[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src: main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseC...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Jun  5 12:51:14 2015
New Revision: 4283

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4283&view=rev
Log:
Add support for one-time-use replay cache expiration to be specified per-invocation via a validation context param.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidatorTest.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidatorTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java?rev=4283&r1=4282&r2=4283&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java	Fri Jun  5 12:51:14 2015
@@ -17,6 +17,7 @@
 
 package org.opensaml.saml.saml2.assertion.impl;
 
+import java.security.PublicKey;
 import java.util.Objects;
 
 import javax.annotation.Nonnull;
@@ -42,8 +43,9 @@
  * {@link ConditionValidator} used for {@link OneTimeUse} conditions.
  * 
  * <p>
- * This validator does not expect any parameters in the {@link ValidationContext#getStaticParameters()} or
- * {@link ValidationContext#getDynamicParameters()}.
+ * This validator supports an optional parameters {@link #ONE_TIME_USE_EXPIRES_PARAM} in the 
+ * {@link ValidationContext#getStaticParameters()}. This validator does not expect any parameters 
+ * in the or {@link ValidationContext#getDynamicParameters()}.
  * </p>
  * 
  * <p>
@@ -52,6 +54,13 @@
  */
 @ThreadSafe
 public class OneTimeUseConditionValidator implements ConditionValidator {
+    
+    /**
+     * The name of the {@link ValidationContext#getStaticParameters()} carrying the {@link Long}
+     * per-invocation value for the Assertion replay cache expiration, in milliseconds.
+     */
+    public static final String ONE_TIME_USE_EXPIRES_PARAM = OneTimeUseConditionValidator.class.getName()
+            + ".OneTimeUseExpires";
     
     /** Cache context name. */
     public static final String CACHE_CONTEXT = OneTimeUseConditionValidator.class.getName();
@@ -136,7 +145,21 @@
      * @return the effective one-time use expiration for the assertion being evaluated
      */
     protected long getExpires(Assertion assertion, ValidationContext context) {
-        return System.currentTimeMillis() + getReplayCacheExpires();
+        Long expires = null;
+        try {
+            expires = (Long) context.getStaticParameters().get(ONE_TIME_USE_EXPIRES_PARAM);
+        } catch (ClassCastException e) {
+            log.warn("Value of param was not a Long: {}", ONE_TIME_USE_EXPIRES_PARAM);
+        }
+        log.debug("Saw one-time use cache expires context param: {}", expires);
+        if (expires == null) {
+            expires = getReplayCacheExpires();
+        }
+        log.debug("Effective one-time use cache expires of: {}", expires);
+        
+        long computedExpiration = System.currentTimeMillis() + expires;
+        log.debug("Computed one-time use cache effective expiration time of: {}", computedExpiration);
+        return computedExpiration;
     }
 
     /**

Modified: trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidatorTest.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidatorTest.java?rev=4283&r1=4282&r2=4283&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidatorTest.java	(original)
+++ trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/HolderOfKeySubjectConfirmationValidatorTest.java	Fri Jun  5 12:51:14 2015
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.saml2.assertion.impl;
 
-import java.io.File;
 import java.net.URISyntaxException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
@@ -34,7 +33,6 @@
 import org.opensaml.saml.saml2.core.KeyInfoConfirmationDataType;
 import org.opensaml.saml.saml2.core.SubjectConfirmation;
 import org.opensaml.saml.saml2.core.SubjectConfirmationData;
-import org.opensaml.security.x509.X509Support;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.testng.Assert;

Modified: trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidatorTest.java

[... 73 lines stripped ...]