[java-identity-provider] 01/03: IDP-1371 Conform CAS proxy HttpClient machinery.

Marvin S. Addison marvin.addison at gmail.com
Thu Dec 13 11:40:09 EST 2018


This is an automated email from the git hooks/post-receive script.

serac pushed a commit to branch maint-3.4
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8912433ebb66fac9499e3042686950b8fe9a2482

commit 8912433ebb66fac9499e3042686950b8fe9a2482
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Tue Dec 11 10:38:06 2018 -0500

    IDP-1371 Conform CAS proxy HttpClient machinery.
    
    Leverage existing IdP beans and OpenSAML components to configure the
    HttpClient instance used to authenticate CAS proxy callback endpoints.
---
 .../cas/proxy/impl/HttpClientProxyValidator.java   | 172 +++++----------------
 .../proxy/impl/HttpClientProxyValidatorTest.java   |  15 +-
 .../src/test/resources/credentials/idp-1371.p12    | Bin 0 -> 6509 bytes
 .../src/test/resources/spring/test-flow-beans.xml  |  65 ++++----
 idp-conf/src/main/resources/conf/cas-protocol.xml  |   5 +-
 .../resources/system/conf/cas-protocol-system.xml  |  42 +++--
 .../idp/test/flows/cas/TestProxyValidator.java     |  15 +-
 7 files changed, 115 insertions(+), 199 deletions(-)

diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
index 4e95191..f39ab3f 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
@@ -17,18 +17,19 @@
 
 package net.shibboleth.idp.cas.proxy.impl;
 
-import java.io.Closeable;
+import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET;
+
 import java.io.IOException;
 import java.net.URI;
 import java.security.GeneralSecurityException;
 import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
 import java.util.Collections;
 import java.util.Set;
 
 import javax.annotation.Nonnull;
-import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import javax.security.auth.login.CredentialException;
 import javax.security.auth.login.FailedLoginException;
 
 import com.google.common.base.Function;
@@ -40,34 +41,24 @@ import net.shibboleth.idp.cas.service.Service;
 import net.shibboleth.idp.cas.service.ServiceContext;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+import org.apache.http.HttpResponse;
 import org.apache.http.client.ClientProtocolException;
-import org.apache.http.client.config.RequestConfig;
-import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.HttpClient;
 import org.apache.http.client.methods.HttpGet;
-import org.apache.http.config.Registry;
-import org.apache.http.config.RegistryBuilder;
-import org.apache.http.conn.socket.ConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.conn.ssl.TrustStrategy;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClients;
-import org.apache.http.impl.conn.BasicHttpClientConnectionManager;
-import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.client.protocol.HttpClientContext;
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.criterion.EntityRoleCriterion;
 import org.opensaml.saml.criterion.ProtocolCriterion;
 import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
-import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import org.opensaml.security.httpclient.HttpClientSecuritySupport;
 import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -89,47 +80,35 @@ public class HttpClientProxyValidator implements ProxyValidator {
     /** Required https scheme for proxy callbacks. */
     protected static final String HTTPS_SCHEME = "https";
 
-    /** Default connection and socket timeout in ms. */
-    private static final int DEFAULT_TIMEOUT = 800;
-
     /** Class logger. */
     private final Logger log = LoggerFactory.getLogger(HttpClientProxyValidator.class);
 
-    /** Trust engine that validates proxy endpoint TLS certificates. */
-    @Nonnull
-    private final TrustEngine<? super X509Credential> trustEngine;
-
     /** Looks up a ServiceContext from the profile request context. */
     private final Function<ProfileRequestContext, ServiceContext> serviceCtxLookupFunction = Functions.compose(
             new ChildContextLookup<ProtocolContext, ServiceContext>(ServiceContext.class),
             new ChildContextLookup<ProfileRequestContext, ProtocolContext>(ProtocolContext.class));
 
+    /** HTTP client that connects to proxy callback endpoint. */
+    private final HttpClient httpClient;
+
+    /** HTTP client security parameters. */
+    private final HttpClientSecurityParameters securityParameters;
+
     /** List of HTTP response codes permitted for successful proxy callback. */
     @NotEmpty
     @NonnullElements
     private Set<Integer> allowedResponseCodes = Collections.singleton(200);
 
