[java-opensaml] 13/16: Support excluding client TLS cred from resolved parameters.
Brent Putman
putmanb at georgetown.edu
Fri Sep 21 22:48:51 EDT 2018
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=e42097903c5e1e7d4c6683c36791a68c1d0d7689
commit e42097903c5e1e7d4c6683c36791a68c1d0d7689
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Sep 21 18:22:30 2018 -0400
Support excluding client TLS cred from resolved parameters.
---
...opulateHttpClientSecurityParametersHandler.java | 31 +++++++
...ateHttpClientSecurityParametersHandlerTest.java | 97 +++++++++++++++++++++-
2 files changed, 127 insertions(+), 1 deletion(-)
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
index 9b1800a..06a7f37 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
@@ -38,6 +38,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.google.common.base.Function;
+import com.google.common.base.Predicate;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -69,6 +70,9 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
/** Resolver for parameters to store into context. */
@NonnullAfterInit private HttpClientSecurityParametersResolver resolver;
+ /** Predicate which determines whether clientTLS credentials should be included in the resolved parameters. */
+ @Nullable private Predicate<MessageContext> clientTLSPredicate;
+
/**
* Constructor.
*/
@@ -76,6 +80,17 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
// Create context by default.
securityParametersContextLookupStrategy = new ChildContextLookup<>(HttpClientSecurityContext.class, true);
}
+
+ /**
+ * Set the predicate which determines whether clientTLS credentials should be included in the resolved parameters.
+ *
+ * @param predicate clientTLS predicate
+ */
+ public void setClientTLSPredicate(@Nullable final Predicate<MessageContext> predicate) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ clientTLSPredicate = predicate;
+ }
/**
* Set the strategy used to look up the {@link HttpClientSecurityContext} to set the parameters for.
@@ -204,6 +219,7 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
try {
final HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
+ postProcessParams(messageContext, params);
paramsCtx.setSecurityParameters(params);
log.debug("{} {} HttpClientSecurityParameters", getLogPrefix(),
params != null ? "Resolved" : "Failed to resolve");
@@ -213,5 +229,20 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
}
}
// Checkstyle: CyclomaticComplexity|ReturnCount ON
+
+ /**
+ * Post-process the resolved parameters.
+ *
+ * @param messageContext the current message context
+ * @param params the parameters to process
+ */
+ protected void postProcessParams(@Nonnull final MessageContext messageContext,
+ @Nonnull final HttpClientSecurityParameters params) {
+
+ if (clientTLSPredicate != null && ! clientTLSPredicate.apply(messageContext)) {
+ log.debug("Configured client TLS predicate indicates to exclude client TLS credential");
+ params.setClientTLSCredential(null);
+ }
+ }
}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
index 5dc6798..69b1627 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
@@ -17,19 +17,32 @@
package org.opensaml.security.messaging.impl;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import java.util.Collection;
import java.util.Collections;
+import javax.crypto.SecretKey;
+
import org.opensaml.core.OpenSAMLInitBaseTestCase;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandlerException;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialContextSet;
+import org.opensaml.security.credential.UsageType;
import org.opensaml.security.httpclient.HttpClientSecurityConfigurationCriterion;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecurityParametersResolver;
import org.opensaml.security.messaging.HttpClientSecurityContext;
+import org.opensaml.security.x509.X509Credential;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import com.google.common.base.Predicates;
+
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
@@ -75,6 +88,27 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
handler.invoke(messageContext);
Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
+ Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+ }
+
+ @Test public void testSuccessIncludeClientTLS() throws Exception {
+ handler.setHttpClientSecurityParametersResolver(new MockResolver(false));
+ handler.setClientTLSPredicate(Predicates.<MessageContext>alwaysTrue());
+ handler.initialize();
+
+ handler.invoke(messageContext);
+ Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
+ Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+ }
+
+ @Test public void testSuccessExcludeClientTLS() throws Exception {
+ handler.setHttpClientSecurityParametersResolver(new MockResolver(false));
+ handler.setClientTLSPredicate(Predicates.<MessageContext>alwaysFalse());
+ handler.initialize();
+
+ handler.invoke(messageContext);
+ Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
+ Assert.assertNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
}
private class MockResolver implements HttpClientSecurityParametersResolver {
@@ -99,7 +133,68 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
}
Constraint.isNotNull(criteria.get(HttpClientSecurityConfigurationCriterion.class), "Criterion was null");
- return new HttpClientSecurityParameters();
+ HttpClientSecurityParameters params = new HttpClientSecurityParameters();
+ params.setClientTLSCredential(new MockX509Credential());
+ return params;
+ }
+
+ }
+
+ private class MockX509Credential implements X509Credential {
+
+ /** {@inheritDoc} */
+ public String getEntityId() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public UsageType getUsageType() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public Collection<String> getKeyNames() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public PublicKey getPublicKey() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public PrivateKey getPrivateKey() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public SecretKey getSecretKey() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public CredentialContextSet getCredentialContextSet() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public Class<? extends Credential> getCredentialType() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public X509Certificate getEntityCertificate() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public Collection<X509Certificate> getEntityCertificateChain() {
+ return null;
+ }
+
+ /** {@inheritDoc} */
+ public Collection<X509CRL> getCRLs() {
+ return null;
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list