[java-identity-provider] branch main updated: IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=84e1a379d3af1072a4e770aedb5b516fe6e22983

The following commit(s) were added to refs/heads/main by this push:
       new  84e1a379d IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
84e1a379d is described below

commit 84e1a379d3af1072a4e770aedb5b516fe6e22983
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Oct 30 21:28:48 2020 -0400

    IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
    
    Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator and
    X509CredentialNameEvaluator.
---
 .../spring/factory/StaticPKIXFactoryBean.java      | 65 ++++++++++++++++++----
 1 file changed, 55 insertions(+), 10 deletions(-)

diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
index 7ac5997d2..058ed590a 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
@@ -32,10 +32,14 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import org.opensaml.security.x509.PKIXTrustEvaluator;
 import org.opensaml.security.x509.X509Support;
 import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
+import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
+import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
 import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
 import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
+import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.FatalBeanException;
@@ -67,9 +71,17 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
     /** Explicit subject name(s) to match. */
     @Nullable private Set<String> trustedNames;
     
-    /** Whether to enable name checking. */
+    /** Whether to enable name checking. If true a default implementation will be used.
+     * See also: {@link #credentialNameEvaluator}. */
     private boolean checkNames;
-    
+
+    /** Custom instance of {@link PKIXTrustEvaluator} to use. */
+    private PKIXTrustEvaluator trustEvaluator;
+
+    /** Custom instance of {@link X509CredentialNameEvaluator} to use.
+     * A non-null value overrides {@link #checkNames}. */
+    private X509CredentialNameEvaluator credentialNameEvaluator;
+
     /** Constructor. */
     public StaticPKIXFactoryBean() {
         checkNames = true;
@@ -110,10 +122,17 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
 
     /**
      * Set whether the perform name checking in the PKIX layer.
-     * 
+     *
+     * <p>
      * Defaults to "true", should generally be disabled when used with an HTTP client
      * that is already checking names.
-     * 
+     * </p>
+     *
+     * <p>
+     * If true a default implementation will be used unless a specific name evaluator impl has been supplied.
+     * See also: {@link #setCredentialNameEvaluator(X509CredentialNameEvaluator)}.
+     * </p>
+     *
      * @param flag flag to set
      * 
      * @since 3.4.0
@@ -136,7 +155,29 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
             trustedNames = null;
         }
     }
-    
+
+    /**
+     * Set the custom instance of {@link PKIXTrustEvaluator} to use.
+     *
+     * @param evaluator The trustEvaluator to set.
+     */
+    public void setTrustEvaluator(@Nullable final PKIXTrustEvaluator evaluator) {
+        trustEvaluator = evaluator;
+    }
+
+    /**
+     * Set the custom instance of {@link X509CredentialNameEvaluator} to use.
+     *
+     * <p>
+     * A non-null value overrides {@link #setCheckNames(boolean)}.
+     * </p>
+     *
+     * @param evaluator The credentialNameEvaluator to set.
+     */
+    public void setCredentialNameEvaluator(@Nullable final X509CredentialNameEvaluator evaluator) {
+        credentialNameEvaluator = evaluator;
+    }
+
     /**
      * Get the configured certificates.
      * 
@@ -189,11 +230,15 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
         
         final StaticPKIXValidationInformationResolver resolver =
                 new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames, checkNames);
-        
-        if (checkNames) {
-            return new PKIXX509CredentialTrustEngine(resolver);
-        }
-        return new PKIXX509CredentialTrustEngine(resolver, null);
+
+        final PKIXTrustEvaluator pkixTrustEvaluator =
+                trustEvaluator != null ? trustEvaluator : new CertPathPKIXTrustEvaluator();
+
+        final X509CredentialNameEvaluator credNameEvaluator =
+                credentialNameEvaluator != null ? credentialNameEvaluator :
+                    (checkNames ? new BasicX509CredentialNameEvaluator() : null);
+
+        return new PKIXX509CredentialTrustEngine(resolver, pkixTrustEvaluator, credNameEvaluator);
     }
     
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.