[java-opensaml COMMIT] in /trunk/opensaml-security-impl/src/test: java/org/opensaml/security/x509/impl/CertPathPKIXTr...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Feb 22 23:39:30 2013
New Revision: 3225

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3225&view=rev
Log:
OSJ-28: port r794

Added:
    trunk/opensaml-security-impl/src/test/resources/data/org/opensaml/security/x509/impl/mdt-ica.1.crt.pem
    trunk/opensaml-security-impl/src/test/resources/data/org/opensaml/security/x509/impl/mdt-ica.2.crt.pem
    trunk/opensaml-security-impl/src/test/resources/data/org/opensaml/security/x509/impl/mdt-ica.3.crt.pem
    trunk/opensaml-security-impl/src/test/resources/data/org/opensaml/security/x509/impl/mdt-root.crt.pem
    trunk/opensaml-security-impl/src/test/resources/data/org/opensaml/security/x509/impl/mdt-signer.crt.pem
Modified:
    trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java

Modified: trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java?rev=3225&r1=3224&r2=3225&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java (original)
+++ trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java Fri Feb 22 23:39:30 2013
@@ -24,6 +24,7 @@
 import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -55,13 +56,19 @@
     private PKIXValidationInformation info;
     
     private X509Credential cred;
-
+    
+    private CertPathPKIXValidationOptions opts;
+       
+    private static Set testPolicy1 = Collections.singleton("1.3.6.1.4.1.32473.2011.6.20");
+    private static Set testPolicy2 = Collections.singleton("1.3.6.1.4.1.32473.2011.6.21");
+    
     /** {@inheritDoc} */
     @BeforeMethod
     protected void setUp() throws Exception {
         pkixEvaluator = new CertPathPKIXTrustEvaluator();
         info = null;
         cred = null;
+        opts = null;
     }
     
     @Test
@@ -309,7 +316,58 @@
         
         testValidateFailure("Valid path was specified, but depth exceeded max path depth", info, cred);
     }
-    
+
+    public void testAnyPolicy() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.1.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy1, false, false);
+
+        testValidateSuccess("Intermediate CA with anyPolicy (2.5.29.32.0) entry permitted", info, cred, opts);
+    }
+
+    public void testExplicitPolicy() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.1.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy1, false, true);
+
+        testValidateFailure("Intermediate CA with anyPolicy (2.5.29.32.0), but anyPolicy is inhibited", info, cred, opts);
+
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.2.crt.pem");
+
+        testValidateSuccess("Intermediate CA with explicit policy " + testPolicy1, info, cred, opts);
+
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.3.crt.pem");
+
+        testValidateSuccess("Intermediate CA with explicit policies " + testPolicy1 + ", " + testPolicy2, info, cred, opts);
+    }
+
+    public void testExplicitPolicyMap() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.3.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy2, false, true);
+
+        testValidateSuccess("Intermediate CA with policy mapping, and mapping is permitted", info, cred, opts);
+    }
+
+    public void testExplicitPolicyNoMap() {
+        cred = getCredential("mdt-signer.crt.pem", "mdt-ica.3.crt.pem");
+        info = getPKIXInfoSet(
+                getCertificates("mdt-root.crt.pem"),
+                EMPTY_CRLS,
+                2 );
+        opts = getPKIXOptions(testPolicy2, true, true);
+
+        testValidateFailure("Intermediate CA with policy mapping, but mapping is inhibited", info, cred, opts);
+    }    
     
     /********************
      * Helper methods.  *
@@ -349,7 +407,31 @@
             // do nothing, failure expected
         }
     }
-    
+
+    private void testValidateSuccess(String message, PKIXValidationInformation info, X509Credential cred,
+                CertPathPKIXValidationOptions opts) {
+        try {
+            PKIXTrustEvaluator pkixEvaluator = new CertPathPKIXTrustEvaluator(opts);
+            if ( !pkixEvaluator.validate(info, cred) ) {

[... 42 lines stripped ...]