[java-xmltooling COMMIT] in /branches/REL_1: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/xml/security/x509/Basic...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Feb 25 15:27:42 2015
New Revision: 846

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=846&view=rev
Log:
JXT-117: Adjust PKIX TrustEngine name handling

Modified:
    branches/REL_1/doc/RELEASE-NOTES.txt
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/BasicX509CredentialNameEvaluator.java
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngine.java
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/StaticPKIXValidationInformationResolver.java
    branches/REL_1/src/main/java/org/opensaml/xml/signature/impl/PKIXSignatureTrustEngine.java
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/BasicX509CredentialNameEvaluatorTest.java
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngineTest.java
    branches/REL_1/src/test/java/org/opensaml/xml/signature/PKIXSignatureTrustEngineTest.java

Modified: branches/REL_1/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/doc/RELEASE-NOTES.txt?rev=846&r1=845&r2=846&view=diff
==============================================================================
--- branches/REL_1/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_1/doc/RELEASE-NOTES.txt Wed Feb 25 15:27:42 2015
@@ -1,6 +1,7 @@
 Changes in Release 1.4.5
 =============================================
 [JXT-116] - Default config for X509Credential KeyInfo generation should emit cert chain in addition to entity cert 
+[JXT-117] - Adjust PKIX TrustEngine name handling
 
 Changes in Release 1.4.4
 =============================================

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/x509/BasicX509CredentialNameEvaluator.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/BasicX509CredentialNameEvaluator.java?rev=846&r1=845&r2=846&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/x509/BasicX509CredentialNameEvaluator.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/x509/BasicX509CredentialNameEvaluator.java Wed Feb 25 15:27:42 2015
@@ -217,8 +217,8 @@
             log.debug("No trusted name options are active, skipping name evaluation");
             return true;
         } else if (trustedNames == null || trustedNames.isEmpty()) {
-            log.debug("Supplied trusted names are null or empty, skipping name evaluation");
-            return true;
+            log.debug("Supplied trusted names are null or empty, failing name evaluation");
+            return false;
         }
 
         if (log.isDebugEnabled()) {

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngine.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngine.java?rev=846&r1=845&r2=846&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngine.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/x509/PKIXX509CredentialTrustEngine.java Wed Feb 25 15:27:42 2015
@@ -192,6 +192,10 @@
         if (credNameEvaluator == null) {
             log.debug("No credential name evaluator was available, skipping trusted name evaluation");
            return true; 
+        } else if (trustedNames == null) {
+            log.debug("Trusted names was null, signalling PKIX resolver does not support trusted names resolution, " 
+                    + "skipping trusted name evaluation");
+           return true; 
         } else {
             return credNameEvaluator.evaluate(untrustedCredential, trustedNames);
         }

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/x509/StaticPKIXValidationInformationResolver.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/StaticPKIXValidationInformationResolver.java?rev=846&r1=845&r2=846&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/x509/StaticPKIXValidationInformationResolver.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/x509/StaticPKIXValidationInformationResolver.java Wed Feb 25 15:27:42 2015
@@ -25,6 +25,7 @@
 
 import org.opensaml.xml.security.CriteriaSet;
 import org.opensaml.xml.security.SecurityException;
+import org.opensaml.xml.security.criteria.EntityIDCriteria;
 
 /**
  * An implementation of {@link PKIXValidationInformationResolver} which always returns a static, fixed set of
@@ -61,8 +62,13 @@
     /** {@inheritDoc} */
     public Set<String> resolveTrustedNames(CriteriaSet criteriaSet) throws SecurityException,
             UnsupportedOperationException {
-
-        return trustedNames;
+        

[... 88 lines stripped ...]