[java-opensaml] branch master updated: Remove deprecated code.
Scott Cantor
cantor.2 at osu.edu
Wed Aug 28 17:22:23 EDT 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=e23064c1a477399c6ff8e8abe31aa70410a217e6
The following commit(s) were added to refs/heads/master by this push:
new e23064c Remove deprecated code.
e23064c is described below
commit e23064c1a477399c6ff8e8abe31aa70410a217e6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Aug 28 17:22:03 2019 -0400
Remove deprecated code.
---
.../opensaml/messaging/context/BaseContext.java | 37 +--
.../messaging/context/BaseContextTest.java | 16 --
.../opensaml/saml/saml1/core/NameIdentifier.java | 16 --
.../filter/impl/SchemaValidationFilter.java | 50 +---
.../filter/impl/SignatureValidationFilter.java | 45 +---
.../impl/AbstractDynamicHTTPMetadataResolver.java | 175 +-------------
.../impl/AbstractDynamicMetadataResolver.java | 22 --
.../resolver/impl/HTTPMetadataResolver.java | 141 +-----------
.../resolver/impl/TemplateRequestURLBuilder.java | 67 ------
.../saml/saml1/core/impl/NameIdentifierImpl.java | 17 --
.../impl/OneTimeUseConditionValidator.java | 1 +
.../impl/TemplateRequestURLBuilderTest.java | 24 --
.../impl/SecurityEnhancedTLSSocketFactory.java | 52 +----
.../impl/TrustEngineTLSSocketFactory.java | 252 ---------------------
.../impl/TrustEngineTLSSocketFactoryTest.java | 213 -----------------
.../http/AbstractPipelineHttpSOAPClient.java | 21 --
16 files changed, 27 insertions(+), 1122 deletions(-)
diff --git a/opensaml-messaging-api/src/main/java/org/opensaml/messaging/context/BaseContext.java b/opensaml-messaging-api/src/main/java/org/opensaml/messaging/context/BaseContext.java
index 5d3ca11..b810252 100644
--- a/opensaml-messaging-api/src/main/java/org/opensaml/messaging/context/BaseContext.java
+++ b/opensaml-messaging-api/src/main/java/org/opensaml/messaging/context/BaseContext.java
@@ -28,8 +28,6 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.collection.ClassIndexedSet;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import org.opensaml.messaging.MessageRuntimeException;
import org.slf4j.Logger;
@@ -70,9 +68,6 @@ public abstract class BaseContext implements Iterable<BaseContext> {
/** The subcontexts being managed. */
@Nonnull @NonnullElements private ClassIndexedSet<BaseContext> subcontexts;
- /** Flag indicating whether subcontexts should, by default, be created if they do not exist. */
- private boolean autoCreateSubcontexts;
-
/** Constructor. Generates a random context id. */
public BaseContext() {
subcontexts = new ClassIndexedSet<>();
@@ -104,7 +99,7 @@ public abstract class BaseContext implements Iterable<BaseContext> {
* @return the held instance of the class, or null
*/
@Nullable public <T extends BaseContext> T getSubcontext(@Nonnull final Class<T> clazz) {
- return getSubcontext(clazz, autoCreateSubcontexts);
+ return getSubcontext(clazz, false);
}
/**
@@ -145,7 +140,7 @@ public abstract class BaseContext implements Iterable<BaseContext> {
*/
@Nullable public BaseContext getSubcontext(@Nonnull @NotEmpty final String className)
throws ClassNotFoundException {
- return getSubcontext(className, autoCreateSubcontexts);
+ return getSubcontext(className, false);
}
/**
@@ -290,34 +285,6 @@ public abstract class BaseContext implements Iterable<BaseContext> {
subcontexts.clear();
}
- /**
- * Get whether the context auto-creates subcontexts by default.
- *
- * @return true if the context auto-creates subcontexts, false otherwise
- *
- * @deprecated
- */
- @Deprecated
- public boolean isAutoCreateSubcontexts() {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".isAutoCreateSubcontexts",
- null, "no replacement");
- return autoCreateSubcontexts;
- }
-
- /**
- * Set whether the context auto-creates subcontexts by default.
- *
- * @param autoCreate whether the context should auto-create subcontexts
- *
- * @deprecated
- */
- @Deprecated
- public void setAutoCreateSubcontexts(final boolean autoCreate) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setAutoCreateSubcontexts",
- null, "no replacement");
- autoCreateSubcontexts = autoCreate;
- }
-
/** {@inheritDoc} */
@Override
@Nonnull public Iterator<BaseContext> iterator() {
diff --git a/opensaml-messaging-api/src/test/java/org/opensaml/messaging/context/BaseContextTest.java b/opensaml-messaging-api/src/test/java/org/opensaml/messaging/context/BaseContextTest.java
index bf17de3..92f0b95 100644
--- a/opensaml-messaging-api/src/test/java/org/opensaml/messaging/context/BaseContextTest.java
+++ b/opensaml-messaging-api/src/test/java/org/opensaml/messaging/context/BaseContextTest.java
@@ -128,23 +128,7 @@ public class BaseContextTest {
Iterator<BaseContext> iterator = parent.iterator();
iterator.remove();
}
-
- /**
- * Test auto creation of subcontexts.
- */
- @SuppressWarnings("deprecation")
- public void testAutoCreateSubcontext() {
- TestContext parent = new TestContext();
- //Default is not to autocreate subcontexts
- TestContext child1 = parent.getSubcontext(TestContext.class);
- Assert.assertNull(child1);
-
- parent.setAutoCreateSubcontexts(true);
- TestContext child2 = parent.getSubcontext(TestContext.class);
- Assert.assertNotNull(child2);
- }
-
/**
* Test case of attempting to add a duplicate subcontext class to a parent,
* when replace is in effect.
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/NameIdentifier.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/NameIdentifier.java
index 08a5b2e..902d02f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/NameIdentifier.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/NameIdentifier.java
@@ -91,22 +91,6 @@ public interface NameIdentifier extends SAMLObject {
*
* @return the identifier
*/
- @Deprecated
- public String getNameIdentifier();
-
- /**
- * Sets the identifier.
- *
- * @param nameIdentifier the identifier.
- */
- @Deprecated
- public void setNameIdentifier(String nameIdentifier);
-
- /**
- * Gets the identifier.
- *
- * @return the identifier
- */
public String getValue();
/**
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilter.java
index b1d2fc6..7d2600c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SchemaValidationFilter.java
@@ -17,8 +17,6 @@
package org.opensaml.saml.metadata.resolver.filter.impl;
-import java.io.InputStream;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.xml.transform.dom.DOMSource;
@@ -34,12 +32,7 @@ import org.slf4j.LoggerFactory;
import org.xml.sax.SAXException;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ClasspathResolver;
import net.shibboleth.utilities.java.support.xml.SchemaBuilder;
/**
@@ -62,50 +55,9 @@ public class SchemaValidationFilter implements MetadataFilter {
* @param builder SAML schema source to use
*/
public SchemaValidationFilter(@Nonnull @ParameterName(name="builder") final SAMLSchemaBuilder builder) {
- this(builder, null);
- }
-
- /**
- * Constructor.
