[java-shib-metadata] 02/03: Fix null and annotation issues.

Scott Cantor cantor.2 at osu.edu
Mon Nov 14 16:32:25 UTC 2022


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-metadata.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-metadata.git;a=commit;h=54a790de6b763f73b35a4549716b8dc3ee2dd706

commit 54a790de6b763f73b35a4549716b8dc3ee2dd706
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 14 11:22:28 2022 -0500

    Fix null and annotation issues.
---
 .../shibboleth/idp/saml/metadata/IdPUIInfo.java    |  17 +-
 .../idp/saml/xmlobject/KeyAuthority.java           |   9 +-
 .../net/shibboleth/idp/saml/xmlobject/Scope.java   |  11 +-
 .../idp/saml/metadata/ACSUIInfoTest.java           |   4 +-
 .../idp/saml/metadata/IdPUIInfoTest.java           |   2 +
 .../idp/saml/metadata/OrganizationUIInfoTest.java  |   2 +
 .../metadata/impl/MetadataProviderContainer.java   |  23 ++-
 .../impl/MetadataResolverServiceStrategy.java      |   7 +-
 .../metadata/impl/ReloadableMetadataResolver.java  |   6 +-
 .../security/impl/KeyAuthorityNodeProcessor.java   |   8 +-
 .../MetadataPKIXValidationInformationResolver.java |  51 ++++--
 .../saml/xmlobject/impl/KeyAuthorityBuilder.java   |   8 +-
 .../idp/saml/xmlobject/impl/KeyAuthorityImpl.java  |  13 +-
 .../xmlobject/impl/KeyAuthorityMarshaller.java     |   3 +-
 .../xmlobject/impl/KeyAuthorityUnmarshaller.java   |   6 +-
 .../idp/saml/xmlobject/impl/ScopeBuilder.java      |   7 +-
 .../idp/saml/xmlobject/impl/ScopeImpl.java         |  30 ++--
 .../saml/xmlobject/impl/ScopedValueBuilder.java    |   5 +-
 .../saml/metadata/impl/BaseNodeProcessorTest.java  |   1 +
 .../metadata/impl/ScopesNodeProcessorTest.java     |   4 +-
 .../metadata/impl/UIInfoNodeProcessorTest.java     |   9 +-
 .../impl/KeyAuthorityNodeProcessorTest.java        |   5 +
 ...adataPKIXValidationInformationResolverTest.java | 119 ++++++++++----
 .../idp/saml/xmlobject/impl/KeyAuthorityTest.java  |   3 +
 .../idp/saml/xmlobject/impl/ScopeTest.java         |   2 +
 .../idp/saml/xmlobject/impl/ScopedValueTest.java   |   4 +-
 .../spring/http/HTTPResourceFactoryBean.java       |  25 +--
 .../AbstractDynamicHTTPMetadataProviderParser.java |  38 ++---
 .../AbstractDynamicMetadataProviderParser.java     |  29 ++--
 .../metadata/AbstractMetadataProviderParser.java   |  23 +--
 .../AbstractReloadingMetadataProviderParser.java   |  17 +-
 .../metadata/ChainingMetadataProviderParser.java   |  12 +-
 .../DynamicHTTPMetadataProviderParser.java         |  29 ++--
 .../FileBackedHTTPMetadataProviderParser.java      |  10 +-
 .../metadata/FilesystemMetadataProviderParser.java |  13 +-
 .../metadata/HTTPMetadataProviderParser.java       |  14 +-
 .../HTTPMetadataProvidersParserSupport.java        |   2 -
 .../metadata/InlineMetadataProviderParser.java     |  11 +-
 .../LocalDynamicMetadataProviderParser.java        |  34 ++--
 .../spring/metadata/MetadataNamespaceHandler.java  |   3 +-
 .../ResourceBackedMetadataProviderParser.java      |   7 +-
 .../metadata/filter/AlgorithmFilterParser.java     |   7 +-
 .../spring/metadata/filter/ByReferenceParser.java  |   7 +-
 .../filter/EntitiesDescriptorNameParser.java       |   7 +-
 .../filter/EntityAttributesFilterParser.java       |  12 +-
 .../metadata/filter/EntityRoleFilterParser.java    |  10 +-
 .../spring/metadata/filter/KeyAuthorityParser.java |   7 +-
 .../metadata/filter/NameIDFormatFilterParser.java  |  12 +-
 .../metadata/filter/NodeProcessingParser.java      |   7 +-
 .../PredicateFilterDirectionFactoryBean.java       |   5 +-
 .../metadata/filter/PredicateFilterParser.java     |  16 +-
 .../metadata/filter/RequiredValidUntilParser.java  |  12 +-
 .../metadata/filter/SchemaValidationParser.java    |  18 +--
 .../SignatureValidationCriteriaSetFactoryBean.java |   6 +-
 .../metadata/filter/SignatureValidationParser.java |  42 +++--
 .../credential/AbstractBasicCredentialParser.java  |  23 +--
 .../credential/AbstractCredentialParser.java       |  27 ++--
 .../credential/AbstractX509CredentialParser.java   |  27 ++--
 .../credential/BasicInlineCredentialParser.java    |   4 +-
 .../credential/BasicResourceCredentialParser.java  |   4 +-
 .../credential/X509InlineCredentialParser.java     |   4 +-
 .../credential/X509ResourceCredentialParser.java   |   4 +-
 .../security/trust/AbstractChainingParser.java     |  13 +-
 .../trust/AbstractPKIXValidationInfoParser.java    |  12 +-
 .../security/trust/AbstractTrustEngineParser.java  |  19 ++-
 .../trust/CertPathPKIXValidationOptionsParser.java |  15 +-
 .../spring/security/trust/ChainingParser.java      |  10 +-
 .../trust/PKIXInlineValidationInfoParser.java      |  10 +-
 .../trust/PKIXResourceValidationInfoParser.java    |   9 +-
 .../trust/PKIXValidationOptionsParser.java         |  12 +-
 .../security/trust/SignatureChainingParser.java    |   9 +-
 .../security/trust/StaticExplicitKeyParser.java    |  13 +-
 .../trust/StaticExplicitKeySignatureParser.java    |  13 +-
 .../security/trust/StaticPKIXSignatureParser.java  |  12 +-
 .../trust/StaticPKIXX509CredentialParser.java      |  12 +-
 .../metadata/AbstractMetadataParserTest.java       |   6 +-
 .../DynamicHTTPMetadataProviderParserTest.java     |  12 ++
 .../spring/metadata/EmptyChainService.java         |   1 +
 .../FileBackedHTTPMetadataProviderParserTest.java  | 175 ++++++++++++---------
 .../metadata/FilesystemMetadataParserTest.java     | 100 ++++++------
 .../spring/metadata/InlineMetadataParserTest.java  |   8 +-
 .../LocalDynamicMetadataProviderParserTest.java    |  11 +-
 .../spring/metadata/MetadataFailFastTest.java      |  40 ++---
 .../metadata/filter/AlgorithmFilterParserTest.java |   1 +
 .../filter/ByReferenceFilterParserTest.java        |   2 +
 .../filter/EntityAttributesFilterParserTest.java   |   2 +
 .../filter/EntityRoleFilterParserTest.java         |   2 +
 .../filter/NameIDFormatFilterParserTest.java       |   2 +
 .../spring/metadata/filter/NodeProcessingTest.java |   3 +
 .../filter/RequiredValidUntilParserTest.java       |   3 +
 .../filter/SchemaValidationParserTest.java         |  17 +-
 .../security/credential/BasicInlineParserTest.java |  10 +-
 .../credential/BasicResourceParserTest.java        |  15 +-
 .../credential/X509FilesystemParserTest.java       |   9 +-
 .../security/credential/X509InlineParserTest.java  |   9 +-
 .../security/trust/ChainingTrustEngineTest.java    |  15 +-
 .../spring/security/trust/MockTrustEngine.java     |  14 +-
 .../security/trust/PKIXFilesystemParserTest.java   |  32 +++-
 .../security/trust/PKIXInlineParserTest.java       |  29 +++-
 .../trust/SignatureChainingParserTest.java         |   6 +-
 .../trust/StaticExplicitKeyParserTest.java         |   3 +-
 .../StaticExplicitKeySignatureParserTest.java      |   3 +-
 .../spring/testing/AbstractFailFastTest.java       |  68 ++++++--
 103 files changed, 1038 insertions(+), 606 deletions(-)

diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java
index ffcd170b..a9cad823 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/metadata/IdPUIInfo.java
@@ -36,6 +36,7 @@ import org.opensaml.saml.saml2.metadata.LocalizedURI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 
@@ -157,7 +158,7 @@ public class IdPUIInfo {
      */
     @Nonnull private final Predicate<LocalizedName> nullLanguageString(final String inside) {
         return new Predicate<>() {
-            public boolean test(@Nonnull final LocalizedName u) {
+            public boolean test(final LocalizedName u) {
                 if (u.getXMLLang() == null) {
                     LOG.warn("String with value {} in <{}/> has no language associated, ignoring",
                             u.getValue(), inside);
@@ -199,7 +200,7 @@ public class IdPUIInfo {
      * 
      * @return the display names
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getDisplayNames() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getDisplayNames() {
         return displayNames; 
     }
     
@@ -208,7 +209,7 @@ public class IdPUIInfo {
      *
      * @return the display names
      */
-    @Nonnull @Unmodifiable public Map<Locale, List<String>> getKeywords() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, List<String>> getKeywords() {
         return keywordList;
     }
     
@@ -217,7 +218,7 @@ public class IdPUIInfo {
      *
      * @return the descriptions names (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getDescriptions() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getDescriptions() {
         return descriptions;
     }
     
@@ -226,7 +227,7 @@ public class IdPUIInfo {
      *
      * @return the logos (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, List<Logo>> getLocaleLogos() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, List<Logo>> getLocaleLogos() {
         return localeLogos;
     }
     
@@ -235,7 +236,7 @@ public class IdPUIInfo {
      *
      * @return the logos (if any)
      */
-    @Nonnull @Unmodifiable public List<Logo> getNonLocaleLogos() {
+    @Nonnull @Unmodifiable @NotLive public List<Logo> getNonLocaleLogos() {
         return nonLocaleLogos;
     }
 
@@ -245,7 +246,7 @@ public class IdPUIInfo {
      * 
      * @return the URLs (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getInformationURLs() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getInformationURLs() {
         return informationURLs;
     }
     
@@ -254,7 +255,7 @@ public class IdPUIInfo {
      * 
      * @return the URLs (if any)
      */
-    @Nonnull @Unmodifiable public Map<Locale, String> getPrivacyStatementURLs() {
+    @Nonnull @Unmodifiable @NotLive public Map<Locale, String> getPrivacyStatementURLs() {
         return privacyStatementURLs;
     }
     
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java
index 54f64eb9..d8db7385 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/KeyAuthority.java
@@ -19,23 +19,26 @@ package net.shibboleth.idp.saml.xmlobject;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /** XMLObject for the Shibboleth KeyAuthority metadata extension. */
 public interface KeyAuthority extends AttributeExtensibleXMLObject {
 
     /** Element local name. */
-    public static final String DEFAULT_ELEMENT_LOCAL_NAME = "KeyAuthority";
+    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "KeyAuthority";
 
     /** Default element name. */
-    public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
+    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
             DEFAULT_ELEMENT_LOCAL_NAME, ExtensionsConstants.SHIB_MDEXT10_PREFIX);
 
     /** VerifyDepth attribute name. */
-    public static final String VERIFY_DEPTH_ATTRIB_NAME = "VerifyDepth";
+    @Nonnull @NotEmpty public static final String VERIFY_DEPTH_ATTRIB_NAME = "VerifyDepth";
 
     /**
      * Get the list of KeyInfo child elements.
diff --git a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java
index bac73c84..fca59c69 100644
--- a/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java
+++ b/shib-metadata-api/src/main/java/net/shibboleth/idp/saml/xmlobject/Scope.java
@@ -17,23 +17,26 @@
 
 package net.shibboleth.idp.saml.xmlobject;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.core.xml.schema.XSString;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /** XMLObject for the Shibboleth Scope metadata extension. */
 public interface Scope extends XSString {
 
     /** Element local name. */
-    public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Scope";
+    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Scope";
 
     /** Default element name. */
-    public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
+    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(ExtensionsConstants.SHIB_MDEXT10_NS,
             DEFAULT_ELEMENT_LOCAL_NAME, ExtensionsConstants.SHIB_MDEXT10_PREFIX);
 
     /** regexp attribute name. */
-    public static final String REGEXP_ATTRIB_NAME = "regexp";
+    @Nonnull @NotEmpty public static final String REGEXP_ATTRIB_NAME = "regexp";
 
     /**
      * Get the regexp attribute value.
@@ -63,4 +66,4 @@ public interface Scope extends XSString {
      */
     public void setRegexp(XSBooleanValue newRegexp);
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/ACSUIInfoTest.java b/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/ACSUIInfoTest.java
index 5b121eec..6d6543f2 100644
--- a/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/ACSUIInfoTest.java
+++ b/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/ACSUIInfoTest.java
@@ -38,6 +38,7 @@ public class ACSUIInfoTest extends XMLObjectBaseTestCase {
     @Test public void test() throws XMLParserException, UnmarshallingException {
 
         final AttributeConsumingService acs = unmarshallElement("/ACSUIInfo.xml", true);
+        assert(acs != null);
         final ACSUIInfo info = new ACSUIInfo(acs); 
 
         assertEquals(info.getServiceNames().size(), 2);
@@ -48,8 +49,9 @@ public class ACSUIInfoTest extends XMLObjectBaseTestCase {
     @Test public void testBad() throws XMLParserException, UnmarshallingException {
 
         final AttributeConsumingService acs = unmarshallElement("/ACSUIInfoBad.xml", true);
+        assert(acs != null);
         final ACSUIInfo info = new ACSUIInfo(acs); 
-
+        
         assertTrue(info.getServiceNames().isEmpty());
         assertEquals(info.getServiceDescriptions().size(), 1);
 
diff --git a/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/IdPUIInfoTest.java b/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/IdPUIInfoTest.java
index e9b41583..641ce674 100644
--- a/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/IdPUIInfoTest.java
+++ b/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/IdPUIInfoTest.java
@@ -35,6 +35,7 @@ public class IdPUIInfoTest extends XMLObjectBaseTestCase {
     @Test public void test() {
 
         final UIInfo samluiinfo = unmarshallElement("/UIInfo.xml");
+        assert(samluiinfo != null);
         final IdPUIInfo uiInfo = new IdPUIInfo(samluiinfo);
 
         assertEquals(uiInfo.getDisplayNames().size(), 2);
@@ -50,6 +51,7 @@ public class IdPUIInfoTest extends XMLObjectBaseTestCase {
     @Test public void testBad() {
 
         final UIInfo samluiinfo = unmarshallElement("/UIInfoBad.xml");
+        assert(samluiinfo != null);
         final IdPUIInfo uiInfo = new IdPUIInfo(samluiinfo);
 
         assertEquals(uiInfo.getDisplayNames().size(), 1);
diff --git a/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfoTest.java b/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfoTest.java
index de30b0d2..ca78566c 100644
--- a/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfoTest.java
+++ b/shib-metadata-api/src/test/java/net/shibboleth/idp/saml/metadata/OrganizationUIInfoTest.java
@@ -37,6 +37,7 @@ public class OrganizationUIInfoTest extends XMLObjectBaseTestCase {
     @Test public void test() throws XMLParserException, UnmarshallingException {
 
         final Organization acs = unmarshallElement("/OrganizationUIInfo.xml", true);
+        assert(acs != null);
         final OrganizationUIInfo info = new OrganizationUIInfo(acs); 
 
         assertEquals(info.getOrganizationNames().size(), 2);
@@ -48,6 +49,7 @@ public class OrganizationUIInfoTest extends XMLObjectBaseTestCase {
     @Test public void testBad() throws XMLParserException, UnmarshallingException {
 
         final Organization acs = unmarshallElement("/OrganizationUIInfoBad.xml", true);
+        assert(acs != null);
         final OrganizationUIInfo info = new OrganizationUIInfo(acs); 
 
         assertEquals(info.getOrganizationNames().size(), 1);
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java
index 3218441d..3e1e166c 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataProviderContainer.java
@@ -41,7 +41,7 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
     private static int sortKeyValue;
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(MetadataProviderContainer.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(MetadataProviderContainer.class);
 
     /** The embedded resolver. */
     @NonnullAfterInit private MetadataResolver resolver;
@@ -49,7 +49,6 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
     /** The key by which we sort the provider. */
     @NonnullAfterInit private Integer sortKey;
 
-
     /**
      * Set the sort key.
      * 
@@ -65,7 +64,7 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
      * 
      * @param theResolver The {@link MetadataResolver} to embed.
      */
-    @Nonnull public void setEmbeddedResolver(@Nonnull final MetadataResolver theResolver) {
+    public void setEmbeddedResolver(@Nonnull final MetadataResolver theResolver) {
         checkSetterPreconditions();
         resolver = Constraint.isNotNull(theResolver, "MetadataResolver cannot be null");
     }
@@ -75,18 +74,24 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
      * 
      * @return the contained resolver.
      */
-    @Nonnull public MetadataResolver getEmbeddedResolver() {
+    @NonnullAfterInit public MetadataResolver getEmbeddedResolver() {
         return resolver;
     }
 
     /** {@inheritDoc} */
     @Override protected void doInitialize() throws ComponentInitializationException {
-        setId(resolver.getId());
-        super.doInitialize();
         if (null == resolver) {
             throw new ComponentInitializationException("MetadataResolver cannot be null");
         }
 
+        final String embeddedId = resolver.getId();
+        if (embeddedId == null) {
+            throw new ComponentInitializationException("Embedded MetadataResolver has no ID");
+        }
+        
+        setId(embeddedId);
+        super.doInitialize();
+        
         if (null == sortKey) {
             synchronized (MetadataProviderContainer.class) {
                 sortKeyValue++;
@@ -100,6 +105,7 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
     /** {@inheritDoc} */
     @Override public int compareTo(final MetadataProviderContainer other) {
         checkComponentActive();
+        
         final int result = sortKey.compareTo(other.sortKey);
         if (result != 0) {
             return result;
@@ -107,6 +113,7 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
         if (equals(other)) {
             return 0;
         }
+
         return getId().compareTo(other.getId());
     }
 
@@ -132,7 +139,9 @@ public class MetadataProviderContainer extends AbstractServiceableComponent<Meta
     }
 
     /** {@inheritDoc} */
-    public MetadataResolver getComponent() {
+    @Nonnull public MetadataResolver getComponent() {
+        checkComponentActive();
+        
         return getEmbeddedResolver();
     }
 }
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceStrategy.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceStrategy.java
index ec6d18ce..db918550 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceStrategy.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/MetadataResolverServiceStrategy.java
@@ -53,6 +53,10 @@ public class MetadataResolverServiceStrategy extends AbstractIdentifiableInitial
 
     /** {@inheritDoc} */
     @Nullable public AbstractServiceableComponent<MetadataResolver> apply(@Nullable final ApplicationContext appContext) {
+        if (appContext == null) {
+            throw new ServiceException("ApplicationContext was null");
+        }
+        
         final Collection<MetadataProviderContainer> containers =
                 appContext.getBeansOfType(MetadataProviderContainer.class).values();
 
@@ -92,4 +96,5 @@ public class MetadataResolverServiceStrategy extends AbstractIdentifiableInitial
            throw new ServiceException("Chaining constructor create failed", e);
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java
index 53313aef..d458357c 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/metadata/impl/ReloadableMetadataResolver.java
@@ -60,7 +60,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull public Iterable<EntityDescriptor> resolve(final CriteriaSet criteria) throws ResolverException {
+    @Override @Nonnull public Iterable<EntityDescriptor> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
         checkComponentActive();
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             if (null == component) {
@@ -78,7 +78,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable public EntityDescriptor resolveSingle(final CriteriaSet criteria) throws ResolverException {
+    @Override @Nullable public EntityDescriptor resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
         checkComponentActive();
         try (final ServiceableComponent<MetadataResolver> component = service.getServiceableComponent()) {
             if (null == component) {
@@ -130,7 +130,7 @@ public class ReloadableMetadataResolver extends AbstractIdentifiableInitializabl
     }
 
     /** {@inheritDoc} */
-    @Override public void setMetadataFilter(final MetadataFilter newFilter) {
+    @Override public void setMetadataFilter(@Nullable final MetadataFilter newFilter) {
         throw new IllegalAccessError("Cannot set Metadata filter");
     }
     
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java
index 17fa6a72..0f7aa62c 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessor.java
@@ -121,11 +121,7 @@ public class KeyAuthorityNodeProcessor implements MetadataNodeProcessor {
             return Collections.emptyList();
         }
         
-        final List<XMLObject> keyAuthorities = extensions.getUnknownXMLObjects(KeyAuthority.DEFAULT_ELEMENT_NAME);
-        if (keyAuthorities == null) {
-            return Collections.emptyList();
-        }
-        return keyAuthorities;
+        return extensions.getUnknownXMLObjects(KeyAuthority.DEFAULT_ELEMENT_NAME);
     }
     
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
index f9d7a486..6165a585 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolver.java
@@ -26,6 +26,7 @@ import java.util.Set;
 import java.util.concurrent.locks.ReadWriteLock;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.criterion.EntityIdCriterion;
@@ -99,7 +100,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
     }
 
     /** {@inheritDoc} */
-    @Override public PKIXValidationInformation resolveSingle(final CriteriaSet criteriaSet) throws ResolverException {
+    @Override public PKIXValidationInformation resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
         final Iterator<PKIXValidationInformation> pkixInfoIter = resolve(criteriaSet).iterator();
         if (pkixInfoIter.hasNext()) {
             return pkixInfoIter.next();
@@ -108,14 +109,23 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
     }
 
     /** {@inheritDoc} */
-    @Override public Iterable<PKIXValidationInformation> resolve(final CriteriaSet criteriaSet)
-                            throws ResolverException {
+    @Override
+    @Nonnull public Iterable<PKIXValidationInformation> resolve(@Nullable final CriteriaSet criteriaSet)
+            throws ResolverException {
         checkComponentActive();
+        
+        if (criteriaSet == null) {
+            throw new ResolverException("CriteriaSet was null");
+        }
+        
         checkCriteriaRequirements(criteriaSet);
-
-        final String entityID = criteriaSet.get(EntityIdCriterion.class).getEntityId();
+        
+        final EntityIdCriterion entityIdCriterion = criteriaSet.get(EntityIdCriterion.class);
+        assert(entityIdCriterion != null);
+        final String entityID = entityIdCriterion.getEntityId();
 
         final EntityRoleCriterion roleCriteria = criteriaSet.get(EntityRoleCriterion.class);
+        assert(roleCriteria != null);
         final QName role = roleCriteria.getRole();
 
