[java-identity-provider COMMIT] in /trunk: idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relying...

[noreply at shibboleth.net]

Author: putmanb
Date: Thu Feb 26 18:04:43 2015
New Revision: 7381

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7381&view=rev
Log:
IDP-628: Add support for disabling trusted name checking in StaticPKIX- TrustEngine parsers.

Added:
    trunk/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/staticPKIX-nameCheckDisabled.xml   (with props)
    trunk/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/staticPKIXCredentials-nameCheckDisabled.xml   (with props)
Modified:
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/AbstractStaticPKIXParser.java
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXSignatureParser.java
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXX509CredentialParser.java
    trunk/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXSignatureParserTest.java
    trunk/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXX509CredentialParserTest.java
    trunk/idp-schema/src/main/resources/schema/shibboleth-security.xsd

Modified: trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/AbstractStaticPKIXParser.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/AbstractStaticPKIXParser.java?rev=7381&r1=7380&r2=7381&view=diff
==============================================================================
--- trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/AbstractStaticPKIXParser.java (original)
+++ trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/AbstractStaticPKIXParser.java Thu Feb 26 18:04:43 2015
@@ -24,13 +24,16 @@
 
 import net.shibboleth.ext.spring.util.SpringSupport;
 import net.shibboleth.idp.profile.spring.relyingparty.security.SecurityNamespaceHandler;
+import net.shibboleth.utilities.java.support.xml.AttributeSupport;
 import net.shibboleth.utilities.java.support.xml.ElementSupport;
 
+import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
 import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
 import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
+import org.w3c.dom.Attr;
 import org.w3c.dom.Element;
 
 /**
@@ -52,7 +55,7 @@
      * @param parserContext the context to parse inside
      * @return the definition
      */
-    protected BeanDefinition getPKIXValidationInformationResolver(Element element,
+    protected BeanDefinition getPKIXValidationInformationResolver(@Nonnull final Element element,
             @Nonnull final ParserContext parserContext) {
 
         final List<Element> validationInfoElements = ElementSupport.getChildElements(element, VALIDATION_INFO);
@@ -74,7 +77,8 @@
      * @param parserContext the context to parse inside
      * @return the definition
      */
-    protected BeanDefinition getPKIXTrustEvaluator(Element element, @Nonnull final ParserContext parserContext) {
+    protected BeanDefinition getPKIXTrustEvaluator(@Nonnull final Element element, 
+            @Nonnull final ParserContext parserContext) {
 
         BeanDefinitionBuilder builder = BeanDefinitionBuilder.genericBeanDefinition(CertPathPKIXTrustEvaluator.class);
 
@@ -86,5 +90,33 @@
         }
         return builder.getBeanDefinition();
     }
+    
+    /**
+     * Get the effective X509CredentialNameEvaluator to use.  Currently we return a literal
+     * value, but in the future a BeanDefinition could be returned if necessary if we support
+     * toggling the name evaluator settings, hence the Object return type.
+     * 
+     * @param element what to parse
+     * @param parserContext the context to parse inside
+     * @return an X509CredentialNameEvaluator instance or a BeanDefinition. May be null.
+     */
+    protected Object getX509CredentialNameEvaluator(@Nonnull final Element element, 
+            @Nonnull final ParserContext parserContext) {
+        
+        boolean trustedNameCheckEnabled = true;
+        Attr attrValue = element.getAttributeNodeNS(null, "trustedNameCheckEnabled");
+        if (attrValue != null) {
+            Boolean value = AttributeSupport.getAttributeValueAsBoolean(attrValue);
+            if (value != null) {
+                trustedNameCheckEnabled = value;
+            }
+        }
+        
+        if (trustedNameCheckEnabled) {

[... 241 lines stripped ...]