[java-opensaml] 13/16: Implement strategy function for TLS CriteriaSet.
Brent Putman
putmanb at georgetown.edu
Sun Dec 17 00:08:23 EST 2017
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=7b2468a967050664d0a523d9d6345f1ea44cc823
commit 7b2468a967050664d0a523d9d6345f1ea44cc823
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Dec 15 21:27:22 2017 -0500
Implement strategy function for TLS CriteriaSet.
Function stored in MessageContext, and evaluated by
HttpClientSecurityParametersHandler as extra Criterion input.
---
.../{ => soap}/SAMLSOAPClientContextBuilder.java | 103 ++++++++++++++++++++-
.../saml/common/messaging/soap/package-info.java | 21 +++++
.../binding/decoding/impl/HTTPArtifactDecoder.java | 2 +-
.../HttpClientSecurityConfiguration.java | 19 ----
.../httpclient/TLSCriteriaSetCriterion.java | 86 +++++++++++++++++
.../messaging/HttpClientSecurityContext.java | 25 +++++
.../impl/BasicHttpClientSecurityConfiguration.java | 49 ----------
.../BasicHttpClientSecurityParametersResolver.java | 9 +-
...opulateHttpClientSecurityParametersHandler.java | 9 ++
.../BasicHttpClientSecurityConfigurationTest.java | 4 -
...icHttpClientSecurityParametersResolverTest.java | 32 ++++---
11 files changed, 268 insertions(+), 91 deletions(-)
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLSOAPClientContextBuilder.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java
similarity index 67%
rename from opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLSOAPClientContextBuilder.java
rename to opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java
index d35b6a1..188893c 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/SAMLSOAPClientContextBuilder.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java
@@ -15,22 +15,36 @@
* limitations under the License.
*/
-package org.opensaml.saml.common.messaging;
+package org.opensaml.saml.common.messaging.soap;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.xml.namespace.QName;
+import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.messaging.MessageException;
+import org.opensaml.messaging.context.BaseContext;
import org.opensaml.messaging.context.InOutOperationContext;
import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.RecursiveTypedParentContextLookup;
import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
+import org.opensaml.saml.common.messaging.context.SAMLProtocolContext;
import org.opensaml.saml.common.messaging.context.SAMLSelfEntityContext;
+import org.opensaml.saml.criterion.EntityRoleCriterion;
+import org.opensaml.saml.criterion.ProtocolCriterion;
+import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
+import org.opensaml.security.credential.UsageType;
+import org.opensaml.security.criteria.UsageCriterion;
+import org.opensaml.security.messaging.HttpClientSecurityContext;
+
+import com.google.common.base.Function;
+
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
//TODO when impl finished, document required vs optional data and derivation rules
@@ -61,6 +75,9 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
/** The SAML peer RoleDescriptor. **/
private RoleDescriptor peerRoleDescriptor;
+ /** TLS CriteriaSet strategy. */
+ private Function<MessageContext<?>, CriteriaSet> tlsCriteriaSetStrategy;
+
/**
* Get the outbound message.
*
@@ -212,6 +229,31 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
}
/**
+ * Get the TLS CriteriaSet strategy.
+ *
+ * @return Returns the tlsCriteriaSetStrategy.
+ */
+ @Nullable public Function<MessageContext<?>, CriteriaSet> getTLSCriteriaSetStrategy() {
+ if (tlsCriteriaSetStrategy != null) {
+ return tlsCriteriaSetStrategy;
+ } else {
+ return new DefaultTLSCriteriaSetStrategy();
+ }
+ }
+
+ /**
+ * Set the TLS CriteriaSet strategy.
+ *
+ * @param strategy the strategy
+ * @return this builder instance
+ */
+ @Nonnull public SAMLSOAPClientContextBuilder<InboundMessageType, OutboundMessageType>
+ setTLSCriteriaSetStrategy(@Nullable final Function<MessageContext<?>, CriteriaSet> strategy) {
+ tlsCriteriaSetStrategy = strategy;
+ return this;
+ }
+
+ /**
* Build the new operation context.
*
* @return the operation context
@@ -225,13 +267,22 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
final MessageContext<OutboundMessageType> outboundContext = new MessageContext<OutboundMessageType>();
outboundContext.setMessage(getOutboundMessage());
+ final Function<MessageContext<?>, CriteriaSet> tlsStrategy = getTLSCriteriaSetStrategy();
+ if (tlsStrategy != null) {
+ outboundContext.getSubcontext(HttpClientSecurityContext.class, true)
+ .setTLSCriteriaSetStrategy(tlsStrategy);
+ }
+
final InOutOperationContext<InboundMessageType, OutboundMessageType> opContext =
new InOutOperationContext<>(null, outboundContext);
+ // This is just so it's easy to change.
