[java-opensaml COMMIT] in /trunk: opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInform...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Dec 15 20:19:44 2014
New Revision: 4186

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4186&view=rev
Log:
Adjust some PKIX name resolution and handling.

Modified:
    trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
    trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
    trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
    trunk/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java
    trunk/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java

Modified: trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java?rev=4186&r1=4185&r2=4186&view=diff
==============================================================================
--- trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java (original)
+++ trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java Mon Dec 15 20:19:44 2014
@@ -19,6 +19,7 @@
 
 import java.util.Set;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -45,7 +46,7 @@
      * @throws ResolverException thrown if there is an error resolving the trusted names
      * @throws UnsupportedOperationException thrown if this optional method is not supported by the implementation
      */
-    @Nullable public Set<String> resolveTrustedNames(@Nullable final CriteriaSet criteriaSet)
+    @Nonnull public Set<String> resolveTrustedNames(@Nullable final CriteriaSet criteriaSet)
         throws ResolverException;
     
     /**

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java?rev=4186&r1=4185&r2=4186&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java (original)
+++ trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java Mon Dec 15 20:19:44 2014
@@ -243,8 +243,8 @@
             log.debug("No trusted name options are active, skipping name evaluation");
             return true;
         } else if (trustedNames == null || trustedNames.isEmpty()) {
-            log.debug("Supplied trusted names are null or empty, skipping name evaluation");
-            return true;
+            log.debug("Supplied trusted names are null or empty, failing name evaluation");
+            return false;
         }
 
         if (log.isDebugEnabled()) {

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java?rev=4186&r1=4185&r2=4186&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java (original)
+++ trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java Mon Dec 15 20:19:44 2014
@@ -204,6 +204,10 @@
         if (getX509CredentialNameEvaluator() == null) {
             log.debug("No credential name evaluator was available, skipping trusted name evaluation");
            return true; 
+        } else if (trustedNames == null) {
+            log.debug("Truted names was null, signalling PKIX resolver does not support trusted names resolution, " 
+                    + "skipping trusted name evaluation");
+           return true; 
         } else {
             return credNameEvaluator.evaluate(untrustedCredential, trustedNames);
         }

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java

[... 184 lines stripped ...]