xmlSignatureFactory.unmarshalXMLSignature(domValidateContext);
        } catch (MarshalException e) {
            LOG.error("XML signature marshalling error: " + e.getMessage(), e);
            continue;
        }
        LOG.debug("validating signature: " + xmlSignature.getId());
        boolean signatureValid = xmlSignature.validate(domValidateContext);
        LOG.debug("signature valid: " + signatureValid);
        if (!signatureValid) {
            LOG.error("invalid signature");
            throw new RuntimeException("invalid signature");
        }

        if (null != originalDocument) {
            Document originalDomDocument = XAdESUtils.loadDocument(originalDocument);
            LOG.debug("performing original document verification");
            verifyCoSignatureReference(xmlSignature, originalDomDocument);
            LOG.debug("original document verified");
        } else {
            /*
             * We can still check whether the co-signature ds:Reference is
             * indeed doing a co-signature.
             */
            verifyCoSignatureReference(xmlSignature, document);
        }

        X509Certificate signingCertificate = keyInfoKeySelector.getCertificate();
        SignatureInfo signatureInfo = xadesValidation.validate(document, xmlSignature, signatureElement,
                signingCertificate);
        signatureInfos.add(signatureInfo);
    }
    return signatureInfos;
}

From source file:com.alvexcore.repo.SimpleKeySelectorResult.java

private LicenseInfo getLicenseInfo(InputStream lic) {
    Document licenseXML = null;//  w w w  .j  a v  a2 s . co m
    try {
        DocumentBuilderFactory fact = DocumentBuilderFactory.newInstance();
        fact.setNamespaceAware(true);
        licenseXML = fact.newDocumentBuilder().parse(lic);
        NodeList nl = licenseXML.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
        DOMValidateContext valContext = new DOMValidateContext(new AlvexKeySelector(), nl.item(0));
        XMLSignatureFactory sfac = XMLSignatureFactory.getInstance("DOM");
        XMLSignature sgn = sfac.unmarshalXMLSignature(valContext);
        if (!sgn.validate(valContext))
            return LicenseInfo.INVALID_LICENSE;
    } catch (Exception ex) {
        return LicenseInfo.INVALID_LICENSE;
    }
    SimpleDateFormat sdf = new SimpleDateFormat("dd/MM/yyyy");
    String id = licenseXML.getDocumentElement().getElementsByTagName("id").item(0).getTextContent();
    String product = licenseXML.getDocumentElement().getElementsByTagName("product").item(0).getTextContent();
    String owner = licenseXML.getDocumentElement().getElementsByTagName("owner").item(0).getTextContent();
    String edition = licenseXML.getDocumentElement().getElementsByTagName("edition").item(0).getTextContent();

    // We intentially have separate try/catch blocks. These tags may fail independently
    // and we'd like to prevent failed version tag from stopping dates parsing.
    String version = ANY_VERSION;
    try {
        version = licenseXML.getDocumentElement().getElementsByTagName("version").item(0).getTextContent();
    } catch (Exception e) {
    }

    Date issued = null;
    Date validThru = null;
    try {
        String expiresStr = licenseXML.getDocumentElement().getElementsByTagName("expires").item(0)
                .getTextContent();
        validThru = sdf.parse(expiresStr);
        String issuedStr = licenseXML.getDocumentElement().getElementsByTagName("issued").item(0)
                .getTextContent();
        issued = sdf.parse(issuedStr);
    } catch (Exception e) {
        String expiresStr = licenseXML.getDocumentElement().getElementsByTagName("expires").item(0)
                .getTextContent();
        String issuedStr = licenseXML.getDocumentElement().getElementsByTagName("issued").item(0)
                .getTextContent();
        logger.warn(
                "Can not parse license dates. " + "Issued: " + issuedStr + ". Expires: " + expiresStr + ".");
    }

    int cores = new Integer(
            licenseXML.getDocumentElement().getElementsByTagName("cores").item(0).getTextContent());
    int users = new Integer(
            licenseXML.getDocumentElement().getElementsByTagName("users").item(0).getTextContent());

    return new LicenseInfo(id, owner, product, edition, version, cores, users, issued, validThru, false);
}