         String protocol = null;
@@ -128,13 +138,22 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull public Set<String> resolveTrustedNames(final CriteriaSet criteriaSet) throws ResolverException {
+    @Override
+    @Nonnull public Set<String> resolveTrustedNames(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
         checkComponentActive();
+        
+        if (criteriaSet == null) {
+            throw new ResolverException("CriteriaSet was null");
+        }
+
         checkCriteriaRequirements(criteriaSet);
 
-        final String entityID = criteriaSet.get(EntityIdCriterion.class).getEntityId();
+        final EntityIdCriterion entityIdCriterion = criteriaSet.get(EntityIdCriterion.class);
+        assert(entityIdCriterion != null);
+        final String entityID = entityIdCriterion.getEntityId();
 
         final EntityRoleCriterion roleCriteria = criteriaSet.get(EntityRoleCriterion.class);
+        assert(roleCriteria != null);
         final QName role = roleCriteria.getRole();
 
         String protocol = null;
@@ -171,7 +190,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * 
      * @param criteriaSet the criteria set to evaluate
      */
-    protected void checkCriteriaRequirements(final CriteriaSet criteriaSet) {
+    protected void checkCriteriaRequirements(@Nonnull final CriteriaSet criteriaSet) {
         final EntityIdCriterion entityCriteria =
                 Constraint.isNotNull(criteriaSet.get(EntityIdCriterion.class), "EntityIdCriterion must be supplied");
         Constraint.isNotNull(StringSupport.trimOrNull(entityCriteria.getEntityId()),
@@ -196,7 +215,7 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @throws ResolverException thrown if the key, certificate, or CRL information is represented in an unsupported
      *             format
      */
-    protected Collection<PKIXValidationInformation> retrievePKIXInfoFromMetadata(final CriteriaSet criteriaSet,
+    @Nonnull protected Collection<PKIXValidationInformation> retrievePKIXInfoFromMetadata(final CriteriaSet criteriaSet,
             final String entityID, final QName role, final String protocol) throws ResolverException {
 
         log.debug("Attempting to retrieve PKIX validation info from resolver for entity: {}", entityID);
@@ -224,12 +243,12 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      *             format
      * 
      */
-    protected void resolvePKIXInfo(final Collection<PKIXValidationInformation> accumulator, 
-            final RoleDescriptor roleDescriptor)
-            throws ResolverException {
+    protected void resolvePKIXInfo(@Nonnull final Collection<PKIXValidationInformation> accumulator, 
+            final RoleDescriptor roleDescriptor) throws ResolverException {
 
-        if (roleDescriptor.getParent() instanceof EntityDescriptor) {
-            final EntityDescriptor entityDescriptor = (EntityDescriptor) roleDescriptor.getParent();
+        final XMLObject parent = roleDescriptor.getParent();
+        if (parent instanceof EntityDescriptor) {
+            final EntityDescriptor entityDescriptor = (EntityDescriptor) parent;
 
             resolvePKIXInfo(accumulator, entityDescriptor.getExtensions());
 
@@ -257,8 +276,10 @@ public class MetadataPKIXValidationInformationResolver extends AbstractInitializ
      * @throws ResolverException thrown if the key, certificate, or CRL information is represented in an unsupported
      *             format
      */
-    protected void resolvePKIXInfo(final Collection<PKIXValidationInformation> accumulator, final Extensions extensions)
+    protected void resolvePKIXInfo(@Nonnull final Collection<PKIXValidationInformation> accumulator,
+            @Nullable final Extensions extensions)
             throws ResolverException {
+        
         if (extensions == null) {
             return;
         }
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityBuilder.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityBuilder.java
index 62d4fd94..30be888a 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityBuilder.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityBuilder.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.saml.xmlobject.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 
 import net.shibboleth.idp.saml.xmlobject.ExtensionsConstants;
@@ -29,7 +31,8 @@ import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 public class KeyAuthorityBuilder extends AbstractXMLObjectBuilder<KeyAuthority> {
 
     /** {@inheritDoc} */
-    public KeyAuthority buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public KeyAuthority buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new KeyAuthorityImpl(namespaceURI, localName, namespacePrefix);
     }
 
@@ -38,8 +41,9 @@ public class KeyAuthorityBuilder extends AbstractXMLObjectBuilder<KeyAuthority>
      * 
      * @return a new instance of {@link KeyAuthority}
      */
-    public KeyAuthority buildObject() {
+    @Nonnull public KeyAuthority buildObject() {
         return buildObject(ExtensionsConstants.SHIB_MDEXT10_NS, KeyAuthority.DEFAULT_ELEMENT_LOCAL_NAME,
                 ExtensionsConstants.SHIB_MDEXT10_PREFIX);
     }
+
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityImpl.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityImpl.java
index 1af8ef5d..9fcd5fc9 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityImpl.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityImpl.java
@@ -21,6 +21,8 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.NotThreadSafe;
 
 import net.shibboleth.idp.saml.xmlobject.KeyAuthority;
@@ -36,13 +38,13 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 public class KeyAuthorityImpl extends AbstractXMLObject implements KeyAuthority {
 
     /** The list of KeyInfo child elements. */
-    private final List<KeyInfo> keyInfos;
+    @Nonnull private final List<KeyInfo> keyInfos;
 
     /** The VerifyDepth attribute. */
-    private Integer verifyDepth;
+    @Nullable private Integer verifyDepth;
 
     /** Wildcard, unknown 'anyAttribute' attributes. */
-    private final AttributeMap unknownAttributes;
+    @Nonnull private final AttributeMap unknownAttributes;
 
     /**
      * Constructor.
@@ -51,7 +53,8 @@ public class KeyAuthorityImpl extends AbstractXMLObject implements KeyAuthority
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected KeyAuthorityImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected KeyAuthorityImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
         keyInfos = new XMLObjectChildrenList<>(this);
         unknownAttributes = new AttributeMap(this);
@@ -77,7 +80,7 @@ public class KeyAuthorityImpl extends AbstractXMLObject implements KeyAuthority
 
     /** {@inheritDoc} */
     @Override
-    public AttributeMap getUnknownAttributes() {
+    @Nonnull public AttributeMap getUnknownAttributes() {
         return unknownAttributes;
     }
 
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java
index f307b6a7..042d0307 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityMarshaller.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.idp.saml.xmlobject.impl;
 
+import javax.annotation.Nonnull;
 import javax.annotation.concurrent.ThreadSafe;
 
 import org.opensaml.core.xml.XMLObject;
@@ -32,7 +33,7 @@ import net.shibboleth.idp.saml.xmlobject.KeyAuthority;
 public class KeyAuthorityMarshaller extends AbstractXMLObjectMarshaller {
 
     /** {@inheritDoc} */
-    protected void marshallAttributes(final XMLObject xmlObject, final Element domElement) throws MarshallingException {
+    protected void marshallAttributes(@Nonnull final XMLObject xmlObject, @Nonnull final Element domElement) throws MarshallingException {
         final KeyAuthority keyAuthority = (KeyAuthority) xmlObject;
 
         if (keyAuthority.getVerifyDepth() != null) {
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java
index 6536d809..d3d9c832 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityUnmarshaller.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.idp.saml.xmlobject.impl;
 
+import javax.annotation.Nonnull;
 import javax.annotation.concurrent.ThreadSafe;
 import javax.xml.namespace.QName;
 
@@ -39,7 +40,7 @@ public class KeyAuthorityUnmarshaller extends AbstractXMLObjectUnmarshaller {
     private final Logger log = LoggerFactory.getLogger(KeyAuthorityUnmarshaller.class);
 
     /** {@inheritDoc} */
-    protected void processAttribute(final XMLObject xmlObject, final Attr attribute) throws UnmarshallingException {
+    protected void processAttribute(final @Nonnull XMLObject xmlObject, final @Nonnull Attr attribute) throws UnmarshallingException {
         final KeyAuthority authority = (KeyAuthority) xmlObject;
 
         if (attribute.getLocalName().equals(KeyAuthority.VERIFY_DEPTH_ATTRIB_NAME)) {
@@ -54,7 +55,7 @@ public class KeyAuthorityUnmarshaller extends AbstractXMLObjectUnmarshaller {
     }
 
     /** {@inheritDoc} */
-    protected void processChildElement(final XMLObject parentXMLObject, final XMLObject childXMLObject)
+    protected void processChildElement(final @Nonnull XMLObject parentXMLObject, final @Nonnull XMLObject childXMLObject)
             throws UnmarshallingException {
         final KeyAuthority authority = (KeyAuthority) parentXMLObject;
 
@@ -64,4 +65,5 @@ public class KeyAuthorityUnmarshaller extends AbstractXMLObjectUnmarshaller {
             log.debug("Ignorning unknown child element {}", childXMLObject.getElementQName());
         }
     }
+
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeBuilder.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeBuilder.java
index 289ea81b..813d5ee0 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeBuilder.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeBuilder.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.saml.xmlobject.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 
 import net.shibboleth.idp.saml.xmlobject.ExtensionsConstants;
@@ -29,7 +31,8 @@ import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 public class ScopeBuilder extends AbstractXMLObjectBuilder<Scope> {
 
     /** {@inheritDoc} */
-    public Scope buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public Scope buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ScopeImpl(namespaceURI, localName, namespacePrefix);
     }
 
@@ -38,7 +41,7 @@ public class ScopeBuilder extends AbstractXMLObjectBuilder<Scope> {
      * 
      * @return a new instance of {@link Scope}
      */
-    public Scope buildObject() {
+    @Nonnull public Scope buildObject() {
         return buildObject(ExtensionsConstants.SHIB_MDEXT10_NS, Scope.DEFAULT_ELEMENT_LOCAL_NAME,
                 ExtensionsConstants.SHIB_MDEXT10_PREFIX);
     }
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java
index e5789a80..8817e646 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeImpl.java
@@ -19,6 +19,8 @@ package net.shibboleth.idp.saml.xmlobject.impl;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.NotThreadSafe;
 
 import org.opensaml.core.xml.AbstractXMLObject;
@@ -32,10 +34,10 @@ import net.shibboleth.idp.saml.xmlobject.Scope;
 public class ScopeImpl extends AbstractXMLObject implements Scope {
 
     /** The regexp attribute value. */
-    private XSBooleanValue regexp;
+    @Nullable private XSBooleanValue regexp;
 
     /** The string content value. */
-    private String scopeValue;
+    @Nullable private String scopeValue;
 
     /**
      * Constructor.
@@ -44,17 +46,19 @@ public class ScopeImpl extends AbstractXMLObject implements Scope {
      * @param elementLocalName the local name of the XML element this Object represents
      * @param namespacePrefix the prefix for the given namespace
      */
-    protected ScopeImpl(final String namespaceURI, final String elementLocalName, final String namespacePrefix) {
+    protected ScopeImpl(@Nullable final String namespaceURI, @Nonnull final String elementLocalName,
+            @Nullable final String namespacePrefix) {
         super(namespaceURI, elementLocalName, namespacePrefix);
-        regexp = null;
     }
 
     /** {@inheritDoc} */
-    @Override public Boolean getRegexp() {
-        if (regexp == null) {
-            return Boolean.FALSE;
+    @Override
+    @Nullable public Boolean getRegexp() {
+        if (regexp != null) {
+            return regexp.getValue();
         }
-        return regexp.getValue();
+        
+        return Boolean.FALSE;
     }
 
     /** {@inheritDoc} */
@@ -67,22 +71,24 @@ public class ScopeImpl extends AbstractXMLObject implements Scope {
     }
 
     /** {@inheritDoc} */
-    @Override public XSBooleanValue getRegexpXSBoolean() {
+    @Override
+    @Nullable public XSBooleanValue getRegexpXSBoolean() {
         return regexp;
     }
 
     /** {@inheritDoc} */
-    @Override public void setRegexp(final XSBooleanValue newRegexp) {
+    @Override public void setRegexp(@Nullable final XSBooleanValue newRegexp) {
         regexp = prepareForAssignment(regexp, newRegexp);
     }
 
     /** {@inheritDoc} */
-    @Override public String getValue() {
+    @Override
+    @Nullable public String getValue() {
         return scopeValue;
     }
 
     /** {@inheritDoc} */
-    @Override public void setValue(final String newScopeValue) {
+    @Override public void setValue(@Nullable final String newScopeValue) {
         scopeValue = prepareForAssignment(scopeValue, newScopeValue);
     }
     
diff --git a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueBuilder.java b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueBuilder.java
index 0ec464ce..2665fb14 100644
--- a/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueBuilder.java
+++ b/shib-metadata-impl/src/main/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueBuilder.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.saml.xmlobject.impl;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
 
 import net.shibboleth.idp.saml.xmlobject.ScopedValue;
@@ -28,7 +30,8 @@ import org.opensaml.core.xml.AbstractXMLObjectBuilder;
 public class ScopedValueBuilder extends AbstractXMLObjectBuilder<ScopedValue> {
 
     /** {@inheritDoc} */
-    public ScopedValue buildObject(final String namespaceURI, final String localName, final String namespacePrefix) {
+    @Nonnull public ScopedValue buildObject(@Nullable final String namespaceURI, @Nonnull final String localName,
+            @Nullable final String namespacePrefix) {
         return new ScopedValueImpl(namespaceURI, localName, namespacePrefix);
     }
 }
\ No newline at end of file
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/BaseNodeProcessorTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/BaseNodeProcessorTest.java
index 57184cda..a3872c1e 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/BaseNodeProcessorTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/BaseNodeProcessorTest.java
@@ -32,6 +32,7 @@ import org.testng.annotations.BeforeClass;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.resolver.ResolverException;
 
+ at SuppressWarnings("javadoc")
 public abstract class BaseNodeProcessorTest extends XMLObjectBaseTestCase {
     
     protected MetadataResolver resolver;
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessorTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessorTest.java
index eb548575..c514d9e1 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessorTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/ScopesNodeProcessorTest.java
@@ -34,12 +34,14 @@ import net.shibboleth.idp.saml.metadata.ScopesContainer;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
+ at SuppressWarnings("javadoc")
 public final class ScopesNodeProcessorTest extends BaseNodeProcessorTest {
     
     @Test
     public void noScopes() throws ResolverException {
         
         final EntityDescriptor noScopes  = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://noscopes.example.org")));
+        assert(noScopes != null);
         assertTrue(noScopes.getObjectMetadata().get(ScopesContainer.class).isEmpty());
         final AttributeAuthorityDescriptor aaNoScope = noScopes.getAttributeAuthorityDescriptor("urn:oasis:names:tc:SAML:2.0:protocol");
         assertTrue(aaNoScope.getObjectMetadata().get(ScopesContainer.class).isEmpty());
@@ -50,7 +52,7 @@ public final class ScopesNodeProcessorTest extends BaseNodeProcessorTest {
     @Test 
     public void scopes() throws ResolverException {
         final EntityDescriptor entity  = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://scopes.example.org")));
-
+        assert(entity != null);
         final List<ScopesContainer> entityList = entity.getObjectMetadata().get(ScopesContainer.class);
         assertEquals(entityList.size(),1);
         final ScopesContainer entityContainer = entityList.get(0);
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessorTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessorTest.java
index 6f37af9a..cf46e8c0 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessorTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/metadata/impl/UIInfoNodeProcessorTest.java
@@ -36,12 +36,13 @@ import net.shibboleth.idp.saml.metadata.OrganizationUIInfo;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
+ at SuppressWarnings("javadoc")
 public final class UIInfoNodeProcessorTest extends BaseNodeProcessorTest {
     
     @Test 
     public void idPUIInfoTest() throws ResolverException {
         final EntityDescriptor entity  = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://scopes.example.org")));
-
+        assert(entity != null);
         final IDPSSODescriptor idpSSO = entity.getIDPSSODescriptor("urn:oasis:names:tc:SAML:2.0:protocol");
         IdPUIInfo uiInfo = null;
         for (final XMLObject  x: idpSSO.getExtensions().getUnknownXMLObjects()) {
@@ -51,7 +52,7 @@ public final class UIInfoNodeProcessorTest extends BaseNodeProcessorTest {
             uiInfo = x.getObjectMetadata().get(IdPUIInfo.class).get(0);
             break;
         }
-        
+        assert(uiInfo != null);
         
         final Locale l = Locale.forLanguageTag("en");
         assertEquals(uiInfo.getDisplayNames().get(l), "Display");
@@ -62,6 +63,7 @@ public final class UIInfoNodeProcessorTest extends BaseNodeProcessorTest {
     
     public void acsUIInfoTest() throws ResolverException {
         final EntityDescriptor entity  = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://sp.example.org")));
+        assert(entity != null);
 
         final AssertionConsumerService acs = entity.
                 getSPSSODescriptor("urn:oasis:names:tc:SAML:2.0:protocol").
@@ -78,6 +80,7 @@ public final class UIInfoNodeProcessorTest extends BaseNodeProcessorTest {
 
     public void organizationInfoTest() throws ResolverException {
         final EntityDescriptor entity  = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://sp.example.org")));
+        assert(entity != null);
 
         final OrganizationUIInfo info = entity.getOrganization().getObjectMetadata().get(OrganizationUIInfo.class).get(0);
 
@@ -93,4 +96,4 @@ public final class UIInfoNodeProcessorTest extends BaseNodeProcessorTest {
         return new UIInfoNodeProcessor();
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessorTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessorTest.java
index 2c59fc3f..2852dd44 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessorTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/KeyAuthorityNodeProcessorTest.java
@@ -36,6 +36,7 @@ import org.testng.annotations.Test;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
+ at SuppressWarnings("javadoc")
 public class KeyAuthorityNodeProcessorTest extends XMLObjectBaseTestCase {
     
     private FilesystemMetadataResolver metadataProvider;
@@ -72,18 +73,22 @@ public class KeyAuthorityNodeProcessorTest extends XMLObjectBaseTestCase {
         List<PKIXValidationInformation> pkixInfos = null;
         
         entityDescriptor = metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
+        assert(entityDescriptor != null);
         pkixInfos = entityDescriptor.getObjectMetadata().get(PKIXValidationInformation.class);
         Assert.assertEquals(pkixInfos.size(), 2);
         
         entityDescriptor = metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-sub1.example.org")));
+        assert(entityDescriptor != null);
         pkixInfos = entityDescriptor.getObjectMetadata().get(PKIXValidationInformation.class);
         Assert.assertEquals(pkixInfos.size(), 3);
         
         entityDescriptor = metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-sub2.example.org")));
+        assert(entityDescriptor != null);
         pkixInfos = entityDescriptor.getObjectMetadata().get(PKIXValidationInformation.class);
         Assert.assertEquals(pkixInfos.size(), 4);
         
         entityDescriptor = metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-sub2a.example.org")));
+        assert(entityDescriptor != null);
         pkixInfos = entityDescriptor.getObjectMetadata().get(PKIXValidationInformation.class);
         Assert.assertEquals(pkixInfos.size(), 5);
     }
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
index 65489814..3f8e8d11 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/security/impl/MetadataPKIXValidationInformationResolverTest.java
@@ -17,13 +17,18 @@
 
 package net.shibboleth.idp.saml.security.impl;
 
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Set;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.saml.criterion.EntityRoleCriterion;
@@ -43,6 +48,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 import org.w3c.dom.Document;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -53,15 +59,20 @@ import net.shibboleth.shared.xml.XMLParserException;
  */
 public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBaseTestCase {
     
-    private String protocolBlue = "PROTOCOL_BLUE";
+    @Nonnull @NotEmpty private String protocolBlue = "PROTOCOL_BLUE";
     
-    private String protocolGreen = "PROTOCOL_GREEN";
+    @Nonnull @NotEmpty private String protocolGreen = "PROTOCOL_GREEN";
     
-    private String fooEntityID = "http://foo.example.org/shibboleth";
+    @Nonnull @NotEmpty private String fooEntityID = "http://foo.example.org/shibboleth";
     
-    private String barEntityID = "http://bar.example.org/shibboleth";
+    @Nonnull @NotEmpty private String barEntityID = "http://bar.example.org/shibboleth";
     
-    private CriteriaSet criteriaSet;
+    @Nonnull private CriteriaSet criteriaSet;
+    
+    /** Constructor. */
+    public MetadataPKIXValidationInformationResolverTest() {
+        criteriaSet = new CriteriaSet();
+    }
     
     @BeforeMethod
     protected void setUp() throws Exception {
@@ -170,8 +181,13 @@ public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBase
        PKIXValidationInformation infoSet = null;
        Assert.assertTrue(iter.hasNext(), "Iterator was empty");
        infoSet = iter.next();
-       Assert.assertEquals(infoSet.getCertificates().size(), 3, "Incorrect number of certificates");
-       Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+       assert(infoSet != null);
+       final Collection<X509Certificate> certs = infoSet.getCertificates();
+       assert(certs != null);
+       final Collection<X509CRL> crls = infoSet.getCRLs();
+       assert(crls != null);
+       Assert.assertEquals(certs.size(), 3, "Incorrect number of certificates");
+       Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
        Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
        
        Assert.assertFalse(iter.hasNext(), "Iterator was not empty");
@@ -204,13 +220,17 @@ public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBase
         criteriaSet.add( new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME) );
         criteriaSet.add( new ProtocolCriterion(protocolBlue) );
         
-        Iterator<PKIXValidationInformation> iter = resolver.resolve(criteriaSet).iterator();
+        final Iterator<PKIXValidationInformation> iter = resolver.resolve(criteriaSet).iterator();
         
-        PKIXValidationInformation infoSet = null;
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
-        infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 7, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 2, "Incorrect number of CRL's");
+        final PKIXValidationInformation infoSet = iter.next();
+        assert(infoSet != null);
+        final Collection<X509Certificate> certs = infoSet.getCertificates();
+        assert(certs != null);
+        final Collection<X509CRL> crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 7, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 2, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
         
         Assert.assertFalse(iter.hasNext(), "Iterator was not empty");
@@ -226,11 +246,15 @@ public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBase
        
        Iterator<PKIXValidationInformation> iter = resolver.resolve(criteriaSet).iterator();
        
