[java-opensaml] branch master updated: IDP-1380 Move repository sources to test.shibboleth.net
Rod Widdowson
rdw at steadingsoftware.com
Thu Dec 13 10:23:07 EST 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=10b4a2520ce6f53339cefa4a4e46f069eb2d4da0
The following commit(s) were added to refs/heads/master by this push:
new 10b4a25 IDP-1380 Move repository sources to test.shibboleth.net
10b4a25 is described below
commit 10b4a2520ce6f53339cefa4a4e46f069eb2d4da0
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Dec 13 11:36:08 2018 +0000
IDP-1380 Move repository sources to test.shibboleth.net
https://issues.shibboleth.net/jira/browse/IDP-1380
Basically involved adding the correct CA or certificate at all the
right places (plus a few new ones since we cannot rely on the system)
At the same time remove a lot of deprecated usages and make some
helper functions common across tests.
---
.../resolver/filter/impl/EntityRoleFilterTest.java | 41 ++++--
.../filter/impl/SchemaValidationFilterTest.java | 2 +-
.../impl/FileBackedHTTPMetadataResolverTest.java | 147 ++++++++------------
...ctionDrivenDynamicHTTPMetadataResolverTest.java | 149 +++++++++------------
.../resolver/impl/HTTPMetadataResolverTest.java | 129 +++++++++++-------
.../saml/metadata/resolver/impl/repo-entity.crt | 63 +++++----
.../saml/metadata/resolver/impl/repo-rootCA.crt | 62 ++++-----
.../SecurityEnhancedHTTPResourceTest.java | 13 +-
8 files changed, 306 insertions(+), 300 deletions(-)
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilterTest.java
index 856bab0..a5deb26 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilterTest.java
@@ -21,43 +21,61 @@ import java.util.ArrayList;
import javax.xml.namespace.QName;
-import org.apache.http.client.params.AllClientPNames;
-import org.apache.http.impl.client.DefaultHttpClient;
+import org.apache.http.client.HttpClient;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
import org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver;
+import org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolverTest;
import org.opensaml.saml.saml2.metadata.AttributeAuthorityDescriptor;
import org.opensaml.saml.saml2.metadata.IDPSSODescriptor;
import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import org.testng.annotations.BeforeClass;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
import net.shibboleth.utilities.java.support.repository.RepositorySupport;
/**
* Unit tests for {@link EntityRoleFilter}.
*/
- at SuppressWarnings("deprecation")
public class EntityRoleFilterTest extends XMLObjectBaseTestCase {
- private DefaultHttpClient httpClient;
+ private HttpClient httpClient;
+
+ private HttpClientBuilder httpClientBuilder;
+
+ private HTTPMetadataResolver metadataProvider;
+
+ private HttpClientSecurityParameters httpClientParams;
/** URL to InCommon metadata. */
private String inCommonMDURL;
- @BeforeMethod
- protected void setUp() throws Exception {
- httpClient = new DefaultHttpClient();
- httpClient.getParams().setIntParameter(AllClientPNames.CONNECTION_TIMEOUT, 1000 * 5);
-
+ @BeforeClass
+ protected void setUpClass() throws Exception {
+ httpClientBuilder = new HttpClientBuilder();
+ httpClientBuilder.setConnectionTimeout(1000 * 5);
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
+ httpClient = httpClientBuilder.buildClient();
+
+ httpClientParams = new HttpClientSecurityParameters();
+ httpClientParams.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+
inCommonMDURL = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml");
}
+ @BeforeMethod
+ protected void setUpMethod() throws Exception {
+ metadataProvider = new HTTPMetadataResolver(httpClient, inCommonMDURL);
+ metadataProvider.setHttpClientSecurityParameters(httpClientParams);
+ }
+
@Test
public void testWhiteListSPRole() throws Exception {
ArrayList<QName> retainedRoles = new ArrayList<>();
retainedRoles.add(SPSSODescriptor.DEFAULT_ELEMENT_NAME);
- HTTPMetadataResolver metadataProvider = new HTTPMetadataResolver(httpClient, inCommonMDURL);
metadataProvider.setParserPool(parserPool);
metadataProvider.setMetadataFilter(new EntityRoleFilter(retainedRoles));
metadataProvider.setId("test");
@@ -70,7 +88,6 @@ public class EntityRoleFilterTest extends XMLObjectBaseTestCase {
retainedRoles.add(IDPSSODescriptor.DEFAULT_ELEMENT_NAME);
retainedRoles.add(AttributeAuthorityDescriptor.DEFAULT_ELEMENT_NAME);
- HTTPMetadataResolver metadataProvider = new HTTPMetadataResolver(httpClient, inCommonMDURL);
metadataProvider.setParserPool(parserPool);
metadataProvider.setMetadataFilter(new EntityRoleFilter(retainedRoles));
metadataProvider.setId("test");
@@ -80,8 +97,6 @@ public class EntityRoleFilterTest extends XMLObjectBaseTestCase {
@Test
public void testWhiteListNoRole() throws Exception {
ArrayList<QName> retainedRoles = new ArrayList<>();
-
- HTTPMetadataResolver metadataProvider = new HTTPMetadataResolver(httpClient, inCommonMDURL);
metadataProvider.setParserPool(parserPool);
metadataProvider.setMetadataFilter(new EntityRoleFilter(retainedRoles));
metadataProvider.setId("test");
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilterTest.java
index 18e128a..8783887 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilterTest.java
@@ -44,7 +44,7 @@ public class SchemaValidationFilterTest extends XMLObjectBaseTestCase {
httpClient = new DefaultHttpClient();
httpClient.getParams().setIntParameter(AllClientPNames.CONNECTION_TIMEOUT, 1000 * 5);
- inCommonMDURL = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml");
+ inCommonMDURL = RepositorySupport.buildHTTPResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/saml2/metadata/InCommon-metadata.xml", false);
}
@Test
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
index 2f1194c..72516d4 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
@@ -20,34 +20,15 @@ package org.opensaml.saml.metadata.resolver.impl;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
-import java.net.URISyntaxException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.Collections;
-import java.util.Set;
-import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.joda.time.DateTime;
import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.X509Credential;
-import org.opensaml.security.x509.X509Support;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
@@ -57,7 +38,6 @@ import com.google.common.io.Resources;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
-import net.shibboleth.utilities.java.support.httpclient.HttpClientSupport;