- *
- * <p>Specifying extension schemas should be done by explicitly injecting a
- * pre-configured {@link SchemaBuilder} using the non-deprecated constructor. Using this
- * version results in an internally constructed {@link SchemaBuilder} using classpath-based
- * schema resolution of any extensions or imports, with other settings left to their
- * defaults.</p>
- *
- * @deprecated
- *
- * @param builder SAML schema source to use
- * @param extensionSchemas classpath-based location of metadata extension schemas
- */
- @Deprecated public SchemaValidationFilter(@Nonnull @ParameterName(name="builder") final SAMLSchemaBuilder builder,
- @Nullable @NonnullElements @ParameterName(name="extensionSchemas") final String[] extensionSchemas) {
samlSchemaBuilder = Constraint.isNotNull(builder, "SAMLSchemaBuilder cannot be null");
-
- if (extensionSchemas != null) {
- log.info("Overriding SchemaBuilder used to construct schemas to accomodate extension schemas");
-
- DeprecationSupport.warn(ObjectType.METHOD,
- getClass().getName() + ".SchemaValidationFilter(SAMLSchemaBuilder, String[])", null,
- "SchemaValidationFilter(SAMLSchemaBuilder)");
-
- final SchemaBuilder overriddenSchemaBuilder = new SchemaBuilder();
- overriddenSchemaBuilder.setResourceResolver(new ClasspathResolver());
- final Class<SAMLSchemaBuilder> clazz = SAMLSchemaBuilder.class;
- for (final String extension : extensionSchemas) {
- final String trimmed = StringSupport.trimOrNull(extension);
- if (trimmed != null) {
- final InputStream stream = clazz.getResourceAsStream(trimmed);
- if (stream != null) {
- overriddenSchemaBuilder.addSchema(stream);
- }
- }
- }
- samlSchemaBuilder.setSchemaBuilder(overriddenSchemaBuilder);
- }
}
-
+
/** {@inheritDoc} */
@Override
@Nullable public XMLObject filter(@Nullable final XMLObject metadata, @Nonnull final MetadataFilterContext context)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
index 07f91bd..29df13a 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilter.java
@@ -50,8 +50,6 @@ import org.slf4j.LoggerFactory;
import net.shibboleth.utilities.java.support.annotation.ParameterName;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
/**
@@ -195,39 +193,7 @@ public class SignatureValidationFilter implements MetadataFilter {
public void setRequireSignedRoot(final boolean require) {
requireSignedRoot = require;
}
-
- /**
- * Get whether incoming metadata's root element is required to be signed.
- *
- * <p>Defaults to <code>true</code>.</p>
- *
- * @return whether incoming metadata is required to be signed
- *
- * @deprecated use instead {@link #getRequireSignedRoot()}
- */
- @Deprecated
- public boolean getRequireSignature() {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".getRequireSignature", null,
- "getRequireSignedRoot");
- return getRequireSignedRoot();
- }
-
- /**
- * Set whether incoming metadata's root element is required to be signed.
- *
- * <p>Defaults to <code>true</code>.</p>
- *
- * @param require whether incoming metadata is required to be signed
- *
- * @deprecated use instead {@link #setRequireSignedRoot(boolean)}
- */
- @Deprecated
- public void setRequireSignature(final boolean require) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setRequireSignature", null,
- "setRequireSignedRoot");
- setRequireSignedRoot(require);
- }
-
+
/**
* Get the optional set of default criteria used as input to the trust engine.
*
@@ -310,9 +276,8 @@ public class SignatureValidationFilter implements MetadataFilter {
log.trace("RoleDescriptor member '{}' was not signed, skipping signature processing...",
roleChild.getElementQName());
continue;
- } else {
- log.trace("Processing signed RoleDescriptor member: {}", roleChild.getElementQName());
}
+ log.trace("Processing signed RoleDescriptor member: {}", roleChild.getElementQName());
try {
final String roleID = getRoleIDToken(entityID, roleChild);
@@ -386,9 +351,8 @@ public class SignatureValidationFilter implements MetadataFilter {
log.trace("EntityDescriptor member '{}' was not signed, skipping signature processing...",
entityChild.getEntityID());
continue;
- } else {
- log.trace("Processing signed EntityDescriptor member: {}", entityChild.getEntityID());
}
+ log.trace("Processing signed EntityDescriptor member: {}", entityChild.getEntityID());
try {
processEntityDescriptor(entityChild, context, false);
@@ -577,9 +541,8 @@ public class SignatureValidationFilter implements MetadataFilter {
final MetadataSource metadataSource = context.get(MetadataSource.class);
if (metadataSource != null) {
return metadataSource.isTrusted();
- } else {
- return false;
}
+ return false;
}
}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
index 792735b..ee34d29 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicHTTPMetadataResolver.java
@@ -29,28 +29,20 @@ import java.util.Timer;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import javax.net.ssl.SSLPeerUnverifiedException;
import org.apache.http.Header;
import org.apache.http.HttpResponse;
import org.apache.http.HttpStatus;
-import org.apache.http.auth.AuthScope;
-import org.apache.http.auth.UsernamePasswordCredentials;
-import org.apache.http.client.CredentialsProvider;
import org.apache.http.client.HttpClient;
import org.apache.http.client.ResponseHandler;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.client.protocol.HttpClientContext;
-import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.core.xml.io.UnmarshallingException;
import org.opensaml.core.xml.util.XMLObjectSource;
-import org.opensaml.security.httpclient.HttpClientSecurityConstants;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecuritySupport;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.slf4j.MDC;
@@ -68,8 +60,6 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.net.MediaTypeSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -106,19 +96,7 @@ public abstract class AbstractDynamicHTTPMetadataResolver extends AbstractDynami
/** HttpClient ResponseHandler instance to use. */
@Nonnull private ResponseHandler<XMLObject> responseHandler;
-
- /** HttpClient credentials provider.
- * @deprecated use {@link #httpClientSecurityParameters}.
- * */
- @Deprecated
- @Nullable private CredentialsProvider credentialsProvider;
-
- /** Optional trust engine used in evaluating server TLS credentials.
- * @deprecated use {@link #httpClientSecurityParameters}.
- * */
- @Deprecated
- @Nullable private TrustEngine<? super X509Credential> tlsTrustEngine;
-
+
/** Optional HttpClient security parameters.*/
@Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
@@ -148,104 +126,6 @@ public abstract class AbstractDynamicHTTPMetadataResolver extends AbstractDynami
}
/**
- * Sets the optional trust engine used in evaluating server TLS credentials.
- *
- * <p>
- * See TLS socket factory requirements documented for
- * {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}.