+ final BaseContext parent = opContext;
+
//TODO is this required always?
final String selfID = getSelfEntityID();
if (selfID != null) {
- final SAMLSelfEntityContext selfContext = opContext.getSubcontext(SAMLSelfEntityContext.class, true);
+ final SAMLSelfEntityContext selfContext = parent.getSubcontext(SAMLSelfEntityContext.class, true);
selfContext.setEntityId(selfID);
}
@@ -244,7 +295,7 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
if (peerRoleName == null) {
errorMissingData("Peer role");
}
- final SAMLPeerEntityContext peerContext = opContext.getSubcontext(SAMLPeerEntityContext.class, true);
+ final SAMLPeerEntityContext peerContext = parent.getSubcontext(SAMLPeerEntityContext.class, true);
peerContext.setEntityId(peerID);
peerContext.setRole(peerRoleName);
@@ -265,5 +316,51 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
private void errorMissingData(@Nonnull final String details) throws MessageException {
throw new MessageException("Required context data was not supplied or derivable: " + details);
}
+
+ /** Default TLS CriteriaSet strategy function. */
+ public static class DefaultTLSCriteriaSetStrategy implements Function<MessageContext<?>, CriteriaSet> {
+
+ /** {@inheritDoc} */
+ public CriteriaSet apply(@Nullable final MessageContext<?> messageContext) {
+ final CriteriaSet criteria = new CriteriaSet();
+ criteria.add(new UsageCriterion(UsageType.SIGNING));
+
+ if (messageContext == null) {
+ return criteria;
+ }
+
+ // This should be consistent with what build() does above.
+ final BaseContext parent = new RecursiveTypedParentContextLookup<>(InOutOperationContext.class)
+ .apply(messageContext);
+ if (parent == null) {
+ return criteria;
+ }
+
+ final SAMLProtocolContext protocolContext = parent.getSubcontext(SAMLProtocolContext.class);
+ if (protocolContext != null && protocolContext.getProtocol() != null) {
+ criteria.add(new ProtocolCriterion(protocolContext.getProtocol()));
+ }
+
+ final SAMLPeerEntityContext peerContext = parent.getSubcontext(SAMLPeerEntityContext.class);
+ if (peerContext == null) {
+ return criteria;
+ }
+
+ final SAMLMetadataContext metadataContext = peerContext.getSubcontext(SAMLMetadataContext.class);
+ if (metadataContext != null && metadataContext.getRoleDescriptor() != null) {
+ criteria.add(new RoleDescriptorCriterion(metadataContext.getRoleDescriptor()));
+ return criteria;
+ } else {
+ if (peerContext.getEntityId() != null) {
+ criteria.add(new EntityIdCriterion(peerContext.getEntityId()));
+ }
+ if (peerContext.getRole() != null) {
+ criteria.add(new EntityRoleCriterion(peerContext.getRole()));
+ }
+ return criteria;
+ }
+ }
+
+ }
}
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java
new file mode 100644
index 0000000..f8b2a6a
--- /dev/null
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java
@@ -0,0 +1,21 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Support classes for SAML SOAP message operations.
+ */
+package org.opensaml.saml.common.messaging.soap;
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
index edc73fc..21deb7f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
@@ -38,8 +38,8 @@ import org.opensaml.saml.common.binding.SAMLBindingSupport;
import org.opensaml.saml.common.binding.artifact.SAMLSourceLocationArtifact;
import org.opensaml.saml.common.binding.decoding.SAMLMessageDecoder;
import org.opensaml.saml.common.binding.impl.DefaultEndpointResolver;
-import org.opensaml.saml.common.messaging.SAMLSOAPClientContextBuilder;
import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
+import org.opensaml.saml.common.messaging.soap.SAMLSOAPClientContextBuilder;
import org.opensaml.saml.common.xml.SAMLConstants;
import org.opensaml.saml.config.SAMLConfigurationSupport;
import org.opensaml.saml.criterion.ArtifactCriterion;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
index 2596eae..a03021e 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
@@ -21,14 +21,11 @@ import java.util.List;
import javax.annotation.Nullable;
-import org.apache.http.client.AuthCache;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
/**
* The security configuration information to use when performing HTTP client requests.
