[java-identity-provider] 02/02: IDP-2069 - Null Handling Task

Rod Widdowson rdw at steadingsoftware.com
Tue Apr 11 14:00:46 UTC 2023


This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4ad2a5a0be4b77116c7f52fcb45a5b597f8f9ef1

commit 4ad2a5a0be4b77116c7f52fcb45a5b597f8f9ef1
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Apr 11 14:53:29 2023 +0100

    IDP-2069 - Null Handling Task
    
    https://shibboleth.atlassian.net/browse/IDP-2069
    
    idp-saml-impl
     - Continue adding and exploiting the @NonnullBeforeExec annotations
     - Remove all warnings (yellow)
---
 .../impl/EncryptionAlgorithmAuditExtractor.java    |  4 ++-
 .../idp/saml/audit/impl/WriteFTICKSLog.java        | 15 ++++++----
 .../principal/impl/NameIDPrincipalSerializer.java  |  2 --
 .../InitializeRelyingPartyContextFromSAMLPeer.java |  9 ++++--
 ...tributeSourcedSAML1NameIdentifierGenerator.java |  4 ++-
 .../impl/AttributeSourcedSAML2NameIDGenerator.java |  4 ++-
 .../nameid/impl/BaseCryptoTransientDecoder.java    |  1 +
 .../impl/PersistentSAML2NameIDGenerator.java       |  4 ++-
 .../impl/StoredTransientIdGenerationStrategy.java  |  4 ++-
 .../impl/BaseAddAttributeStatementToAssertion.java | 23 ++++++++------
 .../profile/impl/ExtractSubjectFromRequest.java    |  5 ++--
 .../impl/FinalizeSAMLSubjectCanonicalization.java  | 12 ++++----
 .../saml/profile/impl/IdPInitiatedSSORequest.java  |  4 ++-
 .../impl/InitializeAuthenticationContext.java      |  4 ++-
 .../impl/InitializeOutboundMessageContext.java     | 12 ++++----
 .../InitializeOutboundMessageContextForError.java  |  4 ++-
 .../InitializeRelyingPartyContextFromSAMLPeer.java | 17 ++++++-----
 .../impl/PopulateBindingAndEndpointContexts.java   | 35 +++++++++++++---------
 .../idp/saml/profile/impl/ReloadMetadata.java      |  3 +-
 .../impl/FilterByQueriedAttributeDesignators.java  | 23 +++++++-------
 .../impl/SingleLogoutProfileConfiguration.java     |  4 ++-
 .../saml/saml2/profile/impl/AddAuthnRequest.java   |  9 ++++--
 .../profile/impl/EnforceDisallowedSSOFeatures.java | 16 +++++-----
 .../profile/impl/FilterByQueriedAttributes.java    | 31 ++++++++++---------
 ...estedAttributesInAttributeConsumingService.java | 22 +++++++-------
 .../profile/impl/PopulateEncryptionParameters.java |  8 +++--
 .../profile/impl/PreProcessLogoutMessage.java      |  9 ++++--
 .../impl/ProcessAssertionsForAuthentication.java   | 17 +++++++----
 .../saml2/profile/impl/ProcessLogoutRequest.java   | 29 ++++++++++--------
 .../profile/impl/ProcessRequestedAuthnContext.java |  5 +++-
 .../saml2/profile/impl/SAMLAuthnController.java    | 14 ++++++---
 .../saml/saml2/profile/impl/SOAPLogoutRequest.java | 34 +++++++++++----------
 .../session/impl/PrepareInboundMessageContext.java |  3 +-
 .../impl/SAML1SPSessionCreationStrategy.java       |  4 ++-
 .../impl/SAML2SPSessionCreationStrategy.java       | 12 +++++---
 .../session/impl/SAML2SPSessionSerializer.java     |  4 ++-
 .../impl/CryptoTransientNameIDDecoderTest.java     |  2 +-
 .../CryptoTransientNameIdentifierDecoderTest.java  |  2 +-
 ...oTransientSAML1NameIdentifierGeneratorTest.java |  2 +-
 .../CryptoTransientSAML2NameIDGeneratorTest.java   |  2 +-
 .../nameid/impl/NameIDCanonicalizationTest.java    |  2 +-
 .../impl/PersistentSAML2NameIDGeneratorTest.java   | 31 ++++++++++---------
 .../nameid/impl/StoredPersistentIdDecoderTest.java |  2 +-
 ...dTransientSAML1NameIdentifierGeneratorTest.java |  2 +-
 .../StoredTransientSAML2NameIDGeneratorTest.java   |  2 +-
 .../saml/nameid/impl/TransformingDecoderTest.java  |  2 +-
 .../idp/saml/nameid/impl/TransientDecoderTest.java |  2 +-
 .../impl/AbstractSAMLProfileConfigurationTest.java |  2 --
 .../PopulateBindingAndEndpointContextsTest.java    |  1 +
 .../impl/BrowserSSOProfileConfigurationTest.java   |  2 +-
 .../impl/AddAttributeStatementToAssertionTest.java |  9 +++---
 .../FilterByQueriedAttributeDesignatorsTest.java   |  8 +++--
 .../IdPInitiatedSSORequestMessageDecoderTest.java  |  1 +
 .../impl/BrowserSSOProfileConfigurationTest.java   | 16 +++++-----
 .../config/impl/SSOSProfileConfigurationTest.java  |  4 +--
 .../tests/ProxyRestrictionLookupFunctionTest.java  |  1 +
 .../saml2/profile/impl/AddAuthnRequestTest.java    |  2 ++
 .../ProcessAssertionsForAuthenticationTest.java    |  4 +--
 .../profile/impl/ProcessLogoutRequestTest.java     |  2 +-
 .../profile/impl/SessionManagerBaseTestCase.java   |  2 +-
 .../impl/PrepareInboundMessageContextTest.java     | 19 ++++++------
 .../session/impl/SAML2SPSessionSerializerTest.java |  2 +-
 62 files changed, 310 insertions(+), 226 deletions(-)

diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java
index b952abfd6..63096ec58 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/EncryptionAlgorithmAuditExtractor.java
@@ -38,9 +38,11 @@ public class EncryptionAlgorithmAuditExtractor implements Function<ProfileReques
     
     /** Constructor. */
     public EncryptionAlgorithmAuditExtractor() {
-        encryptionContextLookupStrategy =
+        final Function<ProfileRequestContext,EncryptionContext> ecls = 
                 new ChildContextLookup<>(EncryptionContext.class).compose(
                         new ChildContextLookup<>(RelyingPartyContext.class));
+        assert ecls != null;
+        encryptionContextLookupStrategy = ecls;
     }
 
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
index 71dfdd7ba..e67543019 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
@@ -83,12 +83,17 @@ public class WriteFTICKSLog extends AbstractProfileAction {
     public WriteFTICKSLog() {
         relyingPartyLookupStrategy = new RelyingPartyIdLookupFunction();
         responderLookupStrategy = new IssuerLookupFunction();
-        usernameLookupStrategy = new SubjectContextPrincipalLookupFunction().compose(
+        final Function<ProfileRequestContext,String>  unls = new SubjectContextPrincipalLookupFunction().compose(
                 new ChildContextLookup<>(SubjectContext.class));
-        authenticationMethodLookupStrategy = new AuthnContextAuditExtractor(
-                new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup()));
-        statusCodeLookupStrategy = new StatusCodeAuditExtractor(
-                new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup()));
+        assert unls != null;
+        usernameLookupStrategy = unls;
+        
+        Function<ProfileRequestContext, SAMLObject> para = new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup());
+        assert para != null;
+        authenticationMethodLookupStrategy = new AuthnContextAuditExtractor(para);
+        para = new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup());
+        assert para != null;
+        statusCodeLookupStrategy = new StatusCodeAuditExtractor(para);
     }
     