import net.shibboleth.utilities.java.support.repository.RepositorySupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -68,12 +48,13 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
*/
public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
- private static final String DATA_PATH = "/org/opensaml/saml/metadata/resolver/impl/";
+ static final String DATA_PATH = "/org/opensaml/saml/metadata/resolver/impl/";
private HttpClientBuilder httpClientBuilder;
private String relativeMDResource;
- private String metadataURL;
+ private String metadataURLHttps;
+ private String metadataURLHttp;
private String badMDURL;
private String backupFilePath;
private FileBackedHTTPMetadataResolver metadataProvider;
@@ -85,7 +66,8 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
httpClientBuilder = new HttpClientBuilder();
relativeMDResource = "org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11472.xml";
- metadataURL = RepositorySupport.buildHTTPSResourceURL("java-opensaml", String.format("opensaml-saml-impl/src/test/resources/%s", relativeMDResource));
+ metadataURLHttps = RepositorySupport.buildHTTPSResourceURL("java-opensaml", String.format("opensaml-saml-impl/src/test/resources/%s", relativeMDResource));
+ metadataURLHttp = RepositorySupport.buildHTTPResourceURL("java-opensaml", String.format("opensaml-saml-impl/src/test/resources/%s", relativeMDResource), false);
entityID = "https://www.example.org/sp";
badMDURL = "http://www.opensaml.org/foo/bar/baz/samlmd";
@@ -108,7 +90,7 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
*/
@Test
public void testGetEntityDescriptor() throws Exception {
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttp, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
metadataProvider.initialize();
@@ -166,7 +148,7 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testFailFastBadBackupFile() throws Exception {
try {
// Use a known existing directory as backup file path, which is an invalid argument.
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, System.getProperty("java.io.tmpdir"));
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, System.getProperty("java.io.tmpdir"));
} catch (ResolverException e) {
Assert.fail("Provider failed bad backup file in constructor");
@@ -191,7 +173,7 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testNoFailFastBadBackupFile() throws Exception {
try {
// Use a known existing directory as backup file path, which is an invalid argument.
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, System.getProperty("java.io.tmpdir"));
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttp, System.getProperty("java.io.tmpdir"));
} catch (ResolverException e) {
Assert.fail("Provider failed bad backup file in constructor");
@@ -226,7 +208,7 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
Assert.assertTrue(backupFile.exists(), "Backup file was not created");
Assert.assertTrue(backupFile.length() > 0, "Backup file contains no data");
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttp, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setFailFastInitialization(true);
metadataProvider.setId("test");
@@ -293,9 +275,9 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test
public void testTrustEngineSocketFactoryNoHTTPSNoTrustEngine() throws Exception {
// Make sure resolver works when TrustEngine socket factory is configured but just using an HTTP URL.
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory(false));
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory(false));
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
metadataProvider.initialize();
@@ -308,12 +290,14 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test
public void testTrustEngineSocketFactoryNoHTTPSWithTrustEngine() throws Exception {
// Make sure resolver works when TrustEngine socket factory is configured but just using an HTTP URL.
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -323,9 +307,9 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test
public void testHTTPSNoTrustEngine() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory(false));
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory(false));
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
metadataProvider.initialize();
@@ -337,12 +321,14 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test
public void testHTTPSTrustEngineExplicitKey() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -353,12 +339,14 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test(expectedExceptions=ComponentInitializationException.class)
public void testHTTPSTrustEngineInvalidKey() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("badKey.crt"));
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("badKey.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -368,12 +356,16 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test
public void testHTTPSTrustEngineValidPKIX() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", null, false));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", null, false));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -383,12 +375,15 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test
public void testHTTPSTrustEngineValidPKIXExplicitName() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", "*.shibboleth.net", true));
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", "test.shibboleth.net", true));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -398,12 +393,15 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test(expectedExceptions=ComponentInitializationException.class)
public void testHTTPSTrustEngineInvalidPKIX() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("badCA.crt", null, false));
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("badCA.crt", null, false));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -413,12 +411,15 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test(expectedExceptions=ComponentInitializationException.class)
public void testHTTPSTrustEngineValidPKIXInvalidName() throws Exception {
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", "foobar.shibboleth.net", true));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", "foobar.shibboleth.net", true));
+ metadataProvider.setHttpClientSecurityParameters(params);
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -429,10 +430,13 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test(expectedExceptions=ComponentInitializationException.class)