- * </p>
- *
- * @param engine the trust engine instance to use
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setTLSTrustEngine(@Nullable final TrustEngine<? super X509Credential> engine) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setTLSTrustEngine",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
- tlsTrustEngine = engine;
- }
-
- /**
- * Set an instance of {@link CredentialsProvider} used for authentication by the HttpClient instance.
- *
- * @param provider the credentials provider
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setCredentialsProvider(@Nullable final CredentialsProvider provider) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setCredentialsProvider",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
-
- credentialsProvider = provider;
- }
-
- /**
- * A convenience method to set a (single) username and password used to access metadata.
- * To disable BASIC authentication pass null for the credentials instance.
- *
- * <p>
- * An {@link AuthScope} will be generated which specifies any host, port, scheme and realm.
- * </p>
- *
- * <p>To specify multiple usernames and passwords for multiple host, port, scheme, and realm combinations, instead
- * provide an instance of {@link CredentialsProvider} via {@link #setCredentialsProvider(CredentialsProvider)}.</p>
- *
- * @param credentials the username and password credentials
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setBasicCredentials(@Nullable final UsernamePasswordCredentials credentials) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setBasicCredentials",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
- setBasicCredentialsWithScope(credentials, null);
- }
-
- /**
- * A convenience method to set a (single) username and password used to access metadata.
- * To disable BASIC authentication pass null for the credentials instance.
- *
- * <p>
- * If the <code>authScope</code> is null, an {@link AuthScope} will be generated which specifies
- * any host, port, scheme and realm.
- * </p>
- *
- * <p>To specify multiple usernames and passwords for multiple host, port, scheme, and realm combinations, instead
- * provide an instance of {@link CredentialsProvider} via {@link #setCredentialsProvider(CredentialsProvider)}.</p>
- *
- * @param credentials the username and password credentials
- * @param scope the HTTP client auth scope with which to scope the credentials, may be null
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setBasicCredentialsWithScope(@Nullable final UsernamePasswordCredentials credentials,
- @Nullable final AuthScope scope) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setBasicCredentialsWithScope",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
-
- if (credentials != null) {
- AuthScope authScope = scope;
- if (authScope == null) {
- authScope = new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT);
- }
- final BasicCredentialsProvider provider = new BasicCredentialsProvider();
- provider.setCredentials(authScope, credentials);
- credentialsProvider = provider;
- } else {
- log.debug("{} Either username or password were null, disabling basic auth", getLogPrefix());
- credentialsProvider = null;
- }
-
- }
-
- /**
* Get the instance of {@link HttpClientSecurityParameters} which provides various parameters to influence
* the security behavior of the HttpClient instance.
*
@@ -359,8 +239,6 @@ public abstract class AbstractDynamicHTTPMetadataResolver extends AbstractDynami
@Override
protected void doDestroy() {
httpClient = null;
- credentialsProvider = null;
- tlsTrustEngine = null;
httpClientSecurityParameters = null;
supportedContentTypes = null;
@@ -392,24 +270,7 @@ public abstract class AbstractDynamicHTTPMetadataResolver extends AbstractDynami
MDC.remove(MDC_ATTRIB_CURRENT_REQUEST_URI);
}
}
-
- /**
- * Check that trust engine evaluation of the server TLS credential was actually performed.
- *
- * @param context the current HTTP context instance in use
- * @param request the HTTP URI request
- * @throws SSLPeerUnverifiedException thrown if the TLS credential was not actually evaluated by the trust engine
- *
- * @deprecated use {@link HttpClientSecuritySupport#checkTLSCredentialEvaluated(HttpClientContext, String)}
- */
- @Deprecated
- protected void checkTLSCredentialTrusted(final HttpClientContext context, final HttpUriRequest request)
- throws SSLPeerUnverifiedException {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".checkTLSCredentialTrusted",
- null, "HttpClientSecuritySupport.checkTLSCredentialEvaluated(HttpClientContext, String)");
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, request.getURI().getScheme());
- }
-
+
/**
* Build an appropriate instance of {@link HttpUriRequest} based on the input criteria set.
*
@@ -443,21 +304,7 @@ public abstract class AbstractDynamicHTTPMetadataResolver extends AbstractDynami
* @return the request URL, or null if it can not be built based on the supplied criteria
*/
@Nullable protected abstract String buildRequestURL(@Nonnull final CriteriaSet criteria);
-
- /**
- * Build the {@link HttpClientContext} instance which will be used to invoke the {@link HttpClient} request.
- *
- * @return a new instance of {@link HttpClientContext}
- *
- * @deprecated use {@link #buildHttpClientContext(HttpUriRequest)}
- */
- @Deprecated
- protected HttpClientContext buildHttpClientContext() {
- //TODO when we remove this deprecated method, change called method to @Nonnull for request
- DeprecationSupport.warn(ObjectType.METHOD, getClass().getName() + ".buildHttpClientContext()", null, null);
- return buildHttpClientContext(null);
- }
-
+
/**
* Build the {@link HttpClientContext} instance which will be used to invoke the {@link HttpClient} request.
*
@@ -465,23 +312,11 @@ public abstract class AbstractDynamicHTTPMetadataResolver extends AbstractDynami
*
* @return a new instance of {@link HttpClientContext}
*/
- protected HttpClientContext buildHttpClientContext(@Nullable final HttpUriRequest request) {
- // TODO Really request should be @Nonnull, change when we remove deprecated buildHttpClientContext()
+ protected HttpClientContext buildHttpClientContext(@Nonnull final HttpUriRequest request) {
final HttpClientContext context = HttpClientContext.create();
HttpClientSecuritySupport.marshalSecurityParameters(context, httpClientSecurityParameters, true);
-
- // If these legacy values are present, let them override the above params instance values unconditionally
- if (credentialsProvider != null) {
- context.setCredentialsProvider(credentialsProvider);
- }
- if (tlsTrustEngine != null) {
- context.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, tlsTrustEngine);
- }
-
- if (request != null) {
- HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(context, request);
- }
+ HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(context, request);
return context;
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
index e4cc0bf..c2d13b7 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
@@ -81,8 +81,6 @@ import net.shibboleth.utilities.java.support.collection.Pair;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.primitive.TimerSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -801,26 +799,6 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
* and then return it.
*
* @param criteria the input criteria set
- * @return the resolved metadata
- * @throws ResolverException if there is a fatal error attempting to resolve the metadata
- *
- * @deprecated instead use {@link #resolveFromOriginSource(CriteriaSet, String)}
- */
- @Deprecated
- @Nonnull @NonnullElements
- protected Iterable<EntityDescriptor> resolveFromOriginSource(
- @Nonnull final CriteriaSet criteria) throws ResolverException {
-
- DeprecationSupport.warnOnce(ObjectType.METHOD, "resolveFromOriginSource", null, "2-arg same-named method");
-
- return resolveFromOriginSource(criteria, resolveEntityID(criteria));
- }
-
- /**
- * Fetch metadata from an origin source based on the input criteria, store it in the backing store
- * and then return it.
