[java-opensaml COMMIT] in /trunk: opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractD...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Dec 16 22:05:18 2015
New Revision: 4414

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4414&view=rev
Log:
OSJ-143: Move checkTLSCredentialTrusted to HttpClientSecuritySupport

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java
    trunk/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
    trunk/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
    trunk/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java?rev=4414&r1=4413&r2=4414&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java	Wed Dec 16 22:05:18 2015
@@ -54,6 +54,7 @@
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.security.httpclient.HttpClientSecurityConstants;
+import org.opensaml.security.httpclient.HttpClientSecuritySupport;
 import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
@@ -273,7 +274,7 @@
         HttpClientContext context = buildHttpClientContext();
         
         XMLObject result = httpClient.execute(request, responseHandler, context);
-        checkTLSCredentialTrusted(context, request);
+        HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, request.getURI().getScheme());
         return result;
     }
     
@@ -283,17 +284,13 @@
      * @param context the current HTTP context instance in use
      * @param request the HTTP URI request
      * @throws SSLPeerUnverifiedException thrown if the TLS credential was not actually evaluated by the trust engine
-     */
+     * 
+     * @deprecated use {@link HttpClientSecuritySupport#checkTLSCredentialEvaluated(HttpClientContext, String)}
+     */
+    @Deprecated
     protected void checkTLSCredentialTrusted(HttpClientContext context, HttpUriRequest request) 
             throws SSLPeerUnverifiedException {
-        if (tlsTrustEngine != null && "https".equalsIgnoreCase(request.getURI().getScheme())) {
-            if (context.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED) == null) {
-                log.warn("Configured TLS trust engine was not used to verify server TLS credential, " 
-                        + "the appropriate socket factory was likely not configured");
-                throw new SSLPeerUnverifiedException(
-                        "Evaluation of server TLS credential with configured TrustEngine was not performed");
-            }
-        }
+        HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, request.getURI().getScheme());
     }
     
     /**

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java?rev=4414&r1=4413&r2=4414&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java	Wed Dec 16 22:05:18 2015
@@ -41,6 +41,7 @@
 import org.apache.http.impl.client.BasicCredentialsProvider;
 import org.apache.http.util.EntityUtils;
 import org.opensaml.security.httpclient.HttpClientSecurityConstants;
+import org.opensaml.security.httpclient.HttpClientSecuritySupport;
 import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
@@ -225,7 +226,7 @@
         try {
             log.debug("Attempting to fetch metadata document from '{}'", metadataURI);
             response = httpClient.execute(httpGet, context);
-            checkTLSCredentialTrusted(context);
+            HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, metadataURI.getScheme());
             final int httpStatusCode = response.getStatusLine().getStatusCode();
 
             if (httpStatusCode == HttpStatus.SC_NOT_MODIFIED) {
@@ -266,16 +267,12 @@
      * 

[... 208 lines stripped ...]