[java-identity-provider] branch master updated: JSPT-79 - Review date and time handling for Java 8
Scott Cantor
cantor.2 at osu.edu
Fri Mar 8 13:37:37 EST 2019
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=82a6f3b87c6b9cc9a0accbd154f04ea7ac8248c7
The following commit(s) were added to refs/heads/master by this push:
new 82a6f3b JSPT-79 - Review date and time handling for Java 8
82a6f3b is described below
commit 82a6f3b87c6b9cc9a0accbd154f04ea7ac8248c7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Mar 8 13:37:33 2019 -0500
JSPT-79 - Review date and time handling for Java 8
https://issues.shibboleth.net/jira/browse/JSPT-79
Remediate Duration annotation use out of java-support.
---
.../impl/PasswordPrincipalSerializer.java | 5 ++--
.../idp/cas/ticket/impl/EncodingTicketService.java | 3 +--
.../impl/CryptoTransientIdGenerationStrategy.java | 30 ++++++++++++----------
.../impl/CryptoTransientNameIDDecoderTest.java | 14 +++++-----
.../CryptoTransientNameIdentifierDecoderTest.java | 3 ++-
...oTransientSAML1NameIdentifierGeneratorTest.java | 5 ++--
.../CryptoTransientSAML2NameIDGeneratorTest.java | 5 ++--
7 files changed, 37 insertions(+), 28 deletions(-)
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/PasswordPrincipalSerializer.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/PasswordPrincipalSerializer.java
index cdd0ab5..fd5eb08 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/PasswordPrincipalSerializer.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/PasswordPrincipalSerializer.java
@@ -21,6 +21,8 @@ import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.security.Principal;
+import java.time.Duration;
+import java.time.Instant;
import java.util.regex.Pattern;
import javax.annotation.Nonnull;
@@ -47,7 +49,6 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
import net.shibboleth.utilities.java.support.security.DataSealer;
import net.shibboleth.utilities.java.support.security.DataSealerException;
-import net.shibboleth.utilities.java.support.xml.DOMTypeSupport;
/**
* Principal serializer for {@link PasswordPrincipal} that encrypts the password.
@@ -113,7 +114,7 @@ public class PasswordPrincipalSerializer extends AbstractPrincipalSerializer<Str
try {
gen.writeStartObject()
.write(PASSWORD_FIELD, sealer.wrap(principal.getName(),
- System.currentTimeMillis() + DOMTypeSupport.durationToLong("P1Y")))
+ Instant.now().plus(Duration.ofDays(365))))
.writeEnd();
} catch (final DataSealerException e) {
throw new IOException(e);
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
index 8b2c777..2408e18 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
@@ -176,8 +176,7 @@ public class EncodingTicketService extends AbstractTicketService {
private <T extends Ticket> T encode(final Class<T> ticketClass, final T ticket, final String prefix) {
final String opaque;
try {
- opaque = dataSealer.wrap(
- serializer(ticketClass).serialize(ticket), ticket.getExpirationInstant().toEpochMilli());
+ opaque = dataSealer.wrap(serializer(ticketClass).serialize(ticket), ticket.getExpirationInstant());
} catch (final Exception e) {
throw new RuntimeException("Ticket encoding failed", e);
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientIdGenerationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientIdGenerationStrategy.java
index b68490f..8194a20 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientIdGenerationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientIdGenerationStrategy.java
@@ -17,12 +17,13 @@
package net.shibboleth.idp.saml.nameid.impl;
+import java.time.Duration;
+import java.time.Instant;
+
import javax.annotation.Nonnull;
-import net.shibboleth.utilities.java.support.annotation.Duration;
import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.annotation.constraint.Positive;
import net.shibboleth.utilities.java.support.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.component.ComponentSupport;
@@ -47,12 +48,12 @@ public class CryptoTransientIdGenerationStrategy extends AbstractIdentifiableIni
/** Object used to protect and encrypt the data. */
@NonnullAfterInit private DataSealer dataSealer;
- /** Length, in milliseconds, tokens are valid. */
- @Duration @Positive private long idLifetime;
+ /** Length tokens are valid. */
+ @Nonnull private Duration idLifetime;
/** Constructor. */
public CryptoTransientIdGenerationStrategy() {
- idLifetime = 1000 * 60 * 60 * 4;
+ idLifetime = Duration.ofHours(4);
}
/**
@@ -67,23 +68,26 @@ public class CryptoTransientIdGenerationStrategy extends AbstractIdentifiableIni
}
/**
- * Get the time, in milliseconds, ids are valid.
+ * Get the time ids are valid.
*
- * @return time, in milliseconds, ids are valid
+ * @return time ids are valid
*/
- @Positive @Duration public long getIdLifetime() {
+ @Nonnull public Duration getIdLifetime() {
return idLifetime;
}
/**
- * Set the time, in milliseconds, ids are valid.
+ * Set the time ids are valid.
