[java-identity-provider] branch master updated: Add explicit trusted name support to StaticPKIX factory bean.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0f032acad08a4286b235d8fa7345eaa9acf81812

The following commit(s) were added to refs/heads/master by this push:
       new  0f032ac   Add explicit trusted name support to StaticPKIX factory bean.
0f032ac is described below

commit 0f032acad08a4286b235d8fa7345eaa9acf81812
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Aug 14 12:36:20 2018 -0400

    Add explicit trusted name support to StaticPKIX factory bean.
---
 .../spring/factory/StaticPKIXFactoryBean.java      | 26 +++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
index dd49486..75d2830 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
@@ -24,8 +24,11 @@ import java.security.cert.CertificateException;
 import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -40,6 +43,9 @@ import org.slf4j.LoggerFactory;
 import org.springframework.beans.FatalBeanException;
 import org.springframework.core.io.Resource;
 
+import com.google.common.base.Predicates;
+import com.google.common.collect.Collections2;
+
 import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 
@@ -62,6 +68,9 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
     /** Verification depth. */
     @Nullable private Integer verifyDepth;
     
+    /** Explicit subject name(s) to match. */
+    @Nullable private Set<String> trustedNames;
+    
     /** Whether to enable name checking. */
     private boolean checkNames;
     
@@ -118,6 +127,21 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
     }
     
     /**
+     * Set explicitly trusted names to match against credential.
+     * 
+     * @param names explicitly trusted names
+     * 
+     * @since 3.4.0
+     */
+    public void setTrustedNames(@Nullable @NonnullElements final Collection<String> names) {
+        if (names != null) {
+            trustedNames = new HashSet<>(Collections2.filter(names, Predicates.notNull()));
+        } else {
+            trustedNames = null;
+        }
+    }
+    
+    /**
      * Get the configured certificates.
      * 
      * @return the certificates
@@ -169,7 +193,7 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
         
         final StaticPKIXValidationInformationResolver resolver =
                 new StaticPKIXValidationInformationResolver(
-                        Collections.<PKIXValidationInformation>singletonList(info), null, checkNames);
+                        Collections.<PKIXValidationInformation>singletonList(info), trustedNames, checkNames);
         
         if (checkNames) {
             return new PKIXX509CredentialTrustEngine(resolver);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.