private X509Certificate analyze(String keyType,String signatureId,X509Certificate delegateCert,X509Certificate requestSigningCertificate,boolean actAsReq,ServerValidatableSamlToken samlToken) throws ContradictoryHoKConditionsException {
  if (signatureId != null && requestSigningCertificate == null) {
    throw new InvalidSecurityHeaderException("SignatureId is not null but the signing certificate is");
  }
  validateNotContradicting(signatureId,delegateCert);
  X509Certificate hokCertificate=null;
  if (keyType == null) {
    hokCertificate=getHoKCertificate(requestSigningCertificate,signatureId,delegateCert,samlToken);
  }
 else   if (keyType.equalsIgnoreCase(BEARER_KEY_TYPE)) {
    if (delegateToReq(delegateCert) || actAsReq) {
      throw new ContradictoryHoKConditionsException("Cannot issue delegated bearer token");
    }
  }
 else   if (keyType.equalsIgnoreCase(HOK_KEY_TYPE)) {
    if ((samlToken != null) && (samlToken.getConfirmationType() == ConfirmationType.BEARER)) {
      throw new ContradictoryHoKConditionsException("Cannot issue Hok token authenticating by bearer token.");
    }
    hokCertificate=getHoKCertificate(requestSigningCertificate,signatureId,delegateCert,samlToken);
    if (hokCertificate == null) {
      throw new ContradictoryHoKConditionsException("Cannot find certificate to use.");
    }
  }
 else {
    throw new ContradictoryHoKConditionsException("Unknown KeyType");
  }
  logger.debug("Found HoK certificate {}",hokCertificate);
  return hokCertificate;
}

private X509Certificate analyze ( String keyType , String signatureId , X509Certificate delegateCert , X509Certificate requestSigningCertificate , boolean actAsReq , ServerValidatableSamlToken samlToken ) throws ContradictoryHoKConditionsException { if ( signatureId != null && requestSigningCertificate == null ) { throw new InvalidSecurityHeaderException ( "SignatureId is not null but the signing certificate is" ) ; } validateNotContradicting ( signatureId , delegateCert ) ; X509Certificate hokCertificate = null ; if ( keyType == null ) { hokCertificate = getHoKCertificate ( requestSigningCertificate , signatureId , delegateCert , samlToken ) ; } else if ( keyType . equalsIgnoreCase ( BEARER_KEY_TYPE ) ) { if ( delegateToReq ( delegateCert ) || actAsReq ) { throw new ContradictoryHoKConditionsException ( "Cannot issue delegated bearer token" ) ; } } else if ( keyType . equalsIgnoreCase ( HOK_KEY_TYPE ) ) { if ( ( samlToken != null ) && ( samlToken . getConfirmationType ( ) == ConfirmationType . BEARER ) ) { throw new ContradictoryHoKConditionsException ( "Cannot issue Hok token authenticating by bearer token." ) ; } hokCertificate = getHoKCertificate ( requestSigningCertificate , signatureId , delegateCert , samlToken ) ; if ( hokCertificate == null ) { throw new ContradictoryHoKConditionsException ( "Cannot find certificate to use." ) ; } } else { throw new ContradictoryHoKConditionsException ( "Unknown KeyType" ) ; } logger . debug ( "Found HoK certificate {}" , hokCertificate ) ; return hokCertificate ; }
evaluates the different conditions for token confirmation type and outputs the certificate that should be embedded into the saml token subject confirmation data .