- *
- * @param criteria the input criteria set
* @param entityID the previously resolved single entityID
* @return the resolved metadata
* @throws ResolverException if there is a fatal error attempting to resolve the metadata
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java
index bc430a4..de29714 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolver.java
@@ -25,30 +25,21 @@ import java.util.Timer;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import javax.net.ssl.SSLPeerUnverifiedException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
import org.apache.http.Header;
import org.apache.http.HttpResponse;
import org.apache.http.HttpStatus;
-import org.apache.http.auth.AuthScope;
-import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.client.protocol.HttpClientContext;
-import org.apache.http.impl.client.BasicCredentialsProvider;
import org.apache.http.util.EntityUtils;
-import org.opensaml.security.httpclient.HttpClientSecurityConstants;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
import org.opensaml.security.httpclient.HttpClientSecuritySupport;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -83,18 +74,6 @@ public class HTTPMetadataResolver extends AbstractReloadingMetadataResolver {
/** The Last-Modified information provided when the currently cached metadata was fetched. */
private String cachedMetadataLastModified;
- /** HttpClient credentials provider.
- * @deprecated use {@link #httpClientSecurityParameters}.
- * */
- @Deprecated
- @Nullable private BasicCredentialsProvider credentialsProvider;
-
- /** Optional trust engine used in evaluating server TLS credentials.
- * @deprecated use {@link #httpClientSecurityParameters}.
- * */
- @Deprecated
- @Nullable private TrustEngine<? super X509Credential> tlsTrustEngine;
-
/** Optional HttpClient security parameters.*/
@Nullable private HttpClientSecurityParameters httpClientSecurityParameters;
@@ -143,81 +122,7 @@ public class HTTPMetadataResolver extends AbstractReloadingMetadataResolver {
public String getMetadataURI() {
return metadataURI.toASCIIString();
}
-
- /**
- * Sets the optional trust engine used in evaluating server TLS credentials.
- *
- * <p>
- * See TLS socket factory requirements documented for
- * {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}.
- * </p>
- *
- * @param engine the trust engine instance to use
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setTLSTrustEngine(@Nullable final TrustEngine<? super X509Credential> engine) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setTLSTrustEngine",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
- tlsTrustEngine = engine;
- }
-
- /**
- * Sets the username and password used to access the metadata URL. To disable BASIC authentication pass null for the
- * credentials instance.
- *
- * An {@link AuthScope} will be generated based off the metadata URI's hostname and port.
- *
- * @param credentials the username and password credentials
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setBasicCredentials(@Nullable final UsernamePasswordCredentials credentials) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setBasicCredentials",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
- setBasicCredentialsWithScope(credentials, null);
- }
-
- /**
- * Sets the username and password used to access the metadata URL. To disable BASIC authentication pass null for the
- * credentials instance.
- *
- * <p>
- * If the <code>authScope</code> is null, an {@link AuthScope} will be generated based off the metadata URI's
- * hostname and port.
- * </p>
- *
- * @param credentials the username and password credentials
- * @param scope the HTTP client auth scope with which to scope the credentials, may be null
- *
- * @deprecated use {@link #setHttpClientSecurityParameters(HttpClientSecurityParameters)}
- */
- @Deprecated
- public void setBasicCredentialsWithScope(@Nullable final UsernamePasswordCredentials credentials,
- @Nullable final AuthScope scope) {
- ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setBasicCredentialsWithScope",
- null, "setHttpClientSecurityParameters(HttpClientSecurityParameters)");
-
- if (credentials != null) {
- AuthScope authScope = scope;
- if (authScope == null) {
- authScope = new AuthScope(metadataURI.getHost(), metadataURI.getPort());
- }
- final BasicCredentialsProvider provider = new BasicCredentialsProvider();
- provider.setCredentials(authScope, credentials);
- credentialsProvider = provider;
- } else {
- log.debug("Either username or password were null, disabling basic auth");
- credentialsProvider = null;
- }
-
- }
-
/**
* Get the instance of {@link HttpClientSecurityParameters} which provides various parameters to influence
* the security behavior of the HttpClient instance.
@@ -266,8 +171,6 @@ public class HTTPMetadataResolver extends AbstractReloadingMetadataResolver {
@Override
protected void doDestroy() {
httpClient = null;
- tlsTrustEngine = null;
- credentialsProvider = null;
httpClientSecurityParameters = null;
metadataURI = null;
cachedMetadataETag = null;
@@ -338,21 +241,6 @@ public class HTTPMetadataResolver extends AbstractReloadingMetadataResolver {
}
/**
- * Check that trust engine evaluation of the server TLS credential was actually performed.
- *
- * @param context the current HTTP context instance in use
- * @throws SSLPeerUnverifiedException thrown if the TLS credential was not actually evaluated by the trust engine
- *
- * @deprecated use {@link HttpClientSecuritySupport#checkTLSCredentialEvaluated(HttpClientContext, String)}
- */
- @Deprecated
- protected void checkTLSCredentialTrusted(final HttpClientContext context) throws SSLPeerUnverifiedException {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName()+ ".checkTLSCredentialTrusted",
- null, "HttpClientSecuritySupport.checkTLSCredentialEvaluated(..)");
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, metadataURI.getScheme());
- }
-
- /**
* Builds the {@link HttpGet} instance used to fetch the metadata. The returned method advertises support for GZIP
* and deflate compression, enables conditional GETs if the cached metadata came with either an ETag or
* Last-Modified information, and sets up basic authentication if such is configured.
@@ -371,20 +259,6 @@ public class HTTPMetadataResolver extends AbstractReloadingMetadataResolver {
return getMethod;
}
-
- /**
- * Build the {@link HttpClientContext} instance which will be used to invoke the {@link HttpClient} request.
- *
- * @return a new instance of {@link HttpClientContext}
- *
- * @deprecated use {@link #buildHttpClientContext(HttpUriRequest)}
- */
- @Deprecated
- protected HttpClientContext buildHttpClientContext() {
- //TODO when we remove this deprecated method, change called method to @Nonnull for request
- DeprecationSupport.warn(ObjectType.METHOD, getClass().getName() + ".buildHttpClientContext()", null, null);
- return buildHttpClientContext(null);
- }
/**
* Build the {@link HttpClientContext} instance which will be used to invoke the {@link HttpClient} request.