public void testHTTPSTrustEngineWrongSocketFactory() throws Exception {
// Trust engine set, but appropriate socket factory not set
- metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps, backupFilePath);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -441,37 +445,4 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
}
- // Helpers
-
- private LayeredConnectionSocketFactory buildTrustEngineSocketFactory() {
- return buildTrustEngineSocketFactory(true);
- }
-
- private LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
- SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
- HttpClientSupport.buildNoTrustTLSSocketFactory(),
- SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
- trustEngineRequired
- );
- return factory;
- }
-
- private TrustEngine<? super X509Credential> buildExplicitKeyTrustEngine(String cert) throws URISyntaxException, CertificateException {
- File certFile = new File(this.getClass().getResource(DATA_PATH + cert).toURI());
- X509Certificate entityCert = X509Support.decodeCertificate(certFile);
- X509Credential entityCredential = new BasicX509Credential(entityCert);
- return new ExplicitKeyTrustEngine(new StaticCredentialResolver(entityCredential));
- }
-
- private TrustEngine<? super X509Credential> buildPKIXTrustEngine(String cert, String name, boolean nameCheckEnabled) throws URISyntaxException, CertificateException {
- File certFile = new File(this.getClass().getResource(DATA_PATH + cert).toURI());
- X509Certificate rootCert = X509Support.decodeCertificate(certFile);
- PKIXValidationInformation info = new BasicPKIXValidationInformation(Collections.singletonList(rootCert), null, 5);
- Set<String> trustedNames = (Set<String>) (name != null ? Collections.singleton(name) : Collections.emptySet());
- StaticPKIXValidationInformationResolver resolver = new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames);
- return new PKIXX509CredentialTrustEngine(resolver,
- new CertPathPKIXTrustEvaluator(),
- (nameCheckEnabled ? new BasicX509CredentialNameEvaluator() : null));
- }
-
}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
index 5660753..9cb6bb9 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
@@ -17,26 +17,10 @@
package org.opensaml.saml.metadata.resolver.impl;
-import java.io.File;
-import java.net.URISyntaxException;
import java.security.MessageDigest;
import java.security.SecureRandom;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
import java.util.Arrays;
-import java.util.Collections;
-import java.util.Set;
-import net.shibboleth.utilities.java.support.codec.StringDigester;
-import net.shibboleth.utilities.java.support.codec.StringDigester.OutputFormat;
-import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
-import net.shibboleth.utilities.java.support.httpclient.HttpClientSupport;
-import net.shibboleth.utilities.java.support.repository.RepositorySupport;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.velocity.VelocityEngine;
-
-import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
import org.opensaml.saml.common.binding.artifact.SAMLSourceIDArtifact;
@@ -45,20 +29,8 @@ import org.opensaml.saml.metadata.resolver.impl.MetadataQueryProtocolRequestURLB
import org.opensaml.saml.metadata.resolver.impl.TemplateRequestURLBuilder.EncodingStyle;
import org.opensaml.saml.saml2.binding.artifact.SAML2ArtifactType0004;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
import org.opensaml.security.crypto.JCAConstants;
-import org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.X509Credential;
-import org.opensaml.security.x509.X509Support;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.testng.Assert;
import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
@@ -66,10 +38,15 @@ import org.testng.annotations.Test;
import com.google.common.collect.Lists;
+import net.shibboleth.utilities.java.support.codec.StringDigester;
+import net.shibboleth.utilities.java.support.codec.StringDigester.OutputFormat;
+import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
+import net.shibboleth.utilities.java.support.repository.RepositorySupport;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import net.shibboleth.utilities.java.support.velocity.VelocityEngine;
+
public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
- private static final String DATA_PATH = "/org/opensaml/saml/metadata/resolver/impl/";
-
private FunctionDrivenDynamicHTTPMetadataResolver resolver;
private HttpClientBuilder httpClientBuilder;
@@ -89,7 +66,7 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
@Test
public void testTemplateFromRepoDefaultContentTypes() throws Exception {
// Repo should return 'text/xml', which is supported by default.
- String template = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/${entityID}.xml");
+ String template = RepositorySupport.buildHTTPResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/${entityID}.xml", false);
String entityID = "https://www.example.org/sp";
// Digesting the entityID is a little artificial for the test, but means we can test more easily against a path in the repo.
@@ -117,7 +94,7 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
@Test(enabled=false)
public void testTemplateFromRepoWithExplicitContentType() throws Exception {
// Explicitly request 'text/plain', and then configure it below to be supported. Also test case-insensitivity.
- String template = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/${entityID}.xml");
+ String template = RepositorySupport.buildHTTPResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/${entityID}.xml", false);
String entityID = "https://www.example.org/sp";
// Digesting the entityID is a little artificial for the test, but means we can test more easily against a path in the repo.
@@ -297,7 +274,7 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory(false));
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory(false));
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
@@ -315,7 +292,7 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
@Test
public void testTrustEngineSocketFactoryNoHTTPSWithTrustEngine() throws Exception {
- String template = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/${entityID}.xml");
+ String template = RepositorySupport.buildHTTPResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/${entityID}.xml", false);
String entityID = "https://www.example.org/sp";
// Digesting the entityID is a little artificial for the test, but means we can test more easily against a path in the repo.