*/
@@ -42,15 +39,6 @@ public interface HttpClientSecurityConfiguration {
@Nullable public CredentialsProvider getCredentialsProvider();
/**
- * Get an instance of {@link AuthCache} used for authentication by the HttpClient instance.
- *
- * @return the cache, or null
- *
- * @since 3.4.0
- */
- @Nullable public AuthCache getAuthCache();
-
- /**
* Sets the optional trust engine used in evaluating server TLS credentials.
*
* @return the trust engine instance to use, or null
@@ -58,13 +46,6 @@ public interface HttpClientSecurityConfiguration {
@Nullable public TrustEngine<? super X509Credential> getTLSTrustEngine();
/**
- * Get the optional criteria set used in evaluating server TLS credentials.
- *
- * @return the criteria set instance to use
- */
- @Nullable public CriteriaSet getTLSCriteriaSet();
-
- /**
* Get the optional list of TLS protocols.
*
* @return the TLS protocols, or null
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java
new file mode 100644
index 0000000..c347394
--- /dev/null
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java
@@ -0,0 +1,86 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.security.httpclient;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.resolver.Criterion;
+
+
+/**
+ * An implementation of {@link Criterion} which specifies criteria pertaining
+ * usage of the resolved credential.
+ */
+public final class TLSCriteriaSetCriterion implements Criterion {
+
+ /** TLS CriteriaSet data. */
+ private CriteriaSet criteriaSet;
+
+ /**
+ * Constructor.
+ *
+ * @param usage the usage for which a credential is intended
+ */
+ public TLSCriteriaSetCriterion(@Nullable final CriteriaSet criteria) {
+ criteriaSet = Constraint.isNotNull(criteria, "TLS CriteriaSet was null");
+ }
+
+ /**
+ * Get the key usage criteria.
+ *
+ * @return Returns the usage.
+ */
+ @Nonnull public CriteriaSet getCriteria() {
+ return criteriaSet;
+ }
+
+ /** {@inheritDoc} */
+ public String toString() {
+ final StringBuilder builder = new StringBuilder();
+ builder.append("CriteriaSet=");
+ builder.append(criteriaSet);
+ builder.append("]");
+ return builder.toString();
+ }
+
+ /** {@inheritDoc} */
+ public int hashCode() {
+ return criteriaSet.hashCode();
+ }
+
+ /** {@inheritDoc} */
+ public boolean equals(final Object obj) {
+ if (this == obj) {
+ return true;
+ }
+
+ if (obj == null) {
+ return false;
+ }
+
+ if (obj instanceof TLSCriteriaSetCriterion) {
+ return criteriaSet.equals(((TLSCriteriaSetCriterion) obj).criteriaSet);
+ }
+
+ return false;
+ }
+
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
index 8db6cde..cde7629 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
@@ -20,8 +20,13 @@ package org.opensaml.security.messaging;
import javax.annotation.Nullable;
import org.opensaml.messaging.context.BaseContext;
+import org.opensaml.messaging.context.MessageContext;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import com.google.common.base.Function;
+
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
/**
* A context implementation holding parameters related to {@link org.apache.http.client.HttpClient} security features.
*/
@@ -30,6 +35,9 @@ public class HttpClientSecurityContext extends BaseContext {
/** The HttpClient security parameters instance. */
private HttpClientSecurityParameters securityParameters;
+ /** TLS criteria strategy function. */
+ private Function<MessageContext<?>, CriteriaSet> tlsCriteriaSetStrategy;
+
/**
* Get the {@link HttpClientSecurityParameters} instance.
*
@@ -48,4 +56,21 @@ public class HttpClientSecurityContext extends BaseContext {
securityParameters = parameters;
}
+ /**
+ * Get the TLS criteria strategy function.
+ *
+ * @return the strategy function, or null
+ */
+ @Nullable public Function<MessageContext<?>, CriteriaSet> getTLSCriteriaSetStrategy() {
+ return tlsCriteriaSetStrategy;
+ }
+
+ /**
+ * Set the TLS criteria strategy function
+ *
+ * @param strategy the strategy function instance, or null
+ */
+ public void setTLSCriteriaSetStrategy(@Nullable final Function<MessageContext<?>, CriteriaSet> strategy) {
+ tlsCriteriaSetStrategy = strategy;
+ }
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
index 49b3186..f651bef 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
import org.apache.http.auth.AuthScope;
import org.apache.http.auth.UsernamePasswordCredentials;
-import org.apache.http.client.AuthCache;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
@@ -34,7 +33,6 @@ import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
* Basic implementation of {@link HttpClientSecurityConfiguration}.