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
index 62f215058..d5f0de236 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
@@ -26,8 +26,6 @@ import java.util.regex.Pattern;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.annotation.concurrent.ThreadSafe;
-import javax.json.Json;
-import javax.json.JsonBuilderFactory;
 import javax.json.JsonException;
 import javax.json.JsonObject;
 import javax.json.JsonReader;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/InitializeRelyingPartyContextFromSAMLPeer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/InitializeRelyingPartyContextFromSAMLPeer.java
index 00f7c78f9..5ff2e6e6b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/InitializeRelyingPartyContextFromSAMLPeer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/InitializeRelyingPartyContextFromSAMLPeer.java
@@ -68,12 +68,17 @@ public class InitializeRelyingPartyContextFromSAMLPeer extends AbstractMessageHa
     
     /** Constructor. */
     public InitializeRelyingPartyContextFromSAMLPeer() {
-        relyingPartyContextCreationStrategy =
+        final Function<MessageContext,RelyingPartyContext> rpccs =
                 new ChildContextLookup<>(RelyingPartyContext.class, true).compose(
                         new RecursiveTypedParentContextLookup<>(InOutOperationContext.class));
-        peerEntityContextLookupStrategy =
+        assert rpccs != null;
+        relyingPartyContextCreationStrategy = rpccs;
+        final Function<MessageContext,SAMLPeerEntityContext> pecls = 
                 new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(
                         new RecursiveTypedParentContextLookup<>(InOutOperationContext.class));
+        assert pecls != null;
+        peerEntityContextLookupStrategy = pecls;
+                
     }
 
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java
index 3dc840adc..c1ff9f741 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java
@@ -74,9 +74,11 @@ public class AttributeSourcedSAML1NameIdentifierGenerator extends AbstractSAML1N
 
     /** Constructor. */
     public AttributeSourcedSAML1NameIdentifierGenerator() {
-        attributeContextLookupStrategy =
+        final Function<ProfileRequestContext,AttributeContext> acls = 
                 new ChildContextLookup<>(AttributeContext.class).compose(
                         new ChildContextLookup<>(RelyingPartyContext.class));
+        assert acls != null;
+        attributeContextLookupStrategy = acls;
         delimiter = '@';
         attributeSourceIds = CollectionSupport.emptyList();
         setDefaultIdPNameQualifierLookupStrategy(new IssuerLookupFunction());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java
index 8ed792b67..ee0300dbb 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java
@@ -73,9 +73,11 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
 
     /** Constructor. */
     public AttributeSourcedSAML2NameIDGenerator() {
-        attributeContextLookupStrategy =
+        final Function<ProfileRequestContext, AttributeContext> acls =
                 new ChildContextLookup<>(AttributeContext.class).compose(
                         new ChildContextLookup<>(RelyingPartyContext.class));
+        assert acls != null;
+        attributeContextLookupStrategy = acls;
         delimiter = '@';
         attributeSourceIds = CollectionSupport.emptyList();
         setDefaultIdPNameQualifierLookupStrategy(new IssuerLookupFunction());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
index 618166279..5abff7e5a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
@@ -132,6 +132,7 @@ public abstract class BaseCryptoTransientDecoder extends AbstractIdentifiableIni
         if (null == prefix) {
             final StringBuilder builder = new StringBuilder("Crypto Transient Decoder '").append(getId()).append("':");
             prefix = builder.toString();
+            assert prefix != null;
             if (null == logPrefix) {
                 logPrefix = prefix;
             }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java
index 2fef52cc7..8e1b2b94f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java
@@ -86,9 +86,11 @@ public class PersistentSAML2NameIDGenerator extends AbstractSAML2NameIDGenerator
     public PersistentSAML2NameIDGenerator() {
         setFormat(NameID.PERSISTENT);
         subjectContextLookupStrategy = new ChildContextLookup<>(SubjectContext.class);
-        attributeContextLookupStrategy =
+        final Function<ProfileRequestContext, AttributeContext> acls =
                 new ChildContextLookup<>(AttributeContext.class).compose(
                         new ChildContextLookup<>(RelyingPartyContext.class));
+        assert acls != null;
+        attributeContextLookupStrategy = acls;
         attributeSourceIds = CollectionSupport.emptyList();
         setDefaultIdPNameQualifierLookupStrategy(new IssuerLookupFunction());
         setDefaultSPNameQualifierLookupStrategy(new RelyingPartyIdLookupFunction());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientIdGenerationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientIdGenerationStrategy.java
index 28117476b..7019ca180 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientIdGenerationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientIdGenerationStrategy.java
@@ -67,7 +67,9 @@ public class StoredTransientIdGenerationStrategy extends AbstractIdentifiableIni
     /** Constructor. */
     public StoredTransientIdGenerationStrategy() {
         idSize = 16;
-        idLifetime = Duration.ofHours(4);
+        final Duration fourHours = Duration.ofHours(4);
+        assert fourHours!=null;
+        idLifetime = fourHours;
     }
 
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java
index ab0c28db1..2d492d75e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java
@@ -21,7 +21,6 @@ import java.util.Collection;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
@@ -29,7 +28,6 @@ import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.common.SAMLObject;
 import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
 
 import net.shibboleth.idp.attribute.AttributeEncodingException;
 import net.shibboleth.idp.attribute.IdPAttribute;
@@ -44,10 +42,12 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.security.IdentifierGenerationStrategy;
 import net.shibboleth.shared.service.ReloadableService;
 
@@ -94,21 +94,22 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
     @NonnullAfterInit private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
     
     /** AttributeContext to use. */
-    @Nullable private AttributeContext attributeCtx;
+    @NonnullBeforeExec private AttributeContext attributeCtx;
 
     /** The generator to use. */
-    @Nullable private IdentifierGenerationStrategy idGenerator;
+    @NonnullBeforeExec private IdentifierGenerationStrategy idGenerator;
 
     /** EntityID to populate as assertion issuer. */
-    @Nullable private String issuerId;
+    @NonnullBeforeExec @NotEmpty private String issuerId;
     
     /** Constructor. */
     public BaseAddAttributeStatementToAssertion() {
         statementInOwnAssertion = false;
         ignoringUnencodableAttributes = true;
-
-        attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
+        final Function<ProfileRequestContext,AttributeContext> acls = new ChildContextLookup<>(AttributeContext.class).compose(
                 new ChildContextLookup<>(RelyingPartyContext.class));
+        assert acls !=null;
+        attributeContextLookupStrategy = acls; 
         idGeneratorLookupStrategy = new IdentifierGenerationStrategyLookupFunction();
         issuerLookupStrategy = new IssuerLookupFunction();
     }
@@ -222,6 +223,7 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
      * @return the context to encode
      */
     @Nonnull public AttributeContext getAttributeContext() {
+        assert isPreExecuteCalled();
         return Constraint.isNotNull(attributeCtx, "AttributeContext has not been initialized yet");
     }
 
@@ -231,6 +233,7 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
      * @return the ID generation strategy
      */
     @Nonnull public IdentifierGenerationStrategy getIdGenerator() {
+        assert isPreExecuteCalled();
         return Constraint.isNotNull(idGenerator, "IdentifierGenerationStrategy has not been initialized yet");
     }
 
@@ -239,8 +242,10 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
      *
      * @return the issuer name
      */
+    @SuppressWarnings("null")
     @Nonnull @NotEmpty public String getIssuerId() {
-        return Constraint.isNotNull(issuerId, "Issuer name has not been initialized yet");
+        assert isPreExecuteCalled();
+        return issuerId;
     }
 
     /** {@inheritDoc} */
@@ -270,7 +275,7 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
         }
         
         issuerId = issuerLookupStrategy.apply(profileRequestContext);
-        if (issuerId == null) {
+        if (issuerId == null || issuerId.isEmpty()) {
             log.debug("{} No assertion issuer value", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
             return false;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
index ba39d452f..b471a1f47 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
@@ -42,6 +42,7 @@ import net.shibboleth.idp.saml.authn.principal.NameIDPrincipal;
 import net.shibboleth.idp.saml.authn.principal.NameIdentifierPrincipal;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 
@@ -83,7 +84,7 @@ public class ExtractSubjectFromRequest extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,String> responderLookupStrategy;
     
