[java-opensaml] branch master updated: OSJ-318 - Deprecate terms from classes and configuration

Scott Cantor cantor.2 at osu.edu
Thu Jun 11 17:16:46 UTC 2020


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=f043b657a638aa15612c6f066a4016bb8dbf2539

The following commit(s) were added to refs/heads/master by this push:
       new  f043b657a OSJ-318 - Deprecate terms from classes and configuration
f043b657a is described below

commit f043b657a638aa15612c6f066a4016bb8dbf2539
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 11 13:16:43 2020 -0400

    OSJ-318 - Deprecate terms from classes and configuration
    
    https://issues.shibboleth.net/jira/browse/OSJ-318
    
    Deprecated and replaced algorithm policy APIs and classes.
    Cleaned a lot of warnings from unrelated tests.
---
 .../handler/impl/CheckExpectedIssuerTest.java      |   1 -
 .../handler/impl/CheckMandatoryIssuerTest.java     |   1 -
 .../handler/impl/SchemaValidateXMLMessageTest.java |   2 -
 .../impl/CheckMessageVersionHandlerTest.java       |   1 -
 .../impl/SAMLOutboundDestinationHandlerTest.java   |   1 -
 .../impl/EndpointURLSchemeSecurityHandlerTest.java |   1 -
 .../impl/MessageLifetimeSecurityHandlerTest.java   |   1 -
 .../impl/MessageReplaySecurityHandlerTest.java     |   1 -
 .../impl/ReceivedEndpointSecurityHandlerTest.java  |   1 -
 ...ocolMessageXMLSignatureSecurityHandlerTest.java |   2 +-
 .../AddAudienceRestrictionToAssertionsTest.java    |   1 -
 .../AddNotOnOrAfterConditionToAssertionsTest.java  |   1 -
 .../ext/idpdisco/impl/DiscoveryResponseTest.java   |   1 -
 .../filter/impl/ByReferenceMetadataFilterTest.java |   2 -
 .../SignatureValidationFilterExplicitKeyTest.java  |   2 +-
 .../impl/FileBackedHTTPMetadataResolverTest.java   |   3 +-
 .../index/impl/MetadataIndexStoreTest.java         |   1 -
 .../binding/decoding/impl/HTTPPostDecoderTest.java |   1 -
 .../decoding/impl/HTTPSOAP11DecoderTest.java       |   1 -
 .../org/opensaml/saml/saml1/core/ResponseTest.java |   1 -
 .../impl/AuthorizationDecisionStatementTest.java   |   1 -
 .../saml/saml1/core/impl/EvidenceTest.java         |   1 -
 .../binding/decoding/impl/HTTPPostDecoderTest.java |   1 -
 .../decoding/impl/HTTPSOAP11DecoderTest.java       |   1 -
 .../impl/AddConsentToResponseHandlerTest.java      |   1 -
 .../impl/ExtractConsentFromRequestHandlerTest.java |   1 -
 ...AML2AuthnRequestsSignedSecurityHandlerTest.java |   1 -
 ...SAML2HTTPPostSimpleSignSecurityHandlerTest.java |   2 +-
 ...edirectDeflateSignatureSecurityHandlerTest.java |   2 +-
 .../opensaml/saml/saml2/core/AuthnRequestTest.java |   8 -
 .../saml2/core/ResponseSuccessAuthnAttribTest.java |  17 -
 .../saml/saml2/core/SignedAssertionTest.java       |   3 -
 .../saml2/encryption/ComplexEncryptionTest.java    |   1 -
 .../encryption/DecryptionPlusSigningTest.java      |   2 -
 ...cryptedElementTypeEncryptedKeyResolverTest.java |   1 -
 .../saml2/encryption/SimpleDecryptionTest.java     |   2 -
 .../saml2/encryption/SimpleEncryptionTest.java     |   1 -
 ...MLMetadataEncryptionParametersResolverTest.java |  16 +-
 ...dataSignatureSigningParametersResolverTest.java |  18 +-
 .../impl/SAMLSignatureProfileValidatorTest.java    |   1 -
 ...tion.java => AlgorithmPolicyConfiguration.java} |  43 +--
 ...ameters.java => AlgorithmPolicyParameters.java} |  58 ++--
 .../opensaml/xmlsec/DecryptionConfiguration.java   |   1 +
 .../org/opensaml/xmlsec/DecryptionParameters.java  |   6 +-
 .../opensaml/xmlsec/EncryptionConfiguration.java   |   1 +
 .../xmlsec/SignatureSigningConfiguration.java      |   1 +
 .../xmlsec/SignatureValidationConfiguration.java   |   1 +
 .../xmlsec/SignatureValidationParameters.java      |   6 +-
 .../xmlsec/WhitelistBlacklistConfiguration.java    |  27 +-
 .../xmlsec/WhitelistBlacklistParameters.java       |  46 +--
 .../xmlsec/algorithm/AlgorithmSupport.java         |  40 +--
 .../xmlsec/encryption/support/Decrypter.java       |  30 +-
 .../opensaml/xmlsec/crypto/XMLSigningUtilTest.java |   1 -
 .../DefaultSecurityConfigurationBootstrap.java     |  17 +-
 .../impl/AbstractSecurityParametersResolver.java   | 156 +++++----
 ...java => BasicAlgorithmPolicyConfiguration.java} | 116 ++++---
 .../xmlsec/impl/BasicDecryptionConfiguration.java  |  10 +-
 .../impl/BasicDecryptionParametersResolver.java    |  10 +-
 .../xmlsec/impl/BasicEncryptionConfiguration.java  |   1 +
 .../impl/BasicEncryptionParametersResolver.java    |   2 +-
 .../impl/BasicSignatureSigningConfiguration.java   |   1 +
 .../BasicSignatureSigningParametersResolver.java   |   4 +-
 .../BasicSignatureValidationConfiguration.java     |   6 +-
 ...BasicSignatureValidationParametersResolver.java |   8 +-
 .../impl/BasicWhitelistBlacklistConfiguration.java | 177 ++++++-----
 ...icate.java => ExcludedAlgorithmsPredicate.java} |  16 +-
 ...icate.java => IncludedAlgorithmsPredicate.java} |  19 +-
 ...pulateSignatureValidationParametersHandler.java |   2 -
 .../support/impl/BaseSignatureTrustEngine.java     |   4 +-
 .../support/impl/SignatureAlgorithmValidator.java  |  28 +-
 .../support/InlineEncryptedKeyResolverTest.java    |   2 -
 ...pleRetrievalMethodEncryptedKeyResolverTest.java |   2 -
 .../AbstractSecurityParametersResolverTest.java    | 347 +++++++++++----------
 ... => AlgorithmPolicyConfigurationCriterion.java} |  22 +-
 .../BasicAlgorithmPolicyConfigurationTest.java     | 140 +++++++++
 .../BasicDecryptionParametersResolverTest.java     |  29 +-
 .../BasicEncryptionParametersResolverTest.java     | 251 +++++++--------
 ...asicSignatureSigningParametersResolverTest.java | 305 +++++++++---------
 ...cSignatureValidationParametersResolverTest.java |  49 +--
 .../BasicWhitelistBlacklistConfigurationTest.java  |  65 ++--
 ...t.java => ExcludedAlgorithmsPredicateTest.java} |  10 +-
 ...t.java => IncludedAlgorithmsPredicateTest.java} |  10 +-
 .../xmlsec/keyinfo/KeyInfoSupportTest.java         |   1 -
 .../keyinfo/impl/BasicKeyInfoGeneratorTest.java    |   1 -
 .../xmlsec/keyinfo/impl/CertChainX509DataTest.java |   2 -
 .../xmlsec/keyinfo/impl/DSAKeyValueTest.java       |   2 -
 .../keyinfo/impl/KeyInfoGeneratorManagerTest.java  |   2 -
 .../impl/LocalKeyInfoCredentialResolverTest.java   |   2 -
 .../impl/NamedKeyInfoGeneratorManagerTest.java     |   2 -
 .../xmlsec/keyinfo/impl/RSAKeyValueTest.java       |   2 -
 .../keyinfo/impl/SingleCertX509DataTest.java       |   2 -
 .../keyinfo/impl/StaticKeyInfoGeneratorTest.java   |   1 -
 .../keyinfo/impl/X509KeyInfoGeneratorTest.java     |   1 -
 .../impl/ExplicitKeySignatureTrustEngineTest.java  |  10 +-
 .../support/impl/PKIXSignatureTrustEngineTest.java |  10 +-
 95 files changed, 1120 insertions(+), 1095 deletions(-)

diff --git a/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuerTest.java b/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuerTest.java
index a8a7fac21..29ba64543 100644
--- a/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuerTest.java
+++ b/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckExpectedIssuerTest.java
@@ -19,7 +19,6 @@ package org.opensaml.messaging.handler.impl;
 
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.messaging.handler.impl.CheckMandatoryIssuer;
 import org.testng.annotations.Test;
 
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
diff --git a/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckMandatoryIssuerTest.java b/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckMandatoryIssuerTest.java
index 910b7fa28..35c8936ab 100644
--- a/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckMandatoryIssuerTest.java
+++ b/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/CheckMandatoryIssuerTest.java
@@ -19,7 +19,6 @@ package org.opensaml.messaging.handler.impl;
 
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.messaging.handler.impl.CheckMandatoryIssuer;
 import org.testng.annotations.Test;
 
 import net.shibboleth.utilities.java.support.logic.FunctionSupport;
diff --git a/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/SchemaValidateXMLMessageTest.java b/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/SchemaValidateXMLMessageTest.java
index fae9fded0..d8ead529a 100644
--- a/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/SchemaValidateXMLMessageTest.java
+++ b/opensaml-messaging-impl/src/test/java/org/opensaml/messaging/handler/impl/SchemaValidateXMLMessageTest.java
@@ -21,8 +21,6 @@ import javax.xml.validation.Schema;
 
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.messaging.handler.impl.SchemaValidateXMLMessage;
-
 import net.shibboleth.utilities.java.support.xml.SchemaBuilder;
 
 import org.opensaml.core.xml.XMLObject;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/CheckMessageVersionHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/CheckMessageVersionHandlerTest.java
index 358aca9d0..d8ef7d680 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/CheckMessageVersionHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/CheckMessageVersionHandlerTest.java
@@ -23,7 +23,6 @@ import org.opensaml.core.OpenSAMLInitBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.SAMLVersion;
-import org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler;
 import org.opensaml.saml.saml1.core.RequestAbstractType;
 import org.opensaml.saml.saml1.profile.SAML1ActionTestingSupport;
 import org.opensaml.saml.saml2.core.AttributeQuery;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLOutboundDestinationHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLOutboundDestinationHandlerTest.java
index fd73cf5d5..ba9800edf 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLOutboundDestinationHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/impl/SAMLOutboundDestinationHandlerTest.java
@@ -21,7 +21,6 @@ import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.SAMLObjectBuilder;
-import org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler;
 import org.opensaml.saml.common.messaging.context.SAMLEndpointContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.saml2.core.AuthnRequest;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/EndpointURLSchemeSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/EndpointURLSchemeSecurityHandlerTest.java
index 30fb3da13..3c19b1a6e 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/EndpointURLSchemeSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/EndpointURLSchemeSecurityHandlerTest.java
@@ -20,7 +20,6 @@ package org.opensaml.saml.common.binding.security.impl;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler;
 import org.opensaml.saml.common.messaging.context.SAMLEndpointContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.saml2.core.AuthnRequest;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageLifetimeSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageLifetimeSecurityHandlerTest.java
index f4d7a57df..d28e6e14e 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageLifetimeSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageLifetimeSecurityHandlerTest.java
@@ -23,7 +23,6 @@ import java.time.Instant;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler;
 import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandlerTest.java
index 15a561688..b5a85bb63 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/MessageReplaySecurityHandlerTest.java
@@ -24,7 +24,6 @@ import java.time.Duration;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
-import org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler;
 import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.storage.ReplayCache;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandlerTest.java
index c5e6ad485..e851b5470 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandlerTest.java
@@ -27,7 +27,6 @@ import org.opensaml.messaging.MessageException;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler;
 import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
 import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.core.AuthnRequest;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
index ab1631b1c..2abe07ff1 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
@@ -179,7 +179,7 @@ public class SAMLProtocolMessageXMLSignatureSecurityHandlerTest extends XMLObjec
      */
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testBlacklistedSigntureAlgorithm() throws MessageHandlerException {
-        sigValParams.setBlacklistedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigValParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         
         trustedCredentials.add(signingX509Cred);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddAudienceRestrictionToAssertionsTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddAudienceRestrictionToAssertionsTest.java
index 3f7a5edf5..1e9016466 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddAudienceRestrictionToAssertionsTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddAudienceRestrictionToAssertionsTest.java
@@ -27,7 +27,6 @@ import org.opensaml.profile.action.ActionTestingSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.common.SAMLObjectBuilder;
-import org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions;
 import org.opensaml.saml.saml1.core.Assertion;
 import org.opensaml.saml.saml1.core.AudienceRestrictionCondition;
 import org.opensaml.saml.saml1.core.Conditions;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddNotOnOrAfterConditionToAssertionsTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddNotOnOrAfterConditionToAssertionsTest.java
index 4c395629c..678d63436 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddNotOnOrAfterConditionToAssertionsTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/impl/AddNotOnOrAfterConditionToAssertionsTest.java
@@ -29,7 +29,6 @@ import org.opensaml.profile.action.ActionTestingSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.common.SAMLObjectBuilder;
-import org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions;
 import org.opensaml.saml.saml1.core.Assertion;
 import org.opensaml.saml.saml1.core.Conditions;
 import org.opensaml.saml.saml1.core.Response;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/ext/idpdisco/impl/DiscoveryResponseTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/ext/idpdisco/impl/DiscoveryResponseTest.java
index 34e207da6..321a8634a 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/ext/idpdisco/impl/DiscoveryResponseTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/ext/idpdisco/impl/DiscoveryResponseTest.java
@@ -23,7 +23,6 @@ import org.testng.Assert;
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.core.xml.XMLObjectProviderBaseTestCase;
 import org.opensaml.saml.ext.idpdisco.DiscoveryResponse;
-import org.opensaml.saml.ext.idpdisco.impl.DiscoveryResponseImpl;
 
 /**
  * Test case for creating, marshalling, and unmarshalling {@link DiscoveryResponseImpl}.
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilterTest.java
index 83da3b01d..5e43aaf05 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilterTest.java
@@ -29,8 +29,6 @@ import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.metadata.resolver.MetadataResolver;
-import org.opensaml.saml.metadata.resolver.filter.impl.ByReferenceMetadataFilter;
-import org.opensaml.saml.metadata.resolver.filter.impl.NameIDFormatFilter;
 import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
 import org.opensaml.saml.saml2.core.NameIDType;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
index 345143967..f8b73f3de 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
@@ -138,7 +138,7 @@ public class SignatureValidationFilterExplicitKeyTest extends XMLObjectBaseTestC
         SignatureValidationFilter filter = new SignatureValidationFilter(switchSigTrustEngine);
         
         SignatureValidationParameters sigParams = new SignatureValidationParameters();
-        sigParams.setBlacklistedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         CriteriaSet defaultCriteriaSet = new CriteriaSet(new SignatureValidationParametersCriterion(sigParams));
         filter.setDefaultCriteria(defaultCriteriaSet);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
index 9569f5cc5..584ec4ee0 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
@@ -94,8 +94,7 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
     /**
      * Tests the basic success case.
      * 
-     * @throws ComponentInitializationException ...
-     * @throws ResolverException ...
+     * @throws Exception ...
      */
     @Test
     public void testGetEntityDescriptor() throws Exception {
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStoreTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStoreTest.java
index 980f01383..ee2bc5403 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStoreTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStoreTest.java
@@ -23,7 +23,6 @@ import org.opensaml.core.OpenSAMLInitBaseTestCase;
 import org.opensaml.core.xml.util.XMLObjectSupport;
 import org.opensaml.saml.metadata.resolver.index.MetadataIndexKey;
 import org.opensaml.saml.metadata.resolver.index.SimpleStringMetadataIndexKey;
-import org.opensaml.saml.metadata.resolver.index.impl.MetadataIndexStore;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoderTest.java
index 91a76f5a2..09702a5ec 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoderTest.java
@@ -29,7 +29,6 @@ import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.decoder.MessageDecodingException;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.saml1.binding.decoding.impl.HTTPPostDecoder;
 import org.opensaml.saml.saml1.core.Response;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.testng.Assert;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11DecoderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11DecoderTest.java
index f91128437..ddff4f451 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11DecoderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPSOAP11DecoderTest.java
@@ -23,7 +23,6 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.saml1.binding.decoding.impl.HTTPSOAP11Decoder;
 import org.opensaml.saml.saml1.core.Request;
 import org.opensaml.soap.messaging.context.SOAP11Context;
 import org.springframework.mock.web.MockHttpServletRequest;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/ResponseTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/ResponseTest.java
index 085fa5ea6..1790810c9 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/ResponseTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/ResponseTest.java
@@ -27,7 +27,6 @@ import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
 import org.opensaml.core.xml.io.Unmarshaller;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
-import org.opensaml.saml.saml1.core.Response;
 import org.w3c.dom.Document;
 
 /**
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/AuthorizationDecisionStatementTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/AuthorizationDecisionStatementTest.java
index dae3e78f1..02a57e652 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/AuthorizationDecisionStatementTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/AuthorizationDecisionStatementTest.java
@@ -35,7 +35,6 @@ import org.opensaml.saml.saml1.core.AuthorizationDecisionStatement;
 import org.opensaml.saml.saml1.core.DecisionTypeEnumeration;
 import org.opensaml.saml.saml1.core.Evidence;
 import org.opensaml.saml.saml1.core.Subject;
-import org.opensaml.saml.saml1.core.impl.AuthorizationDecisionStatementUnmarshaller;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/EvidenceTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/EvidenceTest.java
index 017161339..ce7124ebb 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/EvidenceTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml1/core/impl/EvidenceTest.java
@@ -30,7 +30,6 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml1.core.Assertion;
 import org.opensaml.saml.saml1.core.AssertionIDReference;
 import org.opensaml.saml.saml1.core.Evidence;
-import org.opensaml.saml.saml1.core.impl.EvidenceImpl;
 
 /**
  * Test for {@link EvidenceImpl}
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoderTest.java
index 94becca65..d49017f99 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoderTest.java
@@ -21,7 +21,6 @@ import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.decoder.MessageDecodingException;
 import org.opensaml.saml.common.binding.SAMLBindingSupport;
-import org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder;
 import org.opensaml.saml.saml2.core.RequestAbstractType;
 import org.opensaml.saml.saml2.core.Response;
 import org.springframework.mock.web.MockHttpServletRequest;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPSOAP11DecoderTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPSOAP11DecoderTest.java
index 5a6e1e959..e0752e3e1 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPSOAP11DecoderTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPSOAP11DecoderTest.java
@@ -23,7 +23,6 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.io.MarshallingException;
 import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.saml.saml2.binding.decoding.impl.HTTPSOAP11Decoder;
 import org.opensaml.saml.saml2.core.Response;
 import org.opensaml.soap.messaging.context.SOAP11Context;
 import org.springframework.mock.web.MockHttpServletRequest;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/AddConsentToResponseHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/AddConsentToResponseHandlerTest.java
index 2860aaa40..6bb372f2b 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/AddConsentToResponseHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/AddConsentToResponseHandlerTest.java
@@ -23,7 +23,6 @@ import org.opensaml.core.OpenSAMLInitBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.messaging.context.SAMLConsentContext;
-import org.opensaml.saml.saml2.binding.impl.AddConsentToResponseHandler;
 import org.opensaml.saml.saml2.core.StatusResponseType;
 import org.opensaml.saml.saml2.profile.SAML2ActionTestingSupport;
 import org.testng.Assert;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/ExtractConsentFromRequestHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/ExtractConsentFromRequestHandlerTest.java
index b226f2510..7fb28d776 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/ExtractConsentFromRequestHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/impl/ExtractConsentFromRequestHandlerTest.java
@@ -23,7 +23,6 @@ import org.opensaml.core.OpenSAMLInitBaseTestCase;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.messaging.context.SAMLConsentContext;
-import org.opensaml.saml.saml2.binding.impl.ExtractConsentFromRequestHandler;
 import org.opensaml.saml.saml2.core.RequestAbstractType;
 import org.opensaml.saml.saml2.core.StatusResponseType;
 import org.opensaml.saml.saml2.profile.SAML2ActionTestingSupport;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandlerTest.java
index 31d5b75b0..9db93f970 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2AuthnRequestsSignedSecurityHandlerTest.java
@@ -23,7 +23,6 @@ import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
 import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
-import org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
 import org.testng.annotations.BeforeMethod;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
index bcd8e0017..48c904d1a 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
@@ -258,7 +258,7 @@ public class SAML2HTTPPostSimpleSignSecurityHandlerTest extends XMLObjectBaseTes
      */
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testBlacklistedSignatureAlgorithm() throws MessageHandlerException {
-        sigValParams.setBlacklistedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigValParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         
         trustedCredentials.add(signingX509Cred);
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
index de55737f9..123da3d4d 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
@@ -237,7 +237,7 @@ public class SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest extends XMLObj
      */
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testBlacklistedSignatureAlgorithm() throws MessageHandlerException {
-        sigValParams.setBlacklistedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigValParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         
         trustedCredentials.add(signingX509Cred);
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/AuthnRequestTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/AuthnRequestTest.java
index 5ed970dba..dbe72e47f 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/AuthnRequestTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/AuthnRequestTest.java
@@ -25,14 +25,6 @@ import java.time.Instant;
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.saml.common.BaseComplexSAMLObjectTestCase;
 import org.opensaml.saml.common.SAMLVersion;
-import org.opensaml.saml.saml2.core.Audience;
-import org.opensaml.saml.saml2.core.AudienceRestriction;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.RequestedAuthnContext;
-import org.opensaml.saml.saml2.core.Subject;
 
