[java-identity-provider] 01/01: Remove security namespace support + factory beans, start refactor.
Scott Cantor
cantor.2 at osu.edu
Thu Jun 23 14:12:26 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch dev/IDP-1960
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=73ab8efd0359937aad7aa26109992dd69e777aac
commit 73ab8efd0359937aad7aa26109992dd69e777aac
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 23 10:12:21 2022 -0400
Remove security namespace support + factory beans, start refactor.
---
.../impl/RelyingPartyConditionFactory.java | 64 +++++
.../dc/http/impl/HTTPDataConnectorParser.java | 6 +-
.../dc/ldap/impl/LDAPDataConnectorParser.java | 2 +-
idp-profile-spring/pom.xml | 4 +
.../AbstractBasicCredentialFactoryBean.java | 207 ---------------
.../factory/AbstractCredentialFactoryBean.java | 144 -----------
.../factory/AbstractX509CredentialFactoryBean.java | 133 ----------
.../factory/BasicInlineCredentialFactoryBean.java | 126 ----------
.../BasicResourceCredentialFactoryBean.java | 147 -----------
.../factory/BasicX509CredentialFactoryBean.java | 224 -----------------
.../factory/StaticExplicitKeyFactoryBean.java | 140 -----------
.../spring/factory/StaticPKIXFactoryBean.java | 277 ---------------------
.../factory/X509InlineCredentialFactoryBean.java | 147 -----------
.../filter/impl/SignatureValidationParser.java | 4 +-
.../impl/AbstractBasicCredentialParser.java | 163 ------------
.../credential/impl/AbstractCredentialParser.java | 94 -------
.../impl/AbstractX509CredentialParser.java | 141 -----------
.../impl/BasicInlineCredentialParser.java | 39 ---
.../impl/BasicResourceCredentialParser.java | 40 ---
.../impl/X509InlineCredentialParser.java | 38 ---
.../impl/X509ResourceCredentialParser.java | 41 ---
.../security/credential/impl/package-info.java | 22 --
.../security/impl/SecurityNamespaceHandler.java | 83 ------
.../relyingparty/security/impl/package-info.java | 26 --
...AbstractBasicPKIXValidationInfoFactoryBean.java | 103 --------
.../trustengine/impl/AbstractChainingParser.java | 62 -----
.../impl/AbstractPKIXValidationInfoParser.java | 78 ------
.../trustengine/impl/AbstractStaticPKIXParser.java | 154 ------------
.../impl/AbstractTrustEngineParser.java | 44 ----
.../impl/CertPathPKIXValidationOptionsParser.java | 89 -------
.../security/trustengine/impl/ChainingParser.java | 38 ---
.../impl/ChainingSignatureTrustEngineFactory.java | 69 -----
.../impl/ChainingTrustEngineFactory.java | 70 ------
.../impl/PKIXInlineValidationInfoFactoryBean.java | 107 --------
.../impl/PKIXInlineValidationInfoParser.java | 43 ----
.../PKIXResourceValidationInfoFactoryBean.java | 112 ---------
.../impl/PKIXResourceValidationInfoParser.java | 44 ----
.../impl/PKIXValidationOptionsParser.java | 76 ------
.../trustengine/impl/SignatureChainingParser.java | 39 ---
.../trustengine/impl/StaticExplicitKeyParser.java | 63 -----
.../impl/StaticExplicitKeySignatureParser.java | 67 -----
.../impl/StaticPKIXSignatureParser.java | 67 -----
.../impl/StaticPKIXX509CredentialParser.java | 63 -----
.../security/trustengine/impl/package-info.java | 22 --
.../src/main/resources/META-INF/spring.handlers | 1 -
.../BasicX509CredentialFactoryBeanTest.java | 60 -----
.../spring/factory/StaticPKIXFactoryBeanTest.java | 132 ----------
.../security/AbstractSecurityParserTest.java | 97 --------
.../security/credential/BasicInlineParserTest.java | 71 ------
.../credential/BasicResourceParserTest.java | 80 ------
.../credential/X509FilesystemParserTest.java | 88 -------
.../security/credential/X509InlineParserTest.java | 62 -----
.../trustengine/ChainingTrustEngineTest.java | 50 ----
.../security/trustengine/MockTrustEngine.java | 44 ----
.../trustengine/PKIXFilesystemParserTest.java | 52 ----
.../security/trustengine/PKIXInlineParserTest.java | 53 ----
.../PKIXValidationOptionsParserTest.java | 54 ----
.../trustengine/SignatureChainingParserTest.java | 56 -----
.../StaticExplicitKeyFactoryBeanTest.java | 97 --------
.../trustengine/StaticExplicitKeyParserTest.java | 52 ----
.../StaticExplicitKeySignatureParserTest.java | 52 ----
.../trustengine/StaticPKIXSignatureParserTest.java | 163 ------------
.../StaticPKIXX509CredentialParserTest.java | 116 ---------
63 files changed, 74 insertions(+), 5028 deletions(-)
diff --git a/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/transcoding/impl/RelyingPartyConditionFactory.java b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/transcoding/impl/RelyingPartyConditionFactory.java
new file mode 100644
index 000000000..22613a2eb
--- /dev/null
+++ b/idp-attribute-impl/src/main/java/net/shibboleth/idp/attribute/transcoding/impl/RelyingPartyConditionFactory.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.attribute.transcoding.impl;
+
+import java.util.Collection;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.function.Predicate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.idp.profile.logic.RelyingPartyIdPredicate;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+
+/**
+ * Factory class that processes the IdP-specific {@link AttributeTranscoderRegistry.PROP_RELYINGPARTIES}
+ * rule property on behalf of the IdP-agnostic {@link AttributeTranscoderRegistry} implementation.
+ *
+ *@ since 5.0.0
+ */
+public class RelyingPartyConditionFactory implements Function<Map<String,Object>,Predicate<ProfileRequestContext>> {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(RelyingPartyConditionFactory.class);
+
+ /** {@inheritDoc} */
+ @Nullable public Predicate<ProfileRequestContext> apply(@Nullable final Map<String, Object> input) {
+ final Object relyingParties = input.get(AttributeTranscoderRegistry.PROP_RELYINGPARTIES);
+ if (relyingParties instanceof Collection) {
+ return new RelyingPartyIdPredicate((Collection<String>) relyingParties);
+ } else if (relyingParties instanceof String) {
+ final Collection<String> parsed = StringSupport.normalizeStringCollection(
+ StringSupport.stringToList((String) relyingParties, " "));
+ return new RelyingPartyIdPredicate(parsed);
+ } else if (relyingParties != null) {
+ log.error("{} property did not contain a Collection or String, ignored",
+ AttributeTranscoderRegistry.PROP_RELYINGPARTIES);
+ }
+
+ return null;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java
index 045dc96e9..13e8d196e 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java
@@ -31,9 +31,6 @@ import net.shibboleth.idp.attribute.resolver.dc.http.impl.TemplatedURLBuilder;
import net.shibboleth.idp.attribute.resolver.spring.dc.AbstractDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.impl.CacheConfigParser;
import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
-import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
-import net.shibboleth.idp.profile.spring.factory.StaticExplicitKeyFactoryBean;
-import net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.ScriptTypeBeanParser;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.logic.Constraint;
@@ -42,6 +39,9 @@ import net.shibboleth.utilities.java.support.xml.AttributeSupport;
import net.shibboleth.utilities.java.support.xml.ElementSupport;
import org.opensaml.security.httpclient.HttpClientSecurityParameters;
+import org.opensaml.spring.credential.BasicX509CredentialFactoryBean;
+import org.opensaml.spring.trust.StaticExplicitKeyFactoryBean;
+import org.opensaml.spring.trust.StaticPKIXFactoryBean;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.config.BeanDefinition;
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index f26eeb1b1..186a713c9 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -54,6 +54,7 @@ import org.ldaptive.sasl.SaslConfig;
import org.ldaptive.ssl.AllowAnyHostnameVerifier;
import org.ldaptive.ssl.CertificateHostnameVerifier;
import org.ldaptive.ssl.SslConfig;
+import org.opensaml.spring.credential.BasicX509CredentialFactoryBean;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.config.BeanDefinition;
@@ -70,7 +71,6 @@ import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector;
import net.shibboleth.idp.attribute.resolver.spring.dc.AbstractDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.impl.CacheConfigParser;
import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
-import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
import net.shibboleth.utilities.java.support.logic.Constraint;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
diff --git a/idp-profile-spring/pom.xml b/idp-profile-spring/pom.xml
index d2a69a06f..e0d4ccc4e 100644
--- a/idp-profile-spring/pom.xml
+++ b/idp-profile-spring/pom.xml
@@ -104,6 +104,10 @@
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-security-impl</artifactId>
</dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-spring</artifactId>
+ </dependency>
<dependency>
<groupId>${opensaml.groupId}</groupId>
<artifactId>opensaml-xmlsec-api</artifactId>
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractBasicCredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractBasicCredentialFactoryBean.java
deleted file mode 100644
index 29942a758..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractBasicCredentialFactoryBean.java
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.io.UnsupportedEncodingException;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.crypto.SecretKey;
-
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-import org.apache.commons.codec.binary.Base64;
-import org.bouncycastle.util.encoders.Hex;
-import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.crypto.KeySupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.BeanCreationException;
-
-/**
- * A factory bean to collect information to do with a {@link BasicCredential}.
- */
-public abstract class AbstractBasicCredentialFactoryBean extends AbstractCredentialFactoryBean<BasicCredential> {
-
- /** Form of encoding for SecretKey info. */
- public enum SecretKeyEncoding {
- /** Raw binary encoding. */
- binary,
- /** Hexidecimal encoding. */
- hex,
- /** Base64 encoding. */
- base64
- }
-
- /** Log. */
- private final Logger log = LoggerFactory.getLogger(AbstractBasicCredentialFactoryBean.class);
-
- /** The SecretKey algorithm. */
- @Nullable private String secretKeyAlgorithm;
-
- /** The SecretKey encoding used. */
- @Nullable private SecretKeyEncoding secretKeyEncoding = SecretKeyEncoding.base64;
-
- /**
- * Decode the SecretKey data, based on the specified encoding.
- *
- * @param data the Secret key data
- * @return the decoded SecretKey byte array
- */
- protected byte[] decodeSecretKey(final String data) {
- Constraint.isNotNull(data, "SecretKey data was null");
- switch (getSecretKeyEncoding()) {
- case binary:
- // This sort of doesn't make sense for the String input, but just assume it's UTF-8
- try {
- return data.getBytes("UTF-8");
- } catch (final UnsupportedEncodingException e) {
- // Can't actually happen, UTF-8 always supported.
- return null;
- }
- case hex:
- return Hex.decode(data);
- case base64:
- return Base64.decodeBase64(data);
- default:
- throw new IllegalArgumentException("Saw unsupported encoding: " + getSecretKeyEncoding());
-
- }
- }
-
- /**
- * Decode the SecretKey data, based on the specified encoding.
- *
- * @param data the Secret key data
- * @return the decoded SecretKey byte array
- */
- protected byte[] decodeSecretKey(final byte[] data) {
- Constraint.isNotNull(data, "SecretKey data was null");
- switch (getSecretKeyEncoding()) {
- case binary:
- return data;
- case hex:
- return Hex.decode(data);
- case base64:
- return Base64.decodeBase64(data);
- default:
- throw new IllegalArgumentException("Saw unsupported encoding: " + getSecretKeyEncoding());
-
- }
- }
-
- /** {@inheritDoc} */
- @Override protected BasicCredential doCreateInstance() throws Exception {
-
- final PrivateKey privateKey = getPrivateKey();
- final PublicKey publicKey = getPublicKey();
- final SecretKey secretKey = getSecretKey();
- final BasicCredential credential;
-
- // Asymmetric credential
- if (null != publicKey) {
- if (null == privateKey) {
- credential = new BasicCredential(publicKey);
- } else {
- if (!KeySupport.matchKeyPair(publicKey, privateKey)) {
- log.error("{}: Public and private keys do not match", getConfigDescription());
- throw new BeanCreationException("Public and private keys do not match");
- }
- credential = new BasicCredential(publicKey, privateKey);
- }
- // Symmetric credential
- } else if (null != secretKey) {
- credential = new BasicCredential(secretKey);
- } else {
- throw new BeanCreationException("Neither public key nor secret key specified");
- }
-
- if (null != getUsageType()) {
- credential.setUsageType(UsageType.valueOf(getUsageType()));
- }
- return credential;
- }
-
- /** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
- return BasicCredential.class;
- }
-
- /**
- * Get the algorithm for the SecretKey.
- *
- * @return Returns the SecretKey algorithm
- */
- @Nullable public String getSecretKeyAlgorithm() {
- return secretKeyAlgorithm;
- }
-
- /**
- * Set the algorithm for the SecretKey.
- *
- * @param algorithm The algorithm to set.
- */
- public void setSecretKeyAlgorithm(@Nonnull final String algorithm) {
- secretKeyAlgorithm = Constraint.isNotNull(StringSupport.trimOrNull(algorithm),
- "SecretKey algorithm may not be null");
- }
-
- /**
- * Get the SecretKey encoding. Defaults to: base64.
- *
- * @return the encoding
- */
- public SecretKeyEncoding getSecretKeyEncoding() {
- return secretKeyEncoding;
- }
-
- /**
- * Set the SecretKey encoding. Defaults to: base64
- *
- * @param encoding the new encoding
- */
- public void setSecretKeyEncoding(@Nonnull final SecretKeyEncoding encoding) {
- secretKeyEncoding = Constraint.isNotNull(encoding, "SecretKey encoding may not be null");
- }
-
- /**
- * return the configured Public Key.
- *
- * @return the key, or none if not configured.
- */
- @Nullable protected abstract PublicKey getPublicKey();
-
- /**
- * Get the configured Private key.
- *
- * @return the key or null if non configured
- */
- @Nullable protected abstract PrivateKey getPrivateKey();
-
- /**
- * return the configured Secret Key.
- *
- * @return the key, or none if not configured.
- */
- @Nullable protected abstract SecretKey getSecretKey();
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractCredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractCredentialFactoryBean.java
deleted file mode 100644
index b3fcd7161..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractCredentialFactoryBean.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
-
-import org.opensaml.security.credential.Credential;
-
-/**
- * A factory bean to accumulate the information pertaining to an
- * {@link org.opensaml.security.credential.AbstractCredential}.
- * @param <T> the type of credential to create.
- */
-public abstract class AbstractCredentialFactoryBean<T extends Credential> extends AbstractComponentAwareFactoryBean<T> {
-
- /** Usage type of the credential. */
- private String usageType;
-
- /** Names for the key represented by the credential. */
- private List<String> keyNames;
-
- /** Identifier for the owner of the credential. */
- private String entityID;
-
- /** The privateKey Password (if any). */
- @Nullable private char[] privateKeyPassword;
-
- /** For logging: The description of the source of the configuration.*/
- @Nonnull private String configDescription;
-
- /**
- * Gets the names for the key represented by the credential.
- *
- * @return names for the key represented by the credential
- */
- @Nullable public List<String> getKeyNames() {
- return keyNames;
- }
-
- /**
- * Gets the usage type of the credential.
- *
- * @return usage type of the credential
- */
- @Nullable public String getUsageType() {
- return usageType;
- }
-
- /**
- * Get the entity ID of the credential.
- *
- * @return the entity ID
- */
- @Nullable public String getEntityID() {
- return entityID;
- }
-
- /**
- * Sets the names for the key represented by the credential.
- *
- * @param names names for the key represented by the credential
- */
- public void setKeyNames(@Nullable final List<String> names) {
- keyNames = names;
- }
-
- /**
- * Sets the usage type of the credential.
- *
- * @param type usage type of the credential
- */
- public void setUsageType(@Nullable final String type) {
- if (null != type) {
- usageType = type.toUpperCase();
- } else {
- usageType = type;
- }
- }
-
- /**
- * Set the entity ID of the credential.
- *
- * @param newEntityID the entity ID
- */
- public void setEntityID(@Nullable final String newEntityID) {
- entityID = newEntityID;
- }
-
- /**
- * Get the password for the private key.
- *
- * @return Returns the privateKeyPassword.
- */
- @Nullable public char[] getPrivateKeyPassword() {
- return privateKeyPassword;
- }
-
- /**
- * Set the password for the private key.
- *
- * @param password The password to set.