     /** SAML 1 or 2 identifier object to wrap for c14n. */
-    @Nullable private SAMLObject nameIdentifier;
+    @NonnullBeforeExec private SAMLObject nameIdentifier;
     
     /** Constructor.
      * 
@@ -178,8 +179,6 @@ public class ExtractSubjectFromRequest extends AbstractProfileAction {
             return;
         }
         
-        
-        
         final SubjectCanonicalizationContext c14n = new SubjectCanonicalizationContext();
         c14n.setSubject(subject);
         if (requesterLookupStrategy != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/FinalizeSAMLSubjectCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/FinalizeSAMLSubjectCanonicalization.java
index 71c2278b1..bd88f4e27 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/FinalizeSAMLSubjectCanonicalization.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/FinalizeSAMLSubjectCanonicalization.java
@@ -18,16 +18,16 @@
 package net.shibboleth.idp.saml.profile.impl;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
 
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -49,7 +49,7 @@ public class FinalizeSAMLSubjectCanonicalization extends AbstractProfileAction {
     @Nonnull private final Logger log = LoggerFactory.getLogger(FinalizeSAMLSubjectCanonicalization.class);
     
     /** The principal name extracted from the context tree. */
-    @Nullable private String canonicalPrincipalName;
+    @NonnullBeforeExec private String canonicalPrincipalName;
     
     /** {@inheritDoc} */
     @Override
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/IdPInitiatedSSORequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/IdPInitiatedSSORequest.java
index becff7415..8a5d1f70c 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/IdPInitiatedSSORequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/IdPInitiatedSSORequest.java
@@ -79,7 +79,9 @@ public class IdPInitiatedSSORequest {
         if (newTime != null) {
             time = newTime;
         } else {
-            time = Instant.now();
+            final Instant now = Instant.now();
+            assert now != null;
+            time = now;
         }
     }
 
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
index 56a68f3e2..9e8996537 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
@@ -90,7 +90,9 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
         forceAuthnPredicate = new ForceAuthnProfileConfigPredicate();
         ignoreScopingPredicate = new IgnoreScopingProfileConfigPredicate();
         proxyCountLookupStrategy = new ProxyCountLookupFunction();
-        requestLookupStrategy = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AuthnRequest> rls = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        assert rls != null;
+        requestLookupStrategy = rls;
     }
     
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
index d6be5c915..d4e35eeef 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.profile.impl;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.BaseContext;
 import org.opensaml.messaging.context.MessageContext;
@@ -32,13 +31,14 @@ import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.common.messaging.context.SAMLSelfEntityContext;
 import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Action that adds an outbound {@link MessageContext} and related SAML contexts to the {@link ProfileRequestContext}
@@ -66,7 +66,7 @@ public class InitializeOutboundMessageContext extends AbstractProfileAction {
     @Nonnull private Function<ProfileRequestContext, String> selfIdentityLookupStrategy;
 
     /** The {@link SAMLPeerEntityContext} to base the outbound context on. */
-    @Nullable private SAMLPeerEntityContext peerEntityCtx;
+    @NonnullBeforeExec private SAMLPeerEntityContext peerEntityCtx;
 
     /** Constructor. */
     public InitializeOutboundMessageContext() {
@@ -132,11 +132,9 @@ public class InitializeOutboundMessageContext extends AbstractProfileAction {
         selfContext.setEntityId(selfIdentityLookupStrategy.apply(profileRequestContext));
 
         final SAMLPeerEntityContext peerContext = msgCtx.ensureSubcontext(SAMLPeerEntityContext.class);
-        final SAMLPeerEntityContext pec = peerEntityCtx;
-        assert pec!=null;
-        peerContext.setEntityId(pec.getEntityId());
+        peerContext.setEntityId(peerEntityCtx.getEntityId());
 
-        final SAMLMetadataContext inboundMetadataCtx = pec.getSubcontext(SAMLMetadataContext.class);
+        final SAMLMetadataContext inboundMetadataCtx = peerEntityCtx.getSubcontext(SAMLMetadataContext.class);
         if (inboundMetadataCtx != null) {
             final SAMLMetadataContext outboundMetadataCtx = peerContext.ensureSubcontext(SAMLMetadataContext.class);
             outboundMetadataCtx.setEntityDescriptor(inboundMetadataCtx.getEntityDescriptor());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java
index 3082e23b5..1215903e4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java
@@ -80,8 +80,10 @@ public class InitializeOutboundMessageContextForError extends AbstractProfileAct
     public InitializeOutboundMessageContextForError() {
         
         // Default: outbound msg context -> SAMLBindingContext
-        bindingContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLBindingContext> bcs = 
                 new ChildContextLookup<>(SAMLBindingContext.class, true).compose(new OutboundMessageContextLookup());
+        assert bcs != null;
+        bindingContextLookupStrategy = bcs;
         
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
     }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java
index a0e3356ef..d51591c2c 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.profile.impl;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
@@ -29,11 +28,13 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
 import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
+
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Action that adds a {@link RelyingPartyContext} to the current {@link ProfileRequestContext} tree
@@ -65,13 +66,15 @@ public class InitializeRelyingPartyContextFromSAMLPeer extends AbstractProfileAc
     @Nonnull private Function<ProfileRequestContext,SAMLPeerEntityContext> peerEntityContextLookupStrategy;
 
     /** SAML peer entity context to populate from. */
-    @Nullable private SAMLPeerEntityContext peerEntityCtx;
+    @NonnullBeforeExec private SAMLPeerEntityContext peerEntityCtx;
     
     /** Constructor. */
     public InitializeRelyingPartyContextFromSAMLPeer() {
         relyingPartyContextCreationStrategy = new ChildContextLookup<>(RelyingPartyContext.class, true);
-        peerEntityContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLPeerEntityContext> pecs =  
                 new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(new InboundMessageContextLookup());
+        assert pecs != null; 
+        peerEntityContextLookupStrategy = pecs;
     }
 
     /**
@@ -122,11 +125,9 @@ public class InitializeRelyingPartyContextFromSAMLPeer extends AbstractProfileAc
             ActionSupport.buildEvent(profileRequestContext, IdPEventIds.INVALID_RELYING_PARTY_CTX);
             return;
         }
-        SAMLPeerEntityContext pec = peerEntityCtx;
-        assert pec!=null;
 
-        log.debug("{} Attaching RelyingPartyContext based on SAML peer {}", getLogPrefix(), pec.getEntityId());
-        rpContext.setRelyingPartyIdContextTree(pec);
+        log.debug("{} Attaching RelyingPartyContext based on SAML peer {}", getLogPrefix(), peerEntityCtx.getEntityId());
+        rpContext.setRelyingPartyIdContextTree(peerEntityCtx);
         rpContext.setRelyingPartyIdLookupStrategy(RPID_LOOKUP);
         rpContext.setVerificationLookupStrategy(VERIFY_LOOKUP);
     }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
index ecb699e02..ef9fda6c8 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
@@ -61,6 +61,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.saml.profile.config.SAMLArtifactAwareProfileConfiguration;
 import net.shibboleth.saml.profile.config.SAMLArtifactConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -126,7 +127,7 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,BestMatchLocationCriterion> bestMatchCriterionLookupStrategy;
     
     /** List of possible bindings, in preference order. */
-    @Nullable @NonnullElements private List<BindingDescriptor> bindingDescriptors;
+    @NonnullBeforeExec @NonnullElements private List<BindingDescriptor> bindingDescriptors;
     
     /** Whether an artifact-based binding implies the use of a secure channel. */
     private boolean artifactImpliesSecureChannel;
@@ -159,25 +160,32 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
         
