[java-opensaml] 12/16: Support HttpClient serverTLSFailureFatal option on config and params.
Brent Putman
putmanb at georgetown.edu
Fri Sep 21 22:48:50 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=b09dc353e3a84e9e5eb678e70f1c09a8e42878d9
commit b09dc353e3a84e9e5eb678e70f1c09a8e42878d9
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Sep 21 16:21:29 2018 -0400
Support HttpClient serverTLSFailureFatal option on config and params.
---
.../HttpClientSecurityConfiguration.java | 14 +++++++++
.../httpclient/HttpClientSecurityParameters.java | 36 ++++++++++++++++++++++
.../httpclient/HttpClientSecuritySupport.java | 3 ++
.../httpclient/HttpClientSecuritySupportTest.java | 10 ++++++
.../impl/BasicHttpClientSecurityConfiguration.java | 36 ++++++++++++++++++++++
.../BasicHttpClientSecurityParametersResolver.java | 3 ++
...icHttpClientSecurityParametersResolverTest.java | 6 ++++
.../http/AbstractPipelineHttpSOAPClient.java | 14 ++++++---
8 files changed, 117 insertions(+), 5 deletions(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
index a03021e..9613ca6 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
@@ -72,5 +72,19 @@ public interface HttpClientSecurityConfiguration {
* @return the client TLS credential, or null
*/
@Nullable public X509Credential getClientTLSCredential();
+
+ /**
+ * Get the flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error.
+ *
+ * <p>
+ * Note: a {@link Boolean} is used here rather than <code>boolean</code> to explicitly allow a
+ * non-configured value, allowing consuming components to implement their own internal defaults.
+ * </p>
+ *
+ * @return true if fatal, false if non-fatal, null if not explicitly configured
+ *
+ */
+ @Nullable public Boolean isServerTLSFailureFatal();
}
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
index b8c43fb..b11e518 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
@@ -64,6 +64,10 @@ public class HttpClientSecurityParameters {
/** The X509 credential used for client TLS. */
@Nullable private X509Credential clientTLSCredential;
+ /** Flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error. */
+ @Nullable private Boolean serverTLSFailureFatal;
+
/**
* Get an instance of {@link CredentialsProvider} used for authentication by the HttpClient instance.
*
@@ -268,4 +272,36 @@ public class HttpClientSecurityParameters {
clientTLSCredential = credential;
}
+ /**
+ * Get the flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error.
+ *
+ * <p>
+ * Note: a {@link Boolean} is used here rather than <code>boolean</code> to explicitly allow a
+ * non-configured value, allowing consuming components to implement their own internal defaults.
+ * </p>
+ *
+ * @return true if fatal, false if non-fatal, null if not explicitly configured
+ *
+ */
+ @Nullable public Boolean isServerTLSFailureFatal() {
+ return serverTLSFailureFatal;
+ }
+
+ /**
+ * Set the flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error.
+ *
+ * <p>
+ * Note: a {@link Boolean} is used here rather than <code>boolean</code> to explicitly allow a
+ * non-configured value, allowing consuming components to implement their own internal defaults.
+ * </p>
+ *
+ * @param flag true if fatal, false if non-fatal, null if not explicitly configured
+ *
+ */
+ public void setServerTLSFailureFatal(@Nullable final Boolean flag) {
+ this.serverTLSFailureFatal = flag ;
+ }
+
}
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
index 5e5195a..c2a261c 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
@@ -24,6 +24,7 @@ import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTE
import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_TLS_CIPHER_SUITES;
import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_TLS_PROTOCOLS;
import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE;
+import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL;
import java.util.Collections;
@@ -170,6 +171,8 @@ public final class HttpClientSecuritySupport {
setContextValue(context, CONTEXT_KEY_CLIENT_TLS_CREDENTIAL,
securityParameters.getClientTLSCredential(), replace);
+ setContextValue(context, CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL,
+ securityParameters.isServerTLSFailureFatal(), replace);
}
/**
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
index 7f50b3b..3f79421 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
@@ -24,6 +24,7 @@ import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTE
import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_TLS_CIPHER_SUITES;
import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_TLS_PROTOCOLS;
import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE;
+import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL;
import java.io.File;
import java.net.URISyntaxException;
@@ -93,6 +94,7 @@ public class HttpClientSecuritySupportTest {
Assert.assertNull(context.getAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES));
Assert.assertNull(context.getAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL));
Assert.assertNull(context.getAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER));
