[java-opensaml] branch maint-3.4 updated: OSJ-261: If backing file is outdated, FileBackedHTTPMetadataProvider ...
Brent Putman
putmanb at georgetown.edu
Fri Dec 14 18:56:29 EST 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch maint-3.4
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=41514a2e644b84cc310772d3aaa6708ee2b9ab1c
The following commit(s) were added to refs/heads/maint-3.4 by this push:
new 41514a2 OSJ-261: If backing file is outdated, FileBackedHTTPMetadataProvider ...
41514a2 is described below
commit 41514a2e644b84cc310772d3aaa6708ee2b9ab1c
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Dec 12 21:48:27 2018 -0500
OSJ-261: If backing file is outdated, FileBackedHTTPMetadataProvider ...
Full issue title: "If backing file is outdated,
FileBackedHTTPMetadataProvider doesn't download fresh metadata from
metadataURL."
---
.../impl/AbstractReloadingMetadataResolver.java | 4 +-
.../impl/FileBackedHTTPMetadataResolverTest.java | 99 +++++++++++++++++++++-
...8ced64cddc9f1578598b2cf71ae747b11d11473-bad.xml | 1 +
...64cddc9f1578598b2cf71ae747b11d11473-expired.xml | 49 +++++++++++
4 files changed, 150 insertions(+), 3 deletions(-)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java
index bb4f5d3..ebde14d 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java
@@ -359,7 +359,7 @@ public abstract class AbstractReloadingMetadataResolver extends AbstractBatchMet
}
} catch (final Throwable t) {
trackRefreshSuccess = false;
- nextRefresh = new DateTime(ISOChronology.getInstanceUTC()).plus(minRefreshDelay);
+ nextRefresh = new DateTime(ISOChronology.getInstanceUTC()).plus(computeNextRefreshDelay(null));
if (t instanceof Exception) {
log.error("{} Error occurred while attempting to refresh metadata from '{}'", getLogPrefix(), mdId);
throw new ResolverException((Exception) t);
@@ -509,7 +509,7 @@ public abstract class AbstractReloadingMetadataResolver extends AbstractBatchMet
log.warn("{} Entire metadata document from '{}' was expired at time of loading, existing metadata retained",
getLogPrefix(), metadataIdentifier);
- nextRefresh = new DateTime(ISOChronology.getInstanceUTC()).plus(getMinRefreshDelay());
+ nextRefresh = new DateTime(ISOChronology.getInstanceUTC()).plus(computeNextRefreshDelay(null));
trackRefreshSuccess = false;
}
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
index 2f1194c..1027706 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
@@ -32,6 +32,7 @@ import java.util.Set;
import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.joda.time.DateTime;
+import org.joda.time.chrono.ISOChronology;
import org.opensaml.core.criterion.EntityIdCriterion;
import org.opensaml.core.xml.XMLObjectBaseTestCase;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
@@ -72,8 +73,10 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
private HttpClientBuilder httpClientBuilder;
- private String relativeMDResource;
private String metadataURL;
+ private String relativeMDResource;
+ private String relativeMDResourceExpired;
+ private String relativeMDResourceBad;
private String badMDURL;
private String backupFilePath;
private FileBackedHTTPMetadataResolver metadataProvider;
@@ -85,6 +88,8 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
httpClientBuilder = new HttpClientBuilder();
relativeMDResource = "org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11472.xml";
+ relativeMDResourceExpired = "org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-expired.xml";
+ relativeMDResourceBad = "org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-bad.xml";
metadataURL = RepositorySupport.buildHTTPSResourceURL("java-opensaml", String.format("opensaml-saml-impl/src/test/resources/%s", relativeMDResource));
entityID = "https://www.example.org/sp";
@@ -250,6 +255,98 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
}
/**
+ * Tests initialization from backup file, followed shortly by real refresh via HTTP, for the special case
+ * of a backup file that is already expired. See OSJ-261. Issue there was the backupFileInitNextRefreshDelay
+ * wasn't being honored.
