[java-opensaml COMMIT] /trunk/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineT...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Dec 15 21:02:03 2014
New Revision: 4188

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4188&view=rev
Log:
Update trust engine socket factory to no longer require a CriteriaSet to be passed via the context in order for trust engine processing to happen.
The primary use cases can only use a trust engine with a static credential/PKIX resolver anyway, so often won't have any real criteria.

Modified:
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java?rev=4188&r1=4187&r2=4188&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java (original)
+++ trunk/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java Mon Dec 15 21:02:03 2014
@@ -39,6 +39,8 @@
 import org.apache.http.protocol.HttpContext;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.httpclient.HttpClientSecurityConstants;
 import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.BasicX509Credential;
@@ -67,7 +69,7 @@
  * </p>
  * 
  * <p>
- * If either of the trust engine or criteria set context attributes is not populated by the caller, then no trust 
+ * If the trust engine context attribute is not populated by the caller, then no trust 
  * evaluation is performed.  This allows use of this implementation with use cases where, given a particular 
  * HttpClient instance, sometimes trust engine evaluation is to be performed, and sometimes not.
  * </p>
@@ -160,8 +162,8 @@
         CriteriaSet criteriaSet = (CriteriaSet) context.getAttribute(
                 HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET);
         if (criteriaSet == null) {
-            log.debug("No criteria set supplied by caller, skipping trust eval");
-            return;
+            log.debug("No criteria set supplied by caller, building new criteria set with signing criteria");
+            criteriaSet = new CriteriaSet(new UsageCriterion(UsageType.SIGNING));
         } else {
             log.trace("Saw CriteriaSet: {}", criteriaSet);
         }