[java-identity-provider COMMIT] in /trunk/idp-cas-impl/src: main/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAut...

[noreply at shibboleth.net]

Author: serac
Date: Tue Dec 16 11:08:39 2014
New Revision: 7117

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7117&view=rev
Log:
Perform hostname verification for CAS proxy authentication.

Added:
    trunk/idp-cas-impl/src/test/resources/credentials/localhost.p12   (with props)
    trunk/idp-cas-impl/src/test/resources/credentials/localhost.pem
Modified:
    trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticator.java
    trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticatorTest.java
    trunk/idp-cas-impl/src/test/resources/spring/proxy-authn-test.xml

Modified: trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticator.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticator.java?rev=7117&r1=7116&r2=7117&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticator.java (original)
+++ trunk/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticator.java Tue Dec 16 11:08:39 2014
@@ -153,7 +153,7 @@
                     .build();
             socketFactory = new SSLConnectionSocketFactory(
                     sslContext,
-                    SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
+                    SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER);
         } catch (Exception e) {
             throw new RuntimeException("SSL initialization error", e);
         }

Modified: trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticatorTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticatorTest.java?rev=7117&r1=7116&r2=7117&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticatorTest.java (original)
+++ trunk/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/HttpClientProxyAuthenticatorTest.java Tue Dec 16 11:08:39 2014
@@ -97,7 +97,7 @@
 
         final SslContextFactory sslContextFactory = new SslContextFactory();
         sslContextFactory.setKeyStoreType("PKCS12");
-        sslContextFactory.setKeyStorePath("src/test/resources/credentials/nobody-1.p12");
+        sslContextFactory.setKeyStorePath("src/test/resources/credentials/localhost.p12");
         sslContextFactory.setKeyStorePassword("changeit");
         final ServerConnector connector = new ServerConnector(server, sslContextFactory);
         connector.setHost("127.0.0.1");

Modified: trunk/idp-cas-impl/src/test/resources/spring/proxy-authn-test.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/test/resources/spring/proxy-authn-test.xml?rev=7117&r1=7116&r2=7117&view=diff
==============================================================================
--- trunk/idp-cas-impl/src/test/resources/spring/proxy-authn-test.xml (original)
+++ trunk/idp-cas-impl/src/test/resources/spring/proxy-authn-test.xml Tue Dec 16 11:08:39 2014
@@ -19,13 +19,17 @@
                         <constructor-arg name="anchors">
                             <list>
                                 <bean class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"
-                                      p:resource="classpath:credentials/nobody-1.pem" />
+                                      p:resource="classpath:credentials/localhost.pem" />
                             </list>
                         </constructor-arg>
                     </bean>
                 </constructor-arg>
             </bean>
         </constructor-arg>
+        <constructor-arg name="pkixEvaluator">
+            <bean class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator" />
+        </constructor-arg>
+        <constructor-arg name="nameEvaluator"><null/></constructor-arg>
     </bean>
 
     <bean id="testCase2" class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine">
@@ -46,6 +50,10 @@
                 </constructor-arg>
             </bean>
         </constructor-arg>
+        <constructor-arg name="pkixEvaluator">
+            <bean class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator" />
+        </constructor-arg>
+        <constructor-arg name="nameEvaluator"><null/></constructor-arg>
     </bean>
 
 </beans>