[java-opensaml COMMIT] in /trunk/opensaml-saml-impl/src: main/java/org/opensaml/saml/metadata/resolver/impl/AbstractD...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Nov  7 17:59:28 2016
New Revision: 4571

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4571&view=rev
Log:
OSJ-184: Setting persistentCacheManagerDirectory breaks dynamic metadata resolver

Ensure that the cloned object that we effectively filter and then use as the live object
preserves the DOM, rooted in a new document. This is necessary so that things like signature
validation still work.

Modified:
    trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
    trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolverTest.java

Modified: trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java?rev=4571&r1=4570&r2=4571&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java	(original)
+++ trunk/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java	Mon Nov  7 17:59:28 2016
@@ -720,7 +720,7 @@
             //   1) the root doesn't expose its source byte[] via object metadata, and
             //   2) the object can't be successfully round-tripped (e.g signatures).
             try {
-                return XMLObjectSupport.cloneXMLObject(input, CloneOutputOption.DropDOM);
+                return XMLObjectSupport.cloneXMLObject(input, CloneOutputOption.RootDOMInNewDocument);
             } catch (MarshallingException | UnmarshallingException e) {
                 log.warn("Error cloning XMLObject, will use input root object as filter target", e);
                 return input;

Modified: trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolverTest.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolverTest.java?rev=4571&r1=4570&r2=4571&view=diff
==============================================================================
--- trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolverTest.java	(original)
+++ trunk/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolverTest.java	Mon Nov  7 17:59:28 2016
@@ -19,6 +19,9 @@
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.security.KeyPair;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Timer;
@@ -31,10 +34,25 @@
 import org.opensaml.core.xml.persist.MapLoadSaveManager;
 import org.opensaml.core.xml.persist.XMLObjectLoadSaveManager;
 import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter;
 import org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver.DynamicEntityBackingStore;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.security.SecurityException;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialSupport;
+import org.opensaml.security.credential.impl.StaticCredentialResolver;
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.security.crypto.KeySupport;
+import org.opensaml.xmlsec.SignatureSigningParameters;
+import org.opensaml.xmlsec.config.DefaultSecurityConfigurationBootstrap;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+import org.opensaml.xmlsec.signature.support.SignatureException;
+import org.opensaml.xmlsec.signature.support.SignatureSupport;
+import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
+import org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine;
 import org.testng.Assert;
 import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
@@ -60,13 +78,39 @@
     private String id1, id2, id3;
     private EntityDescriptor ed1, ed2, ed3;
     
+    private Credential signingCred;
+    private SignatureSigningParameters signingParams;
+    private SignatureTrustEngine signatureTrustEngine;
+    private SignatureValidationFilter signatureValidationFilter;
+    
+    @BeforeClass
+    protected void setUpSigningSupport() throws NoSuchAlgorithmException, NoSuchProviderException {
+        KeyPair kp = KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_RSA, 1024, null);
+        signingCred = CredentialSupport.getSimpleCredential(kp.getPublic(), kp.getPrivate());
+        

[... 97 lines stripped ...]