 /**
  * Tests unmarshalling and marshalling for various request messages.
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/ResponseSuccessAuthnAttribTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/ResponseSuccessAuthnAttribTest.java
index c19d8d085..f4517b560 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/ResponseSuccessAuthnAttribTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/ResponseSuccessAuthnAttribTest.java
@@ -26,23 +26,6 @@ import org.opensaml.core.xml.XMLObjectBuilder;
 import org.opensaml.core.xml.schema.XSString;
 import org.opensaml.saml.common.BaseComplexSAMLObjectTestCase;
 import org.opensaml.saml.common.SAMLVersion;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.Attribute;
-import org.opensaml.saml.saml2.core.AttributeStatement;
-import org.opensaml.saml.saml2.core.AttributeValue;
-import org.opensaml.saml.saml2.core.Audience;
-import org.opensaml.saml.saml2.core.AudienceRestriction;
-import org.opensaml.saml.saml2.core.AuthnContext;
-import org.opensaml.saml.saml2.core.AuthnContextClassRef;
-import org.opensaml.saml.saml2.core.AuthnStatement;
-import org.opensaml.saml.saml2.core.Conditions;
-import org.opensaml.saml.saml2.core.Issuer;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.core.Status;
-import org.opensaml.saml.saml2.core.StatusCode;
-import org.opensaml.saml.saml2.core.Subject;
-import org.opensaml.saml.saml2.core.SubjectConfirmation;
 
 /**
  * Tests unmarshalling and marshalling for various response messages.
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/SignedAssertionTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/SignedAssertionTest.java
index ee31df696..a76dfb35e 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/SignedAssertionTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/core/SignedAssertionTest.java
@@ -36,9 +36,6 @@ import org.opensaml.core.xml.XMLObjectBuilder;
 import org.opensaml.saml.common.SAMLObjectBuilder;
 import org.opensaml.saml.common.SAMLTestSupport;
 import org.opensaml.saml.common.SAMLVersion;
-import org.opensaml.saml.saml2.core.Assertion;
-import org.opensaml.saml.saml2.core.AuthnStatement;
-import org.opensaml.saml.saml2.core.Issuer;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.credential.CredentialSupport;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/ComplexEncryptionTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/ComplexEncryptionTest.java
index a0c36ebed..c7dbae71b 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/ComplexEncryptionTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/ComplexEncryptionTest.java
@@ -29,7 +29,6 @@ import org.opensaml.saml.saml2.core.Assertion;
 import org.opensaml.saml.saml2.core.Attribute;
 import org.opensaml.saml.saml2.core.EncryptedAssertion;
 import org.opensaml.saml.saml2.core.EncryptedAttribute;
-import org.opensaml.saml.saml2.encryption.Encrypter;
 import org.opensaml.saml.saml2.encryption.Encrypter.KeyPlacement;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/DecryptionPlusSigningTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/DecryptionPlusSigningTest.java
index b4f6c5099..cd75a19f1 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/DecryptionPlusSigningTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/DecryptionPlusSigningTest.java
@@ -37,8 +37,6 @@ import org.opensaml.saml.saml2.core.Assertion;
 import org.opensaml.saml.saml2.core.EncryptedAssertion;
 import org.opensaml.saml.saml2.core.Issuer;
 import org.opensaml.saml.saml2.core.Response;
-import org.opensaml.saml.saml2.encryption.Decrypter;
-import org.opensaml.saml.saml2.encryption.Encrypter;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolverTest.java
index 2aa2aca9a..fc311d310 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolverTest.java
@@ -28,7 +28,6 @@ import java.util.List;
 
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.saml.saml2.core.EncryptedAssertion;
-import org.opensaml.saml.saml2.encryption.EncryptedElementTypeEncryptedKeyResolver;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleDecryptionTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleDecryptionTest.java
index 39e3f8f45..1b54c52be 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleDecryptionTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleDecryptionTest.java
@@ -39,8 +39,6 @@ import org.opensaml.saml.saml2.core.EncryptedID;
 import org.opensaml.saml.saml2.core.NameID;
 import org.opensaml.saml.saml2.core.NewEncryptedID;
 import org.opensaml.saml.saml2.core.NewID;
-import org.opensaml.saml.saml2.encryption.Decrypter;
-import org.opensaml.saml.saml2.encryption.Encrypter;
 import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleEncryptionTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleEncryptionTest.java
index 7144982d9..d56194ed5 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleEncryptionTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/SimpleEncryptionTest.java
@@ -33,7 +33,6 @@ import org.opensaml.saml.saml2.core.EncryptedID;
 import org.opensaml.saml.saml2.core.NameID;
 import org.opensaml.saml.saml2.core.NewEncryptedID;
 import org.opensaml.saml.saml2.core.NewID;
-import org.opensaml.saml.saml2.encryption.Encrypter;
 import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
 import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
 import org.opensaml.xmlsec.encryption.support.EncryptionException;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java
index 1eb255f78..67fb7d176 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolverTest.java
@@ -24,10 +24,10 @@ import java.security.PublicKey;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 
 import javax.annotation.Nullable;
@@ -140,7 +140,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
         config3 = new BasicEncryptionConfiguration();
         
         // Set these as defaults on the last config in the chain, just so don't have to set in every test.
-        config3.setDataEncryptionAlgorithms(Arrays.asList(
+        config3.setDataEncryptionAlgorithms(List.of(
                 defaultAES128DataAlgo,
                 defaultAES192DataAlgo,
                 defaultAES256DataAlgo,
@@ -149,7 +149,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM,
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM
                 ));
-        config3.setKeyTransportEncryptionAlgorithms(Arrays.asList(
+        config3.setKeyTransportEncryptionAlgorithms(List.of(
                 defaultRSAKeyTransportAlgo, 
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15,
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11,
@@ -245,7 +245,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
     public void testWithBlacklist() throws ResolverException {
         roleDesc.getKeyDescriptors().add(buildKeyDescriptor(rsaCred1KeyName, UsageType.ENCRYPTION, rsaCred1.getPublicKey()));
         
-        config1.setBlacklistedAlgorithms(Arrays.asList(defaultRSAKeyTransportAlgo, defaultAES128DataAlgo, defaultAES192DataAlgo));
+        config1.setExcludedAlgorithms(List.of(defaultRSAKeyTransportAlgo, defaultAES128DataAlgo, defaultAES192DataAlgo));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -263,7 +263,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
     public void testWithWhitelist() throws ResolverException {
         roleDesc.getKeyDescriptors().add(buildKeyDescriptor(rsaCred1KeyName, UsageType.ENCRYPTION, rsaCred1.getPublicKey()));
         
-        config1.setWhitelistedAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
+        config1.setIncludedAlgorithms(List.of(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -468,7 +468,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
         keyDescriptor.getEncryptionMethods().add(buildEncryptionMethod(EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES));
         roleDesc.getKeyDescriptors().add(keyDescriptor);
         
-        config1.setBlacklistedAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES));
+        config1.setExcludedAlgorithms(List.of(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -489,7 +489,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
         keyDescriptor.getEncryptionMethods().add(buildEncryptionMethod(EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES));
         roleDesc.getKeyDescriptors().add(keyDescriptor);
         
-        config1.setWhitelistedAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192));
+        config1.setIncludedAlgorithms(List.of(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -526,7 +526,7 @@ public class SAMLMetadataEncryptionParametersResolverTest extends XMLObjectBaseT
         
         roleDesc.getKeyDescriptors().add(keyDescriptor);
         
-        config1.setBlacklistedAlgorithms(Arrays.asList(SignatureConstants.ALGO_ID_DIGEST_SHA1));
+        config1.setExcludedAlgorithms(List.of(SignatureConstants.ALGO_ID_DIGEST_SHA1));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
index ab7bbb31e..06c2ef125 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
@@ -21,8 +21,8 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
+import java.util.List;
 
 import javax.crypto.SecretKey;
 
@@ -121,7 +121,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
         config3 = new BasicSignatureSigningConfiguration();
         
         // Set these as defaults on the last config in the chain, just so don't have to set in every test.
-        config3.setSignatureAlgorithms(Arrays.asList(defaultRSAAlgo, defaultDSAAlgo, defaultECAlgo, defaultHMACAlgo));
+        config3.setSignatureAlgorithms(List.of(defaultRSAAlgo, defaultDSAAlgo, defaultECAlgo, defaultHMACAlgo));
         config3.setSignatureReferenceDigestMethods(Collections.singletonList(defaultReferenceDigest));
         config3.setSignatureCanonicalizationAlgorithm(defaultC14N);
         config3.setSignatureHMACOutputLength(defaultHMACOutputLength);
@@ -228,7 +228,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     public void testRSAWithSigningMethodBlacklisted() throws ResolverException {
         config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
         
-        config1.setBlacklistedAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5));
+        config1.setExcludedAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5));
         
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5, null, null));
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA1, null, null));
@@ -249,7 +249,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     public void testRSAWithDigestMethodBlacklisted() throws ResolverException {
         config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
         
-        config1.setBlacklistedAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5));
+        config1.setExcludedAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5));
         
         addRoleDescriptorExtension(roleDesc, buildDigestMethod(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5));
         
@@ -267,9 +267,9 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     @Test
     public void testECWithSigningMethodWhitelisted() throws ResolverException {
         if (ecCred != null) {
-            config1.setSigningCredentials(Arrays.asList(rsaCred2048, dsaCred, ecCred));
+            config1.setSigningCredentials(List.of(rsaCred2048, dsaCred, ecCred));
             
-            config1.setWhitelistedAlgorithms(Arrays.asList(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256, defaultReferenceDigest));
+            config1.setIncludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256, defaultReferenceDigest));
             
             addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512, null, null));
             addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, null, null));
@@ -289,7 +289,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testMultipleCredsWithSigningMethodSelection() throws ResolverException {
-        config1.setSigningCredentials(Arrays.asList(rsaCred2048, hmacCred, dsaCred));
+        config1.setSigningCredentials(List.of(rsaCred2048, hmacCred, dsaCred));
         
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA1, null, null));
         
@@ -306,7 +306,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testRSAMinKeyLength() throws ResolverException {
-        config1.setSigningCredentials(Arrays.asList(rsaCred1024, rsaCred2048, rsaCred4096));
+        config1.setSigningCredentials(List.of(rsaCred1024, rsaCred2048, rsaCred4096));
         
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, 4096, null));
         
@@ -323,7 +323,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testRSAMaxKeyLength() throws ResolverException {
-        config1.setSigningCredentials(Arrays.asList(rsaCred4096, rsaCred2048, rsaCred1024));
+        config1.setSigningCredentials(List.of(rsaCred4096, rsaCred2048, rsaCred1024));
         
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, null, 1024));
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidatorTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidatorTest.java
index 41c7aa224..ef2dbc77d 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidatorTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidatorTest.java
@@ -22,7 +22,6 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.Assert;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.saml.common.SignableSAMLObject;
-import org.opensaml.saml.security.impl.SAMLSignatureProfileValidator;
 import org.opensaml.xmlsec.signature.Signature;
 import org.opensaml.xmlsec.signature.impl.SignatureImpl;
 import org.opensaml.xmlsec.signature.support.SignatureException;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java
similarity index 61%
copy from opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java
copy to opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java
index 188d8f187..421eb8968 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyConfiguration.java
@@ -26,54 +26,55 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 
 /**
- * Algorithm URI whitelist and blacklist configuration.
+ * Algorithm URI include/exclude policy configuration.
  */
-public interface WhitelistBlacklistConfiguration {
+public interface AlgorithmPolicyConfiguration {
     
-    /** Whitelist/blacklist precedence values. */
+    /** Rule precedence values. */
     public enum Precedence {
-        /** Whitelist takes precedence over blacklist. */
-        WHITELIST,
+        /** Include takes precedence over exclude. */
+        INCLUDE,
         
-        /** Blacklist takes precedence over whitelist. */
-        BLACKLIST
+        /** Exclude takes precedence over include. */
+        EXCLUDE
     }
     
     /**
-     * Get the list of whitelisted algorithm URI's.
+     * Get the collection of included algorithm URIs.
      * 
-     * @return the list of algorithms
+     * @return the collection of algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getWhitelistedAlgorithms();
+    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getIncludedAlgorithms();
     
     /**
-     * Flag indicating whether to merge this configuration's whitelist with one of a lower order of precedence,
-     * or to treat this whitelist as authoritative.
+     * Flag indicating whether to merge this configuration's includes with one of a lower order of precedence,
+     * or to treat this include collection as authoritative.
      * 
      * @return true if should merge, false otherwise
      */
-    public boolean isWhitelistMerge();
+    public boolean isIncludeMerge();
     
     /**
-     * Get the list of blacklisted algorithm URI's.
+     * Get the collection of excluded algorithm URIs.
      * 
-     * @return the list of algorithms
+     * @return the collection of algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getBlacklistedAlgorithms();
+    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getExcludedAlgorithms();
     
     /**
-     * Flag indicating whether to merge this configuration's blacklist with one of a lower order of precedence,
-     * or to treat this blacklist as authoritative.
+     * Flag indicating whether to merge this configuration's excludes with one of a lower order of precedence,
+     * or to treat this exclude collection as authoritative.
      * 
      * @return true if should merge, false otherwise
      */
-    public boolean isBlacklistMerge();
+    public boolean isExcludeMerge();
     
     /**
-     * Get preference value indicating which should take precedence when both whitelist and blacklist are non-empty.
+     * Get preference value indicating which should take precedence when both include and exclude collections
+     * are non-empty.
      * 
      * @return the configured precedence value.
      */
-    @Nonnull public Precedence getWhitelistBlacklistPrecedence();
+    @Nonnull public Precedence getIncludeExcludePrecedence();
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java
similarity index 51%
copy from opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java
copy to opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java
index 334981005..481e8a88f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/AlgorithmPolicyParameters.java
@@ -19,7 +19,7 @@ package org.opensaml.xmlsec;
 
 import java.util.Collection;
 import java.util.Collections;
-import java.util.HashSet;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -29,67 +29,65 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
-import com.google.common.collect.ImmutableSet;
-
 /**
- * The whitelist and blacklist algorithm parameters.
+ * The algorithm policy parameters.
  */
-public class WhitelistBlacklistParameters {
+public class AlgorithmPolicyParameters {
     
-    /** Whitelisted algorithm URIs. */
-    @Nonnull @NonnullElements private Collection<String> whiteListedAlgorithmURIs;
+    /** Included algorithm URIs. */
+    @Nonnull @NonnullElements private Collection<String> includedAlgorithmURIs;
     
-    /** Blacklisted algorithm URIs. */
-    @Nonnull @NonnullElements private Collection<String> blackListedAlgorithmURIs;
+    /** Excluded algorithm URIs. */
+    @Nonnull @NonnullElements private Collection<String> excludedAlgorithmURIs;
         
     /** Constructor. */
-    public WhitelistBlacklistParameters() {
-        whiteListedAlgorithmURIs = Collections.emptySet();
-        blackListedAlgorithmURIs = Collections.emptySet();
+    public AlgorithmPolicyParameters() {
+        includedAlgorithmURIs = Collections.emptySet();
+        excludedAlgorithmURIs = Collections.emptySet();
     }
     
     /**
-     * Get the list of whitelisted algorithm URI's.
+     * Get the included algorithm URIs.
      * 
-     * @return the list of algorithms
+     * @return the included algorithms
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getWhitelistedAlgorithms() {
-        return ImmutableSet.copyOf(whiteListedAlgorithmURIs);
+    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getIncludedAlgorithms() {
+        return includedAlgorithmURIs;
     }
     
     /**
-     * Set the list of whitelisted algorithm URI's.
+     * Set the included algorithm URIs.
      * 
-     * @param uris the list of algorithms
+     * @param uris the included algorithms
      */
-    public void setWhitelistedAlgorithms(@Nullable final Collection<String> uris) {
+    public void setIncludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
-            whiteListedAlgorithmURIs = Collections.emptySet();
+            includedAlgorithmURIs = Collections.emptySet();
             return;
         }
-        whiteListedAlgorithmURIs = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+        includedAlgorithmURIs = Set.copyOf(StringSupport.normalizeStringCollection(uris));
     }
     
     /**
-     * Get the list of blacklisted algorithm URI's.
+     * Get the excluded algorithm URIs.
      * 
-     * @return the list of algorithms
+     * @return the excluded algorithms
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getBlacklistedAlgorithms() {
-        return ImmutableSet.copyOf(blackListedAlgorithmURIs);
+    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getExcludedAlgorithms() {
+        return excludedAlgorithmURIs;
     }
     
     /**
-     * Set the list of blacklisted algorithm URI's.
+     * Set the excluded algorithm URIs.
      * 
-     * @param uris the list of algorithms
+     * @param uris the excluded algorithms
      */
-    public void setBlacklistedAlgorithms(@Nonnull @NonnullElements final Collection<String> uris) {
+    public void setExcludedAlgorithms(@Nonnull @NonnullElements final Collection<String> uris) {
         if (uris == null) {
-            blackListedAlgorithmURIs = Collections.emptySet();
+            excludedAlgorithmURIs = Collections.emptySet();
             return;
         }
-        blackListedAlgorithmURIs = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+        excludedAlgorithmURIs = Set.copyOf(StringSupport.normalizeStringCollection(uris));
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionConfiguration.java
index 6a52d3842..26af52d9f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionConfiguration.java
@@ -25,6 +25,7 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 /**
  * The configuration information to use when decrypting encrypted XML.
  */
+ at SuppressWarnings("removal")
 public interface DecryptionConfiguration extends WhitelistBlacklistConfiguration {
     
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionParameters.java
index cbc18285c..402a86d0d 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/DecryptionParameters.java
@@ -25,6 +25,7 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 /**
  * The effective parameters to use when decrypting encrypted XML.
  */
+ at SuppressWarnings("removal")
 public class DecryptionParameters extends WhitelistBlacklistParameters {
     
     /** The EncryptedData's KeyInfo credential resolver. */
@@ -36,11 +37,6 @@ public class DecryptionParameters extends WhitelistBlacklistParameters {
     /** The EncryptedKey resolver. */
     @Nullable private EncryptedKeyResolver encryptedKeyResolver;
         
-    /** Constructor. */
-    public DecryptionParameters() {
-        super();
-    }
-    
     /**
      * Get the KeyInfoCredentialResolver to use when processing the EncryptedData/KeyInfo.
      * 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java
index e78b0198b..1d0f295c4 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/EncryptionConfiguration.java
@@ -34,6 +34,7 @@ import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 /**
  * The configuration information to use when generating encrypted XML.
  */
+ at SuppressWarnings("removal")
 public interface EncryptionConfiguration extends WhitelistBlacklistConfiguration {
     
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java
index 0277f2d96..dd350da44 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureSigningConfiguration.java
@@ -33,6 +33,7 @@ import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 /**
  * The configuration information to use when generating an XML signature.
  */
+ at SuppressWarnings("removal")
 public interface SignatureSigningConfiguration extends WhitelistBlacklistConfiguration {
     
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationConfiguration.java
index 59e99b06e..1f7f5daa0 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationConfiguration.java
@@ -24,6 +24,7 @@ import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 /**
  * The configuration information to use when validating an XML signature.
  */
+ at SuppressWarnings("removal")
 public interface SignatureValidationConfiguration extends WhitelistBlacklistConfiguration {
     
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationParameters.java
index ae5b1a87b..40f79efd0 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/SignatureValidationParameters.java
@@ -24,16 +24,12 @@ import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 /**
  * The effective parameters to use when validating an XML signature.
  */
+ at SuppressWarnings("removal")
 public class SignatureValidationParameters extends WhitelistBlacklistParameters {
     
     /** The signature trust engine to use. */
     @Nullable private SignatureTrustEngine signatureTrustEngine;
     
-    /** Constructor. */
-    public SignatureValidationParameters() {
-        super();
-    }
-    
     /**
      * Get the signature trust engine to use.
      * 
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java
index 188d8f187..4bf1acbd5 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistConfiguration.java
@@ -26,10 +26,15 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 
 /**
- * Algorithm URI whitelist and blacklist configuration.
+ * Algorithm URI include/exclude policy configuration.
+ * 
+ * <p>Replace with {@link AlgorithmPolicyConfiguration}.</p> 
+ * 
+ * @deprecated
  */
-public interface WhitelistBlacklistConfiguration {
-    
+ at Deprecated(forRemoval=true, since="4.1.0")
+public interface WhitelistBlacklistConfiguration extends AlgorithmPolicyConfiguration {
+
     /** Whitelist/blacklist precedence values. */
     public enum Precedence {
         /** Whitelist takes precedence over blacklist. */
@@ -38,13 +43,13 @@ public interface WhitelistBlacklistConfiguration {
         /** Blacklist takes precedence over whitelist. */
         BLACKLIST
     }
-    
+
     /**
-     * Get the list of whitelisted algorithm URI's.
+     * Get the list of whitelisted algorithm URIs.
      * 
      * @return the list of algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getWhitelistedAlgorithms();
+    @Nonnull @NonnullElements @Unmodifiable @NotLive Collection<String> getWhitelistedAlgorithms();
     
     /**
      * Flag indicating whether to merge this configuration's whitelist with one of a lower order of precedence,
@@ -52,14 +57,14 @@ public interface WhitelistBlacklistConfiguration {
      * 
      * @return true if should merge, false otherwise
      */
-    public boolean isWhitelistMerge();
+    boolean isWhitelistMerge();
     
     /**
-     * Get the list of blacklisted algorithm URI's.
+     * Get the list of blacklisted algorithm URIs.
      * 
      * @return the list of algorithms
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getBlacklistedAlgorithms();
+    @Nonnull @NonnullElements @Unmodifiable @NotLive Collection<String> getBlacklistedAlgorithms();
     
     /**
      * Flag indicating whether to merge this configuration's blacklist with one of a lower order of precedence,
@@ -67,13 +72,13 @@ public interface WhitelistBlacklistConfiguration {
      * 
      * @return true if should merge, false otherwise
      */
-    public boolean isBlacklistMerge();
+    boolean isBlacklistMerge();
     
     /**
      * Get preference value indicating which should take precedence when both whitelist and blacklist are non-empty.
      * 
      * @return the configured precedence value.
      */
-    @Nonnull public Precedence getWhitelistBlacklistPrecedence();
+    @Nonnull Precedence getWhitelistBlacklistPrecedence();
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java
index 334981005..de19330a9 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/WhitelistBlacklistParameters.java
@@ -18,8 +18,6 @@
 package org.opensaml.xmlsec;
 
 import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -27,26 +25,18 @@ import javax.annotation.Nullable;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import com.google.common.collect.ImmutableSet;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 
 /**
  * The whitelist and blacklist algorithm parameters.
+ * 
+ * <p>Replace with {@link AlgorithmPolicyParameters}.
+ * 
+ * @deprecated
  */
-public class WhitelistBlacklistParameters {
-    
-    /** Whitelisted algorithm URIs. */
-    @Nonnull @NonnullElements private Collection<String> whiteListedAlgorithmURIs;
-    
-    /** Blacklisted algorithm URIs. */
-    @Nonnull @NonnullElements private Collection<String> blackListedAlgorithmURIs;
-        
-    /** Constructor. */
-    public WhitelistBlacklistParameters() {
-        whiteListedAlgorithmURIs = Collections.emptySet();
-        blackListedAlgorithmURIs = Collections.emptySet();
-    }
+ at Deprecated(forRemoval=true, since="4.1.0")
+public class WhitelistBlacklistParameters extends AlgorithmPolicyParameters {
     