@@ -44,15 +42,9 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
/** HttpClient credentials provider. */
@Nullable private CredentialsProvider credentialsProvider;
- /** HttpClient {@link AuthCache} to allow pre-emptive authentication. */
- @Nullable private AuthCache authCache;
-
/** Optional trust engine used in evaluating server TLS credentials. */
@Nullable private TrustEngine<? super X509Credential> tlsTrustEngine;
- /** Optional criteria set used in evaluating server TLS credentials. */
- @Nullable private CriteriaSet tlsCriteriaSet;
-
/** TLS Protocols. */
@Nullable private List<String> tlsProtocols;
@@ -84,29 +76,6 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
}
/**
- * Get an instance of {@link AuthCache} used for authentication by the HttpClient instance.
- *
- * @return the cache, or null
- *
- * @since 3.4.0
- */
- @Nullable public AuthCache getAuthCache() {
- return authCache;
- }
-
- /**
- * Set an instance of {@link AuthCache} used for authentication by the HttpClient instance.
- *
- * @param cache the auth cache
- *
- * @since 3.4.0
- */
- public void setAuthCache(@Nullable final AuthCache cache) {
- authCache = cache;
- }
-
-
- /**
* A convenience method to set a (single) username and password used for BASIC authentication.
* To disable BASIC authentication pass null for the credentials instance.
*
@@ -174,24 +143,6 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
}
/**
- * Get the optional criteria set used in evaluating server TLS credentials.
- *
- * @return the criteria set instance to use
- */
- @Nullable public CriteriaSet getTLSCriteriaSet() {
- return tlsCriteriaSet;
- }
-
- /**
- * Set the optional criteria set used in evaluating server TLS credentials.
- *
- * @param criteriaSet the new criteria set instance to use
- */
- public void setTLSCriteriaSet(@Nullable final CriteriaSet criteriaSet) {
- tlsCriteriaSet = criteriaSet;
- }
-
- /**
* Get the optional list of TLS protocols.
*
* @return the TLS protocols, or null
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
index b77161b..9e64e8a 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
@@ -28,6 +28,7 @@ import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
import org.opensaml.security.httpclient.HttpClientSecurityConfigurationCriterion;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecurityParametersResolver;
+import org.opensaml.security.httpclient.TLSCriteriaSetCriterion;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
@@ -96,8 +97,6 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
criteria.get(HttpClientSecurityConfigurationCriterion.class).getConfigurations();
for (final HttpClientSecurityConfiguration config : configs) {
- params.setAuthCache(ObjectSupport.firstNonNull(params.getAuthCache(),
- config.getAuthCache()));
params.setClientTLSCredential(ObjectSupport.firstNonNull(params.getClientTLSCredential(),
config.getClientTLSCredential()));
params.setCredentialsProvider(ObjectSupport.firstNonNull(params.getCredentialsProvider(),
@@ -106,13 +105,15 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
config.getHostnameVerifier()));
params.setTLSCipherSuites(ObjectSupport.firstNonNull(params.getTLSCipherSuites(),
config.getTLSCipherSuites()));
- params.setTLSCriteriaSet(ObjectSupport.firstNonNull(params.getTLSCriteriaSet(),
- config.getTLSCriteriaSet()));
params.setTLSProtocols(ObjectSupport.firstNonNull(params.getTLSProtocols(),
config.getTLSProtocols()));
params.setTLSTrustEngine(ObjectSupport.<TrustEngine<? super X509Credential>>firstNonNull(
params.getTLSTrustEngine(), config.getTLSTrustEngine()));
}
+
+ if (criteria.contains(TLSCriteriaSetCriterion.class)) {
+ params.setTLSCriteriaSet(criteria.get(TLSCriteriaSetCriterion.class).getCriteria());
+ }
}
/**
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
index bca0973..ef4ea58 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
@@ -31,6 +31,7 @@ import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
import org.opensaml.security.httpclient.HttpClientSecurityConfigurationCriterion;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecurityParametersResolver;
+import org.opensaml.security.httpclient.TLSCriteriaSetCriterion;
import org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration;
import org.opensaml.security.messaging.HttpClientSecurityContext;
import org.slf4j.Logger;
@@ -193,6 +194,14 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
final CriteriaSet criteria = new CriteriaSet(new HttpClientSecurityConfigurationCriterion(configs));
+ if (paramsCtx.getTLSCriteriaSetStrategy() != null) {
+ final CriteriaSet tlsCriteriaSet = paramsCtx.getTLSCriteriaSetStrategy().apply(messageContext);
+ if (tlsCriteriaSet != null) {
