[java-opensaml COMMIT] in /trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl: CertPathPKIXTr...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Feb 22 23:02:45 2013
New Revision: 3224

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3224&view=rev
Log:
OSJ-28: port r790

Modified:
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java?rev=3224&r1=3223&r2=3224&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java (original)
+++ trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java Fri Feb 22 23:02:45 2013
@@ -195,10 +195,16 @@
 
         boolean isForceRevocationEnabled = false;
         boolean forcedRevocation = false;
+        boolean policyMappingInhibited = false;
+        boolean anyPolicyInhibited = false;
+        Set<String> initialPolicies = null;        
         if (options instanceof CertPathPKIXValidationOptions) {
            CertPathPKIXValidationOptions certpathOptions = (CertPathPKIXValidationOptions) options;
            isForceRevocationEnabled = certpathOptions.isForceRevocationEnabled();
            forcedRevocation = certpathOptions.isRevocationEnabled();
+           policyMappingInhibited = certpathOptions.isPolicyMappingInhibited();
+           anyPolicyInhibited = certpathOptions.isAnyPolicyInhibited();
+           initialPolicies = certpathOptions.getInitialPolicies();
         }
         
         if (isForceRevocationEnabled) {
@@ -214,6 +220,17 @@
             }
         }
 
+        params.setPolicyMappingInhibited(policyMappingInhibited);
+        params.setAnyPolicyInhibited(anyPolicyInhibited);
+
+        if (initialPolicies != null && !initialPolicies.isEmpty()) {
+            log.debug("PKIXBuilderParameters#setInitialPolicies is being set to: {}", initialPolicies.toString());
+            params.setInitialPolicies(initialPolicies);
+            params.setExplicitPolicyRequired(true);
+        }
+
+        log.trace("PKIXBuilderParameters successfully created: {}", params.toString());
+        
         return params;
     }
 

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java?rev=3224&r1=3223&r2=3224&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java (original)
+++ trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java Fri Feb 22 23:02:45 2013
@@ -17,6 +17,8 @@
 
 package org.opensaml.security.x509.impl;
 
+import java.util.Set;
+
 import org.opensaml.security.x509.PKIXValidationOptions;
 
 /**
@@ -30,12 +32,24 @@
    
     /** Value for RevocationEnabled when forced. */
     private boolean revocationEnabled;
+    
+    /** Disable policy mapping flag. */
+    private boolean policyMappingInhibit;
 
+    /** Flag for disallowing the "any" policy OID. */
+    private boolean anyPolicyInhibit;
+
+    /** Acceptable policy OIDs. */
+    private Set<String> initialPolicies;
+    
     /** Constructor. */
     public CertPathPKIXValidationOptions() {
         super();
         forceRevocationEnabled = false;
         revocationEnabled = true;
+        policyMappingInhibit = false;
+        anyPolicyInhibit = false;
+        initialPolicies = null;
     }
     
     /**
@@ -90,4 +104,66 @@
         revocationEnabled = flag;
     }
 
+    /**
+     * Returns the value of the policy mapping inhibited flag of the underlying CertPath Provider.
+     * 
+     * @return Returns the policyMappingInhibit boolean.
+     */
+    public boolean isPolicyMappingInhibited() {
+        return policyMappingInhibit;
+    }
+
+    /**
+     * Sets the policy mapping inhibited flag for the underlying CertPath Provider.
+     * See also RFC 5280, section 6.1.1 (e).
+     * 
+     * <p>Default is: <b>false</b></p>
+     * 
+     * @param flag the policyMappingInhibit boolean to set.
+     */
+    public void setPolicyMappingInhibit(boolean flag) {
+        policyMappingInhibit = flag;
+    }
+
+    /**
+     * Returns the value of the any policy inhibited flag of the underlying CertPath Provider.
+     * 
+     * @return Returns the anyPolicyInhibit boolean.
+     */
+    public boolean isAnyPolicyInhibited() {
+        return anyPolicyInhibit;
+    }
+
+    /**
+     * Sets the any policy inhibited flag for the underlying CertPath Provider.

[... 32 lines stripped ...]