     /**
      * Get the list of whitelisted algorithm URI's.
@@ -54,7 +44,8 @@ public class WhitelistBlacklistParameters {
      * @return the list of algorithms
      */
     @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getWhitelistedAlgorithms() {
-        return ImmutableSet.copyOf(whiteListedAlgorithmURIs);
+        DeprecationSupport.warn(ObjectType.METHOD, "getWhitelistedAlgorithms", null, "getIncludedAlgorithms");
+        return getIncludedAlgorithms();
     }
     
     /**
@@ -63,11 +54,8 @@ public class WhitelistBlacklistParameters {
      * @param uris the list of algorithms
      */
     public void setWhitelistedAlgorithms(@Nullable final Collection<String> uris) {
-        if (uris == null) {
-            whiteListedAlgorithmURIs = Collections.emptySet();
-            return;
-        }
-        whiteListedAlgorithmURIs = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+        DeprecationSupport.warn(ObjectType.METHOD, "setWhitelistedAlgorithms", null, "setIncludedAlgorithms");
+        setIncludedAlgorithms(uris);
     }
     
     /**
@@ -76,7 +64,8 @@ public class WhitelistBlacklistParameters {
      * @return the list of algorithms
      */
     @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getBlacklistedAlgorithms() {
-        return ImmutableSet.copyOf(blackListedAlgorithmURIs);
+        DeprecationSupport.warn(ObjectType.METHOD, "getBlacklistedAlgorithms", null, "getExcludedAlgorithms");
+        return getExcludedAlgorithms();
     }
     
     /**
@@ -85,11 +74,8 @@ public class WhitelistBlacklistParameters {
      * @param uris the list of algorithms
      */
     public void setBlacklistedAlgorithms(@Nonnull @NonnullElements final Collection<String> uris) {
-        if (uris == null) {
-            blackListedAlgorithmURIs = Collections.emptySet();
-            return;
-        }
-        blackListedAlgorithmURIs = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+        DeprecationSupport.warn(ObjectType.METHOD, "setBlacklistedAlgorithms", null, "setExcludedAlgorithms");
+        setExcludedAlgorithms(uris);
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java
index a2664685c..cd57da193 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java
@@ -393,42 +393,42 @@ public final class AlgorithmSupport {
     }
     
     /**
-     * Validate the supplied algorithm URI against the specified whitelist and blacklist.
+     * Validate the supplied algorithm URI against the specified includes and excludes.
      * 
      * @param algorithmURI the algorithm URI to evaluate
-     * @param whitelistedAlgorithmURIs the algorithm whitelist
-     * @param blacklistedAlgorithmURIs the algorithm blacklist
+     * @param includedAlgorithmURIs the algorithm include list
+     * @param excludedAlgorithmURIs the algorithm exclude list
      * 
-     * @return true if algorithm URI satisfies the specified whitelist and blacklist, otherwise false
+     * @return true if algorithm URI satisfies the specified includes and excludes, otherwise false
      */
     public static boolean validateAlgorithmURI(@Nonnull final String algorithmURI, 
-            @Nullable final Collection<String> whitelistedAlgorithmURIs,
-            @Nullable final Collection<String> blacklistedAlgorithmURIs) {
+            @Nullable final Collection<String> includedAlgorithmURIs,
+            @Nullable final Collection<String> excludedAlgorithmURIs) {
         
-        if (blacklistedAlgorithmURIs != null) {
-            LOG.debug("Saw non-null algorithm blacklist: {}", blacklistedAlgorithmURIs);
-            if (blacklistedAlgorithmURIs.contains(algorithmURI)) {
-                LOG.warn("Algorithm failed blacklist validation: {}", algorithmURI);
+        if (excludedAlgorithmURIs != null) {
+            LOG.debug("Saw non-null algorithm exclude list: {}", excludedAlgorithmURIs);
+            if (excludedAlgorithmURIs.contains(algorithmURI)) {
+                LOG.warn("Algorithm failed exclude list validation: {}", algorithmURI);
                 return false;
             }
-            LOG.debug("Algorithm passed blacklist validation: {}", algorithmURI);
+            LOG.debug("Algorithm passed exclude list validation: {}", algorithmURI);
         } else {
-            LOG.debug("Saw null algorithm blacklist, nothing to evaluate");
+            LOG.debug("Saw null algorithm exclude list, nothing to evaluate");
         }
         
-        if (whitelistedAlgorithmURIs != null) {
-            LOG.debug("Saw non-null algorithm whitelist: {}", whitelistedAlgorithmURIs);
-            if (!whitelistedAlgorithmURIs.isEmpty()) {
-                if (!whitelistedAlgorithmURIs.contains(algorithmURI)) {
-                    LOG.warn("Algorithm failed whitelist validation: {}", algorithmURI);
+        if (includedAlgorithmURIs != null) {
+            LOG.debug("Saw non-null algorithm include list: {}", includedAlgorithmURIs);
+            if (!includedAlgorithmURIs.isEmpty()) {
+                if (!includedAlgorithmURIs.contains(algorithmURI)) {
+                    LOG.warn("Algorithm failed include list validation: {}", algorithmURI);
                     return false;
                 }
-                LOG.debug("Algorithm passed whitelist validation: {}", algorithmURI);
+                LOG.debug("Algorithm passed include list validation: {}", algorithmURI);
             } else {
-               LOG.debug("Non-null algorithm whitelist was empty, skipping evaluation");
+               LOG.debug("Non-null algorithm include list was empty, skipping evaluation");
             }
         } else {
-            LOG.debug("Saw null algorithm whitelist, nothing to evaluate");
+            LOG.debug("Saw null algorithm include list, nothing to evaluate");
         }
         
         return true;
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
index 08a0355a8..22868f7da 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Decrypter.java
@@ -203,11 +203,11 @@ public class Decrypter {
     /** Resolver for EncryptedKey instances which contain the encrypted data encryption key. */
     private EncryptedKeyResolver encKeyResolver;
     
-    /** The collection of algorithm URI's which are whitelisted. */
-    private Collection<String> whitelistedAlgorithmURIs;
+    /** The collection of algorithm URIs which are included. */
+    private Collection<String> includedAlgorithmURIs;
     
-    /** The collection of algorithm URI's which are blacklisted. */
-    private Collection<String> blacklistedAlgorithmURIs;
+    /** The collection of algorithm URIs which are excluded. */
+    private Collection<String> excludedAlgorithmURIs;
 
     /** Additional criteria to use when resolving credentials based on an EncryptedData's KeyInfo. */
     private CriteriaSet resolverCriteria;
@@ -228,11 +228,11 @@ public class Decrypter {
      * @param params decryption parameters to use
      */
     public Decrypter(final DecryptionParameters params) {
-        this(   params.getDataKeyInfoCredentialResolver(), 
+        this(   params.getDataKeyInfoCredentialResolver(),
                 params.getKEKKeyInfoCredentialResolver(),
                 params.getEncryptedKeyResolver(),
-                params.getWhitelistedAlgorithms(),
-                params.getBlacklistedAlgorithms()
+                params.getIncludedAlgorithms(),
+                params.getExcludedAlgorithms()
                 );
     }
     
@@ -256,22 +256,22 @@ public class Decrypter {
      * @param newResolver resolver for data encryption keys.
      * @param newKEKResolver resolver for key encryption keys.
      * @param newEncKeyResolver resolver for EncryptedKey elements
-     * @param whitelistAlgos collection of whitelisted algorithm URIs
-     * @param blacklistAlgos collection of blacklisted algorithm URIs
+     * @param includeAlgos collection of included algorithm URIs
+     * @param excludeAlgos collection of excluded algorithm URIs
      */
     public Decrypter(@Nullable final KeyInfoCredentialResolver newResolver,
             @Nullable final KeyInfoCredentialResolver newKEKResolver,
             @Nullable final EncryptedKeyResolver newEncKeyResolver,
-            @Nullable final Collection<String> whitelistAlgos,
-            @Nullable final Collection<String> blacklistAlgos) {
+            @Nullable final Collection<String> includeAlgos,
+            @Nullable final Collection<String> excludeAlgos) {
         
         this();
         
         resolver = newResolver;
         kekResolver = newKEKResolver;
         encKeyResolver = newEncKeyResolver;
-        whitelistedAlgorithmURIs = whitelistAlgos;
-        blacklistedAlgorithmURIs = blacklistAlgos;
+        includedAlgorithmURIs = includeAlgos;
+        excludedAlgorithmURIs = excludeAlgos;
     }
     
     /**
@@ -1042,9 +1042,9 @@ public class Decrypter {
     protected void validateAlgorithmURI(@Nonnull final String algorithmURI) throws DecryptionException {
         log.debug("Validating algorithm URI against whitelist and blacklist: "
                 + "algorithm: {}, whitelist: {}, blacklist: {}",
-                algorithmURI, whitelistedAlgorithmURIs, blacklistedAlgorithmURIs);
+                algorithmURI, includedAlgorithmURIs, excludedAlgorithmURIs);
         
-        if (!AlgorithmSupport.validateAlgorithmURI(algorithmURI, whitelistedAlgorithmURIs, blacklistedAlgorithmURIs)) {
+        if (!AlgorithmSupport.validateAlgorithmURI(algorithmURI, includedAlgorithmURIs, excludedAlgorithmURIs)) {
             throw new DecryptionException("Algorithm failed whitelist/blacklist validation: " + algorithmURI);
         }
         
diff --git a/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/crypto/XMLSigningUtilTest.java b/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/crypto/XMLSigningUtilTest.java
index f5b143c9c..1327bb706 100644
--- a/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/crypto/XMLSigningUtilTest.java
+++ b/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/crypto/XMLSigningUtilTest.java
@@ -37,7 +37,6 @@ import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
 import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.xmlsec.crypto.XMLSigningUtil;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
 
 /**
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
index b21287ff7..991b6ebd2 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.config.impl;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 
@@ -66,11 +65,11 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicEncryptionConfiguration buildDefaultEncryptionConfiguration() {
         final BasicEncryptionConfiguration config = new BasicEncryptionConfiguration();
         
-        config.setBlacklistedAlgorithms(Collections.singletonList(
+        config.setExcludedAlgorithms(Collections.singletonList(
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15
                 ));
         
-        config.setDataEncryptionAlgorithms(Arrays.asList(
+        config.setDataEncryptionAlgorithms(List.of(
                 // The order of these is significant.
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192,
@@ -78,7 +77,7 @@ public class DefaultSecurityConfigurationBootstrap {
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES
                 ));
         
-        config.setKeyTransportEncryptionAlgorithms(Arrays.asList(
+        config.setKeyTransportEncryptionAlgorithms(List.of(
                 // The order of the RSA algos is significant.
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP,
                 
@@ -111,7 +110,7 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicDecryptionConfiguration buildDefaultDecryptionConfiguration() {
         final BasicDecryptionConfiguration config = new BasicDecryptionConfiguration();
         
-        config.setBlacklistedAlgorithms(Collections.singletonList(
+        config.setExcludedAlgorithms(Collections.singletonList(
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15
                 ));
         
@@ -128,13 +127,13 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicSignatureSigningConfiguration buildDefaultSignatureSigningConfiguration() {
         final BasicSignatureSigningConfiguration config = new BasicSignatureSigningConfiguration();
         
-        config.setBlacklistedAlgorithms(Arrays.asList(
+        config.setExcludedAlgorithms(List.of(
                 SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5,
                 SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5,
                 SignatureConstants.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5
                 ));
         
-        config.setSignatureAlgorithms(Arrays.asList(
+        config.setSignatureAlgorithms(List.of(
                 // The order within each key group is significant.
                 // The order of the key groups themselves is not significant.
                 
@@ -160,7 +159,7 @@ public class DefaultSecurityConfigurationBootstrap {
                 SignatureConstants.ALGO_ID_MAC_HMAC_SHA1
                 ));
         
-        config.setSignatureReferenceDigestMethods(Arrays.asList(
+        config.setSignatureReferenceDigestMethods(List.of(
                 // The order of these is significant.
                 SignatureConstants.ALGO_ID_DIGEST_SHA256,
                 SignatureConstants.ALGO_ID_DIGEST_SHA384,
@@ -183,7 +182,7 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicSignatureValidationConfiguration buildDefaultSignatureValidationConfiguration() {
         final BasicSignatureValidationConfiguration config = new BasicSignatureValidationConfiguration();
         
-        config.setBlacklistedAlgorithms(Arrays.asList(
+        config.setExcludedAlgorithms(List.of(
                 SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5,
                 SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5,
                 SignatureConstants.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
index 385b5e696..f0068274a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolver.java
@@ -34,9 +34,9 @@ import net.shibboleth.utilities.java.support.resolver.Resolver;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration;
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration.Precedence;
-import org.opensaml.xmlsec.WhitelistBlacklistParameters;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration.Precedence;
+import org.opensaml.xmlsec.AlgorithmPolicyParameters;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
@@ -87,126 +87,124 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
         return KeyInfoSupport.getKeyInfoGenerator(credential, manager, keyInfoProfileName);
     }
     
-// Checkstyle: ReturnCount OFF    
     /**
-     * Resolve and populate the effective whitelist or blacklist on the supplied instance of 
-     * {@link WhitelistBlacklistParameters}.
+     * Resolve and populate the effective includes or excludes on the supplied instance of 
+     * {@link AlgorithmPolicyParameters}.
      * 
-     * @param params the whitelist/blacklist parameters instance to populate
+     * @param params the include/exclude parameters instance to populate
      * @param criteria the input criteria being evaluated
-     * @param configs the effective list of {@link WhitelistBlacklistConfiguration} instances to consider
+     * @param configs the effective list of {@link AlgorithmPolicyConfiguration} instances to consider
      */
-    protected void resolveAndPopulateWhiteAndBlacklists(@Nonnull final WhitelistBlacklistParameters params, 
+    protected void resolveAndPopulateIncludesExcludes(@Nonnull final AlgorithmPolicyParameters params, 
             @Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends WhitelistBlacklistConfiguration> configs) {
+            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
-        final Collection<String> whitelist = resolveEffectiveWhitelist(criteria, configs);
-        log.trace("Resolved effective whitelist: {}", whitelist);
+        final Collection<String> includes = resolveEffectiveIncludes(criteria, configs);
+        log.trace("Resolved effective includes: {}", includes);
         
-        final Collection<String> blacklist = resolveEffectiveBlacklist(criteria, configs);
-        log.trace("Resolved effective blacklist: {}", blacklist);
+        final Collection<String> excludes = resolveEffectiveExcludes(criteria, configs);
+        log.trace("Resolved effective excludes: {}", excludes);
         
-        if (whitelist.isEmpty() && blacklist.isEmpty()) {
+        if (includes.isEmpty() && excludes.isEmpty()) {
             log.trace("Both empty, nothing to populate");
             return;
         }
         
-        if (whitelist.isEmpty()) {
-            log.trace("Whitelist empty, populating blacklist");
-            params.setBlacklistedAlgorithms(blacklist);
+        if (includes.isEmpty()) {
+            log.trace("Includes empty, populating excludes");
+            params.setExcludedAlgorithms(excludes);
             return;
         }
         
-        if (blacklist.isEmpty()) {
-            log.trace("Blacklist empty, populating whitelist");
-            params.setWhitelistedAlgorithms(whitelist);
+        if (excludes.isEmpty()) {
+            log.trace("Excludes empty, populating includes");
+            params.setIncludedAlgorithms(includes);
             return;
         }
         
-        final WhitelistBlacklistConfiguration.Precedence precedence =
-                resolveWhitelistBlacklistPrecedence(criteria, configs);
+        final AlgorithmPolicyConfiguration.Precedence precedence =
+                resolveIncludeExcludePrecedence(criteria, configs);
         log.trace("Resolved effective precedence: {}", precedence);
         switch(precedence) {
-            case WHITELIST:
-                log.trace("Based on precedence, populating whitelist");
-                params.setWhitelistedAlgorithms(whitelist);
+            case INCLUDE:
+                log.trace("Based on precedence, populating includes");
+                params.setIncludedAlgorithms(includes);
                 break;
-            case BLACKLIST:
-                log.trace("Based on precedence, populating blacklist");
-                params.setBlacklistedAlgorithms(blacklist);
+            case EXCLUDE:
+                log.trace("Based on precedence, populating excludes");
+                params.setExcludedAlgorithms(excludes);
                 break;
             default:
-                throw new IllegalArgumentException("WhitelistBlacklistPrecedence value is unknown: " + precedence);
+                throw new IllegalArgumentException("Include/Exclude Precedence value is unknown: " + precedence);
                     
         }
         
     }
-// Checkstyle: ReturnCount ON
     
     /**
-     * Get a predicate which operates according to the effective configured whitelist and blacklist policy.
+     * Get a predicate which operates according to the effective configured include and exclude policy.
      * 
      * @param criteria the input criteria being evaluated
-     * @param configs the effective list of {@link WhitelistBlacklistConfiguration} instances to consider
+     * @param configs the effective list of {@link AlgorithmPolicyConfiguration} instances to consider
      * 
-     * @return a predicate instance which operates accordingly to the effective whitelist and blacklist policy
+     * @return a predicate instance which operates accordingly to the effective include and exclude policy
      */
-    @Nonnull protected Predicate<String> resolveWhitelistBlacklistPredicate(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends WhitelistBlacklistConfiguration> configs) {
+    @Nonnull protected Predicate<String> resolveIncludeExcludePredicate(@Nonnull final CriteriaSet criteria, 
+            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
-        final Collection<String> whitelist = resolveEffectiveWhitelist(criteria, configs);
-        log.trace("Resolved effective whitelist: {}", whitelist);
+        final Collection<String> includes = resolveEffectiveIncludes(criteria, configs);
+        log.trace("Resolved effective includes: {}", includes);
         
-        final Collection<String> blacklist = resolveEffectiveBlacklist(criteria, configs);
-        log.trace("Resolved effective blacklist: {}", blacklist);
+        final Collection<String> excludes = resolveEffectiveExcludes(criteria, configs);
+        log.trace("Resolved effective excludes: {}", excludes);
         
-        if (whitelist.isEmpty() && blacklist.isEmpty()) {
+        if (includes.isEmpty() && excludes.isEmpty()) {
             log.trace("Both empty, returning alwaysTrue predicate");
             return Predicates.alwaysTrue();
         }
         
-        if (whitelist.isEmpty()) {
-            log.trace("Whitelist empty, returning BlacklistPredicate");
-            return new BlacklistPredicate(blacklist);
+        if (includes.isEmpty()) {
+            log.trace("Includes empty, returning ExcludedAlgorithmsPredicate");
+            return new ExcludedAlgorithmsPredicate(excludes);
         }
         
-        if (blacklist.isEmpty()) {
-            log.trace("Blacklist empty, returning WhitelistPredicate");
-            return new WhitelistPredicate(whitelist);
+        if (excludes.isEmpty()) {
+            log.trace("Excludes empty, returning IncludedAlgorithmsPredicate");
+            return new IncludedAlgorithmsPredicate(includes);
         }
         
-        final WhitelistBlacklistConfiguration.Precedence precedence =
-                resolveWhitelistBlacklistPrecedence(criteria, configs);
+        final AlgorithmPolicyConfiguration.Precedence precedence =
+                resolveIncludeExcludePrecedence(criteria, configs);
         log.trace("Resolved effective precedence: {}", precedence);
         switch(precedence) {
-            case WHITELIST:
-                log.trace("Based on precedence, returning WhitelistPredicate");
-                return new WhitelistPredicate(whitelist);
-            case BLACKLIST:
-                log.trace("Based on precedence, returning BlacklistPredicate");
-                return new BlacklistPredicate(blacklist);
+            case INCLUDE:
+                log.trace("Based on precedence, returning IncludedAlgorithmsPredicate");
+                return new IncludedAlgorithmsPredicate(includes);
+            case EXCLUDE:
+                log.trace("Based on precedence, returning ExcludedAlgorithmsPredicate");
+                return new ExcludedAlgorithmsPredicate(excludes);
             default:
-                throw new IllegalArgumentException("WhitelistBlacklistPrecedence value is unknown: " + precedence);
+                throw new IllegalArgumentException("Include/Exclude Precedence value is unknown: " + precedence);
                     
         }
         
     }
 
     /**
-     * Resolve and return the effective algorithm blacklist based on supplied configuration.
+     * Resolve and return the effective algorithm excludes based on supplied configuration.
      * 
      * @param criteria the input criteria being evaluated
-     * @param configs the effective list of {@link WhitelistBlacklistConfiguration} instances to consider
+     * @param configs the effective list of {@link AlgorithmPolicyConfiguration} instances to consider
      * 
-     * @return the effective algorithm blacklist
+     * @return the effective algorithm excludes
      */
-    @Nonnull protected Collection<String> resolveEffectiveBlacklist(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends WhitelistBlacklistConfiguration> configs) {
+    @Nonnull protected Collection<String> resolveEffectiveExcludes(@Nonnull final CriteriaSet criteria, 
+            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         final LazySet<String> accumulator = new LazySet<>();
-        for (final WhitelistBlacklistConfiguration config : configs) {
-            accumulator.addAll(config.getBlacklistedAlgorithms());
-            if (!config.isBlacklistMerge()) {
+        for (final AlgorithmPolicyConfiguration config : configs) {
+            accumulator.addAll(config.getExcludedAlgorithms());
+            if (!config.isExcludeMerge()) {
                 break;
             }
         }
@@ -214,20 +212,20 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
     }
 
     /**
-     * Resolve and return the effective algorithm whitelist based on supplied configuration.
+     * Resolve and return the effective algorithm includes based on supplied configuration.
      * 
      * @param criteria the input criteria being evaluated
-     * @param configs the effective list of {@link WhitelistBlacklistConfiguration} instances to consider
+     * @param configs the effective list of {@link AlgorithmPolicyConfiguration} instances to consider
      * 
-     * @return the effective algorithm whitelist
+     * @return the effective algorithm includes
      */
-    @Nonnull protected Collection<String> resolveEffectiveWhitelist(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends WhitelistBlacklistConfiguration> configs) {
+    @Nonnull protected Collection<String> resolveEffectiveIncludes(@Nonnull final CriteriaSet criteria, 
+            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
         final LazySet<String> accumulator = new LazySet<>();
-        for (final WhitelistBlacklistConfiguration config : configs) {
-            accumulator.addAll(config.getWhitelistedAlgorithms());
-            if (!config.isWhitelistMerge()) {
+        for (final AlgorithmPolicyConfiguration config : configs) {
+            accumulator.addAll(config.getIncludedAlgorithms());
+            if (!config.isIncludeMerge()) {
                 break;
             }
         }
@@ -235,18 +233,18 @@ public abstract class AbstractSecurityParametersResolver<ProductType>
     }
 
