[java-opensaml COMMIT] in /trunk: opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecuri...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Sep 26 17:21:36 2014
New Revision: 4083

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4083&view=rev
Log:
OSJ-4: Client cert auth eval should be conditional

Modified:
    trunk/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java
    trunk/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java

Modified: trunk/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java?rev=4083&r1=4082&r2=4083&view=diff
==============================================================================
--- trunk/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java (original)
+++ trunk/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java Fri Sep 26 17:21:36 2014
@@ -30,6 +30,31 @@
     
     /** A {@link ClientTLSValidationParameters} instance. */
     @Nullable private ClientTLSValidationParameters validationParameters;
+    
+    /** Flag indicating whether to evaluate the certificate presented by the TLS client. */
+    private boolean evaluateClientCertificate = true;
+
+    /**
+     * Determine whether to evaluate the certificate presented by the TLS client.
+     * 
+     * <p>Defaults to: <code>true</code></p>
+     * 
+     * @return true if should evaluate, false otherwise
+     */
+    public boolean isEvaluateClientCertificate() {
+        return evaluateClientCertificate;
+    }
+
+    /**
+     * Set whether to evaluate the certificate presented by the TLS client.
+     * 
+     * <p>Defaults to: <code>true</code></p>
+     * 
+     * @param flag true if should evaluate, false otherwise
+     */
+    public void setEvaluateClientCertificate(boolean flag) {
+        evaluateClientCertificate = flag;
+    }
 
     /**
      * Get an instance of {@link ClientTLSValidationParameters}.

Modified: trunk/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java?rev=4083&r1=4082&r2=4083&view=diff
==============================================================================
--- trunk/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java (original)
+++ trunk/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java Fri Sep 26 17:21:36 2014
@@ -150,6 +150,10 @@
     protected boolean doPreInvoke(MessageContext<MessageType> messageContext) throws MessageHandlerException {
         ClientTLSSecurityParametersContext secContext = 
                 messageContext.getSubcontext(ClientTLSSecurityParametersContext.class);
+        if (secContext != null && !secContext.isEvaluateClientCertificate()) {
+            log.debug("ClientTLSSecurityParametersContext signals to not perform client TLS cert evaluation");
+            return false;
+        }
         if (secContext == null || secContext.getValidationParameters() == null 
                 || secContext.getValidationParameters().getCertificateNameOptions() == null)  {
             throw new MessageHandlerException("CertificateNameOptions was not available from the MessageContext");