[java-identity-provider] branch main updated: IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f4323376878d59f50360c7f5a9814fd94864d3a0

The following commit(s) were added to refs/heads/main by this push:
       new  f43233768 IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
f43233768 is described below

commit f4323376878d59f50360c7f5a9814fd94864d3a0
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Nov 6 12:54:14 2020 -0500

    IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
    
    Enhance to sanity check the inputs around revocation checking.
---
 .../spring/factory/StaticPKIXFactoryBean.java      | 35 +++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
index 058ed590a..17af5255c 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
@@ -19,6 +19,7 @@ package net.shibboleth.idp.profile.spring.factory;
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.security.Security;
 import java.security.cert.CRLException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509CRL;
@@ -37,6 +38,7 @@ import org.opensaml.security.x509.X509Support;
 import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
 import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
 import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
+import org.opensaml.security.x509.impl.CertPathPKIXValidationOptions;
 import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
 import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
 import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
@@ -48,6 +50,7 @@ import org.springframework.core.io.Resource;
 
 import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
 /**
  * File system specific bean for PKIXX509CredentialTrustEngine.
@@ -238,7 +241,37 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
                 credentialNameEvaluator != null ? credentialNameEvaluator :
                     (checkNames ? new BasicX509CredentialNameEvaluator() : null);
 
+        validateConfiguration(pkixTrustEvaluator);
+
         return new PKIXX509CredentialTrustEngine(resolver, pkixTrustEvaluator, credNameEvaluator);
     }
-    
+
+    /**
+     * Validate the configuration of the effective {@link PKIXTrustEvaluator}.
+     *
+     * @param pkixTrustEvaluator the instance whose configuration is to be evaluated
+     *
+     * @throws Exception if configuration issues are encountered
+     */
+    protected void validateConfiguration(@Nonnull final PKIXTrustEvaluator pkixTrustEvaluator) throws Exception {
+        if (CertPathPKIXTrustEvaluator.class.isInstance(pkixTrustEvaluator)
+                && CertPathPKIXValidationOptions.class.isInstance(pkixTrustEvaluator.getPKIXValidationOptions())) {
+            
+            final CertPathPKIXValidationOptions certPathOptions =
+                    CertPathPKIXValidationOptions.class.cast(pkixTrustEvaluator.getPKIXValidationOptions());
+
+           if (certPathOptions.isForceRevocationEnabled() && certPathOptions.isRevocationEnabled()
+                   && getCRLs().isEmpty()
+                   && ! Boolean.getBoolean("com.sun.security.enableCRLDP")
+                   && ! "true".equalsIgnoreCase(StringSupport.trimOrNull(Security.getProperty("oscp.enable"))) ) {
+
+               log.error("Certificate revocation checking was force enabled, "
+                       + "but no static CRLs were supplied and both CRLDP and OCSP processing is disabled");
+
+               throw new FatalBeanException("Certificate revocation checking was force enabled, "
+                       + "but no static CRLs were supplied and both CRLDP and OCSP processing is disabled");
+           }
+        }
+    }
+
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.