     /**
-     * Resolve and return the effective algorithm whitelist/blacklist precedence based 
+     * Resolve and return the effective algorithm include/exclude precedence based 
      * on supplied configuration.
      * 
      * @param criteria the input criteria being evaluated
-     * @param configs the effective list of {@link WhitelistBlacklistConfiguration} instances to consider
+     * @param configs the effective list of {@link AlgorithmPolicyConfiguration} instances to consider
      * 
-     * @return the effective algorithm whitelist/blacklist precedence
+     * @return the effective algorithm include/exclude precedence
      */
-    @Nonnull protected Precedence resolveWhitelistBlacklistPrecedence(@Nonnull final CriteriaSet criteria, 
-            @Nonnull @NonnullElements @NotEmpty final List<? extends WhitelistBlacklistConfiguration> configs) {
+    @Nonnull protected Precedence resolveIncludeExcludePrecedence(@Nonnull final CriteriaSet criteria, 
+            @Nonnull @NonnullElements @NotEmpty final List<? extends AlgorithmPolicyConfiguration> configs) {
         
-        return configs.get(0).getWhitelistBlacklistPrecedence();
+        return configs.get(0).getIncludeExcludePrecedence();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
similarity index 51%
copy from opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java
copy to opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
index c96325fab..ead2b1294 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfiguration.java
@@ -19,82 +19,76 @@ package org.opensaml.xmlsec.impl;
 
 import java.util.Collection;
 import java.util.Collections;
-import java.util.HashSet;
+import java.util.Set;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration;
-
-import com.google.common.collect.ImmutableSet;
-
 /**
- * Basic implementation of {@link WhitelistBlacklistConfiguration}.
+ * Basic implementation of {@link AlgorithmPolicyConfiguration}.
  * 
  * <p>
- * The value returned by {@link #getWhitelistBlacklistPrecedence()} defaults to
- * {@link org.opensaml.xmlsec.WhitelistBlacklistConfiguration.Precedence#WHITELIST}.
+ * The value returned by {@link #getIncludeExcludePrecedence()} defaults to
+ * {@link org.opensaml.xmlsec.AlgorithmPolicyConfiguration.Precedence#INCLUDE}.
  * </p>
  */
-public class BasicWhitelistBlacklistConfiguration implements WhitelistBlacklistConfiguration {
+public class BasicAlgorithmPolicyConfiguration implements AlgorithmPolicyConfiguration {
     
     /** Default precedence. */
-    public static final Precedence DEFAULT_PRECEDENCE = Precedence.WHITELIST;
+    public static final Precedence DEFAULT_PRECEDENCE = Precedence.INCLUDE;
     
-    /** Whitelisted algorithm URIs. */
-    private Collection<String> whitelist;
+    /** Included algorithm URIs. */
+    private Collection<String> includes;
     
-    /** Whitelist merge flag. */
-    private boolean whitelistMerge;
+    /** Include merge flag. */
+    private boolean includeMerge;
     
-    /** Blacklisted algorithm URIs. */
-    private Collection<String> blacklist;
+    /** Excluded algorithm URIs. */
+    private Collection<String> excludes;
     
-    /** Blacklist merge flag. */
-    private boolean blacklistMerge;
+    /** Exclude merge flag. */
+    private boolean excludeMerge;
     
     /** Precedence flag. */
     private Precedence precedence;
     
     /** Constructor. */
-    public BasicWhitelistBlacklistConfiguration() {
-        whitelist = Collections.emptySet();
-        blacklist = Collections.emptySet();
+    public BasicAlgorithmPolicyConfiguration() {
+        includes = Collections.emptySet();
+        excludes = Collections.emptySet();
         precedence = DEFAULT_PRECEDENCE;
         
         // These merging defaults are intended to be the more secure/conservative approach:
-        // - do merge blacklists by default since don't want to unintentionally miss blacklist from lower level
-        // - do not merge whitelists by default since don't want to unintentionally include algos from lower level
-        blacklistMerge = true;
-        whitelistMerge = false;
+        // - do merge excludes by default since don't want to unintentionally miss excludes from lower level
+        // - do not merge includes by default since don't want to unintentionally include algos from lower level
+        excludeMerge = true;
+        includeMerge = false;
     }
-    
-    /**
-     * Get the list of whitelisted algorithm URI's.
-     * 
-     * @return the list of algorithms
-     */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getWhitelistedAlgorithms() {
-        return ImmutableSet.copyOf(whitelist);
+
+    /** {@inheritDoc} */
+    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getIncludedAlgorithms() {
+        return includes;
     }
     
     /**
-     * Set the list of whitelisted algorithm URI's.
+     * Set the list of included algorithm URIs.
      * 
      * @param uris the list of algorithms
      */
-    public void setWhitelistedAlgorithms(@Nullable final Collection<String> uris) {
+    public void setIncludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
-            whitelist = Collections.emptySet();
+            includes = Collections.emptySet();
             return;
         }
-        whitelist = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+        includes = Set.copyOf(StringSupport.normalizeStringCollection(uris));
     }
 
     /** 
@@ -102,42 +96,38 @@ public class BasicWhitelistBlacklistConfiguration implements WhitelistBlacklistC
      * 
      * <p>Defaults to: <code>false</code>.</p>
      */
-    public boolean isWhitelistMerge() {
-        return whitelistMerge;
+    public boolean isIncludeMerge() {
+        return includeMerge;
     }
     
     /**
-     * Set the flag indicating whether to merge this configuration's whitelist with one of a lower order of precedence,
-     * or to treat this whitelist as authoritative.
+     * Set the flag indicating whether to merge this configuration's includes with one of a lower order of precedence,
+     * or to treat these includes as authoritative.
      * 
      * <p>Defaults to: <code>false</code>
      * 
      * @param flag true if should merge, false otherwise
      */
-    public void setWhitelistMerge(final boolean flag) {
-        whitelistMerge = flag;
+    public void setIncludeMerge(final boolean flag) {
+        includeMerge = flag;
     }
 
-    /**
-     * Get the list of blacklisted algorithm URI's.
-     * 
-     * @return the list of algorithms
-     */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getBlacklistedAlgorithms() {
-        return ImmutableSet.copyOf(blacklist);
+    /** {@inheritDoc} */
+    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getExcludedAlgorithms() {
+        return excludes;
     }
     
     /**
-     * Set the list of blacklisted algorithm URI's.
+     * Set the list of excluded algorithm URIs.
      * 
      * @param uris the list of algorithms
      */
-    public void setBlacklistedAlgorithms(@Nullable final Collection<String> uris) {
+    public void setExcludedAlgorithms(@Nullable final Collection<String> uris) {
         if (uris == null) {
-            blacklist = Collections.emptySet();
+            excludes = Collections.emptySet();
             return;
         }
-        blacklist = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+        excludes = Set.copyOf(StringSupport.normalizeStringCollection(uris));
     }
 
     /** 
@@ -145,33 +135,33 @@ public class BasicWhitelistBlacklistConfiguration implements WhitelistBlacklistC
      * 
      * <p>Defaults to: <code>true</code>.</p>
      */
-    public boolean isBlacklistMerge() {
-        return blacklistMerge;
+    public boolean isExcludeMerge() {
+        return excludeMerge;
     }
 
     /**
-     * Set the flag indicating whether to merge this configuration's blacklist with one of a lower order of precedence,
-     * or to treat this blacklist as authoritative.
+     * Set the flag indicating whether to merge this configuration's excludes with one of a lower order of precedence,
+     * or to treat these excludes as authoritative.
      * 
      * <p>Defaults to: <code>true</code>
      * 
      * @param flag true if should merge, false otherwise
      */
-    public void setBlacklistMerge(final boolean flag) {
-        blacklistMerge = flag;
+    public void setExcludeMerge(final boolean flag) {
+        excludeMerge = flag;
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Precedence getWhitelistBlacklistPrecedence() {
+    @Nonnull public Precedence getIncludeExcludePrecedence() {
         return precedence;
     }
     
     /**
-     * Set preference value indicating which should take precedence when both whitelist and blacklist are non-empty.
+     * Set preference value indicating which should take precedence when both includes and excludes are non-empty.
      * 
      * @param value the precedence value
      */
-    public void setWhitelistBlacklistPrecedence(@Nonnull final Precedence value) {
+    public void setIncludeExcludePrecedence(@Nonnull final Precedence value) {
         precedence = Constraint.isNotNull(value, "Precedence may not be null");
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java
index 2e5eb4cbd..431427b63 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionConfiguration.java
@@ -26,6 +26,7 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 /**
  * Basic implementation of {@link DecryptionConfiguration}.
  */
+ at SuppressWarnings("removal")
 public class BasicDecryptionConfiguration extends BasicWhitelistBlacklistConfiguration 
         implements DecryptionConfiguration {
     
@@ -37,14 +38,9 @@ public class BasicDecryptionConfiguration extends BasicWhitelistBlacklistConfigu
     
     /** The EncryptedKey resolver. */
     @Nullable private EncryptedKeyResolver encryptedKeyResolver;
-    
+
     //TODO chaining to parent config instance on getters? or use a wrapping proxy, etc?
-    
-    /** * Constructor. */
-    public BasicDecryptionConfiguration() {
-       super(); 
-    }
-    
+
     /**
      * Get the KeyInfoCredentialResolver to use when processing the EncryptedData/KeyInfo.
      * 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java
index 93fd0fe13..a87629f41 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolver.java
@@ -70,7 +70,7 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
         
         final DecryptionParameters params = new DecryptionParameters();
         
-        resolveAndPopulateWhiteAndBlacklists(params, criteria, 
+        resolveAndPopulateIncludesExcludes(params, criteria, 
                 criteria.get(DecryptionConfigurationCriterion.class).getConfigurations());
         
         params.setDataKeyInfoCredentialResolver(resolveDataKeyInfoCredentialResolver(criteria));
@@ -91,8 +91,8 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
         if (log.isDebugEnabled()) {
             log.debug("Resolved DecryptionParameters:");
             
-            log.debug("\tAlgorithm whitelist: {}", params.getWhitelistedAlgorithms());
-            log.debug("\tAlgorithm blacklist: {}", params.getBlacklistedAlgorithms());
+            log.debug("\tAlgorithm includes: {}", params.getIncludedAlgorithms());
+            log.debug("\tAlgorithm excludes: {}", params.getExcludedAlgorithms());
             
             log.debug("\tData KeyInfoCredentialResolver: {}", 
                     params.getDataKeyInfoCredentialResolver() != null ? "present" : "null");
@@ -160,6 +160,4 @@ public class BasicDecryptionParametersResolver extends AbstractSecurityParameter
         return null;
     }
 
-
-
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
index aa2521caf..ac85ba2e1 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionConfiguration.java
@@ -40,6 +40,7 @@ import org.slf4j.LoggerFactory;
 /**
  * Basic implementation of {@link EncryptionConfiguration}.
  */
+ at SuppressWarnings("removal")
 public class BasicEncryptionConfiguration extends BasicWhitelistBlacklistConfiguration 
         implements EncryptionConfiguration {
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
index 6d6601fca..34e7479af 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
@@ -280,7 +280,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
      * @return a whitelist/blacklist predicate instance
      */
     @Nonnull protected Predicate<String> getWhitelistBlacklistPredicate(@Nonnull final CriteriaSet criteria) {
-        return resolveWhitelistBlacklistPredicate(criteria, 
+        return resolveIncludeExcludePredicate(criteria, 
                 criteria.get(EncryptionConfigurationCriterion.class).getConfigurations());
     }
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
index a7ef1f54c..6ea3b1dab 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfiguration.java
@@ -37,6 +37,7 @@ import org.slf4j.LoggerFactory;
 /**
  * Basic implementation of {@link SignatureSigningConfiguration}.
  */
+ at SuppressWarnings("removal")
 public class BasicSignatureSigningConfiguration extends BasicWhitelistBlacklistConfiguration 
         implements SignatureSigningConfiguration {
     
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java
index baa0ba3fd..fc5d2341e 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolver.java
@@ -193,14 +193,14 @@ public class BasicSignatureSigningParametersResolver
     }
 
     /**
-     * Get a predicate which implements the effective configured whitelist/blacklist policy.
+     * Get a predicate which implements the effective configured include/exclude policy.
      * 
      * @param criteria the input criteria being evaluated
      * 
      * @return a whitelist/blacklist predicate instance
      */
     @Nonnull protected Predicate<String> getWhitelistBlacklistPredicate(@Nonnull final CriteriaSet criteria) {
-        return resolveWhitelistBlacklistPredicate(criteria, 
+        return resolveIncludeExcludePredicate(criteria, 
                 criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations());
     }
 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java
index 48758b803..2e1ab2a8a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationConfiguration.java
@@ -25,6 +25,7 @@ import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 /**
  * Basic implementation of {@link SignatureValidationConfiguration}.
  */
+ at SuppressWarnings("removal")
 public class BasicSignatureValidationConfiguration extends BasicWhitelistBlacklistConfiguration
         implements SignatureValidationConfiguration {
     
@@ -33,11 +34,6 @@ public class BasicSignatureValidationConfiguration extends BasicWhitelistBlackli
     
     //TODO chaining to parent config instance on getters? or use a wrapping proxy, etc?
     
-    /** * Constructor. */
-    public BasicSignatureValidationConfiguration() {
-       super(); 
-    }
-    
     /**
      * Get the signature trust engine to use.
      * 
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java
index 57dac45b8..2b49cc735 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolver.java
@@ -71,7 +71,7 @@ public class BasicSignatureValidationParametersResolver
         
         final SignatureValidationParameters params = new SignatureValidationParameters();
         
-        resolveAndPopulateWhiteAndBlacklists(params, criteria, 
+        resolveAndPopulateIncludesExcludes(params, criteria, 
                 criteria.get(SignatureValidationConfigurationCriterion.class).getConfigurations());
         
         params.setSignatureTrustEngine(resolveSignatureTrustEngine(criteria));
@@ -90,8 +90,8 @@ public class BasicSignatureValidationParametersResolver
         if (log.isDebugEnabled()) {
             log.debug("Resolved SignatureValidationParameters:");
             
-            log.debug("\tAlgorithm whitelist: {}", params.getWhitelistedAlgorithms());
-            log.debug("\tAlgorithm blacklist: {}", params.getBlacklistedAlgorithms());
+            log.debug("\tAlgorithm includes: {}", params.getIncludedAlgorithms());
+            log.debug("\tAlgorithm excludes: {}", params.getExcludedAlgorithms());
             
             log.debug("\tSignatureTrustEngine: {}", 
                     params.getSignatureTrustEngine() != null ? "present" : "null");
@@ -117,4 +117,4 @@ public class BasicSignatureValidationParametersResolver
         return null;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java
index c96325fab..ebddd1886 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfiguration.java
@@ -18,94 +18,46 @@
 package org.opensaml.xmlsec.impl;
 
 import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import org.opensaml.xmlsec.WhitelistBlacklistConfiguration;
+
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotLive;
 import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration;
-
-import com.google.common.collect.ImmutableSet;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 
 /**
  * Basic implementation of {@link WhitelistBlacklistConfiguration}.
  * 
  * <p>
- * The value returned by {@link #getWhitelistBlacklistPrecedence()} defaults to
+ * The value returned by {@link WhitelistBlacklistConfiguration#getWhitelistBlacklistPrecedence()} defaults to
  * {@link org.opensaml.xmlsec.WhitelistBlacklistConfiguration.Precedence#WHITELIST}.
  * </p>
+ * 
+ * @deprecated
  */
-public class BasicWhitelistBlacklistConfiguration implements WhitelistBlacklistConfiguration {
-    
-    /** Default precedence. */
-    public static final Precedence DEFAULT_PRECEDENCE = Precedence.WHITELIST;
-    
-    /** Whitelisted algorithm URIs. */
-    private Collection<String> whitelist;
-    
-    /** Whitelist merge flag. */
-    private boolean whitelistMerge;
-    
-    /** Blacklisted algorithm URIs. */
-    private Collection<String> blacklist;
-    
-    /** Blacklist merge flag. */
-    private boolean blacklistMerge;
-    
-    /** Precedence flag. */
-    private Precedence precedence;
-    
-    /** Constructor. */
-    public BasicWhitelistBlacklistConfiguration() {
-        whitelist = Collections.emptySet();
-        blacklist = Collections.emptySet();
-        precedence = DEFAULT_PRECEDENCE;
-        
-        // These merging defaults are intended to be the more secure/conservative approach:
-        // - do merge blacklists by default since don't want to unintentionally miss blacklist from lower level
-        // - do not merge whitelists by default since don't want to unintentionally include algos from lower level
-        blacklistMerge = true;
-        whitelistMerge = false;
-    }
+ at Deprecated(forRemoval=true, since="4.1.0")
+public class BasicWhitelistBlacklistConfiguration extends BasicAlgorithmPolicyConfiguration
+        implements WhitelistBlacklistConfiguration {
     
     /**
-     * Get the list of whitelisted algorithm URI's.
-     * 
-     * @return the list of algorithms
-     */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getWhitelistedAlgorithms() {
-        return ImmutableSet.copyOf(whitelist);
-    }
-    
-    /**
-     * Set the list of whitelisted algorithm URI's.
-     * 
-     * @param uris the list of algorithms
-     */
-    public void setWhitelistedAlgorithms(@Nullable final Collection<String> uris) {
-        if (uris == null) {
-            whitelist = Collections.emptySet();
-            return;
-        }
-        whitelist = new HashSet<>(StringSupport.normalizeStringCollection(uris));
-    }
-
-    /** 
-     * {@inheritDoc}
+     * Flag indicating whether to merge this configuration's whitelist with one of a lower order of precedence,
+     * or to treat this whitelist as authoritative.
      * 
-     * <p>Defaults to: <code>false</code>.</p>
+     * @return true if should merge, false otherwise
      */
     public boolean isWhitelistMerge() {
-        return whitelistMerge;
+        DeprecationSupport.warn(ObjectType.METHOD, "isWhitelistMerge", null, "isIncludeMerge");
+        return isIncludeMerge();
     }
     
+
     /**
      * Set the flag indicating whether to merge this configuration's whitelist with one of a lower order of precedence,
      * or to treat this whitelist as authoritative.
@@ -115,39 +67,42 @@ public class BasicWhitelistBlacklistConfiguration implements WhitelistBlacklistC
      * @param flag true if should merge, false otherwise
      */
     public void setWhitelistMerge(final boolean flag) {
-        whitelistMerge = flag;
+        DeprecationSupport.warn(ObjectType.METHOD, "setWhitelistMerge", null, "setIncludeMerge");
+        setIncludeMerge(flag);
     }
 
     /**
-     * Get the list of blacklisted algorithm URI's.
+     * Get the list of whitelisted algorithm URIs.
      * 
      * @return the list of algorithms
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<String> getBlacklistedAlgorithms() {
-        return ImmutableSet.copyOf(blacklist);
+    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getWhitelistedAlgorithms() {
+        DeprecationSupport.warn(ObjectType.METHOD, "getWhitelistedAlgorithms", null, "getIncludedAlgorithms");
+        return getIncludedAlgorithms();
     }
     
+
     /**
-     * Set the list of blacklisted algorithm URI's.
+     * Set the list of whitelisted algorithm URIs.
      * 
      * @param uris the list of algorithms
      */
-    public void setBlacklistedAlgorithms(@Nullable final Collection<String> uris) {
-        if (uris == null) {
-            blacklist = Collections.emptySet();
-            return;
-        }
-        blacklist = new HashSet<>(StringSupport.normalizeStringCollection(uris));
+    public void setWhitelistedAlgorithms(@Nullable final Collection<String> uris) {
+        DeprecationSupport.warn(ObjectType.METHOD, "setWhitelistedAlgorithms", null, "setIncludedAlgorithms");
+        setIncludedAlgorithms(uris);
     }
 
-    /** 
-     * {@inheritDoc}
+    /**
+     * Flag indicating whether to merge this configuration's blacklist with one of a lower order of precedence,
+     * or to treat this blacklist as authoritative.
      * 
-     * <p>Defaults to: <code>true</code>.</p>
+     * @return true if should merge, false otherwise
      */
     public boolean isBlacklistMerge() {
-        return blacklistMerge;
+        DeprecationSupport.warn(ObjectType.METHOD, "isBlacklistMerge", null, "isExcludeMerge");
+        return isExcludeMerge();
     }
+    
 
     /**
      * Set the flag indicating whether to merge this configuration's blacklist with one of a lower order of precedence,
@@ -158,21 +113,71 @@ public class BasicWhitelistBlacklistConfiguration implements WhitelistBlacklistC
      * @param flag true if should merge, false otherwise
      */
     public void setBlacklistMerge(final boolean flag) {
-        blacklistMerge = flag;
+        DeprecationSupport.warn(ObjectType.METHOD, "setBlacklistMerge", null, "setExcludeMerge");
+        setExcludeMerge(flag);
     }
 
-    /** {@inheritDoc} */
-    @Nonnull public Precedence getWhitelistBlacklistPrecedence() {
-        return precedence;
+    /**
+     * Get the list of blacklisted algorithm URIs.
+     * 
+     * @return the list of algorithms
+     */
+    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getBlacklistedAlgorithms() {
+        DeprecationSupport.warn(ObjectType.METHOD, "getBlacklistedAlgorithms", null, "getExcludedAlgorithms");
+        return getExcludedAlgorithms();
+    }
+
+    /**
+     * Set the list of blacklisted algorithm URIs.
+     * 
+     * @param uris the list of algorithms
+     */
+    public void setBlacklistedAlgorithms(@Nullable final Collection<String> uris) {
+        DeprecationSupport.warn(ObjectType.METHOD, "setBlacklistedAlgorithms", null, "setExcludedAlgorithms");
+        setExcludedAlgorithms(uris);
+    }
+
+    /**
+     * Get preference value indicating which should take precedence when both whitelist and blacklist are non-empty.
+     * 
+     * @return the configured precedence value.
+     */
+    @Nonnull public WhitelistBlacklistConfiguration.Precedence getWhitelistBlacklistPrecedence() {
+        DeprecationSupport.warn(ObjectType.METHOD, "getWhitelistBlacklistPrecedence", null,
+                "getIncludeExcludePrecedence");
+        
+        switch (getIncludeExcludePrecedence()) {
+            case INCLUDE:
+                return WhitelistBlacklistConfiguration.Precedence.WHITELIST;
+            case EXCLUDE:
+                return WhitelistBlacklistConfiguration.Precedence.BLACKLIST;
+            default:
+                throw new IllegalArgumentException("Unrecognized Precedence value");
+        }
     }
     
