[java-identity-provider COMMIT] /trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseVa...

[noreply at shibboleth.net]

Author: tzeller
Date: Fri Jul 24 17:37:33 2015
New Revision: 7651

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7651&view=rev
Log:
IDP-738 - Validate subj conf address using range.

Use an IP range rather than a string when validating the subject confirmation data address.

https://issues.shibboleth.net/jira/browse/IDP-738

Modified:
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java

Modified: trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java?rev=7651&r1=7650&r2=7651&view=diff
==============================================================================
--- trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java	(original)
+++ trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java	Fri Jul 24 17:37:33 2015
@@ -17,6 +17,7 @@
 
 package net.shibboleth.idp.test.flows.saml2;
 
+import java.net.InetAddress;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -26,6 +27,7 @@
 import javax.annotation.Nullable;
 
 import net.shibboleth.idp.test.flows.AbstractFlowTest;
+import net.shibboleth.utilities.java.support.net.IPRange;
 
 import org.opensaml.core.xml.schema.XSAny;
 import org.opensaml.core.xml.schema.impl.XSAnyBuilder;
@@ -60,6 +62,8 @@
 import org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver;
 import org.testng.Assert;
 
+import com.google.common.net.InetAddresses;
+
 /**
  * SAML 2 {@link #org.opensaml.saml.saml2.core.Response} validator.
  */
@@ -76,6 +80,9 @@
 
     /** Expected subject confirmation method. */
     @Nonnull public String subjectConfirmationMethod = SubjectConfirmation.METHOD_BEARER;
+    
+    /** Expected subject confirmation data address range. Defaults to "127.0.0.1/32". */
+    @Nonnull public IPRange subjectConfirmationDataAddressRange = IPRange.parseCIDRBlock("127.0.0.1/32");
 
     /** Whether authn statements should be validated. */
     @Nonnull public boolean validateAuthnStatements = true;
@@ -407,7 +414,7 @@
     /**
      * Assert that :
      * <ul>
-     * <li>the subject confirmation data address is "127.0.0.1"</li>
+     * <li>the subject confirmation data address is in the expected range</li>
      * <li>the subject confirmation data NotOnOrAfter is not null</li>
      * <li>the subject confirmation data recipient is not null nor empty</li>
      * </ul>
@@ -415,7 +422,8 @@
      * @param subjectConfirmationData the subject confirmation data
      */
     public void assertSubjectConfirmationData(@Nullable final SubjectConfirmationData subjectConfirmationData) {
-        Assert.assertEquals(subjectConfirmationData.getAddress(), "127.0.0.1");
+        final InetAddress address = InetAddresses.forString(subjectConfirmationData.getAddress());
+        Assert.assertTrue(subjectConfirmationDataAddressRange.contains(address));
         // TODO only in some cases ? Assert.assertNotNull(subjectConfirmationData.getNotBefore());
         Assert.assertNotNull(subjectConfirmationData.getNotOnOrAfter());
         Assert.assertNotNull(subjectConfirmationData.getRecipient());