-       PKIXValidationInformation infoSet = null;
        Assert.assertTrue(iter.hasNext(), "Iterator was empty");
-       infoSet = iter.next();
-       Assert.assertEquals(infoSet.getCertificates().size(), 3, "Incorrect number of certificates");
-       Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+       final PKIXValidationInformation infoSet = iter.next();
+       assert(infoSet != null);
+       final Collection<X509Certificate> certs = infoSet.getCertificates();
+       assert(certs != null);
+       final Collection<X509CRL> crls = infoSet.getCRLs();
+       assert(crls != null);
+       Assert.assertEquals(certs.size(), 3, "Incorrect number of certificates");
+       Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
        Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
        
        Assert.assertFalse(iter.hasNext(), "Iterator was not empty");
@@ -260,14 +284,24 @@ public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBase
         PKIXValidationInformation infoSet = null;
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 1, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        Collection<X509Certificate> certs = infoSet.getCertificates();
+        assert(certs != null);
+        Collection<X509CRL> crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 1, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(3), "Incorrect VerifyDepth");
         
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 6, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        certs = infoSet.getCertificates();
+        assert(certs != null);
+        crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 6, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
         
         Assert.assertFalse(iter.hasNext(), "Iterator was not empty");
@@ -286,14 +320,24 @@ public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBase
         PKIXValidationInformation infoSet = null;
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 3, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        Collection<X509Certificate> certs = infoSet.getCertificates();
+        assert(certs != null);
+        Collection<X509CRL> crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 3, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
         
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 1, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        certs = infoSet.getCertificates();
+        assert(certs != null);
+        crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 1, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(3), "Incorrect VerifyDepth");
         
         
@@ -313,20 +357,35 @@ public class MetadataPKIXValidationInformationResolverTest extends XMLObjectBase
         PKIXValidationInformation infoSet = null;
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 1, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        Collection<X509Certificate> certs = infoSet.getCertificates();
+        assert(certs != null);
+        Collection<X509CRL> crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 1, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(3), "Incorrect VerifyDepth");
         
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 3, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 0, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        certs = infoSet.getCertificates();
+        assert(certs != null);
+        crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 3, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 0, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
         
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
         infoSet = iter.next();
-        Assert.assertEquals(infoSet.getCertificates().size(), 4, "Incorrect number of certificates");
-        Assert.assertEquals(infoSet.getCRLs().size(), 1, "Incorrect number of CRL's");
+        assert(infoSet != null);
+        certs = infoSet.getCertificates();
+        assert(certs != null);
+        crls = infoSet.getCRLs();
+        assert(crls != null);
+        Assert.assertEquals(certs.size(), 4, "Incorrect number of certificates");
+        Assert.assertEquals(crls.size(), 1, "Incorrect number of CRL's");
         Assert.assertEquals(infoSet.getVerificationDepth(), Integer.valueOf(5), "Incorrect VerifyDepth");
         
         Assert.assertFalse(iter.hasNext(), "Iterator was not empty");
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityTest.java
index ec095b11..c4be20f7 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/KeyAuthorityTest.java
@@ -92,6 +92,7 @@ public class KeyAuthorityTest extends XMLObjectProviderBaseTestCase {
         KeyAuthority keyAuthority = (KeyAuthority) unmarshallElement(singleElementFile);
 
         Assert.assertNotNull(keyAuthority, "Unmarshalled object was null");
+        assert(keyAuthority != null);
         Assert.assertNull(keyAuthority.getVerifyDepth(), "VerifyDepth attribute value");
 
         Assert.assertTrue(keyAuthority.getUnknownAttributes().isEmpty(), "Extension attribute map was not empty");
@@ -104,6 +105,7 @@ public class KeyAuthorityTest extends XMLObjectProviderBaseTestCase {
         KeyAuthority keyAuthority = (KeyAuthority) unmarshallElement(singleElementOptionalAttributesFile);
 
         Assert.assertNotNull(keyAuthority, "Unmarshalled object was null");
+        assert(keyAuthority != null);
         Assert.assertEquals(expectedVerifyDepth, keyAuthority.getVerifyDepth(), "VerifyDepth attribute value");
 
         Assert.assertFalse(keyAuthority.getUnknownAttributes().isEmpty(), "Extension attribute map was empty");
@@ -120,6 +122,7 @@ public class KeyAuthorityTest extends XMLObjectProviderBaseTestCase {
         KeyAuthority keyAuthority = (KeyAuthority) unmarshallElement(childElementsFile);
 
         Assert.assertNotNull(keyAuthority, "Unmarshalled object was null");
+        assert(keyAuthority != null);
         Assert.assertNull(keyAuthority.getVerifyDepth(), "VerifyDepth attribute value");
 
         Assert.assertTrue(keyAuthority.getUnknownAttributes().isEmpty(), "Extension attribute map was not empty");
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java
index c7a7ec02..4d0f28de 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopeTest.java
@@ -73,6 +73,7 @@ public class ScopeTest extends XMLObjectProviderBaseTestCase {
         Scope scope = (Scope) unmarshallElement(singleElementFile);
 
         Assert.assertNotNull(scope, "Unmarshalled object was null");
+        assert(scope != null);
         Assert.assertEquals(scope.getValue(), expectedContent, "Scope value");
         Assert.assertEquals(Boolean.FALSE, scope.getRegexp(),"Regexp attribute value");
     }
@@ -83,6 +84,7 @@ public class ScopeTest extends XMLObjectProviderBaseTestCase {
         Scope scope = (Scope) unmarshallElement(singleElementOptionalAttributesFile);
 
         Assert.assertNotNull(scope, "Unmarshalled object was null");
+        assert(scope != null);
         Assert.assertEquals(scope.getValue(), expectedContent, "Scope value");
         Assert.assertEquals(expectedRegexp, scope.getRegexp(), "Regexp attribute value");
     }
diff --git a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueTest.java b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueTest.java
index f307fe2b..ee6c03a9 100644
--- a/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueTest.java
+++ b/shib-metadata-impl/src/test/java/net/shibboleth/idp/saml/xmlobject/impl/ScopedValueTest.java
@@ -91,6 +91,7 @@ public class ScopedValueTest extends XMLObjectProviderBaseTestCase {
         ScopedValue sv = (ScopedValue) unmarshallElement(singleElementFile);
 
         Assert.assertNotNull(sv, "Unmarshalled object was null");
+        assert(sv != null);
         Assert.assertEquals(expectedValue + scopeDelimiter + expectedScope, sv.getValue(), "Scoped value");
     }
 
@@ -98,8 +99,9 @@ public class ScopedValueTest extends XMLObjectProviderBaseTestCase {
     @Test
 	public void testSingleElementOptionalAttributesUnmarshall() {
         ScopedValue sv = (ScopedValue) unmarshallElement(singleElementOptionalAttributesFile);
-        sv.setScopeAttributeName(scopeAttribute);
         Assert.assertNotNull(sv, "Unmarshalled object was null");
+        assert(sv != null);
+        sv.setScopeAttributeName(scopeAttribute);
         Assert.assertEquals(expectedValue, sv.getValue(), "Scoped value");
         Assert.assertEquals(expectedScope, sv.getScope(), "Scope value");
         Assert.assertEquals(scopeAttribute, sv.getScopeAttributeName(), "Scope attribute name");
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java
index 10edc3a5..e5de6f2f 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/http/HTTPResourceFactoryBean.java
@@ -50,6 +50,7 @@ import org.opensaml.security.x509.impl.StaticPKIXValidationInformationResolver;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.FatalBeanException;
+import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.config.AbstractFactoryBean;
 import org.springframework.core.io.Resource;
 
@@ -83,10 +84,10 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
     @Nullable private HttpClientContextHandler httpClientContextHandler;
     
     /** The resources to be turned into keys. */
-    @Nonnull private List<Resource> keyResources;
+    @Nonnull @NonnullElements private List<Resource> keyResources;
 
     /** The resources to be turned into certificates. */
-    @Nonnull private List<Resource> certificateResources;
+    @Nonnull @NonnullElements private List<Resource> certificateResources;
     
     /** Use a PKIX trust engine. */
     private boolean usePKIX;
@@ -178,7 +179,7 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
      * 
      * @return the certificates null
      */
-    @Nullable @NonnullElements protected List<Credential> getCredentials() {
+    @Nonnull @NonnullElements protected List<Credential> getCredentials() {
         
         final List<Credential> credentials = new ArrayList<>(keyResources.size() + certificateResources.size());
 
@@ -216,9 +217,6 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
      * @return the certificates
      */
     @Nullable @NonnullElements protected List<X509Certificate> getCertificates() {
-        if (certificateResources == null) {
-            return null;
-        }
         
         final List<X509Certificate> certificates = new ArrayList<>(certificateResources.size());
         for (final Resource f : certificateResources) {
@@ -240,20 +238,27 @@ public class HTTPResourceFactoryBean extends AbstractFactoryBean<HTTPResource> {
 
     /** {@inheritDoc} */
     @Override
-    protected HTTPResource createInstance() throws Exception {
+    @Nonnull protected HTTPResource createInstance() throws Exception {
+        
+        final HttpClient httpClient2 = httpClient;
+        final URL resourceURL2 = resourceURL;
+        
+        if (httpClient2 == null || resourceURL2 == null) {
+            throw new BeanCreationException("HttpClient and resource URL cannot be null");
+        }
         
         final HTTPResource theResource;
         if (backingResource != null) {
-            theResource = new FileBackedHTTPResource(backingResource, httpClient, resourceURL);
+            theResource = new FileBackedHTTPResource(backingResource, httpClient2, resourceURL2);
         } else {
-            theResource = new HTTPResource(httpClient, resourceURL);
+            theResource = new HTTPResource(httpClient2, resourceURL2);
         }
         
         if (httpClientContextHandler != null) {
+            theResource.setHttpClientContextHandler(httpClientContextHandler);
             if (!keyResources.isEmpty() || !certificateResources.isEmpty()) {
                 log.warn("httpClientContextHandler set, ignoring supplied keys/certificates");
             }
-            theResource.setHttpClientContextHandler(httpClientContextHandler);
         } else if (usePKIX) {
             if (!keyResources.isEmpty()) {
                 log.warn("usePKIX set, ignoring supplied keys");
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java
index 400ecdbe..dbdc0bab 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicHTTPMetadataProviderParser.java
@@ -17,20 +17,22 @@
 
 package net.shibboleth.spring.metadata;
 
-import java.util.List;
-
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.beans.factory.support.AbstractBeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
-import net.shibboleth.shared.xml.XMLConstants;
 import net.shibboleth.spring.http.InMemoryCachingHttpClientFactoryBean;
 
 /**
@@ -39,30 +41,30 @@ import net.shibboleth.spring.http.InMemoryCachingHttpClientFactoryBean;
 public abstract class AbstractDynamicHTTPMetadataProviderParser extends AbstractDynamicMetadataProviderParser {
 
     /** Default caching type . */
-    private static final Class<?> DEFAULT_CACHING_CLASS = InMemoryCachingHttpClientFactoryBean.class;
+    @Nonnull private static final Class<?> DEFAULT_CACHING_CLASS = InMemoryCachingHttpClientFactoryBean.class;
 
     /** Default max total connections. */
-    private static final Integer DEFAULT_MAX_CONNECTIONS_TOTAL = 100;
+    @Nonnull private static final Integer DEFAULT_MAX_CONNECTIONS_TOTAL = 100;
 
     /** Default max connections per route. */
-    private static final Integer DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 100;
+    @Nonnull private static final Integer DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 100;
 
     /** Default request connection timeout. */
-    private static final String DEFAULT_CONNECTION_REQUEST_TIMEOUT = "PT5S";
+    @Nonnull @NotEmpty private static final String DEFAULT_CONNECTION_REQUEST_TIMEOUT = "PT5S";
 
     /** Default connection timeout. */
-    private static final String DEFAULT_CONNECTION_TIMEOUT = "PT5S";
+    @Nonnull @NotEmpty private static final String DEFAULT_CONNECTION_TIMEOUT = "PT5S";
 
     /** Default socket timeout. */
-    private static final String DEFAULT_SOCKET_TIMEOUT = "PT5S";
+    @Nonnull @NotEmpty private static final String DEFAULT_SOCKET_TIMEOUT = "PT5S";
 
     /** Logger. */
     private final Logger log = LoggerFactory.getLogger(AbstractDynamicHTTPMetadataProviderParser.class);
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         final Element tlsTrustEngine = ElementSupport.getFirstChildElement(element,
@@ -83,7 +85,8 @@ public abstract class AbstractDynamicHTTPMetadataProviderParser extends Abstract
         }
 
         if (element.hasAttributeNS(null, "httpClientRef")) {
-            builder.addConstructorArgReference(StringSupport.trimOrNull(element.getAttributeNS(null, "httpClientRef")));
+            builder.addConstructorArgReference(
+                    AttributeSupport.getRequiredAttributeValue(element, null, "httpClientRef"));
             if (element.hasAttributeNS(null, "connectionTimeout")
                     || element.hasAttributeNS(null, "connectionRequestTimeout")
                     || element.hasAttributeNS(null, "socketTimeout")
@@ -103,13 +106,10 @@ public abstract class AbstractDynamicHTTPMetadataProviderParser extends Abstract
         }
 
         if (element.hasAttributeNS(null, "supportedContentTypes")) {
-            final List<String> supportedContentTypes =
-                    StringSupport.stringToList(
-                            StringSupport.trimOrNull(element.getAttributeNS(null, "supportedContentTypes")),
-                            XMLConstants.LIST_DELIMITERS);
-            builder.addPropertyValue("supportedContentTypes", supportedContentTypes);
+            final AbstractBeanDefinition listBuilder =
+                    SpringSupport.getAttributeValueAsList(element.getAttributeNodeNS(null, "supportedContentTypes"));
+            builder.addPropertyValue("supportedContentTypes", listBuilder);
         }
-
     }
 // Checkstyle: CyclomaticComplexity ON
 
@@ -124,7 +124,7 @@ public abstract class AbstractDynamicHTTPMetadataProviderParser extends Abstract
      * 
      * Either httpClientSecurityParametersRef or httpClientSecurityParameters can be present, not both.
      */
-    private BeanDefinition buildHttpClient(final Element element, final ParserContext parserContext,
+    private BeanDefinition buildHttpClient(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
             @Nullable final String httpClientSecurityParametersRef,
             @Nullable final BeanDefinition httpClientSecurityParameters) {
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicMetadataProviderParser.java
index ded05862..dd62e1d2 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractDynamicMetadataProviderParser.java
@@ -17,8 +17,13 @@
 
 package net.shibboleth.spring.metadata;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.persist.FilesystemLoadSaveManager;
 import org.slf4j.Logger;
@@ -33,10 +38,10 @@ import org.w3c.dom.Element;
 public abstract class AbstractDynamicMetadataProviderParser extends AbstractMetadataProviderParser {
     
     /** The reference to the system parser pool that we set up. */
-    private static final String DEFAULT_PARSER_POOL_REF = "shibboleth.ParserPool";
+    @Nonnull @NotEmpty private static final String DEFAULT_PARSER_POOL_REF = "shibboleth.ParserPool";
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(AbstractDynamicMetadataProviderParser.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(AbstractDynamicMetadataProviderParser.class);
 
     /**
      * 
@@ -45,8 +50,8 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
      * We assume that we will be summoning up a class which extends an
      * {@link org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver}.
      */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext, 
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         super.doNativeParse(element, parserContext, builder);
 
@@ -65,7 +70,7 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
 
         if (element.hasAttributeNS(null, "indexesRef")) {
             builder.addPropertyReference("indexes",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "indexesRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "indexesRef"));
         }
 
         builder.addPropertyReference("parserPool", getParserPoolRef(element));
@@ -80,8 +85,8 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
      * @param parserContext current parser context
      * @param builder current builder
      */
-    protected void processTimingProperties(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    protected void processTimingProperties(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         if (element.hasAttributeNS(null, "refreshDelayFactor")) {
             builder.addPropertyValue("refreshDelayFactor",
@@ -131,7 +136,7 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
         
         if (element.hasAttributeNS(null, "persistentCacheManagerRef")) {
             builder.addPropertyReference("persistentCacheManager",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "persistentCacheManagerRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "persistentCacheManagerRef"));
             
             if (element.hasAttributeNS(null, "persistentCacheManagerDirectory")) {
                 log.warn("{} Element contained both persistentCacheManagerRef and persistentCacheManagerDirectory, " 
@@ -152,7 +157,7 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
         
         if (element.hasAttributeNS(null, "persistentCacheKeyGeneratorRef")) {
             builder.addPropertyReference("persistentCacheKeyGenerator",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "persistentCacheKeyGeneratorRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "persistentCacheKeyGeneratorRef"));
         }
         
         if (element.hasAttributeNS(null, "initializeFromPersistentCacheInBackground")) {
@@ -167,7 +172,7 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
         
         if (element.hasAttributeNS(null, "initializationFromCachePredicateRef")) {
             builder.addPropertyReference("initializationFromCachePredicate",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "initializationFromCachePredicateRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "initializationFromCachePredicateRef"));
         }
     }
 
@@ -178,7 +183,7 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
      * 
      * @return task timer reference
      */
-    protected String getTaskTimerRef(final Element element) {
+    @Nullable protected String getTaskTimerRef(@Nonnull final Element element) {
 
         if (element.hasAttributeNS(null, "taskTimerRef")) {
             return StringSupport.trimOrNull(StringSupport.trimOrNull(element.getAttributeNS(null, "taskTimerRef")));
@@ -193,7 +198,7 @@ public abstract class AbstractDynamicMetadataProviderParser extends AbstractMeta
      * 
      * @return parser pool reference
      */
-    protected String getParserPoolRef(final Element element) {
+    @Nonnull @NotEmpty protected String getParserPoolRef(@Nonnull final Element element) {
         String parserPoolRef = null;
         if (element.hasAttributeNS(null, "parserPoolRef")) {
             parserPoolRef =
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java
index 0cf1c43b..a918d9b8 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractMetadataProviderParser.java
@@ -37,6 +37,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.DOMTypeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 
@@ -125,10 +126,10 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
      *         {@code null} if none
      * @see #getBeanClassName
      */
-    protected abstract Class<? extends MetadataResolver> getNativeBeanClass(Element element);
+    @Nonnull protected abstract Class<? extends MetadataResolver> getNativeBeanClass(Element element);
 
     /** {@inheritDoc} */
-    @Override protected final Class<?> getBeanClass(final Element element) {
+    @Override protected final Class<?> getBeanClass(@Nonnull final Element element) {
         if (isTopMost(element)) {
             return MetadataProviderContainer.class;
         }
@@ -136,8 +137,8 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
     }
 
     /** {@inheritDoc} */
-    @Override protected final void doParse(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    @Override protected final void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext, 
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
         if (isTopMost(element)) {
             builder.setInitMethodName("initialize");
@@ -171,8 +172,8 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
      * @param builder used to define the {@code BeanDefinition}
      * @see #doParse(Element, BeanDefinitionBuilder)
      */
-    protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         builder.setInitMethodName("initialize");
         builder.setDestroyMethodName("destroy");
@@ -189,10 +190,10 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
             builder.addPropertyValue("requireValidMetadata",
                     SpringSupport.getStringValueAsBoolean(element.getAttributeNS(null, "requireValidMetadata")));
         }
-
+        
         if (element.hasAttributeNS(null, "activationConditionRef")) {
             builder.addPropertyReference("activationCondition",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "activationConditionRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "activationConditionRef"));
         }
 
         processPredicateOptions(element, parserContext, builder);
@@ -226,8 +227,8 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
      * @param parserContext the current parser context
      * @param builder the current bean definition builder
      */
-    private void processPredicateOptions(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    private void processPredicateOptions(@Nonnull final Element element, @Nonnull final ParserContext parserContext, 
+            @Nonnull final BeanDefinitionBuilder builder) {
         
         if (isPresentNotChaining(element, "satisfyAnyPredicates")) {
             builder.addPropertyValue("satisfyAnyPredicates",
@@ -241,7 +242,7 @@ public abstract class AbstractMetadataProviderParser extends AbstractCustomBeanD
 
         if (isPresentNotChaining(element, "criterionPredicateRegistryRef")) {
             builder.addPropertyReference("criterionPredicateRegistry",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "criterionPredicateRegistryRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "criterionPredicateRegistryRef"));
         }
     }
 }
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractReloadingMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractReloadingMetadataProviderParser.java
index 16175924..8f031965 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractReloadingMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/AbstractReloadingMetadataProviderParser.java
@@ -17,8 +17,12 @@
 
 package net.shibboleth.spring.metadata;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
+
+import javax.annotation.Nonnull;
 
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
@@ -30,7 +34,7 @@ import org.w3c.dom.Element;
 public abstract class AbstractReloadingMetadataProviderParser extends AbstractMetadataProviderParser {
 
     /** The reference to the system parser pool that we set up. */
-    private static final String DEFAULT_PARSER_POOL_REF = "shibboleth.ParserPool";
+    @Nonnull @NotEmpty private static final String DEFAULT_PARSER_POOL_REF = "shibboleth.ParserPool";
 
     /**
      * 
@@ -39,8 +43,8 @@ public abstract class AbstractReloadingMetadataProviderParser extends AbstractMe
      * We assume in setting the that we will be summoning up a class which extends 
      * {@link org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver}.
      */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         super.doNativeParse(element, parserContext, builder);
 
@@ -52,7 +56,7 @@ public abstract class AbstractReloadingMetadataProviderParser extends AbstractMe
 
         if (element.hasAttributeNS(null, "indexesRef")) {
             builder.addPropertyReference("indexes",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "indexesRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "indexesRef"));
         }
 
         if (element.hasAttributeNS(null, "resolveViaPredicatesOnly")) {
@@ -105,7 +109,7 @@ public abstract class AbstractReloadingMetadataProviderParser extends AbstractMe
      * 
      * @return parser pool reference
      */
-    protected String getParserPoolRef(final Element element) {
+    @Nonnull protected String getParserPoolRef(final Element element) {
         String parserPoolRef = null;
         if (element.hasAttributeNS(null, "parserPoolRef")) {
             parserPoolRef = StringSupport.trimOrNull(element.getAttributeNS(null, "parserPoolRef"));
@@ -117,4 +121,5 @@ public abstract class AbstractReloadingMetadataProviderParser extends AbstractMe
 
         return parserPoolRef;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java
index 08a33567..dcbe8de6 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ChainingMetadataProviderParser.java
@@ -19,6 +19,8 @@ package net.shibboleth.spring.metadata;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.util.SpringSupport;
 import net.shibboleth.shared.xml.ElementSupport;
@@ -34,13 +36,14 @@ import org.w3c.dom.Element;
 public class ChainingMetadataProviderParser extends AbstractMetadataProviderParser {
 
     /** {@inheritDoc} */
-    @Override protected Class<ChainingMetadataResolver> getNativeBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<ChainingMetadataResolver> getNativeBeanClass(final Element element) {
         return ChainingMetadataResolver.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext, 
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         final List<Element> childProviders =
@@ -54,4 +57,5 @@ public class ChainingMetadataProviderParser extends AbstractMetadataProviderPars
                     StringSupport.trimOrNull(element.getAttributeNS(null, "detectDuplicateEntityIDs")));
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java
index caeccfcd..df237ee7 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.metadata;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.metadata.resolver.MetadataResolver;
@@ -30,6 +31,7 @@ import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 
@@ -39,31 +41,33 @@ import net.shibboleth.shared.xml.ElementSupport;
 public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetadataProviderParser {
 
     /** Element name. */
-    public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
+    @Nonnull public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
             "DynamicHTTPMetadataProvider");
 
     /** Template child element name. */
-    private static final QName TEMPLATE = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "Template");
+    @Nonnull private static final QName TEMPLATE =
+            new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "Template");
 
     /** Regex child element name. */
-    private static final QName REGEX = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "Regex");
+    @Nonnull private static final QName REGEX =
+            new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "Regex");
 
     /** MetadataQueryProtocol child element name. */
-    private static final QName METADATA_QUERY_PROTOCOL = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
-            "MetadataQueryProtocol");
+    @Nonnull private static final QName METADATA_QUERY_PROTOCOL =
+            new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "MetadataQueryProtocol");
 
     /** Name of default VelocityEngine bean to use. */
-    private static final String DEFAULT_VELOCITY_ENGINE_REF = "shibboleth.VelocityEngine";
+    @Nonnull @NotEmpty  private static final String DEFAULT_VELOCITY_ENGINE_REF = "shibboleth.VelocityEngine";
 
     /** {@inheritDoc} */
     @Override
-    protected Class<? extends MetadataResolver> getNativeBeanClass(final Element element) {
+    @Nonnull protected Class<? extends MetadataResolver> getNativeBeanClass(final Element element) {
         return FunctionDrivenDynamicHTTPMetadataResolver.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         builder.addPropertyValue("requestURLBuilder", getRequestURLBuilder(element, builder));
@@ -78,7 +82,8 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
      * @return the function
      */
     // Checkstyle: MethodLength OFF
-    protected BeanDefinition getRequestURLBuilder(final Element element, final BeanDefinitionBuilder parentBuilder) {
+    @Nonnull protected BeanDefinition getRequestURLBuilder(@Nonnull final Element element,
+            @Nonnull final BeanDefinitionBuilder parentBuilder) {
         // Note: we have to do this BeanDefinitionBuilder business b/c for the template one, we need to
         // inject the VelocityEngine. Otherwise would be easier to just return the Function directly.
 