+ * @throws ComponentInitializationException
+ *
+ * @throws ResolverException, ComponentInitializationException
+ */
+ @Test
+ public void testInitFromExpiredBackupFile() throws Exception {
+ File backupFile = new File(backupFilePath);
+ try (FileOutputStream backupFileOutputStream = new FileOutputStream(backupFile)) {
+ Resources.copy(Resources.getResource(relativeMDResourceExpired), backupFileOutputStream);
+ }
+
+ Assert.assertTrue(backupFile.exists(), "Backup file was not created");
+ Assert.assertTrue(backupFile.length() > 0, "Backup file contains no data");
+
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider.setParserPool(parserPool);
+ metadataProvider.setFailFastInitialization(true);
+ metadataProvider.setId("test");
+ metadataProvider.setBackupFileInitNextRefreshDelay(1000);
+ metadataProvider.initialize();
+
+ Assert.assertTrue(metadataProvider.isInitializedFromBackupFile());
+
+ DateTime postInit = new DateTime(ISOChronology.getInstanceUTC());
+ DateTime initRefresh = metadataProvider.getLastRefresh();
+ DateTime initUpdate = metadataProvider.getLastUpdate();
+
+ // Metadata was expired, so have no live metadata at this point
+ Assert.assertNull(initUpdate);
+ Assert.assertNull(metadataProvider.resolveSingle(criteriaSet), "Metadata inited from backing file was non-null");
+
+ // Sleep past the artificial next refresh delay on init from backup file.
+ Thread.sleep(metadataProvider.getBackupFileInitNextRefreshDelay() + 5000);
+
+ Assert.assertTrue(initRefresh.isBefore(metadataProvider.getLastRefresh()));
+ DateTime refreshUpdate = metadataProvider.getLastUpdate();
+ Assert.assertNotNull(refreshUpdate);
+ Assert.assertTrue(refreshUpdate.isAfter(postInit));
+
+ Assert.assertNotNull(metadataProvider.resolveSingle(criteriaSet), "Metadata retrieved from HTTP refreshed metadata was null");
+ }
+
+ /**
+ * Tests initialization from backup file, followed shortly by real refresh via HTTP, for the special case
+ * of a backup file that throws during processing when fail-fast=false. See OSJ-261.
+ * Issue there was the backupFileInitNextRefreshDelay wasn't being honored.
+ * @throws ComponentInitializationException
+ *
+ * @throws ResolverException, ComponentInitializationException
+ */
+ @Test
+ public void testInitFromBadBackupFileNonFailFast() throws Exception {
+ File backupFile = new File(backupFilePath);
+ try (FileOutputStream backupFileOutputStream = new FileOutputStream(backupFile)) {
+ Resources.copy(Resources.getResource(relativeMDResourceBad), backupFileOutputStream);
+ }
+
+ Assert.assertTrue(backupFile.exists(), "Backup file was not created");
+ Assert.assertTrue(backupFile.length() > 0, "Backup file contains no data");
+
+ metadataProvider = new FileBackedHTTPMetadataResolver(httpClientBuilder.buildClient(), metadataURL, backupFilePath);
+ metadataProvider.setParserPool(parserPool);
+ metadataProvider.setFailFastInitialization(false);
+ metadataProvider.setId("test");
+ metadataProvider.setBackupFileInitNextRefreshDelay(1000);
+ metadataProvider.initialize();
+
+ Assert.assertTrue(metadataProvider.isInitializedFromBackupFile());
+
+ DateTime postInit = new DateTime(ISOChronology.getInstanceUTC());
+ DateTime initRefresh = metadataProvider.getLastRefresh();
+ DateTime initUpdate = metadataProvider.getLastUpdate();
+
+ // Metadata was fundamentally not able to be processed, so have no live metadata at this point
+ Assert.assertNull(initUpdate);
+ Assert.assertNull(metadataProvider.resolveSingle(criteriaSet), "Metadata inited from backing file was non-null");
+
+ // Sleep past the artificial next refresh delay on init from backup file.
+ Thread.sleep(metadataProvider.getBackupFileInitNextRefreshDelay() + 5000);
+
+ Assert.assertTrue(initRefresh.isBefore(metadataProvider.getLastRefresh()));
+ DateTime refreshUpdate = metadataProvider.getLastUpdate();
+ Assert.assertNotNull(refreshUpdate);
+ Assert.assertTrue(refreshUpdate.isAfter(postInit));
+
+ Assert.assertNotNull(metadataProvider.resolveSingle(criteriaSet), "Metadata retrieved from HTTP refreshed metadata was null");
+ }
+
+ /**
* Tests that backup file is not loaded on a refresh when already have cached metadata.
* @throws ComponentInitializationException
*
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-bad.xml b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-bad.xml
new file mode 100644
index 0000000..1b64796
--- /dev/null
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-bad.xml
@@ -0,0 +1 @@
+This is not valid XML.