@@ -325,13 +302,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -354,7 +335,7 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory(false));
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory(false));
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
@@ -382,13 +363,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -411,13 +396,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildExplicitKeyTrustEngine("badKey.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("badKey.crt"));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -438,13 +427,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", null, false));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", null, false));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -467,13 +460,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", "*.shibboleth.net", true));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", "test.shibboleth.net", true));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -496,13 +493,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildPKIXTrustEngine("badCA.crt", null, false));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("badCA.crt", null, false));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -523,13 +524,17 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EncodingStyle.path,
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
- httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
+ httpClientBuilder.setTLSSocketFactory(HTTPMetadataResolverTest.buildTrustEngineSocketFactory());
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", "foobar.shibboleth.net", true));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", "foobar.shibboleth.net", true));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -551,12 +556,16 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
new StringDigester("SHA-1", OutputFormat.HEX_LOWER));
// Trust engine set, but appropriate socket factory not set
-
+
resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
resolver.setId("myDynamicResolver");
resolver.setParserPool(parserPool);
resolver.setRequestURLBuilder(requestURLBuilder);
- resolver.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ resolver.setHttpClientSecurityParameters(params);
+
resolver.initialize();
CriteriaSet criteriaSet = new CriteriaSet( new EntityIdCriterion(entityID));
@@ -564,40 +573,4 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
Assert.assertNull(ed);
}
-
-
-
- // Helpers
-
- private LayeredConnectionSocketFactory buildTrustEngineSocketFactory() {
- return buildTrustEngineSocketFactory(true);
- }
-
- private LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
- SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
- HttpClientSupport.buildNoTrustTLSSocketFactory(),
- SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
- trustEngineRequired
- );
- return factory;
- }
-
- private TrustEngine<? super X509Credential> buildExplicitKeyTrustEngine(String cert) throws URISyntaxException, CertificateException {
- File certFile = new File(this.getClass().getResource(DATA_PATH + cert).toURI());
- X509Certificate entityCert = X509Support.decodeCertificate(certFile);
- X509Credential entityCredential = new BasicX509Credential(entityCert);
- return new ExplicitKeyTrustEngine(new StaticCredentialResolver(entityCredential));
- }
-
- private TrustEngine<? super X509Credential> buildPKIXTrustEngine(String cert, String name, boolean nameCheckEnabled) throws URISyntaxException, CertificateException {
- File certFile = new File(this.getClass().getResource(DATA_PATH + cert).toURI());
- X509Certificate rootCert = X509Support.decodeCertificate(certFile);
- PKIXValidationInformation info = new BasicPKIXValidationInformation(Collections.singletonList(rootCert), null, 5);
- Set<String> trustedNames = (Set<String>) (name != null ? Collections.singleton(name) : Collections.emptySet());
- StaticPKIXValidationInformationResolver resolver = new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames);
- return new PKIXX509CredentialTrustEngine(resolver,
- new CertPathPKIXTrustEvaluator(),
- (nameCheckEnabled ? new BasicX509CredentialNameEvaluator() : null));
- }
-
}
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
index da1f3fb..3091a00 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
@@ -30,6 +30,7 @@ import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
import org.opensaml.security.credential.impl.StaticCredentialResolver;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
@@ -43,6 +44,7 @@ import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
import org.testng.Assert;
+import org.testng.annotations.BeforeClass;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -58,30 +60,34 @@ import net.shibboleth.utilities.java.support.resolver.ResolverException;
*/
public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