@@ -158,7 +163,7 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
      * 
      * @return the encoding style as a string
      */
-    private String parseTemplateEncodingStyle(final Element template) {
+    private String parseTemplateEncodingStyle(@Nonnull final Element template) {
         String encodingStyle = null;
         if (template.hasAttributeNS(null, "encodingStyle")) {
             encodingStyle = StringSupport.trimOrNull(template.getAttributeNS(null, "encodingStyle"));
@@ -169,4 +174,4 @@ public class DynamicHTTPMetadataProviderParser extends AbstractDynamicHTTPMetada
         return encodingStyle;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java
index 056e0106..a1aee64a 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.metadata;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.primitive.StringSupport;
@@ -33,17 +34,18 @@ import org.w3c.dom.Element;
 public class FileBackedHTTPMetadataProviderParser extends HTTPMetadataProviderParser {
 
     /** Element name. */
-    public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
+    @Nonnull public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
             "FileBackedHTTPMetadataProvider");
 
     /** {@inheritDoc} */
-    @Override protected Class<FileBackedHTTPMetadataResolver> getNativeBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<FileBackedHTTPMetadataResolver> getNativeBeanClass(final Element element) {
         return FileBackedHTTPMetadataResolver.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         builder.addConstructorArgValue(StringSupport.trimOrNull(element.getAttributeNS(null, "backingFile")));
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java
index fff94843..20df9afa 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/FilesystemMetadataProviderParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.metadata;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
@@ -32,19 +33,21 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class FilesystemMetadataProviderParser extends AbstractReloadingMetadataProviderParser {
 
     /** Element name. */
-    public static final QName ELEMENT_NAME =
+    @Nonnull public static final QName ELEMENT_NAME =
             new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "FilesystemMetadataProvider");
 
     /** {@inheritDoc} */
-    @Override protected Class<FilesystemMetadataResolver> getNativeBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<FilesystemMetadataResolver> getNativeBeanClass(final Element element) {
         return FilesystemMetadataResolver.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         builder.addConstructorArgValue(StringSupport.trimOrNull(element.getAttributeNS(null, "metadataFile")));
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProviderParser.java
index b427ad77..da4b7cae 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProviderParser.java
@@ -28,6 +28,7 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
 import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 import net.shibboleth.spring.http.HttpClientFactoryBean;
 
@@ -37,15 +38,15 @@ import net.shibboleth.spring.http.HttpClientFactoryBean;
 public abstract class HTTPMetadataProviderParser extends AbstractReloadingMetadataProviderParser {
 
     /** Default caching type. */
-    private static final Class<?> DEFAULT_CACHING_CLASS = HttpClientFactoryBean.class;
+    @Nonnull private static final Class<?> DEFAULT_CACHING_CLASS = HttpClientFactoryBean.class;
 
     /** Logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(HTTPMetadataProviderParser.class);
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         
         super.doNativeParse(element, parserContext, builder);
 
@@ -67,7 +68,8 @@ public abstract class HTTPMetadataProviderParser extends AbstractReloadingMetada
         }
 
         if (element.hasAttributeNS(null, "httpClientRef")) {
-            builder.addConstructorArgReference(StringSupport.trimOrNull(element.getAttributeNS(null, "httpClientRef")));
+            builder.addConstructorArgReference(
+                    AttributeSupport.getRequiredAttributeValue(element, null, "httpClientRef"));
             if (element.hasAttributeNS(null, "connectionTimeout")
                     || element.hasAttributeNS(null, "connectionRequestTimeout")
                     || element.hasAttributeNS(null, "socketTimeout")
@@ -98,8 +100,8 @@ public abstract class HTTPMetadataProviderParser extends AbstractReloadingMetada
      * 
      * Either httpClientSecurityParametersRef or httpClientSecurityParameters can be present, not both.
      */
-    private BeanDefinition buildHttpClient(final Element element, final ParserContext parserContext,
-            @Nullable final String httpClientSecurityParametersRef,
+    @Nonnull private BeanDefinition buildHttpClient(@Nonnull final Element element,
+            @Nonnull final ParserContext parserContext, @Nullable final String httpClientSecurityParametersRef,
             @Nullable final BeanDefinition httpClientSecurityParameters) {
 
         return HTTPMetadataProvidersParserSupport.buildCommonClientBuilder(element, parserContext,
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java
index b4f4eb1f..95ea4d2a 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/HTTPMetadataProvidersParserSupport.java
@@ -128,7 +128,6 @@ public final class HTTPMetadataProvidersParserSupport {
         return builder.getBeanDefinition();
     }
 
-// Checkstyle: CyclomaticComplexity|MethodLength OFF
     /**
      * Build a {@link BeanDefinitionBuilder} for a {@link HttpClientFactoryBean} and populate it from the "standard"
      * attributes which are shared between the Dynamic and Static providers. non standard defaults are applied by the
@@ -188,6 +187,5 @@ public final class HTTPMetadataProvidersParserSupport {
 
         return clientBuilder;
     }
-// Checkstyle: CyclomaticComplexity|MethodLength ON
     
 }
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java
index 696b85a5..a256b07a 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/InlineMetadataProviderParser.java
@@ -22,8 +22,8 @@ import java.util.List;
 import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
-import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
@@ -40,13 +40,14 @@ public class InlineMetadataProviderParser extends AbstractMetadataProviderParser
             "InlineMetadataProvider");
 
     /** {@inheritDoc} */
-    @Override protected Class<DOMMetadataResolver> getNativeBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<DOMMetadataResolver> getNativeBeanClass(final Element element) {
         return DOMMetadataResolver.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext, 
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         List<Element> metadataContent =
@@ -59,7 +60,7 @@ public class InlineMetadataProviderParser extends AbstractMetadataProviderParser
         
         if (element.hasAttributeNS(null, "indexesRef")) {
             builder.addPropertyReference("indexes",
-                    StringSupport.trimOrNull(element.getAttributeNS(null, "indexesRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "indexesRef"));
         }
         
         if (element.hasAttributeNS(null, "resolveViaPredicatesOnly")) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java
index b69f07ac..d9c41e59 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.metadata;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.persist.FilesystemLoadSaveManager;
@@ -36,6 +37,7 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
 import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 
 /**
  * Parser for {@link LocalDynamicMetadataResolver}.
@@ -43,20 +45,21 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataProviderParser {
     
     /** Element name. */
-    public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
+    @Nonnull public static final QName ELEMENT_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
             "LocalDynamicMetadataProvider");
 
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(LocalDynamicMetadataProviderParser.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(LocalDynamicMetadataProviderParser.class);
     
     /** {@inheritDoc} */
-    protected Class<? extends MetadataResolver> getNativeBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<? extends MetadataResolver> getNativeBeanClass(final Element element) {
         return LocalDynamicMetadataResolver.class;
     }
     
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
         
         Object sourceKeyGeneratorRefOrBean = null;
@@ -106,7 +109,7 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
      *
      * @param element the element being parsed
      */
-    private void checkAndLogSourceDirectoryOverrides(final Element element) {
+    private void checkAndLogSourceDirectoryOverrides(@Nonnull final Element element) {
         if (element.hasAttributeNS(null, "sourceDirectory")) {
             log.warn("Presence of sourceManagerRef will override sourceDirectory");
         }
@@ -128,8 +131,8 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
      *
      * @return the bean definition for the filesystem source manager
      */
-    private BeanDefinition buildFilesystemManagerDefinition(final Element element, final ParserContext parserContext,
-            final boolean isDefaultSourceKeyGenerator) {
+    private BeanDefinition buildFilesystemManagerDefinition(@Nonnull final Element element,
+            @Nonnull final ParserContext parserContext, final boolean isDefaultSourceKeyGenerator) {
 
         final BeanDefinitionBuilder sourceManagerBuilder =
                 BeanDefinitionBuilder.genericBeanDefinition(FilesystemLoadSaveManager.class);
@@ -155,13 +158,14 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
      * @param sourceManagerBuilder the source build manager for the FilesystemLoadSaveManager being built
      * @param isDefaultSourceKeyGenerator whether the internal default source key manager is being used
      */
-    private void processIntermediateDirectoryStrategy(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder sourceManagerBuilder, final boolean isDefaultSourceKeyGenerator) {
+    private void processIntermediateDirectoryStrategy(@Nonnull final Element element,
+            @Nonnull final ParserContext parserContext, @Nonnull final BeanDefinitionBuilder sourceManagerBuilder,
+            final boolean isDefaultSourceKeyGenerator) {
 
         if (element.hasAttributeNS(null, "sourceDirectoryIntermediateStrategyRef")) {
             sourceManagerBuilder.addConstructorArgReference(
-                    StringSupport.trimOrNull(
-                            element.getAttributeNS(null, "sourceDirectoryIntermediateStrategyRef")));
+                    AttributeSupport.getRequiredAttributeValue(element, null,
+                            "sourceDirectoryIntermediateStrategyRef"));
         } else if (isDefaultSourceKeyGenerator) {
             final BeanDefinition intermediateDirectoryStrategy =
                     checkAndBuildPassthroughIntermediateDirectoryStrategy(element, parserContext);
@@ -186,8 +190,8 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
      * @param parserContext the current parser context
      * @return the strategy bean definition, or null if not configured
      */
-    private BeanDefinition checkAndBuildPassthroughIntermediateDirectoryStrategy(final Element element,
-            final ParserContext parserContext) {
+    private BeanDefinition checkAndBuildPassthroughIntermediateDirectoryStrategy(@Nonnull final Element element,
+            @Nonnull final ParserContext parserContext) {
 
         if (!element.hasAttributeNS(null, "sourceDirectoryIntermediateSegmentNumber")
                 && !element.hasAttributeNS(null, "sourceDirectoryIntermediateSegmentLength") ) {
@@ -217,4 +221,4 @@ public class LocalDynamicMetadataProviderParser extends AbstractDynamicMetadataP
         return strategyBuilder.getBeanDefinition();
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/MetadataNamespaceHandler.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/MetadataNamespaceHandler.java
index f3f9cf1d..c518fc35 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/MetadataNamespaceHandler.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/MetadataNamespaceHandler.java
@@ -34,7 +34,6 @@ import net.shibboleth.spring.metadata.filter.SchemaValidationParser;
 import net.shibboleth.spring.metadata.filter.SignatureValidationParser;
 
 /** Namespace handler for <code>urn:mace:shibboleth:2.0:metadata</code>. */
-
 public class MetadataNamespaceHandler extends BaseSpringNamespaceHandler {
 
     /** Metadata provider element name. */
@@ -79,4 +78,4 @@ public class MetadataNamespaceHandler extends BaseSpringNamespaceHandler {
         registerBeanDefinitionParser(KeyAuthorityParser.TYPE_NAME, new KeyAuthorityParser());
     }
 
-}
\ No newline at end of file
+}
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java
index 2e182a15..05fe8772 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/ResourceBackedMetadataProviderParser.java
@@ -60,7 +60,8 @@ public class ResourceBackedMetadataProviderParser extends AbstractReloadingMetad
     @Nonnull private final Logger log = LoggerFactory.getLogger(ResourceBackedMetadataProviderParser.class);
 
     /** {@inheritDoc} */
-    @Override protected Class<? extends AbstractBatchMetadataResolver> getNativeBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<? extends AbstractBatchMetadataResolver> getNativeBeanClass(final Element element) {
 
         if (AttributeSupport.hasAttribute(element, RESOURCE_REF)) {
             return ResourceBackedMetadataResolver.class;
@@ -70,8 +71,8 @@ public class ResourceBackedMetadataProviderParser extends AbstractReloadingMetad
     }
 
     /** {@inheritDoc} */
-    @Override protected void doNativeParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doNativeParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doNativeParse(element, parserContext, builder);
 
         final String beanRef = StringSupport.trimOrNull(AttributeSupport.getAttributeValue(element, RESOURCE_REF));
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParser.java
index 9c13848f..6d53f3c2 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParser.java
@@ -64,14 +64,15 @@ public class AlgorithmFilterParser extends AbstractCustomBeanDefinitionParser {
     @Nonnull private final Logger log = LoggerFactory.getLogger(AlgorithmFilterParser.class);
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return AlgorithmFilter.class;
     }
 
 // Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         final Unmarshaller digestUnmarshaller = XMLObjectSupport.getUnmarshaller(DigestMethod.DEFAULT_ELEMENT_NAME);
         final Unmarshaller signingUnmarshaller =XMLObjectSupport.getUnmarshaller(SigningMethod.DEFAULT_ELEMENT_NAME);
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java
index cd898267..23731b42 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/ByReferenceParser.java
@@ -47,13 +47,14 @@ public class ByReferenceParser extends AbstractCustomBeanDefinitionParser {
             new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "ByReference");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return ByReferenceMetadataFilter.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         builder.setLazyInit(false);
 
         final List<Element> children = ElementSupport.getChildElements(element,
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntitiesDescriptorNameParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntitiesDescriptorNameParser.java
index dbbd000c..0be82d95 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntitiesDescriptorNameParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntitiesDescriptorNameParser.java
@@ -38,13 +38,14 @@ public class EntitiesDescriptorNameParser extends AbstractCustomBeanDefinitionPa
             "EntitiesDescriptorName");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return EntitiesDescriptorNameProcessor.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParser.java
index 38d3beea..73c01a0e 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParser.java
@@ -58,14 +58,15 @@ public class EntityAttributesFilterParser extends AbstractCustomBeanDefinitionPa
     @Nonnull private final Logger log = LoggerFactory.getLogger(EntityAttributesFilterParser.class);
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return EntityAttributesFilter.class;
     }
 
 // Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         final Unmarshaller unmarshaller = XMLObjectSupport.getUnmarshaller(Attribute.DEFAULT_ELEMENT_NAME);
         if (unmarshaller == null) {
@@ -89,8 +90,9 @@ public class EntityAttributesFilterParser extends AbstractCustomBeanDefinitionPa
                 "AttributeFilterRef")) {
             builder.addPropertyReference("attributeFilter", ElementSupport.getElementContentAsString(child));
             child = ElementSupport.getNextSiblingElement(child);
-        } else if (ElementSupport.isElementNamed(child, AbstractMetadataProviderParser.METADATA_NAMESPACE,
-                "AttributeFilterScript")) {
+        } else if (child != null &&
+                ElementSupport.isElementNamed(child, AbstractMetadataProviderParser.METADATA_NAMESPACE,
+                        "AttributeFilterScript")) {
             builder.addPropertyValue("attributeFilter",
                     ScriptTypeBeanParser.parseScriptType(ScriptedPredicate.class, child).getBeanDefinition());
             child = ElementSupport.getNextSiblingElement(child);
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java
index 025b4314..730a0761 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParser.java
@@ -43,13 +43,14 @@ public class EntityRoleFilterParser extends AbstractCustomBeanDefinitionParser {
             "EntityRole");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return EntityRoleFilter.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         
         final List<QName> retainedRoles = new ArrayList<>();
         final List<Element> retainedRoleElems =
@@ -79,4 +80,5 @@ public class EntityRoleFilterParser extends AbstractCustomBeanDefinitionParser {
     @Override protected boolean shouldGenerateId() {
         return true;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/KeyAuthorityParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/KeyAuthorityParser.java
index 6baaa349..5f07cc43 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/KeyAuthorityParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/KeyAuthorityParser.java
@@ -38,14 +38,15 @@ public class KeyAuthorityParser extends AbstractCustomBeanDefinitionParser {
             new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "KeyAuthority");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return KeyAuthorityNodeProcessor.class;
     }
 
     /** {@inheritDoc} */
     @Override
-    protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParser.java
index e069ff46..021891a8 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParser.java
@@ -25,8 +25,6 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.profile.logic.EntityIdPredicate;
 import org.opensaml.saml.metadata.resolver.filter.impl.NameIDFormatFilter;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.ManagedList;
@@ -49,18 +47,16 @@ public class NameIDFormatFilterParser extends AbstractCustomBeanDefinitionParser
     @Nonnull public static final QName TYPE_NAME = new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE,
             "NameIDFormat");
 
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(NameIDFormatFilterParser.class);
-
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return NameIDFormatFilter.class;
     }
 
 // Checkstyle: MethodLength OFF
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         builder.setInitMethodName("initialize");
         builder.setDestroyMethodName("destroy");
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NodeProcessingParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NodeProcessingParser.java
index 2aa0a628..84fdbde0 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NodeProcessingParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/NodeProcessingParser.java
@@ -43,13 +43,14 @@ public class NodeProcessingParser extends AbstractCustomBeanDefinitionParser {
             new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "NodeProcessing");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return NodeProcessingMetadataFilter.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         builder.setInitMethodName("initialize");
         builder.setDestroyMethodName("destroy");
         builder.setLazyInit(true);
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterDirectionFactoryBean.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterDirectionFactoryBean.java
index aaf1bf67..c13f3f01 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterDirectionFactoryBean.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterDirectionFactoryBean.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.metadata.filter;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.saml.metadata.resolver.filter.impl.PredicateFilter;
@@ -42,13 +43,13 @@ public class PredicateFilterDirectionFactoryBean extends AbstractFactoryBean<Pre
     
     /** {@inheritDoc} */
     @Override
-    public Class<?> getObjectType() {
+    @Nonnull public Class<?> getObjectType() {
         return PredicateFilter.Direction.class;
     }
 
     /** {@inheritDoc} */
     @Override
-    protected Direction createInstance() throws Exception {
+    @Nonnull protected Direction createInstance() throws Exception {
         if (value == null) {
             throw new BeanCreationException("Predicate filter requires 'direction' attribute");
         } else if ("exclude".equals(value)) {
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterParser.java
index c3e06c33..a1663d91 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/PredicateFilterParser.java
@@ -44,6 +44,7 @@ import net.shibboleth.shared.logic.ScriptedPredicate;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 import net.shibboleth.spring.ScriptTypeBeanParser;
 import net.shibboleth.spring.metadata.AbstractMetadataProviderParser;
@@ -78,13 +79,14 @@ public class PredicateFilterParser extends AbstractCustomBeanDefinitionParser {
     }
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return PredicateFilter.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         if (element.hasAttributeNS(null, "removeEmptyEntitiesDescriptors")) {
             builder.addPropertyValue("removeEmptyEntitiesDescriptors", SpringSupport.getStringValueAsBoolean(
@@ -98,7 +100,8 @@ public class PredicateFilterParser extends AbstractCustomBeanDefinitionParser {
 
         if (element.hasAttributeNS(null, "conditionRef")) {
             log.info("Found conditionRef attribute, ignoring embedded Entity/Group/Tag elements");
-            builder.addConstructorArgReference(StringSupport.trimOrNull(element.getAttributeNS(null, "conditionRef")));
+            builder.addConstructorArgReference(
+                    AttributeSupport.getRequiredAttributeValue(element, null, "conditionRef"));
         } else {
             builder.addConstructorArgValue(parseCustomElements(element));
         }
@@ -149,8 +152,10 @@ public class PredicateFilterParser extends AbstractCustomBeanDefinitionParser {
                 return tagPredicateBuilder.getBeanDefinition();
             } else if (mappedTagPredicateBuilder != null) {
                 return mappedTagPredicateBuilder.getBeanDefinition();
-            } else {
+            } else if (scriptPredicateBuilder != null) {
                 return scriptPredicateBuilder.getBeanDefinition();
+            } else {
+                throw new BeanCreationException("No Entity, Group, Tag, or ConditionScript element found");
             }
         } else {
             final BeanDefinitionBuilder orBuilder =
@@ -292,6 +297,7 @@ public class PredicateFilterParser extends AbstractCustomBeanDefinitionParser {
                 }
                 managedTagList.add(tagBuilder.getBeanDefinition());
             }
+            assert mappedPredicateClass != null;
             final BeanDefinitionBuilder builder = BeanDefinitionBuilder.genericBeanDefinition(mappedPredicateClass);
             builder.addConstructorArgValue(managedTagList);
             builder.addConstructorArgValue(StringSupport.trimOrNull(element.getAttributeNS(null, "trim")));
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParser.java
index 3715e0b2..2b9c6d9f 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParser.java
@@ -21,8 +21,6 @@ import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
@@ -38,19 +36,17 @@ public class RequiredValidUntilParser extends AbstractCustomBeanDefinitionParser
     /** Element name. */
     @Nonnull public static final QName TYPE_NAME =
             new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "RequiredValidUntil");
-    
-    /** Class logger. */
-    @Nonnull private Logger log = LoggerFactory.getLogger(RequiredValidUntilParser.class);
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         // IDP-693 maxValidityInterval is a duration or a value in seconds - so we need a factory
         return RequiredValidUntilFilter.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
 
         if (element.hasAttributeNS(null, "maxValidityInterval")) {
             builder.addPropertyValue("maxValidityInterval", element.getAttributeNS(null, "maxValidityInterval"));
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SchemaValidationParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SchemaValidationParser.java
index 4b5484bf..fe4dd036 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SchemaValidationParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SchemaValidationParser.java
@@ -21,14 +21,12 @@ import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.metadata.resolver.filter.impl.SchemaValidationFilter;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
-import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.spring.metadata.AbstractMetadataProviderParser;
 