- */
- public void setPrivateKeyPassword(@Nullable final char[] password) {
- if (null != password && password.length > 0) {
- privateKeyPassword = password;
- } else {
- privateKeyPassword = null;
- }
- }
-
- /** For logging, get the description of the resource that defined this bean.
- * @return Returns the description.
- */
- public String getConfigDescription() {
- return configDescription;
- }
-
- /** For logging, set the description of the resource that defined this bean.
- * @param desc what to set.
- */
- public void setConfigDescription(@Nonnull final String desc) {
- configDescription = desc;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractX509CredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractX509CredentialFactoryBean.java
deleted file mode 100644
index d88e3b506..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/AbstractX509CredentialFactoryBean.java
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.security.PrivateKey;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.BeanCreationException;
-
-/**
- * A factory bean to collect information to do with an X509 backed {@link BasicX509Credential}.
- */
-public abstract class AbstractX509CredentialFactoryBean extends AbstractCredentialFactoryBean<BasicX509Credential> {
-
- /** Log. */
- private final Logger log = LoggerFactory.getLogger(AbstractX509CredentialFactoryBean.class);
-
- /** {@inheritDoc} */
- // Checkstyle: CyclomaticComplexity OFF
- @Override protected BasicX509Credential doCreateInstance() throws Exception {
-
- final List<X509Certificate> certificates = getCertificates();
- if (null == certificates || certificates.isEmpty()) {
- log.error("{}: No Certificates provided", getConfigDescription());
- throw new BeanCreationException("No Certificates provided");
- }
-
- X509Certificate entityCertificate = getEntityCertificate();
- if (null == entityCertificate) {
- entityCertificate = certificates.get(0);
- }
-
- final PrivateKey privateKey = getPrivateKey();
-
- final BasicX509Credential credential;
- if (null == privateKey) {
- credential = new BasicX509Credential(entityCertificate);
- } else {
- credential = new BasicX509Credential(entityCertificate, privateKey);
-
- if (!KeySupport.matchKeyPair(entityCertificate.getPublicKey(), privateKey)) {
- log.error("{}: Public and private keys do not match", getConfigDescription());
- throw new BeanCreationException("Public and private keys do not match");
- }
- }
-
- credential.setEntityCertificateChain(certificates);
-
- final List<X509CRL> crls = getCRLs();
- if (null != crls && !crls.isEmpty()) {
- credential.setCRLs(crls);
- }
-
- if (null != getUsageType()) {
- credential.setUsageType(UsageType.valueOf(getUsageType()));
- }
-
- if (null != getEntityID()) {
- credential.setEntityId(getEntityID());
- }
-
- final List<String> keyNames = getKeyNames();
- if (null != keyNames) {
- credential.getKeyNames().addAll(keyNames);
- }
-
- return credential;
- }
-
- // Checkstyle: CyclomaticComplexity ON
-
- /** {@inheritDoc} */
- @Override public Class<BasicX509Credential> getObjectType() {
- return BasicX509Credential.class;
- }
-
- /**
- * return the explicitly configured entity certificate.
- *
- * @return the certificate, or none if not configured.
- */
- @Nullable protected abstract X509Certificate getEntityCertificate();
-
- /**
- * Get the configured certificates. This <strong>MUST</strong> include the entity certificate if it was configured.
- *
- * @return the certificates.
- */
-
- @Nonnull @NotEmpty protected abstract List<X509Certificate> getCertificates();
-
- /**
- * Get the configured private key.
- *
- * @return the key or null if non configured
- */
- @Nullable protected abstract PrivateKey getPrivateKey();
-
- /**
- * Get the configured CRL list.
- *
- * @return the crls or null
- */
- @Nullable protected abstract List<X509CRL> getCRLs();
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicInlineCredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicInlineCredentialFactoryBean.java
deleted file mode 100644
index 0238a2183..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicInlineCredentialFactoryBean.java
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.security.KeyException;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-
-import javax.annotation.Nullable;
-import javax.crypto.SecretKey;
-
-import org.cryptacular.util.KeyPairUtil;
-import org.opensaml.security.crypto.KeySupport;
-import org.springframework.beans.factory.BeanCreationException;
-
-/**
- * Factory bean for BasicInline Credentials.
- */
-public class BasicInlineCredentialFactoryBean extends AbstractBasicCredentialFactoryBean {
-
- /** Configured public key Info. */
- @Nullable private byte[] publicKeyInfo;
-
- /** Configured private key Info. */
- @Nullable private byte[] privateKeyInfo;
-
- /** Configured secret key Info. */
- @Nullable private byte[] secretKeyInfo;
-
- /**
- * Get the information used to generate the public key.
- *
- * @return Returns the info.
- */
- @Nullable public byte[] getPublicKeyInfo() {
- return publicKeyInfo;
- }
-
- /**
- * Set the information used to generate the public key.
- *
- * @param info The info to set.
- */
- public void setPublicKeyInfo(@Nullable final byte[] info) {
- publicKeyInfo = info;
- }
-
- /**
- * Get the information used to generate the private key.
- *
- * @return Returns the info.
- */
- @Nullable public byte[] getPrivateKeyInfo() {
- return privateKeyInfo;
- }
-
- /**
- * Set the information used to generate the private key.
- *
- * @param info The info to set.
- */
- public void setPrivateKeyInfo(@Nullable final byte[] info) {
- privateKeyInfo = info;
- }
-
- /**
- * Get the information used to generate the secret key.
- *
- * @return Returns the info.
- */
- @Nullable public byte[] getSecretKeyInfo() {
- return secretKeyInfo;
- }
-
- /**
- * Set the information used to generate the secret key.
- *
- * @param info The info to set.
- */
- public void setSecretKeyInfo(@Nullable final byte[] info) {
- secretKeyInfo = info;
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected PublicKey getPublicKey() {
- if (null == getPublicKeyInfo()) {
- return null;
- }
- return KeyPairUtil.decodePublicKey(getPublicKeyInfo());
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected PrivateKey getPrivateKey() {
- if (null == getPrivateKeyInfo()) {
- return null;
- }
- return KeyPairUtil.decodePrivateKey(getPrivateKeyInfo(), getPrivateKeyPassword());
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected SecretKey getSecretKey() {
- if (null == getSecretKeyInfo()) {
- return null;
- }
- try {
- return KeySupport.decodeSecretKey(decodeSecretKey(getSecretKeyInfo()), getSecretKeyAlgorithm());
- } catch (final KeyException e) {
- throw new BeanCreationException("Could not decode secret key", e);
- }
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicResourceCredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicResourceCredentialFactoryBean.java
deleted file mode 100644
index eed8ef499..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicResourceCredentialFactoryBean.java
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.KeyException;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-
-import javax.annotation.Nullable;
-import javax.crypto.SecretKey;
-
-import org.cryptacular.util.KeyPairUtil;
-import org.opensaml.security.crypto.KeySupport;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.BeanCreationException;
-import org.springframework.core.io.Resource;
-
-import com.google.common.io.ByteStreams;
-
-/**
- * Spring bean factory for producing a {@link org.opensaml.security.credential.BasicCredential} from {@link Resource}s.
- */
-public class BasicResourceCredentialFactoryBean extends AbstractBasicCredentialFactoryBean {
-
- /** log. */
- private final Logger log = LoggerFactory.getLogger(BasicResourceCredentialFactoryBean.class);
-
- /** Configured public key Info. */
- @Nullable private Resource publicKeyInfo;
-
- /** Configured private key Info. */
- @Nullable private Resource privateKeyInfo;
-
- /** Configured secret key Info. */
- @Nullable private Resource secretKeyInfo;
-
- /**
- * Get the information used to generate the public key.
- *
- * @return Returns the info.
- */
- @Nullable public Resource getPublicKeyInfo() {
- return publicKeyInfo;
- }
-
- /**
- * Set the information used to generate the public key.
- *
- * @param info The info to set.
- */
- public void setPublicKeyInfo(@Nullable final Resource info) {
- publicKeyInfo = info;
- }
-
- /**
- * Get the information used to generate the private key.
- *
- * @return Returns the info.
- */
- @Nullable public Resource getPrivateKeyInfo() {
- return privateKeyInfo;
- }
-
- /**
- * Set the information used to generate the private key.
- *
- * @param info The info to set.
- */
- public void setPrivateKeyInfo(@Nullable final Resource info) {
- privateKeyInfo = info;
- }
-
- /**
- * Get the information used to generate the secret key.
- *
- * @return Returns the info.
- */
- @Nullable public Resource getSecretKeyInfo() {
- return secretKeyInfo;
- }
-
- /**
- * Set the information used to generate the secret key.
- *
- * @param info The info to set.
- */
- public void setSecretKeyInfo(@Nullable final Resource info) {
- secretKeyInfo = info;
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected PublicKey getPublicKey() {
- if (null == getPublicKeyInfo()) {
- return null;
- }
- try (InputStream is = getPublicKeyInfo().getInputStream()) {
- return KeyPairUtil.readPublicKey(is);
- } catch (final IOException e) {
- log.error("{}: Could not decode public key: {}", getConfigDescription(), e.getMessage());
- throw new BeanCreationException("Could not decode public key", e);
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected PrivateKey getPrivateKey() {
- if (null == getPrivateKeyInfo()) {
- return null;
- }
- try (InputStream is = getPrivateKeyInfo().getInputStream()) {
- return KeySupport.decodePrivateKey(is, getPrivateKeyPassword());
- } catch (final KeyException | IOException e) {
- log.error("{}: Could not decode private key: {}", getConfigDescription(), e.getMessage());
- throw new BeanCreationException("Could not decode private key", e);
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected SecretKey getSecretKey() {
- if (null == getSecretKeyInfo()) {
- return null;
- }
- try (InputStream is = getSecretKeyInfo().getInputStream()) {
- return KeySupport.decodeSecretKey(decodeSecretKey(ByteStreams.toByteArray(is)), getSecretKeyAlgorithm());
- } catch (final KeyException | IOException e) {
- log.error("{}: Could not decode secret key: {}", getConfigDescription(), e.getMessage());
- throw new BeanCreationException("Could not decode secret key", e);
- }
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java
deleted file mode 100644
index 73cc143ec..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java
+++ /dev/null
@@ -1,224 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.KeyException;
-import java.security.PrivateKey;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.collection.LazyList;
-
-import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.security.x509.X509Support;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.FatalBeanException;
-import org.springframework.core.io.Resource;
-
-/**
- * Spring bean factory for producing a {@link org.opensaml.security.x509.BasicX509Credential} from {@link Resource}s.
- *
- * <p>
- * This factory bean supports DER and PEM encoded certificate resources and encrypted and non-encrypted PKCS8, DER, or
- * PEM encoded private key resources.
- * </p>
- */
-public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactoryBean {
-
- /** log. */
- private final Logger log = LoggerFactory.getLogger(BasicX509CredentialFactoryBean.class);
-
- /** The specification of where the entity Resource is to be found. */
- private Resource entityResource;
-
- /** Where the certificates are to be found. */
- private List<Resource> certificateResources;
-
- /** Where the private key is to be found. */
- private Resource privateKeyResource;
-
- /** Where the crls are to be found. */
- private List<Resource> crlResources;
-
- /**
- * Set the Resource with the entity certificate.
- *
- * @param what The Resource to set.
- */
- public void setEntity(@Nonnull final Resource what) {
- entityResource = what;
- }
-
- /**
- * Sets the Resources which contain the certificates.
- *
- * @param what The values to set.
- */
- public void setCertificates(@Nullable @NotEmpty final List<Resource> what) {
- certificateResources = what;
- }
-
- /**
- * Set the Resource with the entity certificate.
- *
- * @param what The resource to set.
- */
- public void setPrivateKey(@Nullable final Resource what) {
- privateKeyResource = what;
- }
-
- /**
- * Sets the Resources which contain the crls.
- *
- * @param what The value to set.
- */
- public void setCRLs(@Nullable @NotEmpty final List<Resource> what) {
- crlResources = what;
- }
-
- //
- // BasicX509CredentialFactoryBean
- //
- /**
- * Set the resource containing the private key.
- *
- * @param res private key resource, never <code>null</code>
- */
- public void setPrivateKeyResource(@Nonnull final Resource res) {
- setPrivateKey(res);
- }
-
- /**
- * Set the password for the private key.
- *
- * @param password password for the private key, may be null if the key is not encrypted
- */
- public void setPrivateKeyPassword(@Nullable final String password) {
- setPrivateKeyPassword(password.toCharArray());
- }
-
- /**
- * Set the certificate resource.
- *
- * @param res certificate resource
- */
- public void setCertificateResource(@Nonnull final Resource res) {
- setCertificates(Collections.singletonList(res));
- }
-
- /**
- * Set the entityID for the credential.
- *
- * @param id entityID
- */
- public void setEntityId(@Nullable final String id) {
- setEntityID(id);
- }
-
- /** {@inheritDoc} */
- @Override public boolean isSingleton() {
- return true;
- }
-
- /** {@inheritDoc}. */
- @Override @Nullable protected X509Certificate getEntityCertificate() {
-
- if (null == entityResource) {
- return null;
- }
- try {
- final Collection<X509Certificate> certs = X509Support.decodeCertificates(entityResource.getInputStream());
- if (certs.size() > 1) {
- log.error("{}: Configuration element indicated an entityCertificate,"
- + " but multiple certificates were decoded", getConfigDescription());
- throw new FatalBeanException("Configuration element indicated an entityCertificate,"
- + " but multiple certificates were decoded");
- }
- return certs.iterator().next();
- } catch (final CertificateException | IOException e) {
- log.error("{}: Could not decode provided Entity Certificate at {}: {}", getConfigDescription(),
- entityResource.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided Entity Certificate file "
- + entityResource.getDescription(), e);
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull protected List<X509Certificate> getCertificates() {
-
- if (certificateResources == null) {
- return Collections.emptyList();
- }
-
- final List<X509Certificate> certificates = new LazyList<>();
- for (final Resource r : certificateResources) {
- try(InputStream is = r.getInputStream()) {
- certificates.addAll(X509Support.decodeCertificates(is));
- } catch (final CertificateException | IOException e) {
- log.error("{}: could not decode CertificateFile at {}: {}", getConfigDescription(),
- r.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided CertificateFile: " + r.getDescription(), e);
- }
- }
- return certificates;
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected PrivateKey getPrivateKey() {
- if (null == privateKeyResource) {
- return null;
- }
- try (InputStream is = privateKeyResource.getInputStream()) {
- return KeySupport.decodePrivateKey(is, getPrivateKeyPassword());
- } catch (final KeyException | IOException e) {
- log.error("{}: Could not decode KeyFile at {}: {}", getConfigDescription(),
- privateKeyResource.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided KeyFile " + privateKeyResource.getDescription(), e);
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected List<X509CRL> getCRLs() {
- if (null == crlResources) {
- return null;
- }
- final List<X509CRL> crls = new LazyList<>();
- for (final Resource crl : crlResources) {
- try (InputStream is = crl.getInputStream()) {
- crls.addAll(X509Support.decodeCRLs(is));
- } catch (final CRLException | IOException e) {
- log.error("{}: Could not decode CRL file at {}: {}", getConfigDescription(), crl.getDescription(),
- e.getMessage());
- throw new FatalBeanException("Could not decode provided CRL file " + crl.getDescription(), e);
- }
- }
- return crls;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticExplicitKeyFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticExplicitKeyFactoryBean.java
deleted file mode 100644
index b9c6d2e4e..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticExplicitKeyFactoryBean.java
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.cryptacular.EncodingException;
-import org.cryptacular.StreamException;
-import org.cryptacular.util.KeyPairUtil;
-import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.security.x509.X509Support;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.FatalBeanException;
-import org.springframework.core.io.Resource;
-
-import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-
-/**
- * Factory bean for simple use cases involving the {@link ExplicitKeyTrustEngine} and static credentials.
- *
- * @since 3.3.0
- */
-public class StaticExplicitKeyFactoryBean extends AbstractComponentAwareFactoryBean<ExplicitKeyTrustEngine> {
-
- /** Class logger. */
- @Nonnull private Logger log = LoggerFactory.getLogger(StaticExplicitKeyFactoryBean.class);
-
- /** The resources to be turned into keys. */
- private List<Resource> keyResources;
-
- /** The resources to be turned into certificates. */
- private List<Resource> certificateResources;
-
- /** Constructor. */
- public StaticExplicitKeyFactoryBean() {
- keyResources = Collections.emptyList();
- certificateResources = Collections.emptyList();
- }
-
- /**
- * Set the resources which we will convert into certificates.
