[java-opensaml COMMIT] in /trunk: opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAML...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Mar  5 22:36:06 2014
New Revision: 3679

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3679&view=rev
Log:
Finish out OSJ-64:
Refactor SignatureTrustEngine impls to accept and eval a SignatureValidationParametersCriterion for algorithm white/blacklisting.
Update signature-validating security MessageHandlers to add the criterion to constructed CriteriaSet using MessageContext data, if present.

Added:
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureValidationParametersCriterion.java   (with props)
Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLSimpleSignatureSecurityHandler.java
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLXMLSignatureSecurityHandler.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterTest.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngine.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngine.java
    trunk/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngineTest.java
    trunk/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLSimpleSignatureSecurityHandler.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLSimpleSignatureSecurityHandler.java?rev=3679&r1=3678&r2=3679&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLSimpleSignatureSecurityHandler.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLSimpleSignatureSecurityHandler.java Wed Mar  5 22:36:06 2014
@@ -47,7 +47,10 @@
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
+import org.opensaml.xmlsec.SignatureValidationParameters;
+import org.opensaml.xmlsec.context.SecurityParametersContext;
 import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
+import org.opensaml.xmlsec.signature.support.SignatureValidationParametersCriterion;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -386,13 +389,18 @@
             Constraint.isNotNull(protocolContext, "SAMLProtocolContext was null");
             Constraint.isNotNull(protocolContext.getProtocol(), "SAML protocol was null");
             criteriaSet.add(new ProtocolCriterion(protocolContext.getProtocol()));
-
         } catch (ConstraintViolationException e) {
             throw new MessageHandlerException(e);
         }
-
+        
         criteriaSet.add(new UsageCriterion(UsageType.SIGNING));
         
+        SecurityParametersContext secParamsContext = messageContext.getSubcontext(SecurityParametersContext.class);
+        if (secParamsContext != null && secParamsContext.getSignatureValidationParameters() != null) {
+            criteriaSet.add(new SignatureValidationParametersCriterion(
+                    secParamsContext.getSignatureValidationParameters()));
+        }
+
         return criteriaSet;
     }
 

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLXMLSignatureSecurityHandler.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLXMLSignatureSecurityHandler.java?rev=3679&r1=3678&r2=3679&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLXMLSignatureSecurityHandler.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/BaseSAMLXMLSignatureSecurityHandler.java Wed Mar  5 22:36:06 2014
@@ -35,7 +35,9 @@
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler;
+import org.opensaml.xmlsec.context.SecurityParametersContext;

[... 678 lines stripped ...]