[java-opensaml COMMIT] in /trunk: opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryp...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon May 12 21:37:39 2014
New Revision: 3864

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3864&view=rev
Log:
Refactor algorithm used within encryption params resolvers.Select data encryption algorithm first, so that selection of key transport algorithm may be influenced by that.
Misc code cleanup.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java?rev=3864&r1=3863&r2=3864&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java Mon May 12 21:37:39 2014
@@ -91,32 +91,29 @@
                 SAMLMDCredentialContext metadataCredContext = 
                         keyTransportCredential.getCredentialContextSet().get(SAMLMDCredentialContext.class);
                 
+                String dataEncryptionAlgorithm = resolveDataEncryptionAlgorithm(criteria, whitelistBlacklistPredicate, 
+                        metadataCredContext);
+                
                 String keyTransportAlgorithm = resolveKeyTransportAlgorithm(keyTransportCredential,
-                        criteria, whitelistBlacklistPredicate, metadataCredContext);
+                        criteria, whitelistBlacklistPredicate, dataEncryptionAlgorithm, metadataCredContext);
                 if (keyTransportAlgorithm == null) {
                     log.debug("Unable to resolve key transport algorithm for credential with key type '{}', " 
                             + "considering other credentials", 
-                            CredentialSupport.extractEncryptionKey(keyTransportCredential));
+                            CredentialSupport.extractEncryptionKey(keyTransportCredential).getAlgorithm());
                     continue;
                 }
                 
-                String dataEncryptionAlgorithm = resolveDataEncryptionAlgorithmByKeyTransportCredential(
-                        keyTransportCredential, keyTransportAlgorithm, criteria, whitelistBlacklistPredicate, 
-                        metadataCredContext);
                 if (dataEncryptionAlgorithm == null) {
-                    log.debug("Unable to resolve data encryption algorithm URI for use with key transport key " 
-                            + "'{}' and algorithm '{}', encryption will use internal defaults", 
-                            CredentialSupport.extractEncryptionKey(keyTransportCredential), keyTransportAlgorithm);
+                    log.debug("Unable to resolve data encryption algorithm URI, encryption will use internal defaults");
                 }
                 
                 params.setKeyTransportEncryptionCredential(keyTransportCredential);
                 params.setKeyTransportEncryptionAlgorithmURI(keyTransportAlgorithm);
                 params.setDataEncryptionAlgorithmURI(dataEncryptionAlgorithm);
-                if (isAutoGenerateDataEncryptionCredential() && dataEncryptionAlgorithm != null) {
-                    params.setDataEncryptionCredential(generateDataEncryptionCredential(dataEncryptionAlgorithm));
-                }
+                
+                processDataEncryptionCredentialAutoGeneration(params);
+                
                 return;
-                
             }
         } catch (ResolverException e) {
             log.warn("Problem resolving credentials from metadata, falling back to local configuration", e);
@@ -130,16 +127,21 @@
 
     /**
      * Determine the key transport algorithm URI to use with the specified credential.
+     * Any algorithms specified in metadata via 
+     * the passed {@link SAMLMDCredentialContext} are considered first, 
+     * followed by locally configured algorithms.
      * 
      * @param keyTransportCredential the key transport credential to evaluate
      * @param criteria  the criteria instance being evaluated
      * @param whitelistBlacklistPredicate the whitelist/blacklist predicate with which to evaluate the 
      *          candidate data encryption and key transport algorithm URIs
+     * @param dataEncryptionAlgorithm the optional data encryption algorithm URI to consider
      * @param metadataCredContext the credential context extracted from metadata
      * @return the selected algorithm URI
      */
     @Nullable protected String resolveKeyTransportAlgorithm(@Nonnull final Credential keyTransportCredential, 

[... 319 lines stripped ...]