[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src: main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryp...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Feb 27 18:18:59 2015
New Revision: 4243

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4243&view=rev
Log:
OSJ-104: SAMLMetadataEncryptionParametersResolver should consider the entire EncryptionMethod data when deciding whether to accept or reject a candidate in metadata 

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java?rev=4243&r1=4242&r2=4243&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java (original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java Fri Feb 27 18:18:59 2015
@@ -42,6 +42,7 @@
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.opensaml.xmlsec.encryption.MGF;
 import org.opensaml.xmlsec.encryption.OAEPparams;
+import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.opensaml.xmlsec.encryption.support.RSAOAEPParameters;
 import org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver;
 import org.opensaml.xmlsec.signature.DigestMethod;
@@ -251,6 +252,7 @@
      * @param whitelistBlacklistPredicate the whitelist/blacklist predicate with which to evaluate the 
      *          candidate data encryption and key transport algorithm URIs
      */
+     // Checkstyle: CyclomaticComplexity OFF -- more readable not split up
     protected void populateRSAOAEPParamsFromEncryptionMethod(@Nonnull final RSAOAEPParameters params, 
             @Nonnull final EncryptionMethod encryptionMethod, 
             @Nonnull final Predicate<String> whitelistBlacklistPredicate) {
@@ -267,12 +269,14 @@
             }
         }
         
-        List<XMLObject> mgfs = encryptionMethod.getUnknownXMLObjects(MGF.DEFAULT_ELEMENT_NAME);
-        if (mgfs.size() > 0) {
-            MGF mgf = (MGF) mgfs.get(0);
-            String mgfAlgorithm = StringSupport.trimOrNull(mgf.getAlgorithm());
-            if (mgfAlgorithm != null && whitelistBlacklistPredicate.apply(mgfAlgorithm)) {
-                params.setMaskGenerationFunction(mgfAlgorithm);
+        if (EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11.equals(encryptionMethod.getAlgorithm())) {
+            List<XMLObject> mgfs = encryptionMethod.getUnknownXMLObjects(MGF.DEFAULT_ELEMENT_NAME);
+            if (mgfs.size() > 0) {
+                MGF mgf = (MGF) mgfs.get(0);
+                String mgfAlgorithm = StringSupport.trimOrNull(mgf.getAlgorithm());
+                if (mgfAlgorithm != null && whitelistBlacklistPredicate.apply(mgfAlgorithm)) {
+                    params.setMaskGenerationFunction(mgfAlgorithm);
+                }
             }
         }
         
@@ -285,6 +289,7 @@
         }
         
     }
+    // Checkstyle:CyclomaticComplexity ON
 
     /**
      * Determine the key transport algorithm URI to use with the specified credential, also returning the associated
@@ -314,9 +319,11 @@
             for (EncryptionMethod encryptionMethod : metadataCredContext.getEncryptionMethods()) {
                 String algorithm = encryptionMethod.getAlgorithm();
                 log.trace("Evaluating SAML metadata EncryptionMethod algorithm for key transport: {}", algorithm);
-                if (isKeyTransportAlgorithm(algorithm) && whitelistBlacklistPredicate.apply(algorithm) 
+                if (isKeyTransportAlgorithm(algorithm) 
+                        && whitelistBlacklistPredicate.apply(algorithm) 
                         && getAlgorithmRuntimeSupportedPredicate().apply(algorithm)
-                        && credentialSupportsEncryptionMethod(keyTransportCredential, encryptionMethod)) {
+                        && credentialSupportsEncryptionMethod(keyTransportCredential, encryptionMethod)
+                        && evaluateEncryptionMethodChildren(encryptionMethod, criteria, whitelistBlacklistPredicate)) {
                     
                     if (keyTransportPredicate != null) {
                         if (keyTransportPredicate.apply(new KeyTransportAlgorithmPredicate.SelectionInput(
@@ -368,8 +375,10 @@
             for (EncryptionMethod encryptionMethod : metadataCredContext.getEncryptionMethods()) {
                 String algorithm = encryptionMethod.getAlgorithm();
                 log.trace("Evaluating SAML metadata EncryptionMethod algorithm for data encryption: {}", algorithm);
-                if (isDataEncryptionAlgorithm(algorithm) && whitelistBlacklistPredicate.apply(algorithm)

[... 143 lines stripped ...]