 /**
@@ -40,20 +38,18 @@ public class SchemaValidationParser extends AbstractCustomBeanDefinitionParser {
     @Nonnull public static final QName TYPE_NAME =
             new QName(AbstractMetadataProviderParser.METADATA_NAMESPACE, "SchemaValidation");
 
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(SchemaValidationParser.class);
-
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return SchemaValidationFilter.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         if (element.hasAttributeNS(null, "schemaBuilderRef")) {
-            builder.addConstructorArgReference(StringSupport.trimOrNull(element
-                    .getAttributeNS(null, "schemaBuilderRef")));
+            builder.addConstructorArgReference(
+                    AttributeSupport.getRequiredAttributeValue(element, null, "schemaBuilderRef"));
         } else {
             builder.addConstructorArgReference("shibboleth.SchemaBuilder");
         }
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationCriteriaSetFactoryBean.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationCriteriaSetFactoryBean.java
index aad7e8dd..923d6c2b 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationCriteriaSetFactoryBean.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationCriteriaSetFactoryBean.java
@@ -110,7 +110,7 @@ public class SignatureValidationCriteriaSetFactoryBean implements FactoryBean<Cr
     }
 
     /** {@inheritDoc} */
-    public Class<?> getObjectType() {
+    @Nonnull public Class<?> getObjectType() {
         return CriteriaSet.class;
     }
 
@@ -120,7 +120,7 @@ public class SignatureValidationCriteriaSetFactoryBean implements FactoryBean<Cr
     }
     
     /** {@inheritDoc} */
-    public CriteriaSet getObject() throws Exception {
+    @Nonnull public CriteriaSet getObject() throws Exception {
         log.debug("Building CriteriaSet based on factory bean inputs");
         final CriteriaSet criteriaSet = new CriteriaSet();
         
@@ -162,4 +162,4 @@ public class SignatureValidationCriteriaSetFactoryBean implements FactoryBean<Cr
         return criteriaSet;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationParser.java
index 6860ed5b..b3dc77c3 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/metadata/filter/SignatureValidationParser.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter;
@@ -43,9 +44,11 @@ import org.springframework.beans.factory.support.ManagedList;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 import net.shibboleth.spring.metadata.AbstractMetadataProviderParser;
 
@@ -66,14 +69,15 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
     @Nonnull private final Logger log = LoggerFactory.getLogger(SignatureValidationParser.class);
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return SignatureValidationFilter.class;
     }
 
 // Checkstyle: CyclomaticComplexity|MethodLength OFF
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext, 
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext, 
+            @Nonnull final BeanDefinitionBuilder builder) {
         final boolean hasEngineRef = element.hasAttributeNS(null, "trustEngineRef");
         final boolean hasCertFile = element.hasAttributeNS(null, "certificateFile");
         final List<Element> publicKeys = ElementSupport.getChildElements(element, PUBLIC_KEY);
@@ -98,8 +102,8 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
                         .getReaderContext().getResource().getDescription());
                 throw new BeanCreationException("trustEngineRef and embedded public keys are mutually exclusive");
             }
-            builder.addConstructorArgReference(StringSupport.trimOrNull(element.getAttributeNS(null, 
-                    "trustEngineRef")));
+            builder.addConstructorArgReference(
+                    AttributeSupport.getRequiredAttributeValue(element, null, "trustEngineRef"));
         } else if (hasCertFile) {
             if (null != publicKeys && !publicKeys.isEmpty()) {
                 log.error("{}: certificateFile and embedded public keys are mutually exclusive", parserContext
@@ -114,14 +118,17 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
             buildTrustEngine(builder, buildCertificateCredential(element.getAttributeNS(null, "certificateFile")));
         } else if (null != trustEngines && !trustEngines.isEmpty()) {
             if (trustEngines.size() > 1) {
-                log.error("{}: Too many <TrustEngine>s", parserContext.getReaderContext().getResource()
+                log.error("{}: Too many <TrustEngine> elements", parserContext.getReaderContext().getResource()
                         .getDescription());
-                throw new BeanCreationException("Too many <TrustEngine>s");
+                throw new BeanCreationException("Too many <TrustEngine> elements");
             }
-            final ManagedList<BeanDefinition> engines = 
+            final ManagedList<BeanDefinition> engines =
                     SpringSupport.parseCustomElements(trustEngines, parserContext, builder);
-
-            builder.addConstructorArgValue(engines.get(0));
+            if (engines != null && !engines.isEmpty()) {
+                builder.addConstructorArgValue(engines.get(0));
+            } else {
+                throw new BeanCreationException("Unable to parse <TrustEngine> element");
+            }
         } else {
             buildTrustEngine(builder, buildPublicKeyCredential(parserContext, publicKeys));
         }
@@ -137,7 +144,8 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
         }
 
         if (element.hasAttributeNS(null, "defaultCriteriaRef")) {
-            builder.addPropertyReference("defaultCriteria", element.getAttributeNS(null, "defaultCriteriaRef"));
+            builder.addPropertyReference("defaultCriteria",
+                    AttributeSupport.getRequiredAttributeValue(element, null, "defaultCriteriaRef"));
         } else {
             // TODO refactor, if decide upon new strategy for (or against) well-known bean refs
             builder.addPropertyReference("defaultCriteria", "shibboleth.MetadataSignatureValidationStaticCriteria");
@@ -145,12 +153,12 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
 
         if (element.hasAttributeNS(null, "signaturePrevalidatorRef")) {
             builder.addPropertyReference("signaturePrevalidator",
-                    element.getAttributeNS(null, "signaturePrevalidatorRef"));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "signaturePrevalidatorRef"));
         }
 
         if (element.hasAttributeNS(null, "dynamicTrustedNamesStrategyRef")) {
             builder.addPropertyReference("dynamicTrustedNamesStrategy",
-                    element.getAttributeNS(null, "dynamicTrustedNamesStrategyRef"));
+                    AttributeSupport.getRequiredAttributeValue(element, null, "dynamicTrustedNamesStrategyRef"));
         }
 
     }
@@ -162,7 +170,8 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
      * @param builder the builder for this bean.
      * @param credential the definition of a {@link org.opensaml.security.credential.Credential}
      */
-    private void buildTrustEngine(final BeanDefinitionBuilder builder, final BeanDefinition credential) {
+    private void buildTrustEngine(@Nonnull final BeanDefinitionBuilder builder,
+            @Nonnull final BeanDefinition credential) {
         final BeanDefinitionBuilder trustEngineBuilder =
                 BeanDefinitionBuilder.genericBeanDefinition(ExplicitKeySignatureTrustEngine.class);
 
@@ -190,7 +199,8 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
      * @param publicKeys the list of <PublicKey> elements
      * @return the definition.
      */
-    private BeanDefinition buildPublicKeyCredential(final ParserContext parserContext, final List<Element> publicKeys) {
+    @Nonnull private BeanDefinition buildPublicKeyCredential(@Nonnull final ParserContext parserContext,
+            @Nullable final List<Element> publicKeys) {
         if (null == publicKeys || publicKeys.isEmpty()) {
             log.error("{}: SignatureValidation filter must have a 'trustEngineRef' attribute"
                     + ", a 'certificateFile' attribute or <PublicKey> elements", parserContext.getReaderContext()
@@ -226,7 +236,7 @@ public class SignatureValidationParser extends AbstractCustomBeanDefinitionParse
      * @param attribute the name of the certificate file
      * @return the bean definition.
      */
-    private BeanDefinition buildCertificateCredential(final String attribute) {
+    @Nonnull private BeanDefinition buildCertificateCredential(@Nonnull @NotEmpty final String attribute) {
         final BeanDefinitionBuilder credentialBuilder =
                 BeanDefinitionBuilder.genericBeanDefinition(BasicX509CredentialFactoryBean.class);
         final List<String> certs = new ManagedList<>(1);
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractBasicCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractBasicCredentialParser.java
index c1cbfa97..6ed33e9a 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractBasicCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractBasicCredentialParser.java
@@ -45,23 +45,23 @@ import org.w3c.dom.Element;
 public abstract class AbstractBasicCredentialParser extends AbstractCredentialParser {
 
     /** <PrivateKey>. */
-    public static final QName PRIVATE_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName PRIVATE_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "PrivateKey");
 
     /** <PublicKey>. */
-    public static final QName PUBLIC_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName PUBLIC_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "PublicKey");
 
     /** <SecretKey>. */
-    public static final QName SECRET_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName SECRET_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "SecretKey");
 
     /** log. */
-    private final Logger log = LoggerFactory.getLogger(AbstractBasicCredentialParser.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractBasicCredentialParser.class);
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
         builder.addPropertyValue("configDescription", parserContext.getReaderContext().getResource().getDescription());
 
@@ -77,8 +77,8 @@ public abstract class AbstractBasicCredentialParser extends AbstractCredentialPa
      * @param parserContext used for logging.
      * @param builder the builder.
      */
-    private void parsePrivateKey(@Nullable final List<Element> childElements, final ParserContext parserContext,
-            @Nonnull final BeanDefinitionBuilder builder) {
+    private void parsePrivateKey(@Nullable final List<Element> childElements,
+            @Nonnull final ParserContext parserContext, @Nonnull final BeanDefinitionBuilder builder) {
         if (null == childElements || childElements.isEmpty()) {
             return;
         }
@@ -106,7 +106,7 @@ public abstract class AbstractBasicCredentialParser extends AbstractCredentialPa
      * @param parserContext used for logging.
      * @param builder the builder
      */
-    private void parsePublicKey(@Nullable final List<Element> childElements, final ParserContext parserContext,
+    private void parsePublicKey(@Nullable final List<Element> childElements, @Nonnull final ParserContext parserContext,
             @Nonnull final BeanDefinitionBuilder builder) {
         if (null == childElements || childElements.isEmpty()) {
             return;
@@ -138,7 +138,7 @@ public abstract class AbstractBasicCredentialParser extends AbstractCredentialPa
      * @param parserContext used for logging.
      * @param builder the builder
      */
-    private void parseSecretKey(@Nullable final List<Element> childElements, final ParserContext parserContext,
+    private void parseSecretKey(@Nullable final List<Element> childElements, @Nonnull final ParserContext parserContext,
             @Nonnull final BeanDefinitionBuilder builder) {
         if (null == childElements || childElements.isEmpty()) {
             return;
@@ -160,4 +160,5 @@ public abstract class AbstractBasicCredentialParser extends AbstractCredentialPa
         builder.addPropertyValue("secretKeyAlgorithm", StringSupport.trimOrNull(key.getAttributeNS(null, "algorithm")));
         builder.addPropertyValue("secretKeyEncoding", StringSupport.trimOrNull(key.getAttributeNS(null, "encoding")));
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractCredentialParser.java
index c18ff99e..45e7c5a4 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractCredentialParser.java
@@ -19,6 +19,8 @@ package net.shibboleth.spring.security.credential;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.springframework.beans.factory.support.AbstractBeanDefinition;
@@ -26,9 +28,11 @@ import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
 import net.shibboleth.shared.spring.util.SpringSupport;
+import net.shibboleth.shared.xml.AttributeSupport;
 import net.shibboleth.shared.xml.ElementSupport;
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
 
@@ -38,22 +42,23 @@ import net.shibboleth.spring.security.SecurityNamespaceHandler;
 public abstract class AbstractCredentialParser extends AbstractCustomBeanDefinitionParser {
 
     /** <Credential>. */
-    public static final QName CREDENTIAL_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName CREDENTIAL_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "Credential");
 
     /** <KeyName>. */
-    public static final QName KEY_NAME_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName KEY_NAME_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "KeyName");
 
     /** {@inheritDoc} */
-    @Override protected String resolveId(final Element element, final AbstractBeanDefinition definition,
-            final ParserContext parserContext) {
-        return StringSupport.trimOrNull(element.getAttributeNS(null, "id"));
+    @Override
+    @Nonnull @NotEmpty protected String resolveId(@Nonnull final Element element,
+            @Nonnull final AbstractBeanDefinition definition, @Nonnull final ParserContext parserContext) {
+        return AttributeSupport.getRequiredAttributeValue(element,null, "id");
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
         
         builder.setLazyInit(true);
@@ -68,7 +73,7 @@ public abstract class AbstractCredentialParser extends AbstractCustomBeanDefinit
      * @param element credential element
      * @param builder bean definition builder
      */
-    protected void parseAttributes(final Element element, final BeanDefinitionBuilder builder) {
+    protected void parseAttributes(@Nonnull final Element element, @Nonnull final BeanDefinitionBuilder builder) {
         final String usage = StringSupport.trimOrNull(element.getAttributeNS(null, "usage"));
         builder.addPropertyValue("usageType", usage);
 
@@ -84,11 +89,13 @@ public abstract class AbstractCredentialParser extends AbstractCustomBeanDefinit
      * @param keyNameElems the elements to parse
      * @param builder credential build
      */
-    protected void parseKeyNames(final List<Element> keyNameElems, final BeanDefinitionBuilder builder) {
+    protected void parseKeyNames(@Nullable final List<Element> keyNameElems,
+            @Nonnull final BeanDefinitionBuilder builder) {
         if (keyNameElems == null || keyNameElems.isEmpty()) {
             return;
         }
 
         builder.addPropertyValue("keyNames", SpringSupport.getElementTextContentAsManagedList(keyNameElems));
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractX509CredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractX509CredentialParser.java
index f1c914a2..33525fed 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractX509CredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/AbstractX509CredentialParser.java
@@ -47,21 +47,21 @@ import org.w3c.dom.Element;
 public abstract class AbstractX509CredentialParser extends AbstractCredentialParser {
 
     /** <PrivateKey>. */
-    public static final QName PRIVATE_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName PRIVATE_KEY_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "PrivateKey");
 
     /** <Certificate>. */
-    public static final QName CERTIFICATE_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName CERTIFICATE_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "Certificate");
 
     /** <CRL>. */
-    public static final QName CRL_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "CRL");
+    @Nonnull public static final QName CRL_ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "CRL");
 
     /** log. */
-    private Logger log = LoggerFactory.getLogger(AbstractX509CredentialParser.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(AbstractX509CredentialParser.class);
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, builder);
         parsePrivateKey(ElementSupport.getChildElements(element, PRIVATE_KEY_ELEMENT_NAME), builder);
         parseCertificates(ElementSupport.getChildElements(element, CERTIFICATE_ELEMENT_NAME), builder);
@@ -111,12 +111,14 @@ public abstract class AbstractX509CredentialParser extends AbstractCredentialPar
             if (null == cert) {
                 throw new BeanCreationException("All <Certificate> elements must contain text.");
             }
-            if (elem.hasAttributeNS(null, "entityCertificate")
-                    && AttributeSupport.getAttributeValueAsBoolean(elem.getAttributeNodeNS(null,
-                            "entityCertificate"))) {
-                // Note the loss of property replacement for this undocumented extension
-                log.debug("Found a certficate marked as an entityCertificate {}", cert);
-                builder.addPropertyValue("entity", cert);
+            if (elem.hasAttributeNS(null, "entityCertificate")) {
+                final Boolean flag = AttributeSupport.getAttributeValueAsBoolean(
+                        elem.getAttributeNodeNS(null, "entityCertificate"));
+                if (flag != null && flag) {
+                    // Note the loss of property replacement for this undocumented extension
+                    log.debug("Found a certficate marked as an entityCertificate {}", cert);
+                    builder.addPropertyValue("entity", cert);
+                }
             } else {
                 log.debug("Found a certficate {}", cert);
             }
@@ -138,4 +140,5 @@ public abstract class AbstractX509CredentialParser extends AbstractCredentialPar
 
         builder.addPropertyValue("CRLs", SpringSupport.getElementTextContentAsManagedList(childElements));
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java
index ae8ce397..5d3ba5b2 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicInlineCredentialParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.credential;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -33,7 +34,8 @@ public class BasicInlineCredentialParser extends AbstractBasicCredentialParser {
     public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "BasicInline");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return BasicInlineCredentialFactoryBean.class;
     }
 }
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java
index 679608ce..693fb169 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/BasicResourceCredentialParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.credential;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -34,7 +35,8 @@ public class BasicResourceCredentialParser extends AbstractBasicCredentialParser
             "BasicResourceBacked");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return BasicResourceCredentialFactoryBean.class;
     }
 }
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java
index c677a349..483d451a 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509InlineCredentialParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.credential;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -32,7 +33,8 @@ public class X509InlineCredentialParser extends AbstractX509CredentialParser {
     /** Element Name.*/
     public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "X509Inline");
 
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return X509InlineCredentialFactoryBean.class;
     }
 }
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java
index 0858e2bf..78182003 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/credential/X509ResourceCredentialParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.credential;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -33,7 +34,8 @@ public class X509ResourceCredentialParser extends AbstractX509CredentialParser {
     public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "X509ResourceBacked");
 
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return BasicX509CredentialFactoryBean.class;
     }
 
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractChainingParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractChainingParser.java
index c28977d3..c94e2d47 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractChainingParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractChainingParser.java
@@ -19,6 +19,8 @@ package net.shibboleth.spring.security.trust;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.spring.util.SpringSupport;
 import net.shibboleth.shared.xml.ElementSupport;
@@ -37,8 +39,8 @@ import org.w3c.dom.Element;
 public abstract class AbstractChainingParser extends AbstractTrustEngineParser {
     
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         final List<Element> childEngines =
@@ -50,12 +52,13 @@ public abstract class AbstractChainingParser extends AbstractTrustEngineParser {
         
         allChildren.addAll(SpringSupport.parseCustomElements(childEngines, parserContext, builder));
         
-        for (final Element ref:childEngineRefs) {
+        for (final Element ref : childEngineRefs) {
             final String reference = StringSupport.trimOrNull(ref.getAttributeNS(null, "ref"));
             if (null != reference) {
-                allChildren.add(new RuntimeBeanReference(StringSupport.trim(reference)));
+                allChildren.add(new RuntimeBeanReference(reference));
             }
         }
         builder.addConstructorArgValue(allChildren);
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractPKIXValidationInfoParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractPKIXValidationInfoParser.java
index 6f46b251..9443ffc0 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractPKIXValidationInfoParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractPKIXValidationInfoParser.java
@@ -19,6 +19,7 @@ package net.shibboleth.spring.security.trust;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.primitive.StringSupport;
@@ -39,15 +40,15 @@ import org.w3c.dom.Element;
 public abstract class AbstractPKIXValidationInfoParser extends AbstractCustomBeanDefinitionParser {
 
     /** The element <Certificate>. */
-    private static final QName CERTIFICATE =
+    @Nonnull private static final QName CERTIFICATE =
             new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "Certificate");
 
     /** The element <CRL>. */
-    private static final QName CRL = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "CRL");
+    @Nonnull private static final QName CRL = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "CRL");
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         builder.addPropertyValue("configDescription", parserContext.getReaderContext().getResource().getDescription());
@@ -75,4 +76,5 @@ public abstract class AbstractPKIXValidationInfoParser extends AbstractCustomBea
 
         builder.addPropertyValue("CRLs", crlStrings);
     }
-}
+    
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractTrustEngineParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractTrustEngineParser.java
index 851ac5fd..b036c05c 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractTrustEngineParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/AbstractTrustEngineParser.java
@@ -17,13 +17,16 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
+
 import org.springframework.beans.factory.support.AbstractBeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.w3c.dom.Element;
 
-import net.shibboleth.shared.primitive.StringSupport;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
+import net.shibboleth.shared.xml.AttributeSupport;
 
 /**
  * Basis of all parsers for <security:TrustEngine>.
@@ -31,14 +34,16 @@ import net.shibboleth.shared.spring.custom.AbstractCustomBeanDefinitionParser;
 public abstract class AbstractTrustEngineParser extends AbstractCustomBeanDefinitionParser {
 
     /** {@inheritDoc} */
-    @Override protected String resolveId(final Element element, final AbstractBeanDefinition definition,
-            final ParserContext parserContext) {
-        return StringSupport.trimOrNull(element.getAttributeNS(null, "id"));
+    @Override
+    @Nonnull @NotEmpty protected String resolveId(@Nonnull final Element element,
+            @Nonnull final AbstractBeanDefinition definition, @Nonnull final ParserContext parserContext) {
+        return AttributeSupport.getRequiredAttributeValue(element, null, "id");
     }
 
