Getting credentials in OpenSAML

For all cryptographic functions OpenSAML requires a Credential which is a basically a cryptographic key wrapped in an object. The Credential can contain either an symmetric key or an asymmetric key not both. The Credential can be created manually with
BasicX509Credential and BasicCredential classes and then populated with the setters. But the preferred way is to use on of the many CredentialResolvers to create the credential for you.
I will now show some examples of how creating credentials using the basic classes and two different resolvers.

The Basic classes has methods like
SetPublicKey
SetSecretKey
SetEntityCertificate
SetPrivateKey

By setting this you can manually create credetials

BasicCredential credential = new BasicCredential();
credential.setPublicKey(myJCEPublicKey);
credential.setPrivateKey(myJCEPrivateKey);
credential.setUsageType(UsageType.SIGNING);

And now you have a credential to use with signing.

The credential resolvers can do things easier for you by helping to extract the keys from for example a java key store(JKS) or metadata.

KeyStore keystore;
keystore = KeyStore.getInstance(KeyStore.getDefaultType());
FileInputStream inputStream = new FileInputStream("/path/to/my/JKS");
keystore.load(inputStream, "MyKeystorePassword".toCharArray());
inputStream.close();

Map<String, String> passwordMap = new HashMap<String, String>();
passwordMap.put("MyEntryID"), "MyEntryPassword");
KeyStoreCredentialResolver resolver = new KeyStoreCredentialResolver(keystore, passwordMap);

Criteria criteria = new EntityIDCriteria("MyEntryID");
CriteriaSet criteriaSet = new CriteriaSet(criteria);

X509Credential credential = (X509Credential)resolver.resolveSingle(criteriaSet); 

The Meta data resolver helps to extract public credentials from meta data

First we create a meta data provider.

InputStream metaDataInputStream = new FileInputStream("path/to/meta/data");
Document metaDataDocument = ppMgr.parse(metaDataInputStream);
Element metadataRoot = metaDataDocument.getDocumentElement();
metaDataInputStream.close();

DOMMetadataProvider idpMetadataProvider = new DOMMetadataProvider(metadataRoot);
idpMetadataProvider.setRequireValidMetadata(true);
idpMetadataProvider.setParserPool(new BasicParserPool());
idpMetadataProvider.initialize();

And then we resolve the credential

MetadataCredentialResolverFactory credentialResolverFactory = MetadataCredentialResolverFactory.getFactory();

MetadataCredentialResolver credentialResolver = credentialResolverFactory.getInstance(idpMetadataProvider);

CriteriaSet criteriaSet = new CriteriaSet();
criteriaSet.add(new MetadataCriteria(IDPSSODescriptor.DEFAULT_ELEMENT_NAME, SAMLConstants.SAML20P_NS));
criteriaSet.add(new EntityIDCriteria("IPDEntityId"));

X509Credential credential = (X509Credential)credentialResolver.resolveSingle(criteriaSet);

Further reading

In my book, A Guide to OpenSAML, I describe credentials, digital sigatures and other security features in OpenSAML