[java-identity-provider COMMIT] in /trunk: idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relying...

[noreply at shibboleth.net]

Author: putmanb
Date: Tue Dec  9 22:05:09 2014
New Revision: 7054

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7054&view=rev
Log:
IDP-516:  Schema and custom parser for SignatureValidationFilter needs to account for default static CriteriaSet or other algorithm whitelisting/blacklisting

Added:
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationCriteriaSetFactoryBean.java   (with props)
    trunk/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationCriteriaSetFactoryBeanTest.java   (with props)
Modified:
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParser.java
    trunk/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd

Modified: trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParser.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParser.java?rev=7054&r1=7053&r2=7054&view=diff
==============================================================================
--- trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParser.java (original)
+++ trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/SignatureValidationParser.java Tue Dec  9 22:05:09 2014
@@ -100,6 +100,19 @@
         if (element.hasAttributeNS(null, "requireSignedMetadata")) {
             builder.addPropertyValue("requireSignature", element.getAttributeNS(null, "requireSignedMetadata"));
         }
+        
+        if (element.hasAttributeNS(null, "defaultCriteriaRef")) {
+            builder.addPropertyReference("defaultCriteria", element.getAttributeNS(null, "defaultCriteriaRef"));
+        }
+        
+        if (element.hasAttributeNS(null, "signaturePrevalidatorRef")) {
+            builder.addPropertyReference("signaturePrevalidator", element.getAttributeNS(null, "signaturePrevalidatorRef"));
+        }
+        
+        if (element.hasAttributeNS(null, "dynamicTrustedNamesStrategyRef")) {
+            builder.addPropertyReference("dynamicTrustedNamesStrategy", element.getAttributeNS(null, "dynamicTrustedNamesStrategyRef"));
+        }
+        
     }
 
     /**

Modified: trunk/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd?rev=7054&r1=7053&r2=7054&view=diff
==============================================================================
--- trunk/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd (original)
+++ trunk/idp-schema/src/main/resources/schema/shibboleth-metadata.xsd Tue Dec  9 22:05:09 2014
@@ -680,6 +680,23 @@
                         </documentation>
                     </annotation>
                 </attribute>
+                <attribute name="defaultCriteriaRef" type="string">
+                    <annotation>
+                        <documentation>The ID of the optional set of static criteria supplied to the trust engine.</documentation>
+                    </annotation>
+                </attribute>
+                <attribute name="signaturePrevalidatorRef" type="string">
+                    <annotation>
+                        <documentation>The ID of the optional signature prevalidator used to validate some non-cryptographic aspects
+                            of the signature, prior to cryptographic verification.</documentation>
+                    </annotation>
+                </attribute>
+                <attribute name="dynamicTrustedNamesStrategyRef" type="string">
+                    <annotation>
+                        <documentation>The ID of the optional strategy used to build at runtime the set of dynamic PKIX trusted names supplied
+                             to the trust engine via the passed criteria set.</documentation>
+                    </annotation>
+                </attribute>
             </extension>
         </complexContent>
     </complexType>