### Question:
SigningCertFromMetadataExtractor { public X509Certificate getSigningCertForCurrentSigningKey(PublicKey publicSigningKey) { CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(hubEntityId), new UsageCriterion(UsageType.SIGNING), new ProtocolCriterion(SAMLConstants.SAML20P_NS), new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME), new EvaluablePublicKeyCredentialCriterion(publicSigningKey) ); try { Credential credential = credentialResolver.resolveSingle(criteriaSet); if (credential instanceof X509Credential) { X509Certificate x509Cert = ((X509Credential)credential).getEntityCertificate(); if (x509Cert.getPublicKey().equals(publicSigningKey)){ return x509Cert; } } } catch (ResolverException e) { throw new SigningKeyExtractionException("Unable to resolve metadata.", e); } throw new SigningKeyExtractionException("Certificate for public signing key not found in metadata."); } @Inject  SigningCertFromMetadataExtractor(@Named(VERIFY_METADATA_RESOLVER) MetadataResolver metadataResolver,
                                            @Named("HubEntityId") String hubEntityId); X509Certificate getSigningCertForCurrentSigningKey(PublicKey publicSigningKey);  }### Answer:
@Test public void certIsSuccessfullyExtractedFromMetadata() throws ComponentInitializationException, ResolverException { signingCertFromMetadataExtractor = new SigningCertFromMetadataExtractor(metadataResolver, HUB_ENTITY_ID); when(metadataResolver.resolve(any())).thenReturn(List.of(hubEntityDescriptor)); assertThat(signingCertFromMetadataExtractor.getSigningCertForCurrentSigningKey(hubPrimarySigningPublicKey)).isEqualTo(hubPrimarySigningCert); }
@Test public void certIsSuccessfullyExtractedFromMetadataReversed() throws ComponentInitializationException, ResolverException { signingCertFromMetadataExtractor = new SigningCertFromMetadataExtractor(metadataResolver, HUB_ENTITY_ID); when(metadataResolver.resolve(any())).thenReturn(List.of(hubEntityDescriptor)); assertThat(signingCertFromMetadataExtractor.getSigningCertForCurrentSigningKey(hubSecondarySigningPublicKey)).isEqualTo(hubSecondarySigningCert); }
@Test(expected = SigningKeyExtractionException.class) public void certIsNotFoundWhenResolvedMetadataDoesNotContainRelevantCert() throws ComponentInitializationException, ResolverException { signingCertFromMetadataExtractor = new SigningCertFromMetadataExtractor(metadataResolver, HUB_ENTITY_ID); when(metadataResolver.resolve(any())).thenReturn(List.of(hubEntityDescriptor)); signingCertFromMetadataExtractor.getSigningCertForCurrentSigningKey(notHubSigningPublicKey); }
@Test(expected = SigningKeyExtractionException.class) public void certIsNotFoundWhenEmptyMetadataReturned() throws ComponentInitializationException, ResolverException { signingCertFromMetadataExtractor = new SigningCertFromMetadataExtractor(metadataResolver, HUB_ENTITY_ID); when(metadataResolver.resolve(any())).thenReturn(emptyList()); signingCertFromMetadataExtractor.getSigningCertForCurrentSigningKey(notHubSigningPublicKey); }
@Test(expected = SigningKeyExtractionException.class) public void unableToResolveMetadata() throws ComponentInitializationException, ResolverException { signingCertFromMetadataExtractor = new SigningCertFromMetadataExtractor(metadataResolver, HUB_ENTITY_ID); when(metadataResolver.resolve(any())).thenThrow(new ResolverException()); signingCertFromMetadataExtractor.getSigningCertForCurrentSigningKey(hubPrimarySigningCert.getPublicKey()); }