[java-opensaml COMMIT] /trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialReso...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed May 14 14:05:38 2014
New Revision: 3869

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3869&view=rev
Log:
Tighten up how roles are resolved from metadata in metadata credential resolver.  Just use the specific criteria we want, instead of passing the entire original input set.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java?rev=3869&r1=3868&r2=3869&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java Wed May 14 14:05:38 2014
@@ -437,7 +437,13 @@
                         new Object[] {entityID, role, protocol});
             }
             
-            return getRoleDescriptorResolver().resolve(criteriaSet);
+            // Construct a new criteria set with just the specific criteria we want considered.
+            CriteriaSet criteria = new CriteriaSet(new EntityIdCriterion(entityID), new EntityRoleCriterion(role));
+            if (protocol != null) {
+                criteria.add(new ProtocolCriterion(protocol));
+            }
+            
+            return getRoleDescriptorResolver().resolve(criteria);
 
         } catch (ResolverException e) {
             log.error("Unable to resolve information from metadata", e);