         // Default: outbound msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
-        metadataContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLMetadataContext> mcls =
                 new ChildContextLookup<>(SAMLMetadataContext.class).compose(
                         new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(
                                 new OutboundMessageContextLookup()));
-        
+        assert mcls != null;
+        metadataContextLookupStrategy = mcls;
+
         // Default: outbound msg context -> SAMLBindingContext
-        bindingContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLBindingContext> bcs =
                 new ChildContextLookup<>(SAMLBindingContext.class, true).compose(new OutboundMessageContextLookup());
+        assert bcs != null;
+        bindingContextLookupStrategy = bcs;
 
         // Default: outbound msg context -> SAMLArtifactContext
-        artifactContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLArtifactContext> acs =
                 new ChildContextLookup<>(SAMLArtifactContext.class, true).compose(new OutboundMessageContextLookup());
+        assert acs != null;
+        artifactContextLookupStrategy = acs;
         
         // Default: outbound msg context -> SAMLPeerEntityContext -> SAMLEndpointContext
-        endpointContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLEndpointContext> ecls = 
                 new ChildContextLookup<>(SAMLEndpointContext.class, true).compose(
                         new ChildContextLookup<>(SAMLPeerEntityContext.class, true).compose(
                                 new OutboundMessageContextLookup()));
-        
+        assert ecls != null;
+        endpointContextLookupStrategy = ecls;
         artifactImpliesSecureChannel = true;
     }
     
@@ -394,11 +402,8 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
         
         log.debug("{} Attempting to resolve endpoint of type {} for outbound message", getLogPrefix(), endpointType);
 
-        // Compile binding list.  binding descriptors were checked for being non null in pre
-        final List<BindingDescriptor> bds = bindingDescriptors;
-        assert bds != null; 
-        @Nonnull final List<String> bindings = new ArrayList<>(bds.size());
-        for (final BindingDescriptor bindingDescriptor : bds) {
+        @Nonnull final List<String> bindings = new ArrayList<>(bindingDescriptors.size());
+        for (final BindingDescriptor bindingDescriptor : bindingDescriptors) {
             if (bindingDescriptor.test(profileRequestContext)) {
                 bindings.add(bindingDescriptor.getId());
             }
@@ -412,8 +417,10 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
         log.trace("{} Candidate outbound bindings: {}", getLogPrefix(), bindings);
         
         // Build criteria for the resolver.
+        final String firstBinding = bindings.get(0);
+        assert firstBinding!=null;
         final CriteriaSet criteria = new CriteriaSet(new BindingCriterion(bindings),
-                buildEndpointCriterion(bindings.get(0)));
+                buildEndpointCriterion(firstBinding));
         
         if (bestMatchCriterionLookupStrategy != null) {
             final BestMatchLocationCriterion bestMatch = bestMatchCriterionLookupStrategy.apply(profileRequestContext);
@@ -465,7 +472,7 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
         bindingCtx.setRelayState(SAMLBindingSupport.getRelayState(imc));
         
         final Optional<BindingDescriptor> bindingDescriptor =
-                bds.stream().filter(b -> b.getId().equals(bindingURI)).findFirst();
+                bindingDescriptors.stream().filter(b -> b.getId().equals(bindingURI)).findFirst();
 
         if (bindingDescriptor.isPresent()) {
             bindingCtx.setBindingDescriptor(bindingDescriptor.orElseThrow());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ReloadMetadata.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ReloadMetadata.java
index 11e770f2d..9a5168f53 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ReloadMetadata.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ReloadMetadata.java
@@ -38,6 +38,7 @@ import jakarta.servlet.http.HttpServletResponse;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.SpringRequestContext;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -71,7 +72,7 @@ public class ReloadMetadata extends AbstractProfileAction {
     @NonnullAfterInit private ReloadableService<MetadataResolver> metadataResolverService;
     
     /** Identifies bean to refresh. */
-    @Nullable private String id;
+    @NonnullBeforeExec private String id;
 
     /**
      * Set the service that describes the metadata.
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
index 8705be40a..0e4cd4a2f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
@@ -20,12 +20,11 @@ package net.shibboleth.idp.saml.saml1.profile.impl;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashSet;
-import java.util.Set;
 import java.util.List;
+import java.util.Set;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.messaging.context.navigate.MessageLookup;
@@ -33,11 +32,10 @@ import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
-import org.opensaml.saml.saml1.core.AttributeQuery;
 import org.opensaml.saml.saml1.core.AttributeDesignator;
+import org.opensaml.saml.saml1.core.AttributeQuery;
 import org.opensaml.saml.saml1.core.Request;
 import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
 
 import net.shibboleth.idp.attribute.AttributeDecodingException;
 import net.shibboleth.idp.attribute.IdPAttribute;
@@ -50,9 +48,11 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.service.ReloadableService;
 import net.shibboleth.shared.service.ServiceException;
 import net.shibboleth.shared.service.ServiceableComponent;
@@ -78,10 +78,10 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
     @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
 
     /** Query to filter against. */
-    @Nullable private AttributeQuery query;
+    @NonnullBeforeExec private AttributeQuery query;
     
     /** AttributeContext to filter. */
-    @Nullable private AttributeContext attributeContext;
+    @NonnullBeforeExec private AttributeContext attributeContext;
 
     /** Constructor. */
     public FilterByQueriedAttributeDesignators() {
@@ -178,12 +178,9 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
 
         final Set<String> decodedAttributeIds = new HashSet<>();
 
-        final AttributeQuery ac = query;
-        final AttributeContext aCtx = attributeContext;
-        assert ac != null && aCtx != null;
         try (final ServiceableComponent<AttributeTranscoderRegistry> component =
                 transcoderRegistry.getServiceableComponent()) {
-            for (final AttributeDesignator designator : ac.getAttributeDesignators()) {
+            for (final AttributeDesignator designator : query.getAttributeDesignators()) {
                 assert designator!=null;
                 try {
                     decodeAttributeDesignator(component.getComponent(), profileRequestContext, designator,
@@ -198,10 +195,10 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
             return;
         }
 
-        final Collection<IdPAttribute> keepers = new ArrayList<>(ac.getAttributeDesignators().size());
+        final Collection<IdPAttribute> keepers = new ArrayList<>(query.getAttributeDesignators().size());
         log.debug("Query content mapped to attribute IDs: {}", decodedAttributeIds);
         
-        for (final IdPAttribute attribute : aCtx.getIdPAttributes().values()) {
+        for (final IdPAttribute attribute : attributeContext.getIdPAttributes().values()) {
             if (decodedAttributeIds.contains(attribute.getId())) {
                 log.debug("Retaining attribute '{}' requested by query", attribute.getId());
                 keepers.add(attribute);
@@ -210,7 +207,7 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
             }
         }
         
-        aCtx.setIdPAttributes(keepers);
+        attributeContext.setIdPAttributes(keepers);
     }
 
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
index 7c61289c9..51bb4e336 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
@@ -69,7 +69,9 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
         setEncryptNameIDsPredicate(new NoConfidentialityMessageChannelPredicate());
 
         signSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate();
-        clientTLSSOAPRequestsPredicate = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate().negate();
+        final Predicate<MessageContext> cltsrp = new org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate().negate();
+        assert cltsrp!=null;
+        clientTLSSOAPRequestsPredicate = cltsrp;
         
         qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
     }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 211c385c4..06f36edb2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -126,14 +126,18 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
         setAuthenticationContextLookupStrategy(new ParentContextLookup<>(AuthenticationContext.class));
 
         // Root PRC -> RelyingPartyContext -> ID
-        requesterLookupStrategy = new RelyingPartyIdLookupFunction().compose(
+        final Function<ProfileRequestContext,String> rls = new RelyingPartyIdLookupFunction().compose(
                 new RootContextLookup<>(ProfileRequestContext.class));
+        assert rls!= null;
+        requesterLookupStrategy = rls;
         
