[java-opensaml COMMIT] in /trunk/opensaml-security-api/src: main/java/org/opensaml/security/x509/X509Support.java tes...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Sep 19 12:16:23 2014
New Revision: 4018

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4018&view=rev
Log:
Port forward cert CN extraction changes, reverse the list we get back from cryptacular so that the CN(s) from the "most specific" RDN are returned first in the list.

Modified:
    trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
    trunk/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java

Modified: trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java?rev=4018&r1=4017&r2=4018&view=diff
==============================================================================
--- trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java (original)
+++ trunk/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java Fri Sep 19 12:16:23 2014
@@ -34,6 +34,7 @@
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.LinkedList;
 import java.util.List;
 
@@ -62,6 +63,7 @@
 import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
+import com.google.common.collect.Lists;
 import com.google.common.io.Files;
 import com.google.common.net.InetAddresses;
 
@@ -143,12 +145,17 @@
     }
 
     /**
-     * Gets the commons names that appear within the given distinguished name. The returned list provides the names in
-     * the order they appeared in the DN.
+     * Gets the commons names that appear within the given distinguished name. 
+     * 
+     * <p>
+     * The returned list provides the names in the order they appeared in the DN, according to 
+     * RFC 1779/2253 encoding. In this encoding the "most specific" name would typically appear
+     * in the left-most position, and would appear first in the returned list.
+     * </p>
      * 
      * @param dn the DN to extract the common names from
      * 
-     * @return the common names that appear in the DN in the order they appear or null if the given DN is null
+     * @return the common names that appear in the DN in the order they appear, or null if the given DN is null
      */
     @Nullable public static List<String> getCommonNames(@Nullable final X500Principal dn) {
         if (dn == null) {
@@ -158,7 +165,14 @@
         Logger log = getLogger();
         log.debug("Extracting CNs from the following DN: {}", dn.toString());
         final Attributes attrs = NameReader.readX500Principal(dn);
-        return attrs.getValues(AttributeType.CommonName);
+        // Have to copy because list returned from Attributes is unmodifiable, so can't reverse it.
+        List<String> values = Lists.newArrayList(attrs.getValues(AttributeType.CommonName));
+        
+        // Reverse the order so that the most-specific CN is first in the list, 
+        // consistent with RFC 1779/2253 RDN ordering.
+        Collections.reverse(values);
+        
+        return values;
     }
 
     /**

Modified: trunk/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java?rev=4018&r1=4017&r2=4018&view=diff
==============================================================================
--- trunk/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java (original)
+++ trunk/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java Fri Sep 19 12:16:23 2014
@@ -296,22 +296,38 @@
         commonNames = X509Support.getCommonNames(new X500Principal("cn=foo.example.org"));
         Assert.assertNotNull(commonNames);
         Assert.assertEquals(commonNames.size(), 1);
-        Assert.assertTrue(commonNames.contains("foo.example.org"));
+        Assert.assertEquals(commonNames.get(0), "foo.example.org");
         
         // 2 components, 1 cn
         commonNames = X509Support.getCommonNames(new X500Principal("cn=foo.example.org, o=MyOrg"));
         Assert.assertNotNull(commonNames);
         Assert.assertEquals(commonNames.size(), 1);
-        Assert.assertTrue(commonNames.contains("foo.example.org"));
+        Assert.assertEquals(commonNames.get(0), "foo.example.org");
         
         // 2 components each with cn
         commonNames = X509Support.getCommonNames(new X500Principal("cn=foo.example.org, cn=MyOrg"));
         Assert.assertNotNull(commonNames);
         Assert.assertEquals(commonNames.size(), 2);
-        Assert.assertTrue(commonNames.contains("foo.example.org"));
-        Assert.assertTrue(commonNames.contains("MyOrg"));
+        Assert.assertEquals(commonNames.get(0), "foo.example.org");
+        Assert.assertEquals(commonNames.get(1), "MyOrg");
+        
+        // 4 components, 3 cn

[... 65 lines stripped ...]