- private static final String DATA_PATH = "/org/opensaml/saml/metadata/resolver/impl/";
-
private HttpClientBuilder httpClientBuilder;
- private String metadataURL;
+ private String metadataURLHttp;
+ private String metadataURLHttps;
private String badMDURL;
private String entityID;
private HTTPMetadataResolver metadataProvider;
private CriteriaSet criteriaSet;
+ @BeforeClass
+ protected void setUpClass() {
+ metadataURLHttps = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11472.xml");
+ metadataURLHttp = RepositorySupport.buildHTTPResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11472.xml", false);
+ }
+
@BeforeMethod
- protected void setUp() throws Exception {
+ protected void setUpMethod() throws Exception {
httpClientBuilder = new HttpClientBuilder();
- metadataURL = RepositorySupport.buildHTTPSResourceURL("java-opensaml", "opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11472.xml");
-
badMDURL = "http://www.google.com/";
entityID = "https://www.example.org/sp";
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttp);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
metadataProvider.initialize();
+
criteriaSet = new CriteriaSet(new EntityIdCriterion(entityID));
}
@@ -140,7 +146,7 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
// Make sure resolver works when TrustEngine socket factory is configured but just using an HTTP URL.
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory(false));
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
metadataProvider.initialize();
@@ -155,10 +161,13 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
// Make sure resolver works when TrustEngine socket factory is configured but just using an HTTP URL.
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -170,7 +179,7 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSNoTrustEngine() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory(false));
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
metadataProvider.initialize();
@@ -184,10 +193,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSTrustEngineExplicitKey() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -200,10 +213,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSTrustEngineInvalidKey() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("badKey.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("badKey.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -215,10 +232,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSTrustEngineValidPKIX() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", null, false));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", null, false));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -230,10 +251,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSTrustEngineValidPKIXExplicitName() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", "*.shibboleth.net", true));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", "test.shibboleth.net", true));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -245,10 +270,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSTrustEngineInvalidPKIX() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("badCA.crt", null, false));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("badCA.crt", null, false));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -260,10 +289,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public void testHTTPSTrustEngineValidPKIXInvalidName() throws Exception {
httpClientBuilder.setTLSSocketFactory(buildTrustEngineSocketFactory());
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildPKIXTrustEngine("repo-rootCA.crt", "foobar.shibboleth.net", true));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildPKIXTrustEngine("repo-rootCA.crt", "foobar.shibboleth.net", true));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -274,10 +307,14 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
@Test(expectedExceptions=ComponentInitializationException.class)
public void testHTTPSTrustEngineWrongSocketFactory() throws Exception {
// Trust engine set, but appropriate socket factory not set
- metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL);
+ metadataProvider = new HTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURLHttps);
metadataProvider.setParserPool(parserPool);
metadataProvider.setId("test");
- metadataProvider.setTLSTrustEngine(buildExplicitKeyTrustEngine("repo-entity.crt"));
+
+ final HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setTLSTrustEngine(HTTPMetadataResolverTest.buildExplicitKeyTrustEngine("repo-entity.crt"));
+ metadataProvider.setHttpClientSecurityParameters(params);
+
metadataProvider.initialize();
EntityDescriptor descriptor = metadataProvider.resolveSingle(criteriaSet);
@@ -289,11 +326,29 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
// Helpers
- private LayeredConnectionSocketFactory buildTrustEngineSocketFactory() {