         // Root PRC -> inbound context -> ProxiedRequesterContext
-        proxiedRequesterContextLookupStrategy =
+        final Function<ProfileRequestContext,ProxiedRequesterContext> prcls =
                 new ChildContextLookup<>(ProxiedRequesterContext.class).compose(
                         new InboundMessageContextLookup().compose(
                                 new RootContextLookup<>(ProfileRequestContext.class)));
+        assert prcls != null;
+        proxiedRequesterContextLookupStrategy = prcls;
     }
     
     /**
@@ -504,6 +508,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
             final RequestedAttributes reqExt = reqExtBuilder.buildObject();
             attrs.forEach(attr -> {
                 try {
+                    assert attr != null;
                     reqExt.getRequestedAttributes().add(XMLObjectSupport.cloneXMLObject(attr));
                 } catch (final MarshallingException|UnmarshallingException e) {
                     log.error("{} Error cloning RequestedAttribute from profile configuration", getLogPrefix(), e);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java
index d99aba5a0..c42003db8 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.messaging.context.navigate.MessageLookup;
@@ -32,13 +31,14 @@ import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.core.NameIDPolicy;
 import org.opensaml.saml.saml2.core.NameIDType;
 import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
 import net.shibboleth.profile.config.ProfileConfiguration;
 import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An action that processes a SAML 2 {@link AuthnRequest} and blocks the use of any "simple"
@@ -60,12 +60,14 @@ public class EnforceDisallowedSSOFeatures extends AbstractProfileAction {
     @Nonnull private Function<ProfileRequestContext,AuthnRequest> authnRequestLookupStrategy;
     
     /** The request message to read from. */
-    @Nullable private AuthnRequest authnRequest;
+    @NonnullBeforeExec private AuthnRequest authnRequest;
     
     /** Constructor. */
     public EnforceDisallowedSSOFeatures() {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
-        authnRequestLookupStrategy = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AuthnRequest> arls = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        assert arls!=null;
+        authnRequestLookupStrategy = arls;
     }
 
     /**
@@ -125,9 +127,7 @@ public class EnforceDisallowedSSOFeatures extends AbstractProfileAction {
         }
         
         @Nonnull final BrowserSSOProfileConfiguration profileConfiguration = (BrowserSSOProfileConfiguration) pc;
-        final AuthnRequest localAuthnRequest = this.authnRequest;
-        assert localAuthnRequest!= null;
-        final Boolean forceAuthn = localAuthnRequest.isForceAuthn();
+        final Boolean forceAuthn = authnRequest.isForceAuthn();
         if (forceAuthn != null && forceAuthn &&
                 profileConfiguration.isFeatureDisallowed(profileRequestContext,
                         BrowserSSOProfileConfiguration.FEATURE_FORCEAUTHN)) {
@@ -136,7 +136,7 @@ public class EnforceDisallowedSSOFeatures extends AbstractProfileAction {
             return;
         }
         
-        final NameIDPolicy nidPolicy = localAuthnRequest.getNameIDPolicy();
+        final NameIDPolicy nidPolicy = authnRequest.getNameIDPolicy();
         if (nidPolicy != null) {
             if (nidPolicy.getFormat() != null &&
                     profileConfiguration.isFeatureDisallowed(profileRequestContext,
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
index d34cd48da..e7f3e6b39 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
@@ -23,7 +23,6 @@ import java.util.List;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.messaging.context.navigate.MessageLookup;
@@ -34,7 +33,6 @@ import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
 import org.opensaml.saml.saml2.core.Attribute;
 import org.opensaml.saml.saml2.core.AttributeQuery;
 import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
 
 import com.google.common.collect.HashMultimap;
 import com.google.common.collect.Multimap;
@@ -51,9 +49,11 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.service.ReloadableService;
 import net.shibboleth.shared.service.ServiceException;
 import net.shibboleth.shared.service.ServiceableComponent;
@@ -79,17 +79,21 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
     @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
 
     /** Query to filter against. */
-    @Nullable private AttributeQuery query;
+    @NonnullBeforeExec private AttributeQuery query;
     
     /** AttributeContext to filter. */
-    @Nullable private AttributeContext attributeContext;
+    @NonnullBeforeExec private AttributeContext attributeContext;
 
     /** Constructor. */
     public FilterByQueriedAttributes() {
-        attributeContextLookupStrategy = new ChildContextLookup<>(AttributeContext.class).compose(
+        final Function<ProfileRequestContext,AttributeContext> acls = new ChildContextLookup<>(AttributeContext.class).compose(
                 new ChildContextLookup<>(RelyingPartyContext.class));
+        assert acls != null;
+        attributeContextLookupStrategy = acls;
         
-        queryLookupStrategy = new MessageLookup<>(AttributeQuery.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AttributeQuery> qls =  new MessageLookup<>(AttributeQuery.class).compose(new InboundMessageContextLookup());
+        assert qls != null;
+        queryLookupStrategy = qls;
     }
 
     /**
@@ -144,9 +148,8 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
         }
         
         query = queryLookupStrategy.apply(profileRequestContext);
-        final AttributeQuery localQuery = query;
         
-        if (localQuery == null || localQuery.getAttributes().isEmpty()) {
+        if (query == null || query.getAttributes().isEmpty()) {
             log.debug("No queried Attributes found, nothing to do ");
             return false;
         }
@@ -157,7 +160,6 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
             return false;
         }
 
-        assert attributeContext!=null;
         if (attributeContext.getIdPAttributes().isEmpty()) {
             log.debug("{} No attributes to filter", getLogPrefix());
             return false;
@@ -172,13 +174,10 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
                 
         final Multimap<String,IdPAttribute> mapped = HashMultimap.create();
         assert mapped != null;
-        final AttributeQuery localQuery = query;
-        final AttributeContext localAttributeContext = attributeContext;
-        assert localQuery!=null && localAttributeContext!=null;
         try (final ServiceableComponent<AttributeTranscoderRegistry> component =
                 transcoderRegistry.getServiceableComponent()) {
 
-            for (final Attribute designator : localQuery.getAttributes()) {
+            for (final Attribute designator : query.getAttributes()) {
                 assert designator != null;
                 try {
                     decodeAttribute(component.getComponent(), profileRequestContext, designator, mapped);
@@ -194,9 +193,9 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
                 
         log.debug("{} Query content mapped to attribute IDs: {}", getLogPrefix(), mapped.keySet());
 
-        final Collection<IdPAttribute> keepers = new ArrayList<>(localQuery.getAttributes().size());
+        final Collection<IdPAttribute> keepers = new ArrayList<>(query.getAttributes().size());
         
-        for (final IdPAttribute attribute : localAttributeContext.getIdPAttributes().values()) {
+        for (final IdPAttribute attribute : attributeContext.getIdPAttributes().values()) {
             
             final Collection<IdPAttribute> requested = mapped.get(attribute.getId());
             
@@ -218,7 +217,7 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
             }
         }
         
-        localAttributeContext.setIdPAttributes(keepers);
+        attributeContext.setIdPAttributes(keepers);
     }
     
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/MapRequestedAttributesInAttributeConsumingService.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/MapRequestedAttributesInAttributeConsumingService.java
index 958b76541..2e02eb08d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/MapRequestedAttributesInAttributeConsumingService.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/MapRequestedAttributesInAttributeConsumingService.java
@@ -20,14 +20,6 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
 import java.util.function.Function;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
-import net.shibboleth.idp.attribute.AttributesMapContainer;
-import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
-import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.idp.saml.attribute.impl.AttributeMappingNodeProcessor;
-import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.service.ReloadableService;
 
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
@@ -40,7 +32,15 @@ import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.metadata.resolver.filter.FilterException;
 import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
 import org.slf4j.Logger;
+
+import net.shibboleth.idp.attribute.AttributesMapContainer;
+import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
+import net.shibboleth.idp.profile.AbstractProfileAction;
+import net.shibboleth.idp.saml.attribute.impl.AttributeMappingNodeProcessor;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.service.ReloadableService;
 
 /**
  * Action that ensures that the attributes in the ACS (if any) are mapped.
@@ -56,7 +56,7 @@ public class MapRequestedAttributesInAttributeConsumingService extends AbstractP
         attributeConsumingServiceContextLookupStrategy;
 