@@ -393,23 +267,12 @@ public class HTTPMetadataResolver extends AbstractReloadingMetadataResolver {
*
* @return a new instance of {@link HttpClientContext}
*/
- protected HttpClientContext buildHttpClientContext(@Nullable final HttpUriRequest request) {
+ protected HttpClientContext buildHttpClientContext(@Nonnull final HttpUriRequest request) {
// TODO Really request should be @Nonnull, change when we remove deprecated buildHttpClientContext()
final HttpClientContext context = HttpClientContext.create();
HttpClientSecuritySupport.marshalSecurityParameters(context, httpClientSecurityParameters, true);
-
- // If these legacy values are present, let them override the above params instance values unconditionally
- if (credentialsProvider != null) {
- context.setCredentialsProvider(credentialsProvider);
- }
- if (tlsTrustEngine != null) {
- context.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, tlsTrustEngine);
- }
-
- if (request != null) {
- HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(context, request);
- }
+ HttpClientSecuritySupport.addDefaultTLSTrustEngineCriteria(context, request);
return context;
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilder.java
index 58c9cf4..059d24a 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilder.java
@@ -34,10 +34,8 @@ import com.google.common.net.UrlEscapers;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.velocity.Template;
/**
@@ -95,70 +93,6 @@ public class TemplateRequestURLBuilder implements Function<CriteriaSet, String>
*
* @param engine the {@link VelocityEngine} instance to use
* @param templateString the Velocity template string
- * @param encoded true if entity ID should be URL form-encoded prior to substitution, false otherwise
- *
- * @deprecated Replacement is the variant which accepts an instance of {@link EncodingStyle}
- */
- @Deprecated
- public TemplateRequestURLBuilder(@Nonnull final VelocityEngine engine,
- @Nonnull @NotEmpty final String templateString, final boolean encoded) {
- this(engine, templateString, encoded ? EncodingStyle.form : EncodingStyle.none, null,
- StandardCharsets.US_ASCII);
-
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".constructor", null,
- "variant accepting EncodingStyle enum");
- }
- /**
- * Constructor.
- *
- * <p>The template character set will be US ASCII.</p>
- *
- * @param engine the {@link VelocityEngine} instance to use
- * @param templateString the Velocity template string
- * @param transform function which transforms the entityID prior to substitution, may be null
- * @param encoded true if entity ID should be URL form-encoded prior to substitution, false otherwise
- *
- * @deprecated Replacement is the variant which accepts an instance of {@link EncodingStyle}
- */
- @Deprecated
- public TemplateRequestURLBuilder(@Nonnull final VelocityEngine engine,
- @Nonnull @NotEmpty final String templateString, final boolean encoded,
- @Nullable final Function<String, String> transform) {
- this(engine, templateString, encoded ? EncodingStyle.form : EncodingStyle.none, transform,
- StandardCharsets.US_ASCII);
-
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".constructor", null,
- "variant accepting EncodingStyle enum");
- }
-
- /**
- * Constructor.
- *
- * @param engine the {@link VelocityEngine} instance to use
- * @param templateString the Velocity template string
- * @param encoded true if entity ID should be URL form-encoded prior to substitution, false otherwise
- * @param transform function which transforms the entityID prior to substitution, may be null
- * @param charSet character set of the template, may be null
- *
- * @deprecated Replacement is the variant which accepts an instance of {@link EncodingStyle}
- */
- @Deprecated
- public TemplateRequestURLBuilder(@Nonnull final VelocityEngine engine,
- @Nonnull @NotEmpty final String templateString, final boolean encoded,
- @Nullable final Function<String, String> transform, @Nullable final Charset charSet) {
- this(engine, templateString, encoded ? EncodingStyle.form : EncodingStyle.none, transform, charSet);
-
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".constructor", null,
- "variant accepting EncodingStyle enum");
- }
-
- /**
- * Constructor.
- *
- * <p>The template character set will be US ASCII.</p>
- *
- * @param engine the {@link VelocityEngine} instance to use
- * @param templateString the Velocity template string
* @param encodingStyle the style for encoding the entity ID prior to substitution,
* null means {@link EncodingStyle#none}
*/
@@ -263,5 +197,4 @@ public class TemplateRequestURLBuilder implements Function<CriteriaSet, String>
}
}
-
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/NameIdentifierImpl.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/NameIdentifierImpl.java
index 1ceda28..3fa7312 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/NameIdentifierImpl.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/NameIdentifierImpl.java
@@ -23,9 +23,6 @@ import org.opensaml.core.xml.AbstractXMLObject;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.saml.saml1.core.NameIdentifier;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-
/**
* Complete implementation of {@link org.opensaml.saml.saml1.core.NameIdentifier}.
*/
@@ -63,13 +60,6 @@ public class NameIdentifierImpl extends AbstractXMLObject implements NameIdentif
}
/** {@inheritDoc} */
- @Deprecated
- public String getNameIdentifier() {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".getNameIdentifier", null, "getValue");
- return getValue();
- }
-
- /** {@inheritDoc} */
public String getValue() {
return nameIdentifier;
}
@@ -85,13 +75,6 @@ public class NameIdentifierImpl extends AbstractXMLObject implements NameIdentif
}
/** {@inheritDoc} */
- @Deprecated
- public void setNameIdentifier(final String id) {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".setNameIdentifier", null, "setValue");
- setValue(id);
- }
-
- /** {@inheritDoc} */
public void setValue(final String id) {
nameIdentifier = prepareForAssignment(nameIdentifier, id);
}
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
index b04bfc3..faf44fa 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/OneTimeUseConditionValidator.java
@@ -159,6 +159,7 @@ public class OneTimeUseConditionValidator implements ConditionValidator {
expires = (Duration) raw;
} else if (raw instanceof Long) {
expires = Duration.ofMillis((Long) raw);
+ // V4 deprecation, remove in V5
DeprecationSupport.warn(ObjectType.CONFIGURATION,
SAML2AssertionValidationParameters.COND_ONE_TIME_USE_EXPIRES, null, Duration.class.getName());
}
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilderTest.java
index 4cb1c28..49bbdd0 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/TemplateRequestURLBuilderTest.java
@@ -41,30 +41,6 @@ public class TemplateRequestURLBuilderTest {
}
@Test
- @SuppressWarnings("deprecation")
- public void testEncodedQueryParamLegacy() {
- function = new TemplateRequestURLBuilder(engine, "http://metadata.example.org/?entity=${entityID}", true);
-
- Assert.assertEquals(function.apply(new CriteriaSet(new EntityIdCriterion("http://example.org/idp"))), "http://metadata.example.org/?entity=http%3A%2F%2Fexample.org%2Fidp");
- }
-
- @Test
- @SuppressWarnings("deprecation")
- public void testMDQStyleLegacy() {
- function = new TemplateRequestURLBuilder(engine, "http://metadata.example.org/entities/${entityID}", true);
-
- Assert.assertEquals(function.apply(new CriteriaSet(new EntityIdCriterion("http://example.org/idp"))), "http://metadata.example.org/entities/http%3A%2F%2Fexample.org%2Fidp");
- }
-
- @Test
- @SuppressWarnings("deprecation")
- public void testWellKnownLocationStyleLegacy() {
- function = new TemplateRequestURLBuilder(engine, "${entityID}", false);
-
- Assert.assertEquals(function.apply(new CriteriaSet(new EntityIdCriterion("http://example.org/idp"))), "http://example.org/idp");
- }
-
- @Test
public void testEncodedQueryParam() {
function = new TemplateRequestURLBuilder(engine, "http://metadata.example.org/?entity=${entityID}", EncodingStyle.form);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 78b7f04..dfc4e37 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -48,6 +48,7 @@ import org.opensaml.security.x509.tls.impl.ThreadLocalX509CredentialContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.httpclient.HttpClientSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
@@ -247,39 +248,14 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
* and {@link CriteriaSet} supplied by the caller via the {@link HttpContext}.