+ public static TrustEngine<? super X509Credential> buildPKIXTrustEngine(String cert, String name, boolean nameCheckEnabled) throws URISyntaxException, CertificateException {
+ File certFile = new File(FileBackedHTTPMetadataResolver.class.getResource(FileBackedHTTPMetadataResolverTest.DATA_PATH + cert).toURI());
+ X509Certificate rootCert = X509Support.decodeCertificate(certFile);
+ PKIXValidationInformation info = new BasicPKIXValidationInformation(Collections.singletonList(rootCert), null, 5);
+ Set<String> trustedNames = (Set<String>) (name != null ? Collections.singleton(name) : Collections.emptySet());
+ StaticPKIXValidationInformationResolver resolver = new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames);
+ return new PKIXX509CredentialTrustEngine(resolver,
+ new CertPathPKIXTrustEvaluator(),
+ (nameCheckEnabled ? new BasicX509CredentialNameEvaluator() : null));
+ }
+
+ public static TrustEngine<? super X509Credential> buildExplicitKeyTrustEngine(String cert) throws URISyntaxException, CertificateException {
+ File certFile = new File(FileBackedHTTPMetadataResolver.class.getResource(FileBackedHTTPMetadataResolverTest.DATA_PATH + cert).toURI());
+ X509Certificate entityCert = X509Support.decodeCertificate(certFile);
+ X509Credential entityCredential = new BasicX509Credential(entityCert);
+ return new ExplicitKeyTrustEngine(new StaticCredentialResolver(entityCredential));
+ }
+
+ public static LayeredConnectionSocketFactory buildTrustEngineSocketFactory() {
return buildTrustEngineSocketFactory(true);
}
- private LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
+ public static LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
HttpClientSupport.buildNoTrustTLSSocketFactory(),
SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
@@ -302,22 +357,4 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
return factory;
}
- private TrustEngine<? super X509Credential> buildExplicitKeyTrustEngine(String cert) throws URISyntaxException, CertificateException {
- File certFile = new File(this.getClass().getResource(DATA_PATH + cert).toURI());
- X509Certificate entityCert = X509Support.decodeCertificate(certFile);
- X509Credential entityCredential = new BasicX509Credential(entityCert);
- return new ExplicitKeyTrustEngine(new StaticCredentialResolver(entityCredential));
- }
-
- private TrustEngine<? super X509Credential> buildPKIXTrustEngine(String cert, String name, boolean nameCheckEnabled) throws URISyntaxException, CertificateException {
- File certFile = new File(this.getClass().getResource(DATA_PATH + cert).toURI());
- X509Certificate rootCert = X509Support.decodeCertificate(certFile);
- PKIXValidationInformation info = new BasicPKIXValidationInformation(Collections.singletonList(rootCert), null, 5);
- Set<String> trustedNames = (Set<String>) (name != null ? Collections.singleton(name) : Collections.emptySet());
- StaticPKIXValidationInformationResolver resolver = new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames);
- return new PKIXX509CredentialTrustEngine(resolver,
- new CertPathPKIXTrustEvaluator(),
- (nameCheckEnabled ? new BasicX509CredentialNameEvaluator() : null));
- }
-
-}
\ No newline at end of file
+}
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-entity.crt b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-entity.crt
index 900b38f..b983425 100644
--- a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-entity.crt
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-entity.crt
@@ -1,32 +1,39 @@
## This is the current *.shibboleth.net wildcard cert, expires Jan 2019.
-----BEGIN CERTIFICATE-----
-MIIFDjCCA/agAwIBAgIUdnR7SqD521AChztho7tl+/HLFyMwDQYJKoZIhvcNAQEL
-BQAwTTELMAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxIzAh
-BgNVBAMTGlF1b1ZhZGlzIEdsb2JhbCBTU0wgSUNBIEcyMB4XDTE3MDEwNDA5MTcy
-NFoXDTE5MDEwNDA5MTcyMVowgYwxCzAJBgNVBAYTAkdCMRAwDgYDVQQIEwdCcmlz
-dG9sMRAwDgYDVQQHEwdCcmlzdG9sMR4wHAYDVQQKExVKaXNjIFNlcnZpY2VzIExp
-bWl0ZWQxHjAcBgNVBAsTFVNoaWJib2xldGggQ29uc29ydGl1bTEZMBcGA1UEAwwQ
-Ki5zaGliYm9sZXRoLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AM6gYqSI4ZIF3aOKDjWGeNIE3gDpuBldu92YJSx9y02WJ51WAnf4z4i746/Zzs/M
-hJ9aiqr/jly2uJHuLRSMct8/BfeEuLkkt9G11QxhhmIlnsoS4a1LSPx7cj2Ga2bc
-EMHZZrOAPjOZdmQxoYImX8DXU/r9pJhM/OTKm6X/wX2dMEJpHdSv8jyjvBTc2MTL
-Tx2mSvGZxEJ4QWWgE/xHtNXsbbX60/mDdh9Ghok5k9gxwZwddhHALPmNgzjh0Bk0
-rNq2f/bhRKzm0ODXShXSMDYK1Ry5zy5VAXqBExthB5s35oXn2zHzKV0lFUHUIi9v
-tXxUzLDKpWUB5Bb6QPa+fKMCAwEAAaOCAaQwggGgMHMGCCsGAQUFBwEBBGcwZTAq
-BggrBgEFBQcwAYYeaHR0cDovL29jc3AucXVvdmFkaXNnbG9iYWwuY29tMDcGCCsG
-AQUFBzAChitodHRwOi8vdHJ1c3QucXVvdmFkaXNnbG9iYWwuY29tL3F2c3NsZzIu
-Y3J0MCsGA1UdEQQkMCKCECouc2hpYmJvbGV0aC5uZXSCDnNoaWJib2xldGgubmV0
-MFEGA1UdIARKMEgwRgYMKwYBBAG+WAACZAEBMDYwNAYIKwYBBQUHAgEWKGh0dHA6
-Ly93d3cucXVvdmFkaXNnbG9iYWwuY29tL3JlcG9zaXRvcnkwDgYDVR0PAQH/BAQD
-AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBSR
-GWKtWxenMPvw3jklsb2MubhRJzA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3Js