*
- * @param lifetime time, in milliseconds, ids are valid
+ * @param lifetime time ids are valid
*/
- @Duration public void setIdLifetime(@Duration @Positive final long lifetime) {
+ public void setIdLifetime(@Nonnull final Duration lifetime) {
ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
- idLifetime = Constraint.isGreaterThan(0, lifetime, "ID lifetime must be positive");
+ Constraint.isNotNull(lifetime, "Lifetime cannot be null");
+ Constraint.isFalse(lifetime.isNegative() || lifetime.isZero(), "Lifetime must be positive");
+
+ idLifetime = lifetime;
}
/** {@inheritDoc} */
@@ -105,7 +109,7 @@ public class CryptoTransientIdGenerationStrategy extends AbstractIdentifiableIni
principalTokenIdBuilder.append(relyingPartyId).append("!").append(principalName);
try {
- return dataSealer.wrap(principalTokenIdBuilder.toString(), System.currentTimeMillis() + idLifetime);
+ return dataSealer.wrap(principalTokenIdBuilder.toString(), Instant.now().plus(idLifetime));
} catch (final DataSealerException e) {
throw new SAMLException("Exception wrapping principal identifier", e);
}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
index 75322ce..68da6a6 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
@@ -18,6 +18,8 @@
package net.shibboleth.idp.saml.nameid.impl;
import java.io.IOException;
+import java.time.Duration;
+import java.time.Instant;
import java.util.Collections;
import javax.security.auth.Subject;
@@ -51,8 +53,8 @@ import org.testng.annotations.Test;
*/
public class CryptoTransientNameIDDecoderTest extends OpenSAMLInitBaseTestCase {
- private final static long TIMEOUT = 50000;
-
+ private final static Duration TIMEOUT = Duration.ofSeconds(5);
+
private final static String PRINCIPAL = "ThePrincipal";
private final static String ISSUER = "https://idp.example.org/issuer";
@@ -98,11 +100,11 @@ public class CryptoTransientNameIDDecoderTest extends OpenSAMLInitBaseTestCase {
decoder.initialize();
}
- private String code(final String principalName, final String attributeRecipientID, final long timeout)
+ private String code(final String principalName, final String attributeRecipientID, final Duration timeout)
throws DataSealerException {
final String principalTokenId =
new StringBuilder().append(attributeRecipientID).append("!").append(principalName).toString();
- return dataSealer.wrap(principalTokenId, System.currentTimeMillis() + timeout);
+ return dataSealer.wrap(principalTokenId, Instant.now().plus(timeout));
}
private String code(final String principalName, final String attributeIssuerID, final String attributeRecipientID)
@@ -119,7 +121,7 @@ public class CryptoTransientNameIDDecoderTest extends OpenSAMLInitBaseTestCase {
@Test(expectedExceptions = NameDecoderException.class)
public void timeout()
throws SubjectCanonicalizationException, DataSealerException, NameDecoderException {
- final String ct = code(PRINCIPAL, RECIPIENT, -10);
+ final String ct = code(PRINCIPAL, RECIPIENT, Duration.ofMillis(-5));
decoder.decode(ct, RECIPIENT);
}
@@ -136,7 +138,7 @@ public class CryptoTransientNameIDDecoderTest extends OpenSAMLInitBaseTestCase {
final String principalTokenId =
new StringBuilder().append(ISSUER).append("!").append(RECIPIENT).append("+").append(PRINCIPAL)
.toString();
- final String ct = dataSealer.wrap(principalTokenId, System.currentTimeMillis() + TIMEOUT);
+ final String ct = dataSealer.wrap(principalTokenId, Instant.now().plus(TIMEOUT));
Assert.assertNull(decoder.decode(ct, RECIPIENT));
}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
index 9de339c..4395f7a 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.saml.nameid.impl;
import java.io.IOException;
+import java.time.Duration;
import java.util.Collections;
import javax.security.auth.Subject;
@@ -49,7 +50,7 @@ import org.testng.annotations.Test;
*/
public class CryptoTransientNameIdentifierDecoderTest extends OpenSAMLInitBaseTestCase {
- private final static long TIMEOUT = 5000;
+ private final static Duration TIMEOUT = Duration.ofSeconds(5);
private DataSealer dataSealer;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java
index 6ab61f1..9201894 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.saml.nameid.impl;
import java.io.IOException;
+import java.time.Duration;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.profile.RequestContextBuilder;
@@ -40,7 +41,7 @@ import org.testng.annotations.Test;
/** Unit test for {@link TransientSAML1NameIdentifierGenerator} using crypto-based generator. */
public class CryptoTransientSAML1NameIdentifierGeneratorTest extends OpenSAMLInitBaseTestCase {
- private static final long TIMEOUT = 500;
+ private static final Duration TIMEOUT = Duration.ofMillis(500);
private DataSealer sealer;
@@ -126,7 +127,7 @@ public class CryptoTransientSAML1NameIdentifierGeneratorTest extends OpenSAMLIni
Assert.assertEquals(decode, rpc.getRelyingPartyId() + "!" + "jdoe");
- Thread.sleep(TIMEOUT*2);
+ Thread.sleep(TIMEOUT.multipliedBy(2).toMillis());
try {
sealer.unwrap(val);
Assert.fail("Timeout not set correctly");
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java
index b466ad9..dfa8ed5 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java
@@ -18,6 +18,7 @@
package net.shibboleth.idp.saml.nameid.impl;
import java.io.IOException;
+import java.time.Duration;
import net.shibboleth.ext.spring.resource.ResourceHelper;
import net.shibboleth.idp.authn.context.SubjectContext;
@@ -41,7 +42,7 @@ import org.testng.annotations.Test;
/** Unit test for {@link TransientSAML2NameIDGenerator} using crypto-based generator. */
public class CryptoTransientSAML2NameIDGeneratorTest extends OpenSAMLInitBaseTestCase {
- private static final long TIMEOUT = 500;
+ private static final Duration TIMEOUT = Duration.ofMillis(500);
private DataSealer sealer;
@@ -127,7 +128,7 @@ public class CryptoTransientSAML2NameIDGeneratorTest extends OpenSAMLInitBaseTes
Assert.assertEquals(decode, rpc.getRelyingPartyId() + "!" + "jdoe");
- Thread.sleep(TIMEOUT*2);
+ Thread.sleep(TIMEOUT.multipliedBy(2).toMillis());
try {
sealer.unwrap(val);
Assert.fail("Timeout not set correctly");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list