[java-opensaml] 02/02: OSJ-209: Support mandatory use of TrustEngine in SecurityEnhancedTLSSocketFactory

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=7c1572939158a6261bf27fcd866fbe4093ee4244

commit 7c1572939158a6261bf27fcd866fbe4093ee4244
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Jun 29 18:53:10 2017 -0400

    OSJ-209: Support mandatory use of TrustEngine in
    SecurityEnhancedTLSSocketFactory
    
    If supportTrustEngine=false, make it non-required.
    Add new method for client TLS only.
---
 .../impl/SecurityEnhancedHttpClientSupport.java    | 31 ++++++++++++++++++----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
index abf9fac..543455f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
@@ -46,7 +46,7 @@ public final class SecurityEnhancedHttpClientSupport {
     /**
      * Build an instance of TLS-capable {@link LayeredConnectionSocketFactory} 
      * wrapped by {@link SecurityEnhancedTLSSocketFactory}, configured for 
-     * server TLS based on a {@link TrustEngine}.
+     * server TLS based on a mandatory {@link TrustEngine} supplied at runtime.
      * 
      * <p>
      * Equivalent to {@link #buildTLSSocketFactory(true, false)}.
@@ -61,8 +61,8 @@ public final class SecurityEnhancedHttpClientSupport {
     /**
      * Build an instance of TLS-capable {@link LayeredConnectionSocketFactory} 
      * wrapped by {@link SecurityEnhancedTLSSocketFactory}, configured for 
-     * server TLS based on a {@link TrustEngine} and additionally configured for 
-     * client TLS support via context client TLS credential.
+     * server TLS based on a mandatory {@link TrustEngine} supplied at runtime,
+     * and additionally configured for optional client TLS support via context client TLS credential.
      * 
      * <p>
      * Equivalent to {@link #buildTLSSocketFactory(true, true)}.
@@ -75,6 +75,25 @@ public final class SecurityEnhancedHttpClientSupport {
     }
     
     /**
+     * Build an instance of TLS-capable {@link LayeredConnectionSocketFactory} 
+     * wrapped by {@link SecurityEnhancedTLSSocketFactory},
+     * configured for optional client TLS support via context client TLS credential.
+     * 
+     * <p>
+     * Server TLS will be based on the default JSSE trust mechanism.
+     * </p>
+     * 
+     * <p>
+     * Equivalent to {@link #buildTLSSocketFactory(false, true)}.
+     * </p>
+     * 
+     * @return a new instance of security-enhanced TLS socket factory 
+     */
+    @Nonnull public static LayeredConnectionSocketFactory buildTLSSocketFactoryWithClientTLSOnly() {
+        return buildTLSSocketFactory(false, true);
+    }
+    
+    /**
      * Build an instance of TLS-capable {@link LayeredConnectionSocketFactory}.
      * 
      * <p>
@@ -86,7 +105,8 @@ public final class SecurityEnhancedHttpClientSupport {
      * <p>
      * If <code>supportTrustEngine</code> is true, then the wrapped factory will be configured
      * with a "no trust" {@link X509TrustManager}, to allow the actual server TLS trust evaluation
-     * to be performed by a {@link TrustEngine}, as documented in {@link SecurityEnhancedTLSSocketFactory}.
+     * to be performed by a mandatory {@link TrustEngine} supplied at runtime,
+     * as documented in {@link SecurityEnhancedTLSSocketFactory}.
      * </p>
      * 
      * <p>
@@ -118,7 +138,8 @@ public final class SecurityEnhancedHttpClientSupport {
                         Collections.<KeyManager>singletonList(new ThreadLocalX509CredentialKeyManager()));
             }
             
-            return new SecurityEnhancedTLSSocketFactory(wrappedFactoryBuilder.build(), new StrictHostnameVerifier());
+            return new SecurityEnhancedTLSSocketFactory(wrappedFactoryBuilder.build(), new StrictHostnameVerifier(), 
+                    supportTrustEngine);
             
         } else {
             return HttpClientSupport.buildStrictTLSSocketFactory();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.