-LnF1b3ZhZGlzZ2xvYmFsLmNvbS9xdnNzbGcyLmNybDAdBgNVHQ4EFgQUtblck29X
-TVA0UbqsT4WpABb4fqswDQYJKoZIhvcNAQELBQADggEBABhCGXmDsgxmVGNz9+Re
-b4HmQdXEU8BDgVbXgHLngjLRARKgfpFttfhvQ2fCDQSf5QGHe84JTH/9NicIj3Gb
-aMjHUU3t2zWjBCbL9zL6DUgmDliNLtXyKGgO1BqOj41jKory6l154lKf31EO/lB5
-E5cxMoE4qUohcdvnzYKauXr8GBc9By20eX5E+abzdn95ZuV0m+ZQyY5CW2sojIIk
-0grsnPFSIGgY7YWG0HkH4p/2WnMPXgsNpl41RNx/CKL3a6kWPgIpbunUCVEbLWCO
-Bgor2SHVd04AVV2ZMvqP1/fNvF7h4ouCTuyKsarED0ioj5KtTPMbH/EP6J2LEZV6
-x3w=
+MIIGazCCBFOgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCVVMx
+DTALBgNVBAgMBE9oaW8xHjAcBgNVBAoMFVNoaWJib2xldGggQ29uc29ydGl1bTEr
+MCkGA1UEAwwiU2hpYmJvbGV0aCBQcm9qZWN0IEludGVybWVkaWF0ZSBDQTAeFw0x
+ODEyMTExNTE5NDlaFw0zODEyMDYxNTE5NDlaMFoxCzAJBgNVBAYTAlVTMQ0wCwYD
+VQQIDARPaGlvMR4wHAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xHDAaBgNV
+BAMME3Rlc3Quc2hpYmJvbGV0aC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQDI39TBFEbOkf0Bb2h/qnG4bbJRF5Ga9OBgSAxPsx2PNgVmf1cvJYlq
+uRCzATu3O4PPclomow5VU7hB+umpk2s03FHejUtO8w85qQx7bkSeyfLpMYloX3SD
+AWDFSpw54Tg2Dfja6jYLnE0aYWUCTXjcFJEIrT0QP1Azdk8b9PeKLqGIagECUMzC
+UjmJxEcyqhbe6mB7tdSsBng+R4DRdVdouN4rtHknNuEyAc5eEppGxY33KXhElYol
+4IK6YxAqXI6iQIDdcVxrH061/iKh7qT1bCAEmzeeoS4st4v4oyIhxUk7yUxYOuFc
+NhYUd5U93Ws4P8xPFzcPhD2TIZDAS/bnm2EJ+JxLG6Gp1jhBN5qTpdTPWiG9+Tmm
+HFuYOrSefgZk0edkJhe0dycfV/FWFX2fNrmkpQhyPQzb3ZyZ5mACn020TXDaF5o3
+fX8ndLl4RghTORJs5n51TuLX85DEeZWkJe5f8Hsip1mpmxlMTl9QMqHrN70n5gBi
+uCYo9g/Jw5xoropCq7Jri9K9FWtbORncUIXutsTVo+fXeHZ6IDRoovR004gHHEJ7
+ks46fZQYNbd8bB/mPlCdYiFyJnfUiOu89O5aLqvhrJNgPUhMt/gmhSV7zw+/3/cd
+o7pwWH2h2ObuS8v8gVUZAE04tefqRJZEB0YsWA3DASDT7nVqndOp2QIDAQABo4IB
+KjCCASYwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUG3Vg4ubsJVaylBUCPtqVc9mHWfYwgYwGA1UdIwSBhDCBgYAUELzfpij2mkrs
+9B4CEsXYmoN6cKuhZaRjMGExCzAJBgNVBAYTAlVTMQ0wCwYDVQQIDARPaGlvMR4w
+HAYDVQQKDBVTaGliYm9sZXRoIENvbnNvcnRpdW0xIzAhBgNVBAMMGlNoaWJib2xl
+dGggUHJvamVjdCBUZXN0IENBggIQADAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAww
+CgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZQF7KzKGSPieV2eQWbFt30
+kVZzVe/T5UAvrr8n7mRqMfye4QtHHOVM3MHvZv93AXVUQU4PH9KPGtv7poEtwNWk
+7hNbq74z5x5tSvE0EYYI9UMolDL6il+QR5AgLw7YqgMmPPhtm+crmLg8+uMoQDyU
+uSH8ej4rMrdhL2xKlgvL/rhWycpYu1cFLmeolljOZGqr7ITwWJ06BQsLtt4/cyYj
+WiVldHQRZMGAuHLHlX+ukaEg7Gc/N7o936bS5d7AqXwtmtkXiA8An5q5rhncEK1G
+kwUUQN2y5iyx/nD4B2k1IcgFlu/bM4iXZQtmMUtLptUqRssuxS45ukiweiM9UU8n
+WxyxJMzFTctJJ2f/y4Bg5ggsr4WQU/YhoDaQVYxyjXiBt3oT+7eqsoep9HK9xwbG
+xriLzrlao+K3EcKA3vjKGYh15gpEDUbn0Cr5V74TUSdkHjhG7ocaJ5u9/vCS4+AR
+iU5ge2zN6QcwoZKT8+8XGKeXqVc/3hXeXTn3FyvMitPDZsmg8wUhnb/pq5MyKqUA
+bNse4a7oGAeAUGkLf4Q+eLCLSZmL5udrGXdHIffFYqZVcZS+zVWQ1TRfodTDPkFb
+KTz1mcr4KjLNCtplu4CfFpHwC20uk3hPEslOUd+ugj0+HGNH93L7H0WL1GDQoCPh
+RcdRISVwORcD/dit15zD
-----END CERTIFICATE-----
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-rootCA.crt b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-rootCA.crt
index 35cc4eb..89e896f 100644
--- a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-rootCA.crt
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/repo-rootCA.crt
@@ -1,33 +1,33 @@
-----BEGIN CERTIFICATE-----
-MIIFtzCCA5+gAwIBAgICBQkwDQYJKoZIhvcNAQEFBQAwRTELMAkGA1UEBhMCQk0x
-GTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMTElF1b1ZhZGlzIFJv
-b3QgQ0EgMjAeFw0wNjExMjQxODI3MDBaFw0zMTExMjQxODIzMzNaMEUxCzAJBgNV
-BAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9W
-YWRpcyBSb290IENBIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCa
-GMpLlA0ALa8DKYrwD4HIrkwZhR0In6spRIXzL4GtMh6QRr+jhiYaHv5+HBg6XJxg
-Fyo6dIMzMH1hVBHL7avg5tKifvVrbxi3Cgst/ek+7wrGsxDp3MJGF/hd/aTa/55J
-WpzmM+Yklvc/ulsrHHo1wtZn/qtmUIttKGAr79dgw8eTvI02kfN/+NsRE8Scd3bB
-rrcCaoF6qUWD4gXmuVbBlDePSHFjIuwXZQeVikvfj8ZaCuWw419eaxGrDPmF60Tp
-+ARz8un+XJiM9XOva7R+zdRcAitMOeGylZUtQofX1bOQQ7dsE/He3fbE+Ik/0XX1
-ksOR1YqI0JDs3G3eicJlcZaLDQP9nL9bFqyS2+r+eXyt66/3FsvbzSUr5R/7mp/i
-Ucw6UwxI5g69ybR2BlLmEROFcmMDBOAENisgGQLodKcftslWZvB1JdxnwQ5hYIiz
-PtGo/KPaHbDRsSNU30R2be1B2MGyIrZTHN81Hdyhdyox5C315eXbyOD/5YDXC2Og
-/zOhD7osFRXql7PSorW+8oyWHhqPHWykYTe5hnMz15eWniN9gqRMgeKh0bpnX5UH
-oycR7hYQe7xFSkyyBNKr79X9DFHOUGoIMfmR2gyPZFwDwzqLID9ujWc9Otb+fVuI
-yV77zGHcizN300QyNQliBJIWENieJ0f7OyHj+OsdWwIDAQABo4GwMIGtMA8GA1Ud
-EwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMB0GA1UdDgQWBBQahGK8SEwzJQTU7tD2
-A8QZRtGUazBuBgNVHSMEZzBlgBQahGK8SEwzJQTU7tD2A8QZRtGUa6FJpEcwRTEL
-MAkGA1UEBhMCQk0xGTAXBgNVBAoTEFF1b1ZhZGlzIExpbWl0ZWQxGzAZBgNVBAMT
-ElF1b1ZhZGlzIFJvb3QgQ0EgMoICBQkwDQYJKoZIhvcNAQEFBQADggIBAD4KFk2f
-BluornFdLwUvZ+YTRYPENvbzwCYMDbVHZF34tHLJRqUDGCdViXh9duqWNIAXINzn
-g/iN/Ae42l9NLmeyhP3ZRPx3UIHmfLTJDQtyU/h2BwdBR5YM++CCJpNVjP4iH2Bl
-fF/nJrP3MpCYUNQ3cVX2kiF495V5+vgtJodmVjB3pjd4M1IQWK4/YY7yarHvGH5K
-WWPKjaJW1acvvFYfzznB4vsKqBUsfU16Y8Zsl0Q80m/DShcK+JDSV6IZUaUtl0Ha
-B0+pUNqQjZRG4T7wlP0QADj1O+hA4bRuVhogzG9Yje0uRY/W6ZM/57Es3zrWIozc
-hLsib9D45MY56QSIPMO661V6bYCZJPVsAfv4l7CUW+v90m/xd2gNNWQjrLhVoQPR
-TUIZ3Ph1WVaj+ahJefivDrkRoHy3au000LYmYjgahwz46P0u05B/B5EqHdZ+XIWD