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
         builder.setLazyInit(true);
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/CertPathPKIXValidationOptionsParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/CertPathPKIXValidationOptionsParser.java
index abf48bea..ba6550e9 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/CertPathPKIXValidationOptionsParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/CertPathPKIXValidationOptionsParser.java
@@ -19,6 +19,7 @@ package net.shibboleth.spring.security.trust;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.primitive.StringSupport;
@@ -37,21 +38,22 @@ import org.w3c.dom.Element;
  */
 public class CertPathPKIXValidationOptionsParser extends PKIXValidationOptionsParser {
     /** Schema type. */
-    public static final QName SCHEMA_TYPE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName SCHEMA_TYPE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "CertPathValidationOptionsType");
 
     /** PolicyOid Element type. */
-    public static final QName POLICY_OID_ELEMENT = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName POLICY_OID_ELEMENT = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "PolicyOID");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return CertPathPKIXValidationOptions.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         if (element.hasAttributeNS(null, "forceRevocationEnabled")) {
@@ -86,4 +88,5 @@ public class CertPathPKIXValidationOptionsParser extends PKIXValidationOptionsPa
             builder.addPropertyValue("initialPolicies", initialPolicies);
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/ChainingParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/ChainingParser.java
index 7b217b72..c957f949 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/ChainingParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/ChainingParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -30,10 +31,13 @@ import org.w3c.dom.Element;
 public class ChainingParser extends AbstractChainingParser {
     
     /** Schema type. */
-    public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "Chaining");
+    @Nonnull public static final QName TYPE_NAME =
+            new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "Chaining");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return ChainingTrustEngineFactoryBean.class;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXInlineValidationInfoParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXInlineValidationInfoParser.java
index e503b448..b688eefd 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXInlineValidationInfoParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXInlineValidationInfoParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -35,10 +36,13 @@ import org.w3c.dom.Element;
 public class PKIXInlineValidationInfoParser extends AbstractPKIXValidationInfoParser {
     
     /** Element Name.*/
-    public static final QName SCHEMA_TYPE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "PKIXInline");
+    @Nonnull public static final QName SCHEMA_TYPE =
+            new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "PKIXInline");
     
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return PKIXInlineValidationInfoFactoryBean.class;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXResourceValidationInfoParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXResourceValidationInfoParser.java
index 16b558f1..b2efa6ff 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXResourceValidationInfoParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXResourceValidationInfoParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -35,11 +36,13 @@ import org.w3c.dom.Element;
 public class PKIXResourceValidationInfoParser extends AbstractPKIXValidationInfoParser {
 
     /** Schema type for PKIXResourceBackedValidationInformation. */
-    public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName TYPE_NAME_RESOURCE = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "PKIXResourceBacked");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return PKIXResourceValidationInfoFactoryBean.class;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXValidationOptionsParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXValidationOptionsParser.java
index f7045c5c..f0966ef2 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXValidationOptionsParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/PKIXValidationOptionsParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.primitive.StringSupport;
@@ -34,17 +35,18 @@ import org.w3c.dom.Element;
 public class PKIXValidationOptionsParser extends AbstractCustomBeanDefinitionParser {
 
     /** Validation Options. */
-    public static final QName ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName ELEMENT_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "ValidationOptions");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return PKIXValidationOptions.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         if (element.hasAttributeNS(null, "processEmptyCRLs")) {
@@ -73,4 +75,4 @@ public class PKIXValidationOptionsParser extends AbstractCustomBeanDefinitionPar
         return true;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/SignatureChainingParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/SignatureChainingParser.java
index 81e102f6..6bd2de5b 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/SignatureChainingParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/SignatureChainingParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -30,11 +31,13 @@ import org.w3c.dom.Element;
 public class SignatureChainingParser extends AbstractChainingParser {
 
     /** Schema type. */
-    public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "SignatureChaining");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return ChainingSignatureTrustEngineFactoryBean.class;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParser.java
index 44886ca7..d5fb4cc8 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParser.java
@@ -19,6 +19,7 @@ package net.shibboleth.spring.security.trust;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.spring.util.SpringSupport;
@@ -37,17 +38,18 @@ import org.w3c.dom.Element;
 public class StaticExplicitKeyParser extends AbstractTrustEngineParser {
 
     /** Schema type. */
-    public static final QName TYPE_NAME =
+    @Nonnull public static final QName TYPE_NAME =
             new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "StaticExplicitKey");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return ExplicitKeyTrustEngine.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         final List<Element> credentials =
@@ -59,4 +61,5 @@ public class StaticExplicitKeyParser extends AbstractTrustEngineParser {
 
         builder.addConstructorArgValue(resolver.getBeanDefinition());
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParser.java
index 02b6f5c6..a135b2b1 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParser.java
@@ -19,6 +19,7 @@ package net.shibboleth.spring.security.trust;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.spring.util.SpringSupport;
@@ -38,17 +39,18 @@ import org.w3c.dom.Element;
 public class StaticExplicitKeySignatureParser extends AbstractTrustEngineParser {
 
     /** Schema type. */
-    public static final QName TYPE_NAME =
+    @Nonnull public static final QName TYPE_NAME =
             new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE, "StaticExplicitKeySignature");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return ExplicitKeySignatureTrustEngine.class;
     }
 
     /** {@inheritDoc} */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         final List<Element> credentials =
@@ -63,4 +65,5 @@ public class StaticExplicitKeySignatureParser extends AbstractTrustEngineParser
         builder.addConstructorArgValue(DefaultSecurityConfigurationBootstrap
                 .buildBasicInlineKeyInfoCredentialResolver());
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXSignatureParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXSignatureParser.java
index 5109131e..839c2243 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXSignatureParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXSignatureParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -33,11 +34,12 @@ import org.w3c.dom.Element;
 public class StaticPKIXSignatureParser extends AbstractStaticPKIXParser {
 
     /** Schema type. */
-    public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "StaticPKIXSignature");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return PKIXSignatureTrustEngine.class;
     }
 
@@ -53,8 +55,8 @@ public class StaticPKIXSignatureParser extends AbstractStaticPKIXParser {
      * org.opensaml.security.x509.impl.X509CredentialNameEvaluator)}.
      * </p>
      */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         builder.addConstructorArgValue(getPKIXValidationInformationResolver(element, parserContext));
@@ -64,4 +66,4 @@ public class StaticPKIXSignatureParser extends AbstractStaticPKIXParser {
         builder.addConstructorArgValue(getX509CredentialNameEvaluator(element, parserContext));
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXX509CredentialParser.java b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXX509CredentialParser.java
index 343be82e..d5c19f8f 100644
--- a/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXX509CredentialParser.java
+++ b/shib-metadata-spring/src/main/java/net/shibboleth/spring/security/trust/StaticPKIXX509CredentialParser.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.spring.security.SecurityNamespaceHandler;
@@ -32,11 +33,12 @@ import org.w3c.dom.Element;
 public class StaticPKIXX509CredentialParser extends AbstractStaticPKIXParser {
 
     /** Schema type. */
-    public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
+    @Nonnull public static final QName TYPE_NAME = new QName(SecurityNamespaceHandler.SECURITY_NAMESPACE,
             "StaticPKIXX509Credential");
 
     /** {@inheritDoc} */
-    @Override protected Class<?> getBeanClass(final Element element) {
+    @Override
+    @Nonnull protected Class<?> getBeanClass(@Nonnull final Element element) {
         return PKIXX509CredentialTrustEngine.class;
     }
 
@@ -51,8 +53,8 @@ public class StaticPKIXX509CredentialParser extends AbstractStaticPKIXParser {
      *   org.opensaml.security.x509.impl.X509CredentialNameEvaluator)}.
      * </p>
      */
-    @Override protected void doParse(final Element element, final ParserContext parserContext,
-            final BeanDefinitionBuilder builder) {
+    @Override protected void doParse(@Nonnull final Element element, @Nonnull final ParserContext parserContext,
+            @Nonnull final BeanDefinitionBuilder builder) {
         super.doParse(element, parserContext, builder);
 
         builder.addConstructorArgValue(getPKIXValidationInformationResolver(element, parserContext));
@@ -60,4 +62,4 @@ public class StaticPKIXX509CredentialParser extends AbstractStaticPKIXParser {
         builder.addConstructorArgValue(getX509CredentialNameEvaluator(element, parserContext));
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java
index e39e1130..57f40e59 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/AbstractMetadataParserTest.java
@@ -27,6 +27,8 @@ import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.springframework.context.ApplicationContext;
@@ -165,13 +167,13 @@ public class AbstractMetadataParserTest extends OpenSAMLInitBaseTestCase {
         return getBean(claz, null, files);
     }
         
-    protected MockPropertySource singletonPropertySource(final String name, final String value) {
+    protected MockPropertySource singletonPropertySource(@Nonnull final String name, @Nonnull final String value) {
         MockPropertySource propSource = new MockPropertySource("localProperties");
         propSource.setProperty(name, value);
         return propSource;
     }
    
-    static public CriteriaSet criteriaFor(final String entityId) {
+    @Nonnull static public CriteriaSet criteriaFor(@Nonnull final String entityId) {
         final EntityIdCriterion criterion = new EntityIdCriterion(entityId);
         return new CriteriaSet(criterion);
     }
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
index a48b3aeb..393d11f4 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/DynamicHTTPMetadataProviderParserTest.java
@@ -227,6 +227,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
 
@@ -244,6 +245,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
 
@@ -260,6 +262,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -290,6 +293,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -307,6 +311,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -324,6 +329,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
 
@@ -341,6 +347,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
 
@@ -358,6 +365,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -375,6 +383,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -392,6 +401,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -425,6 +435,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
@@ -442,6 +453,7 @@ public class DynamicHTTPMetadataProviderParserTest extends AbstractMetadataParse
         
         final EntityDescriptor ed = resolver.resolveSingle(criteriaSet);
         Assert.assertNotNull(ed);
+        assert ed != null;
         Assert.assertEquals(ed.getEntityID(), entityID);
     }
     
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java
index e7a97f70..c4ee41aa 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/EmptyChainService.java
@@ -33,6 +33,7 @@ public class EmptyChainService extends AbstractMetadataParserTest {
     @Test public void setup() throws IOException {
         final ReloadableService<RefreshableMetadataResolver> service = getBean(ReloadableService.class, "empty-chain-svc.xml");
         try (final ServiceableComponent<RefreshableMetadataResolver> comp = service.getServiceableComponent()) {
+            assert comp != null;
             final ChainingMetadataResolver chain = (ChainingMetadataResolver) comp.getComponent();
             Assert.assertTrue(chain.getResolvers().isEmpty());
         }
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java
index 42828f96..a13c4194 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FileBackedHTTPMetadataProviderParserTest.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.spring.metadata;
 
+import static org.testng.Assert.*;
+
 import java.time.Duration;
 import java.util.Iterator;
 
@@ -26,7 +28,6 @@ import org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.mock.env.MockPropertySource;
-import org.testng.Assert;
 import org.testng.annotations.Test;
 
 import net.shibboleth.shared.testing.RepositorySupport;
@@ -43,79 +44,98 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
     private static final String ENTITIES_XML = "shib-metadata-spring/src/test/resources/net/shibboleth/spring/metadata/entities.xml";
         
     @Test public void entity() throws Exception {
-        MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+        final MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
                 RepositorySupport.buildHTTPResourceURL(REPO_IDP, ENTITY_XML, false));
 
-        FileBackedHTTPMetadataResolver resolver = getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntity.xml", "beans.xml");
+        final FileBackedHTTPMetadataResolver resolver =
+                getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntity.xml", "beans.xml");
+        assert resolver != null;
 
-        Assert.assertEquals(resolver.getId(), "fileBackedHTTPEntity");
+        assertEquals(resolver.getId(), "fileBackedHTTPEntity");
 
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
-        Assert.assertTrue(resolver.isFailFastInitialization());
-        Assert.assertTrue(resolver.isRequireValidMetadata());
+        final Iterable<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID));
+        assertNotNull(entities);
+        assert entities != null;
+        
+        final Iterator<EntityDescriptor> iter = entities.iterator();
+        
+        assertTrue(resolver.isFailFastInitialization());
+        assertTrue(resolver.isRequireValidMetadata());
 
-        Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
-        Assert.assertFalse(entities.hasNext());
+        assertEquals(iter.next().getEntityID(), IDP_ID);
+        assertFalse(iter.hasNext());
 
-        Assert.assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
-        Assert.assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
-        Assert.assertSame(resolver.getParserPool(), parserPool);
+        assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
+        assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
+        assertSame(resolver.getParserPool(), parserPool);
 
-        Assert.assertEquals(resolver.isInitializeFromBackupFile(), false);
-        Assert.assertEquals(resolver.getBackupFileInitNextRefreshDelay(), Duration.ofSeconds(10));
+        assertEquals(resolver.isInitializeFromBackupFile(), false);
+        assertEquals(resolver.getBackupFileInitNextRefreshDelay(), Duration.ofSeconds(10));
 
-        Assert.assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
     }
 
     @Test(expectedExceptions = {BeanCreationException.class}) public void badIFBVF() throws Exception {
-        MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+        final MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
                 RepositorySupport.buildHTTPResourceURL(REPO_IDP, ENTITY_XML, false));
 
-        FileBackedHTTPMetadataResolver resolver = getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntityBadIFBF.xml", "beans.xml");
+        final FileBackedHTTPMetadataResolver resolver =
+                getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntityBadIFBF.xml", "beans.xml");
+        assert resolver != null;
 
-        Assert.assertEquals(resolver.getId(), "BadIFBF");
+        assertEquals(resolver.getId(), "BadIFBF");
 
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
-        Assert.assertTrue(resolver.isFailFastInitialization());
-        Assert.assertTrue(resolver.isRequireValidMetadata());
+        final Iterable<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID));
+        assertNotNull(entities);
+        assert entities != null;
+        
+        final Iterator<EntityDescriptor> iter = entities.iterator();
+        assertTrue(resolver.isFailFastInitialization());
+        assertTrue(resolver.isRequireValidMetadata());
 
-        Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
-        Assert.assertFalse(entities.hasNext());
+        assertEquals(iter.next().getEntityID(), IDP_ID);
+        assertFalse(iter.hasNext());
 
-        Assert.assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
-        Assert.assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
-        Assert.assertSame(resolver.getParserPool(), parserPool);
+        assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
+        assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
+        assertSame(resolver.getParserPool(), parserPool);
 
-        Assert.assertEquals(resolver.isInitializeFromBackupFile(), true);
-        Assert.assertEquals(resolver.getBackupFileInitNextRefreshDelay(), Duration.ofSeconds(10));
+        assertEquals(resolver.isInitializeFromBackupFile(), true);
+        assertEquals(resolver.getBackupFileInitNextRefreshDelay(), Duration.ofSeconds(10));
 
-        Assert.assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
     }
 
     
     @Test(expectedExceptions = {BeanCreationException.class}) public void badTLS() throws Exception {
-        MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
+        final MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
                 RepositorySupport.buildHTTPResourceURL(REPO_IDP, ENTITY_XML, false));
 
-        FileBackedHTTPMetadataResolver resolver = getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntityDisRegardTLSBad.xml", "beans.xml");
+        final FileBackedHTTPMetadataResolver resolver =
+                getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntityDisRegardTLSBad.xml", "beans.xml");
 
-        Assert.assertEquals(resolver.getId(), "badTLS");
+        assertEquals(resolver.getId(), "badTLS");
+
+        final Iterable<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID));
+        assertNotNull(entities);
+        assert entities != null;
+        
+        final Iterator<EntityDescriptor> iter = entities.iterator();
 
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
-        Assert.assertTrue(resolver.isFailFastInitialization());
-        Assert.assertTrue(resolver.isRequireValidMetadata());
+        assertTrue(resolver.isFailFastInitialization());
+        assertTrue(resolver.isRequireValidMetadata());
 
-        Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
-        Assert.assertFalse(entities.hasNext());
+        assertEquals(iter.next().getEntityID(), IDP_ID);
+        assertFalse(iter.hasNext());
 
-        Assert.assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
-        Assert.assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
-        Assert.assertSame(resolver.getParserPool(), parserPool);
+        assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
+        assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
+        assertSame(resolver.getParserPool(), parserPool);
 
-        Assert.assertEquals(resolver.isInitializeFromBackupFile(), false);
-        Assert.assertEquals(resolver.getBackupFileInitNextRefreshDelay(), Duration.ofSeconds(10));
+        assertEquals(resolver.isInitializeFromBackupFile(), false);
+        assertEquals(resolver.getBackupFileInitNextRefreshDelay(), Duration.ofSeconds(10));
 
-        Assert.assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
     }
 
 
@@ -123,12 +143,13 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
         MockPropertySource propSource = singletonPropertySource(PROP_MDURL,
                 RepositorySupport.buildHTTPResourceURL(REPO_IDP, ENTITIES_XML, false));
 
-        MetadataResolver resolver = getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntities.xml", "beans.xml");
+        final MetadataResolver resolver =
+                getBean(FileBackedHTTPMetadataResolver.class, propSource, "fileBackedHTTPEntities.xml", "beans.xml");
 
-        Assert.assertEquals(resolver.getId(), "fileBackedHTTPEntities");
+        assertEquals(resolver.getId(), "fileBackedHTTPEntities");
 
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
     }
 
     @Test(enabled=false) public void httpsNoTrustEngine() throws Exception {
@@ -137,9 +158,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-noTrustEngine.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntity");
+        assertEquals(resolver.getId(), "HTTPSEntity");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     }
     
     @Test public void httpsTrustEngineExplicitKey() throws Exception {
@@ -148,9 +169,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-explicitKey.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntity");
+        assertEquals(resolver.getId(), "HTTPSEntity");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     }
     
     @Test(expectedExceptions=BeanCreationException.class) public void httpsTrustEngineInvalidKey() throws Exception {
@@ -159,9 +180,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-invalidKey.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntity");
+        assertEquals(resolver.getId(), "HTTPSEntity");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     } 
     
     @Test public void httpsTrustEngineValidPKIX() throws Exception {
@@ -170,9 +191,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-validPKIX.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntity");
+        assertEquals(resolver.getId(), "HTTPSEntity");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     }
     
     @Test public void httpsTrustEngineValidPKIXExplicitTrustedName() throws Exception {
@@ -181,9 +202,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-validPKIX-explicitTrustedName.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntity");
+        assertEquals(resolver.getId(), "HTTPSEntity");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     }
     
     @Test(expectedExceptions=BeanCreationException.class) public void httpsTrustEngineInvalidPKIX() throws Exception {
@@ -192,9 +213,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-trustEngine-invalidPKIX.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntity");
+        assertEquals(resolver.getId(), "HTTPSEntity");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     } 
     
     /**
@@ -217,10 +238,10 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "http-entities-client.xml", "beans.xml", "httpClient.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPEntities");
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
-        Assert.assertNotSame(resolver.getParserPool(), parserPool);
+        assertEquals(resolver.getId(), "HTTPEntities");
+        assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotSame(resolver.getParserPool(), parserPool);
         
     }
     
@@ -230,8 +251,8 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "http-entity-httpCaching-none.xml", "beans.xml", "httpClient.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPEntity");
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertEquals(resolver.getId(), "HTTPEntity");
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
         
     }
     
@@ -241,8 +262,8 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "http-entity-httpCaching-memory.xml", "beans.xml", "httpClient.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPEntity");
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertEquals(resolver.getId(), "HTTPEntity");
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
         
     }
     
@@ -254,8 +275,8 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "http-entity-httpCaching-file.xml", "beans.xml", "httpClient.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPEntity");
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertEquals(resolver.getId(), "HTTPEntity");
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
         
     }
     
@@ -265,9 +286,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-timeouts.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntityWithTimeouts");
+        assertEquals(resolver.getId(), "HTTPSEntityWithTimeouts");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     }
     
     @Test public void clientSecurityParameters() throws Exception {
@@ -276,9 +297,9 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-client-security-params.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntityWithClientSecurityParams");
+        assertEquals(resolver.getId(), "HTTPSEntityWithClientSecurityParams");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
     }
     
     @Test public void indexes() throws Exception {
@@ -287,12 +308,12 @@ public class FileBackedHTTPMetadataProviderParserTest extends AbstractMetadataPa
 
         HTTPMetadataResolver resolver = getBean(HTTPMetadataResolver.class, propSource, "https-indexes.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "HTTPSEntityWithIndexes");
+        assertEquals(resolver.getId(), "HTTPSEntityWithIndexes");
         
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
         
-        Assert.assertNotNull(resolver.getIndexes());
-        Assert.assertEquals(resolver.getIndexes().size(), 3);
+        assertNotNull(resolver.getIndexes());
+        assertEquals(resolver.getIndexes().size(), 3);
     }
     
 }
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FilesystemMetadataParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FilesystemMetadataParserTest.java
index 39387d7f..a2d15abf 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FilesystemMetadataParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/FilesystemMetadataParserTest.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.spring.metadata;
 
+import static org.testng.Assert.*;
+
 import java.io.IOException;
 import java.time.Duration;
 import java.util.Iterator;
@@ -25,10 +27,10 @@ import org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.context.ApplicationContext;
-import org.testng.Assert;
 import org.testng.annotations.Test;
 
 import net.shibboleth.idp.saml.metadata.impl.MetadataProviderContainer;
+import net.shibboleth.shared.logic.Constraint;
 
 @SuppressWarnings("javadoc")
 public class FilesystemMetadataParserTest extends AbstractMetadataParserTest {
@@ -37,75 +39,77 @@ public class FilesystemMetadataParserTest extends AbstractMetadataParserTest {
 
         FilesystemMetadataResolver resolver = getBean(FilesystemMetadataResolver.class, "fileEntityActivationCondition.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "fileEntityActivationCondition");
+        assertEquals(resolver.getId(), "fileEntityActivationCondition");
    
         final Iterable<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID));
-        Assert.assertTrue(resolver.isFailFastInitialization());
-        Assert.assertTrue(resolver.isRequireValidMetadata());
+        assertTrue(resolver.isFailFastInitialization());
+        assertTrue(resolver.isRequireValidMetadata());
         
-        Assert.assertNull(entities);
+        assertNull(entities);
     }
 
     @Test public void entity() throws Exception {
 
         FilesystemMetadataResolver resolver = getBean(FilesystemMetadataResolver.class, "fileEntity.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "fileEntity");
+        assertEquals(resolver.getId(), "fileEntity");
    
