[java-xmltooling COMMIT] in /branches/REL_1/src/main/java/org/opensaml/xml/security/x509: CertPathPKIXTrustEvaluator....

[noreply at shibboleth.net]

Author: scantor
Date: Mon Feb 11 11:37:10 2013
New Revision: 790

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=790&view=rev
Log:
JXT-98: support for configuring PKIX policy checking in the PKIX trust engine

Modified:
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluator.java
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXValidationOptions.java

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluator.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluator.java?rev=790&r1=789&r2=790&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluator.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXTrustEvaluator.java Mon Feb 11 11:37:10 2013
@@ -191,10 +191,16 @@
 
         boolean isForceRevocationEnabled = false;
         boolean forcedRevocation = false;
+        boolean policyMappingInhibited = false;
+        boolean anyPolicyInhibited = false;
+        Set<String> initialPolicies = null;
         if (options instanceof CertPathPKIXValidationOptions) {
            CertPathPKIXValidationOptions certpathOptions = (CertPathPKIXValidationOptions) options;
            isForceRevocationEnabled = certpathOptions.isForceRevocationEnabled();
            forcedRevocation = certpathOptions.isRevocationEnabled();
+           policyMappingInhibited = certpathOptions.isPolicyMappingInhibited();
+           anyPolicyInhibited = certpathOptions.isAnyPolicyInhibited();
+           initialPolicies = certpathOptions.getInitialPolicies();
         }
         
         if (isForceRevocationEnabled) {
@@ -209,6 +215,17 @@
                 params.setRevocationEnabled(false);
             }
         }
+
+        params.setPolicyMappingInhibited(policyMappingInhibited);
+        params.setAnyPolicyInhibited(anyPolicyInhibited);
+
+        if (initialPolicies != null && !initialPolicies.isEmpty()) {
+            log.debug("PKIXBuilderParameters#setInitialPolicies is being set to: {}", initialPolicies.toString());
+            params.setInitialPolicies(initialPolicies);
+            params.setExplicitPolicyRequired(true);
+        }
+
+        log.trace("PKIXBuilderParameters successfully created: {}", params.toString());
 
         return params;
     }

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXValidationOptions.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXValidationOptions.java?rev=790&r1=789&r2=790&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXValidationOptions.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/x509/CertPathPKIXValidationOptions.java Mon Feb 11 11:37:10 2013
@@ -17,6 +17,8 @@
 
 package org.opensaml.xml.security.x509;
 
+import java.util.Set;
+
 /**
  * Specialization of {@link PKIXValidationOptions} which specifies options specific to a {@link PKIXTrustEvaluator}
  * based on the Java CertPath API.
@@ -29,11 +31,23 @@
     /** Value for RevocationEnabled when forced. */
     private boolean revocationEnabled;
 
+    /** Disable policy mapping flag. */
+    private boolean policyMappingInhibit;
+
+    /** Flag for disallowing the "any" policy OID. */
+    private boolean anyPolicyInhibit;
+
+    /** Acceptable policy OIDs. */
+    private Set<String> initialPolicies;
+
     /** Constructor. */
     public CertPathPKIXValidationOptions() {
         super();
         forceRevocationEnabled = false;
         revocationEnabled = true;
+        policyMappingInhibit = false;
+        anyPolicyInhibit = false;
+        initialPolicies = null;
     }
     
     /**
@@ -56,10 +70,10 @@
      * 
      * <p>Default is: <b>false</b></p>
      * 
-     * @param forceRevocationEnabled The forceRevocationEnabled to set.
+     * @param flag The forceRevocationEnabled to set.
      */
-    public void setForceRevocationEnabled(boolean forceRevocationEnabled) {
-        this.forceRevocationEnabled = forceRevocationEnabled;
+    public void setForceRevocationEnabled(boolean flag) {
+        forceRevocationEnabled = flag;
     }
 
     /**
@@ -82,11 +96,72 @@
      * 
      * <p>Default is: <b>true</b></p>
      * 
-     * @param revocationEnabled The revocationEnabled to set.
+     * @param flag The revocationEnabled to set.
      */
-    public void setRevocationEnabled(boolean revocationEnabled) {
-        this.revocationEnabled = revocationEnabled;
+    public void setRevocationEnabled(boolean flag) {
+        revocationEnabled = flag;
     }
-    
 
+    /**
+     * Returns the value of the policy mapping inhibited flag of the underlying CertPath Provider.
+     * 
+     * @return Returns the policyMappingInhibit boolean.

[... 60 lines stripped ...]