[java-opensaml] 01/02: OSJ-188: Enhance SignatureValidationFilter to make operation ...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=2d7f927574b9349fb86c5bd1e8de98640d3b775f

commit 2d7f927574b9349fb86c5bd1e8de98640d3b775f
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Aug 21 18:14:36 2019 -0400

    OSJ-188: Enhance SignatureValidationFilter to make operation ...
    
    Add config flag alwaysVerifyTrustedSource to allow forcing
    verification of the root signature.
---
 .../filter/impl/SignatureValidationFilter.java     | 25 ++++++++++++++++++++++
 .../SignatureValidationFilterExplicitKeyTest.java  |  3 +++
 2 files changed, 28 insertions(+)

diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
index c5e0bda..8da0e40 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
@@ -68,6 +68,9 @@ public class SignatureValidationFilter implements MetadataFilter {
     /** Indicates whether the metadata root element is required to be signed. */
     private boolean requireSignedRoot;
     
+    /** Flag indicating whether the root signature of a trusted source should always be verified. */
+    private boolean alwaysVerifyTrustedSource;
+
     /** Set of externally specified default criteria for input to the trust engine. */
     @Nullable private CriteriaSet defaultCriteria;
     
@@ -101,6 +104,24 @@ public class SignatureValidationFilter implements MetadataFilter {
     }
 
     /**
+     * Get the flag indicating whether the root signature of a trusted source should always be verified.
+     *
+     * @return true if root signature should always be verified, false if should be dynamically determined
+     */
+    public boolean isAlwaysVerifyTrustedSource() {
+        return alwaysVerifyTrustedSource;
+    }
+
+    /**
+     * Set the flag indicating whether the root signature of a trusted source should always be verified.
+     *
+     * @param flag true if root signature should always be verified, false if should be dynamically determined
+     */
+    public void setAlwaysVerifyTrustedSource(final boolean flag) {
+        alwaysVerifyTrustedSource = flag;
+    }
+
+    /**
      * Get the strategy function for extracting dynamic trusted names from signed metadata elements.
      * 
      * <p>Defaults to: {@link BasicDynamicTrustedNamesStrategy}.</p>
@@ -547,6 +568,10 @@ public class SignatureValidationFilter implements MetadataFilter {
      * @return true if root signature validation should be skipped, false if not
      */
     protected boolean isSkipRootSignature(@Nonnull final MetadataFilterContext context) {
+        if (isAlwaysVerifyTrustedSource()) {
+            return false;
+        }
+
         final MetadataSource metadataSource = context.get(MetadataSource.class);
         if (metadataSource != null) {
             return metadataSource.isTrusted();
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
index d0b43ad..3451439 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
@@ -314,6 +314,9 @@ public class SignatureValidationFilterExplicitKeyTest extends XMLObjectBaseTestC
 
         metadataSource.setTrusted(true);
         Assert.assertTrue(filter.isSkipRootSignature(context));
+
+        filter.setAlwaysVerifyTrustedSource(true);
+        Assert.assertFalse(filter.isSkipRootSignature(context));
     }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.