boolean valid = false;
Reference ref = null;
try {
XMLSignature signature = new XMLSignature(signatureElement, "");
// See also WSS4J SAMLUtil.getCredentialFromKeyInfo
KeyInfo keyInfo = signature.getKeyInfo();
X509Certificate cert = keyInfo.getX509Certificate();
if (cert != null) {
valid = signature.checkSignatureValue(cert);
} else {
PublicKey pk = keyInfo.getPublicKey();
if (pk != null) {
valid = signature.checkSignatureValue(pk);
}
}
// is this call redundant given that signature.checkSignatureValue uses References ?
ref = getReference(signature);
Element signedElement = validateReference(root, ref);
// validate trust
new TrustValidator().validateTrust(crypto, cert, keyInfo.getPublicKey());
if (persistSignature) {
message.setContent(XMLSignature.class, signature);
message.setContent(Element.class, signedElement);
}