[java-identity-provider COMMIT] in /trunk: idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/Ab...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Mar 31 16:54:24 2014
New Revision: 5669

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=5669&view=rev
Log:
Add a flag for bypassing encryption failure when no key is available.

Modified:
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/AbstractSAML2ProfileConfiguration.java
    trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/SAML2ProfileConfiguration.java
    trunk/idp-schema/src/main/resources/schema/shibboleth-relying-party-saml.xsd

Modified: trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/AbstractSAML2ProfileConfiguration.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/AbstractSAML2ProfileConfiguration.java?rev=5669&r1=5668&r2=5669&view=diff
==============================================================================
--- trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/AbstractSAML2ProfileConfiguration.java (original)
+++ trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/AbstractSAML2ProfileConfiguration.java Mon Mar 31 16:54:24 2014
@@ -41,6 +41,9 @@
 public abstract class AbstractSAML2ProfileConfiguration extends AbstractSAMLProfileConfiguration implements
         SAML2ProfileConfiguration {
 
+    /** Whether encryption is optional in the face of no key, etc. */
+    private boolean encryptionOptional;
+    
     /** Predicate used to determine if assertions should be encrypted. */
     @Nonnull private Predicate<ProfileRequestContext> encryptAssertionsPredicate;
 
@@ -64,6 +67,7 @@
     public AbstractSAML2ProfileConfiguration(@Nonnull @NotEmpty final String profileId) {
         super(profileId);
 
+        encryptionOptional = false;
         encryptAssertionsPredicate = Predicates.alwaysTrue();
         encryptNameIDsPredicate = Predicates.alwaysFalse();
         encryptAttributesPredicate = Predicates.alwaysFalse();
@@ -109,6 +113,20 @@
                 proxyAudiences.add(trimmedAudience);
             }
         }
+    }
+    
+    /** {@inheritDoc} */
+    @Override public boolean isEncryptionOptional() {
+        return encryptionOptional;
+    }
+    
+    /**
+     * Set whether encryption is optional in the face of a missing key, etc.
+     * 
+     * @param flag  flag to set
+     */
+    public void setEncryptionOptional(final boolean flag) {
+        encryptionOptional = flag;
     }
 
     /** {@inheritDoc} */

Modified: trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/SAML2ProfileConfiguration.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/SAML2ProfileConfiguration.java?rev=5669&r1=5668&r2=5669&view=diff
==============================================================================
--- trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/SAML2ProfileConfiguration.java (original)
+++ trunk/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/saml2/SAML2ProfileConfiguration.java Mon Mar 31 16:54:24 2014
@@ -24,6 +24,7 @@
 import net.shibboleth.utilities.java.support.annotation.constraint.NonNegative;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
+import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 
@@ -39,33 +40,47 @@
      * 
      * @return maximum number of times an assertion may be proxied
      */
-    @NonNegative public long getProxyCount();
+    @NonNegative long getProxyCount();
 
     /**
      * Get the unmodifiable collection of audiences for a proxied assertion.
      * 
      * @return audiences for a proxied assertion
      */
-    @Nonnull @NonnullElements @NotLive public Collection<String> getProxyAudiences();
+    @Nonnull @NonnullElements @NotLive @Unmodifiable Collection<String> getProxyAudiences();
 
+    /**
+     * Get whether to ignore an inability to encrypt due to external factors.
+     * 
+     *  <p>This allows a deployer to signal that encryption is "best effort" and
+     *  can be omitted if a relying party doesn't possess a key, support a compatible
+     *  algorithm, etc.</p>
+     *  
+     *  <p>Defaults to false.</p>
+     * 
+     * @return true iff encryption should be treated as optional
+     */
+    boolean isEncryptionOptional();
+    
     /**
      * Get the predicate used to determine if assertions should be encrypted.
      * 
      * @return predicate used to determine if assertions should be encrypted
      */
-    @Nonnull public Predicate<ProfileRequestContext> getEncryptAssertionsPredicate();
+    @Nonnull Predicate<ProfileRequestContext> getEncryptAssertionsPredicate();
 
     /**
      * Get the predicate used to determine if name identifiers should be encrypted.
      * 

[... 33 lines stripped ...]