[java-identity-provider COMMIT] /trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/Sta...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Dec 30 15:21:56 2016
New Revision: 8589

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8589&view=rev
Log:
Add ability to turn off name checking for HTTP client cases.

Modified:
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java

Modified: trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java?rev=8589&r1=8588&r2=8589&view=diff
==============================================================================
--- trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java	(original)
+++ trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java	Fri Dec 30 15:21:56 2016
@@ -60,6 +60,14 @@
     /** Verification depth. */
     @Nullable private Integer verifyDepth;
     
+    /** Whether to enable name checking. */
+    private boolean checkNames;
+    
+    /** Constructor. */
+    public StaticPKIXFactoryBean() {
+        checkNames = true;
+    }
+    
     /** {@inheritDoc} */
     @Override
     public Class<?> getObjectType() {
@@ -91,6 +99,18 @@
      */
     public void setVerifyDepth(final int depth) {
         verifyDepth = depth;
+    }
+
+    /**
+     * Set whether the perform name checking in the PKIX layer.
+     * 
+     * Defaults to "true", should generally be disabled when used with an HTTP client
+     * that is already checking names.
+     * 
+     * @param flag flag to set
+     */
+    public void setCheckNames(final boolean flag) {
+        checkNames = flag;
     }
     
     /**
@@ -145,8 +165,13 @@
         
         final StaticPKIXValidationInformationResolver resolver =
                 new StaticPKIXValidationInformationResolver(
-                        Collections.<PKIXValidationInformation>singletonList(info), null, true);
-        return new PKIXX509CredentialTrustEngine(resolver);
+                        Collections.<PKIXValidationInformation>singletonList(info), null, checkNames);
+        
+        if (checkNames) {
+            return new PKIXX509CredentialTrustEngine(resolver);
+        } else {
+            return new PKIXX509CredentialTrustEngine(resolver, null);
+        }
     }
     
 }