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-expired.xml b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-expired.xml
new file mode 100644
index 0000000..f63b2d0
--- /dev/null
+++ b/opensaml-saml-impl/src/test/resources/org/opensaml/saml/metadata/resolver/impl/08ced64cddc9f1578598b2cf71ae747b11d11473-expired.xml
@@ -0,0 +1,49 @@
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_a3623fbbcb6af813c50b67a828668b1e55ae2c0f" entityID="https://www.example.org/sp" validUntil="2018-11-09T19:46:18Z">
+
+ <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
+ <md:Extensions>
+ <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://www.example.org/Shibboleth.sso/Login"/>
+ <idpdisc:DiscoveryResponse xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://www.example.org/Shibboleth.sso/Login" index="1"/>
+ </md:Extensions>
+ <md:KeyDescriptor>
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+ <ds:KeyName>https://www.example.org/shibboleth</ds:KeyName>
+ <ds:KeyName>www.example.org</ds:KeyName>
+ <ds:X509Data>
+ <ds:X509SubjectName>CN=www.example.org</ds:X509SubjectName>
+ <ds:X509Certificate>MIIDRDCCAiygAwIBAgIJAIc3DausM4oaMA0GCSqGSIb3DQEBBQUAMCUxIzAhBgNV
+BAMTGnd3dy5saWJyYXJ5Lmdlb3JnZXRvd24uZWR1MB4XDTEyMDgwOTIxMjIwNFoX
+DTMyMDgwNDIxMjIwNFowJTEjMCEGA1UEAxMad3d3LmxpYnJhcnkuZ2VvcmdldG93
+bi5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkc0sA/9cehYrs
+AR8nT0Me8JcKIFeFZlAi9jp0vhvsF8tbbhq9diZjaCeww93yfeDPC9u9wi6ya40x
+gkLHLeBinYJlDruk84QLrRImQ1di4rJQgBBt/wLr+wZQgeuo/P+es0ox9VU+fBqr
+xQRHvenkw/LKPuCz7mkhotZt/zy0UnNcq5o5t6tsZLU+BbSUWoBoB3MQXzN/PjMq
+ROks9/v90HtUCiF9J7hPDpxLLJ7qkvJ+YpfuBcQB5NevoDv423cwwfkJGBJAu3Do
+Qs2vWOfS3AwDh8Cee43wjZB5eD44y+cVIeed16WehDKnXQ+DEcKnHzxF6IRMU+d1
+4kLs+QZHAgMBAAGjdzB1MFQGA1UdEQRNMEuCGnd3dy5saWJyYXJ5Lmdlb3JnZXRv
+d24uZWR1hi1odHRwczovL3d3dy5saWJyYXJ5Lmdlb3JnZXRvd24uZWR1L3NoaWJi
+b2xldGgwHQYDVR0OBBYEFO1vnaFkb0y5fLvOjUVlqDwIOWphMA0GCSqGSIb3DQEB
+BQUAA4IBAQDBEJbbxyd3IH5Kc6ZPNEJmSNEau5AeTeU3YNv5+I7OhpWbVjxtITTy
++IOnd8s8+1YbcwFJRsPQXc+uboTiVF9B+CHlJQ+mwgUH1ePBVG9PUwaRrX0my88c
+XEQptBIVdUqaNwuBBMQzUr2/UZK6EaStRor/yRrEgZNnPUFWtsW+sCG406gGbcxU
+93RurxLa4Cv0sE+SEFMkQnnmAN7odx6qM/1I1TCQPN0t4JfWjmhj8Iez0lnGMQPh
+NWevYWCdgIDPlYhhvJ9gnHu8JOfFRlZCXpc2p+x7Nsrudb+5Hhs7x93xciVyrttQ
+Iul4vX+c2dQrUz0m7rJ8tdZDwyQvUvwd
+</ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ </md:KeyDescriptor>
+ <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://www.example.org/Shibboleth.sso/Artifact/SOAP" index="0"/>
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://www.example.org/Shibboleth.sso/SLO/SOAP"/>
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://www.example.org/Shibboleth.sso/SLO/Redirect"/>
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.example.org/Shibboleth.sso/SLO/POST"/>
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://www.example.org/Shibboleth.sso/SLO/Artifact"/>
+ <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.example.org/Shibboleth.sso/SAML2/POST" index="0"/>
+ <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://www.example.org/Shibboleth.sso/SAML2/POST-SimpleSign" index="1"/>
+ <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://www.example.org/Shibboleth.sso/SAML2/Artifact" index="2"/>
+ <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://www.example.org/Shibboleth.sso/SAML2/ECP" index="3"/>
+ <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://www.example.org/Shibboleth.sso/SAML/POST" index="4"/>
+ <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://www.example.org/Shibboleth.sso/SAML/Artifact" index="5"/>
+ </md:SPSSODescriptor>
+
+</md:EntityDescriptor>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list