[java-identity-provider] branch master updated: IDP-1371 Add trusted names criteria.

[Marvin S. Addison]

This is an automated email from the git hooks/post-receive script.

serac pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=271b10a378ba1cde63fe441e6039bcf116d2290f

The following commit(s) were added to refs/heads/master by this push:
       new  271b10a   IDP-1371 Add trusted names criteria.
271b10a is described below

commit 271b10a378ba1cde63fe441e6039bcf116d2290f
Author: Marvin S. Addison <serac at vt.edu>
AuthorDate: Thu Dec 13 11:39:15 2018 -0500

    IDP-1371 Add trusted names criteria.
    
    Needed for hostname validation in PKIX trust engine check.
---
 .../shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java  | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
index a578c37..83b01ba 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
@@ -59,6 +59,7 @@ import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.httpclient.HttpClientSecurityParameters;
 import org.opensaml.security.httpclient.HttpClientSecuritySupport;
 import org.opensaml.security.trust.TrustEngine;
+import org.opensaml.security.x509.TrustedNamesCriterion;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -153,7 +154,7 @@ public class HttpClientProxyValidator implements ProxyValidator {
     protected int connect(@Nonnull final URI uri, @Nonnull Service service) throws GeneralSecurityException {
         final HttpClientContext clientContext = HttpClientContext.create();
         HttpClientSecuritySupport.marshalSecurityParameters(clientContext, securityParameters, true);
-        setCASTLSTrustEngineCriteria(clientContext, service);
+        setCASTLSTrustEngineCriteria(clientContext, uri, service);
         HttpResponse response;
         try {
             log.debug("Attempting to validate CAS proxy callback URI {}", uri);
@@ -175,7 +176,8 @@ public class HttpClientProxyValidator implements ProxyValidator {
         }
     }
 
-    private static void setCASTLSTrustEngineCriteria(final HttpClientContext context, final Service service) {
+    private static void setCASTLSTrustEngineCriteria(
+            final HttpClientContext context, final URI requestUri, final Service service) {
         final String entityID;
         if (service.getEntityDescriptor() != null) {
             entityID = service.getEntityDescriptor().getEntityID();
@@ -186,7 +188,8 @@ public class HttpClientProxyValidator implements ProxyValidator {
                 new EntityIdCriterion(entityID),
                 new EntityRoleCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME),
                 new ProtocolCriterion(AbstractProtocolConfiguration.PROTOCOL_URI),
-                new UsageCriterion(UsageType.SIGNING));
+                new UsageCriterion(UsageType.SIGNING),
+                new TrustedNamesCriterion(Collections.singleton(requestUri.getHost())));
         context.setAttribute(CONTEXT_KEY_CRITERIA_SET, criteria);
     }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.