     /** The registry of decoding rules. */
-    @Nullable private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
+    @NonnullBeforeExec private ReloadableService<AttributeTranscoderRegistry> transcoderRegistry;
 
     /** The context we use to get and put the {@link AttributeConsumingService}.*/
     private AttributeConsumingServiceContext acsContext;
@@ -66,11 +66,13 @@ public class MapRequestedAttributesInAttributeConsumingService extends AbstractP
      */
     public MapRequestedAttributesInAttributeConsumingService() {
         // At this point, by default  the SAMLMetadataContext hangs off the SAMLPeerContext
-        attributeConsumingServiceContextLookupStrategy =
+        final Function<ProfileRequestContext, AttributeConsumingServiceContext> acscls = 
                 new ChildContextLookup<>(AttributeConsumingServiceContext.class).compose(
                         new ChildContextLookup<>(SAMLMetadataContext.class).compose(
                                 new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(
                                         new InboundMessageContextLookup())));
+        assert acscls != null;
+        attributeConsumingServiceContextLookupStrategy = acscls;
     }
 
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 46c2d6560..a2f32aed3 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -130,13 +130,17 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
         
         // Create context by default.
-        encryptionContextLookupStrategy =
+        final Function<ProfileRequestContext,EncryptionContext> ecls =
                 new ChildContextLookup<>(EncryptionContext.class, true).compose(
                         new ChildContextLookup<>(RelyingPartyContext.class));
+        assert ecls != null;
+        encryptionContextLookupStrategy = ecls;
 
         // Default: outbound msg context -> SAMLPeerEntityContext
-        peerContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLPeerEntityContext> pcls =
                 new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(new OutboundMessageContextLookup());
+        assert pcls != null;
+        peerContextLookupStrategy = pcls;
     }
     
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessage.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessage.java
index d1fc48ba0..501d4c532 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessage.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessage.java
@@ -88,9 +88,12 @@ public class PreProcessLogoutMessage extends AbstractProfileAction {
     
     /** Constructor. */
     public PreProcessLogoutMessage() {
-        metadataContextLookupStrategy = new InboundMessageContextLookup().andThen(
-                new ChildContextLookup<>(SAMLPeerEntityContext.class).andThen(
-                        new ChildContextLookup<>(SAMLMetadataContext.class)));
+        final Function<ProfileRequestContext,SAMLMetadataContext> mcls =
+                new InboundMessageContextLookup().andThen(
+                        new ChildContextLookup<>(SAMLPeerEntityContext.class).andThen(
+                                new ChildContextLookup<>(SAMLMetadataContext.class)));
+        assert mcls != null;
+        metadataContextLookupStrategy = mcls;
     }
 
     /**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
index 4394f8bfc..1cec5b8b4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
@@ -80,13 +80,19 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
      * Constructor.
      */
     public ProcessAssertionsForAuthentication() {
-        responseResolver = new DefaultResponseResolver().compose(
-                new ChildContextLookup<>(ProfileRequestContext.class).compose(
-                        new ChildContextLookup<>(AuthenticationContext.class)));
+        final Function<ProfileRequestContext, Response> rr =
+                new DefaultResponseResolver().compose(
+                        new ChildContextLookup<>(ProfileRequestContext.class).compose(
+                                new ChildContextLookup<>(AuthenticationContext.class)));
+        assert rr != null;
+        responseResolver = rr;
         
         // PRC -> AC -> SAMLAuthnContext
-        samlContextLookupStrategy = new ChildContextLookup<>(SAMLAuthnContext.class).compose(
-                new ChildContextLookup<>(AuthenticationContext.class));
+        final Function<ProfileRequestContext,SAMLAuthnContext> scls =
+                new ChildContextLookup<>(SAMLAuthnContext.class).compose(
+                        new ChildContextLookup<>(AuthenticationContext.class));
+        assert scls!= null;
+        samlContextLookupStrategy = scls;
         
         // Get the Assertion containing the earliest child AuthnStatement#SessionNotOnOrAfter,
         // with null values converted to Instant.MAX and therefore having the lowest precedence.
@@ -307,6 +313,7 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
     private class AssertionContainsConfirmedSubject implements Predicate<Assertion> {
 
         /** {@inheritDoc} */
+        @SuppressWarnings("unused")
         public boolean test(@Nullable final Assertion assertion) {
             if (assertion == null) {
                 return false;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
index a82995df0..76d2a188e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
@@ -56,6 +56,7 @@ import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
 import net.shibboleth.saml.saml2.profile.config.navigate.QualifiedNameIDFormatsLookupFunction;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -115,7 +116,7 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,String> relyingPartyLookupStrategy;
     
     /** LogoutRequest to process. */
-    @Nullable private LogoutRequest logoutRequest;
+    @NonnullBeforeExec private LogoutRequest logoutRequest;
     
     /** {@link NameID} Formats allowing defaulted qualifiers. */
     @Nonnull private Set<String> qualifiedNameIDFormats;
@@ -147,8 +148,11 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
             }
         };
     
-        logoutRequestLookupStrategy = new MessageLookup<>(LogoutRequest.class).compose(
-                new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,LogoutRequest> lrls =
+                new MessageLookup<>(LogoutRequest.class).compose(
+                        new InboundMessageContextLookup());
+        assert lrls!=null;
+        logoutRequestLookupStrategy = lrls;
         
         qualifiedNameIDFormatsLookupStrategy = new QualifiedNameIDFormatsLookupFunction();
 
@@ -287,15 +291,15 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
             return false;
         }
         
+
         logoutRequest = logoutRequestLookupStrategy.apply(profileRequestContext);
-        final LogoutRequest request = logoutRequest;
-        if (request == null) {
+        if (logoutRequest == null) {
             log.warn("{} No LogoutRequest found to process", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
             return false;
         }
         
-        final NameID nid = request.getNameID();
+        final NameID nid = logoutRequest.getNameID();
         if (nid == null) {
             log.warn("{} LogoutRequest did not contain NameID", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
@@ -410,12 +414,11 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
     private boolean sessionMatches(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final SPSession session) {
         
+        assert isPreExecuteCalled();
+        
         if (session instanceof SAML2SPSession) {
             final SAML2SPSession saml2Session = (SAML2SPSession) session;
-            final LogoutRequest request = logoutRequest;
-            assert request != null;
-            
-            final Issuer issuer = request.getIssuer();
+            final Issuer issuer = logoutRequest.getIssuer();
             
             // Make sure the SP matches.
             if (issuer == null || !saml2Session.getId().equals(issuer.getValue())) {
@@ -430,7 +433,7 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
                 format = NameID.UNSPECIFIED;
             }
             
-            final NameID requestedNameID = request.getNameID();
+            final NameID requestedNameID = logoutRequest.getNameID();
             assert requestedNameID != null;
             if (NameID.PERSISTENT.equals(format) || NameID.TRANSIENT.equals(format)
                     || qualifiedNameIDFormats.contains(format)) {
@@ -452,11 +455,11 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
             
             // Check SessionIndex match.
             