-mbA4CD/pXvk1B+TJYm5Xf6dQlfe6yJvmjqIBxdZmv3lh8zwc4bmCXF2gw+nYSL0Z
-ohEUGW6yhhtoPkg3Goi3XZZenMfvJ2II4pEZXNLxId26F0KCl3GBUzGpn/Z9Yr9y
-4aOTHcyKJloJONDO1w2AFrR4pTqHTI2KpdVGl/IsELm8VCLAAVBpQ570su9t+Oza
-8eOx79+Rj1QqCyXBJhnEUhAFZdWCEOrCMc0u
+MIIFqDCCA5CgAwIBAgIJAIEDdQdu3nBaMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV
+BAYTAlVTMQ0wCwYDVQQIDARPaGlvMR4wHAYDVQQKDBVTaGliYm9sZXRoIENvbnNv
+cnRpdW0xIzAhBgNVBAMMGlNoaWJib2xldGggUHJvamVjdCBUZXN0IENBMB4XDTE4
+MTIxMTE0NTQzM1oXDTQ2MDQyODE0NTQzM1owYTELMAkGA1UEBhMCVVMxDTALBgNV
+BAgMBE9oaW8xHjAcBgNVBAoMFVNoaWJib2xldGggQ29uc29ydGl1bTEjMCEGA1UE
+AwwaU2hpYmJvbGV0aCBQcm9qZWN0IFRlc3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQCq4lNY743on4A4/E5dOYCbscXE+lsJtDjd8fyFXmXqYpfi
+1KP6Vh8foWEvG70dEQR4oxxcA1que2HbqIaQtWOT4LJBWTvUNF+dKFiDkTHkzbxx
+FnzJVPXYDzrDz2CbWpAh496S8BsT7+84+TqGGngJs2POFcHhQFAxr7Of9pKwGLXz
+BWCes+FSjst7yLrrrbkB8MXuHD5h+EjK+C552jECqCmgabbThESsMleVqBcjmuoH
+X2BejIghRsw5Y8wGq5hWr92lOD86p+Hn3kC+4yR20XCQu9P+l/ZPlzFkW/FFDPPh
+6U9ZP1Kf1hDkkDQDZLtyy5xLs0ew+4rjxlH4Bmh45zBcDprd8yA6hnoIN4w5IFF+
+w1bZTUPlNvMdf/4EjVIJ8UFfJXTMSD2VPeTd1veb/uaAtToU599u7ITh2gaZGfh3
+AmXUR2gX9+eKbJG4fXHwLxkddl/dSjgbFRPrtBgp/w8DNZICmpJSpdWvmSY/o8ix
+Tq1ZKX8UuzrsBOtG0Y7Fi/aJtrsgD9KqpnGEhBFWJ8zFHHdZIUMKacUJgzFARlsM
+e/eoM49a4oCqFfPeRgriC9eWfFbRIH86RBjuVk8Rs/q35mkpk702eEnf0kdB7E/q
+JE4qgBnEhSONl2ytTt7rsrw19jXCw+FOfHB2KQa50h59wsKF3oaCoG4f5hZC/wID
+AQABo2MwYTAdBgNVHQ4EFgQU6lFKNP6lo4e1TixtvcdR5NVuxfkwHwYDVR0jBBgw
+FoAU6lFKNP6lo4e1TixtvcdR5NVuxfkwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B
+Af8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBADt/nRWMaUr396xdtu/UNtzm0dfp
+zyqusqaD09JbqW1mQJ/fH6mZ+yPOYd7h5A47znPe9o0jJlR11GcPvRPTM4IR8aLB
+ogK05TGtWP6sBNR8vld87C5e1hKRwoHDqyLUriK/hpi30zB4B+whW0kty6wqF9lt
+X819emItLgDr1qS6v9iDd9AS4xmpcRxP47YugvlIKBNeiuK+UXhY3lBYg4453Pgn
+Fi78GoOM51oEY1LrCpiXSly4sz25MflM47Cppxh5fAIPoFsqRwmpJ3lETBmLCe6v
+7Shjgc0bEidlAxF8BPoXKvMSkjfBRmmhw6UvJ158NmKWSXV6r6x1ZWG/5N2GKpO4
+1eV7RNV4ojpyc87RJJdpstcFJFVjBzEVZ9EcohG1/UDHITu3e5XPrtgPQZGXKjX5
+EHtO5hDb6xxkblQ6qe1L3Ga+ZfNg1rHIpicYz1yZS5mR0dD1LJrzwyan9s1Ld5IU
+v2YWniDlnFXBFWC+9hRF544aN2M/7Q10J13ZYg7d2YbOnp2XhTV1Ud7T/PN4wxHu
+aTJ+2OEsL2Uy4oQ5bGEfgkG22NVxOpAR5/baAoqwxUxIXmE9ub2jVOPt6AzLeNdr
+RaPULkvHLvGMy+VpAqEIPG1OiROg+tWKRmDhF5PtOTneeHR2yHjjWGO+DDY7sAEu
+JWXY3HAfr1aJ7DVm
-----END CERTIFICATE-----
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
index 9d2d2b3..848b998 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
@@ -29,6 +29,7 @@ import net.shibboleth.ext.spring.resource.HTTPResource;
import net.shibboleth.ext.spring.resource.ResourceTestHelper;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
+import net.shibboleth.utilities.java.support.repository.RepositorySupport;
import org.apache.http.client.HttpClient;
import org.apache.http.conn.ssl.X509HostnameVerifier;
@@ -43,8 +44,10 @@ import org.testng.annotations.Test;
*/
public class SecurityEnhancedHTTPResourceTest {
- private final String existsURL =
- "https://git.shibboleth.net/view/?p=spring-extensions.git;a=blob_plain;f=src/test/resources/data/document.xml;h=e8ec7c0d20c7a6b8193e1868398cda0c28df45ed;hb=HEAD";
+ private final String path = "net/shibboleth/ext/spring/resource/document.xml";
+ private final String pathPrefix = "src/test/resources/";
+ private final String existsHttps = RepositorySupport.buildHTTPSResourceURL("spring-extensions", pathPrefix+ path);
+ private final String existsHttp = RepositorySupport.buildHTTPResourceURL("spring-extensions", pathPrefix+ path, false);
private HttpClient client;
private HttpClientSecurityParameters params;
@@ -62,14 +65,14 @@ public class SecurityEnhancedHTTPResourceTest {
}
@Test public void testNoSecurityAdded() throws IOException, ComponentInitializationException {
- final HTTPResource existsResource = new HTTPResource(client, existsURL);
+ final HTTPResource existsResource = new HTTPResource(client, existsHttp);
existsResource.setHttpClientContextHandler(handler);
Assert.assertTrue(ResourceTestHelper.compare(existsResource, new ClassPathResource("net/shibboleth/ext/spring/resource/document.xml")));
}
@Test public void testHostnameRejected() throws IOException, ComponentInitializationException {
- final HTTPResource existsResource = new HTTPResource(client, existsURL);
+ final HTTPResource existsResource = new HTTPResource(client, existsHttps);
existsResource.setHttpClientContextHandler(handler);
params.setHostnameVerifier(new X509HostnameVerifier() {
@@ -91,7 +94,7 @@ public class SecurityEnhancedHTTPResourceTest {
}
@Test public void testBadSSLProtocol() throws IOException, ComponentInitializationException {
- final HTTPResource existsResource = new HTTPResource(client, existsURL);
+ final HTTPResource existsResource = new HTTPResource(client, existsHttps);
existsResource.setHttpClientContextHandler(handler);
params.setTLSProtocols(Collections.singletonList("SSLv3"));
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list