*
* @param socket the socket instance being processed
- * @param context the HttpClient context being processed
- *
- * @throws IOException if the server TLS credential is untrusted, or if there is a fatal error
- * attempting trust evaluation.
- *
- * @deprecated use {@link #performTrustEval(Socket, String, HttpContext)}
- */
- @Deprecated
- protected void performTrustEval(@Nonnull final Socket socket, @Nonnull final HttpContext context)
- throws IOException {
- //TODO when we remove this deprecated method, change called method to @Nonnull for hostname
- DeprecationSupport.warn(ObjectType.METHOD, getClass().getName() + ".performTrustEval(Socket, HttpContext)",
- null, null);
- performTrustEval(socket, null, context);
- }
-
-// Checkstyle: ReturnCount OFF
- /**
- * Perform trust evaluation by extracting the server TLS {@link X509Credential} from the
- * {@link SSLSession} and evaluating it via a
- * {@link TrustEngine}<code><</code>{@link org.opensaml.security.credential.Credential}<code>></code>
- * and {@link CriteriaSet} supplied by the caller via the {@link HttpContext}.
- *
- * @param socket the socket instance being processed
* @param hostname the hostname being processed
* @param context the HttpClient context being processed
*
* @throws IOException if the server TLS credential is untrusted, or if there is a fatal error
* attempting trust evaluation.
*/
- protected void performTrustEval(@Nonnull final Socket socket, @Nullable final String hostname,
+ protected void performTrustEval(@Nonnull final Socket socket, @Nonnull @NotEmpty final String hostname,
@Nonnull final HttpContext context) throws IOException {
- //TODO Really hostname should be @Nonnull, change when we remove deprecated performTrustEval(...)
if (!(socket instanceof SSLSocket)) {
log.debug("Socket was not an instance of SSLSocket, skipping trust eval");
@@ -289,30 +265,28 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
log.debug("Attempting to evaluate server TLS credential against supplied TrustEngine and CriteriaSet");
- @SuppressWarnings("unchecked") final
- TrustEngine<? super X509Credential> trustEngine = (TrustEngine<? super X509Credential>) context.getAttribute(
- HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE);
+ @SuppressWarnings("unchecked")
+ final TrustEngine<? super X509Credential> trustEngine =
+ (TrustEngine<? super X509Credential>) context.getAttribute(
+ HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE);
if (trustEngine == null) {
if (isTrustEngineRequired()) {
log.warn("The required trust engine was not supplied by the caller, failing socket TLS creation");
throw new SSLPeerUnverifiedException("The required trust engine was not supplied by the caller");
- } else {
- log.debug("No trust engine supplied by caller, skipping trust eval");
- return;
}
- } else {
- log.trace("Saw trust engine of type: {}", trustEngine.getClass().getName());
+ log.debug("No trust engine supplied by caller, skipping trust eval");
+ return;
}
+ log.trace("Saw trust engine of type: {}", trustEngine.getClass().getName());
+
CriteriaSet criteriaSet = (CriteriaSet) context.getAttribute(
HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET);
if (criteriaSet == null) {
log.debug("No criteria set supplied by caller, building new criteria set with signing "
+ "and trusted names criteria");
criteriaSet = new CriteriaSet(new UsageCriterion(UsageType.SIGNING));
- if (hostname != null) {
- criteriaSet.add(new TrustedNamesCriterion(Collections.singleton(hostname)));
- }
+ criteriaSet.add(new TrustedNamesCriterion(Collections.singleton(hostname)));
} else {
log.trace("Saw CriteriaSet: {}", criteriaSet);
}
@@ -333,9 +307,8 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
log.debug("Credential evaluated as untrusted, failure indicated as fatal");
throw new SSLPeerUnverifiedException(
"Trust engine could not establish trust of server TLS credential");
- } else {
- log.debug("Credential evaluated as untrusted, failure indicated as non-fatal");
}
+ log.debug("Credential evaluated as untrusted, failure indicated as non-fatal");
}
} catch (final SecurityException e) {
log.error("Trust engine error evaluating credential", e);
@@ -343,7 +316,6 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
}
}
-// Checkstyle: ReturnCount ON
/**
* Extract the server TLS {@link X509Credential} from the supplied {@link SSLSocket}.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java
deleted file mode 100644
index 04dda01..0000000
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactory.java
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.opensaml.security.httpclient.impl;
-
-import java.io.IOException;
-import java.net.InetSocketAddress;
-import java.net.Socket;
-import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.net.ssl.SSLPeerUnverifiedException;
-import javax.net.ssl.SSLSession;
-import javax.net.ssl.SSLSocket;
-
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-import org.apache.http.HttpHost;
-import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
-import org.apache.http.protocol.HttpContext;
-import org.opensaml.security.SecurityException;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.criteria.UsageCriterion;
-import org.opensaml.security.httpclient.HttpClientSecurityConstants;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.security.x509.X509Credential;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * An implementation of HttpClient's {@link LayeredConnectionSocketFactory}, which supports
- * verifying the server TLS certificate and chain via a
- * {@link TrustEngine}<code><</code>{@link org.opensaml.security.credential.Credential}<code>></code>
- * and {@link CriteriaSet} supplied by the HttpClient caller via the {@link HttpContext}.
- *
- * <p>
- * The context keys used by this component are as follows, defined in {@link HttpClientSecurityConstants}:
- * <ul>
- * <li>{@link HttpClientSecurityConstants#CONTEXT_KEY_TRUST_ENGINE}: The trust engine instance used.
- * Supplied by the HttpClient caller. Must be an instance of
- * {@link TrustEngine}<code><</code>{@link org.opensaml.security.credential.Credential}<code>></code>.</li>
- * <li>{@link HttpClientSecurityConstants#CONTEXT_KEY_CRITERIA_SET}: The criteria set instance used.
- * Supplied by the HttpClient caller. Must be an instance of {@link CriteriaSet}. </li>
- * <li>{@link HttpClientSecurityConstants#CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED}: The result of the
- * trust evaluation, if it was performed. Populated by this component. Will be a {@link Boolean},
- * where <code>true</code> means the server TLS was evaluated as trusted, <code>false</code> means
- * the credential was evaluated as untrusted. A null or missing value means that trust engine
- * evaluation was not performed.</li>
- * </ul>
- * </p>
- *
- * <p>
- * If the trust engine context attribute is not populated by the caller, then no trust
- * evaluation is performed. This allows use of this implementation with use cases where, given a particular
- * HttpClient instance, sometimes trust engine evaluation is to be performed, and sometimes not.