-            if (request.getSessionIndexes().isEmpty()) {
+            if (logoutRequest.getSessionIndexes().isEmpty()) {
                 return true;
             }
             
-            for (final SessionIndex index : request.getSessionIndexes()) {
+            for (final SessionIndex index : logoutRequest.getSessionIndexes()) {
                 final String value = index.getValue();
                 if (value != null && value.equals(saml2Session.getSessionIndex())) {
                     return true;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
index 4693d0f64..6dd63581c 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
@@ -88,7 +88,10 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
     /** Constructor. */
     public ProcessRequestedAuthnContext() {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
-        authnRequestLookupStrategy = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AuthnRequest> arls =
+                new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        assert arls != null;
+        authnRequestLookupStrategy = arls;
         ignoredContexts = CollectionSupport.singleton(AuthnContext.UNSPECIFIED_AUTHN_CTX);
     }
 
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index 29d6b65e4..ce4d6648f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -87,12 +87,18 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
     /** Constructor. */
     public SAMLAuthnController() {
         // PRC -> AC -> nested PRC
-        profileRequestContextLookupStrategy = new ChildContextLookup<>(ProfileRequestContext.class).compose(
-                new ChildContextLookup<>(AuthenticationContext.class));
+        final Function<ProfileRequestContext,ProfileRequestContext> prcls =
+                new ChildContextLookup<>(ProfileRequestContext.class).compose(
+                        new ChildContextLookup<>(AuthenticationContext.class));
+        assert prcls!= null;
+        profileRequestContextLookupStrategy = prcls;
         
         // PRC -> AC -> SAMLAuthnContext
-        samlContextLookupStrategy = new ChildContextLookup<>(SAMLAuthnContext.class).compose(
-                new ChildContextLookup<>(AuthenticationContext.class));
+        final Function<ProfileRequestContext,SAMLAuthnContext>  scls =
+                new ChildContextLookup<>(SAMLAuthnContext.class).compose(
+                        new ChildContextLookup<>(AuthenticationContext.class));
+        assert scls!=null;
+        samlContextLookupStrategy = scls;
         
         bindingMap = CollectionSupport.emptyMap();
     }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java
index 5d390d5f1..a82f86640 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java
@@ -52,6 +52,7 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.session.context.LogoutPropagationContext;
 import net.shibboleth.idp.session.context.LogoutPropagationContext.Result;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -105,36 +106,42 @@ public class SOAPLogoutRequest extends AbstractProfileAction {
     @Nullable @NotEmpty private String soapPipelineName;
     
     /** LogoutRequest to process. */
-    @Nullable private LogoutRequest logoutRequest;
+    @NonnullBeforeExec private LogoutRequest logoutRequest;
     
     /** LogoutPropagationContext. */
-    @Nullable private LogoutPropagationContext propagationContext;
+    @NonnullBeforeExec private LogoutPropagationContext propagationContext;
     
     /** Optional metadata for use in SOAP client. */
     @Nullable private SAMLMetadataContext mdContext;
     
     /** Endpoint context to determine destination address. */
-    @Nullable private SAMLEndpointContext epContext;
+    @NonnullBeforeExec private SAMLEndpointContext epContext;
     
     /** Constructor. */
     public SOAPLogoutRequest() {
         
-        logoutRequestLookupStrategy =
+        final Function<ProfileRequestContext,LogoutRequest> lrls = 
                 new MessageLookup<>(LogoutRequest.class).compose(new OutboundMessageContextLookup());
+        assert lrls != null;
+        logoutRequestLookupStrategy = lrls;
 
         propagationContextLookupStrategy = new ChildContextLookup<>(LogoutPropagationContext.class);
         
         // Default: outbound msg context -> SAMLPeerEntityContext -> SAMLMetadataContext
-        metadataContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLMetadataContext>  mcls =
                 new ChildContextLookup<>(SAMLMetadataContext.class).compose(
                         new ChildContextLookup<>(SAMLPeerEntityContext.class).compose(
                                 new OutboundMessageContextLookup()));
+        assert mcls!= null;
+        metadataContextLookupStrategy = mcls;
 
         // Default: outbound msg context -> SAMLPeerEntityContext -> SAMLEndpointContext
-        endpointContextLookupStrategy =
+        final Function<ProfileRequestContext,SAMLEndpointContext> ecls =
                 new ChildContextLookup<>(SAMLEndpointContext.class, true).compose(
                         new ChildContextLookup<>(SAMLPeerEntityContext.class, true).compose(
                                 new OutboundMessageContextLookup()));
+        assert ecls != null;
+        endpointContextLookupStrategy = ecls;
     }
     
     /**
@@ -236,8 +243,8 @@ public class SOAPLogoutRequest extends AbstractProfileAction {
             return false;
         }
 
-        final SAMLEndpointContext ctx = epContext = endpointContextLookupStrategy.apply(profileRequestContext);
-        final Endpoint ep = ctx == null ? null : ctx.getEndpoint(); 
+        epContext = endpointContextLookupStrategy.apply(profileRequestContext);
+        final Endpoint ep = epContext == null ? null : epContext.getEndpoint(); 
         if (ep == null|| ep.getLocation() == null) {
             log.warn("{} No destination endpoint found", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MSG_CTX);
@@ -261,15 +268,12 @@ public class SOAPLogoutRequest extends AbstractProfileAction {
                     .setPeerRoleDescriptor(mdContext != null ? mdContext.getRoleDescriptor() : null)
                     .build();
             
-            final SAMLEndpointContext ctx = epContext;
-            assert ctx != null;
-            final Endpoint ep = ctx.getEndpoint();
-            final LogoutRequest lReq = logoutRequest;
-            assert ep != null && lReq != null && opContext != null;
+            final Endpoint ep = epContext.getEndpoint();
+            assert ep != null && opContext != null;
             
             final String dest = ep.getLocation();
             assert dest != null;
-            lReq.setDestination(dest);
+            logoutRequest.setDestination(dest);
         
             log.debug("{} Executing LogoutRequest over SOAP 1.1 binding to endpoint: {}", getLogPrefix(), dest);
             
@@ -299,7 +303,7 @@ public class SOAPLogoutRequest extends AbstractProfileAction {
             bctx.setBindingDescriptor(omcBc.getBindingDescriptor());
             
             log.debug("{} Processing LogoutResponse received via SOAP 1.1 binding from endpoint: {}", getLogPrefix(),
-                    lReq.getDestination());
+                    logoutRequest.getDestination());
             handleResponse(profileRequestContext, (LogoutResponse) response);
         } catch (final ClassCastException e) {
             log.warn("{} SOAP message payload was not an instance of LogoutResponse", getLogPrefix());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContext.java
index ae5dcfd4a..6e951e63d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContext.java
@@ -35,6 +35,7 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.saml.session.SAML2SPSession;
 import net.shibboleth.idp.session.SPSession;
 import net.shibboleth.idp.session.context.LogoutPropagationContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -64,7 +65,7 @@ public class PrepareInboundMessageContext extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,String> relyingPartyLookupStrategy;
     
     /** The relying party name to base the inbound context on. */
-    @Nullable private String relyingPartyId;
+    @NonnullBeforeExec private String relyingPartyId;
 
     /** Constructor. */
     public PrepareInboundMessageContext() {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionCreationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionCreationStrategy.java
index 2936313c4..681050faa 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionCreationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionCreationStrategy.java
@@ -92,7 +92,9 @@ public class SAML1SPSessionCreationStrategy implements Function<ProfileRequestCo
         }
         
         final Instant now = Instant.now();
-        return new SAML1SPSession(issuer, now, now.plus(sessionLifetime));
+        final Instant then = now.plus(sessionLifetime);
+        assert then != null;
+        return new SAML1SPSession(issuer, now, then);
     }
 
 }
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java
index f9c984e52..a665290f9 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java
@@ -87,7 +87,10 @@ public class SAML2SPSessionCreationStrategy implements Function<ProfileRequestCo
     public SAML2SPSessionCreationStrategy(@Nonnull final Duration lifetime) {
         sessionLifetime = Constraint.isNotNull(lifetime, "Lifetime cannot be null");
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
-        responseLookupStrategy = new MessageLookup<>(Response.class).compose(new OutboundMessageContextLookup());
+        final Function<ProfileRequestContext, Response> rls =
+                new MessageLookup<>(Response.class).compose(new OutboundMessageContextLookup());
+        assert rls!=null;
+        responseLookupStrategy = rls;
     }
 