+
     /**
      * Set preference value indicating which should take precedence when both whitelist and blacklist are non-empty.
      * 
      * @param value the precedence value
      */
-    public void setWhitelistBlacklistPrecedence(@Nonnull final Precedence value) {
-        precedence = Constraint.isNotNull(value, "Precedence may not be null");
+    public void setWhitelistBlacklistPrecedence(@Nonnull final WhitelistBlacklistConfiguration.Precedence value) {
+        DeprecationSupport.warn(ObjectType.METHOD, "setWhitelistBlacklistPrecedence", null,
+                "setIncludeExcludePrecedence");
+        
+        switch(Constraint.isNotNull(value, "Precedence cannot be null")) {
+            case WHITELIST:
+                setIncludeExcludePrecedence(AlgorithmPolicyConfiguration.Precedence.INCLUDE);
+                break;
+                
+            case BLACKLIST:
+                setIncludeExcludePrecedence(AlgorithmPolicyConfiguration.Precedence.EXCLUDE);
+                break;
+                    
+            default:
+                throw new IllegalArgumentException("Unrecognized precedence value");
+        }
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BlacklistPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
similarity index 73%
rename from opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BlacklistPredicate.java
rename to opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
index ecf83ca9e..b21288d36 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BlacklistPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicate.java
@@ -28,20 +28,20 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
 /**
- * Predicate which implements an algorithm URI blacklist policy.
+ * Predicate which implements an algorithm URI exclusion policy.
  */
-public class BlacklistPredicate implements Predicate<String> {
+public class ExcludedAlgorithmsPredicate implements Predicate<String> {
     
-    /** Blacklisted algorithms. */
-    @Nonnull @NonnullElements private Collection<String> blacklist;
+    /** Excluded algorithms. */
+    @Nonnull @NonnullElements private Collection<String> excludes;
     
     /**
      * Constructor.
      *
-     * @param algorithms collection of blacklisted algorithms
+     * @param algorithms collection of excluded algorithms
      */
-    public BlacklistPredicate(@Nonnull @NonnullElements final Collection<String> algorithms) {
-        blacklist = Set.copyOf(Constraint.isNotNull(algorithms, "Blacklist may not be null"));
+    public ExcludedAlgorithmsPredicate(@Nonnull @NonnullElements final Collection<String> algorithms) {
+        excludes = Set.copyOf(Constraint.isNotNull(algorithms, "Exclusions may not be null"));
     }
 
     /** {@inheritDoc} */
@@ -49,7 +49,7 @@ public class BlacklistPredicate implements Predicate<String> {
         if (input == null) {
             throw new IllegalArgumentException("Algorithm URI to evaluate may not be null");
         }
-        return ! blacklist.contains(input);
+        return ! excludes.contains(input);
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/WhitelistPredicate.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
similarity index 71%
rename from opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/WhitelistPredicate.java
rename to opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
index b829dc0bd..3d59401bb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/WhitelistPredicate.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicate.java
@@ -28,21 +28,21 @@ import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElemen
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
 /**
- * Predicate which implements an algorithm URI whitelist policy.
+ * Predicate which implements an algorithm URI inclusion policy.
  * 
  */
-public class WhitelistPredicate implements Predicate<String> {
+public class IncludedAlgorithmsPredicate implements Predicate<String> {
     
-    /** Whitelisted algorithms. */
-    @Nonnull @NonnullElements private Collection<String> whitelist;
+    /** Included algorithms. */
+    @Nonnull @NonnullElements private Collection<String> includes;
     
     /**
      * Constructor.
      *
-     * @param algorithms collection of whitelisted algorithms
+     * @param algorithms collection of included algorithms
      */
-    public WhitelistPredicate(@Nonnull final Collection<String> algorithms) {
-        whitelist = Set.copyOf(Constraint.isNotNull(algorithms, "Whitelist may not be null"));
+    public IncludedAlgorithmsPredicate(@Nonnull final Collection<String> algorithms) {
+        includes = Set.copyOf(Constraint.isNotNull(algorithms, "Inclusions may not be null"));
     }
 
     /** {@inheritDoc} */
@@ -50,10 +50,7 @@ public class WhitelistPredicate implements Predicate<String> {
         if (input == null) {
             throw new IllegalArgumentException("Algorithm URI to evaluate may not be null");
         }
-        if (whitelist.isEmpty()) {
-            return true;
-        }
-        return whitelist.contains(input);
+        return includes.isEmpty() || includes.contains(input);
     }
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
index 096468ce8..4dd65887a 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
@@ -126,7 +126,6 @@ public class PopulateSignatureValidationParametersHandler extends AbstractMessag
         }
     }
     
-// Checkstyle: ReturnCount OFF
     /** {@inheritDoc} */
     @Override
     protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
@@ -157,6 +156,5 @@ public class PopulateSignatureValidationParametersHandler extends AbstractMessag
             throw new MessageHandlerException("Error resolving SignatureValidationParameters");
         }
     }
-// Checkstyle: ReturnCount ON
     
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
index 335664da0..85a6a23d8 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/BaseSignatureTrustEngine.java
@@ -130,8 +130,8 @@ public abstract class BaseSignatureTrustEngine<TrustBasisType> implements Signat
         if (validationCriterion != null) {
             log.debug("Performing signature algorithm whitelist/blacklist validation using params from CriteriaSet");
             final SignatureValidationParameters params = validationCriterion.getSignatureValidationParameters();
-            if (!AlgorithmSupport.validateAlgorithmURI(algorithmURI, params.getWhitelistedAlgorithms(), 
-                    params.getBlacklistedAlgorithms())) {
+            if (!AlgorithmSupport.validateAlgorithmURI(algorithmURI, params.getIncludedAlgorithms(), 
+                    params.getExcludedAlgorithms())) {
                 log.warn("Simple/raw signature failed algorithm whitelist/blacklist validation");
                 return false;
             }
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java
index e87eefc29..729cdf58d 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/signature/support/impl/SignatureAlgorithmValidator.java
@@ -70,11 +70,11 @@ public class SignatureAlgorithmValidator {
     /** Logger. */
     private Logger log = LoggerFactory.getLogger(SignatureAlgorithmValidator.class);
     
-    /** The collection of algorithm URI's which are whitelisted. */
-    private Collection<String> whitelistedAlgorithmURIs;
+    /** The collection of algorithm URIs which are included. */
+    private Collection<String> includedAlgorithmURIs;
     
-    /** The collection of algorithm URI's which are blacklisted. */
-    private Collection<String> blacklistedAlgorithmURIs;
+    /** The collection of algorithm URIs which are excluded. */
+    private Collection<String> excludedAlgorithmURIs;
     
     /**
      * Constructor.
@@ -84,21 +84,21 @@ public class SignatureAlgorithmValidator {
     public SignatureAlgorithmValidator(
             @Nonnull @ParameterName(name="params") final SignatureValidationParameters params) {
         Constraint.isNotNull(params, "SignatureValidationParameters may not be null");
-        whitelistedAlgorithmURIs = params.getWhitelistedAlgorithms();
-        blacklistedAlgorithmURIs = params.getBlacklistedAlgorithms();
+        includedAlgorithmURIs = params.getIncludedAlgorithms();
+        excludedAlgorithmURIs = params.getExcludedAlgorithms();
     }
     
     /**
      * Constructor.
      *
-     * @param whitelistAlgos the algorithm whitelist
-     * @param blacklistAlgos the algorithm blacklist
+     * @param includeAlgos the algorithm includes
+     * @param excludeAlgos the algorithm excludes
      */
     public SignatureAlgorithmValidator(
-            @Nullable @ParameterName(name="whitelistAlgos") final Collection<String> whitelistAlgos,
-            @Nullable @ParameterName(name="blacklistAlgos") final Collection<String> blacklistAlgos) {
-        whitelistedAlgorithmURIs = whitelistAlgos;
-        blacklistedAlgorithmURIs = blacklistAlgos;
+            @Nullable @ParameterName(name="includeAlgos") final Collection<String> includeAlgos,
+            @Nullable @ParameterName(name="excludeAlgos") final Collection<String> excludeAlgos) {
+        includedAlgorithmURIs = includeAlgos;
+        excludedAlgorithmURIs = excludeAlgos;
     }
 
     /**
@@ -195,9 +195,9 @@ public class SignatureAlgorithmValidator {
     protected void validateAlgorithmURI(@Nonnull final String algorithmURI) throws SignatureException {
         log.debug("Validating algorithm URI against whitelist and blacklist: "
                 + "algorithm: {}, whitelist: {}, blacklist: {}",
-                algorithmURI, whitelistedAlgorithmURIs, blacklistedAlgorithmURIs);
+                algorithmURI, includedAlgorithmURIs, excludedAlgorithmURIs);
         
-        if (!AlgorithmSupport.validateAlgorithmURI(algorithmURI, whitelistedAlgorithmURIs, blacklistedAlgorithmURIs)) {
+        if (!AlgorithmSupport.validateAlgorithmURI(algorithmURI, includedAlgorithmURIs, excludedAlgorithmURIs)) {
             throw new SignatureException("Algorithm failed whitelist/blacklist validation: " + algorithmURI);
         }
         
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolverTest.java
index 613692df0..66153616a 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolverTest.java
@@ -29,8 +29,6 @@ import java.util.List;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
-import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
-import org.opensaml.xmlsec.encryption.support.InlineEncryptedKeyResolver;
 
 /**
  * Test the inline encrypted key resolver.
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolverTest.java
index 85ea8ae5f..0e39f4513 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolverTest.java
@@ -30,8 +30,6 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
-import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
-import org.opensaml.xmlsec.encryption.support.SimpleRetrievalMethodEncryptedKeyResolver;
 import org.opensaml.xmlsec.mock.SignableSimpleXMLObject;
 
 /**
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolverTest.java
index df27a5b69..52ecd8c22 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AbstractSecurityParametersResolverTest.java
@@ -17,13 +17,15 @@
 
 package org.opensaml.xmlsec.impl;
 
+import static org.testng.Assert.*;
+
 import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Set;
 import java.util.function.Predicate;
 
@@ -39,12 +41,11 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
 import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration;
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration.Precedence;
-import org.opensaml.xmlsec.WhitelistBlacklistParameters;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration.Precedence;
+import org.opensaml.xmlsec.AlgorithmPolicyParameters;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 import org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory;
-import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
@@ -54,152 +55,152 @@ import org.testng.annotations.Test;
  */
 public class AbstractSecurityParametersResolverTest extends XMLObjectBaseTestCase {
     
-    private WhitelistBlacklistParametersResolver resolver;
+    private DummyParametersResolver resolver;
     
-    private BasicWhitelistBlacklistConfiguration config1, config2, config3;
-    private  WhitelistBlacklistConfigurationCriterion criterion;
+    private BasicAlgorithmPolicyConfiguration config1, config2, config3;
+    private AlgorithmPolicyConfigurationCriterion criterion;
     private CriteriaSet criteriaSet;
     private Set<String> set1, set2, set3;
     
     @BeforeMethod
     public void setUp() {
-        resolver = new WhitelistBlacklistParametersResolver();
+        resolver = new DummyParametersResolver();
         
-        config1 = new BasicWhitelistBlacklistConfiguration();
-        config2 = new BasicWhitelistBlacklistConfiguration();
-        config3 = new BasicWhitelistBlacklistConfiguration();
+        config1 = new BasicAlgorithmPolicyConfiguration();
+        config2 = new BasicAlgorithmPolicyConfiguration();
+        config3 = new BasicAlgorithmPolicyConfiguration();
         
-        criterion = new WhitelistBlacklistConfigurationCriterion(config1, config2, config3);
+        criterion = new AlgorithmPolicyConfigurationCriterion(config1, config2, config3);
         
         criteriaSet = new CriteriaSet(criterion);
         
-        set1 = new HashSet<>(Arrays.asList("A", "B", "C", "D"));
-        set2 = new HashSet<>(Arrays.asList("X", "Y", "Z"));
-        set3 = new HashSet<>(Arrays.asList("foo", "bar", "baz"));
+        set1 = Set.of("A", "B", "C", "D");
+        set2 = Set.of("X", "Y", "Z");
+        set3 = Set.of("foo", "bar", "baz");
     }
     
     @Test
     public void testBlacklistOnlyDefaults() throws ResolverException {
-        config1.setBlacklistedAlgorithms(set1);
-        config2.setBlacklistedAlgorithms(set2);
+        config1.setExcludedAlgorithms(set1);
+        config2.setExcludedAlgorithms(set2);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
         HashSet<String> control = new HashSet<>();
         control.addAll(set1);
         control.addAll(set2);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), Collections.emptySet());
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), control);
+        assertTrue(params.getIncludedAlgorithms().equals(Collections.emptySet()));
+        assertTrue(params.getExcludedAlgorithms().equals(control));
     }
     
     @Test
     public void testBlacklistOnlyNoMerge() throws ResolverException {
-        config1.setBlacklistedAlgorithms(set1);
-        config1.setBlacklistMerge(false);
-        config2.setBlacklistedAlgorithms(set2);
+        config1.setExcludedAlgorithms(set1);
+        config1.setExcludeMerge(false);
+        config2.setExcludedAlgorithms(set2);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), Collections.emptySet());
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), set1);
+        assertTrue(params.getIncludedAlgorithms().equals(Collections.emptySet()));
+        assertTrue(params.getExcludedAlgorithms().equals(set1));
     }
     
     @Test
     public void testBlacklistOnlyWithSimpleMerge() throws ResolverException {
-        config1.setBlacklistedAlgorithms(set1);
-        config1.setBlacklistMerge(true);
-        config2.setBlacklistedAlgorithms(set2);
+        config1.setExcludedAlgorithms(set1);
+        config1.setExcludeMerge(true);
+        config2.setExcludedAlgorithms(set2);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
         HashSet<String> control = new HashSet<>();
         control.addAll(set1);
         control.addAll(set2);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), Collections.emptySet());
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), control);
+        assertTrue(params.getIncludedAlgorithms().equals(Collections.emptySet()));
+        assertTrue(params.getExcludedAlgorithms().equals(control));
     }
     
     @Test
     public void testBlacklistOnlyWithTransitiveMerge() throws ResolverException {
-        config1.setBlacklistedAlgorithms(set1);
-        config1.setBlacklistMerge(true);
-        config2.setBlacklistMerge(true);
-        config3.setBlacklistedAlgorithms(set3);
+        config1.setExcludedAlgorithms(set1);
+        config1.setExcludeMerge(true);
+        config2.setExcludeMerge(true);
+        config3.setExcludedAlgorithms(set3);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
         HashSet<String> control = new HashSet<>();
         control.addAll(set1);
         control.addAll(set3);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), Collections.emptySet());
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), control);
+        assertTrue(params.getIncludedAlgorithms().equals(Collections.emptySet()));
+        assertTrue(params.getExcludedAlgorithms().equals(control));
     }
     
     @Test
     public void testWhitelistOnlyDefaults() throws ResolverException {
-        config1.setWhitelistedAlgorithms(set1);
-        config2.setWhitelistedAlgorithms(set2);
+        config1.setIncludedAlgorithms(set1);
+        config2.setIncludedAlgorithms(set2);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), set1);
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), Collections.emptySet());
+        assertTrue(params.getIncludedAlgorithms().equals(set1));
+        assertTrue(params.getExcludedAlgorithms().equals(Collections.emptySet()));
     }
     
     @Test
     public void testWhitelistOnlyWithSimpleMerge() throws ResolverException {
-        config1.setWhitelistedAlgorithms(set1);
-        config1.setWhitelistMerge(true);
-        config2.setWhitelistedAlgorithms(set2);
+        config1.setIncludedAlgorithms(set1);
+        config1.setIncludeMerge(true);
+        config2.setIncludedAlgorithms(set2);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
         HashSet<String> control = new HashSet<>();
         control.addAll(set1);
         control.addAll(set2);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), control);
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), Collections.emptySet());
+        assertTrue(params.getIncludedAlgorithms().equals(control));
+        assertTrue(params.getExcludedAlgorithms().equals(Collections.emptySet()));
     }
     
     @Test
     public void testWhitelistOnlyWithTransitiveMerge() throws ResolverException {
-        config1.setWhitelistedAlgorithms(set1);
-        config1.setWhitelistMerge(true);
-        config2.setWhitelistMerge(true);
-        config3.setWhitelistedAlgorithms(set3);
+        config1.setIncludedAlgorithms(set1);
+        config1.setIncludeMerge(true);
+        config2.setIncludeMerge(true);
+        config3.setIncludedAlgorithms(set3);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
         HashSet<String> control = new HashSet<>();
         control.addAll(set1);
         control.addAll(set3);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), control);
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), Collections.emptySet());
+        assertTrue(params.getIncludedAlgorithms().equals(control));
+        assertTrue(params.getExcludedAlgorithms().equals(Collections.emptySet()));
     }
     
     @Test
     public void testPrecedence() throws ResolverException {
-        config1.setWhitelistedAlgorithms(set1);
-        config1.setBlacklistedAlgorithms(set2);
+        config1.setIncludedAlgorithms(set1);
+        config1.setExcludedAlgorithms(set2);
         
-        config1.setWhitelistBlacklistPrecedence(Precedence.WHITELIST);
+        config1.setIncludeExcludePrecedence(Precedence.INCLUDE);
         
-        WhitelistBlacklistParameters params = resolver.resolveSingle(criteriaSet);
+        AlgorithmPolicyParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), set1);
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), Collections.emptySet());
+        assertTrue(params.getIncludedAlgorithms().equals(set1));
+        assertTrue(params.getExcludedAlgorithms().equals(Collections.emptySet()));
         
-        config1.setWhitelistBlacklistPrecedence(Precedence.BLACKLIST);
+        config1.setIncludeExcludePrecedence(Precedence.EXCLUDE);
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertEquals(params.getWhitelistedAlgorithms(), Collections.emptySet());
-        Assert.assertEquals(params.getBlacklistedAlgorithms(), set2);
+        assertTrue(params.getIncludedAlgorithms().equals(Collections.emptySet()));
+        assertTrue(params.getExcludedAlgorithms().equals(set2));
     }
 
     
@@ -207,153 +208,153 @@ public class AbstractSecurityParametersResolverTest extends XMLObjectBaseTestCas
     public void testResolvePredicate() {
         Predicate<String> predicate;
         
-        config1.setWhitelistedAlgorithms(set1);
-        config1.setBlacklistedAlgorithms(set2);
+        config1.setIncludedAlgorithms(set1);
+        config1.setExcludedAlgorithms(set2);
         
-        config1.setWhitelistBlacklistPrecedence(Precedence.WHITELIST);
+        config1.setIncludeExcludePrecedence(Precedence.INCLUDE);
         
-        predicate = resolver.resolveWhitelistBlacklistPredicate(criteriaSet, Arrays.asList(config1, config2, config3));
+        predicate = resolver.resolveIncludeExcludePredicate(criteriaSet, List.of(config1, config2, config3));
         
         // Note: Have effective whitelist based on set1
         
-        Assert.assertTrue(predicate.test("A"));
-        Assert.assertTrue(predicate.test("B"));
-        Assert.assertTrue(predicate.test("C"));
-        Assert.assertTrue(predicate.test("D"));
+        assertTrue(predicate.test("A"));
+        assertTrue(predicate.test("B"));
+        assertTrue(predicate.test("C"));
+        assertTrue(predicate.test("D"));
         
-        Assert.assertFalse(predicate.test("X"));
-        Assert.assertFalse(predicate.test("Y"));
-        Assert.assertFalse(predicate.test("Z"));
-        Assert.assertFalse(predicate.test("foo"));
-        Assert.assertFalse(predicate.test("bar"));
-        Assert.assertFalse(predicate.test("bax"));
+        assertFalse(predicate.test("X"));
+        assertFalse(predicate.test("Y"));
+        assertFalse(predicate.test("Z"));
+        assertFalse(predicate.test("foo"));
+        assertFalse(predicate.test("bar"));
+        assertFalse(predicate.test("bax"));
         
-        config1.setWhitelistBlacklistPrecedence(Precedence.BLACKLIST);
+        config1.setIncludeExcludePrecedence(Precedence.EXCLUDE);
         
-        predicate = resolver.resolveWhitelistBlacklistPredicate(criteriaSet, Arrays.asList(config1, config2, config3));
+        predicate = resolver.resolveIncludeExcludePredicate(criteriaSet, List.of(config1, config2, config3));
         
         // Note: Have effective blacklist based on set2
         
-        Assert.assertTrue(predicate.test("A"));
-        Assert.assertTrue(predicate.test("B"));
-        Assert.assertTrue(predicate.test("C"));
-        Assert.assertTrue(predicate.test("D"));
-        Assert.assertTrue(predicate.test("foo"));
-        Assert.assertTrue(predicate.test("bar"));
-        Assert.assertTrue(predicate.test("bax"));
-        
-        Assert.assertFalse(predicate.test("X"));
-        Assert.assertFalse(predicate.test("Y"));
-        Assert.assertFalse(predicate.test("Z"));
+        assertTrue(predicate.test("A"));
+        assertTrue(predicate.test("B"));
+        assertTrue(predicate.test("C"));
+        assertTrue(predicate.test("D"));
+        assertTrue(predicate.test("foo"));
+        assertTrue(predicate.test("bar"));
+        assertTrue(predicate.test("bax"));
+        
+        assertFalse(predicate.test("X"));
+        assertFalse(predicate.test("Y"));
+        assertFalse(predicate.test("Z"));
     }
     
     @Test
     public void testResolveEffectiveWhitelist() {
         Collection<String> whitelist;
         
-        whitelist = resolver.resolveEffectiveWhitelist(criteriaSet, criterion.getConfigurations());
-        Assert.assertTrue(whitelist.isEmpty());
+        whitelist = resolver.resolveEffectiveIncludes(criteriaSet, criterion.getConfigurations());
+        assertTrue(whitelist.isEmpty());
         
-        config1.setWhitelistedAlgorithms(set1);
-        config2.setWhitelistedAlgorithms(set2);
-        config3.setWhitelistedAlgorithms(set3);   
+        config1.setIncludedAlgorithms(set1);
+        config2.setIncludedAlgorithms(set2);
+        config3.setIncludedAlgorithms(set3);   
         
-        whitelist = resolver.resolveEffectiveWhitelist(criteriaSet, criterion.getConfigurations());
-        Assert.assertTrue(whitelist.containsAll(set1));
-        Assert.assertFalse(whitelist.containsAll(set2));
-        Assert.assertFalse(whitelist.containsAll(set3));
+        whitelist = resolver.resolveEffectiveIncludes(criteriaSet, criterion.getConfigurations());
+        assertTrue(whitelist.containsAll(set1));
+        assertFalse(whitelist.containsAll(set2));
+        assertFalse(whitelist.containsAll(set3));
         
