[java-identity-provider COMMIT] in /trunk/idp-saml-impl/src: main/java/net/shibboleth/idp/saml/security/impl/Metadata...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Dec 15 20:20:02 2014
New Revision: 7108

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7108&view=rev
Log:
Adjust some PKIX name resolution and handling.

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java?rev=7108&r1=7107&r2=7108&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java Mon Dec 15 20:20:02 2014
@@ -51,6 +51,7 @@
 import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.x509.PKIXValidationInformation;
 import org.opensaml.security.x509.PKIXValidationInformationResolver;
+import org.opensaml.security.x509.TrustedNamesCriterion;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.slf4j.Logger;
@@ -127,7 +128,7 @@
     }
 
     /** {@inheritDoc} */
-    @Override public Set<String> resolveTrustedNames(CriteriaSet criteriaSet) throws ResolverException {
+    @Override @Nonnull public Set<String> resolveTrustedNames(CriteriaSet criteriaSet) throws ResolverException {
         ComponentSupport.ifNotInitializedThrowUninitializedComponentException(this);
 
         checkCriteriaRequirements(criteriaSet);
@@ -151,8 +152,14 @@
             usage = UsageType.UNSPECIFIED;
         }
 
-        return retrieveTrustedNamesFromMetadata(criteriaSet, entityID, role, protocol, usage);
-
+        Set<String> trustedNames = new HashSet<>();
+        trustedNames.addAll(retrieveTrustedNamesFromMetadata(criteriaSet, entityID, role, protocol, usage));
+        trustedNames.add(entityID);
+        TrustedNamesCriterion trustedNamesCriterion = criteriaSet.get(TrustedNamesCriterion.class);
+        if (trustedNamesCriterion != null) {
+            trustedNames.addAll(trustedNamesCriterion.getTrustedNames());
+        }
+        return trustedNames;
     }
 
     /** {@inheritDoc} */

Modified: trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java?rev=7108&r1=7107&r2=7108&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java (original)
+++ trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java Mon Dec 15 20:20:02 2014
@@ -40,11 +40,14 @@
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.x509.PKIXValidationInformation;
+import org.opensaml.security.x509.TrustedNamesCriterion;
 import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 import org.w3c.dom.Document;
 
+import com.google.common.collect.Sets;
+
 /**
  * Testing the Shibboleth metadata PKIX validation information resolver.
  */
@@ -90,8 +93,9 @@
         
         Assert.assertNotNull(names, "Set of resolved trusted names was null");
         Assert.assertFalse(names.isEmpty(), "Set of trusted names was empty"); 
-        Assert.assertEquals(names.size(), 1, "Set of trusted names had incorrect size");
+        Assert.assertEquals(names.size(), 2, "Set of trusted names had incorrect size");
         Assert.assertTrue(names.contains("foo.example.org"), "Did't find expected name value");
+        Assert.assertTrue(names.contains(fooEntityID), "Did't find expected name value");
         
         criteriaSet.clear();
         criteriaSet.add( new UsageCriterion(UsageType.SIGNING) );
@@ -103,9 +107,10 @@
         
         Assert.assertNotNull(names, "Set of resolved trusted names was null");
         Assert.assertFalse(names.isEmpty(), "Set of trusted names was empty");
-        Assert.assertEquals(names.size(), 2, "Set of trusted names had incorrect size");
+        Assert.assertEquals(names.size(), 3, "Set of trusted names had incorrect size");
         Assert.assertTrue(names.contains("CN=foo.example.org,O=Internet2"), "Did't find expected name value");
         Assert.assertTrue(names.contains("idp.example.org"), "Did't find expected name value");

[... 34 lines stripped ...]