- *
- * @param keys the resources
- */
- public void setPublicKeys(@Nullable final List<Resource> keys) {
- keyResources = keys != null ? keys : Collections.emptyList();
- }
-
- /**
- * Set the resources which we will convert into certificates.
- *
- * @param certs the resources
- */
- public void setCertificates(@Nullable final List<Resource> certs) {
- certificateResources = certs != null ? certs : Collections.emptyList();
- }
-
- /**
- * Get the configured certificates.
- *
- * @return the certificates null
- */
- @Nullable @NonnullElements protected List<Credential> getCredentials() {
-
- final List<Credential> credentials = new ArrayList<>(keyResources.size() + certificateResources.size());
-
- for (final Resource f : keyResources) {
- try(final InputStream is = f.getInputStream()) {
- credentials.add(new BasicCredential(KeyPairUtil.readPublicKey(is)));
- } catch (final EncodingException|StreamException|IOException e) {
- log.error("Could not decode public key from {}: {}", f.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode public key from " + f.getDescription(), e);
- }
- }
-
- for (final Resource f : certificateResources) {
- try(final InputStream is = f.getInputStream()) {
- final Collection<X509Certificate> raw = X509Support.decodeCertificates(is);
- if (raw != null) {
- raw.forEach(x -> {
- if (x != null) {
- credentials.add(new BasicX509Credential(x));
- }
- }
- );
- }
-
- } catch (final CertificateException | IOException e) {
- log.error("Could not decode certificate from {}: {}", f.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode certificate from " + f.getDescription(), e);
- }
- }
-
- return credentials;
- }
-
- /** {@inheritDoc} */
- @Override
- public Class<?> getObjectType() {
- return ExplicitKeyTrustEngine.class;
- }
-
- /** {@inheritDoc} */
- @Override
- protected ExplicitKeyTrustEngine doCreateInstance() throws Exception {
- return new ExplicitKeyTrustEngine(new StaticCredentialResolver(getCredentials()));
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
deleted file mode 100644
index 2bafae20a..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBean.java
+++ /dev/null
@@ -1,277 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.Security;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-import java.util.Set;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import org.opensaml.security.x509.PKIXTrustEvaluator;
-import org.opensaml.security.x509.X509Support;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXValidationOptions;
-import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
-import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.FatalBeanException;
-import org.springframework.core.io.Resource;
-
-
-import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
-import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * File system specific bean for PKIXX509CredentialTrustEngine.
- *
- * @since 3.3.0
- */
-public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKIXX509CredentialTrustEngine> {
-
- /** log. */
- @Nonnull private Logger log = LoggerFactory.getLogger(StaticPKIXFactoryBean.class);
-
- /** Certificate resources. */
- @Nullable private List<Resource> certificateResources;
-
- /** CRL resources. */
- @Nullable private List<Resource> crlResources;
-
- /** Verification depth. */
- @Nullable private Integer verifyDepth;
-
- /** Explicit subject name(s) to match. */
- @Nullable private Set<String> trustedNames;
-
- /** Whether to enable name checking. If true a default implementation will be used.
- * See also: {@link #credentialNameEvaluator}. */
- private boolean checkNames;
-
- /** Custom instance of {@link PKIXTrustEvaluator} to use. */
- private PKIXTrustEvaluator trustEvaluator;
-
- /** Custom instance of {@link X509CredentialNameEvaluator} to use.
- * A non-null value overrides {@link #checkNames}. */
- private X509CredentialNameEvaluator credentialNameEvaluator;
-
- /** Constructor. */
- public StaticPKIXFactoryBean() {
- checkNames = true;
- }
-
- /** {@inheritDoc} */
- @Override
- public Class<?> getObjectType() {
- return PKIXX509CredentialTrustEngine.class;
- }
-
- /**
- * Set the resources which we will convert into certificates.
- *
- * @param certs the resources
- */
- public void setCertificates(@Nullable final List<Resource> certs) {
- certificateResources = certs;
- }
-
- /**
- * Set the resources which we will convert into CRLs.
- *
- * @param crls the resources
- */
- public void setCRLs(@Nullable final List<Resource> crls) {
- crlResources = crls;
- }
-
- /**
- * Set the verify depth.
- *
- * @param depth value to set
- */
- public void setVerifyDepth(final int depth) {
- verifyDepth = depth;
- }
-
- /**
- * Set whether the perform name checking in the PKIX layer.
- *
- * <p>
- * Defaults to "true", should generally be disabled when used with an HTTP client
- * that is already checking names.
- * </p>
- *
- * <p>
- * If true a default implementation will be used unless a specific name evaluator impl has been supplied.
- * See also: {@link #setCredentialNameEvaluator(X509CredentialNameEvaluator)}.
- * </p>
- *
- * @param flag flag to set
- *
- * @since 3.4.0
- */
- public void setCheckNames(final boolean flag) {
- checkNames = flag;
- }
-
- /**
- * Set explicitly trusted names to match against credential.
- *
- * @param names explicitly trusted names
- *
- * @since 3.4.0
- */
- public void setTrustedNames(@Nullable @NonnullElements final Collection<String> names) {
- if (names != null) {
- trustedNames = Set.copyOf(names);
- } else {
- trustedNames = null;
- }
- }
-
- /**
- * Set the custom instance of {@link PKIXTrustEvaluator} to use.
- *
- * @param evaluator The trustEvaluator to set.
- */
- public void setTrustEvaluator(@Nullable final PKIXTrustEvaluator evaluator) {
- trustEvaluator = evaluator;
- }
-
- /**
- * Set the custom instance of {@link X509CredentialNameEvaluator} to use.
- *
- * <p>
- * A non-null value overrides {@link #setCheckNames(boolean)}.
- * </p>
- *
- * @param evaluator The credentialNameEvaluator to set.
- */
- public void setCredentialNameEvaluator(@Nullable final X509CredentialNameEvaluator evaluator) {
- credentialNameEvaluator = evaluator;
- }
-
- /**
- * Get the configured certificates.
- *
- * @return the certificates
- */
- @Nonnull @NonnullElements protected List<X509Certificate> getCertificates() {
- if (certificateResources == null) {
- return Collections.emptyList();
- }
-
- final List<X509Certificate> certificates = new ArrayList<>(certificateResources.size());
- for (final Resource f : certificateResources) {
- try(final InputStream is = f.getInputStream()) {
- certificates.addAll(X509Support.decodeCertificates(is));
- } catch (final CertificateException | IOException e) {
- log.error("Could not decode Certificate at {}: {}", f.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided CertificateFile: " + f.getDescription(), e);
- }
- }
- return certificates;
- }
-
- /**
- * Get the configured CRL list.
- *
- * @return the crls
- */
- @Nonnull @NonnullElements protected List<X509CRL> getCRLs() {
- if (crlResources == null) {
- return Collections.emptyList();
- }
-
- final List<X509CRL> crls = new ArrayList<>(crlResources.size());
- for (final Resource crlFile : crlResources) {
- try(final InputStream is = crlFile.getInputStream()) {
- crls.addAll(X509Support.decodeCRLs(is));
- } catch (final CRLException | IOException e) {
- log.error("Could not decode CRL file at {}: {}", crlFile.getDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided CRL file " + crlFile.getDescription(), e);
- }
- }
- return crls;
- }
-
- /** {@inheritDoc} */
- @Override
- protected PKIXX509CredentialTrustEngine doCreateInstance() throws Exception {
- final BasicPKIXValidationInformation info =
- new BasicPKIXValidationInformation(getCertificates(), getCRLs(), verifyDepth);
-
- final StaticPKIXValidationInformationResolver resolver =
- new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames, checkNames);
-
- final PKIXTrustEvaluator pkixTrustEvaluator =
- trustEvaluator != null ? trustEvaluator : new CertPathPKIXTrustEvaluator();
-
- final X509CredentialNameEvaluator credNameEvaluator =
- credentialNameEvaluator != null ? credentialNameEvaluator :
- (checkNames ? new BasicX509CredentialNameEvaluator() : null);
-
- validateConfiguration(pkixTrustEvaluator);
-
- return new PKIXX509CredentialTrustEngine(resolver, pkixTrustEvaluator, credNameEvaluator);
- }
-
- /**
- * Validate the configuration of the effective {@link PKIXTrustEvaluator}.
- *
- * @param pkixTrustEvaluator the instance whose configuration is to be evaluated
- *
- * @throws Exception if configuration issues are encountered
- */
- protected void validateConfiguration(@Nonnull final PKIXTrustEvaluator pkixTrustEvaluator) throws Exception {
- if (CertPathPKIXTrustEvaluator.class.isInstance(pkixTrustEvaluator)
- && CertPathPKIXValidationOptions.class.isInstance(pkixTrustEvaluator.getPKIXValidationOptions())) {
-
- final CertPathPKIXValidationOptions certPathOptions =
- CertPathPKIXValidationOptions.class.cast(pkixTrustEvaluator.getPKIXValidationOptions());
-
- if (certPathOptions.isForceRevocationEnabled() && certPathOptions.isRevocationEnabled()
- && getCRLs().isEmpty()
- && ! Boolean.getBoolean("com.sun.security.enableCRLDP")
- && ! "true".equalsIgnoreCase(StringSupport.trimOrNull(Security.getProperty("oscp.enable"))) ) {
-
- log.error("Certificate revocation checking was force enabled, "
- + "but no static CRLs were supplied and both CRLDP and OCSP processing is disabled");
-
- throw new FatalBeanException("Certificate revocation checking was force enabled, "
- + "but no static CRLs were supplied and both CRLDP and OCSP processing is disabled");
- }
- }
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/X509InlineCredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/X509InlineCredentialFactoryBean.java
deleted file mode 100644
index 056f868db..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/X509InlineCredentialFactoryBean.java
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.security.PrivateKey;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
-import net.shibboleth.utilities.java.support.collection.LazyList;
-
-import org.cryptacular.util.KeyPairUtil;
-import org.opensaml.security.x509.X509Support;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.FatalBeanException;
-
-/**
- * A factory bean to understand X509Inline credentials.
- */
-public class X509InlineCredentialFactoryBean extends AbstractX509CredentialFactoryBean {
-
- /** log. */
- private final Logger log = LoggerFactory.getLogger(X509InlineCredentialFactoryBean.class);
-
- /** The entity certificate. */
- private String entityCertificate;
-
- /** The certificates. */
- private List<String> certificates;
-
- /** The private key. */
- private byte[] privateKey;
-
- /** The crls. */
- private List<String> crls;
-
- /**
- * Set the file with the entity certificate.
- *
- * @param entityCert The file to set.
- */
- public void setEntity(@Nonnull final String entityCert) {
- entityCertificate = entityCert;
- }
-
- /**
- * Sets the certificates.
- *
- * @param certs The value to set.
- */
- public void setCertificates(@Nullable @NotEmpty final List<String> certs) {
- certificates = certs;
- }
-
- /**
- * Set the private key.
- *
- * @param key The file to set.
- */
- public void setPrivateKey(@Nullable final byte[] key) {
- privateKey = key;
- }
-
- /**
- * Sets the files which contain the crls.
- *
- * @param list The value to set.
- */
- public void setCRLs(@Nullable @NotEmpty final List<String> list) {
- crls = list;
- }
-
- /** {@inheritDoc}. */
- @Override @Nullable protected X509Certificate getEntityCertificate() {
-
- if (null == entityCertificate) {
- return null;
- }
- try {
- return X509Support.decodeCertificate(entityCertificate);
- } catch (final CertificateException e) {
- log.error("{}: Could not decode provided Entity Certificate: {}", getConfigDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided Entity Certificate", e);
- }
- }
-
- /** {@inheritDoc} */
- @Override @Nonnull protected List<X509Certificate> getCertificates() {
- final List<X509Certificate> certs = new LazyList<>();
- for (final String cert : certificates) {
- try {
- certs.add(X509Support.decodeCertificate(cert.trim()));
- } catch (final CertificateException e) {
- log.error("{}: Could not decode provided Certificate: {}", getConfigDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided Certificate", e);
- }
- }
- return certs;
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected PrivateKey getPrivateKey() {
- if (null == privateKey) {
- return null;
- }
- return KeyPairUtil.decodePrivateKey(privateKey, getPrivateKeyPassword());
- }
-
- /** {@inheritDoc} */
- @Override @Nullable protected List<X509CRL> getCRLs() {
- if (null == crls) {
- return null;
- }
- final List<X509CRL> result = new LazyList<>();
- for (final String crl : crls) {
- try {
- result.add(X509Support.decodeCRL(crl));
- } catch (final CRLException | CertificateException e) {
- log.error("{}: Could not decode provided CRL: {}", getConfigDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided CRL", e);
- }
- }
- return result;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
index 5a97f9db7..c1581671e 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/SignatureValidationParser.java
@@ -25,6 +25,8 @@ import javax.xml.namespace.QName;
import org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter;
import org.opensaml.security.credential.impl.StaticCredentialResolver;
+import org.opensaml.spring.credential.BasicInlineCredentialFactoryBean;
+import org.opensaml.spring.credential.BasicX509CredentialFactoryBean;
import org.opensaml.xmlsec.keyinfo.impl.BasicProviderKeyInfoCredentialResolver;
import org.opensaml.xmlsec.keyinfo.impl.KeyInfoProvider;
import org.opensaml.xmlsec.keyinfo.impl.provider.DSAKeyValueProvider;
@@ -43,8 +45,6 @@ import org.w3c.dom.Element;
import net.shibboleth.ext.spring.util.AbstractCustomBeanDefinitionParser;
import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.factory.BasicInlineCredentialFactoryBean;
-import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.xml.ElementSupport;
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractBasicCredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractBasicCredentialParser.java
deleted file mode 100644
index a8d128a4a..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractBasicCredentialParser.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.BeanCreationException;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Specific parser for all BasicCredentials.
- *
- * <p>
- * This does the work of putting the element values into strings. The bean factory then does the correct thing - with
- * some help from Spring doing auto-conversion.
- * </p>
- */
-public abstract class AbstractBasicCredentialParser extends AbstractCredentialParser {
-
- /** <PrivateKey>. */
- public static final QName PRIVATE_KEY_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "PrivateKey");
-
- /** <PublicKey>. */
- public static final QName PUBLIC_KEY_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "PublicKey");
-
- /** <SecretKey>. */
- public static final QName SECRET_KEY_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "SecretKey");
-
- /** log. */
- private final Logger log = LoggerFactory.getLogger(AbstractBasicCredentialParser.class);
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
- builder.addPropertyValue("configDescription", parserContext.getReaderContext().getResource().getDescription());
-
- parsePrivateKey(ElementSupport.getChildElements(element, PRIVATE_KEY_ELEMENT_NAME), parserContext, builder);
- parsePublicKey(ElementSupport.getChildElements(element, PUBLIC_KEY_ELEMENT_NAME), parserContext, builder);
- parseSecretKey(ElementSupport.getChildElements(element, SECRET_KEY_ELEMENT_NAME), parserContext, builder);
- }
-
- /**
- * Parse the <PrivateKey> element.
- *
- * @param childElements the elements containing the private key, may be null or empty.
- * @param parserContext used for logging.
- * @param builder the builder.
- */
- private void parsePrivateKey(@Nullable final List<Element> childElements, final ParserContext parserContext,
- @Nonnull final BeanDefinitionBuilder builder) {
- if (null == childElements || childElements.isEmpty()) {
- return;
- }
- if (childElements.size() > 1) {
- log.error("{}: More than one <PrivateKey> Elements present.", parserContext.getReaderContext()
- .getResource().getDescription());
- throw new BeanCreationException("More than one <PrivateKey> Elements present.");
- }
- final Element key = childElements.get(0);
- final String value = StringSupport.trimOrNull(key.getTextContent());
- if (null == value) {
- log.error("{}: <PrivateKey> Must contain text.", parserContext.getReaderContext().getResource()
- .getDescription());
- throw new BeanCreationException("<PrivateKey> Must contain text.");
- }
- log.debug("Found a private key <Supressed>");
- builder.addPropertyValue("privateKeyInfo", value);
- builder.addPropertyValue("privateKeyPassword", key.getAttributeNS(null, "password"));
- }
-
- /**
- * Parse the <PublicKey> elements.