-        config1.setWhitelistMerge(true);
+        config1.setIncludeMerge(true);
         
-        whitelist = resolver.resolveEffectiveWhitelist(criteriaSet, criterion.getConfigurations());
+        whitelist = resolver.resolveEffectiveIncludes(criteriaSet, criterion.getConfigurations());
         
-        Assert.assertTrue(whitelist.containsAll(set1));
-        Assert.assertTrue(whitelist.containsAll(set2));
-        Assert.assertFalse(whitelist.containsAll(set3));
+        assertTrue(whitelist.containsAll(set1));
+        assertTrue(whitelist.containsAll(set2));
+        assertFalse(whitelist.containsAll(set3));
         
-        config1.setWhitelistMerge(true);
-        config2.setWhitelistMerge(true);
+        config1.setIncludeMerge(true);
+        config2.setIncludeMerge(true);
         
-        whitelist = resolver.resolveEffectiveWhitelist(criteriaSet, criterion.getConfigurations());
+        whitelist = resolver.resolveEffectiveIncludes(criteriaSet, criterion.getConfigurations());
         
-        Assert.assertTrue(whitelist.containsAll(set1));
-        Assert.assertTrue(whitelist.containsAll(set2));
-        Assert.assertTrue(whitelist.containsAll(set3));
+        assertTrue(whitelist.containsAll(set1));
+        assertTrue(whitelist.containsAll(set2));
+        assertTrue(whitelist.containsAll(set3));
         
         
         // Set 1 and 2 empty
-        config1.setWhitelistedAlgorithms(new HashSet<String>());
-        config2.setWhitelistedAlgorithms(new HashSet<String>());
+        config1.setIncludedAlgorithms(new HashSet<String>());
+        config2.setIncludedAlgorithms(new HashSet<String>());
         
-        config1.setWhitelistMerge(true);
-        config2.setWhitelistMerge(true);
+        config1.setIncludeMerge(true);
+        config2.setIncludeMerge(true);
         
-        whitelist = resolver.resolveEffectiveWhitelist(criteriaSet, criterion.getConfigurations());
+        whitelist = resolver.resolveEffectiveIncludes(criteriaSet, criterion.getConfigurations());
         
-        Assert.assertFalse(whitelist.containsAll(set1));
-        Assert.assertFalse(whitelist.containsAll(set2));
-        Assert.assertTrue(whitelist.containsAll(set3));
+        assertFalse(whitelist.containsAll(set1));
+        assertFalse(whitelist.containsAll(set2));
+        assertTrue(whitelist.containsAll(set3));
     }
     
     @Test
     public void testResolveEffectiveBlacklist() {
         Collection<String> blacklist;
         
-        blacklist = resolver.resolveEffectiveBlacklist(criteriaSet, criterion.getConfigurations());
-        Assert.assertTrue(blacklist.isEmpty());
+        blacklist = resolver.resolveEffectiveExcludes(criteriaSet, criterion.getConfigurations());
+        assertTrue(blacklist.isEmpty());
         
-        config1.setBlacklistedAlgorithms(set1);
-        config2.setBlacklistedAlgorithms(set2);
-        config3.setBlacklistedAlgorithms(set3);   
+        config1.setExcludedAlgorithms(set1);
+        config2.setExcludedAlgorithms(set2);
+        config3.setExcludedAlgorithms(set3);   
         
-        blacklist = resolver.resolveEffectiveBlacklist(criteriaSet, criterion.getConfigurations());
-        Assert.assertTrue(blacklist.containsAll(set1));
-        Assert.assertTrue(blacklist.containsAll(set2));
-        Assert.assertTrue(blacklist.containsAll(set3));
+        blacklist = resolver.resolveEffectiveExcludes(criteriaSet, criterion.getConfigurations());
+        assertTrue(blacklist.containsAll(set1));
+        assertTrue(blacklist.containsAll(set2));
+        assertTrue(blacklist.containsAll(set3));
         
-        config2.setBlacklistMerge(false);
+        config2.setExcludeMerge(false);
         
-        blacklist = resolver.resolveEffectiveBlacklist(criteriaSet, criterion.getConfigurations());
+        blacklist = resolver.resolveEffectiveExcludes(criteriaSet, criterion.getConfigurations());
         
-        Assert.assertTrue(blacklist.containsAll(set1));
-        Assert.assertTrue(blacklist.containsAll(set2));
-        Assert.assertFalse(blacklist.containsAll(set3));
+        assertTrue(blacklist.containsAll(set1));
+        assertTrue(blacklist.containsAll(set2));
+        assertFalse(blacklist.containsAll(set3));
         
-        config1.setBlacklistMerge(false);
-        config2.setBlacklistMerge(false);
+        config1.setExcludeMerge(false);
+        config2.setExcludeMerge(false);
         
-        blacklist = resolver.resolveEffectiveBlacklist(criteriaSet, criterion.getConfigurations());
+        blacklist = resolver.resolveEffectiveExcludes(criteriaSet, criterion.getConfigurations());
         
-        Assert.assertTrue(blacklist.containsAll(set1));
-        Assert.assertFalse(blacklist.containsAll(set2));
-        Assert.assertFalse(blacklist.containsAll(set3));
+        assertTrue(blacklist.containsAll(set1));
+        assertFalse(blacklist.containsAll(set2));
+        assertFalse(blacklist.containsAll(set3));
         
         
         // Set 1 and 2 empty
-        config1.setBlacklistedAlgorithms(new HashSet<String>());
-        config2.setBlacklistedAlgorithms(new HashSet<String>());
+        config1.setExcludedAlgorithms(new HashSet<String>());
+        config2.setExcludedAlgorithms(new HashSet<String>());
         
-        config1.setBlacklistMerge(true);
-        config2.setBlacklistMerge(true);
+        config1.setExcludeMerge(true);
+        config2.setExcludeMerge(true);
         
-        blacklist = resolver.resolveEffectiveBlacklist(criteriaSet, criterion.getConfigurations());
+        blacklist = resolver.resolveEffectiveExcludes(criteriaSet, criterion.getConfigurations());
         
-        Assert.assertFalse(blacklist.containsAll(set1));
-        Assert.assertFalse(blacklist.containsAll(set2));
-        Assert.assertTrue(blacklist.containsAll(set3));
+        assertFalse(blacklist.containsAll(set1));
+        assertFalse(blacklist.containsAll(set2));
+        assertTrue(blacklist.containsAll(set3));
     }
     
     @Test
     public void testResolveEffectivePrecedence() {
-        WhitelistBlacklistConfiguration.Precedence precedence;
+        AlgorithmPolicyConfiguration.Precedence precedence;
         
-        config1.setWhitelistBlacklistPrecedence(Precedence.WHITELIST);
-        precedence = resolver.resolveWhitelistBlacklistPrecedence(criteriaSet, criterion.getConfigurations());
-        Assert.assertEquals(precedence, WhitelistBlacklistConfiguration.Precedence.WHITELIST);
+        config1.setIncludeExcludePrecedence(Precedence.INCLUDE);
+        precedence = resolver.resolveIncludeExcludePrecedence(criteriaSet, criterion.getConfigurations());
+        assertEquals(precedence, AlgorithmPolicyConfiguration.Precedence.INCLUDE);
         
-        config1.setWhitelistBlacklistPrecedence(Precedence.BLACKLIST);
-        precedence = resolver.resolveWhitelistBlacklistPrecedence(criteriaSet, criterion.getConfigurations());
-        Assert.assertEquals(precedence, WhitelistBlacklistConfiguration.Precedence.BLACKLIST);
+        config1.setIncludeExcludePrecedence(Precedence.EXCLUDE);
+        precedence = resolver.resolveIncludeExcludePrecedence(criteriaSet, criterion.getConfigurations());
+        assertEquals(precedence, AlgorithmPolicyConfiguration.Precedence.EXCLUDE);
     }
     
     @Test
@@ -365,26 +366,26 @@ public class AbstractSecurityParametersResolverTest extends XMLObjectBaseTestCas
         manager = new NamedKeyInfoGeneratorManager();
         manager.setUseDefaultManager(false);
         manager.registerDefaultFactory(new BasicKeyInfoGeneratorFactory());
-        Assert.assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, null));
-        Assert.assertNull(resolver.lookupKeyInfoGenerator(cred, manager, "test"));
+        assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, null));
+        assertNull(resolver.lookupKeyInfoGenerator(cred, manager, "test"));
         
         manager = new NamedKeyInfoGeneratorManager();
         manager.setUseDefaultManager(true);
         manager.registerDefaultFactory(new BasicKeyInfoGeneratorFactory());
-        Assert.assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, null));
-        Assert.assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, "test"));
+        assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, null));
+        assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, "test"));
         
         manager = new NamedKeyInfoGeneratorManager();
         manager.registerFactory("test", new BasicKeyInfoGeneratorFactory());
-        Assert.assertNull(resolver.lookupKeyInfoGenerator(cred, manager, null));
-        Assert.assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, "test"));
+        assertNull(resolver.lookupKeyInfoGenerator(cred, manager, null));
+        assertNotNull(resolver.lookupKeyInfoGenerator(cred, manager, "test"));
         
-        Assert.assertNull(resolver.lookupKeyInfoGenerator(cred, null, null));
-        Assert.assertNull(resolver.lookupKeyInfoGenerator(cred, null, "test"));
+        assertNull(resolver.lookupKeyInfoGenerator(cred, null, null));
+        assertNull(resolver.lookupKeyInfoGenerator(cred, null, "test"));
         
         try {
             resolver.lookupKeyInfoGenerator(null, manager, "test");
-            Assert.fail("Null credential should have thrown");
+            fail("Null credential should have thrown");
         } catch (ConstraintViolationException e) {
             // expected
         }
@@ -394,12 +395,12 @@ public class AbstractSecurityParametersResolverTest extends XMLObjectBaseTestCas
     /* Supporting classes */
     
     /** Concrete class used for testing the abstract class. */
-    public class WhitelistBlacklistParametersResolver extends AbstractSecurityParametersResolver<WhitelistBlacklistParameters> {
+    public class DummyParametersResolver extends AbstractSecurityParametersResolver<AlgorithmPolicyParameters> {
 
         /** {@inheritDoc} */
         @Nonnull
-        public Iterable<WhitelistBlacklistParameters> resolve(CriteriaSet criteria) throws ResolverException {
-            WhitelistBlacklistParameters params = resolveSingle(criteria);
+        public Iterable<AlgorithmPolicyParameters> resolve(CriteriaSet criteria) throws ResolverException {
+            AlgorithmPolicyParameters params = resolveSingle(criteria);
             if (params != null) {
                 return Collections.singletonList(params);
             }
@@ -408,10 +409,10 @@ public class AbstractSecurityParametersResolverTest extends XMLObjectBaseTestCas
 
         /** {@inheritDoc} */
         @Nullable
-        public WhitelistBlacklistParameters resolveSingle(CriteriaSet criteria) throws ResolverException {
-            WhitelistBlacklistParameters params = new WhitelistBlacklistParameters();
-            resolveAndPopulateWhiteAndBlacklists(params, criteria, 
-                    criteria.get(WhitelistBlacklistConfigurationCriterion.class).getConfigurations());
+        public AlgorithmPolicyParameters resolveSingle(CriteriaSet criteria) throws ResolverException {
+            AlgorithmPolicyParameters params = new AlgorithmPolicyParameters();
+            resolveAndPopulateIncludesExcludes(params, criteria, 
+                    criteria.get(AlgorithmPolicyConfigurationCriterion.class).getConfigurations());
             return params;
         }
         
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/WhitelistBlacklistConfigurationCriterion.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmPolicyConfigurationCriterion.java
similarity index 78%
rename from opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/WhitelistBlacklistConfigurationCriterion.java
rename to opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmPolicyConfigurationCriterion.java
index a297bbe54..399751d7a 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/WhitelistBlacklistConfigurationCriterion.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/AlgorithmPolicyConfigurationCriterion.java
@@ -28,24 +28,24 @@ import net.shibboleth.utilities.java.support.annotation.constraint.Unmodifiable;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.resolver.Criterion;
 
-import org.opensaml.xmlsec.WhitelistBlacklistConfiguration;
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration;
 
 /**
- * Criterion which holds one or more instances of {@link WhitelistBlacklistConfiguration},
+ * Criterion which holds one or more instances of {@link AlgorithmPolicyConfiguration},
  * used exclusively for testing the {@link AbstractSecurityParametersResolver}.
  */
-public class WhitelistBlacklistConfigurationCriterion implements Criterion {
+public class AlgorithmPolicyConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    private List<WhitelistBlacklistConfiguration> configs;
+    private List<AlgorithmPolicyConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public WhitelistBlacklistConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty
-            List<WhitelistBlacklistConfiguration> configurations) {
+    public AlgorithmPolicyConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty
+            final List<AlgorithmPolicyConfiguration> configurations) {
         configs = List.copyOf(Constraint.isNotNull(configurations, "List of configurations may not be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
         
@@ -56,8 +56,8 @@ public class WhitelistBlacklistConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public WhitelistBlacklistConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty
-            WhitelistBlacklistConfiguration... configurations) {
+    public AlgorithmPolicyConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty
+            final AlgorithmPolicyConfiguration... configurations) {
         configs = List.of(Constraint.isNotNull(configurations, "List of configurations may not be null"));
         Constraint.isNotEmpty(configs, "At least one configuration is required");
     }
@@ -67,7 +67,7 @@ public class WhitelistBlacklistConfigurationCriterion implements Criterion {
      * @return the list of configuration instances
      */
     @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<WhitelistBlacklistConfiguration> getConfigurations() {
+    public List<AlgorithmPolicyConfiguration> getConfigurations() {
         return configs;
     }
     
@@ -98,8 +98,8 @@ public class WhitelistBlacklistConfigurationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof WhitelistBlacklistConfigurationCriterion) {
-            return configs.equals(((WhitelistBlacklistConfigurationCriterion) obj).getConfigurations());
+        if (obj instanceof AlgorithmPolicyConfigurationCriterion) {
+            return configs.equals(((AlgorithmPolicyConfigurationCriterion) obj).getConfigurations());
         }
 
         return false;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfigurationTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfigurationTest.java
new file mode 100644
index 000000000..8b466352c
--- /dev/null
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicAlgorithmPolicyConfigurationTest.java
@@ -0,0 +1,140 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package org.opensaml.xmlsec.impl;
+
+import static org.testng.Assert.*;
+
+import java.util.Arrays;
+
+import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
+
+import org.opensaml.xmlsec.AlgorithmPolicyConfiguration.Precedence;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+public class BasicAlgorithmPolicyConfigurationTest {
+    
+    private BasicAlgorithmPolicyConfiguration config;
+    
+    @BeforeMethod
+    public void setUp() {
+        config = new BasicAlgorithmPolicyConfiguration();
+    }
+    
+    @Test
+    public void testDefaults() {
+        assertEquals(config.isIncludeMerge(), false);
+        assertNotNull(config.getIncludedAlgorithms());
+        assertTrue(config.getIncludedAlgorithms().isEmpty());
+        
+        assertEquals(config.isExcludeMerge(), true);
+        assertNotNull(config.getExcludedAlgorithms());
+        assertTrue(config.getExcludedAlgorithms().isEmpty());
+        
+        assertEquals(config.getIncludeExcludePrecedence(), Precedence.INCLUDE);
+    }
+    
+    @Test
+    public void testValidWhitelist() {
+        config.setIncludedAlgorithms(Arrays.asList("  A   ", null, "   B   ", null, "   C   "));
+        
+        assertEquals(config.getIncludedAlgorithms().size(), 3);
+        assertTrue(config.getIncludedAlgorithms().contains("A"));
+        assertTrue(config.getIncludedAlgorithms().contains("B"));
+        assertTrue(config.getIncludedAlgorithms().contains("C"));
+    }
+
+    @Test
+    public void testNullWhitelist() {
+        config.setIncludedAlgorithms(null);
+        assertNotNull(config.getIncludedAlgorithms());
+        assertTrue(config.getIncludedAlgorithms().isEmpty());
+    }
+
+    @Test(expectedExceptions=UnsupportedOperationException.class)
+    public void testWhitelistImmutable() {
+        config.setIncludedAlgorithms(Arrays.asList("A", "B", "C"));
+        config.getIncludedAlgorithms().add("D");
+    }
+
+    @Test
+    public void testWhitelistMerge() {
+        // Test default
+        assertFalse(config.isIncludeMerge());
+        
+        config.setIncludeMerge(true);
+        assertTrue(config.isIncludeMerge());
+        
+        config.setIncludeMerge(false);
+        assertFalse(config.isIncludeMerge());
+    }
+
+    @Test
+    public void testValidBlacklist() {
+        config.setExcludedAlgorithms(Arrays.asList("   A   ", null, "   B   ", null, "   C   "));
+        
+        assertEquals(config.getExcludedAlgorithms().size(), 3);
+        assertTrue(config.getExcludedAlgorithms().contains("A"));
+        assertTrue(config.getExcludedAlgorithms().contains("B"));
+        assertTrue(config.getExcludedAlgorithms().contains("C"));
+    }
+    
+    @Test
+    public void testNullBlacklist() {
+        config.setExcludedAlgorithms(null);
+        assertNotNull(config.getExcludedAlgorithms());
+        assertTrue(config.getExcludedAlgorithms().isEmpty());
+    }
+    
+    @Test(expectedExceptions=UnsupportedOperationException.class)
+    public void testBlacklistImmutable() {
+        config.setExcludedAlgorithms(Arrays.asList("A", "B", "C"));
+        config.getExcludedAlgorithms().add("D");
+    }
+    
+    @Test
+    public void testBlacklistMerge() {
+        // Test default
+        assertTrue(config.isExcludeMerge());
+        
+        config.setExcludeMerge(false);
+        assertFalse(config.isExcludeMerge());
+        
+        config.setExcludeMerge(true);
+        assertTrue(config.isExcludeMerge());
+    }
+
+    @Test
+    public void testValidPrecedence() {
+        // Test default
+        assertEquals(config.getIncludeExcludePrecedence(), Precedence.INCLUDE);
+        
+        config.setIncludeExcludePrecedence(Precedence.INCLUDE);
+        assertEquals(config.getIncludeExcludePrecedence(), Precedence.INCLUDE);
+        
+        config.setIncludeExcludePrecedence(Precedence.EXCLUDE);
+        assertEquals(config.getIncludeExcludePrecedence(), Precedence.EXCLUDE);
+    }
+    
+    @Test(expectedExceptions=ConstraintViolationException.class)
+    public void testNullPrecedence() {
+        config.setIncludeExcludePrecedence(null);
+    }
+    
+}
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java
index 952b35f4d..5bc90f0c2 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicDecryptionParametersResolverTest.java
@@ -18,14 +18,13 @@
 package org.opensaml.xmlsec.impl;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Iterator;
+import java.util.List;
 
 import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
 import net.shibboleth.utilities.java.support.resolver.ResolverException;
 
-import org.opensaml.security.credential.Credential;
 import org.opensaml.xmlsec.DecryptionParameters;
 import org.opensaml.xmlsec.criterion.DecryptionConfigurationCriterion;
 import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
@@ -57,9 +56,9 @@ public class BasicDecryptionParametersResolverTest {
     
     @BeforeClass
     public void buildResolvers() {
-        controlKeyInfoResolver1 = new StaticKeyInfoCredentialResolver(new ArrayList<Credential>());
-        controlKeyInfoResolver2 = new StaticKeyInfoCredentialResolver(new ArrayList<Credential>());
-        controlKeyInfoResolver3 = new StaticKeyInfoCredentialResolver(new ArrayList<Credential>());
+        controlKeyInfoResolver1 = new StaticKeyInfoCredentialResolver(new ArrayList<>());
+        controlKeyInfoResolver2 = new StaticKeyInfoCredentialResolver(new ArrayList<>());
+        controlKeyInfoResolver3 = new StaticKeyInfoCredentialResolver(new ArrayList<>());
         
         controlEncKeyResolver1 = new InlineEncryptedKeyResolver();
         controlEncKeyResolver2 = new InlineEncryptedKeyResolver();
@@ -156,7 +155,7 @@ public class BasicDecryptionParametersResolverTest {
     
     @Test
     public void testResolve() throws ResolverException {
-        config1.setBlacklistedAlgorithms(Arrays.asList("foo", "bar"));
+        config1.setExcludedAlgorithms(List.of("foo", "bar"));
         config1.setDataKeyInfoCredentialResolver(controlKeyInfoResolver1);
         config1.setKEKKeyInfoCredentialResolver(controlKeyInfoResolver1);
         config1.setEncryptedKeyResolver(controlEncKeyResolver1);
@@ -175,17 +174,17 @@ public class BasicDecryptionParametersResolverTest {
         Assert.assertTrue(params.getDataKeyInfoCredentialResolver() == controlKeyInfoResolver1);
         Assert.assertTrue(params.getKEKKeyInfoCredentialResolver() == controlKeyInfoResolver1);
         Assert.assertTrue(params.getEncryptedKeyResolver() == controlEncKeyResolver1);
-        Assert.assertTrue(params.getWhitelistedAlgorithms().isEmpty());
-        Assert.assertEquals(params.getBlacklistedAlgorithms().size(), 2);
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("foo"));
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("bar"));
+        Assert.assertTrue(params.getIncludedAlgorithms().isEmpty());
+        Assert.assertEquals(params.getExcludedAlgorithms().size(), 2);
+        Assert.assertTrue(params.getExcludedAlgorithms().contains("foo"));
+        Assert.assertTrue(params.getExcludedAlgorithms().contains("bar"));
         
         Assert.assertFalse(iterator.hasNext());
     }
     
     @Test
     public void testResolveSingle() throws ResolverException {
-        config1.setBlacklistedAlgorithms(Arrays.asList("foo", "bar"));
+        config1.setExcludedAlgorithms(List.of("foo", "bar"));
         config1.setDataKeyInfoCredentialResolver(controlKeyInfoResolver1);
         config1.setKEKKeyInfoCredentialResolver(controlKeyInfoResolver1);
         config1.setEncryptedKeyResolver(controlEncKeyResolver1);
@@ -196,10 +195,10 @@ public class BasicDecryptionParametersResolverTest {
         Assert.assertTrue(params.getDataKeyInfoCredentialResolver() == controlKeyInfoResolver1);
         Assert.assertTrue(params.getKEKKeyInfoCredentialResolver() == controlKeyInfoResolver1);
         Assert.assertTrue(params.getEncryptedKeyResolver() == controlEncKeyResolver1);
-        Assert.assertTrue(params.getWhitelistedAlgorithms().isEmpty());
-        Assert.assertEquals(params.getBlacklistedAlgorithms().size(), 2);
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("foo"));
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("bar"));
+        Assert.assertTrue(params.getIncludedAlgorithms().isEmpty());
+        Assert.assertEquals(params.getExcludedAlgorithms().size(), 2);
+        Assert.assertTrue(params.getExcludedAlgorithms().contains("foo"));
+        Assert.assertTrue(params.getExcludedAlgorithms().contains("bar"));
     }
     