-    /** Connection and socket timeout. */
-    @Positive
-    private int timeout = DEFAULT_TIMEOUT;
-
 
     /**
      * Creates a new instance.
      *
      * @param engine Trust engine to use for validating proxy X.509 certificate credentials.
      */
-    public HttpClientProxyValidator(@Nonnull final TrustEngine<? super X509Credential> engine) {
-        trustEngine = Constraint.isNotNull(engine, "Trust engine cannot be null");
-    }
-
-    /**
-     * Sets connect and socket timeouts for HTTP connection to proxy callback endpoint.
-     *
-     * @param timeoutMillis Non-zero timeout in milliseconds for both connection and socket timeouts.
-     */
-    public void setTimeout(@Positive final int timeoutMillis) {
-        timeout = (int) Constraint.isGreaterThan(0, timeoutMillis, "Timeout must be positive");
+    public HttpClientProxyValidator(
+            @Nonnull final HttpClient client, @Nonnull final HttpClientSecurityParameters parameters) {
+        httpClient = Constraint.isNotNull(client, "HTTP client cannot be null");
+        securityParameters = Constraint.isNotNull(parameters, "HTTP client security parameters cannot be null");
     }
 
     /**
@@ -172,22 +151,19 @@ public class HttpClientProxyValidator implements ProxyValidator {
      * @throws GeneralSecurityException On connection errors, e.g. invalid/untrusted cert.
      */
     protected int connect(@Nonnull final URI uri, @Nonnull Service service) throws GeneralSecurityException {
-
-        CloseableHttpClient httpClient = null;
-        CloseableHttpResponse response = null;
+        final HttpClientContext clientContext = HttpClientContext.create();
+        HttpClientSecuritySupport.marshalSecurityParameters(clientContext, securityParameters, true);
+        setCASTLSTrustEngineCriteria(clientContext, service);
+        HttpResponse response;
         try {
-            httpClient = createHttpClient(service);
-            log.debug("Attempting to connect to {}", uri);
+            log.debug("Attempting to validate CAS proxy callback URI {}", uri);
             final HttpGet request = new HttpGet(uri);
-            request.setConfig(
-                    RequestConfig.custom()
-                            .setConnectTimeout(timeout)
-                            .setSocketTimeout(timeout)
-                            .build());
-            response = httpClient.execute(request);
+            response = httpClient.execute(request, clientContext);
             return response.getStatusLine().getStatusCode();
         } catch (final ClientProtocolException e) {
             throw new GeneralSecurityException("HTTP protocol error", e);
+        } catch (final SSLPeerUnverifiedException e) {
+            throw new CredentialException("Untrusted certificate presented by CAS proxy callback endpoint");
         } catch (final SSLException e) {
             if (e.getCause() instanceof CertificateException) {
                 throw (CertificateException) e.getCause();
@@ -195,91 +171,21 @@ public class HttpClientProxyValidator implements ProxyValidator {
             throw new GeneralSecurityException("SSL connection error", e);
         } catch (final IOException e) {
             throw new GeneralSecurityException("IO error", e);
-        } finally {
-            close(response);
-            close(httpClient);
-        }
-    }
-
-    /**
-     * Build HTTP client.
-     * 
-     * @param service CAS service.
-     * @return HTTP client
-     */
-    protected CloseableHttpClient createHttpClient(final Service service) {
-        final SSLConnectionSocketFactory socketFactory;
-        try {
-            final SSLContext sslContext = SSLContextBuilder.create()
-                    .loadTrustMaterial(null, new TrustEngineTrustStrategy(service))
-                    .build();
-            socketFactory = new SSLConnectionSocketFactory(sslContext);
-        } catch (final Exception e) {
-            throw new RuntimeException("SSL initialization error", e);
         }
-        final Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
-                .register(HTTPS_SCHEME, socketFactory).build();
-        final BasicHttpClientConnectionManager connectionManager = new BasicHttpClientConnectionManager(registry);
-        return HttpClients.custom().setConnectionManager(connectionManager).build();
     }
 