From source file:eu.europa.ec.markt.dss.validation102853.tsl.TrustedListsCertificateSource.java

/**
 * Load a trusted list for the specified URL
 *
 * @param url//from ww  w  .j a  va2s . c o  m
 * @param signerCert
 * @return
 * @throws IOException
 */
private TrustStatusList getTrustStatusList(String url, X509Certificate signerCert) {

    InputStream input = null;
    try {

        input = dataLoader.get(url);
        if (input == null) {

            throw new DSSNullReturnedException("The loader returned a null InputStream for: " + url);
        }
        if (url.toLowerCase().endsWith(".zip")) {

            input = getZippedData(input);
        }

        Document doc = DSSXMLUtils.buildDOM(input);

        boolean coreValidity = true;
        if (checkSignature) {

            coreValidity = false;
            if (signerCert != null) {

                final NodeList signatureNodeList = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
                if (signatureNodeList.getLength() == 0) {

                    throw new DSSException("Not ETSI compliant signature. The Xml is not signed.");
                }
                if (signatureNodeList.getLength() > 1) {

                    throw new DSSException("Not ETSI compliant signature. There is more than one signature.");
                }
                final Element signatureEl = (Element) signatureNodeList.item(0);

                final KeySelector keySelector = KeySelector.singletonKeySelector(signerCert.getPublicKey());
                final DOMValidateContext valContext = new DOMValidateContext(keySelector, signatureEl);
                final TSLURIDereferencer tsluriDereferencer = new TSLURIDereferencer(signatureEl);
                valContext.setURIDereferencer(tsluriDereferencer);
                final XMLSignatureFactory factory = XMLSignatureFactory.getInstance("DOM");
                final XMLSignature signature = factory.unmarshalXMLSignature(valContext);
                coreValidity = signature.validate(valContext);
                LOG.info("The TSL signature validity: " + coreValidity);
            }
        }
        final TrustStatusList tsl = TrustServiceListFactory.newInstance(doc);
        tsl.setWellSigned(coreValidity);
        return tsl;
    } catch (DSSException e) {

        throw e;
    } catch (Exception e) {

        throw new DSSException(e);
    } finally {

        DSSUtils.closeQuietly(input);
    }
}

From source file:com.vmware.identity.sts.ws.SignatureValidator.java

/**
 * Validates the request signature. If the signature is not valid the
 * relevant {@link WSFaultException} is thrown
 *
 * @param signatureNode//  w w  w . j a  v  a  2s  . co  m
 *           not null
 * @param signature
 *           not null
 */
private void validateSignature(Node signatureNode, Signature signature, Node timestampNode) {
    assert signatureNode != null;
    assert signature != null;
    assert timestampNode != null;

    XMLSignatureFactory fac = XMLSignatureFactory.getInstance();
    DOMValidateContext valContext = new DOMValidateContext(signature.getCertificate().getPublicKey(),
            signatureNode);
    try {
        XMLSignature xmlSignature = fac.unmarshalXMLSignature(valContext);
        if (!xmlSignature.validate(valContext)) {
            throw new WSFaultException(FaultKey.WSSE_FAILED_CHECK, "Signature is invalid.");
        }

        validateCanonicalizationMethod(xmlSignature);

        validateSignatureReferences(xmlSignature, valContext, signatureNode.getOwnerDocument(), timestampNode);

    } catch (MarshalException e) {
        throw new WSFaultException(FaultKey.WSSE_FAILED_CHECK, e);
    } catch (XMLSignatureException e) {
        throw new WSFaultException(FaultKey.WSSE_FAILED_CHECK, e);
    }
}