- *
- * @param childElements the elements containing the public key, must have exactly one element
- * @param parserContext used for logging.
- * @param builder the builder
- */
- private void parsePublicKey(@Nullable final List<Element> childElements, final ParserContext parserContext,
- @Nonnull final BeanDefinitionBuilder builder) {
- if (null == childElements || childElements.isEmpty()) {
- return;
- }
- if (childElements.size() > 1) {
- log.error("{}: More than one <PublicKey> elements present.", parserContext.getReaderContext().getResource()
- .getDescription());
- throw new BeanCreationException("More than one <PublicKey> elements present.");
- }
- final Element key = childElements.get(0);
- final String value = StringSupport.trimOrNull(key.getTextContent());
- if (null == value) {
- log.error("{}: <PublicKey> Must contain text.", parserContext.getReaderContext().getResource()
- .getDescription());
- throw new BeanCreationException("<PublicKey> Must contain text.");
- }
- log.debug("Found a public key {}", value);
- builder.addPropertyValue("publicKeyInfo", value);
-
- if (key.hasAttributeNS(null, "password")) {
- log.warn("password on public key is ignored");
- }
- }
-
- /**
- * Parse the <SecretKey> element.
- *
- * @param childElements the elements containing the private key, may be null or empty.
- * @param parserContext used for logging.
- * @param builder the builder
- */
- private void parseSecretKey(@Nullable final List<Element> childElements, final ParserContext parserContext,
- @Nonnull final BeanDefinitionBuilder builder) {
- if (null == childElements || childElements.isEmpty()) {
- return;
- }
- if (childElements.size() > 1) {
- log.error("{}: More than one <SecretKey> Elements present.", parserContext.getReaderContext().getResource()
- .getDescription());
- throw new BeanCreationException("More than one <SecretKey> Elements present.");
- }
- final Element key = childElements.get(0);
- final String value = StringSupport.trimOrNull(key.getTextContent());
- if (null == value) {
- log.error("{}: <SecretKey> Must contain text.", parserContext.getReaderContext().getResource()
- .getDescription());
- throw new BeanCreationException("<SecretKey> Must contain text.");
- }
- log.debug("Found a secret key <Supressed>");
- builder.addPropertyValue("secretKeyInfo", value);
- builder.addPropertyValue("secretKeyAlgorithm", StringSupport.trimOrNull(key.getAttributeNS(null, "algorithm")));
- builder.addPropertyValue("secretKeyEncoding", StringSupport.trimOrNull(key.getAttributeNS(null, "encoding")));
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractCredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractCredentialParser.java
deleted file mode 100644
index b845874db..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractCredentialParser.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import java.util.List;
-
-import javax.xml.namespace.QName;
-
-import org.springframework.beans.factory.support.AbstractBeanDefinition;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-import net.shibboleth.ext.spring.util.AbstractCustomBeanDefinitionParser;
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-/**
- * Base parser for all <Credential> elements.
- */
-public abstract class AbstractCredentialParser extends AbstractCustomBeanDefinitionParser {
-
- /** <Credential>. */
- public static final QName CREDENTIAL_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "Credential");
-
- /** <KeyName>. */
- public static final QName KEY_NAME_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "KeyName");
-
- /** {@inheritDoc} */
- @Override protected String resolveId(final Element element, final AbstractBeanDefinition definition,
- final ParserContext parserContext) {
- return StringSupport.trimOrNull(element.getAttributeNS(null, "id"));
- }
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- builder.setLazyInit(true);
-
- parseAttributes(element, builder);
- parseKeyNames(ElementSupport.getChildElements(element, KEY_NAME_ELEMENT_NAME), builder);
- }
-
- /**
- * Parse the credential element attributes.
- *
- * @param element credential element
- * @param builder bean definition builder
- */
- protected void parseAttributes(final Element element, final BeanDefinitionBuilder builder) {
- final String usage = StringSupport.trimOrNull(element.getAttributeNS(null, "usage"));
- builder.addPropertyValue("usageType", usage);
-
- final String entityID = StringSupport.trimOrNull(element.getAttributeNS(null, "entityID"));
- if (entityID != null) {
- builder.addPropertyValue("entityID", entityID);
- }
- }
-
- /**
- * Parses the key names from the credential configuration.
- *
- * @param keyNameElems the elements to parse
- * @param builder credential build
- */
- protected void parseKeyNames(final List<Element> keyNameElems, final BeanDefinitionBuilder builder) {
- if (keyNameElems == null || keyNameElems.isEmpty()) {
- return;
- }
-
- builder.addPropertyValue("keyNames", SpringSupport.getElementTextContentAsManagedList(keyNameElems));
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractX509CredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractX509CredentialParser.java
deleted file mode 100644
index 57712a511..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/AbstractX509CredentialParser.java
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-import javax.xml.namespace.QName;
-
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.AttributeSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.BeanCreationException;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.ManagedList;
-import org.w3c.dom.Element;
-
-/**
- * Specific parser for all X509Credentials.
- *
- * <p>
- * This does the work of putting the element values into strings. The bean factory then does the correct thing - with
- * some help from Spring doing auto-conversion.
- * </p>
- */
-public abstract class AbstractX509CredentialParser extends AbstractCredentialParser {
-
- /** <PrivateKey>. */
- public static final QName PRIVATE_KEY_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "PrivateKey");
-
- /** <Certificate>. */
- public static final QName CERTIFICATE_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "Certificate");
-
- /** <CRL>. */
- public static final QName CRL_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "CRL");
-
- /** log. */
- private Logger log = LoggerFactory.getLogger(AbstractX509CredentialParser.class);
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final BeanDefinitionBuilder builder) {
- super.doParse(element, builder);
- parsePrivateKey(ElementSupport.getChildElements(element, PRIVATE_KEY_ELEMENT_NAME), builder);
- parseCertificates(ElementSupport.getChildElements(element, CERTIFICATE_ELEMENT_NAME), builder);
- parseCRLs(ElementSupport.getChildElements(element, CRL_ELEMENT_NAME), builder);
- }
-
- /**
- * Parse the <PrivateKey> element.
- *
- * @param childElements the elements containing the private key, may be null or empty.
- * @param builder the builder
- */
- private void parsePrivateKey(@Nullable final List<Element> childElements,
- @Nonnull final BeanDefinitionBuilder builder) {
- if (null == childElements || childElements.isEmpty()) {
- return;
- }
- if (childElements.size() > 1) {
- throw new BeanCreationException("More than one <PrivateKey> Elements present.");
- }
- final Element key = childElements.get(0);
- final String value = StringSupport.trimOrNull(key.getTextContent());
- if (null == value) {
- throw new BeanCreationException("<PrivateKey> Must contain text.");
- }
- log.debug("Found a private key <Supressed>");
- builder.addPropertyValue("privateKey", value);
- builder.addPropertyValue("privateKeyPassword", key.getAttributeNS(null, "password"));
- }
-
- /**
- * Parse the <Certificate> elements.
- *
- * @param childElements the elements containing the certificates, Must have at least one element.
- * @param builder the builder
- */
- private void parseCertificates(@Nullable final List<Element> childElements,
- @Nonnull final BeanDefinitionBuilder builder) {
- if (null == childElements || childElements.isEmpty()) {
- throw new BeanCreationException("At least one <Certificate> should be present.");
- }
-
- final List<String> certs = new ManagedList<>(childElements.size());
-
- for (final Element elem : childElements) {
- final String cert = StringSupport.trimOrNull(elem.getTextContent());
- if (null == cert) {
- throw new BeanCreationException("All <Certificate> elements must contain text.");
- }
- if (elem.hasAttributeNS(null, "entityCertificate")
- && AttributeSupport.getAttributeValueAsBoolean(elem.getAttributeNodeNS(null,
- "entityCertificate"))) {
- // Note the loss of property replacement for this undocumented extension
- log.debug("Found a certficate marked as an entityCertificate {}", cert);
- builder.addPropertyValue("entity", cert);
- } else {
- log.debug("Found a certficate {}", cert);
- }
- certs.add(cert);
- }
- builder.addPropertyValue("certificates", certs);
- }
-
- /**
- * Parse the <CRL> elements.
- *
- * @param childElements the elements containing the CRLs, Must have at least one element.
- * @param builder the builder
- */
- private void parseCRLs(@Nullable final List<Element> childElements, @Nonnull final BeanDefinitionBuilder builder) {
- if (null == childElements || childElements.isEmpty()) {
- return;
- }
-
- builder.addPropertyValue("CRLs", SpringSupport.getElementTextContentAsManagedList(childElements));
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/BasicInlineCredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/BasicInlineCredentialParser.java
deleted file mode 100644
index ac8a7dd4f..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/BasicInlineCredentialParser.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.factory.BasicInlineCredentialFactoryBean;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.w3c.dom.Element;
-
-/**
- * Parser for BasicInline Credentials.
- */
-public class BasicInlineCredentialParser extends AbstractBasicCredentialParser {
-
- /** Element Name.*/
- public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "BasicInline");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return BasicInlineCredentialFactoryBean.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/BasicResourceCredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/BasicResourceCredentialParser.java
deleted file mode 100644
index bbbd59f82..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/BasicResourceCredentialParser.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import javax.xml.namespace.QName;
-
-import org.w3c.dom.Element;
-
-import net.shibboleth.idp.profile.spring.factory.BasicResourceCredentialFactoryBean;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-/**
- * Parser for BasicFilesystem and BasicResourceBacked Credentials.
- */
-public class BasicResourceCredentialParser extends AbstractBasicCredentialParser {
-
- /** Type for Resource. */
- public static final QName TYPE_NAME_RESOURCE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "BasicResourceBacked");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return BasicResourceCredentialFactoryBean.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/X509InlineCredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/X509InlineCredentialParser.java
deleted file mode 100644
index 7ba72b7a2..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/X509InlineCredentialParser.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.factory.X509InlineCredentialFactoryBean;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.w3c.dom.Element;
-
-/**
- * Parser for X509Inline credentials.
- */
-public class X509InlineCredentialParser extends AbstractX509CredentialParser {
-
- /** Element Name.*/
- public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "X509Inline");
-
- @Override protected Class<?> getBeanClass(final Element element) {
- return X509InlineCredentialFactoryBean.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/X509ResourceCredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/X509ResourceCredentialParser.java
deleted file mode 100644
index b69c463a1..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/X509ResourceCredentialParser.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
-
-import javax.xml.namespace.QName;
-
-import org.w3c.dom.Element;
-
-import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-/**
- * Parser for X509Filesystem credentials.
- */
-public class X509ResourceCredentialParser extends AbstractX509CredentialParser {
-
- /** Type for X509 credentials. */
- public static final QName TYPE_NAME_RESOURCE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "X509ResourceBacked");
-
- @Override protected Class<?> getBeanClass(final Element element) {
- return BasicX509CredentialFactoryBean.class;
- }
-
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/package-info.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/package-info.java
deleted file mode 100644
index ad8119401..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/impl/package-info.java
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Parsers and bean factories to deal with the parsing of <Credential> elements.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl;
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
deleted file mode 100644
index 004f4ebb1..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/SecurityNamespaceHandler.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.ext.spring.util.BaseSpringNamespaceHandler;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl.BasicInlineCredentialParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl.BasicResourceCredentialParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl.X509InlineCredentialParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl.X509ResourceCredentialParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.CertPathPKIXValidationOptionsParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.ChainingParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.PKIXInlineValidationInfoParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.PKIXResourceValidationInfoParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.PKIXValidationOptionsParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.SignatureChainingParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticExplicitKeyParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticExplicitKeySignatureParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticPKIXSignatureParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.StaticPKIXX509CredentialParser;
-
-/** Namespace handler for {@link AbstractMetadataProviderParser#SECURITY_NAMESPACE}. */
-public class SecurityNamespaceHandler extends BaseSpringNamespaceHandler {
-
- /** Credential element name. */
- public static final QName CREDENTIAL_ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "Credential");
-
- /** TrustEngineRef element name. */
- public static final QName TRUST_ENGINE_REF = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "TrustEngineRef");
-
- /** {@inheritDoc} */
- @Override public void init() {
- // Credentials
- registerBeanDefinitionParser(X509ResourceCredentialParser.TYPE_NAME_RESOURCE,
- new X509ResourceCredentialParser());
- registerBeanDefinitionParser(X509InlineCredentialParser.TYPE_NAME, new X509InlineCredentialParser());
- registerBeanDefinitionParser(BasicInlineCredentialParser.TYPE_NAME, new BasicInlineCredentialParser());
- registerBeanDefinitionParser(BasicResourceCredentialParser.TYPE_NAME_RESOURCE,
- new BasicResourceCredentialParser());
-
- registerBeanDefinitionParser(StaticExplicitKeySignatureParser.TYPE_NAME,
- new StaticExplicitKeySignatureParser());
- registerBeanDefinitionParser(StaticPKIXSignatureParser.TYPE_NAME, new StaticPKIXSignatureParser());
- registerBeanDefinitionParser(SignatureChainingParser.TYPE_NAME, new SignatureChainingParser());
-
- // Validation Info
- registerBeanDefinitionParser(PKIXResourceValidationInfoParser.TYPE_NAME_RESOURCE,
- new PKIXResourceValidationInfoParser());
- registerBeanDefinitionParser(PKIXInlineValidationInfoParser.SCHEMA_TYPE, new PKIXInlineValidationInfoParser());
-
- // Validation Opts
- registerBeanDefinitionParser(PKIXValidationOptionsParser.ELEMENT_NAME, new PKIXValidationOptionsParser());
- registerBeanDefinitionParser(CertPathPKIXValidationOptionsParser.ELEMENT_NAME,
- new CertPathPKIXValidationOptionsParser());
-
- //
- // Trust Engines needed for the HttpMetadataProvider
- //
- registerBeanDefinitionParser(ChainingParser.TYPE_NAME, new ChainingParser());
- registerBeanDefinitionParser(StaticExplicitKeyParser.TYPE_NAME, new StaticExplicitKeyParser());
- registerBeanDefinitionParser(StaticPKIXX509CredentialParser.TYPE_NAME, new StaticPKIXX509CredentialParser());
-
- }
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/package-info.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/package-info.java
deleted file mode 100644
index d7cd5b33a..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/impl/package-info.java
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Basis of all parsers in the
- * {link
-net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser#SECURITY_NAMESPACE
-} schema.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.impl;
-
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractBasicPKIXValidationInfoFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractBasicPKIXValidationInfoFactoryBean.java
deleted file mode 100644
index a27099acc..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractBasicPKIXValidationInfoFactoryBean.java
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
-
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-
-/**
- * A factory bean to collect information to do with a {@link BasicPKIXValidationInformation}.
- */
-public abstract class AbstractBasicPKIXValidationInfoFactoryBean extends
- AbstractComponentAwareFactoryBean<BasicPKIXValidationInformation> {
-
- /** Verification depth. */
- @Nullable private Integer verifyDepth;
-
- /** The description of the file with the configuration us. */
- @Nonnull private String configDescription;
-
- /**
- * Get the verify Depth.
- *
- * @return Returns the depth.
- */
- public int getVerifyDepth() {
- return verifyDepth;
- }
-
- /**
- * Set the verify Depth.
- *
- * @param depth The value to set.
- */
- public void setVerifyDepth(final int depth) {
- verifyDepth = depth;
- }
-
- /**
- * For logging, get the description of the resource that defined this bean.
- *
- * @return Returns the description.
- */
- public String getConfigDescription() {
- return configDescription;
- }
-
- /**
- * For logging, set the description of the resource that defined this bean.
- *
- * @param desc what to set.
- */
- public void setConfigDescription(@Nonnull final String desc) {
- configDescription = desc;
- }
-
- /** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
- return BasicPKIXValidationInformation.class;
- }
-
- /** {@inheritDoc} */
- @Override protected BasicPKIXValidationInformation doCreateInstance() throws Exception {
- return new BasicPKIXValidationInformation(getCertificates(), getCRLs(), verifyDepth);
- }
-
- /**
- * Get the configured certificates.
- *
- * @return the certificates.
- */
- @Nullable protected abstract List<X509Certificate> getCertificates();
-
- /**
- * Get the configured CRL list.