-    /**
-     * Close the resource.
-     * 
-     * @param resource the resource to close
-     */
-    private void close(final Closeable resource) {
-        if (resource != null) {
-            try {
-                resource.close();
-            } catch (final IOException e) {
-                log.warn("Error closing " + resource, e);
-            }
-        }
-    }
-
-    /**
-     * Delegates X.509 certificate trust to an underlying OpenSAML <code>TrustEngine</code>.
-     */
-    private class TrustEngineTrustStrategy implements TrustStrategy {
-
-        /** Class logger. */
-        private final Logger log = LoggerFactory.getLogger(TrustEngineTrustStrategy.class);
-
-        /** CAS protocol service. */
-        private final Service service;
-
-
-        public TrustEngineTrustStrategy(final Service s) {
-            service = s;
-        }
-
-        @Override
-        public boolean isTrusted(final X509Certificate[] certificates, final String authType)
-                throws CertificateException {
-            if (certificates == null || certificates.length < 1) {
-                return false;
-            }
-            // Assume the first certificate is the end-entity cert
-            try {
-                log.debug("Validating cert {} issued by {}",
-                        certificates[0].getSubjectDN().getName(),
-                        certificates[0].getIssuerDN().getName());
-                final String entityID;
-                if (service.getEntityDescriptor() != null) {
-                    entityID = service.getEntityDescriptor().getEntityID();
-                } else {
-                    entityID = service.getName();
-                }
-                final CriteriaSet criteria = new CriteriaSet(
-                        new EntityIdCriterion(entityID),
-                        new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
-                        new ProtocolCriterion(AbstractProtocolConfiguration.PROTOCOL_URI),
-                        new UsageCriterion(UsageType.SIGNING));
-                return trustEngine.validate(new BasicX509Credential(certificates[0]), criteria);
-            } catch (final SecurityException e) {
-                throw new CertificateException("X509 validation error", e);
-            }
+    private static void setCASTLSTrustEngineCriteria(final HttpClientContext context, final Service service) {
+        final String entityID;
+        if (service.getEntityDescriptor() != null) {
+            entityID = service.getEntityDescriptor().getEntityID();
+        } else {
+            entityID = service.getName();
         }
+        final CriteriaSet criteria = new CriteriaSet(
+                new EntityIdCriterion(entityID),
+                new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
+                new ProtocolCriterion(AbstractProtocolConfiguration.PROTOCOL_URI),
+                new UsageCriterion(UsageType.SIGNING));
+        context.setAttribute(CONTEXT_KEY_CRITERIA_SET, criteria);
     }
 }
diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java
index 77cc07d..e89dac5 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java
@@ -19,8 +19,10 @@ package net.shibboleth.idp.cas.proxy.impl;
 
 import java.io.IOException;
 import java.net.URI;
+import java.security.GeneralSecurityException;
 import java.security.cert.CertificateException;
 
+import javax.security.auth.login.CredentialException;
 import javax.security.auth.login.FailedLoginException;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -81,12 +83,20 @@ public class HttpClientProxyValidatorTest extends AbstractFlowActionTest {
                         new FailedLoginException()
                 },
 
-                // Untrusted cert
+                // Untrusted self-signed cert
                 new Object[] {
                         "https://localhost:8443",
                         "src/test/resources/credentials/nobody-2.p12",
                         200,
-                        new CertificateException(),
+                        new CredentialException(),
+                },
+
+                // Untrusted cert signed by commercial CA that appears in default system truststore
+                new Object[] {
+                        "https://localhost:8443",
+                        "src/test/resources/credentials/idp-1371.p12",
+                        200,
+                        new CredentialException(),
                 },
         };
     }
@@ -98,7 +108,6 @@ public class HttpClientProxyValidatorTest extends AbstractFlowActionTest {
         Server server = null;
         try {
             server = startServer(keyStorePath, new ConfigurableStatusHandler(status));
-            validator.setTimeout(5000); // 5s timeout for Windows
             validator.validate(
                     buildProfileRequestContext(serviceURL),
                     new URI("https://localhost:8443/?pgtId=A&pgtIOU=B"));
diff --git a/idp-cas-impl/src/test/resources/credentials/idp-1371.p12 b/idp-cas-impl/src/test/resources/credentials/idp-1371.p12
new file mode 100644
index 0000000..61daeed
Binary files /dev/null and b/idp-cas-impl/src/test/resources/credentials/idp-1371.p12 differ
diff --git a/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml b/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
index bb2aa42..47916f6 100644
--- a/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
+++ b/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml
@@ -85,9 +85,8 @@
         <ref bean="shibboleth.CASServiceRegistry" />
     </util:list>
 
