[java-identity-provider] branch main updated: IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
Brent Putman
putmanb at georgetown.edu
Thu Mar 11 22:45:37 UTC 2021
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=9dca1611478516823d38f052c5ef292a07807c54
The following commit(s) were added to refs/heads/main by this push:
new 9dca16114 IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
9dca16114 is described below
commit 9dca1611478516823d38f052c5ef292a07807c54
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Mar 11 17:44:10 2021 -0500
IDP-1706: Enhance StaticPKIXFactoryBean to support PKIXTrustEvaluator...
Add unit tests.
---
.../spring/factory/StaticPKIXFactoryBeanTest.java | 132 +++++++++++++++++++++
.../static-pkix-factory-custom-failsValidation.xml | 33 ++++++
.../factory/static-pkix-factory-custom-success.xml | 30 +++++
.../factory/static-pkix-factory-defaults.xml | 24 ++++
4 files changed, 219 insertions(+)
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBeanTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBeanTest.java
new file mode 100644
index 000000000..5b3023266
--- /dev/null
+++ b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBeanTest.java
@@ -0,0 +1,132 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.profile.spring.factory;
+
+import java.util.Set;
+
+import org.opensaml.security.SecurityException;
+import org.opensaml.security.x509.PKIXTrustEvaluator;
+import org.opensaml.security.x509.PKIXValidationInformation;
+import org.opensaml.security.x509.PKIXValidationOptions;
+import org.opensaml.security.x509.X509Credential;
+import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
+import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
+import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
+import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
+import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
+import org.springframework.beans.FatalBeanException;
+import org.springframework.context.support.GenericApplicationContext;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext;
+import net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader;
+
+/**
+ *
+ */
+ at SuppressWarnings("javadoc")
+public class StaticPKIXFactoryBeanTest {
+
+ @Test
+ public void defaults() {
+ final GenericApplicationContext context = new FilesystemGenericApplicationContext();
+ context.setDisplayName("ApplicationContext: X509Credential");
+ final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
+ new SchemaTypeAwareXMLBeanDefinitionReader(context);
+
+ beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/static-pkix-factory-defaults.xml");
+
+ context.refresh();
+
+ final PKIXX509CredentialTrustEngine trustEngine = context.getBean("StaticPKIXX509CredentialTrustEngine",
+ PKIXX509CredentialTrustEngine.class);
+
+ Assert.assertNotNull(trustEngine);
+
+ Assert.assertTrue(StaticPKIXValidationInformationResolver.class.isInstance((trustEngine.getPKIXResolver())));
+
+ Assert.assertTrue(CertPathPKIXTrustEvaluator.class.isInstance((trustEngine.getPKIXTrustEvaluator())));
+
+ Assert.assertTrue(BasicX509CredentialNameEvaluator.class.isInstance((trustEngine.getX509CredentialNameEvaluator())));
+ }
+
+ @Test
+ public void customPropertiesSuccess() {
+ final GenericApplicationContext context = new FilesystemGenericApplicationContext();
+ context.setDisplayName("ApplicationContext: X509Credential");
+ final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
+ new SchemaTypeAwareXMLBeanDefinitionReader(context);
+
+ beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-success.xml");
+
+ context.refresh();
+
+ final PKIXX509CredentialTrustEngine trustEngine = context.getBean("StaticPKIXX509CredentialTrustEngine",
+ PKIXX509CredentialTrustEngine.class);
+
+ Assert.assertNotNull(trustEngine);
+
+ Assert.assertTrue(StaticPKIXValidationInformationResolver.class.isInstance((trustEngine.getPKIXResolver())));
+
+ Assert.assertTrue(MockPKIXTrustEvaluator.class.isInstance((trustEngine.getPKIXTrustEvaluator())));
+
+ Assert.assertTrue(MockX509CredentialNameEvaluator.class.isInstance((trustEngine.getX509CredentialNameEvaluator())));
+ }
+
+ @Test(expectedExceptions=FatalBeanException.class)
+ public void customPropertiesFailsValidation() {
+ final GenericApplicationContext context = new FilesystemGenericApplicationContext();
+ context.setDisplayName("ApplicationContext: X509Credential");
+ final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
+ new SchemaTypeAwareXMLBeanDefinitionReader(context);
+
+ beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-failsValidation.xml");
+
+ context.refresh();
+ }
+
+
+ //
+ // Helpers
+ //
+
+ public static class MockPKIXTrustEvaluator implements PKIXTrustEvaluator {
+
+ /** {@inheritDoc} */
+ public boolean validate(PKIXValidationInformation validationInfo, X509Credential untrustedCredential)
+ throws SecurityException {
+ return false;
+ }
+
+ /** {@inheritDoc} */
+ public PKIXValidationOptions getPKIXValidationOptions() {
+ return null;
+ }
+
+ }
+
+ public static class MockX509CredentialNameEvaluator implements X509CredentialNameEvaluator {
+
+ /** {@inheritDoc} */
+ public boolean evaluate(X509Credential credential, Set<String> trustedNames) throws SecurityException {
+ return false;
+ }
+
+ }
+}
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-failsValidation.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-failsValidation.xml
new file mode 100644
index 000000000..8960775e3
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-failsValidation.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean id="StaticPKIXX509CredentialTrustEngine"
+ class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean">
+ <property name="certificates">
+ <list>
+ <value>classpath:net/shibboleth/idp/profile/spring/factory/idp-signing.crt</value>
+ </list>
+ </property>
+ <property name="trustEvaluator">
+ <bean class="org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator">
+ <property name="PKIXValidationOptions">
+ <bean class="org.opensaml.security.x509.impl.CertPathPKIXValidationOptions"
+ p:forceRevocationEnabled="true"
+ p:revocationEnabled="true" />
+ </property>
+ </bean>
+ </property>
+ </bean>
+
+</beans>
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-success.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-success.xml
new file mode 100644
index 000000000..9f4ae76cb
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-success.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean id="StaticPKIXX509CredentialTrustEngine"
+ class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean">
+ <property name="certificates">
+ <list>
+ <value>classpath:net/shibboleth/idp/profile/spring/factory/idp-signing.crt</value>
+ </list>
+ </property>
+ <property name="trustEvaluator">
+ <bean class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBeanTest.MockPKIXTrustEvaluator" />
+ </property>
+ <property name="credentialNameEvaluator">
+ <bean class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBeanTest.MockX509CredentialNameEvaluator" />
+ </property>
+ </bean>
+
+</beans>
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-defaults.xml b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-defaults.xml
new file mode 100644
index 000000000..49f37e0c6
--- /dev/null
+++ b/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/factory/static-pkix-factory-defaults.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"
+
+ default-init-method="initialize"
+ default-destroy-method="destroy">
+
+ <bean id="StaticPKIXX509CredentialTrustEngine"
+ class="net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean">
+ <property name="certificates">
+ <list>
+ <value>classpath:net/shibboleth/idp/profile/spring/factory/idp-signing.crt</value>
+ </list>
+ </property>
+ </bean>
+
+</beans>
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list