+ criteria.add(new TLSCriteriaSetCriterion(tlsCriteriaSet));
+ }
+ }
+
+
try {
final HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
paramsCtx.setSecurityParameters(params);
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
index 874766a..36eb2c0 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
@@ -54,21 +54,17 @@ public class BasicHttpClientSecurityConfigurationTest {
@Test
public void testBasic() {
BasicHttpClientSecurityConfiguration config = new BasicHttpClientSecurityConfiguration();
- config.setAuthCache(new BasicAuthCache());
config.setClientTLSCredential(x509Credential);
config.setCredentialsProvider(new BasicCredentialsProvider());
config.setHostnameVerifier(new StrictHostnameVerifier());
config.setTLSCipherSuites(Lists.newArrayList("test"));
- config.setTLSCriteriaSet(new CriteriaSet());
config.setTLSProtocols(Lists.newArrayList("test"));
config.setTLSTrustEngine(new MockTrustEngine());
- Assert.assertNotNull(config.getAuthCache());
Assert.assertNotNull(config.getClientTLSCredential());
Assert.assertNotNull(config.getCredentialsProvider());
Assert.assertNotNull(config.getHostnameVerifier());
Assert.assertNotNull(config.getTLSCipherSuites());
- Assert.assertNotNull(config.getTLSCriteriaSet());
Assert.assertNotNull(config.getTLSProtocols());
Assert.assertNotNull(config.getTLSTrustEngine());
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index 1d54639..5edfcc8 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -23,13 +23,13 @@ import java.security.KeyException;
import java.security.cert.CertificateException;
import org.apache.http.conn.ssl.StrictHostnameVerifier;
-import org.apache.http.impl.client.BasicAuthCache;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.CredentialSupport;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.httpclient.HttpClientSecurityConfigurationCriterion;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import org.opensaml.security.httpclient.TLSCriteriaSetCriterion;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509Support;
@@ -76,12 +76,12 @@ public class BasicHttpClientSecurityParametersResolverTest {
HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
Assert.assertNotNull(params);;
- Assert.assertNotNull(params.getAuthCache());
+ Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
- Assert.assertNotNull(params.getTLSCriteriaSet());
+ Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
}
@@ -117,12 +117,12 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
Assert.assertNotNull(params);;
- Assert.assertNotNull(params.getAuthCache());
+ Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
- Assert.assertNotNull(params.getTLSCriteriaSet());
+ Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
@@ -134,12 +134,12 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
Assert.assertNotNull(params);;
- Assert.assertNotNull(params.getAuthCache());
+ Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
- Assert.assertNotNull(params.getTLSCriteriaSet());
+ Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
@@ -151,12 +151,12 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
Assert.assertNotNull(params);;
- Assert.assertNotNull(params.getAuthCache());
+ Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
Assert.assertNotNull(params.getHostnameVerifier());
Assert.assertNotNull(params.getTLSCipherSuites());
- Assert.assertNotNull(params.getTLSCriteriaSet());
+ Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
}
@@ -208,17 +208,27 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertSame(params.getClientTLSCredential(), config3.getClientTLSCredential());
}
+ @Test
+ public void testTLSCriteriaSet() throws ResolverException {
+ CriteriaSet criteria = new CriteriaSet(new HttpClientSecurityConfigurationCriterion(
+ new BasicHttpClientSecurityConfiguration()));
+ criteria.add(new TLSCriteriaSetCriterion(new CriteriaSet()));
+
+ HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
+
+ Assert.assertNotNull(params);;
+ Assert.assertNotNull(params.getTLSCriteriaSet());
+ }
+
// Helpers
private BasicHttpClientSecurityConfiguration buildBaseConfiguration(X509Credential x509Credential) {
BasicHttpClientSecurityConfiguration config = new BasicHttpClientSecurityConfiguration();
- config.setAuthCache(new BasicAuthCache());
config.setClientTLSCredential(x509Credential);
config.setCredentialsProvider(new BasicCredentialsProvider());
config.setHostnameVerifier(new StrictHostnameVerifier());
config.setTLSCipherSuites(Lists.newArrayList("test"));
- config.setTLSCriteriaSet(new CriteriaSet());
config.setTLSProtocols(Lists.newArrayList("test"));
config.setTLSTrustEngine(new MockTrustEngine());
return config;
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list