- *
- * @return the crls or null
- */
- @Nullable protected abstract List<X509CRL> getCRLs();
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractChainingParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractChainingParser.java
deleted file mode 100644
index 2519cc5f7..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractChainingParser.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.List;
-
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.impl.SecurityNamespaceHandler;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.springframework.beans.BeanMetadataElement;
-import org.springframework.beans.factory.config.RuntimeBeanReference;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.ManagedList;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Base Parser for trust engines of type SignatureChaining and Chaining.
- */
-public abstract class AbstractChainingParser extends AbstractTrustEngineParser {
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- final List<Element> childEngines =
- ElementSupport.getChildElements(element, AbstractMetadataProviderParser.TRUST_ENGINE_ELEMENT_NAME);
- final List<Element> childEngineRefs =
- ElementSupport.getChildElements(element, SecurityNamespaceHandler.TRUST_ENGINE_REF);
-
- final List<BeanMetadataElement> allChildren = new ManagedList<>(childEngines.size()+ childEngineRefs.size());
-
- allChildren.addAll(SpringSupport.parseCustomElements(childEngines, parserContext, builder));
-
- for (final Element ref:childEngineRefs) {
- final String reference = StringSupport.trimOrNull(ref.getAttributeNS(null, "ref"));
- if (null != reference) {
- allChildren.add(new RuntimeBeanReference(StringSupport.trim(reference)));
- }
- }
- builder.addConstructorArgValue(allChildren);
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractPKIXValidationInfoParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractPKIXValidationInfoParser.java
deleted file mode 100644
index ab915ac88..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractPKIXValidationInfoParser.java
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.List;
-
-import javax.xml.namespace.QName;
-
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.ManagedList;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-import net.shibboleth.ext.spring.util.AbstractCustomBeanDefinitionParser;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-/**
- * Base parser for all <ValidationInfo> types. This does all the heavy lifting of creating lists of strings from
- * the sub-elements. The derived classes specify which factory bean to create and that in turn converts from string to
- * CRL or Certificate (either inline or from a file).
- */
-public abstract class AbstractPKIXValidationInfoParser extends AbstractCustomBeanDefinitionParser {
-
- /** The element <Certificate>. */
- private static final QName CERTIFICATE =
- new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "Certificate");
-
- /** The element <CRL>. */
- private static final QName CRL = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "CRL");
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- builder.addPropertyValue("configDescription", parserContext.getReaderContext().getResource().getDescription());
-
- if (element.hasAttributeNS(null, "verifyDepth")) {
- builder.addPropertyValue("verifyDepth",
- StringSupport.trimOrNull(element.getAttributeNS(null, "verifyDepth")));
- }
-
- final List<Element> certificates = ElementSupport.getChildElements(element, CERTIFICATE);
- final List<String> certStrings = new ManagedList<>(certificates.size());
-
- for (final Element cert : certificates) {
- certStrings.add(cert.getTextContent());
- }
-
- builder.addPropertyValue("certificates", certStrings);
-
- final List<Element> crls = ElementSupport.getChildElements(element, CRL);
- final List<String> crlStrings = new ManagedList<>(certificates.size());
-
- for (final Element crl : crls) {
- crlStrings.add(crl.getTextContent());
- }
-
- builder.addPropertyValue("CRLs", crlStrings);
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractStaticPKIXParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractStaticPKIXParser.java
deleted file mode 100644
index 3eb58c87a..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractStaticPKIXParser.java
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.List;
-
-import javax.annotation.Nonnull;
-import javax.xml.namespace.QName;
-
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
-import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
-import org.springframework.beans.factory.config.AbstractFactoryBean;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Base Parser for trust engines of type StaticPKIXKeySignature and StaticPKIXX509Credential.
- */
-public abstract class AbstractStaticPKIXParser extends AbstractTrustEngineParser {
-
- /** Validation Information. */
- public static final QName VALIDATION_INFO = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "ValidationInfo");
-
- /** Trusted Names Information. */
- public static final QName TRUSTED_NAMES = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "TrustedName");
-
- /**
- * Get the definition for the {@link org.opensaml.security.x509.PKIXValidationInformationResolver}. This is
- * constructed from the Trusted names and the Validation Info.
- *
- * @param element what to parse
- * @param parserContext the context to parse inside
- * @return the definition
- */
- protected BeanDefinition getPKIXValidationInformationResolver(@Nonnull final Element element,
- @Nonnull final ParserContext parserContext) {
-
- final List<Element> validationInfoElements = ElementSupport.getChildElements(element, VALIDATION_INFO);
- final List<Element> trustedNameElements = ElementSupport.getChildElements(element, TRUSTED_NAMES);
-
- final BeanDefinitionBuilder builder =
- BeanDefinitionBuilder.genericBeanDefinition(StaticPKIXValidationInformationResolver.class);
- builder.addConstructorArgValue(
- SpringSupport.parseCustomElements(validationInfoElements, parserContext, builder));
- builder.addConstructorArgValue(
- SpringSupport.getElementTextContentAsManagedList(trustedNameElements));
-
- return builder.getBeanDefinition();
- }
-
- /**
- * Get the definition for the {@link org.opensaml.security.x509.PKIXTrustEvaluator}. This is purely a
- * {@link CertPathPKIXTrustEvaluator} constructed with whatever ValidationOptions we provide.
- *
- * @param element what to parse
- * @param parserContext the context to parse inside
- * @return the definition
- */
- protected BeanDefinition getPKIXTrustEvaluator(@Nonnull final Element element,
- @Nonnull final ParserContext parserContext) {
-
- final BeanDefinitionBuilder builder =
- BeanDefinitionBuilder.genericBeanDefinition(CertPathPKIXTrustEvaluator.class);
-
- final List<Element> validationOptionsElements =
- ElementSupport.getChildElements(element, PKIXValidationOptionsParser.ELEMENT_NAME);
-
- if (null != validationOptionsElements && !validationOptionsElements.isEmpty()) {
- builder.addConstructorArgValue(
- SpringSupport.parseCustomElements(validationOptionsElements, parserContext, builder));
- }
- return builder.getBeanDefinition();
- }
-
- /**
- * Get the effective X509CredentialNameEvaluator to use. Currently we return a literal value, but in the future a
- * BeanDefinition could be returned if necessary if we support toggling the name evaluator settings, hence the
- * Object return type.
- *
- * @param element what to parse
- * @param parserContext the context to parse inside
- * @return an X509CredentialNameEvaluator instance or a BeanDefinition. May be null.
- */
- protected Object getX509CredentialNameEvaluator(@Nonnull final Element element,
- @Nonnull final ParserContext parserContext) {
-
- final BeanDefinitionBuilder builder =
- BeanDefinitionBuilder.genericBeanDefinition(X509CredentialNameEvaluatorFactoryBean.class);
- final String attrValue = StringSupport.trimOrNull(element.getAttributeNS(null, "trustedNameCheckEnabled"));
- if (attrValue != null) {
- builder.addPropertyValue("trustedNameCheckEnabled", attrValue);
- }
- return builder.getBeanDefinition();
- }
-
- /**
- * FactoryBean to do a deferred decision on whether to create a {@link X509CredentialNameEvaluator}. This is in a
- * factory bean to allow for property replacement. The default (no value setting) is true.
- */
- protected static class X509CredentialNameEvaluatorFactoryBean extends
- AbstractFactoryBean<X509CredentialNameEvaluator> {
-
- /** Do we emit a {@link X509CredentialNameEvaluator} or not. */
- private boolean trustedNameCheckEnabled = true;
-
- /**
- * Set whether to perform the trusted name check.
- *
- * @param enabled whether we emit a {@link X509CredentialNameEvaluator} .
- */
- public void setTrustedNameCheckEnabled(final boolean enabled) {
- trustedNameCheckEnabled = enabled;
- }
-
- /** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
- return BasicX509CredentialNameEvaluator.class;
- }
-
- /** {@inheritDoc} */
- @Override protected BasicX509CredentialNameEvaluator createInstance() throws Exception {
- if (trustedNameCheckEnabled) {
- return new BasicX509CredentialNameEvaluator();
- }
- return null;
- }
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractTrustEngineParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractTrustEngineParser.java
deleted file mode 100644
index f8da9315c..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/AbstractTrustEngineParser.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import org.springframework.beans.factory.support.AbstractBeanDefinition;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-import net.shibboleth.ext.spring.util.AbstractCustomBeanDefinitionParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * Basis of all parsers for <security:TrustEngine>.
- */
-public abstract class AbstractTrustEngineParser extends AbstractCustomBeanDefinitionParser {
-
- /** {@inheritDoc} */
- @Override protected String resolveId(final Element element, final AbstractBeanDefinition definition,
- final ParserContext parserContext) {
- return StringSupport.trimOrNull(element.getAttributeNS(null, "id"));
- }
-
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
- builder.setLazyInit(true);
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/CertPathPKIXValidationOptionsParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/CertPathPKIXValidationOptionsParser.java
deleted file mode 100644
index 212522238..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/CertPathPKIXValidationOptionsParser.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.List;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.opensaml.security.x509.impl.CertPathPKIXValidationOptions;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.support.ManagedList;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Spring bean definition parser for {urn:mace:shibboleth:2.0:security}ValidationOptions elements which have a type
- * specialization of {urn:mace:shibboleth:2.0:security}CertPathValidationOptionsType.
- */
-public class CertPathPKIXValidationOptionsParser extends PKIXValidationOptionsParser {
- /** Schema type. */
- public static final QName SCHEMA_TYPE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "CertPathValidationOptionsType");
-
- /** PolicyOid Element type. */
- public static final QName POLICY_OID_ELEMENT = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "PolicyOID");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return CertPathPKIXValidationOptions.class;
- }
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- if (element.hasAttributeNS(null, "forceRevocationEnabled")) {
- builder.addPropertyValue("forceRevocationEnabled",
- StringSupport.trimOrNull(element.getAttributeNS(null, "forceRevocationEnabled")));
- }
-
- if (element.hasAttributeNS(null, "revocationEnabled")) {
- builder.addPropertyValue("revocationEnabled",
- StringSupport.trimOrNull(element.getAttributeNS(null, "revocationEnabled")));
- }
-
- if (element.hasAttributeNS(null, "policyMappingInhibit")) {
- builder.addPropertyValue("policyMappingInhibit",
- StringSupport.trimOrNull(element.getAttributeNS(null, "policyMappingInhibit")));
- }
-
- if (element.hasAttributeNS(null, "anyPolicyInhibit")) {
- builder.addPropertyValue("anyPolicyInhibit",
- StringSupport.trimOrNull(element.getAttributeNS(null, "anyPolicyInhibit")));
- }
-
- final List<Element> childElems = ElementSupport.getChildElements(element, POLICY_OID_ELEMENT);
- if (null != childElems && !childElems.isEmpty()) {
- final List<String> initialPolicies = new ManagedList<>(childElems.size());
- for (final Element nameElem : childElems) {
- final String value = StringSupport.trimOrNull(nameElem.getTextContent());
- if (null != value) {
- initialPolicies.add(value);
- }
- }
- builder.addPropertyValue("initialPolicies", initialPolicies);
- }
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingParser.java
deleted file mode 100644
index c5acc59be..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingParser.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of type SignatureChaining.
- */
-public class ChainingParser extends AbstractChainingParser {
-
- /** Schema type. */
- public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "Chaining");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return ChainingTrustEngineFactory.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingSignatureTrustEngineFactory.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingSignatureTrustEngineFactory.java
deleted file mode 100644
index e37a1d75d..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingSignatureTrustEngineFactory.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
-import org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine;
-
-/**
- * Factory bean for {@link ChainingSignatureTrustEngine}. This finesses the issue that some parsers are not supported
- * and return a bean of type object and these cannot be injected into the trust engine. This factory just filters the
- * unsupported engines out. A warning has been issued at point of parse so no further logging is required.
- */
-public class ChainingSignatureTrustEngineFactory extends
- AbstractComponentAwareFactoryBean<ChainingSignatureTrustEngine> {
-
- /** The unfiltered list of putative trust engines. */
- private final List<Object> engines;
-
- /**
- * Constructor.
- *
- * @param list the putative trust engines.
- */
- public ChainingSignatureTrustEngineFactory(@Nonnull final List<Object> list) {
- engines = Constraint.isNotNull(list, "Engine list must be non null");
- }
-
- /** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
- return ChainingSignatureTrustEngine.class;
- }
-
- /** {@inheritDoc} */
- @Override protected ChainingSignatureTrustEngine doCreateInstance() throws Exception {
- final List<SignatureTrustEngine> list = new ArrayList<>(engines.size());
-
- for (final Object engine : engines) {
- if (engine instanceof SignatureTrustEngine) {
- list.add((SignatureTrustEngine) engine);
-
- }
- }
- return new ChainingSignatureTrustEngine(list);
- }
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingTrustEngineFactory.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingTrustEngineFactory.java
deleted file mode 100644
index c30d9004a..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/ChainingTrustEngineFactory.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.trust.impl.ChainingTrustEngine;
-
-/**
- * Factory bean for {@link ChainingTrustEngine}. This finesses the issue that some parsers are not supported
- * and return a bean of type object and these cannot be injected into the trust engine. This factory just filters the
- * unsupported engines out. A warning has been issued at point of parse so no further logging is required.
- */
-public class ChainingTrustEngineFactory extends
- AbstractComponentAwareFactoryBean<ChainingTrustEngine<?>> {
-
- /** The unfiltered list of putative trust engines. */
- private final List<Object> engines;
-
- /**
- * Constructor.
- *
- * @param list the putative trust engines.
- */
- public ChainingTrustEngineFactory(@Nonnull final List<Object> list) {
- engines = Constraint.isNotNull(list, "Engine list must be non null");
- }
-
- /** {@inheritDoc} */
- @Override public Class<?> getObjectType() {
- return ChainingTrustEngine.class;
- }
-
- /** {@inheritDoc} */
- @SuppressWarnings({"rawtypes", "unchecked"})
- @Override protected ChainingTrustEngine<?> doCreateInstance() throws Exception {
- final List<TrustEngine<?>> list = new ArrayList<>(engines.size());
-
- for (final Object engine : engines) {
- if (engine instanceof TrustEngine) {
- list.add((TrustEngine<?>) engine);
-
- }
- }
- return new ChainingTrustEngine(list);
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXInlineValidationInfoFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXInlineValidationInfoFactoryBean.java
deleted file mode 100644
index 62011cebb..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXInlineValidationInfoFactoryBean.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.security.x509.X509Support;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.FatalBeanException;
-
-/**
- * File system specific bean for PKIXValidationInfo.
- */
-public class PKIXInlineValidationInfoFactoryBean extends AbstractBasicPKIXValidationInfoFactoryBean {
-
- /** log. */
- private Logger log = LoggerFactory.getLogger(PKIXInlineValidationInfoFactoryBean.class);
-
- /** The strings to be turned into the certificates. */
- private List<String> certificateFiles;
-
- /** The strings to be turned into the crls. */
- private List<String> crlStrings;
-
- /**
- * Set the file names which we will convert into certificates.
- *
- * @param certs the file names.
- */
- public void setCertificates(@Nullable final List<String> certs) {
- certificateFiles = certs;
- }
-
- /**
- * Set the file names which we will convert into crls.
- *
- * @param crls the file names.
- */
- public void setCRLs(@Nullable final List<String> crls) {
- crlStrings = crls;
- }
-
- /**
- * Get the configured certificates.
- *
- * @return the certificates null
- */
- @Override @Nullable protected List<X509Certificate> getCertificates() {
- if (null == certificateFiles) {
- return null;
- }
- final List<X509Certificate> certificates = new ArrayList<>(certificateFiles.size());
- for (final String cert : certificateFiles) {
- try {
- certificates.add(X509Support.decodeCertificate(cert.trim()));
- } catch (final CertificateException e) {
- log.error("{}: Could not decode provided Certificate: {}", getConfigDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided Certificate", e);
- }
- }
- return certificates;
- }
-
- /**
- * Get the configured CRL list.
