[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl: AbstractD...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Feb 23 16:40:03 2015
New Revision: 4234

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4234&view=rev
Log:
OSJ-83: TrustEngine/SocketFactory mismatch should throw an exception.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java?rev=4234&r1=4233&r2=4234&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java Mon Feb 23 16:40:03 2015
@@ -27,6 +27,7 @@
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
+import javax.net.ssl.SSLPeerUnverifiedException;
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
@@ -52,7 +53,6 @@
 import org.apache.http.impl.client.BasicCredentialsProvider;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.io.UnmarshallingException;
-import org.opensaml.security.credential.Credential;
 import org.opensaml.security.httpclient.HttpClientSecurityConstants;
 import org.opensaml.security.httpclient.impl.TrustEngineTLSSocketFactory;
 import org.opensaml.security.trust.TrustEngine;
@@ -280,12 +280,16 @@
      * 
      * @param context the current HTTP context instance in use
      * @param request the HTTP URI request
-     */
-    protected void checkTLSCredentialTrusted(HttpClientContext context, HttpUriRequest request) {
+     * @throws SSLPeerUnverifiedException thrown if the TLS credential was not actually evaluated by the trust engine
+     */
+    protected void checkTLSCredentialTrusted(HttpClientContext context, HttpUriRequest request) 
+            throws SSLPeerUnverifiedException {
         if (tlsTrustEngine != null && "https".equalsIgnoreCase(request.getURI().getScheme())) {
             if (context.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED) == null) {
                 log.warn("Configured TLS trust engine was not used to verify server TLS credential, " 
                         + "the appropriate socket factory was likely not configured");
+                throw new SSLPeerUnverifiedException(
+                        "Evaluation of server TLS credential with configured TrustEngine was not performed");
             }
         }
     }

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java?rev=4234&r1=4233&r2=4234&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java Mon Feb 23 16:40:03 2015
@@ -24,6 +24,7 @@
 import java.util.Timer;
 
 import javax.annotation.Nullable;
+import javax.net.ssl.SSLPeerUnverifiedException;
 
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -263,12 +264,15 @@
      * Check that trust engine evaluation of the server TLS credential was actually performed.
      * 
      * @param context the current HTTP context instance in use
-     */
-    protected void checkTLSCredentialTrusted(HttpClientContext context) {
+     * @throws SSLPeerUnverifiedException thrown if the TLS credential was not actually evaluated by the trust engine
+     */
+    protected void checkTLSCredentialTrusted(HttpClientContext context) throws SSLPeerUnverifiedException {
         if (tlsTrustEngine != null && "https".equalsIgnoreCase(metadataURI.getScheme())) {
             if (context.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED) == null) {
                 log.warn("Configured TLS trust engine was not used to verify server TLS credential, " 
                         + "the appropriate socket factory was likely not configured");
+                throw new SSLPeerUnverifiedException(
+                        "Evaluation of server TLS credential with configured TrustEngine was not performed");
             }
         }
     }