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
index 6774c221f..def068df3 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
@@ -17,14 +17,16 @@
 
 package org.opensaml.xmlsec.impl;
 
+import static org.testng.Assert.*;
+
 import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Iterator;
+import java.util.List;
 import java.util.Map;
 
 import javax.annotation.Nullable;
@@ -49,7 +51,6 @@ import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 import org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
-import org.testng.Assert;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
@@ -110,7 +111,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         config3 = new BasicEncryptionConfiguration();
         
         // Set these as defaults on the last config in the chain, just so don't have to set in every test.
-        config3.setDataEncryptionAlgorithms(Arrays.asList(
+        config3.setDataEncryptionAlgorithms(List.of(
                 defaultAES128DataAlgo,
                 defaultAES192DataAlgo,
                 defaultAES256DataAlgo,
@@ -119,7 +120,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM,
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM
                 ));
-        config3.setKeyTransportEncryptionAlgorithms(Arrays.asList(
+        config3.setKeyTransportEncryptionAlgorithms(List.of(
                 defaultRSAKeyTransportAlgo, 
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15,
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11,
@@ -154,14 +155,14 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), defaultRSAKeyTransportAlgo);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), defaultRSAKeyTransportAlgo);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
+        assertNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
@@ -173,48 +174,48 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256);
+        assertNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
     public void testRSAWithBlacklist() throws ResolverException {
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config1.setBlacklistedAlgorithms(Arrays.asList(defaultRSAKeyTransportAlgo, defaultAES128DataAlgo, defaultAES192DataAlgo));
+        config1.setExcludedAlgorithms(List.of(defaultRSAKeyTransportAlgo, defaultAES128DataAlgo, defaultAES192DataAlgo));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES256DataAlgo);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES256DataAlgo);
+        assertNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
     public void testRSAWithWhitelist() throws ResolverException {
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config1.setWhitelistedAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
+        config1.setIncludedAlgorithms(List.of(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256);
+        assertNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
@@ -225,16 +226,16 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), defaultRSAKeyTransportAlgo);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), defaultRSAKeyTransportAlgo);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNotNull(params.getDataEncryptionCredential());
-        Assert.assertNotNull(params.getDataEncryptionCredential().getSecretKey());
-        Assert.assertEquals(KeySupport.getKeyLength(params.getDataEncryptionCredential().getSecretKey()), Integer.valueOf(128));
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
-        Assert.assertNotNull(params.getDataKeyInfoGenerator());
+        assertNotNull(params.getDataEncryptionCredential());
+        assertNotNull(params.getDataEncryptionCredential().getSecretKey());
+        assertEquals(KeySupport.getKeyLength(params.getDataEncryptionCredential().getSecretKey()), Integer.valueOf(128));
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
+        assertNotNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
@@ -245,32 +246,32 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         // Shouldn't resolve since not RSA OAEP
         config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertNull(params.getRSAOAEPParameters());
+        assertNull(params.getRSAOAEPParameters());
         
         // Should resolve an empty instance
         config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertNotNull(params.getRSAOAEPParameters());
-        Assert.assertTrue(params.getRSAOAEPParameters().isEmpty());
+        assertNotNull(params.getRSAOAEPParameters());
+        assertTrue(params.getRSAOAEPParameters().isEmpty());
         
         // Should resolve full set of values from config3
         config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
         config3.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA1, EncryptionConstants.ALGO_ID_MGF1_SHA1, "dummy-oaep-params-3"));
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertNotNull(params.getRSAOAEPParameters());
-        Assert.assertEquals(params.getRSAOAEPParameters().getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA1);
-        Assert.assertEquals(params.getRSAOAEPParameters().getMaskGenerationFunction(), EncryptionConstants.ALGO_ID_MGF1_SHA1);
-        Assert.assertEquals(params.getRSAOAEPParameters().getOAEPParams(), "dummy-oaep-params-3");
+        assertNotNull(params.getRSAOAEPParameters());
+        assertEquals(params.getRSAOAEPParameters().getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA1);
+        assertEquals(params.getRSAOAEPParameters().getMaskGenerationFunction(), EncryptionConstants.ALGO_ID_MGF1_SHA1);
+        assertEquals(params.getRSAOAEPParameters().getOAEPParams(), "dummy-oaep-params-3");
         
         // Should resolve digest and mgf from config2, OAEPParams from config3 (merged)
         config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
         config2.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA256, EncryptionConstants.ALGO_ID_MGF1_SHA256, null));
         config3.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA1, EncryptionConstants.ALGO_ID_MGF1_SHA1, "dummy-oaep-params-3"));
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertNotNull(params.getRSAOAEPParameters());
-        Assert.assertEquals(params.getRSAOAEPParameters().getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
-        Assert.assertEquals(params.getRSAOAEPParameters().getMaskGenerationFunction(), EncryptionConstants.ALGO_ID_MGF1_SHA256);
-        Assert.assertEquals(params.getRSAOAEPParameters().getOAEPParams(), "dummy-oaep-params-3");
+        assertNotNull(params.getRSAOAEPParameters());
+        assertEquals(params.getRSAOAEPParameters().getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+        assertEquals(params.getRSAOAEPParameters().getMaskGenerationFunction(), EncryptionConstants.ALGO_ID_MGF1_SHA256);
+        assertEquals(params.getRSAOAEPParameters().getOAEPParams(), "dummy-oaep-params-3");
         
         // Should resolve digest from config1, and mgf from config2 (merged), but with no merging from config3 
         config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
@@ -279,10 +280,10 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         config2.setRSAOAEPParametersMerge(false);
         config3.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA1, EncryptionConstants.ALGO_ID_MGF1_SHA1, "dummy-oaep-params-3"));
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertNotNull(params.getRSAOAEPParameters());
-        Assert.assertEquals(params.getRSAOAEPParameters().getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
-        Assert.assertEquals(params.getRSAOAEPParameters().getMaskGenerationFunction(), EncryptionConstants.ALGO_ID_MGF1_SHA256);
-        Assert.assertNull(params.getRSAOAEPParameters().getOAEPParams());
+        assertNotNull(params.getRSAOAEPParameters());
+        assertEquals(params.getRSAOAEPParameters().getDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
+        assertEquals(params.getRSAOAEPParameters().getMaskGenerationFunction(), EncryptionConstants.ALGO_ID_MGF1_SHA256);
+        assertNull(params.getRSAOAEPParameters().getOAEPParams());
         
         // Should resolve empty instance based on config1 only, with no merging
         config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
@@ -290,8 +291,8 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         config1.setRSAOAEPParametersMerge(false);
         config2.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA256, EncryptionConstants.ALGO_ID_MGF1_SHA256, "dummy-oaep-params2"));
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertNotNull(params.getRSAOAEPParameters());
-        Assert.assertTrue(params.getRSAOAEPParameters().isEmpty());
+        assertNotNull(params.getRSAOAEPParameters());
+        assertTrue(params.getRSAOAEPParameters().isEmpty());
     }
     
     @Test
@@ -300,14 +301,14 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), aes128Cred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYWRAP_AES128);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), aes128Cred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYWRAP_AES128);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
+        assertNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
@@ -316,58 +317,58 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertNull(params.getKeyTransportEncryptionCredential());
-        Assert.assertNull(params.getKeyTransportEncryptionAlgorithm());
-        Assert.assertNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertNull(params.getKeyTransportEncryptionCredential());
+        assertNull(params.getKeyTransportEncryptionAlgorithm());
+        assertNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertEquals(params.getDataEncryptionCredential(), aes256Cred1);
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES256DataAlgo);
-        Assert.assertNotNull(params.getDataKeyInfoGenerator());
+        assertEquals(params.getDataEncryptionCredential(), aes256Cred1);
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES256DataAlgo);
+        assertNotNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
     public void testKeyTransportCredWithBlacklistAndFallthrough() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Arrays.asList(rsaCred1, aes256Cred1));
+        config1.setKeyTransportEncryptionCredentials(List.of(rsaCred1, aes256Cred1));
         
         // Blacklist all RSA algos so rsaCred1 is skipped in favor of aes256Cred1
-        config1.setBlacklistedAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
+        config1.setExcludedAlgorithms(List.of(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), aes256Cred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYWRAP_AES256);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), aes256Cred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYWRAP_AES256);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
+        assertNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
     public void testDataCredOnlyWithBlacklistAndFallthrough() throws ResolverException {
-        config1.setDataEncryptionCredentials(Arrays.asList(aes128Cred1, aes256Cred1));
+        config1.setDataEncryptionCredentials(List.of(aes128Cred1, aes256Cred1));
         
         // Blacklist both AES-128 variants so aes128Cred1 is skipped in favor of aes256Cred1
-        config1.setBlacklistedAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM));
+        config1.setExcludedAlgorithms(List.of(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128, EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertNull(params.getKeyTransportEncryptionCredential());
-        Assert.assertNull(params.getKeyTransportEncryptionAlgorithm());
-        Assert.assertNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertNull(params.getKeyTransportEncryptionCredential());
+        assertNull(params.getKeyTransportEncryptionAlgorithm());
+        assertNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertEquals(params.getDataEncryptionCredential(), aes256Cred1);
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES256DataAlgo);
-        Assert.assertNotNull(params.getDataKeyInfoGenerator());
+        assertEquals(params.getDataEncryptionCredential(), aes256Cred1);
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES256DataAlgo);
+        assertNotNull(params.getDataKeyInfoGenerator());
     }
     
     @Test
     public void testKeyTransportAlgorithmPredicate() throws ResolverException {
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config1.setKeyTransportEncryptionAlgorithms(Arrays.asList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
+        config1.setKeyTransportEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
         config1.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128));
         
         // Data algorithm -> key transport algorithm preferences mappings
@@ -378,22 +379,22 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         // Without the predicate, for control
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
+        assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
         
         config1.setKeyTransportAlgorithmPredicate(predicate);
         
         // Explicit preference with predicate, mapping # 1
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP);
+        assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP);
         
         config1.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
         
         // Explicit preference with predicate, mapping # 2
         params = resolver.resolveSingle(criteriaSet);
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
+        assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15);
     }
     
     @Test
@@ -408,16 +409,16 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params.getDataKeyInfoGenerator());
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params.getDataKeyInfoGenerator());
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
         defaultDataEncryptionKeyInfoGeneratorManager.setUseDefaultManager(false);
         defaultKeyTransportKeyInfoGeneratorManager.setUseDefaultManager(false);
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params.getDataKeyInfoGenerator());
-        Assert.assertNull(params.getKeyTransportKeyInfoGenerator());
+        assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getKeyTransportKeyInfoGenerator());
         
         defaultDataEncryptionKeyInfoGeneratorManager.setUseDefaultManager(false);
         defaultKeyTransportKeyInfoGeneratorManager.setUseDefaultManager(false);
@@ -426,8 +427,8 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params.getDataKeyInfoGenerator());
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params.getDataKeyInfoGenerator());
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
     }
     
     @Test
@@ -435,68 +436,68 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
         
         Iterable<EncryptionParameters> paramsIter = resolver.resolve(criteriaSet);
-        Assert.assertNotNull(paramsIter);
+        assertNotNull(paramsIter);
         
         Iterator<EncryptionParameters> iterator = paramsIter.iterator();
-        Assert.assertNotNull(iterator);
+        assertNotNull(iterator);
         
-        Assert.assertTrue(iterator.hasNext());
+        assertTrue(iterator.hasNext());
         
         EncryptionParameters params = iterator.next();
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
-        Assert.assertEquals(params.getKeyTransportEncryptionAlgorithm(), defaultRSAKeyTransportAlgo);
-        Assert.assertNotNull(params.getKeyTransportKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getKeyTransportEncryptionCredential(), rsaCred1);
+        assertEquals(params.getKeyTransportEncryptionAlgorithm(), defaultRSAKeyTransportAlgo);
+        assertNotNull(params.getKeyTransportKeyInfoGenerator());
         
-        Assert.assertNull(params.getDataEncryptionCredential());
-        Assert.assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
-        Assert.assertNull(params.getDataKeyInfoGenerator());
+        assertNull(params.getDataEncryptionCredential());
+        assertEquals(params.getDataEncryptionAlgorithm(), defaultAES128DataAlgo);
+        assertNull(params.getDataKeyInfoGenerator());
         
-        Assert.assertFalse(iterator.hasNext());
+        assertFalse(iterator.hasNext());
     }
     
     @Test
     public void testNoCredentials() throws ResolverException {
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test
     public void testNoKeyTransportAlgorithms() throws ResolverException {
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config3.setKeyTransportEncryptionAlgorithms(new ArrayList<String>());
+        config3.setKeyTransportEncryptionAlgorithms(new ArrayList<>());
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test
     public void testNoDataEncryptionAlgorithmForResolvedDataCredential() throws ResolverException {
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
         config1.setDataEncryptionCredentials(Collections.singletonList(aes128Cred1));
-        config3.setDataEncryptionAlgorithms(new ArrayList<String>());
+        config3.setDataEncryptionAlgorithms(new ArrayList<>());
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test
     public void testNoDataEncryptionAlgorithmForEncrypterAutoGen() throws ResolverException {
         config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config3.setDataEncryptionAlgorithms(new ArrayList<String>());
+        config3.setDataEncryptionAlgorithms(new ArrayList<>());
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test
     public void testResolveKeyTransportAlgorithmPredicate() {
-        Assert.assertNull(resolver.resolveKeyTransportAlgorithmPredicate(criteriaSet));
+        assertNull(resolver.resolveKeyTransportAlgorithmPredicate(criteriaSet));
         
         final KeyTransportAlgorithmPredicate predicate = new KeyTransportAlgorithmPredicate() {
             public boolean test(@Nullable SelectionInput input) {
@@ -506,7 +507,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         
         config2.setKeyTransportAlgorithmPredicate(predicate);
         
-        Assert.assertTrue(resolver.resolveKeyTransportAlgorithmPredicate(criteriaSet) == predicate);
+        assertTrue(resolver.resolveKeyTransportAlgorithmPredicate(criteriaSet) == predicate);
     }
     
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
index 3d19229ed..a6f0c27bc 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
@@ -17,13 +17,15 @@
 
 package org.opensaml.xmlsec.impl;
 
+import static org.testng.Assert.*;
+
 import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.Iterator;
+import java.util.List;
 
 import javax.crypto.SecretKey;
 
@@ -43,7 +45,6 @@ import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
 import org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.signature.support.SignatureConstants;
-import org.testng.Assert;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
@@ -105,7 +106,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         config3 = new BasicSignatureSigningConfiguration();
         
         // Set these as defaults on the last config in the chain, just so don't have to set in every test.
-        config3.setSignatureAlgorithms(Arrays.asList(defaultRSAAlgo, defaultDSAAlgo, defaultECAlgo, defaultHMACAlgo));
+        config3.setSignatureAlgorithms(List.of(defaultRSAAlgo, defaultDSAAlgo, defaultECAlgo, defaultHMACAlgo));
         config3.setSignatureReferenceDigestMethods(Collections.singletonList(defaultReferenceDigest));
         config3.setSignatureCanonicalizationAlgorithm(defaultC14N);
         config3.setSignatureHMACOutputLength(defaultHMACOutputLength);
@@ -128,14 +129,14 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -146,56 +147,56 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
     public void testRSAWithBlacklist() throws ResolverException {
         config1.setSigningCredentials(Collections.singletonList(rsaCred));
-        config1.setBlacklistedAlgorithms(Arrays.asList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA1));
+        config1.setExcludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA1));
         
         // Deliberately putting SHA-1 variants first here.  They should be filtered out.
-        config2.setSignatureAlgorithms(Arrays.asList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
-        config2.setSignatureReferenceDigestMethods(Arrays.asList(SignatureConstants.ALGO_ID_DIGEST_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA256));
+        config2.setSignatureAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        config2.setSignatureReferenceDigestMethods(List.of(SignatureConstants.ALGO_ID_DIGEST_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA256));
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+        assertEquals(params.getSignatureReferenceDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
     public void testRSAWithWhitelist() throws ResolverException {
         config1.setSigningCredentials(Collections.singletonList(rsaCred));
-        config1.setWhitelistedAlgorithms(Arrays.asList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, SignatureConstants.ALGO_ID_DIGEST_SHA256));
+        config1.setIncludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, SignatureConstants.ALGO_ID_DIGEST_SHA256));
         
         // Deliberately putting SHA-1 variants first here.  They should be filtered out.
-        config2.setSignatureAlgorithms(Arrays.asList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
-        config2.setSignatureReferenceDigestMethods(Arrays.asList(SignatureConstants.ALGO_ID_DIGEST_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA256));
+        config2.setSignatureAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        config2.setSignatureReferenceDigestMethods(List.of(SignatureConstants.ALGO_ID_DIGEST_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA256));
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
+        assertEquals(params.getSignatureReferenceDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -204,14 +205,14 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), dsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultDSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), dsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultDSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -222,14 +223,14 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
             
             SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
             
-            Assert.assertNotNull(params);
-            Assert.assertEquals(params.getSigningCredential(), ecCred);
-            Assert.assertEquals(params.getSignatureAlgorithm(), defaultECAlgo);
-            Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-            Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-            Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-            Assert.assertNull(params.getSignatureHMACOutputLength());
-            Assert.assertNotNull(params.getKeyInfoGenerator());
+            assertNotNull(params);
+            assertEquals(params.getSigningCredential(), ecCred);
+            assertEquals(params.getSignatureAlgorithm(), defaultECAlgo);
+            assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+            assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+            assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+            assertNull(params.getSignatureHMACOutputLength());
+            assertNotNull(params.getKeyInfoGenerator());
         }
     }
     
@@ -239,14 +240,14 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), hmacCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultHMACAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertEquals(params.getSignatureHMACOutputLength(), defaultHMACOutputLength);
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), hmacCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultHMACAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertEquals(params.getSignatureHMACOutputLength(), defaultHMACOutputLength);
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -259,14 +260,14 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), hmacCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureHMACOutputLength(), Integer.valueOf(160));
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), hmacCred);
+        assertEquals(params.getSignatureAlgorithm(), SignatureConstants.ALGO_ID_MAC_HMAC_SHA256);
+        assertEquals(params.getSignatureReferenceDigestMethod(), SignatureConstants.ALGO_ID_DIGEST_SHA256);
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureHMACOutputLength(), Integer.valueOf(160));
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -277,14 +278,14 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), SignatureConstants.ALGO_ID_C14N11_WITH_COMMENTS);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), SignatureConstants.ALGO_ID_C14N11_WITH_COMMENTS);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -295,91 +296,91 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertEquals(params.getSignatureReferenceCanonicalizationAlgorithm(), SignatureConstants.TRANSFORM_C14N_EXCL_WITH_COMMENTS);
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertEquals(params.getSignatureReferenceCanonicalizationAlgorithm(), SignatureConstants.TRANSFORM_C14N_EXCL_WITH_COMMENTS);
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
     public void testMultipleCreds() throws ResolverException {
-        config1.setSigningCredentials(Arrays.asList(rsaCred, dsaCred));
+        config1.setSigningCredentials(List.of(rsaCred, dsaCred));
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
         
-        config1.setSigningCredentials(Arrays.asList(dsaCred, rsaCred));
+        config1.setSigningCredentials(List.of(dsaCred, rsaCred));
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), dsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultDSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), dsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultDSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
         
         // EC not supported in all JREs out-of-the-box.
         if (ecCred != null) {
-            config1.setSigningCredentials(Arrays.asList(ecCred, dsaCred, rsaCred));
+            config1.setSigningCredentials(List.of(ecCred, dsaCred, rsaCred));
             
             params = resolver.resolveSingle(criteriaSet);
             
-            Assert.assertNotNull(params);
-            Assert.assertEquals(params.getSigningCredential(), ecCred);
-            Assert.assertEquals(params.getSignatureAlgorithm(), defaultECAlgo);
-            Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-            Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-            Assert.assertNull(params.getSignatureHMACOutputLength());
-            Assert.assertNotNull(params.getKeyInfoGenerator());
+            assertNotNull(params);
+            assertEquals(params.getSigningCredential(), ecCred);
+            assertEquals(params.getSignatureAlgorithm(), defaultECAlgo);
+            assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+            assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+            assertNull(params.getSignatureHMACOutputLength());
+            assertNotNull(params.getKeyInfoGenerator());
         }
         
-        config1.setSigningCredentials(Arrays.asList(hmacCred, dsaCred, rsaCred));
+        config1.setSigningCredentials(List.of(hmacCred, dsaCred, rsaCred));
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), hmacCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultHMACAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertEquals(params.getSignatureHMACOutputLength(), defaultHMACOutputLength);
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), hmacCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultHMACAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertEquals(params.getSignatureHMACOutputLength(), defaultHMACOutputLength);
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
     public void testCredOverrides() throws ResolverException {
         config1.setSigningCredentials(Collections.singletonList(dsaCred));
         
-        config2.setSigningCredentials(Arrays.asList(rsaCred, dsaCred, hmacCred));
+        config2.setSigningCredentials(List.of(rsaCred, dsaCred, hmacCred));
         config2.setSignatureAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), dsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultDSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), dsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultDSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertNull(params.getSignatureReferenceCanonicalizationAlgorithm());
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -392,20 +393,20 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params.getKeyInfoGenerator());
         
         defaultKeyInfoGeneratorManager.setUseDefaultManager(false);
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params.getKeyInfoGenerator());
+        assertNull(params.getKeyInfoGenerator());
         
         defaultKeyInfoGeneratorManager.setUseDefaultManager(false);
         defaultKeyInfoGeneratorManager.registerFactory("testKeyInfoProfile", new BasicKeyInfoGeneratorFactory());
         
         params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params.getKeyInfoGenerator());
     }
     
     @Test
@@ -413,31 +414,31 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         config1.setSigningCredentials(Collections.singletonList(rsaCred));
         
         Iterable<SignatureSigningParameters> paramsIter = resolver.resolve(criteriaSet);
-        Assert.assertNotNull(paramsIter);
+        assertNotNull(paramsIter);
         