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
-        Assert.assertTrue(resolver.isFailFastInitialization());
-        Assert.assertTrue(resolver.isRequireValidMetadata());
+        final Iterator<EntityDescriptor> entities =
+                Constraint.isNotNull(resolver.resolve(criteriaFor(IDP_ID)), "Resolver returned null").iterator();
+        assertTrue(resolver.isFailFastInitialization());
+        assertTrue(resolver.isRequireValidMetadata());
         
-        Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
-        Assert.assertFalse(entities.hasNext());
+        assertEquals(entities.next().getEntityID(), IDP_ID);
+        assertFalse(entities.hasNext());
 
-        Assert.assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
-        Assert.assertSame(resolver.getParserPool(), parserPool);
+        assertEquals(resolver.getRefreshDelayFactor(), 0.75, 0.001);
+        assertSame(resolver.getParserPool(), parserPool);
         
-        Assert.assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNull(resolver.resolveSingle(criteriaFor(SP_ID)));
     }
 
     @Test public void entities() throws Exception {
 
         FilesystemMetadataResolver resolver = getBean(FilesystemMetadataResolver.class, "fileEntities.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "fileEntities");
-        Assert.assertEquals(resolver.getMaxRefreshDelay(), Duration.ofMinutes(55));
-        Assert.assertEquals(resolver.getMinRefreshDelay(), Duration.ofMinutes(15));
-        Assert.assertEquals(resolver.getRefreshDelayFactor(), 0.5, 0.001);
-        Assert.assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
-        Assert.assertNotSame(resolver.getParserPool(), parserPool);
+        assertEquals(resolver.getId(), "fileEntities");
+        assertEquals(resolver.getMaxRefreshDelay(), Duration.ofMinutes(55));
+        assertEquals(resolver.getMinRefreshDelay(), Duration.ofMinutes(15));
+        assertEquals(resolver.getRefreshDelayFactor(), 0.5, 0.001);
+        assertEquals(resolver.getExpirationWarningThreshold(), Duration.ofHours(12));
+        assertNotSame(resolver.getParserPool(), parserPool);
    
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
-        Assert.assertTrue(resolver.isFailFastInitialization());
-        Assert.assertTrue(resolver.isRequireValidMetadata());
+        final Iterator<EntityDescriptor> entities =
+                Constraint.isNotNull(resolver.resolve(criteriaFor(IDP_ID)), "Resolver returned null").iterator();
+        assertTrue(resolver.isFailFastInitialization());
+        assertTrue(resolver.isRequireValidMetadata());
         
-        Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
-        Assert.assertFalse(entities.hasNext());
+        assertEquals(entities.next().getEntityID(), IDP_ID);
+        assertFalse(entities.hasNext());
 
-        Assert.assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
+        assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
     }
     
     @Test public void predicatesDefaults() throws IOException {
         FilesystemMetadataResolver resolver = getBean(FilesystemMetadataResolver.class, "filePredicatesDefaults.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "filePredicatesDefaults");
+        assertEquals(resolver.getId(), "filePredicatesDefaults");
         
-        Assert.assertFalse(resolver.isSatisfyAnyPredicates());
-        Assert.assertTrue(resolver.isUseDefaultPredicateRegistry());
-        Assert.assertNotNull(resolver.getCriterionPredicateRegistry());
-        Assert.assertFalse(resolver.isResolveViaPredicatesOnly());
+        assertFalse(resolver.isSatisfyAnyPredicates());
+        assertTrue(resolver.isUseDefaultPredicateRegistry());
+        assertNotNull(resolver.getCriterionPredicateRegistry());
+        assertFalse(resolver.isResolveViaPredicatesOnly());
     }
     
     @Test public void predicatesNoDefaultRegistry() throws IOException {
         FilesystemMetadataResolver resolver = getBean(FilesystemMetadataResolver.class, "filePredicatesNoDefaultRegistry.xml", "beans.xml");
         
-        Assert.assertEquals(resolver.getId(), "filePredicatesNoDefaultRegistry");
+        assertEquals(resolver.getId(), "filePredicatesNoDefaultRegistry");
         
-        Assert.assertFalse(resolver.isSatisfyAnyPredicates());
-        Assert.assertFalse(resolver.isUseDefaultPredicateRegistry());
-        Assert.assertNull(resolver.getCriterionPredicateRegistry());
-        Assert.assertFalse(resolver.isResolveViaPredicatesOnly());
+        assertFalse(resolver.isSatisfyAnyPredicates());
+        assertFalse(resolver.isUseDefaultPredicateRegistry());
+        assertNull(resolver.getCriterionPredicateRegistry());
+        assertFalse(resolver.isResolveViaPredicatesOnly());
     }
     
     @Test public void predicatesOptions() throws IOException {
@@ -117,13 +121,13 @@ public class FilesystemMetadataParserTest extends AbstractMetadataParserTest {
         FilesystemMetadataResolver resolver = 
                 FilesystemMetadataResolver.class.cast(rpProvider.getEmbeddedResolver());
         
-        Assert.assertEquals(resolver.getId(), "filePredicatesOptions");
+        assertEquals(resolver.getId(), "filePredicatesOptions");
         
-        Assert.assertTrue(resolver.isSatisfyAnyPredicates());
-        Assert.assertTrue(resolver.isUseDefaultPredicateRegistry());
-        Assert.assertNotNull(resolver.getCriterionPredicateRegistry());
-        Assert.assertSame(resolver.getCriterionPredicateRegistry(), appContext.getBean("metadata.CriterionPredicateRegistry"));
-        Assert.assertTrue(resolver.isResolveViaPredicatesOnly());
+        assertTrue(resolver.isSatisfyAnyPredicates());
+        assertTrue(resolver.isUseDefaultPredicateRegistry());
+        assertNotNull(resolver.getCriterionPredicateRegistry());
+        assertSame(resolver.getCriterionPredicateRegistry(), appContext.getBean("metadata.CriterionPredicateRegistry"));
+        assertTrue(resolver.isResolveViaPredicatesOnly());
     }
     
     @Test(expectedExceptions = {BeanCreationException.class}) public void badRVPO() throws IOException {
@@ -135,13 +139,13 @@ public class FilesystemMetadataParserTest extends AbstractMetadataParserTest {
         FilesystemMetadataResolver resolver = 
                 FilesystemMetadataResolver.class.cast(rpProvider.getEmbeddedResolver());
         
-        Assert.assertEquals(resolver.getId(), "BadRVPO");
+        assertEquals(resolver.getId(), "BadRVPO");
         
-        Assert.assertTrue(resolver.isSatisfyAnyPredicates());
-        Assert.assertTrue(resolver.isUseDefaultPredicateRegistry());
-        Assert.assertNotNull(resolver.getCriterionPredicateRegistry());
-        Assert.assertSame(resolver.getCriterionPredicateRegistry(), appContext.getBean("metadata.CriterionPredicateRegistry"));
-        Assert.assertFalse(resolver.isResolveViaPredicatesOnly());
+        assertTrue(resolver.isSatisfyAnyPredicates());
+        assertTrue(resolver.isUseDefaultPredicateRegistry());
+        assertNotNull(resolver.getCriterionPredicateRegistry());
+        assertSame(resolver.getCriterionPredicateRegistry(), appContext.getBean("metadata.CriterionPredicateRegistry"));
+        assertFalse(resolver.isResolveViaPredicatesOnly());
     }
 
 }
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java
index 508b0975..d2cde888 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/InlineMetadataParserTest.java
@@ -23,6 +23,7 @@ import java.util.Collection;
 import java.util.Iterator;
 import java.util.stream.Collectors;
 
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.ResolverException;
 import net.shibboleth.shared.service.ServiceableComponent;
 import net.shibboleth.shared.spring.resource.PreferFileSystemResourceLoader;
@@ -53,7 +54,8 @@ public class InlineMetadataParserTest extends AbstractMetadataParserTest {
         Assert.assertNotNull(resolver.getIndexes());
         Assert.assertFalse(resolver.getIndexes().isEmpty());
 
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
+        final Iterator<EntityDescriptor> entities =
+                Constraint.isNotNull(resolver.resolve(criteriaFor(IDP_ID)), "Resolver returned null").iterator();
         Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
         Assert.assertFalse(entities.hasNext());
 
@@ -71,7 +73,8 @@ public class InlineMetadataParserTest extends AbstractMetadataParserTest {
         Assert.assertNotNull(resolver.getIndexes());
         Assert.assertFalse(resolver.getIndexes().isEmpty());
 
-        final Iterator<EntityDescriptor> entities = resolver.resolve(criteriaFor(IDP_ID)).iterator();
+        final Iterator<EntityDescriptor> entities =
+                Constraint.isNotNull(resolver.resolve(criteriaFor(IDP_ID)), "Resolver returned null").iterator();
         Assert.assertEquals(entities.next().getEntityID(), IDP_ID);
         Assert.assertFalse(entities.hasNext());
 
@@ -116,6 +119,7 @@ public class InlineMetadataParserTest extends AbstractMetadataParserTest {
                 context.getBean("shibboleth.MetadataResolverService", ReloadableSpringService.class);
 
         try (final ServiceableComponent<MetadataResolver> msc = ms.getServiceableComponent()){
+            assert msc != null;
             final MetadataResolver resolver = msc.getComponent();
             Assert.assertNotNull(resolver.resolveSingle(criteriaFor(IDP_ID)));
             Assert.assertNotNull(resolver.resolveSingle(criteriaFor(SP_ID)));
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java
index 18f9ad15..4cd2034f 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/LocalDynamicMetadataProviderParserTest.java
@@ -115,7 +115,7 @@ public class LocalDynamicMetadataProviderParserTest extends AbstractMetadataPars
         ApplicationContext appContext = getApplicationContext("LocalDynamic", 
                 "localDynamicWithManagerAndGenerator.xml", "beans.xml");
 
-        XMLObjectLoadSaveManager<XMLObject> sourceManager = 
+        final XMLObjectLoadSaveManager<XMLObject> sourceManager = 
                 appContext.getBean("metadata.LocalDynamicSourceManager", XMLObjectLoadSaveManager.class);
 
         MetadataProviderContainer rpProvider = appContext.getBean("localDynamicWithManagerAndGenerator", MetadataProviderContainer.class);
@@ -173,8 +173,9 @@ public class LocalDynamicMetadataProviderParserTest extends AbstractMetadataPars
         // Sleep past the negative lookup cache expiration
         Uninterruptibles.sleepUninterruptibly(resolver.getNegativeLookupCacheDuration().toMillis()+TIME_GRANULARITY_MS, TimeUnit.MILLISECONDS);
         
-        EntityDescriptor resolved = resolver.resolveSingle(criteria);
+        final EntityDescriptor resolved = resolver.resolveSingle(criteria);
         Assert.assertNotNull(resolved);
+        assert resolved != null;
         Assert.assertEquals(resolved.getEntityID(), entityID);
     }
     
@@ -217,8 +218,9 @@ public class LocalDynamicMetadataProviderParserTest extends AbstractMetadataPars
         // Sleep past the negative lookup cache expiration
         Uninterruptibles.sleepUninterruptibly(resolver.getNegativeLookupCacheDuration().toMillis()+TIME_GRANULARITY_MS, TimeUnit.MILLISECONDS);
         
-        EntityDescriptor resolved = resolver.resolveSingle(criteria);
+        final EntityDescriptor resolved = resolver.resolveSingle(criteria);
         Assert.assertNotNull(resolved);
+        assert resolved != null;
         Assert.assertEquals(resolved.getEntityID(), entityID);
     }
     
@@ -261,8 +263,9 @@ public class LocalDynamicMetadataProviderParserTest extends AbstractMetadataPars
         // Sleep past the negative lookup cache expiration
         Uninterruptibles.sleepUninterruptibly(resolver.getNegativeLookupCacheDuration().toMillis()+TIME_GRANULARITY_MS, TimeUnit.MILLISECONDS);
         
-        EntityDescriptor resolved = resolver.resolveSingle(criteria);
+        final EntityDescriptor resolved = resolver.resolveSingle(criteria);
         Assert.assertNotNull(resolved);
+        assert resolved != null;
         Assert.assertEquals(resolved.getEntityID(), entityID);
     }
     
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java
index 8d127220..39bf5cc8 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/MetadataFailFastTest.java
@@ -28,7 +28,6 @@ import org.springframework.mock.env.MockPropertySource;
 import org.testng.annotations.Ignore;
 import org.testng.annotations.Test;
 
-import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.service.ReloadableService;
 import net.shibboleth.shared.service.ServiceableComponent;
 import net.shibboleth.shared.testing.RepositorySupport;
@@ -58,6 +57,7 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
         final ReloadableService<MetadataResolver > service = (ReloadableService<MetadataResolver>) bean;
         assertNotNull(service);
         try (final ServiceableComponent<MetadataResolver> srv = service.getServiceableComponent()) {
+            assert srv != null;
             final MetadataResolver resolver = srv.getComponent();
             assertNotNull(resolver);
         }
@@ -101,21 +101,22 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     @Test public void workingFile() throws IOException {
-        final List<Pair<String, String>> prop = List.of(new Pair<>("ServiceConfiguration", makePath("fileMetadata.xml")),
-                new Pair<>("File", makePath("metadataFileGood.xml")));
+        final List<MockProperty> prop = List.of(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
+                new MockProperty("File", makePath("metadataFileGood.xml")));
         
         final Object bean = getBean(propertySource(prop), "metadataBeansDefaultFF.xml");
         final ReloadableService<MetadataResolver > service = (ReloadableService<MetadataResolver>) bean;
         assertNotNull(service);
         try (final ServiceableComponent<MetadataResolver> srv = service.getServiceableComponent()) {
+            assert srv != null;
             final MetadataResolver resolver = srv.getComponent();
             assertNotNull(resolver);
         }
     }
 
     private void badFile(final Boolean failFast) throws IOException {
-        final List<Pair<String, String>> prop = List.of(new Pair<>("ServiceConfiguration", makePath("fileMetadata.xml")),
-                new Pair<>("File", makePath("metadataFileBad.xml")));
+        final List<MockProperty> prop = List.of(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
+                new MockProperty("File", makePath("metadataFileBad.xml")));
         nonWorkingMetadata(failFast, propertySource(prop));
     }
 
@@ -132,8 +133,8 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     private void nonExistingFile(final Boolean failFast) throws IOException {
-        final List<Pair<String, String>> prop = List.of(new Pair<>("ServiceConfiguration", makePath("fileMetadata.xml")),
-                new Pair<>("File", makePath("metadatNooneHome.xml")));
+        final List<MockProperty> prop = List.of(new MockProperty("ServiceConfiguration", makePath("fileMetadata.xml")),
+                new MockProperty("File", makePath("metadatNooneHome.xml")));
         nonWorkingMetadata(failFast, propertySource(prop));
     }
 
@@ -150,25 +151,26 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     @Test public void workingHttp() throws IOException {
-        final List<Pair<String, String>> prop = List.of(
-                new Pair<>("ServiceConfiguration", makePath("httpMetadata.xml")),
-                new Pair<>("Backing", makeTempPath("workingHttpTmp" + uniquifier++ + ".xml")),
-                new Pair<>("metadataURL", makeURLPath("metadataFileGood.xml")));
+        final List<MockProperty> prop = List.of(
+                new MockProperty("ServiceConfiguration", makePath("httpMetadata.xml")),
+                new MockProperty("Backing", makeTempPath("workingHttpTmp" + uniquifier++ + ".xml")),
+                new MockProperty("metadataURL", makeURLPath("metadataFileGood.xml")));
 
         final Object bean = getBean(propertySource(prop), "metadataBeansDefaultFF.xml");
         final ReloadableService<MetadataResolver > service = (ReloadableService<MetadataResolver>) bean;
         assertNotNull(service);
         try (final ServiceableComponent<MetadataResolver> srv = service.getServiceableComponent()) {
+            assert srv != null;
             final MetadataResolver resolver = srv.getComponent();
             assertNotNull(resolver);
         }
     }
 
     private void badHttp(final Boolean failFast) throws IOException {
-        final List<Pair<String, String>> prop = List.of(
-                new Pair<>("ServiceConfiguration", makePath("httpMetadata.xml")),
-                new Pair<>("Backing", makeTempPath("badHttpTmp" + uniquifier++ + ".xml")),
-                new Pair<>("metadataURL", makeURLPath("metadataFileBad.xml")));
+        final List<MockProperty> prop = List.of(
+                new MockProperty("ServiceConfiguration", makePath("httpMetadata.xml")),
+                new MockProperty("Backing", makeTempPath("badHttpTmp" + uniquifier++ + ".xml")),
+                new MockProperty("metadataURL", makeURLPath("metadataFileBad.xml")));
         nonWorkingMetadata(failFast, propertySource(prop));
     }
 
@@ -185,10 +187,10 @@ public class MetadataFailFastTest extends AbstractFailFastTest {
     }
 
     private void nonExistingHttp(final Boolean failFast) throws IOException {
-        final List<Pair<String, String>> prop = List.of(
-                new Pair<>("ServiceConfiguration", makePath("httpMetadata.xml")),
-                new Pair<>("Backing", makeTempPath("badHttpTmp" + uniquifier++ + ".xml")),
-                new Pair<>("metadataURL", makeURLPath("ItsNotThere.xml")));
+        final List<MockProperty> prop = List.of(
+                new MockProperty("ServiceConfiguration", makePath("httpMetadata.xml")),
+                new MockProperty("Backing", makeTempPath("badHttpTmp" + uniquifier++ + ".xml")),
+                new MockProperty("metadataURL", makeURLPath("ItsNotThere.xml")));
         nonWorkingMetadata(failFast, propertySource(prop));
     }
 
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParserTest.java
index e6de97b3..ea7a99c8 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/AlgorithmFilterParserTest.java
@@ -82,6 +82,7 @@ public class AlgorithmFilterParserTest extends AbstractMetadataParserTest {
         crit = new EntityIdCriterion("https://sp2.example.org/sp/shibboleth");
         entity = resolver.resolveSingle(new CriteriaSet(crit));
         Assert.assertNotNull(entity);
+        assert entity != null;
         final Extensions exts = entity.getExtensions();
         if (exts != null) {
             Assert.assertTrue(exts.getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME).isEmpty());
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ByReferenceFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ByReferenceFilterParserTest.java
index 98b2fd45..0c438d22 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ByReferenceFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/ByReferenceFilterParserTest.java
@@ -48,6 +48,7 @@ public class ByReferenceFilterParserTest extends AbstractMetadataParserTest {
         EntityIdCriterion key = new EntityIdCriterion("https://sp.example.org/sp/shibboleth");
         EntityDescriptor entity = resolver.resolveSingle(new CriteriaSet(key));
         Assert.assertNotNull(entity);
+        assert entity != null;
 
         Extensions exts = entity.getExtensions();
         Assert.assertNotNull(exts);
@@ -62,6 +63,7 @@ public class ByReferenceFilterParserTest extends AbstractMetadataParserTest {
         key = new EntityIdCriterion("https://sp2.example.org/sp/shibboleth");
         entity = resolver.resolveSingle(new CriteriaSet(key));
         Assert.assertNotNull(entity);
+        assert entity != null;
         exts = entity.getExtensions();
         if (exts != null) {
             extElements = exts.getUnknownXMLObjects(EntityAttributes.DEFAULT_ELEMENT_NAME);
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParserTest.java
index 6d09b879..b481ff9a 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityAttributesFilterParserTest.java
@@ -62,6 +62,7 @@ public class EntityAttributesFilterParserTest extends AbstractMetadataParserTest
         EntityIdCriterion key = new EntityIdCriterion("https://sp.example.org/sp/shibboleth");
         EntityDescriptor entity = resolver.resolveSingle(new CriteriaSet(key));
         Assert.assertNotNull(entity);
+        assert entity != null;
 
         Extensions exts = entity.getExtensions();
         Assert.assertNotNull(exts);
@@ -78,6 +79,7 @@ public class EntityAttributesFilterParserTest extends AbstractMetadataParserTest
         key = new EntityIdCriterion("https://sp2.example.org/sp/shibboleth");
         entity = resolver.resolveSingle(new CriteriaSet(key));
         Assert.assertNotNull(entity);
+        assert entity != null;
         exts = entity.getExtensions();
         if (exts != null) {
             extElements = exts.getUnknownXMLObjects(EntityAttributes.DEFAULT_ELEMENT_NAME);
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java
index d45b5ab3..a36c8060 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/EntityRoleFilterParserTest.java
@@ -41,6 +41,7 @@ public class EntityRoleFilterParserTest extends AbstractMetadataParserTest {
         final MetadataResolver resolver = getBean(MetadataResolver.class, "filter/entityRole.xml");
 
         final EntityRoleFilter filter = (EntityRoleFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getRemoveEmptyEntitiesDescriptors(), true);
         Assert.assertEquals(filter.getRemoveRolelessEntityDescriptors(), true);
         Assert.assertEquals(filter.getRetainedRoles().size(), 0);
@@ -50,6 +51,7 @@ public class EntityRoleFilterParserTest extends AbstractMetadataParserTest {
         final MetadataResolver resolver = getBean(MetadataResolver.class, "filter/entityRoleParams.xml");
 
         final EntityRoleFilter filter = (EntityRoleFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getRemoveEmptyEntitiesDescriptors(), false);
         Assert.assertEquals(filter.getRemoveRolelessEntityDescriptors(), false);
         final List<QName> roles = filter.getRetainedRoles();
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParserTest.java
index 82277cec..9506cd2a 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NameIDFormatFilterParserTest.java
@@ -56,6 +56,7 @@ public class NameIDFormatFilterParserTest extends AbstractMetadataParserTest {
         EntityIdCriterion key = new EntityIdCriterion("https://sp.example.org/sp/shibboleth");
         EntityDescriptor entity = resolver.resolveSingle(new CriteriaSet(key));
         Assert.assertNotNull(entity);
+        assert entity != null;
 
         Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().size(), 1);
         Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().get(0).getURI(), "foo");
@@ -63,6 +64,7 @@ public class NameIDFormatFilterParserTest extends AbstractMetadataParserTest {
         key = new EntityIdCriterion("https://sp2.example.org/sp/shibboleth");
         entity = resolver.resolveSingle(new CriteriaSet(key));
         Assert.assertNotNull(entity);
+        assert entity != null;
 
         Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().size(), 2);
         Assert.assertEquals(entity.getSPSSODescriptor(SAMLConstants.SAML20P_NS).getNameIDFormats().get(0).getURI(), "foo");
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NodeProcessingTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NodeProcessingTest.java
index 472a5b4f..3358e375 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NodeProcessingTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/NodeProcessingTest.java
@@ -44,6 +44,7 @@ public class NodeProcessingTest extends AbstractMetadataParserTest {
         final MetadataResolver resolver = getBean(MetadataResolver.class, "nodeproc/empty.xml");
 
         final NodeProcessingMetadataFilter filter = (NodeProcessingMetadataFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getNodeProcessors().size(), 0);
     }
 
@@ -51,6 +52,7 @@ public class NodeProcessingTest extends AbstractMetadataParserTest {
         final MetadataResolver resolver = getBean(MetadataResolver.class, "nodeproc/both.xml");
 
         final NodeProcessingMetadataFilter filter = (NodeProcessingMetadataFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getNodeProcessors().size(), 2);
         Assert.assertEquals(filter.getNodeProcessors().get(0).getClass(), EntitiesDescriptorNameProcessor.class);
         Assert.assertEquals(filter.getNodeProcessors().get(1).getClass(), KeyAuthorityNodeProcessor.class);
@@ -58,6 +60,7 @@ public class NodeProcessingTest extends AbstractMetadataParserTest {
         final EntityDescriptor entity =
                 resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://sp.example.org/sp/shibboleth")));
         Assert.assertNotNull(entity);
+        assert entity != null;
         final List<EntityGroupName> groups = entity.getObjectMetadata().get(EntityGroupName.class);
         Assert.assertEquals(groups.size(), 1);
         Assert.assertEquals(groups.get(0).getName(), "Example");
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParserTest.java
index 646b5a5f..ad17e2a0 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/RequiredValidUntilParserTest.java
@@ -37,6 +37,7 @@ public class RequiredValidUntilParserTest extends AbstractMetadataParserTest {
         MetadataResolver resolver = getBean(MetadataResolver.class, "filter/requiredValidUntil.xml");
 
         final RequiredValidUntilFilter filter = (RequiredValidUntilFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getMaxValidityInterval(), Duration.ofDays(14));
     }
     
@@ -44,6 +45,7 @@ public class RequiredValidUntilParserTest extends AbstractMetadataParserTest {
         MetadataResolver resolver = getBean(MetadataResolver.class, "filter/requiredValidUntilParam.xml");
 
         final RequiredValidUntilFilter filter = (RequiredValidUntilFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getMaxValidityInterval(), Duration.ofDays(2));
     }
 
@@ -51,6 +53,7 @@ public class RequiredValidUntilParserTest extends AbstractMetadataParserTest {
         MetadataResolver resolver = getBean(MetadataResolver.class, "filter/requiredValidUntilParamNonDuration.xml");
 
         final RequiredValidUntilFilter filter = (RequiredValidUntilFilter) resolver.getMetadataFilter();
+        assert filter != null;
         Assert.assertEquals(filter.getMaxValidityInterval(), Duration.ofMillis(2));
     }
 }
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/SchemaValidationParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/SchemaValidationParserTest.java
index c68b3aa3..bfe369cf 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/SchemaValidationParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/metadata/filter/SchemaValidationParserTest.java
@@ -20,6 +20,7 @@ package net.shibboleth.spring.metadata.filter;
 import java.io.IOException;
 
 import org.opensaml.saml.metadata.resolver.MetadataResolver;
+import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
 import org.opensaml.saml.metadata.resolver.filter.impl.SchemaValidationFilter;
 import org.testng.Assert;
 import org.testng.annotations.Test;
@@ -33,14 +34,18 @@ import net.shibboleth.spring.metadata.AbstractMetadataParserTest;
 public class SchemaValidationParserTest extends AbstractMetadataParserTest {
 
     @Test public void validUntil() throws IOException {
-        MetadataResolver resolver = getBean(MetadataResolver.class, "filter/schemaValidation.xml", "beans.xml");
-
-        Assert.assertEquals(resolver.getMetadataFilter().getClass(), SchemaValidationFilter.class); 
+        final MetadataResolver resolver = getBean(MetadataResolver.class, "filter/schemaValidation.xml", "beans.xml");
+        final MetadataFilter filter = resolver.getMetadataFilter();
+        Assert.assertNotNull(filter);
+        assert filter != null;
+        Assert.assertEquals(filter.getClass(), SchemaValidationFilter.class); 
     }
     
     @Test public void bean() throws IOException {
-        MetadataResolver resolver = getBean(MetadataResolver.class, "filter/schemaValidationRefs.xml", "filter/schemaValidationRefs-beans.xml");
-
-        Assert.assertEquals(resolver.getMetadataFilter().getClass(), SchemaValidationFilter.class); 
+        final MetadataResolver resolver = getBean(MetadataResolver.class, "filter/schemaValidationRefs.xml", "filter/schemaValidationRefs-beans.xml");
+        final MetadataFilter filter = resolver.getMetadataFilter();
+        Assert.assertNotNull(filter);
+        assert filter != null;
+        Assert.assertEquals(filter.getClass(), SchemaValidationFilter.class); 
     }
 }
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicInlineParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicInlineParserTest.java
index 725fe742..42ec1949 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicInlineParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicInlineParserTest.java
@@ -55,16 +55,18 @@ public class BasicInlineParserTest extends AbstractSecurityParserTest {
     @Test public void secretBase64() throws IOException {
         final BasicCredential credential =
                 (BasicCredential) getBean(Credential.class, "credential/secretKeyAESBase64.xml");
-        Assert.assertNotNull(credential.getSecretKey());
-        SecretKey key = credential.getSecretKey();
+        final SecretKey key = credential.getSecretKey();
+        Assert.assertNotNull(key);
+        assert key != null;
         Assert.assertEquals(key.getAlgorithm(), "AES");
     }
     
     @Test public void secretHex() throws IOException {
         final BasicCredential credential =
                 (BasicCredential) getBean(Credential.class, "credential/secretKeyAESHex.xml");
-        Assert.assertNotNull(credential.getSecretKey());
-        SecretKey key = credential.getSecretKey();
+        final SecretKey key = credential.getSecretKey();
+        Assert.assertNotNull(key);
+        assert key != null;
         Assert.assertEquals(key.getAlgorithm(), "AES");
     }
     
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicResourceParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicResourceParserTest.java
index d483c32f..7f256d1e 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicResourceParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/BasicResourceParserTest.java
@@ -56,24 +56,27 @@ public class BasicResourceParserTest extends AbstractSecurityParserTest {
     @Test public void secretBase64() throws IOException {
         final BasicCredential credential =
                 (BasicCredential) getBean(Credential.class, "credential/resourceSecretAESBase64.xml");
-        Assert.assertNotNull(credential.getSecretKey());
-        SecretKey key = credential.getSecretKey();
+        final SecretKey key = credential.getSecretKey();
+        Assert.assertNotNull(key);
+        assert key != null;
         Assert.assertEquals(key.getAlgorithm(), "AES");
     }
     
     @Test public void secretHex() throws IOException {
         final BasicCredential credential =
                 (BasicCredential) getBean(Credential.class, "credential/resourceSecretAESHex.xml");
-        Assert.assertNotNull(credential.getSecretKey());
-        SecretKey key = credential.getSecretKey();
+        final SecretKey key = credential.getSecretKey();
+        Assert.assertNotNull(key);
+        assert key != null;
         Assert.assertEquals(key.getAlgorithm(), "AES");
     }
     
     @Test public void secretBinary() throws IOException {
         final BasicCredential credential =
                 (BasicCredential) getBean(Credential.class, "credential/resourceSecretAESBinary.xml");
-        Assert.assertNotNull(credential.getSecretKey());
-        SecretKey key = credential.getSecretKey();
+        final SecretKey key = credential.getSecretKey();
+        Assert.assertNotNull(key);
+        assert key != null;
         Assert.assertEquals(key.getAlgorithm(), "AES");
     }
     
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509FilesystemParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509FilesystemParserTest.java
index 9c54bc64..2ab34182 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509FilesystemParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509FilesystemParserTest.java
@@ -18,7 +18,9 @@
 package net.shibboleth.spring.security.credential;
 
 import java.io.IOException;
+import java.security.cert.X509CRL;
 import java.time.Instant;
+import java.util.Collection;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.UsageType;
@@ -64,8 +66,11 @@ public class X509FilesystemParserTest extends AbstractSecurityParserTest {
                 Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
         Assert.assertEquals(credential.getEntityCertificateChain().size(), 3);
         Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-        Assert.assertEquals(credential.getCRLs().size(), 1);
-        Assert.assertEquals(credential.getCRLs().iterator().next().getNextUpdate().getTime(),
+        
+        final Collection<X509CRL> crls = credential.getCRLs();
+        assert crls != null;
+        Assert.assertEquals(crls.size(), 1);
+        Assert.assertEquals(crls.iterator().next().getNextUpdate().getTime(),
                 Instant.parse("2007-09-02T14:14:48Z").toEpochMilli());
     }
 
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509InlineParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509InlineParserTest.java
index e830f43f..1592f4d7 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509InlineParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/credential/X509InlineParserTest.java
@@ -18,7 +18,9 @@
 package net.shibboleth.spring.security.credential;
 
 import java.io.IOException;
+import java.security.cert.X509CRL;
 import java.time.Instant;
+import java.util.Collection;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.BasicX509Credential;
@@ -55,8 +57,11 @@ public class X509InlineParserTest extends AbstractSecurityParserTest {
         Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
         Assert.assertEquals(credential.getEntityCertificateChain().size(), 3);
         Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
-        Assert.assertEquals(credential.getCRLs().size(), 1);
-        Assert.assertEquals(credential.getCRLs().iterator().next().getNextUpdate().getTime(), Instant.parse("2007-09-02T14:14:48Z").toEpochMilli());
+        
+        final Collection<X509CRL> crls = credential.getCRLs();
+        assert crls != null;
+        Assert.assertEquals(crls.size(), 1);
+        Assert.assertEquals(crls.iterator().next().getNextUpdate().getTime(), Instant.parse("2007-09-02T14:14:48Z").toEpochMilli());
     }
     
 }
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java
index b85a0ce6..5846d7c3 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/ChainingTrustEngineTest.java
@@ -35,16 +35,21 @@ public class ChainingTrustEngineTest extends AbstractSecurityParserTest {
 
     
     @Test public void one() throws IOException, SecurityException {
-        final ChainingTrustEngine<?> engine = lookup("chainingTrue.xml");
+        final ChainingTrustEngine<Object> engine = (ChainingTrustEngine<Object>) lookup("chainingTrue.xml");
+        
+        final Object token = new Object();
         
         Assert.assertEquals(engine.getChain().size(), 1);
-        Assert.assertTrue(engine.validate(null, null));
+        Assert.assertTrue(engine.validate(token, null));
     }
 
     @Test public void two() throws IOException, SecurityException {
-        final ChainingTrustEngine<?> engine = lookup("chainingTrueFalse.xml");
+        final ChainingTrustEngine<Object> engine = (ChainingTrustEngine<Object>) lookup("chainingTrueFalse.xml");
+        
+        final Object token = new Object();
         
         Assert.assertEquals(engine.getChain().size(), 2);
-        Assert.assertTrue(engine.validate(null, null));
+        Assert.assertTrue(engine.validate(token, null));
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/MockTrustEngine.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/MockTrustEngine.java
index 9d03aaa6..d306b398 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/MockTrustEngine.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/MockTrustEngine.java
@@ -17,12 +17,19 @@
 
 package net.shibboleth.spring.security.trust;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.trust.TrustEngine;
 
 import net.shibboleth.shared.resolver.CriteriaSet;
 
- at SuppressWarnings("javadoc")
+/**
+ * Mock trust engine.
+ *
+ * @param <T> token type
+ */
 public class MockTrustEngine<T> implements TrustEngine<T> {
 
     private final boolean result;
@@ -37,8 +44,9 @@ public class MockTrustEngine<T> implements TrustEngine<T> {
     }
     
     /** {@inheritDoc} */
-    @Override public boolean validate(T token, CriteriaSet trustBasisCriteria) throws SecurityException {
+    public boolean validate(@Nonnull T token, @Nullable CriteriaSet trustBasisCriteria)
+            throws SecurityException {
         return result;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXFilesystemParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXFilesystemParserTest.java
index 10ad8471..c1cdeaa5 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXFilesystemParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXFilesystemParserTest.java
@@ -18,6 +18,9 @@
 package net.shibboleth.spring.security.trust;
 
 import java.io.IOException;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import java.util.Collection;
 
 import org.opensaml.security.x509.PKIXValidationInformation;
 import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
@@ -38,15 +41,32 @@ public class PKIXFilesystemParserTest extends AbstractSecurityParserTest {
 
     @Test public void simple() throws IOException {
         final BasicPKIXValidationInformation info = lookup("resourceValidationInfo.xml");
+        assert info != null;
+        
         Assert.assertNull(info.getVerificationDepth());
-        Assert.assertTrue(info.getCertificates().isEmpty());
-        Assert.assertTrue(info.getCRLs().isEmpty());
+        
+        final Collection<X509Certificate> certs = info.getCertificates();
+        assert certs != null;
+        Assert.assertTrue(certs.isEmpty());
+        
+        final Collection<X509CRL> crls = info.getCRLs();
+        assert crls != null;
+        Assert.assertTrue(crls.isEmpty());
     }
     
     @Test public void complex() throws IOException {
         final BasicPKIXValidationInformation info = lookup("resourceValidationInfoValues.xml");
-        Assert.assertEquals(info.getVerificationDepth().intValue(), 99);
-        Assert.assertEquals(info.getCertificates().size(), 2);
-        Assert.assertEquals(info.getCRLs().size(), 1);
+        assert info != null;
+        
+        Assert.assertEquals(info.getVerificationDepth(), 99);
+
+        final Collection<X509Certificate> certs = info.getCertificates();
+        assert certs != null;
+        Assert.assertEquals(certs.size(), 2);
+        
+        final Collection<X509CRL> crls = info.getCRLs();
+        assert crls != null;
+        Assert.assertEquals(crls.size(), 1);
     }
-}
+    
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXInlineParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXInlineParserTest.java
index 8fb6d60d..8a742b6f 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXInlineParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/PKIXInlineParserTest.java
@@ -18,6 +18,9 @@
 package net.shibboleth.spring.security.trust;
 
 import java.io.IOException;
+import java.security.cert.X509CRL;
+import java.security.cert.X509Certificate;
+import java.util.Collection;
 
 import org.opensaml.security.x509.PKIXValidationInformation;
 import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
@@ -38,16 +41,32 @@ public class PKIXInlineParserTest extends AbstractSecurityParserTest {
 
     @Test public void simple() throws IOException {
         final BasicPKIXValidationInformation info = lookup("inlineValidationInfo.xml");
+        assert info != null;
+
         Assert.assertNull(info.getVerificationDepth());
-        Assert.assertTrue(info.getCertificates().isEmpty());
-        Assert.assertTrue(info.getCRLs().isEmpty());
+
+        final Collection<X509Certificate> certs = info.getCertificates();
+        assert certs != null;
+        Assert.assertTrue(certs.isEmpty());
+        
+        final Collection<X509CRL> crls = info.getCRLs();
+        assert crls != null;
+        Assert.assertTrue(crls.isEmpty());
     }
 
     @Test(enabled=true) public void complex() throws IOException {
         final BasicPKIXValidationInformation info = lookup("inlineValidationInfoValues.xml");
-        Assert.assertEquals(info.getVerificationDepth().intValue(), 98);
-        Assert.assertEquals(info.getCertificates().size(), 2);
-        Assert.assertEquals(info.getCRLs().size(), 1);
+        assert info != null;
+
+        Assert.assertEquals(info.getVerificationDepth(), 98);
+
+        final Collection<X509Certificate> certs = info.getCertificates();
+        assert certs != null;
+        Assert.assertEquals(certs.size(), 2);
+        
+        final Collection<X509CRL> crls = info.getCRLs();
+        assert crls != null;
+        Assert.assertEquals(crls.size(), 1);
     }
 
 }
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/SignatureChainingParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/SignatureChainingParserTest.java
index 061dd9ff..05cb7a74 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/SignatureChainingParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/SignatureChainingParserTest.java
@@ -45,7 +45,8 @@ public class SignatureChainingParserTest extends AbstractSecurityParserTest {
         
         final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
         
-        BasicX509Credential credential  = (BasicX509Credential) resolver.resolveSingle(null);
+        final BasicX509Credential credential  = (BasicX509Credential) resolver.resolveSingle(null);
+        assert credential != null;
         
         Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
         Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
@@ -53,4 +54,5 @@ public class SignatureChainingParserTest extends AbstractSecurityParserTest {
         Assert.assertEquals(credential.getEntityCertificate().getNotAfter().getTime(), Instant.parse("2024-04-08T13:39:18Z").toEpochMilli());
         
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParserTest.java
index fce25940..fc2033b2 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeyParserTest.java
@@ -41,7 +41,8 @@ public class StaticExplicitKeyParserTest extends AbstractSecurityParserTest {
         
         final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
         
-        BasicX509Credential credential  = (BasicX509Credential) resolver.resolveSingle(null);
+        final BasicX509Credential credential  = (BasicX509Credential) resolver.resolveSingle(null);
+        assert credential != null;
         
         Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
         Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
diff --git a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParserTest.java b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParserTest.java
index 5e6d0f15..5b6e5aa8 100644
--- a/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParserTest.java
+++ b/shib-metadata-spring/src/test/java/net/shibboleth/spring/security/trust/StaticExplicitKeySignatureParserTest.java
@@ -41,7 +41,8 @@ public class StaticExplicitKeySignatureParserTest extends AbstractSecurityParser
         
         final StaticCredentialResolver resolver = (StaticCredentialResolver) engine.getCredentialResolver();
         
-        BasicX509Credential credential  = (BasicX509Credential) resolver.resolveSingle(null);
+        final BasicX509Credential credential  = (BasicX509Credential) resolver.resolveSingle(null);
+        assert credential != null;
         
         Assert.assertEquals(credential.getEntityCertificateChain().size(), 1);
         Assert.assertTrue(credential.getEntityCertificateChain().contains(credential.getEntityCertificate()));
diff --git a/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java b/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java
index c4c047e2..29bc76c1 100644
--- a/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java
+++ b/shib-metadata-testing/src/main/java/net/shibboleth/spring/testing/AbstractFailFastTest.java
@@ -25,6 +25,8 @@ import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
 import org.slf4j.LoggerFactory;
 import org.springframework.context.ApplicationContext;
@@ -36,7 +38,8 @@ import org.testng.annotations.AfterSuite;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeSuite;
 
-import net.shibboleth.shared.collection.Pair;
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.service.ReloadableService;
 import net.shibboleth.shared.spring.util.ApplicationContextBuilder;
 import net.shibboleth.shared.spring.util.SpringSupport;
@@ -64,7 +67,7 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
     /** Our test path.
      * @return the path
      */
-    protected String getPath() {
+    @Nonnull protected String getPath() {
         return "/net/shibboleth/spring/failfast/";
     }
 
@@ -92,7 +95,6 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
     }
 
     /** tear down all the {@link GenericApplicationContext} we have used. */
-    @SuppressWarnings("resource")
     @AfterSuite public void afterSuite() {
         final Iterator<GenericApplicationContext> contextIterator = contexts.iterator(); 
         while (contextIterator.hasNext()) {
@@ -111,8 +113,8 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @return a {@link GenericApplicationContext}
      * @throws IOException as required.
      */
-    protected ApplicationContext getApplicationContext(final String contextName, final MockPropertySource propSource, final String... files)
-            throws IOException {
+    @Nonnull protected ApplicationContext getApplicationContext(final String contextName,
+            final MockPropertySource propSource, final String... files) throws IOException {
         final Resource[] resources = new Resource[files.length];
 
         for (int i = 0; i < files.length; i++) {
@@ -134,7 +136,9 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
         return context;
     }
 
-    /** Conjur up, and remember a {@link GenericApplicationContext}.
+    /**
+     * Conjure up, and remember a {@link GenericApplicationContext}.
+     * 
      * @param contextName what to call it
      * @param files all the files to read
      * @return a {@link GenericApplicationContext} 
@@ -195,8 +199,8 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @param value the property value
      * @return the {@link MockPropertySource}
      */
-    protected MockPropertySource propertySource(final String name, final String value) {
-        MockPropertySource propSource = new MockPropertySource("localProperties");
+    @Nonnull protected MockPropertySource propertySource(@Nonnull final String name, @Nonnull final String value) {
+        final MockPropertySource propSource = new MockPropertySource("localProperties");
         propSource.setProperty(name, value);
         return propSource;
     }
@@ -205,14 +209,52 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
      * @param values the properties (name,value) to set.
      * @return the {@link MockPropertySource}
      */
-    protected MockPropertySource propertySource(final Collection<Pair<String,String>> values) {
-        MockPropertySource propSource = new MockPropertySource("localProperties");
-        for (final Pair<String, String> value: values) {
-            propSource.setProperty(value.getFirst(), value.getSecond());
+    @Nonnull protected MockPropertySource propertySource(@Nonnull @NonnullElements final Collection<MockProperty> values) {
+        final MockPropertySource propSource = new MockPropertySource("localProperties");
+        for (final MockProperty property : values) {
+            propSource.setProperty(property.name(), property.value());
         }
         return propSource;
     }
+    
+    /**
+     * A record wrapper for a mock property.
+     * 
+     * @param name property name 
+     * @param value property value
+     */
+    public record MockProperty(@Nonnull String name, @Nonnull String value) {
+        
+        /**
+         * Constructor.
+         *
+         * @param name property name
+         * @param value property value
+         */
+        public MockProperty(@Nonnull String name, @Nonnull String value) {
+            this.name = Constraint.isNotNull(name, "Name cannot be null");
+            this.value = Constraint.isNotNull(value, "Value cannot be null");
+        }
+        
+        /**
+         * Get name.
+         * 
+         * @return name
+         */
+        @Nonnull public String name() {
+            return name;
+        }
 
+        /**
+         * Get value.
+         * 
+         * @return value
+         */
+        @Nonnull public String value() {
+            return value;
+        }
+    };
+    
     /** Return the name of the file in the working dir with this name.
      * @param filePart the file name
      * @return the Fully Qualified Path
@@ -229,4 +271,4 @@ public class AbstractFailFastTest extends OpenSAMLInitBaseTestCase {
         return getWorkspaceDirName()  +  filePart;
     }
 
-}
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list