- * </p>
- *
- * <p>
- * Since this implementation may typically be used with and wrap a "no trust" SSL socket factory,
- * an optional instance of {@link X509HostnameVerifier} may also be supplied. If supplied, hostname
- * verification will be performed against the new {@link SSLSocket} via
- * {@link X509HostnameVerifier#verify(String, SSLSocket)}.
- * </p>
- *
- * @deprecated use instead {@link SecurityEnhancedTLSSocketFactory}.
- */
- at Deprecated
-public class TrustEngineTLSSocketFactory implements LayeredConnectionSocketFactory {
-
- /** Logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(TrustEngineTLSSocketFactory.class);
-
- /** The HttpClient socket factory instance wrapped by this implementation. */
- @Nonnull private LayeredConnectionSocketFactory wrappedFactory;
-
- /** The hostname verifier evaluated by this implementation. */
- @Nullable private X509HostnameVerifier hostnameVerifier;
-
- /**
- * Constructor.
- *
- * @param factory the underlying HttpClient socket factory wrapped by this implementation.
- * @param verifier the hostname verifier evaluated by this implementation
- */
- public TrustEngineTLSSocketFactory(final LayeredConnectionSocketFactory factory,
- final X509HostnameVerifier verifier) {
- DeprecationSupport.warnOnce(ObjectType.CLASS, getClass().getName(), null, "SecurityEnhancedTLSSocketFactory");
- wrappedFactory = Constraint.isNotNull(factory, "Socket factory was null");
- hostnameVerifier = verifier;
- }
-
- /** {@inheritDoc} */
- public Socket createSocket(final HttpContext context) throws IOException {
- log.trace("In createSocket");
- return wrappedFactory.createSocket(context);
- }
-
-// Checkstyle: ParameterNumber OFF
- /** {@inheritDoc} */
- public Socket connectSocket(final int connectTimeout, final Socket sock, final HttpHost host,
- final InetSocketAddress remoteAddress, final InetSocketAddress localAddress,
- final HttpContext context) throws IOException {
-
- log.trace("In connectSocket");
- final Socket socket =
- wrappedFactory.connectSocket(connectTimeout, sock, host, remoteAddress, localAddress, context);
- performTrustEval(socket, context);
- performHostnameVerification(socket, host.getHostName(), context);
- return socket;
-
- }
-// Checkstyle: ParameterNumber ON
-
- /** {@inheritDoc} */
- public Socket createLayeredSocket(final Socket socket, final String target, final int port,
- final HttpContext context) throws IOException {
- log.trace("In createLayeredSocket");
- final Socket layeredSocket = wrappedFactory.createLayeredSocket(socket, target, port, context);
- performTrustEval(layeredSocket, context);
- performHostnameVerification(layeredSocket, target, context);
- return layeredSocket;
- }
-
-// Checkstyle: ReturnCount OFF
- /**
- * Perform trust evaluation by extracting the server TLS {@link X509Credential} from the
- * {@link SSLSession} and evaluating it via a
- * {@link TrustEngine}<code><</code>{@link org.opensaml.security.credential.Credential}<code>></code>
- * and {@link CriteriaSet} supplied by the caller via the {@link HttpContext}.
- *
- * @param socket the socket instance being processed
- * @param context the HttpClient context being processed
- *
- * @throws IOException if the server TLS credential is untrusted, or if there is a fatal error
- * attempting trust evaluation.
- */
- protected void performTrustEval(@Nonnull final Socket socket, @Nonnull final HttpContext context)
- throws IOException {
- if (!(socket instanceof SSLSocket)) {
- log.debug("Socket was not an instance of SSLSocket, skipping trust eval");
- return;
- }
- final SSLSocket sslSocket = (SSLSocket) socket;
-
- log.debug("Attempting to evaluate server TLS credential against supplied TrustEngine and CriteriaSet");
-
- @SuppressWarnings("unchecked") final
- TrustEngine<? super X509Credential> trustEngine = (TrustEngine<? super X509Credential>) context.getAttribute(
- HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE);
- if (trustEngine == null) {
- log.debug("No trust engine supplied by caller, skipping trust eval");
- return;
- } else {
- log.trace("Saw trust engine of type: {}", trustEngine.getClass().getName());
- }
-
- CriteriaSet criteriaSet = (CriteriaSet) context.getAttribute(
- HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET);
- if (criteriaSet == null) {
- log.debug("No criteria set supplied by caller, building new criteria set with signing criteria");
- criteriaSet = new CriteriaSet(new UsageCriterion(UsageType.SIGNING));
- } else {
- log.trace("Saw CriteriaSet: {}", criteriaSet);
- }
-
- final X509Credential credential = extractCredential(sslSocket);
-
- try {
- if (trustEngine.validate(credential, criteriaSet)) {
- log.debug("Credential evaluated as trusted");
- context.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED,
- Boolean.TRUE);
- } else {
- log.debug("Credential evaluated as untrusted");
- context.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED,
- Boolean.FALSE);
- throw new SSLPeerUnverifiedException("Trust engine could not establish trust of server TLS credential");
- }
- } catch (final SecurityException e) {
- log.error("Trust engine error evaluating credential", e);
- throw new IOException("Trust engine error evaluating credential", e);
- }
-
- }
-// Checkstyle: ReturnCount ON
-
- /**
- * Extract the server TLS {@link X509Credential} from the supplied {@link SSLSocket}.
- *
- * @param sslSocket the SSL socket instance to process
- * @return an X509Credential representing the server TLS entity certificate as well as the
- * supplied supporting intermediate certificate chain (if any)
- * @throws IOException if credential data can not be extracted from the socket
- */
- @Nonnull protected X509Credential extractCredential(@Nonnull final SSLSocket sslSocket) throws IOException {
- final SSLSession session = sslSocket.getSession();
- final Certificate[] peerCertificates = session.getPeerCertificates();
- if (peerCertificates == null || peerCertificates.length < 1) {
- throw new SSLPeerUnverifiedException("SSLSession peer certificates array was null or empty");
- }
-
- final ArrayList<X509Certificate> certChain = new ArrayList<>();
- for (final Certificate cert : peerCertificates) {
- certChain.add((X509Certificate) cert);
- }
-
- final X509Certificate entityCert = certChain.get(0);
-
- final BasicX509Credential credential = new BasicX509Credential(entityCert);
- credential.setEntityCertificateChain(certChain);
-
- return credential;
- }
-
- /**
- * Perform hostname verification on the connection represented by the supplied socket.