+ Assert.assertNull(context.getAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL));
}
@Test
@@ -107,6 +109,7 @@ public class HttpClientSecuritySupportTest {
params.setTLSCipherSuites(Lists.newArrayList("foo"));
params.setClientTLSCredential(new BasicX509Credential(cert));
params.setHostnameVerifier(new StrictHostnameVerifier());
+ params.setServerTLSFailureFatal(Boolean.TRUE);
HttpClientSecuritySupport.marshalSecurityParameters(context, params, false);
@@ -117,6 +120,7 @@ public class HttpClientSecuritySupportTest {
Assert.assertSame(context.getAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES), params.getTLSCipherSuites());
Assert.assertSame(context.getAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL), params.getClientTLSCredential());
Assert.assertSame(context.getAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER), params.getHostnameVerifier());
+ Assert.assertTrue(((Boolean)context.getAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL)));
}
@@ -131,6 +135,7 @@ public class HttpClientSecuritySupportTest {
context.setAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES, Lists.newArrayList("foo"));
context.setAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL, new BasicX509Credential(cert));
context.setAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER, new StrictHostnameVerifier());
+ context.setAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
HttpClientSecurityParameters params = new HttpClientSecurityParameters();
params.setCredentialsProvider(new BasicCredentialsProvider());
@@ -140,6 +145,7 @@ public class HttpClientSecuritySupportTest {
params.setTLSCipherSuites(Lists.newArrayList("foo"));
params.setClientTLSCredential(new BasicX509Credential(cert));
params.setHostnameVerifier(new StrictHostnameVerifier());
+ params.setServerTLSFailureFatal(Boolean.TRUE);
HttpClientSecuritySupport.marshalSecurityParameters(context, params, true);
@@ -150,6 +156,7 @@ public class HttpClientSecuritySupportTest {
Assert.assertSame(context.getAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES), params.getTLSCipherSuites());
Assert.assertSame(context.getAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL), params.getClientTLSCredential());
Assert.assertSame(context.getAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER), params.getHostnameVerifier());
+ Assert.assertTrue(((Boolean)context.getAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL)));
}
@Test
@@ -171,6 +178,7 @@ public class HttpClientSecuritySupportTest {
context.setAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES, cipherSuites);
context.setAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL, clientTLSCred);
context.setAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER, verifier);
+ context.setAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
HttpClientSecurityParameters params = new HttpClientSecurityParameters();
params.setCredentialsProvider(new BasicCredentialsProvider());
@@ -180,6 +188,7 @@ public class HttpClientSecuritySupportTest {
params.setTLSCipherSuites(Lists.newArrayList("foo"));
params.setClientTLSCredential(new BasicX509Credential(cert));
params.setHostnameVerifier(new StrictHostnameVerifier());
+ params.setServerTLSFailureFatal(Boolean.TRUE);
HttpClientSecuritySupport.marshalSecurityParameters(context, params, false);
@@ -190,6 +199,7 @@ public class HttpClientSecuritySupportTest {
Assert.assertSame(context.getAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES), cipherSuites);
Assert.assertSame(context.getAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL), clientTLSCred);
Assert.assertSame(context.getAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER), verifier);
+ Assert.assertFalse(((Boolean)context.getAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL)));
}
@Test
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
index f651bef..df0863b 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
@@ -57,6 +57,10 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
/** The X509 credential used for client TLS. */
@Nullable private X509Credential clientTLSCredential;
+ /** Flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error. */
+ @Nullable private Boolean serverTLSFailureFatal;
+
/**
* Get an instance of {@link CredentialsProvider} used for authentication by the HttpClient instance.
*
@@ -219,5 +223,37 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
public void setClientTLSCredential(@Nullable final X509Credential credential) {
clientTLSCredential = credential;
}
+
+ /**
+ * Get the flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error.
+ *
+ * <p>
+ * Note: a {@link Boolean} is used here rather than <code>boolean</code> to explicitly allow a
+ * non-configured value, allowing consuming components to implement their own internal defaults.
+ * </p>
+ *
+ * @return true if fatal, false if non-fatal, null if not explicitly configured
+ *
+ */
+ @Nullable public Boolean isServerTLSFailureFatal() {
+ return serverTLSFailureFatal;
+ }
+
+ /**
+ * Set the flag indicating whether failure of server TLS trust engine evaluation should be treated as
+ * a fatal error.