- *
- * @return the crls or null
- */
- @Override @Nullable protected List<X509CRL> getCRLs() {
- if (null == crlStrings) {
- return null;
- }
- final List<X509CRL> crls = new ArrayList<>(crlStrings.size());
- for (final String crl : crlStrings) {
- try {
- crls.add(X509Support.decodeCRL(crl));
- } catch (final CRLException | CertificateException e) {
- log.error("{}: Could not decode provided CRL: {}", getConfigDescription(), e.getMessage());
- throw new FatalBeanException("Could not decode provided CRL", e);
- }
- }
- return crls;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXInlineValidationInfoParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXInlineValidationInfoParser.java
deleted file mode 100644
index c2eea4894..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXInlineValidationInfoParser.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.w3c.dom.Element;
-
-/**
- * Parser for <ValidationInfo type="PKIXInline">.
- *
- * <p>
- * All of the heavy lifting is done in the super class and the associated factory bean (which gets the parameters of
- * the type is wants by virtue of Springs type coercion).
- * </p>
- */
-public class PKIXInlineValidationInfoParser extends AbstractPKIXValidationInfoParser {
-
- /** Element Name.*/
- public static final QName SCHEMA_TYPE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "PKIXInline");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return PKIXInlineValidationInfoFactoryBean.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoFactoryBean.java
deleted file mode 100644
index 89ae63a96..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoFactoryBean.java
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.cert.CRLException;
-import java.security.cert.CertificateException;
-import java.security.cert.X509CRL;
-import java.security.cert.X509Certificate;
-import java.util.ArrayList;
-import java.util.List;
-
-import javax.annotation.Nullable;
-
-import org.opensaml.security.x509.X509Support;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.FatalBeanException;
-import org.springframework.core.io.Resource;
-
-/**
- * File system specific bean for PKIXValidationInfo.
- */
-public class PKIXResourceValidationInfoFactoryBean extends AbstractBasicPKIXValidationInfoFactoryBean {
-
- /** log. */
- private Logger log = LoggerFactory.getLogger(PKIXResourceValidationInfoFactoryBean.class);
-
- /** The file to be turned into the certificates. */
- private List<Resource> certificateFiles;
-
- /** The file to be turned into the crls. */
- private List<Resource> crlFiles;
-
- /**
- * Set the file names which we will convert into certificates.
- *
- * @param certs the file names.
- */
- public void setCertificates(@Nullable final List<Resource> certs) {
- certificateFiles = certs;
- }
-
- /**
- * Set the file names which we will convert into crls.
- *
- * @param crls the file names.
- */
- public void setCRLs(@Nullable final List<Resource> crls) {
- crlFiles = crls;
- }
-
- /**
- * Get the configured certificates.
- *
- * @return the certificates null
- */
- @Override @Nullable protected List<X509Certificate> getCertificates() {
- if (null == certificateFiles) {
- return null;
- }
- final List<X509Certificate> certificates = new ArrayList<>(certificateFiles.size());
- for (final Resource f : certificateFiles) {
- try(InputStream is = f.getInputStream()) {
- certificates.addAll(X509Support.decodeCertificates(is));
- } catch (final CertificateException | IOException e) {
- log.error("{}: Could not decode Certificate at {}: {}", getConfigDescription(), f.getDescription(),
- e.getMessage());
- throw new FatalBeanException("Could not decode provided CertificateFile: " + f.getDescription(), e);
- }
- }
- return certificates;
- }
-
- /**
- * Get the configured CRL list.
- *
- * @return the crls or null
- */
- @Override @Nullable protected List<X509CRL> getCRLs() {
- if (null == crlFiles) {
- return null;
- }
- final List<X509CRL> crls = new ArrayList<>(crlFiles.size());
- for (final Resource crlFile : crlFiles) {
- try(InputStream is = crlFile.getInputStream()) {
- crls.addAll(X509Support.decodeCRLs(is));
- } catch (final CRLException | IOException e) {
- log.error("{}: Could not decode CRL file at {}: {}", getConfigDescription(), crlFile.getDescription(),
- e.getMessage());
- throw new FatalBeanException("Could not decode provided CRL file " + crlFile.getDescription(), e);
- }
- }
- return crls;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoParser.java
deleted file mode 100644
index 8b0f7462e..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXResourceValidationInfoParser.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import org.w3c.dom.Element;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-/**
- * Parser for <ValidationInfo type="PKIXFilesystem"> and <ValidationInfo type="PKIXResourceBacked">.
- *
- * <p>
- * All of the heavy lifting is done in the super class and the associated factory bean (which gets the parameters of the
- * type is wants by virtue of Springs type coercion).
- * </p>
- */
-public class PKIXResourceValidationInfoParser extends AbstractPKIXValidationInfoParser {
-
- /** Schema type for PKIXResourceBackedValidationInformation. */
- public static final QName TYPE_NAME_RESOURCE = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "PKIXResourceBacked");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return PKIXResourceValidationInfoFactoryBean.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXValidationOptionsParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXValidationOptionsParser.java
deleted file mode 100644
index 5048e3ef1..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/PKIXValidationOptionsParser.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import org.opensaml.security.x509.PKIXValidationOptions;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-import net.shibboleth.ext.spring.util.AbstractCustomBeanDefinitionParser;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-
-/**
- * A Parser for the < ValidationOptions > within a StaticPKIXSignature.
- */
-public class PKIXValidationOptionsParser extends AbstractCustomBeanDefinitionParser {
-
- /** Validation Options. */
- public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "ValidationOptions");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return PKIXValidationOptions.class;
- }
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- if (element.hasAttributeNS(null, "processEmptyCRLs")) {
- builder.addPropertyValue("processEmptyCRLs",
- StringSupport.trimOrNull(element.getAttributeNS(null, "processEmptyCRLs")));
- }
-
- if (element.hasAttributeNS(null, "processExpiredCRLs")) {
- builder.addPropertyValue("processExpiredCRLs",
- StringSupport.trimOrNull(element.getAttributeNS(null, "processExpiredCRLs")));
- }
-
- if (element.hasAttributeNS(null, "processCredentialCRLs")) {
- builder.addPropertyValue("processCredentialCRLs",
- StringSupport.trimOrNull(element.getAttributeNS(null, "processCredentialCRLs")));
- }
-
- if (element.hasAttributeNS(null, "defaultVerificationDepth")) {
- builder.addPropertyValue("defaultVerificationDepth",
- StringSupport.trimOrNull(element.getAttributeNS(null, "defaultVerificationDepth")));
- }
- }
-
- /** {@inheritDoc} */
- @Override protected boolean shouldGenerateId() {
- return true;
- }
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/SignatureChainingParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/SignatureChainingParser.java
deleted file mode 100644
index ee8e7f6e3..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/SignatureChainingParser.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of type SignatureChaining.
- */
-public class SignatureChainingParser extends AbstractChainingParser {
-
- /** Schema type. */
- public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "SignatureChaining");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return ChainingSignatureTrustEngineFactory.class;
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticExplicitKeyParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticExplicitKeyParser.java
deleted file mode 100644
index b2334a58d..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticExplicitKeyParser.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.List;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl.AbstractCredentialParser;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of type StaticExplicitKey TrustEngine.
- */
-public class StaticExplicitKeyParser extends AbstractTrustEngineParser {
-
- /** Schema type. */
- public static final QName TYPE_NAME =
- new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "StaticExplicitKey");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return ExplicitKeyTrustEngine.class;
- }
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- final List<Element> credentials =
- ElementSupport.getChildElements(element, AbstractCredentialParser.CREDENTIAL_ELEMENT_NAME);
-
- final BeanDefinitionBuilder resolver =
- BeanDefinitionBuilder.genericBeanDefinition(StaticCredentialResolver.class);
- resolver.addConstructorArgValue(SpringSupport.parseCustomElements(credentials, parserContext, resolver));
-
- builder.addConstructorArgValue(resolver.getBeanDefinition());
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticExplicitKeySignatureParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticExplicitKeySignatureParser.java
deleted file mode 100644
index 11cecd9d8..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticExplicitKeySignatureParser.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import java.util.List;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-import net.shibboleth.idp.profile.spring.relyingparty.security.credential.impl.AbstractCredentialParser;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap;
-import org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of type StaticExplicitKeySignature.
- */
-public class StaticExplicitKeySignatureParser extends AbstractTrustEngineParser {
-
- /** Schema type. */
- public static final QName TYPE_NAME =
- new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE, "StaticExplicitKeySignature");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return ExplicitKeySignatureTrustEngine.class;
- }
-
- /** {@inheritDoc} */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- final List<Element> credentials =
- ElementSupport.getChildElements(element, AbstractCredentialParser.CREDENTIAL_ELEMENT_NAME);
-
- final BeanDefinitionBuilder resolver =
- BeanDefinitionBuilder.genericBeanDefinition(StaticCredentialResolver.class);
- resolver.addConstructorArgValue(SpringSupport.parseCustomElements(credentials, parserContext, resolver));
-
- builder.addConstructorArgValue(resolver.getBeanDefinition());
-
- builder.addConstructorArgValue(DefaultSecurityConfigurationBootstrap
- .buildBasicInlineKeyInfoCredentialResolver());
- }
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticPKIXSignatureParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticPKIXSignatureParser.java
deleted file mode 100644
index c44fb65c3..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticPKIXSignatureParser.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.opensaml.xmlsec.config.impl.DefaultSecurityConfigurationBootstrap;
-import org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of type StaticPKIXKeySignature.
- */
-public class StaticPKIXSignatureParser extends AbstractStaticPKIXParser {
-
- /** Schema type. */
- public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "StaticPKIXSignature");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return PKIXSignatureTrustEngine.class;
- }
-
- /**
- * {@inheritDoc}
- *
- * <p>We call into
- * {@link
- * PKIXSignatureTrustEngine#PKIXSignatureTrustEngine(
- * org.opensaml.security.x509.PKIXValidationInformationResolver,
- * org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver,
- * org.opensaml.security.x509.PKIXTrustEvaluator,
- * org.opensaml.security.x509.impl.X509CredentialNameEvaluator)}.
- * </p>
- */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- builder.addConstructorArgValue(getPKIXValidationInformationResolver(element, parserContext));
- builder.addConstructorArgValue(DefaultSecurityConfigurationBootstrap
- .buildBasicInlineKeyInfoCredentialResolver());
- builder.addConstructorArgValue(getPKIXTrustEvaluator(element, parserContext));
- builder.addConstructorArgValue(getX509CredentialNameEvaluator(element, parserContext));
- }
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticPKIXX509CredentialParser.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticPKIXX509CredentialParser.java
deleted file mode 100644
index 6f3be316d..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/StaticPKIXX509CredentialParser.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
-
-import javax.xml.namespace.QName;
-
-import net.shibboleth.idp.profile.spring.relyingparty.metadata.AbstractMetadataProviderParser;
-
-import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.w3c.dom.Element;
-
-/**
- * Parser for trust engines of type StaticPKIXX509Credential.
- */
-public class StaticPKIXX509CredentialParser extends AbstractStaticPKIXParser {
-
- /** Schema type. */
- public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.SECURITY_NAMESPACE,
- "StaticPKIXX509Credential");
-
- /** {@inheritDoc} */
- @Override protected Class<?> getBeanClass(final Element element) {
- return PKIXX509CredentialTrustEngine.class;
- }
-
- /**
- * {@inheritDoc}
- *
- * <p>
- * We call into
- * {@link PKIXX509CredentialTrustEngine#PKIXX509CredentialTrustEngine(
- * org.opensaml.security.x509.PKIXValidationInformationResolver,
- * org.opensaml.security.x509.PKIXTrustEvaluator,
- * org.opensaml.security.x509.impl.X509CredentialNameEvaluator)}.
- * </p>
- */
- @Override protected void doParse(final Element element, final ParserContext parserContext,
- final BeanDefinitionBuilder builder) {
- super.doParse(element, parserContext, builder);
-
- builder.addConstructorArgValue(getPKIXValidationInformationResolver(element, parserContext));
- builder.addConstructorArgValue(getPKIXTrustEvaluator(element, parserContext));
- builder.addConstructorArgValue(getX509CredentialNameEvaluator(element, parserContext));
- }
-
-}
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/package-info.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/package-info.java
deleted file mode 100644
index d99335a6f..000000000
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/impl/package-info.java
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Parsers to deal with <security:TrustEngine>.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl;
\ No newline at end of file
diff --git a/idp-profile-spring/src/main/resources/META-INF/spring.handlers b/idp-profile-spring/src/main/resources/META-INF/spring.handlers
index 3801cfc5f..93a3c0144 100644
--- a/idp-profile-spring/src/main/resources/META-INF/spring.handlers
+++ b/idp-profile-spring/src/main/resources/META-INF/spring.handlers
@@ -1,3 +1,2 @@
urn\:mace\:shibboleth\:2.0\:metadata = net.shibboleth.idp.profile.spring.relyingparty.metadata.impl.MetadataNamespaceHandler
urn\:mace\:shibboleth\:2.0\:resource = net.shibboleth.idp.profile.spring.resource.impl.ResourceNamespaceHandler
-urn\:mace\:shibboleth\:2.0\:security = net.shibboleth.idp.profile.spring.relyingparty.security.impl.SecurityNamespaceHandler
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBeanTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBeanTest.java
deleted file mode 100644
index f312228f6..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBeanTest.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import org.opensaml.security.x509.BasicX509Credential;
-import org.springframework.context.support.GenericApplicationContext;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext;
-import net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader;
-
-/**
- *
- */
- at SuppressWarnings("javadoc")
-public class BasicX509CredentialFactoryBeanTest {
-
- @Test public void bean() {
- final GenericApplicationContext context = new FilesystemGenericApplicationContext();
- context.setDisplayName("ApplicationContext: X509Credential");
- final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
- new SchemaTypeAwareXMLBeanDefinitionReader(context);
-
- beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/bean.xml");
-
- context.refresh();
-
- final BasicX509Credential cred1 = context.getBean("Credential", BasicX509Credential.class);
-
- final BasicX509Credential cred2 = context.getBean("EncCredential", BasicX509Credential.class);
-
- Assert.assertEquals("http://example.org/enc", cred2.getEntityId());
-
- final byte[] cb1 = cred1.getPrivateKey().getEncoded();
- final byte[] cb2 = cred2.getPrivateKey().getEncoded();
-
- Assert.assertEquals(cb1.length, cb2.length);
-
- for (int i = 0; i< cb1.length; i++)Assert.assertEquals(cb1[i], cb2[i]);
-
- Assert.assertEquals(cred2.getPublicKey(), cred2.getPublicKey());
-
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBeanTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBeanTest.java
deleted file mode 100644
index 5b3023266..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/factory/StaticPKIXFactoryBeanTest.java
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.factory;
-
-import java.util.Set;
-
-import org.opensaml.security.SecurityException;
-import org.opensaml.security.x509.PKIXTrustEvaluator;
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.PKIXValidationOptions;
-import org.opensaml.security.x509.X509Credential;
-import org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
-import org.opensaml.security.x509.impl.X509CredentialNameEvaluator;
-import org.springframework.beans.FatalBeanException;
-import org.springframework.context.support.GenericApplicationContext;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-import net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext;
-import net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader;
-
-/**
- *
- */
- at SuppressWarnings("javadoc")
-public class StaticPKIXFactoryBeanTest {
-
- @Test
- public void defaults() {
- final GenericApplicationContext context = new FilesystemGenericApplicationContext();
- context.setDisplayName("ApplicationContext: X509Credential");
- final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
- new SchemaTypeAwareXMLBeanDefinitionReader(context);
-
- beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/static-pkix-factory-defaults.xml");
-
- context.refresh();
-
- final PKIXX509CredentialTrustEngine trustEngine = context.getBean("StaticPKIXX509CredentialTrustEngine",
- PKIXX509CredentialTrustEngine.class);
-
- Assert.assertNotNull(trustEngine);
-
- Assert.assertTrue(StaticPKIXValidationInformationResolver.class.isInstance((trustEngine.getPKIXResolver())));
-
- Assert.assertTrue(CertPathPKIXTrustEvaluator.class.isInstance((trustEngine.getPKIXTrustEvaluator())));
-
- Assert.assertTrue(BasicX509CredentialNameEvaluator.class.isInstance((trustEngine.getX509CredentialNameEvaluator())));