-    <util:list id="shibboleth.CASProxyTrustedCertificates">
-        <bean class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"
-                  p:resource="classpath:/credentials/localhost.pem" />
+    <util:list id="shibboleth.CASProxyTrustedCertificates" value-type="java.lang.String">
+        <value>classpath:/credentials/localhost.pem</value>
     </util:list>
 
     <bean id="shibboleth.MetadataCredentialResolver"
@@ -145,33 +144,47 @@
         </property>
     </bean>
 
-    <bean id="proxyTrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
-        <constructor-arg name="chain">
-            <list>
-                <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
-                      c:resolver-ref="shibboleth.MetadataCredentialResolver" />
-                <bean class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine" c:nameEvaluator="#{null}">
-                    <constructor-arg name="resolver">
-                        <bean class="org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver" c:names="#{null}">
-                            <constructor-arg name="info">
-                                <bean class="org.opensaml.security.x509.impl.BasicPKIXValidationInformation"
-                                      c:anchors="#{getObject('shibboleth.CASProxyTrustedCertificates') ?: getObject('shibboleth.DefaultCASProxyTrustedCertificates')}"
-                                      c:crls="#{null}"
-                                      c:depth="5" />
-                            </constructor-arg>
-                        </bean>
-                    </constructor-arg>
-                    <constructor-arg name="pkixEvaluator">
-                        <bean class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator" />
-                    </constructor-arg>
-                </bean>
-            </list>
-        </constructor-arg>
+    <bean id="shibboleth.NonCachingHttpClient"
+          lazy-init="true"
+          class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean"
+          p:connectionDisregardTLSCertificate="false"
+          p:connectionTimeout="PT1M"
+          p:connectionRequestTimeout="PT1M"
+          p:socketTimeout="PT1M"
+          p:maxConnectionsTotal="10"
+          p:maxConnectionsPerRoute="10" />
+
+    <bean id="shibboleth.SecurityEnhancedTLSSocketFactory" name="shibboleth.TrustEngineTLSSocketFactory"
+          lazy-init="true"
+          class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
+          factory-method="buildTLSSocketFactory" />
+
+    <bean id="proxyHttpClient" parent="shibboleth.NonCachingHttpClient"
+          p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory" />
+
+    <bean id="shibboleth.StaticPKIXTrustEngine" abstract="true"
+          class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean" />
+
+    <bean id="proxyHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
+        <property name="tLSTrustEngine">
+            <bean class="org.opensaml.security.trust.impl.ChainingTrustEngine">
+                <constructor-arg name="chain">
+                    <list>
+                        <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
+                              c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+                        <bean parent="shibboleth.StaticPKIXTrustEngine"
+                              p:certificates="#{getObject('shibboleth.CASProxyTrustedCertificates') ?: getObject('shibboleth.DefaultCASProxyTrustedCertificates')}"
+                              p:checkNames="false" />
+                    </list>
+                </constructor-arg>
+            </bean>
+        </property>
     </bean>
 
     <bean id="proxyValidator"
           class="net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator"
-          c:engine-ref="proxyTrustEngine" />
+          c:client-ref="proxyHttpClient"
+          c:parameters-ref="proxyHttpSecurity" />
 