         Iterator<SignatureSigningParameters> iterator = paramsIter.iterator();
-        Assert.assertNotNull(iterator);
+        assertNotNull(iterator);
         
-        Assert.assertTrue(iterator.hasNext());
+        assertTrue(iterator.hasNext());
         
         SignatureSigningParameters params =iterator.next();
         
-        Assert.assertNotNull(params);
-        Assert.assertEquals(params.getSigningCredential(), rsaCred);
-        Assert.assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
-        Assert.assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
-        Assert.assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
-        Assert.assertNull(params.getSignatureHMACOutputLength());
-        Assert.assertNotNull(params.getKeyInfoGenerator());
+        assertNotNull(params);
+        assertEquals(params.getSigningCredential(), rsaCred);
+        assertEquals(params.getSignatureAlgorithm(), defaultRSAAlgo);
+        assertEquals(params.getSignatureReferenceDigestMethod(), defaultReferenceDigest);
+        assertEquals(params.getSignatureCanonicalizationAlgorithm(), defaultC14N);
+        assertNull(params.getSignatureHMACOutputLength());
+        assertNotNull(params.getKeyInfoGenerator());
         
-        Assert.assertFalse(iterator.hasNext());
+        assertFalse(iterator.hasNext());
     }
     
     @Test
     public void testNoCredentials() throws ResolverException {
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
+        assertNull(params);
         
-        Assert.assertNull(params);
     }
     
     @Test
@@ -447,7 +448,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test
@@ -457,7 +458,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test
@@ -467,7 +468,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNull(params);
+        assertNull(params);
     }
     
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java
index de7bf3b8e..c7e5c4ddb 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureValidationParametersResolverTest.java
@@ -17,9 +17,11 @@
 
 package org.opensaml.xmlsec.impl;
 
+import static org.testng.Assert.*;
+
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Iterator;
+import java.util.List;
 
 import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -34,7 +36,6 @@ import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoCredentialResolver;
 import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
 import org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine;
-import org.testng.Assert;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
@@ -79,64 +80,64 @@ public class BasicSignatureValidationParametersResolverTest {
         SignatureTrustEngine trustEngine;
         
         trustEngine = resolver.resolveSignatureTrustEngine(criteriaSet);
-        Assert.assertNull(trustEngine);
+        assertNull(trustEngine);
         
         config1.setSignatureTrustEngine(controlTrustEngine1);
         config2.setSignatureTrustEngine(controlTrustEngine2);
         config3.setSignatureTrustEngine(controlTrustEngine3);
         
         trustEngine = resolver.resolveSignatureTrustEngine(criteriaSet);
-        Assert.assertTrue(trustEngine == controlTrustEngine1);
+        assertTrue(trustEngine == controlTrustEngine1);
         
         config1.setSignatureTrustEngine(null);
         
         trustEngine = resolver.resolveSignatureTrustEngine(criteriaSet);
-        Assert.assertTrue(trustEngine == controlTrustEngine2);
+        assertTrue(trustEngine == controlTrustEngine2);
         
         config2.setSignatureTrustEngine(null);
         
         trustEngine = resolver.resolveSignatureTrustEngine(criteriaSet);
-        Assert.assertTrue(trustEngine == controlTrustEngine3);
+        assertTrue(trustEngine == controlTrustEngine3);
     }
 
     @Test
     public void testResolve() throws ResolverException {
-        config1.setBlacklistedAlgorithms(Arrays.asList("foo", "bar"));
+        config1.setExcludedAlgorithms(List.of("foo", "bar"));
         config1.setSignatureTrustEngine(controlTrustEngine1);
         
         Iterable<SignatureValidationParameters> paramsIter = resolver.resolve(criteriaSet);
-        Assert.assertNotNull(paramsIter);
+        assertNotNull(paramsIter);
         
         Iterator<SignatureValidationParameters> iterator = paramsIter.iterator();
-        Assert.assertNotNull(iterator);
+        assertNotNull(iterator);
         
-        Assert.assertTrue(iterator.hasNext());
+        assertTrue(iterator.hasNext());
         
         SignatureValidationParameters params =iterator.next();
         
-        Assert.assertNotNull(params);
-        Assert.assertTrue(params.getSignatureTrustEngine() == controlTrustEngine1);
-        Assert.assertTrue(params.getWhitelistedAlgorithms().isEmpty());
-        Assert.assertEquals(params.getBlacklistedAlgorithms().size(), 2);
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("foo"));
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("bar"));
+        assertNotNull(params);
+        assertTrue(params.getSignatureTrustEngine() == controlTrustEngine1);
+        assertTrue(params.getIncludedAlgorithms().isEmpty());
+        assertEquals(params.getExcludedAlgorithms().size(), 2);
+        assertTrue(params.getExcludedAlgorithms().contains("foo"));
+        assertTrue(params.getExcludedAlgorithms().contains("bar"));
         
-        Assert.assertFalse(iterator.hasNext());
+        assertFalse(iterator.hasNext());
     }
 
     @Test
     public void testResolveSingle() throws ResolverException {
-        config1.setBlacklistedAlgorithms(Arrays.asList("foo", "bar"));
+        config1.setExcludedAlgorithms(List.of("foo", "bar"));
         config1.setSignatureTrustEngine(controlTrustEngine1);
         
         SignatureValidationParameters params = resolver.resolveSingle(criteriaSet);
         
-        Assert.assertNotNull(params);
-        Assert.assertTrue(params.getSignatureTrustEngine() == controlTrustEngine1);
-        Assert.assertTrue(params.getWhitelistedAlgorithms().isEmpty());
-        Assert.assertEquals(params.getBlacklistedAlgorithms().size(), 2);
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("foo"));
-        Assert.assertTrue(params.getBlacklistedAlgorithms().contains("bar"));
+        assertNotNull(params);
+        assertTrue(params.getSignatureTrustEngine() == controlTrustEngine1);
+        assertTrue(params.getIncludedAlgorithms().isEmpty());
+        assertEquals(params.getExcludedAlgorithms().size(), 2);
+        assertTrue(params.getExcludedAlgorithms().contains("foo"));
+        assertTrue(params.getExcludedAlgorithms().contains("bar"));
     }
 
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfigurationTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfigurationTest.java
index e9485611a..a9ec8350a 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfigurationTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicWhitelistBlacklistConfigurationTest.java
@@ -18,15 +18,18 @@
 
 package org.opensaml.xmlsec.impl;
 
+import static org.testng.Assert.*;
+
 import java.util.Arrays;
+import java.util.List;
 
 import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 
 import org.opensaml.xmlsec.WhitelistBlacklistConfiguration.Precedence;
-import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+ at SuppressWarnings("removal")
 public class BasicWhitelistBlacklistConfigurationTest {
     
     private BasicWhitelistBlacklistConfiguration config;
@@ -38,97 +41,97 @@ public class BasicWhitelistBlacklistConfigurationTest {
     
     @Test
     public void testDefaults() {
-        Assert.assertEquals(config.isWhitelistMerge(), false);
-        Assert.assertNotNull(config.getWhitelistedAlgorithms());
-        Assert.assertTrue(config.getWhitelistedAlgorithms().isEmpty());
+        assertEquals(config.isWhitelistMerge(), false);
+        assertNotNull(config.getWhitelistedAlgorithms());
+        assertTrue(config.getWhitelistedAlgorithms().isEmpty());
         
-        Assert.assertEquals(config.isBlacklistMerge(), true);
-        Assert.assertNotNull(config.getBlacklistedAlgorithms());
-        Assert.assertTrue(config.getBlacklistedAlgorithms().isEmpty());
+        assertEquals(config.isBlacklistMerge(), true);
+        assertNotNull(config.getBlacklistedAlgorithms());
+        assertTrue(config.getBlacklistedAlgorithms().isEmpty());
         
-        Assert.assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.WHITELIST);
+        assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.WHITELIST);
     }
     
     @Test
     public void testValidWhitelist() {
         config.setWhitelistedAlgorithms(Arrays.asList("  A   ", null, "   B   ", null, "   C   "));
         
-        Assert.assertEquals(config.getWhitelistedAlgorithms().size(), 3);
-        Assert.assertTrue(config.getWhitelistedAlgorithms().contains("A"));
-        Assert.assertTrue(config.getWhitelistedAlgorithms().contains("B"));
-        Assert.assertTrue(config.getWhitelistedAlgorithms().contains("C"));
+        assertEquals(config.getWhitelistedAlgorithms().size(), 3);
+        assertTrue(config.getWhitelistedAlgorithms().contains("A"));
+        assertTrue(config.getWhitelistedAlgorithms().contains("B"));
+        assertTrue(config.getWhitelistedAlgorithms().contains("C"));
     }
 
     @Test
     public void testNullWhitelist() {
         config.setWhitelistedAlgorithms(null);
-        Assert.assertNotNull(config.getWhitelistedAlgorithms());
-        Assert.assertTrue(config.getWhitelistedAlgorithms().isEmpty());
+        assertNotNull(config.getWhitelistedAlgorithms());
+        assertTrue(config.getWhitelistedAlgorithms().isEmpty());
     }
 
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testWhitelistImmutable() {
-        config.setWhitelistedAlgorithms(Arrays.asList("A", "B", "C"));
+        config.setWhitelistedAlgorithms(List.of("A", "B", "C"));
         config.getWhitelistedAlgorithms().add("D");
     }
 
     @Test
     public void testWhitelistMerge() {
         // Test default
-        Assert.assertFalse(config.isWhitelistMerge());
+        assertFalse(config.isWhitelistMerge());
         
         config.setWhitelistMerge(true);
-        Assert.assertTrue(config.isWhitelistMerge());
+        assertTrue(config.isWhitelistMerge());
         
         config.setWhitelistMerge(false);
-        Assert.assertFalse(config.isWhitelistMerge());
+        assertFalse(config.isWhitelistMerge());
     }
 
     @Test
     public void testValidBlacklist() {
         config.setBlacklistedAlgorithms(Arrays.asList("   A   ", null, "   B   ", null, "   C   "));
         
-        Assert.assertEquals(config.getBlacklistedAlgorithms().size(), 3);
-        Assert.assertTrue(config.getBlacklistedAlgorithms().contains("A"));
-        Assert.assertTrue(config.getBlacklistedAlgorithms().contains("B"));
-        Assert.assertTrue(config.getBlacklistedAlgorithms().contains("C"));
+        assertEquals(config.getBlacklistedAlgorithms().size(), 3);
+        assertTrue(config.getBlacklistedAlgorithms().contains("A"));
+        assertTrue(config.getBlacklistedAlgorithms().contains("B"));
+        assertTrue(config.getBlacklistedAlgorithms().contains("C"));
     }
     
     @Test
     public void testNullBlacklist() {
         config.setBlacklistedAlgorithms(null);
-        Assert.assertNotNull(config.getBlacklistedAlgorithms());
-        Assert.assertTrue(config.getBlacklistedAlgorithms().isEmpty());
+        assertNotNull(config.getBlacklistedAlgorithms());
+        assertTrue(config.getBlacklistedAlgorithms().isEmpty());
     }
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testBlacklistImmutable() {
-        config.setBlacklistedAlgorithms(Arrays.asList("A", "B", "C"));
+        config.setBlacklistedAlgorithms(List.of("A", "B", "C"));
         config.getBlacklistedAlgorithms().add("D");
     }
     
     @Test
     public void testBlacklistMerge() {
         // Test default
-        Assert.assertTrue(config.isBlacklistMerge());
+        assertTrue(config.isBlacklistMerge());
         
         config.setBlacklistMerge(false);
-        Assert.assertFalse(config.isBlacklistMerge());
+        assertFalse(config.isBlacklistMerge());
         
         config.setBlacklistMerge(true);
-        Assert.assertTrue(config.isBlacklistMerge());
+        assertTrue(config.isBlacklistMerge());
     }
 
     @Test
     public void testValidPrecedence() {
         // Test default
-        Assert.assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.WHITELIST);
+        assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.WHITELIST);
         
         config.setWhitelistBlacklistPrecedence(Precedence.WHITELIST);
-        Assert.assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.WHITELIST);
+        assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.WHITELIST);
         
         config.setWhitelistBlacklistPrecedence(Precedence.BLACKLIST);
-        Assert.assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.BLACKLIST);
+        assertEquals(config.getWhitelistBlacklistPrecedence(), Precedence.BLACKLIST);
     }
     
     @Test(expectedExceptions=ConstraintViolationException.class)
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BlacklistPredicateTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicateTest.java
similarity index 84%
rename from opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BlacklistPredicateTest.java
rename to opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicateTest.java
index 3affb0264..b10f94298 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BlacklistPredicateTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/ExcludedAlgorithmsPredicateTest.java
@@ -17,18 +17,18 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Arrays;
+import java.util.List;
 
 import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-public class BlacklistPredicateTest {
+public class ExcludedAlgorithmsPredicateTest {
 
     @Test
     public void testBasic() {
-        BlacklistPredicate predicate = new BlacklistPredicate(Arrays.asList("A", "B", "C", "D"));
+        ExcludedAlgorithmsPredicate predicate = new ExcludedAlgorithmsPredicate(List.of("A", "B", "C", "D"));
         
         Assert.assertFalse(predicate.test("A"));
         Assert.assertFalse(predicate.test("B"));
@@ -45,12 +45,12 @@ public class BlacklistPredicateTest {
     
     @Test(expectedExceptions=ConstraintViolationException.class)
     public void testNullSet() {
-        new BlacklistPredicate(null);
+        new ExcludedAlgorithmsPredicate(null);
     }
     
     @Test(expectedExceptions=IllegalArgumentException.class)
     public void testNullArg() {
-        BlacklistPredicate predicate = new BlacklistPredicate(Arrays.asList("A", "B", "C", "D"));
+        ExcludedAlgorithmsPredicate predicate = new ExcludedAlgorithmsPredicate(List.of("A", "B", "C", "D"));
         predicate.test(null);
     }
     
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/WhitelistPredicateTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicateTest.java
similarity index 84%
rename from opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/WhitelistPredicateTest.java
rename to opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicateTest.java
index a72e59900..0161b23d1 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/WhitelistPredicateTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/IncludedAlgorithmsPredicateTest.java
@@ -17,7 +17,7 @@
 
 package org.opensaml.xmlsec.impl;
 
-import java.util.Arrays;
+import java.util.List;
 
 import net.shibboleth.utilities.java.support.logic.ConstraintViolationException;
 
@@ -27,11 +27,11 @@ import org.testng.annotations.Test;
 /**
  *
  */
-public class WhitelistPredicateTest {
+public class IncludedAlgorithmsPredicateTest {
 
     @Test
     public void testBasic() {
-        WhitelistPredicate predicate = new WhitelistPredicate(Arrays.asList("A", "B", "C", "D"));
+        IncludedAlgorithmsPredicate predicate = new IncludedAlgorithmsPredicate(List.of("A", "B", "C", "D"));
         
         Assert.assertTrue(predicate.test("A"));
         Assert.assertTrue(predicate.test("B"));
@@ -48,12 +48,12 @@ public class WhitelistPredicateTest {
     
     @Test(expectedExceptions=ConstraintViolationException.class)
     public void testNullSet() {
-        new WhitelistPredicate(null);
+        new IncludedAlgorithmsPredicate(null);
     }
     
     @Test(expectedExceptions=IllegalArgumentException.class)
     public void testNullArg() {
-        WhitelistPredicate predicate = new WhitelistPredicate(Arrays.asList("A", "B", "C", "D"));
+        IncludedAlgorithmsPredicate predicate = new IncludedAlgorithmsPredicate(List.of("A", "B", "C", "D"));
         predicate.test(null);
     }
     
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupportTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupportTest.java
index c73df93f5..552e1dd7a 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupportTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/KeyInfoSupportTest.java
@@ -44,7 +44,6 @@ import org.opensaml.core.xml.XMLObjectBaseTestCase;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.x509.X509Support;
-import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
 import org.opensaml.xmlsec.signature.DEREncodedKeyValue;
 import org.opensaml.xmlsec.signature.DSAKeyValue;
 import org.opensaml.xmlsec.signature.Exponent;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java
index e9e2fccd6..f08c01254 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/BasicKeyInfoGeneratorTest.java
@@ -30,7 +30,6 @@ import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
-import org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
 /**
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/CertChainX509DataTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/CertChainX509DataTest.java
index 1fcd79bb8..7c51fa465 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/CertChainX509DataTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/CertChainX509DataTest.java
@@ -40,8 +40,6 @@ import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509Support;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
-import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
 import org.opensaml.xmlsec.signature.KeyInfo;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/DSAKeyValueTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/DSAKeyValueTest.java
index 6abbe0573..1e255326c 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/DSAKeyValueTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/DSAKeyValueTest.java
@@ -34,8 +34,6 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
-import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoGeneratorManagerTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoGeneratorManagerTest.java
index fda3290c2..da26f853d 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoGeneratorManagerTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/KeyInfoGeneratorManagerTest.java
@@ -35,8 +35,6 @@ import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager;
-import org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory;
-import org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory;
 
 /**
  * Test the KeyInfoGeneratorFactory manager.
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolverTest.java
index 5b01b8197..593b4d2d1 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/LocalKeyInfoCredentialResolverTest.java
@@ -36,8 +36,6 @@ import org.opensaml.security.credential.impl.CollectionCredentialResolver;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
-import org.opensaml.xmlsec.keyinfo.impl.LocalKeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java
index 3f5cb8c11..424290483 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/NamedKeyInfoGeneratorManagerTest.java
@@ -34,8 +34,6 @@ import org.opensaml.security.x509.X509Credential;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGeneratorManager;
 import org.opensaml.xmlsec.keyinfo.NamedKeyInfoGeneratorManager;
-import org.opensaml.xmlsec.keyinfo.impl.BasicKeyInfoGeneratorFactory;
-import org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory;
 
 /**
  * Test the NamedKeyInfoGeneratorFactory manager.
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/RSAKeyValueTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/RSAKeyValueTest.java
index 87995b2d3..724086bac 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/RSAKeyValueTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/RSAKeyValueTest.java
@@ -34,8 +34,6 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
-import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.RSAKeyValueProvider;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/SingleCertX509DataTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/SingleCertX509DataTest.java
index 72458392d..576fe3b15 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/SingleCertX509DataTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/SingleCertX509DataTest.java
@@ -36,8 +36,6 @@ import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509Support;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCriterion;
-import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
-import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
 import org.opensaml.xmlsec.keyinfo.impl.provider.InlineX509DataProvider;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGeneratorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGeneratorTest.java
index 3d652a4d8..26ce581b1 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGeneratorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/StaticKeyInfoGeneratorTest.java
@@ -30,7 +30,6 @@ import org.opensaml.security.SecurityException;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
-import org.opensaml.xmlsec.keyinfo.impl.StaticKeyInfoGenerator;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.KeyName;
 import org.w3c.dom.Element;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java
index 93dab21ea..568ef4977 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/X509KeyInfoGeneratorTest.java
@@ -44,7 +44,6 @@ import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509Support;
 import org.opensaml.xmlsec.keyinfo.KeyInfoGenerator;
 import org.opensaml.xmlsec.keyinfo.KeyInfoSupport;
-import org.opensaml.xmlsec.keyinfo.impl.X509KeyInfoGeneratorFactory;
 import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.X509Data;
 import org.opensaml.xmlsec.signature.X509Digest;
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngineTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngineTest.java
index 55cbae351..8999a9c5e 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngineTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/ExplicitKeySignatureTrustEngineTest.java
@@ -240,7 +240,7 @@ public class ExplicitKeySignatureTrustEngineTest extends XMLObjectBaseTestCase {
         algos.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
         algos.add(SignatureConstants.ALGO_ID_DIGEST_SHA1);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setWhitelistedAlgorithms(algos);
+        validationParams.setIncludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         SignableXMLObject signableXO = getValidSignedObject();
@@ -259,7 +259,7 @@ public class ExplicitKeySignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setBlacklistedAlgorithms(algos);
+        validationParams.setExcludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         SignableXMLObject signableXO = getValidSignedObject();
@@ -278,7 +278,7 @@ public class ExplicitKeySignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(SignatureConstants.ALGO_ID_DIGEST_SHA1);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setBlacklistedAlgorithms(algos);
+        validationParams.setExcludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         SignableXMLObject signableXO = getValidSignedObject();
@@ -349,7 +349,7 @@ public class ExplicitKeySignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(rawAlgorithmURI);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setWhitelistedAlgorithms(algos);
+        validationParams.setIncludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         Assert.assertTrue(engine.validate(rawControlSignature, rawData.getBytes(), rawAlgorithmURI, 
@@ -369,7 +369,7 @@ public class ExplicitKeySignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(rawAlgorithmURI);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setBlacklistedAlgorithms(algos);
+        validationParams.setExcludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         Assert.assertFalse(engine.validate(rawControlSignature, rawData.getBytes(), rawAlgorithmURI, 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java
index 2ce4303cc..b2dc9d518 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/impl/PKIXSignatureTrustEngineTest.java
@@ -259,7 +259,7 @@ public class PKIXSignatureTrustEngineTest extends XMLObjectBaseTestCase {
         algos.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
         algos.add(SignatureConstants.ALGO_ID_DIGEST_SHA1);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setWhitelistedAlgorithms(algos);
+        validationParams.setIncludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         signature = getSignature("foo-1A1-good.crt", "foo-1A1-good.key");
@@ -277,7 +277,7 @@ public class PKIXSignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setBlacklistedAlgorithms(algos);
+        validationParams.setExcludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         signature = getSignature("foo-1A1-good.crt", "foo-1A1-good.key");
@@ -295,7 +295,7 @@ public class PKIXSignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(SignatureConstants.ALGO_ID_DIGEST_SHA1);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setBlacklistedAlgorithms(algos);
+        validationParams.setExcludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         signature = getSignature("foo-1A1-good.crt", "foo-1A1-good.key");
@@ -459,7 +459,7 @@ public class PKIXSignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(rawAlgorithmURI);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setWhitelistedAlgorithms(algos);
+        validationParams.setIncludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         rawCandidateCred = getCredential("foo-1A1-good.crt", "foo-1A1-good.key");
@@ -478,7 +478,7 @@ public class PKIXSignatureTrustEngineTest extends XMLObjectBaseTestCase {
         HashSet<String> algos = new HashSet<>();
         algos.add(rawAlgorithmURI);
         SignatureValidationParameters validationParams = new SignatureValidationParameters();
-        validationParams.setBlacklistedAlgorithms(algos);
+        validationParams.setExcludedAlgorithms(algos);
         criteriaSet.add(new SignatureValidationParametersCriterion(validationParams));
         
         rawCandidateCred = getCredential("foo-1A1-good.crt", "foo-1A1-good.key");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list