- }
-
- @Test
- public void customPropertiesSuccess() {
- final GenericApplicationContext context = new FilesystemGenericApplicationContext();
- context.setDisplayName("ApplicationContext: X509Credential");
- final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
- new SchemaTypeAwareXMLBeanDefinitionReader(context);
-
- beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-success.xml");
-
- context.refresh();
-
- final PKIXX509CredentialTrustEngine trustEngine = context.getBean("StaticPKIXX509CredentialTrustEngine",
- PKIXX509CredentialTrustEngine.class);
-
- Assert.assertNotNull(trustEngine);
-
- Assert.assertTrue(StaticPKIXValidationInformationResolver.class.isInstance((trustEngine.getPKIXResolver())));
-
- Assert.assertTrue(MockPKIXTrustEvaluator.class.isInstance((trustEngine.getPKIXTrustEvaluator())));
-
- Assert.assertTrue(MockX509CredentialNameEvaluator.class.isInstance((trustEngine.getX509CredentialNameEvaluator())));
- }
-
- @Test(expectedExceptions=FatalBeanException.class)
- public void customPropertiesFailsValidation() {
- final GenericApplicationContext context = new FilesystemGenericApplicationContext();
- context.setDisplayName("ApplicationContext: X509Credential");
- final SchemaTypeAwareXMLBeanDefinitionReader beanDefinitionReader =
- new SchemaTypeAwareXMLBeanDefinitionReader(context);
-
- beanDefinitionReader.loadBeanDefinitions("net/shibboleth/idp/profile/spring/factory/static-pkix-factory-custom-failsValidation.xml");
-
- context.refresh();
- }
-
-
- //
- // Helpers
- //
-
- public static class MockPKIXTrustEvaluator implements PKIXTrustEvaluator {
-
- /** {@inheritDoc} */
- public boolean validate(PKIXValidationInformation validationInfo, X509Credential untrustedCredential)
- throws SecurityException {
- return false;
- }
-
- /** {@inheritDoc} */
- public PKIXValidationOptions getPKIXValidationOptions() {
- return null;
- }
-
- }
-
- public static class MockX509CredentialNameEvaluator implements X509CredentialNameEvaluator {
-
- /** {@inheritDoc} */
- public boolean evaluate(X509Credential credential, Set<String> trustedNames) throws SecurityException {
- return false;
- }
-
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/AbstractSecurityParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/AbstractSecurityParserTest.java
deleted file mode 100644
index d85629319..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/AbstractSecurityParserTest.java
+++ /dev/null
@@ -1,97 +0,0 @@
-
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security;
-
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.Collections;
-
-import net.shibboleth.ext.spring.util.ApplicationContextBuilder;
-
-import org.springframework.context.support.GenericApplicationContext;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.mock.env.MockPropertySource;
-import org.testng.annotations.AfterMethod;
-import org.testng.annotations.BeforeSuite;
-
-/**
- * Base mechanics for Security parser tests
- */
- at SuppressWarnings("javadoc")
-public class AbstractSecurityParserTest {
-
- private static final String PATH = "/net/shibboleth/idp/profile/spring/relyingparty/security/";
-
- protected static final String SP_ID = "https://sp.example.org/sp/shibboleth";
- protected static final String IDP_ID = "https://idp.example.org/idp/shibboleth";
-
- static private String workspaceDirName;
-
- private GenericApplicationContext pendingTeardownContext = null;
-
- @AfterMethod public void tearDownTestContext() {
- if (null == pendingTeardownContext ) {
- return;
- }
- pendingTeardownContext.close();
- pendingTeardownContext = null;
- }
-
- protected void setTestContext(final GenericApplicationContext context) {
- tearDownTestContext();
- pendingTeardownContext = context;
- }
-
- @BeforeSuite public void setupDirs() throws IOException {
- final ClassPathResource resource = new ClassPathResource(PATH);
- workspaceDirName = resource.getFile().getAbsolutePath();
- }
-
- protected <T> T getBean(final Class<T> claz, final String... files) throws IOException{
- return getBean(null, claz, files);
- }
-
- protected <T> T getBean(final String name, final Class<T> claz, final String... files) throws IOException{
- final Resource[] resources = new Resource[files.length];
-
- for (int i = 0; i < files.length; i++) {
- resources[i] = new ClassPathResource(PATH + files[i]);
- }
-
- final ApplicationContextBuilder builder = new ApplicationContextBuilder();
-
- builder.setName("ApplicationContext: " + claz);
-
- final MockPropertySource mockEnvVars = new MockPropertySource();
- mockEnvVars.setProperty("DIR", workspaceDirName);
- builder.setPropertySources(Collections.singletonList(mockEnvVars));
-
- builder.setServiceConfigurations(Arrays.asList(resources));
-
- final GenericApplicationContext context = builder.build();
-
- setTestContext(context);
-
- if (name != null) {
- return context.getBean(name, claz);
- }
- return context.getBean(claz);
- }
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/BasicInlineParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/BasicInlineParserTest.java
deleted file mode 100644
index d121d1b8b..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/BasicInlineParserTest.java
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential;
-
-import java.io.IOException;
-
-import javax.crypto.SecretKey;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.Credential;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test parsing Basic Inline Credentials
- */
- at SuppressWarnings("javadoc")
-public class BasicInlineParserTest extends AbstractSecurityParserTest {
-
- @Test public void publicOnly() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/inlinePublicOnly.xml");
-
- Assert.assertNull(credential.getPrivateKey());
- }
-/*
- @Test(expectedExceptions={BeanCreationException.class,}) public void wrongCert() throws IOException {
- getBean(Credential.class, true, "credential/inlineWrongCert.xml");
- }
- */
- @Test public void publicPrivate() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/inlinePublicPrivate.xml");
- Assert.assertNotNull(credential.getPrivateKey());
-
- }
-
- @Test public void secretBase64() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/secretKeyAESBase64.xml");
- Assert.assertNotNull(credential.getSecretKey());
- SecretKey key = credential.getSecretKey();
- Assert.assertEquals(key.getAlgorithm(), "AES");
- }
-
- @Test public void secretHex() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/secretKeyAESHex.xml");
- Assert.assertNotNull(credential.getSecretKey());
- SecretKey key = credential.getSecretKey();
- Assert.assertEquals(key.getAlgorithm(), "AES");
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/BasicResourceParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/BasicResourceParserTest.java
deleted file mode 100644
index ece1e778a..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/BasicResourceParserTest.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential;
-
-import java.io.IOException;
-
-import javax.crypto.SecretKey;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.Credential;
-import org.springframework.beans.factory.BeanCreationException;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test parsing Basic File System and Resource Credentials
- */
- at SuppressWarnings("javadoc")
-public class BasicResourceParserTest extends AbstractSecurityParserTest {
-
- @Test public void publicOnly() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/resourcePublicOnly.xml");
-
- Assert.assertNull(credential.getPrivateKey());
- }
-
- @Test(expectedExceptions={BeanCreationException.class,}) public void wrongCert() throws IOException {
- getBean(Credential.class, "credential/resourceWrongPublic.xml");
- }
-
- @Test public void publicPrivate() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/resourcePublicPrivate.xml");
- Assert.assertNotNull(credential.getPrivateKey());
-
- }
-
- @Test public void secretBase64() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/resourceSecretAESBase64.xml");
- Assert.assertNotNull(credential.getSecretKey());
- SecretKey key = credential.getSecretKey();
- Assert.assertEquals(key.getAlgorithm(), "AES");
- }
-
- @Test public void secretHex() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/resourceSecretAESHex.xml");
- Assert.assertNotNull(credential.getSecretKey());
- SecretKey key = credential.getSecretKey();
- Assert.assertEquals(key.getAlgorithm(), "AES");
- }
-
- @Test public void secretBinary() throws IOException {
- final BasicCredential credential =
- (BasicCredential) getBean(Credential.class, "credential/resourceSecretAESBinary.xml");
- Assert.assertNotNull(credential.getSecretKey());
- SecretKey key = credential.getSecretKey();
- Assert.assertEquals(key.getAlgorithm(), "AES");
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/X509FilesystemParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/X509FilesystemParserTest.java
deleted file mode 100644
index ebeb82a61..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/X509FilesystemParserTest.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.springframework.beans.factory.BeanCreationException;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test parsing X509 Filesystem Credentials
- */
- at SuppressWarnings("javadoc")
-public class X509FilesystemParserTest extends AbstractSecurityParserTest {
-
- private BasicX509Credential lookup(String file) throws IOException {
- return (BasicX509Credential) getBean(Credential.class, "credential/" + file);
- }
-
- @Test public void certOnly() throws IOException {
- final BasicX509Credential credential = lookup("resourceCertOnly.xml");
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(),
- Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
- }
-
- @Test(expectedExceptions = {BeanCreationException.class,}) public void twoCert() throws IOException {
- lookup("resourceTwoCert.xml");
- }
-
- @Test(expectedExceptions = {BeanCreationException.class,}) public void wrongCert() throws IOException {
- lookup("resourceWrongCert.xml");
- }
-
- @Test public void certKeyCrl() throws IOException {
- final BasicX509Credential credential = lookup("resourceKeyCertCrl.xml");
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(),
- Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 3);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
- Assert.assertEquals(credential.getCRLs().size(), 1);
- Assert.assertEquals(credential.getCRLs().iterator().next().getNextUpdate().getTime(),
- Instant.parse("2007-09-02T14:14:48Z").toEpochMilli());
- }
-
- @Test public void certElementsKeyNames() throws IOException {
- final BasicX509Credential credential = lookup("resourceCertElementsKeyName.xml");
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(),
- Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
-
- Assert.assertEquals(credential.getUsageType(), UsageType.SIGNING);
- Assert.assertEquals(credential.getKeyNames().size(), 2);
- Assert.assertTrue(credential.getKeyNames().contains("Name1"));
- Assert.assertTrue(credential.getKeyNames().contains("Name2"));
-
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/X509InlineParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/X509InlineParserTest.java
deleted file mode 100644
index e8bada0a7..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/credential/X509InlineParserTest.java
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.credential;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.springframework.beans.factory.BeanCreationException;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test parsing X509 Inline Credentials
- */
- at SuppressWarnings("javadoc")
-public class X509InlineParserTest extends AbstractSecurityParserTest {
-
- @Test public void certOnly() throws IOException {
- final BasicX509Credential credential =
- (BasicX509Credential) getBean(Credential.class, "credential/inlineCertOnly.xml");
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
- }
-
- @Test(expectedExceptions={BeanCreationException.class,}) public void wrongCert() throws IOException {
- getBean(Credential.class, "credential/inlineWrongCert.xml");
- }
-
- @Test public void certKeyCrl() throws IOException {
- final BasicX509Credential credential =
- (BasicX509Credential) getBean(Credential.class, "credential/inlineKeyCertCrl.xml");
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 3);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
- Assert.assertEquals(credential.getCRLs().size(), 1);
- Assert.assertEquals(credential.getCRLs().iterator().next().getNextUpdate().getTime(), Instant.parse("2007-09-02T14:14:48Z").toEpochMilli());
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/ChainingTrustEngineTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/ChainingTrustEngineTest.java
deleted file mode 100644
index b8b93b1c0..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/ChainingTrustEngineTest.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.SecurityException;
-import org.opensaml.security.trust.impl.ChainingTrustEngine;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
- at SuppressWarnings("javadoc")
-public class ChainingTrustEngineTest extends AbstractSecurityParserTest {
-
- private ChainingTrustEngine<?> lookup(String file) throws IOException {
- return getBean(ChainingTrustEngine.class, "trustengine/" + file);
- }
-
-
- @Test public void one() throws IOException, SecurityException {
- final ChainingTrustEngine<?> engine = lookup("chainingTrue.xml");
-
- Assert.assertEquals(engine.getChain().size(), 1);
- Assert.assertTrue(engine.validate(null, null));
- }
-
- @Test public void two() throws IOException, SecurityException {
- final ChainingTrustEngine<?> engine = lookup("chainingTrueFalse.xml");
-
- Assert.assertEquals(engine.getChain().size(), 2);
- Assert.assertTrue(engine.validate(null, null));
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/MockTrustEngine.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/MockTrustEngine.java
deleted file mode 100644
index 178b550e7..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/MockTrustEngine.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
-import org.opensaml.security.SecurityException;
-import org.opensaml.security.trust.TrustEngine;
-
- at SuppressWarnings("javadoc")
-public class MockTrustEngine<T> implements TrustEngine<T> {
-
- private final boolean result;
-
- /**
- * Constructor.
- *
- * @param retVal ...
- */
- public MockTrustEngine(boolean retVal) {
- result = retVal;
- }
-
- /** {@inheritDoc} */
- @Override public boolean validate(T token, CriteriaSet trustBasisCriteria) throws SecurityException {
- return result;
- }
-
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXFilesystemParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXFilesystemParserTest.java
deleted file mode 100644
index 962dab5ed..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXFilesystemParserTest.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for parsing of filesystem backed ValidationInfo
- */
- at SuppressWarnings("javadoc")
-public class PKIXFilesystemParserTest extends AbstractSecurityParserTest {
-
- private BasicPKIXValidationInformation lookup(String file) throws IOException {
- return (BasicPKIXValidationInformation) getBean(PKIXValidationInformation.class, "trustengine/" + file);
- }
-
- @Test public void simple() throws IOException {
- final BasicPKIXValidationInformation info = lookup("resourceValidationInfo.xml");
- Assert.assertNull(info.getVerificationDepth());
- Assert.assertTrue(info.getCertificates().isEmpty());
- Assert.assertTrue(info.getCRLs().isEmpty());
- }
-
- @Test public void complex() throws IOException {
- final BasicPKIXValidationInformation info = lookup("resourceValidationInfoValues.xml");
- Assert.assertEquals(info.getVerificationDepth().intValue(), 99);
- Assert.assertEquals(info.getCertificates().size(), 2);
- Assert.assertEquals(info.getCRLs().size(), 1);
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXInlineParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXInlineParserTest.java
deleted file mode 100644
index 51e2283a6..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXInlineParserTest.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for parsing of inline ValidationInfo
- */
- at SuppressWarnings("javadoc")
-public class PKIXInlineParserTest extends AbstractSecurityParserTest {
-
- private BasicPKIXValidationInformation lookup(String file) throws IOException {
- return (BasicPKIXValidationInformation) getBean(PKIXValidationInformation.class, "trustengine/" + file);
- }
-
- @Test public void simple() throws IOException {
- final BasicPKIXValidationInformation info = lookup("inlineValidationInfo.xml");
- Assert.assertNull(info.getVerificationDepth());
- Assert.assertTrue(info.getCertificates().isEmpty());
- Assert.assertTrue(info.getCRLs().isEmpty());
- }
-
- @Test(enabled=true) public void complex() throws IOException {
- final BasicPKIXValidationInformation info = lookup("inlineValidationInfoValues.xml");
- Assert.assertEquals(info.getVerificationDepth().intValue(), 98);
- Assert.assertEquals(info.getCertificates().size(), 2);
- Assert.assertEquals(info.getCRLs().size(), 1);
- }
-
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXValidationOptionsParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXValidationOptionsParserTest.java
deleted file mode 100644
index 899a91168..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/PKIXValidationOptionsParserTest.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.idp.profile.spring.relyingparty.security.trustengine.impl.PKIXValidationOptionsParser;
-
-import org.opensaml.security.x509.PKIXValidationOptions;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * Test for {@link PKIXValidationOptionsParser}.
- */
- at SuppressWarnings("javadoc")
-public class PKIXValidationOptionsParserTest extends AbstractSecurityParserTest {
-
-
- @Test public void simple() throws IOException {
- PKIXValidationOptions what = getBean(PKIXValidationOptions.class, "trustengine/validationOptions.xml");
-
- Assert.assertTrue(what.isProcessCredentialCRLs());
- Assert.assertTrue(what.isProcessEmptyCRLs());
- Assert.assertTrue(what.isProcessExpiredCRLs());
- Assert.assertEquals(what.getDefaultVerificationDepth(), Integer.valueOf(1));
- }
-
- @Test public void complex() throws IOException {
- PKIXValidationOptions what = getBean(PKIXValidationOptions.class, "trustengine/validationOptionsValues.xml");
-
- Assert.assertFalse(what.isProcessCredentialCRLs());
- Assert.assertFalse(what.isProcessEmptyCRLs());
- Assert.assertTrue(what.isProcessExpiredCRLs());
- Assert.assertEquals(what.getDefaultVerificationDepth(), Integer.valueOf(2));
- }
-
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java
deleted file mode 100644
index 65376e5f0..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/SignatureChainingParserTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.trust.TrustedCredentialTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for xsi:type="security:StaticExplicitKeySignature".
