[java-identity-provider COMMIT] /trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingpart...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Oct 24 16:29:37 2016
New Revision: 8532

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8532&view=rev
Log:
IDP-1071: Config schema and parser support for HttpClientSecurityParameters in HTTP metadata resolvers.

Support client TLS via HttpClientSecurityParameters using new OpenSAML support class.

Modified:
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/TLSSocketFactoryFactoryBean.java

Modified: trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/TLSSocketFactoryFactoryBean.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/TLSSocketFactoryFactoryBean.java?rev=8532&r1=8531&r2=8532&view=diff
==============================================================================
--- trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/TLSSocketFactoryFactoryBean.java	(original)
+++ trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/TLSSocketFactoryFactoryBean.java	Mon Oct 24 16:29:37 2016
@@ -21,9 +21,8 @@
 
 import org.apache.http.client.HttpClient;
 import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
 import org.opensaml.security.httpclient.HttpClientSecurityParameters;
-import org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory;
+import org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport;
 import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.X509Credential;
 import org.springframework.beans.factory.config.AbstractFactoryBean;
@@ -78,10 +77,12 @@
 
     /** {@inheritDoc} */
     protected Object createInstance() throws Exception {
-        if (tlsTrustEngine != null 
-                || (httpClientSecurityParameters != null && httpClientSecurityParameters.getTLSTrustEngine() != null)) {
-            return  new SecurityEnhancedTLSSocketFactory(HttpClientSupport.buildNoTrustTLSSocketFactory(), 
-                    new StrictHostnameVerifier());
+        final boolean haveTrustEngine = (tlsTrustEngine != null 
+                || (httpClientSecurityParameters != null && httpClientSecurityParameters.getTLSTrustEngine() != null));
+        final boolean haveClientTLSCred = 
+                (httpClientSecurityParameters != null && httpClientSecurityParameters.getClientTLSCredential() != null);
+        if (haveTrustEngine || haveClientTLSCred) {
+            return SecurityEnhancedHttpClientSupport.buildTLSSocketFactory(haveTrustEngine, haveClientTLSCred);
         } else if (connectionDisregardTLSCertificate) {
             return HttpClientSupport.buildNoTrustTLSSocketFactory();
         } else {