[java-opensaml COMMIT] in /trunk: opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointRe...

[noreply at shibboleth.net]

Author: scantor
Date: Wed Aug 20 00:01:56 2014
New Revision: 4005

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4005&view=rev
Log:
IDP-470 - redesign endpoint resolver handling of "implicitly trusted" endpoint criterion

Modified:
    trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
    trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java
    trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/SignedRequestCriterion.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/DefaultEndpointResolverTest.java

Modified: trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java?rev=4005&r1=4004&r2=4005&view=diff
==============================================================================
--- trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java (original)
+++ trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java Wed Aug 20 00:01:56 2014
@@ -33,7 +33,6 @@
 
 import org.opensaml.saml.criterion.EndpointCriterion;
 import org.opensaml.saml.criterion.RoleDescriptorCriterion;
-import org.opensaml.saml.criterion.SignedRequestCriterion;
 import org.opensaml.saml.saml2.metadata.Endpoint;
 import org.opensaml.saml.saml2.metadata.IndexedEndpoint;
 import org.slf4j.Logger;
@@ -55,11 +54,8 @@
  *  <dt>{@link EndpointCriterion} (required)
  *  <dd>Contains a "template" for the eventual {@link Endpoint}(s) to resolve that identifies at minimum the
  *  type of endpoint object (via schema type or element name) to resolve. It MAY contain other attributes that
- *  will be used in matching candidate endpoints for suitability, such as index, binding, location, etc.
- *  
- *  <dt>{@link SignedRequestCriterion}
- *  <dd>If present, and if the supplied {@link EndpointCriterion} contains a fully usable {@link Endpoint},
- *  that endpoint is returned as the sole resolution result, unless a subclass overrides its validation.
+ *  will be used in matching candidate endpoints for suitability, such as index, binding, location, etc. If so
+ *  marked, it may also be resolved as a trusted endpoint without additional verification required.
  *  
  *  <dt>{@link RoleDescriptorCriterion}
  *  <dd>If present, provides access to the candidate endpoint(s) to attempt resolution against. Strictly optional,
@@ -177,8 +173,9 @@
      * @return true iff the supplied endpoint via {@link EndpointCriterion} should be returned
      */
     private boolean canUseRequestedEndpoint(@Nonnull final CriteriaSet criteria) {
-        final EndpointType requestedEndpoint = (EndpointType) criteria.get(EndpointCriterion.class).getEndpoint();
-        if (criteria.contains(SignedRequestCriterion.class)) {
+        final EndpointCriterion epc = criteria.get(EndpointCriterion.class);
+        if (epc.isTrusted()) {
+            final EndpointType requestedEndpoint = (EndpointType) epc.getEndpoint();
             if (requestedEndpoint.getBinding() != null && (requestedEndpoint.getLocation() != null
                     || requestedEndpoint.getResponseLocation() != null)) {
                 return true;

Modified: trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java?rev=4005&r1=4004&r2=4005&view=diff
==============================================================================
--- trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java (original)
+++ trunk/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java Wed Aug 20 00:01:56 2014
@@ -33,6 +33,9 @@
  */
 public final class EndpointCriterion<EndpointType extends Endpoint> implements Criterion {
 
+    /** Is this endpoint implicitly trusted? */
+    private final boolean trusted;
+    
     /** The endpoint. */
     @Nonnull private final EndpointType endpoint;
 
@@ -40,9 +43,11 @@
      * Constructor.
      * 
      * @param ep the endpoint
+     * @param trust if true, the endpoint should be implicitly trusted regardless of verification by other criteria
      */
-    public EndpointCriterion(@Nonnull final EndpointType ep) {
+    public EndpointCriterion(@Nonnull final EndpointType ep, final boolean trust) {
         endpoint = Constraint.isNotNull(ep, "Endpoint cannot be null");
+        trusted = trust;
     }
 
     /**
@@ -53,25 +58,36 @@
     @Nonnull public EndpointType getEndpoint() {
         return endpoint;
     }
+    
+    /**
+     * Get the trust indicator for the endpoint.
+     * 
+     * @return true iff the endpoint does not require independent verification against a trusted source of endpoints
+     */
+    public boolean isTrusted() {

[... 76 lines stripped ...]