[java-identity-provider COMMIT] in /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/log...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Mar 31 13:16:00 2014
New Revision: 5667

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5667&view=rev
Log:
Implement conditional signing/encryption option using message context.

Modified:
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacyEncryptionRequirementPredicate.java
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacySigningRequirementPredicate.java

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacyEncryptionRequirementPredicate.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacyEncryptionRequirementPredicate.java?rev=5667&r1=5666&r2=5667&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacyEncryptionRequirementPredicate.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacyEncryptionRequirementPredicate.java Mon Mar 31 13:16:00 2014
@@ -18,10 +18,12 @@
 package net.shibboleth.idp.saml.impl.profile.config.logic;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
+import org.opensaml.messaging.context.MessageChannelSecurityContext;
 import org.opensaml.profile.context.ProfileRequestContext;
 
 import com.google.common.base.Predicate;
@@ -67,7 +69,7 @@
     }
 
     /** {@inheritDoc} */
-    public boolean apply(ProfileRequestContext input) {
+    public boolean apply(@Nullable final ProfileRequestContext input) {
         switch (settingToApply) {
             case ALWAYS:
                 return true;
@@ -76,10 +78,12 @@
                 return false;
                 
             case CONDITIONAL:
-                Constraint.isNotNull(input,
-                        "ProfileRequestContext cannot be null to apply 'conditional' encryption setting");
-                // TODO: implement conditional checking
-                return true;
+                if (input == null || input.getOutboundMessageContext() == null) {
+                    throw new IllegalArgumentException(
+                            "Conditional setting for encryption requires non-null outbound message context");
+                }
+                return !input.getOutboundMessageContext().getSubcontext(
+                        MessageChannelSecurityContext.class, true).isConfidentialityActive();
                 
             default:
                 throw new IllegalArgumentException("Encryption requirement setting not one of the supported values");

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacySigningRequirementPredicate.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacySigningRequirementPredicate.java?rev=5667&r1=5666&r2=5667&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacySigningRequirementPredicate.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/impl/profile/config/logic/LegacySigningRequirementPredicate.java Mon Mar 31 13:16:00 2014
@@ -18,10 +18,12 @@
 package net.shibboleth.idp.saml.impl.profile.config.logic;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
+import org.opensaml.messaging.context.MessageChannelSecurityContext;
 import org.opensaml.profile.context.ProfileRequestContext;
 
 import com.google.common.base.Predicate;
@@ -67,7 +69,7 @@
     }
 
     /** {@inheritDoc} */
-    public boolean apply(ProfileRequestContext input) {
+    public boolean apply(@Nullable final ProfileRequestContext input) {
         switch (settingToApply) {
             case ALWAYS:
                 return true;
@@ -76,10 +78,12 @@
                 return false;
                 
             case CONDITIONAL:
-                Constraint.isNotNull(input,
-                        "ProfileRequestContext cannot be null to apply 'conditional' signing setting");
-                // TODO: implement conditional checking
-                return true;
+                if (input == null || input.getOutboundMessageContext() == null) {
+                    throw new IllegalArgumentException(
+                            "Conditional setting for signing requires non-null outbound message context");
+                }
+                return !input.getOutboundMessageContext().getSubcontext(

[... 5 lines stripped ...]