- */
- at SuppressWarnings("javadoc")
-public class SignatureChainingParserTest extends AbstractSecurityParserTest {
-
- @Test public void simple() throws IOException, ResolverException {
- final ChainingSignatureTrustEngine chain = getBean(ChainingSignatureTrustEngine.class, "trustengine/chain.xml");
-
- Assert.assertEquals(chain.getChain().size(),2);
-
- final TrustedCredentialTrustEngine<?> engine = (TrustedCredentialTrustEngine<?>) chain.getChain().get(1);
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
-
- BasicX509Credential credential = (BasicX509Credential) resolver.resolveSingle(null);
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
-
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeyFactoryBeanTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeyFactoryBeanTest.java
deleted file mode 100644
index d692f9351..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeyFactoryBeanTest.java
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-import java.time.Instant;
-import java.util.Iterator;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.credential.Credential;
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.opensaml.security.x509.X509Credential;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * Test for StaticExplicitKey factory bean.
- */
- at SuppressWarnings("javadoc")
-public class StaticExplicitKeyFactoryBeanTest extends AbstractSecurityParserTest {
-
- static private String TESTPATH = "trustengine/staticExplicitNative.xml";
-
- @Test public void singleKey() throws IOException, ResolverException {
- final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean("staticKeySingle", TrustEngine.class, TESTPATH);
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
- Credential credential = resolver.resolveSingle(null);
-
- Assert.assertNotNull(credential.getPublicKey());
- }
-
- @Test public void singleCert() throws IOException, ResolverException {
- final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean("staticX509Single", TrustEngine.class, TESTPATH);
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
- X509Credential credential = (X509Credential) resolver.resolveSingle(null);
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
- }
-
- @Test public void multipleCert() throws IOException, ResolverException {
- final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean("staticX509Multiple", TrustEngine.class, TESTPATH);
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
-
- Iterator<Credential> credentials = resolver.resolve(null).iterator();
-
- Assert.assertTrue(credentials.hasNext());
- final X509Credential first = (X509Credential) credentials.next();
- Assert.assertEquals(first.getEntityCertificateChain().size(), 1);
-
- Assert.assertTrue(credentials.hasNext());
- final X509Credential second = (X509Credential) credentials.next();
- Assert.assertEquals(second.getEntityCertificateChain().size(), 1);
- }
-
- @Test public void mixed() throws IOException, ResolverException {
- final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean("staticMixed", TrustEngine.class, TESTPATH);
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
-
- Iterator<Credential> credentials = resolver.resolve(null).iterator();
-
- Assert.assertTrue(credentials.hasNext());
- final Credential first = credentials.next();
- Assert.assertNotNull(first.getPublicKey());
- Assert.assertFalse(first instanceof X509Credential);
-
- Assert.assertTrue(credentials.hasNext());
- final X509Credential second = (X509Credential) credentials.next();
- Assert.assertEquals(second.getEntityCertificateChain().size(), 1);
- Assert.assertEquals(second.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
- }
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeyParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeyParserTest.java
deleted file mode 100644
index 2e0c51676..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeyParserTest.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.trust.impl.ExplicitKeyTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for xsi:type="security:StaticExplicitKeySignature".
- */
- at SuppressWarnings("javadoc")
-public class StaticExplicitKeyParserTest extends AbstractSecurityParserTest {
-
- @Test public void simple() throws IOException, ResolverException {
- final ExplicitKeyTrustEngine engine = (ExplicitKeyTrustEngine) getBean(TrustEngine.class, "trustengine/staticExplicit.xml");
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
-
- BasicX509Credential credential = (BasicX509Credential) resolver.resolveSingle(null);
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
-
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeySignatureParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeySignatureParserTest.java
deleted file mode 100644
index 46bc518f5..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticExplicitKeySignatureParserTest.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-import java.time.Instant;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.credential.impl.StaticCredentialResolver;
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.trust.TrustedCredentialTrustEngine;
-import org.opensaml.security.x509.BasicX509Credential;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for xsi:type="security:StaticExplicitKeySignature".
- */
- at SuppressWarnings("javadoc")
-public class StaticExplicitKeySignatureParserTest extends AbstractSecurityParserTest {
-
- @Test public void simple() throws IOException, ResolverException {
- final TrustedCredentialTrustEngine<?> engine = (TrustedCredentialTrustEngine<?>) getBean(TrustEngine.class, "trustengine/staticExplicitSignature.xml");
-
- final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
-
- BasicX509Credential credential = (BasicX509Credential) resolver.resolveSingle(null);
-
- Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
- Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-
- Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
-
- }
-}
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXSignatureParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXSignatureParserTest.java
deleted file mode 100644
index 1b2f1c4b3..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXSignatureParserTest.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.PKIXValidationOptions;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXValidationOptions;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
-import org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for xsi:type="security:StaticPKIXKeySignature".
- */
- at SuppressWarnings("javadoc")
-public class StaticPKIXSignatureParserTest extends AbstractSecurityParserTest {
-
- @Test public void simple() throws IOException, ResolverException {
- final PKIXSignatureTrustEngine engine =
- (PKIXSignatureTrustEngine) getBean(TrustEngine.class, "trustengine/staticPKIX.xml");
-
- Assert.assertNotNull(engine.getX509CredentialNameEvaluator());
-
- final StaticPKIXValidationInformationResolver resolver =
- (StaticPKIXValidationInformationResolver) engine.getPKIXResolver();
- Assert.assertTrue(resolver.resolveTrustedNames(null).isEmpty());
-
- final List<PKIXValidationInformation> infos = new ArrayList<>();
- for (final PKIXValidationInformation info : resolver.resolve(null)) {
- infos.add(info);
- }
- Assert.assertEquals(infos.size(), 1);
-
- final CertPathPKIXTrustEvaluator trustEvaluator = (CertPathPKIXTrustEvaluator) engine.getPKIXTrustEvaluator();
- final PKIXValidationOptions options = trustEvaluator.getPKIXValidationOptions();
- Assert.assertTrue(options.isProcessCredentialCRLs());
- Assert.assertTrue(options.isProcessEmptyCRLs());
- Assert.assertTrue(options.isProcessExpiredCRLs());
- Assert.assertEquals(options.getDefaultVerificationDepth().intValue(), 1);
- }
-
- @Test public void nameCheckDisabled() throws IOException, ResolverException {
- final PKIXSignatureTrustEngine engine =
- (PKIXSignatureTrustEngine) getBean(TrustEngine.class, "trustengine/staticPKIX-nameCheckDisabled.xml");
-
- Assert.assertNull(engine.getX509CredentialNameEvaluator());
-
- final StaticPKIXValidationInformationResolver resolver =
- (StaticPKIXValidationInformationResolver) engine.getPKIXResolver();
- Assert.assertTrue(resolver.resolveTrustedNames(null).isEmpty());
-
- final List<PKIXValidationInformation> infos = new ArrayList<>();
- for (final PKIXValidationInformation info : resolver.resolve(null)) {
- infos.add(info);
- }
- Assert.assertEquals(infos.size(), 1);
-
- final CertPathPKIXTrustEvaluator trustEvaluator = (CertPathPKIXTrustEvaluator) engine.getPKIXTrustEvaluator();
- final PKIXValidationOptions options = trustEvaluator.getPKIXValidationOptions();
- Assert.assertTrue(options.isProcessCredentialCRLs());
- Assert.assertTrue(options.isProcessEmptyCRLs());
- Assert.assertTrue(options.isProcessExpiredCRLs());
- Assert.assertEquals(options.getDefaultVerificationDepth().intValue(), 1);
- }
-
- @Test public void values() throws IOException, ResolverException {
- final PKIXSignatureTrustEngine engine =
- (PKIXSignatureTrustEngine) getBean(TrustEngine.class, "trustengine/staticPKIXValues.xml");
-
- Assert.assertNotNull(engine.getX509CredentialNameEvaluator());
-
- final StaticPKIXValidationInformationResolver resolver =
- (StaticPKIXValidationInformationResolver) engine.getPKIXResolver();
- final Set<String> tns = resolver.resolveTrustedNames(null);
- Assert.assertEquals(tns.size(), 3);
- Assert.assertTrue(tns.contains("Name1"));
- Assert.assertTrue(tns.contains("Name2"));
- Assert.assertTrue(tns.contains("Name3"));
-
- final List<PKIXValidationInformation> infos = new ArrayList<>();
- for (final PKIXValidationInformation info : resolver.resolve(null)) {
- infos.add(info);
- }
- Assert.assertEquals(infos.size(), 2);
- final int firstVal = ((BasicPKIXValidationInformation) infos.get(0)).getVerificationDepth().intValue();
- final int secondVal = ((BasicPKIXValidationInformation) infos.get(1)).getVerificationDepth().intValue();
-
- Assert.assertTrue((98 == firstVal) || (99 == firstVal));
- Assert.assertTrue((98 == secondVal) || (99 == secondVal));
- Assert.assertNotEquals(firstVal, secondVal);
-
- final CertPathPKIXTrustEvaluator trustEvaluator = (CertPathPKIXTrustEvaluator) engine.getPKIXTrustEvaluator();
- final PKIXValidationOptions options = trustEvaluator.getPKIXValidationOptions();
- Assert.assertFalse(options.isProcessCredentialCRLs());
- Assert.assertFalse(options.isProcessEmptyCRLs());
- Assert.assertFalse(options.isProcessExpiredCRLs());
- Assert.assertEquals(options.getDefaultVerificationDepth().intValue(), 2);
- }
-
- @Test public void certPath() throws IOException, ResolverException {
- final PKIXSignatureTrustEngine engine =
- (PKIXSignatureTrustEngine) getBean(TrustEngine.class, "trustengine/staticPKIXValuesCertPathOpts.xml");
-
- Assert.assertNotNull(engine.getX509CredentialNameEvaluator());
-
- final StaticPKIXValidationInformationResolver resolver =
- (StaticPKIXValidationInformationResolver) engine.getPKIXResolver();
- final Set<String> tns = resolver.resolveTrustedNames(null);
- Assert.assertEquals(tns.size(), 1);
- Assert.assertTrue(tns.contains("Name1"));
-
- final List<PKIXValidationInformation> infos = new ArrayList<>();
- for (final PKIXValidationInformation info : resolver.resolve(null)) {
- infos.add(info);
- }
- Assert.assertEquals(infos.size(), 1);
- final int value = ((BasicPKIXValidationInformation) infos.get(0)).getVerificationDepth().intValue();
-
- Assert.assertEquals(value, 99);
-
- final CertPathPKIXTrustEvaluator trustEvaluator = (CertPathPKIXTrustEvaluator) engine.getPKIXTrustEvaluator();
- final CertPathPKIXValidationOptions options = (CertPathPKIXValidationOptions) trustEvaluator.getPKIXValidationOptions();
- Assert.assertFalse(options.isProcessCredentialCRLs());
- Assert.assertFalse(options.isProcessEmptyCRLs());
- Assert.assertFalse(options.isProcessExpiredCRLs());
- Assert.assertEquals(options.getDefaultVerificationDepth().intValue(), 3);
-
- Assert.assertFalse(options.isRevocationEnabled());
- Assert.assertTrue(options.isAnyPolicyInhibited());
- Assert.assertTrue(options.isPolicyMappingInhibited());
- Assert.assertTrue(options.isForceRevocationEnabled());
- Assert.assertEquals(options.getInitialPolicies().size(), 1);
- Assert.assertTrue(options.getInitialPolicies().contains("1234"));
- }
-
-}
\ No newline at end of file
diff --git a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXX509CredentialParserTest.java b/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXX509CredentialParserTest.java
deleted file mode 100644
index 2eec5841d..000000000
--- a/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/StaticPKIXX509CredentialParserTest.java
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.profile.spring.relyingparty.security.trustengine;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-
-import net.shibboleth.idp.profile.spring.relyingparty.security.AbstractSecurityParserTest;
-import net.shibboleth.utilities.java.support.resolver.ResolverException;
-
-import org.opensaml.security.trust.TrustEngine;
-import org.opensaml.security.x509.PKIXValidationInformation;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
-import org.opensaml.security.x509.impl.CertPathPKIXValidationOptions;
-import org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine;
-import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * test for xsi:type="security:StaticPKIXX509CredentialParser".
- */
- at SuppressWarnings("javadoc")
-public class StaticPKIXX509CredentialParserTest extends AbstractSecurityParserTest {
-
- @Test public void certPath() throws IOException, ResolverException {
- final PKIXX509CredentialTrustEngine engine =
- (PKIXX509CredentialTrustEngine) getBean(TrustEngine.class, "trustengine/staticPKIXCredentials.xml");
-
- Assert.assertNotNull(engine.getX509CredentialNameEvaluator());
-
- final StaticPKIXValidationInformationResolver resolver =
- (StaticPKIXValidationInformationResolver) engine.getPKIXResolver();
- final Set<String> tns = resolver.resolveTrustedNames(null);
- Assert.assertEquals(tns.size(), 1);
- Assert.assertTrue(tns.contains("Name1"));
-
- final List<PKIXValidationInformation> infos = new ArrayList<>();
- for (final PKIXValidationInformation info : resolver.resolve(null)) {
- infos.add(info);
- }
- Assert.assertEquals(infos.size(), 1);
- final int value = ((BasicPKIXValidationInformation) infos.get(0)).getVerificationDepth().intValue();
-
- Assert.assertEquals(value, 99);
-
- final CertPathPKIXTrustEvaluator trustEvaluator = (CertPathPKIXTrustEvaluator) engine.getPKIXTrustEvaluator();
- final CertPathPKIXValidationOptions options = (CertPathPKIXValidationOptions) trustEvaluator.getPKIXValidationOptions();
- Assert.assertFalse(options.isProcessCredentialCRLs());
- Assert.assertFalse(options.isProcessEmptyCRLs());
- Assert.assertFalse(options.isProcessExpiredCRLs());
- Assert.assertEquals(options.getDefaultVerificationDepth().intValue(), 3);
-
- Assert.assertFalse(options.isRevocationEnabled());
- Assert.assertTrue(options.isAnyPolicyInhibited());
- Assert.assertTrue(options.isPolicyMappingInhibited());
- Assert.assertTrue(options.isForceRevocationEnabled());
- Assert.assertEquals(options.getInitialPolicies().size(), 1);
- Assert.assertTrue(options.getInitialPolicies().contains("1234"));
- }
-
- @Test public void nameCheckDisabled() throws IOException, ResolverException {
- final PKIXX509CredentialTrustEngine engine =
- (PKIXX509CredentialTrustEngine) getBean(TrustEngine.class, "trustengine/staticPKIXCredentials-nameCheckDisabled.xml");
-
- Assert.assertNull(engine.getX509CredentialNameEvaluator());
-
- final StaticPKIXValidationInformationResolver resolver =
- (StaticPKIXValidationInformationResolver) engine.getPKIXResolver();
- final Set<String> tns = resolver.resolveTrustedNames(null);
- Assert.assertEquals(tns.size(), 0);
-
- final List<PKIXValidationInformation> infos = new ArrayList<>();
- for (final PKIXValidationInformation info : resolver.resolve(null)) {
- infos.add(info);
- }
- Assert.assertEquals(infos.size(), 1);
- final int value = ((BasicPKIXValidationInformation) infos.get(0)).getVerificationDepth().intValue();
-
- Assert.assertEquals(value, 99);
-
- final CertPathPKIXTrustEvaluator trustEvaluator = (CertPathPKIXTrustEvaluator) engine.getPKIXTrustEvaluator();
- final CertPathPKIXValidationOptions options = (CertPathPKIXValidationOptions) trustEvaluator.getPKIXValidationOptions();
- Assert.assertFalse(options.isProcessCredentialCRLs());
- Assert.assertFalse(options.isProcessEmptyCRLs());
- Assert.assertFalse(options.isProcessExpiredCRLs());
- Assert.assertEquals(options.getDefaultVerificationDepth().intValue(), 3);
-
- Assert.assertFalse(options.isRevocationEnabled());
- Assert.assertTrue(options.isAnyPolicyInhibited());
- Assert.assertTrue(options.isPolicyMappingInhibited());
- Assert.assertTrue(options.isForceRevocationEnabled());
- Assert.assertEquals(options.getInitialPolicies().size(), 1);
- Assert.assertTrue(options.getInitialPolicies().contains("1234"));
- }
-
-
-}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list