[java-opensaml COMMIT] in /trunk: opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryp...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon May 19 21:42:21 2014
New Revision: 3889

URL: http://svn.shibboleth.net/view/java-opensaml?rev=3889&view=rev
Log:
Add a Predicate impl which evals whether an algorithm is supported by the runtime environment, according to the AlgorithmRegistry.
Add predicate usage to encryption and signing resolvers, so don't ever try and use an algorithm that isn't supported by the environment.

Added:
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicate.java   (with props)
    trunk/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmRuntimeSupportedPredicateTest.java   (with props)
Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
    trunk/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java?rev=3889&r1=3888&r2=3889&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java Mon May 19 21:42:21 2014
@@ -161,6 +161,7 @@
                 String algorithm = encryptionMethod.getAlgorithm();
                 log.trace("Evaluating SAML metadata EncryptionMethod algorithm for key transport: {}", algorithm);
                 if (isKeyTransportAlgorithm(algorithm) && whitelistBlacklistPredicate.apply(algorithm) 
+                        && getAlgorithmRuntimeSupportedPredicate().apply(algorithm)
                         && credentialSupportsEncryptionMethod(keyTransportCredential, encryptionMethod)) {
                     log.debug("Resolved key transport algorithm URI from SAML metadata EncryptionMethod: {}",
                             algorithm);
@@ -195,7 +196,8 @@
             for (EncryptionMethod encryptionMethod : metadataCredContext.getEncryptionMethods()) {
                 String algorithm = encryptionMethod.getAlgorithm();
                 log.trace("Evaluating SAML metadata EncryptionMethod algorithm for data encryption: {}", algorithm);
-                if (isDataEncryptionAlgorithm(algorithm) && whitelistBlacklistPredicate.apply(algorithm)) {
+                if (isDataEncryptionAlgorithm(algorithm) && whitelistBlacklistPredicate.apply(algorithm)
+                        && getAlgorithmRuntimeSupportedPredicate().apply(algorithm)) {
                     log.debug("Resolved data encryption algorithm URI from SAML metadata EncryptionMethod: {}",
                             algorithm);
                     return algorithm;

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java?rev=3889&r1=3888&r2=3889&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java Mon May 19 21:42:21 2014
@@ -87,6 +87,7 @@
                     signingMethod.getAlgorithm(), signingMethod.getMinKeySize(), signingMethod.getMaxKeySize());
             
             if (signingMethod.getAlgorithm() == null 
+                    || !getAlgorithmRuntimeSupportedPredicate().apply(signingMethod.getAlgorithm())
                     || !whitelistBlacklistPredicate.apply(signingMethod.getAlgorithm())) {
                 continue;
             }
@@ -178,7 +179,9 @@
             
             log.trace("Evaluating SAML metadata DigestMethod with algorithm: {}", digestMethod.getAlgorithm());
             
-            if (digestMethod.getAlgorithm() != null && whitelistBlacklistPredicate.apply(digestMethod.getAlgorithm())) {
+            if (digestMethod.getAlgorithm() != null 
+                    && getAlgorithmRuntimeSupportedPredicate().apply(digestMethod.getAlgorithm())
+                    && whitelistBlacklistPredicate.apply(digestMethod.getAlgorithm())) {
                 log.debug("Resolved reference digest method algorithm URI from SAML metadata DigestMethod: {}",

[... 103 lines stripped ...]