 
     <!-- Flow beans -->
diff --git a/idp-conf/src/main/resources/conf/cas-protocol.xml b/idp-conf/src/main/resources/conf/cas-protocol.xml
index c7ece39..535cf0a 100644
--- a/idp-conf/src/main/resources/conf/cas-protocol.xml
+++ b/idp-conf/src/main/resources/conf/cas-protocol.xml
@@ -93,9 +93,8 @@
        | which is the preferred mechanism to specify CAS proxy trust material. In the case of metadata, self-signed
        | certificates are recommended.
        -->
-    <util:list id="shibboleth.CASProxyTrustedCertificates">
-        <!--<bean class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"
-                  p:resource="%{idp.home}/credentials/your_ca.pem" /> -->
+    <util:list id="shibboleth.CASProxyTrustedCertificates" value-type="java.lang.String">
+        <!--<value>%{idp.home}/credentials/your_ca.pem</value>-->
     </util:list>
 
 
diff --git a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml b/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
index d388059..b9e505a 100644
--- a/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
+++ b/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
@@ -36,33 +36,29 @@
 
     <alias name="simpleTicketService" alias="shibboleth.DefaultCASTicketService" />
 
-    <bean id="proxyTrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
-        <constructor-arg name="chain">
-            <list>
-                <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
-                      c:resolver-ref="shibboleth.MetadataCredentialResolver" />
-                <bean class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine" c:nameEvaluator="#{null}">
-                    <constructor-arg name="resolver">
-                        <bean class="org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver" c:names="#{null}">
-                            <constructor-arg name="info">
-                                <bean class="org.opensaml.security.x509.impl.BasicPKIXValidationInformation"
-                                      c:anchors="#{getObject('shibboleth.CASProxyTrustedCertificates') ?: getObject('shibboleth.DefaultCASProxyTrustedCertificates')}"
-                                      c:crls="#{null}"
-                                      c:depth="5" />
-                            </constructor-arg>
-                        </bean>
-                    </constructor-arg>
-                    <constructor-arg name="pkixEvaluator">
-                        <bean class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator" />
-                    </constructor-arg>
-                </bean>
-            </list>
-        </constructor-arg>
+    <bean id="proxyHttpClient" parent="shibboleth.NonCachingHttpClient"
+          p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactory" />
+
+    <bean id="proxyHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
+        <property name="tLSTrustEngine">
+            <bean class="org.opensaml.security.trust.impl.ChainingTrustEngine">
+                <constructor-arg name="chain">
+                    <list>
+                        <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
+                              c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+                        <bean parent="shibboleth.StaticPKIXTrustEngine"
+                              p:certificates="#{getObject('shibboleth.CASProxyTrustedCertificates') ?: getObject('shibboleth.DefaultCASProxyTrustedCertificates')}"
+                              p:checkNames="false" />
+                    </list>
+                </constructor-arg>
+            </bean>
+        </property>
     </bean>
 
     <bean id="proxyValidator"
           class="net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator"
-          c:engine-ref="proxyTrustEngine" />
+          c:client-ref="proxyHttpClient"
+          c:parameters-ref="proxyHttpSecurity" />
 
     <bean id="shibboleth.DefaultCASProxyValidateIdPSessionPredicate"
           class="com.google.common.base.Predicates"
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/TestProxyValidator.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/TestProxyValidator.java
index 0e88230..85e2b0d 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/TestProxyValidator.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/TestProxyValidator.java
@@ -19,12 +19,10 @@ package net.shibboleth.idp.test.flows.cas;
 
 import net.shibboleth.idp.cas.proxy.impl.HttpClientProxyValidator;
 import net.shibboleth.idp.cas.service.Service;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.X509Credential;
+import org.apache.http.impl.client.HttpClients;
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import java.net.URI;
 
@@ -38,15 +36,10 @@ public class TestProxyValidator extends HttpClientProxyValidator {
     /** Validation repsonse HTTP status code to return. */
     private int responseCode;
 
+
     /** Creates a new instance. */
     public TestProxyValidator() {
-        super(new TrustEngine<X509Credential>() {
-            @Override
-            public boolean validate(
-                    @Nonnull final X509Credential x509Credential, @Nullable final CriteriaSet criteriaSet) {
-                return true;
-            }
-        });
+        super(HttpClients.createDefault(), new HttpClientSecurityParameters());
     }
 
     public void setResponseCode(final int code) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list