+ *
+ * <p>
+ * Note: a {@link Boolean} is used here rather than <code>boolean</code> to explicitly allow a
+ * non-configured value, allowing consuming components to implement their own internal defaults.
+ * </p>
+ *
+ * @param flag true if fatal, false if non-fatal, null if not explicitly configured
+ *
+ */
+ public void setServerTLSFailureFatal(@Nullable final Boolean flag) {
+ this.serverTLSFailureFatal = flag ;
+ }
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
index 9e64e8a..bc69dfa 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
@@ -109,6 +109,8 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
config.getTLSProtocols()));
params.setTLSTrustEngine(ObjectSupport.<TrustEngine<? super X509Credential>>firstNonNull(
params.getTLSTrustEngine(), config.getTLSTrustEngine()));
+ params.setServerTLSFailureFatal(ObjectSupport.firstNonNull(params.isServerTLSFailureFatal(),
+ config.isServerTLSFailureFatal()));
}
if (criteria.contains(TLSCriteriaSetCriterion.class)) {
@@ -147,6 +149,7 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
log.debug("\tHostnameVerifier: {}", params.getHostnameVerifier() != null ? "present" : "null");
log.debug("\tTLS TrustEngine: {}", params.getTLSTrustEngine() != null ? "present" : "null");
log.debug("\tTLS CriteriaSet: {}", params.getTLSCriteriaSet() != null ? "present" : "null");
+ log.debug("\tServer TLS Failure Fatal: {}", params.isServerTLSFailureFatal());
log.debug("\tTLS cipher suites: {}", params.getTLSCipherSuites());
log.debug("\tTLS protocols: {}", params.getTLSProtocols());
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index 5edfcc8..fbad80c 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -84,6 +84,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
+ Assert.assertNotNull(params.isServerTLSFailureFatal());
}
@Test
@@ -102,6 +103,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNull(params.getTLSProtocols());
Assert.assertNull(params.getTLSTrustEngine());
+ Assert.assertNull(params.isServerTLSFailureFatal());
}
@Test
@@ -125,6 +127,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
+ Assert.assertNotNull(params.isServerTLSFailureFatal());
criteria = new CriteriaSet(new HttpClientSecurityConfigurationCriterion(
new BasicHttpClientSecurityConfiguration(),
@@ -142,6 +145,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
+ Assert.assertNotNull(params.isServerTLSFailureFatal());
criteria = new CriteriaSet(new HttpClientSecurityConfigurationCriterion(
new BasicHttpClientSecurityConfiguration(),
@@ -159,6 +163,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
Assert.assertNull(params.getTLSCriteriaSet());
Assert.assertNotNull(params.getTLSProtocols());
Assert.assertNotNull(params.getTLSTrustEngine());
+ Assert.assertNotNull(params.isServerTLSFailureFatal());
}
@Test
@@ -231,6 +236,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
config.setTLSCipherSuites(Lists.newArrayList("test"));
config.setTLSProtocols(Lists.newArrayList("test"));
config.setTLSTrustEngine(new MockTrustEngine());
+ config.setServerTLSFailureFatal(true);
return config;
}
diff --git a/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java b/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java
index 4c2afe1..57636dd 100644
--- a/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java
+++ b/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java
@@ -352,14 +352,18 @@ public abstract class AbstractPipelineHttpSOAPClient<OutboundMessageType, Inboun
HttpClientSecuritySupport.marshalSecurityParameters(clientContext, getHttpClientSecurityParameters(), false);
- if ("https".equalsIgnoreCase(request.getURI().getScheme())) {
- if (clientContext.getAttribute(CONTEXT_KEY_TRUST_ENGINE) != null
- && clientContext.getAttribute(CONTEXT_KEY_CRITERIA_SET) == null) {
+ if ("https".equalsIgnoreCase(request.getURI().getScheme())
+ && clientContext.getAttribute(CONTEXT_KEY_TRUST_ENGINE) != null) {
+
+ if (clientContext.getAttribute(CONTEXT_KEY_CRITERIA_SET) == null) {
clientContext.setAttribute(CONTEXT_KEY_CRITERIA_SET,
buildTLSCriteriaSet(request, operationContext));
}
- if (clientContext.getAttribute(CONTEXT_KEY_TRUST_ENGINE) != null
- && clientContext.getAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL) == null) {
+
+ // Default this false if not explicitly set, as pipeline handlers will generally
+ // want to evaluate the result themselves. Can set explicitly on this client's params
+ // instance if want to override.
+ if (clientContext.getAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL) == null) {
clientContext.setAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list