- *
- * @param socket the socket instance being processed
- * @param hostname the hostname against which to verify
- * @param context the current HttpClient context instance
- * @throws IOException if an I/O error occurs or the verification process fails
- */
- protected void performHostnameVerification(final Socket socket, final String hostname, final HttpContext context)
- throws IOException {
- if (hostnameVerifier != null && socket instanceof SSLSocket) {
- hostnameVerifier.verify(hostname, (SSLSocket) socket);
- }
- }
-
-}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactoryTest.java
deleted file mode 100644
index 5473fa8..0000000
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/TrustEngineTLSSocketFactoryTest.java
+++ /dev/null
@@ -1,213 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.opensaml.security.httpclient.impl;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.Socket;
-import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-
-import javax.net.ssl.SSLException;
-import javax.net.ssl.SSLPeerUnverifiedException;
-
-import org.apache.http.HttpHost;
-import org.apache.http.client.protocol.HttpClientContext;
-import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
-import org.apache.http.protocol.HttpContext;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.httpclient.HttpClientSecurityConstants;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.security.x509.X509Credential;
-import org.opensaml.security.x509.X509Support;
-import org.testng.Assert;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
-
- at SuppressWarnings("deprecation")
-public class TrustEngineTLSSocketFactoryTest {
-
- private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
-
- private TrustEngineTLSSocketFactory trustEngineFactory;
-
- private HttpContext httpContext;
-
- private String hostname = "foo.example.org";
-
- @BeforeMethod
- public void buildHttpContext() {
- httpContext = new HttpClientContext();
- }
-
- @Test
- public void testNonSSL() throws IOException {
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(null, hostname), null);
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
- trustEngineFactory.connectSocket(0, socket, new HttpHost(hostname, 80, "http"), null, null, httpContext);
-
- Assert.assertNull(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED));
- }
-
- @Test
- public void testSuccessNoTrustEngine() throws IOException {
- X509Credential cred = getCredential("foo-1A1-good.crt");
-
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), null);
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
- trustEngineFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
-
- Assert.assertNull(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED));
- }
-
- @Test
- public void testSuccessWithEngine() throws IOException {
- X509Credential cred = getCredential("foo-1A1-good.crt");
- ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(cred));
- httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
-
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), null);
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
- trustEngineFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
-
- Assert.assertEquals(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED), Boolean.TRUE);
- }
-
- @Test
- public void testSuccessWithEngineAndVerifier() throws IOException {
- X509Credential cred = getCredential("foo-1A1-good.crt");
- ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(cred));
- httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
-
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
- trustEngineFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
-
- Assert.assertEquals(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED), Boolean.TRUE);
- }
-
- @Test(expectedExceptions=SSLPeerUnverifiedException.class)
- public void testFailUntrustedCert() throws IOException {
- X509Credential cred = getCredential("foo-1A1-good.crt");
- List<Credential> emptyCreds = new ArrayList<>();
- ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(emptyCreds));
- httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
-
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
- try {
- trustEngineFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
- } catch (Exception e) {
- Assert.assertEquals(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED), Boolean.FALSE);
- throw e;
- }
- }
-
- @Test(expectedExceptions=SSLException.class)
- public void testFailBadHostname() throws IOException {
- X509Credential cred = getCredential("foo-1A1-good.crt");
- ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(cred));
- httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
-
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), "bogus.example.com"), new StrictHostnameVerifier());
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
-
- try {
- trustEngineFactory.connectSocket(0, socket, new HttpHost("bogus.example.com", 443, "https"), null, null, httpContext);
- } catch (Exception e) {
- Assert.assertEquals(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED), Boolean.TRUE);
- throw e;
- }
- }
-
- @Test(expectedExceptions=SSLPeerUnverifiedException.class)
- public void testFailNoCertsInSession() throws IOException {
- X509Credential cred = getCredential("foo-1A1-good.crt");
- ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(cred));
- httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
-
- // Pass an empty cert list, to simulate unlikely condition of SSLSession not having any peerCertificates
- trustEngineFactory = new TrustEngineTLSSocketFactory(buildInnerSSLFactory(
- new ArrayList<Certificate>(), hostname), new StrictHostnameVerifier());
- Socket socket = trustEngineFactory.createSocket(httpContext);
-
- trustEngineFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
- }
-
- // Helper methods
-
- private LayeredConnectionSocketFactory buildInnerSSLFactory(List<Certificate> certs, String host) {
- if (certs == null) {
- return new MockTLSSocketFactory();
- } else {
- return new MockTLSSocketFactory(certs, host);
- }
- }
-
- private BasicX509Credential getCredential(String entityCertFileName, String ... chainMembers) {
- X509Certificate entityCert = getCertificate(entityCertFileName);
-
- BasicX509Credential cred = new BasicX509Credential(entityCert);
-
- HashSet<X509Certificate> certChain = new HashSet<>();
- certChain.add(entityCert);
-
- for (String member: chainMembers) {
- certChain.add( getCertificate(member) );
- }
-
- cred.setEntityCertificateChain(certChain);
-
- return cred;
- }
-
- private X509Certificate getCertificate(String fileName) {
- try {
- InputStream ins = getInputStream(fileName);
- byte[] encoded = new byte[ins.available()];
- ins.read(encoded);
- return X509Support.decodeCertificates(encoded).iterator().next();
- } catch (Exception e) {
- Assert.fail("Could not create certificate from file: " + fileName + ": " + e.getMessage());
- }
- return null;
- }
-
- private InputStream getInputStream(String fileName) {
- return this.getClass().getResourceAsStream(DATA_PATH + fileName);
- }
-
-}
diff --git a/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java b/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java
index 5161002..50a1146 100644
--- a/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java
+++ b/opensaml-soap-api/src/main/java/org/opensaml/soap/client/http/AbstractPipelineHttpSOAPClient.java
@@ -28,7 +28,6 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import javax.net.ssl.SSLException;
-import javax.net.ssl.SSLPeerUnverifiedException;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
@@ -36,8 +35,6 @@ import net.shibboleth.utilities.java.support.component.AbstractInitializableComp
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import org.apache.http.HttpResponse;
@@ -302,25 +299,7 @@ public abstract class AbstractPipelineHttpSOAPClient
*/
@Nonnull protected abstract HttpClientMessagePipeline newPipeline()
throws SOAPException;
-
- /**
- * Check that trust engine evaluation of the server TLS credential was actually performed.
- *
- * @param context the current HTTP context instance in use
- * @param request the HTTP URI request
- * @throws SSLPeerUnverifiedException thrown if the TLS credential was not actually evaluated by the trust engine
- *
- * @deprecated use {@link HttpClientSecuritySupport#checkTLSCredentialEvaluated(HttpClientContext, String)}
- */
- @Deprecated
- protected void checkTLSCredentialTrusted(@Nonnull final HttpClientContext context,
- @Nonnull final HttpUriRequest request) throws SSLPeerUnverifiedException {
- DeprecationSupport.warnOnce(ObjectType.METHOD, getClass().getName() + ".checkTLSCredentialTrusted", null,
- "HttpClientSecuritySupport.checkTLSCredentialEvaluated");
- HttpClientSecuritySupport.checkTLSCredentialEvaluated(context, request.getURI().getScheme());
- }
-
/**
* Build the {@link HttpUriRequest} instance to be executed by the HttpClient.
*
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list