     /**
@@ -130,7 +133,9 @@ public class SAML2SPSessionCreationStrategy implements Function<ProfileRequestCo
         if (result == null) {
             log.info("Creating BasicSPSession in the absence of necessary information");
             final Instant now = Instant.now();
-            return new BasicSPSession(issuer, now, now.plus(sessionLifetime));
+            final Instant then = now.plus(sessionLifetime);
+            assert then != null;
+            return new BasicSPSession(issuer, now, then);
         }
         
         final Instant now = Instant.now();
@@ -173,8 +178,7 @@ public class SAML2SPSessionCreationStrategy implements Function<ProfileRequestCo
         // Thse guarantees come from the getAssertionAndStatement method.
         final NameID nameID = subject.getNameID();
         final String index = second.getSessionIndex();
-        assert nameID != null;
-        assert index != null;
+        assert nameID != null && index != null && now != null && expiration != null;
         return new SAML2SPSession(issuer, now, expiration, nameID, index, acsLocation, supportLogoutPropagation);
     }
 // Checkstyle: CyclomaticComplexity ON
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java
index 5069b8611..152b73a95 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java
@@ -130,7 +130,9 @@ public class SAML2SPSessionSerializer extends AbstractSPSessionSerializer {
             final XMLObject nameID =
                     XMLObjectSupport.unmarshallFromReader(parserPool, new StringReader(rawNameID.getString()));
             if (nameID instanceof NameID) {
-                return new SAML2SPSession(id, creation, expiration, (NameID) nameID, sessionIndex.getString(),
+                final String sessionIndexString = sessionIndex.getString();
+                assert sessionIndexString!= null;
+                return new SAML2SPSession(id, creation, expiration, (NameID) nameID, sessionIndexString,
                         acsLocation != null ? acsLocation.getString() : null, supportsLogoutProp);
             }
             throw new IOException("XMLObject stored in NameID field was not a NameID");
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
index db3f29b38..22642a67d 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
@@ -51,7 +51,7 @@ import org.testng.annotations.Test;
 /**
  * Unit test for {@link CryptoTransientNameIDDecoder}.
  */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class CryptoTransientNameIDDecoderTest extends OpenSAMLInitBaseTestCase {
 
     private final static Duration TIMEOUT = Duration.ofSeconds(5);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
index aed6b093a..afcb22ee6 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
@@ -45,7 +45,7 @@ import org.testng.annotations.Test;
 /**
  * Unit test for {@link CryptoTransientNameIdentifierDecoder}.
  */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class CryptoTransientNameIdentifierDecoderTest extends OpenSAMLInitBaseTestCase {
 
     private final static Duration TIMEOUT = Duration.ofSeconds(5);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java
index 9570fa231..03861085f 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML1NameIdentifierGeneratorTest.java
@@ -40,7 +40,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** Unit test for {@link TransientSAML1NameIdentifierGenerator} using crypto-based generator. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class CryptoTransientSAML1NameIdentifierGeneratorTest extends OpenSAMLInitBaseTestCase {
 
     private static final Duration TIMEOUT = Duration.ofMillis(500);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java
index 9ab840ee2..c7e28ca02 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientSAML2NameIDGeneratorTest.java
@@ -41,7 +41,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** Unit test for {@link TransientSAML2NameIDGenerator} using crypto-based generator. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class CryptoTransientSAML2NameIDGeneratorTest extends OpenSAMLInitBaseTestCase {
 
     private static final Duration TIMEOUT = Duration.ofMillis(500);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalizationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalizationTest.java
index 984a335c9..eb6a00861 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalizationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalizationTest.java
@@ -43,7 +43,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** {@link NameIDCanonicalization} unit test. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class NameIDCanonicalizationTest extends OpenSAMLInitBaseTestCase {
 
     private ProfileRequestContext prc;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGeneratorTest.java
index 3692fda7a..edab9bc79 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGeneratorTest.java
@@ -21,6 +21,19 @@ import java.util.Collections;
 
 import javax.sql.DataSource;
 
+import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
+import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
+import org.opensaml.saml.saml2.testing.SAML2ActionTestingSupport;
+import org.testng.Assert;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
 import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.PairwiseId;
 import net.shibboleth.idp.attribute.StringAttributeValue;
@@ -32,28 +45,14 @@ import net.shibboleth.idp.profile.testing.RequestContextBuilder;
 import net.shibboleth.idp.saml.impl.testing.TestSources;
 import net.shibboleth.idp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration;
 import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.shared.testing.DatabaseTestingSupport;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
-
-import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
-import org.opensaml.core.xml.util.XMLObjectSupport;
-import org.opensaml.messaging.context.MessageContext;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.opensaml.saml.saml2.core.AuthnRequest;
-import org.opensaml.saml.saml2.core.NameID;
-import org.opensaml.saml.saml2.core.NameIDPolicy;
-import org.opensaml.saml.saml2.testing.SAML2ActionTestingSupport;
-import org.springframework.validation.MessageCodeFormatter;
-import org.testng.Assert;
-import org.testng.annotations.AfterMethod;
-import org.testng.annotations.BeforeMethod;
-import org.testng.annotations.Test;
+import net.shibboleth.shared.testing.DatabaseTestingSupport;
 
 /**
  * Test for {@link PersistentSAML2NameIDGenerator}.
  */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class PersistentSAML2NameIDGeneratorTest extends OpenSAMLInitBaseTestCase {
 
     /** Value calculated using V2 version. DO NOT CHANGE WITHOUT TESTING AGAINST 2.0 */
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java
index 4490c024b..2cd4c5112 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java
@@ -48,7 +48,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.testing.DatabaseTestingSupport;
 
 /** Test for {@link StoredPersistentIdDecoder}. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
 
     private DataSource testSource;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML1NameIdentifierGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML1NameIdentifierGeneratorTest.java
index fc99ee464..86ee5e257 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML1NameIdentifierGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML1NameIdentifierGeneratorTest.java
@@ -34,7 +34,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** Unit test for {@link TransientSAML1NameIdentifierGenerator} using storage-based generator. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class StoredTransientSAML1NameIdentifierGeneratorTest extends OpenSAMLInitBaseTestCase {
 
     private MemoryStorageService store;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML2NameIDGeneratorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML2NameIDGeneratorTest.java
index e6de39e0f..84b0ee528 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML2NameIDGeneratorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredTransientSAML2NameIDGeneratorTest.java
@@ -35,7 +35,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** Unit test for {@link TransientSAML2NameIDGenerator} using storage-based generator. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class StoredTransientSAML2NameIDGeneratorTest extends OpenSAMLInitBaseTestCase {
 
     private MemoryStorageService store;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java
index a23134604..0748035b8 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java
@@ -27,7 +27,7 @@ import org.testng.Assert;
 import org.testng.annotations.Test;
 
 /** {@link BaseTransformingDecoder} unit test. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class TransformingDecoderTest {
 
     private static final String PRINCIPAL="ThePrincipalName at foo.edu";
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java
index 115e79c88..ebda535c5 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java
@@ -39,7 +39,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** {@link BaseTransientDecoder} unit test. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class TransientDecoderTest extends OpenSAMLInitBaseTestCase {
 
     private static final String RECIPIENT="TheRecipient";
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfigurationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfigurationTest.java
index 47cdebd9b..ffc8282f0 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfigurationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/config/impl/AbstractSAMLProfileConfigurationTest.java
@@ -20,8 +20,6 @@ package net.shibboleth.idp.saml.profile.config.impl;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-import net.shibboleth.idp.saml.profile.config.impl.AbstractSAMLProfileConfiguration;
-
 /** Unit test for {@link AbstractSAMLProfileConfiguration}. */
 @SuppressWarnings("javadoc")
 public class AbstractSAMLProfileConfigurationTest {
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContextsTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContextsTest.java
index 1c6effdb6..39e5699b8 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContextsTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContextsTest.java
@@ -572,6 +572,7 @@ public class PopulateBindingAndEndpointContextsTest extends XMLObjectBaseTestCas
         Assert.assertEquals(ep.getLocation(), LOCATION_POST);
     }
     
+    @SuppressWarnings("null")
     @Nonnull private EntityDescriptor loadMetadata(@Nonnull @NotEmpty final String path) throws UnmarshallingException {
         
         try {
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfigurationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfigurationTest.java
index 66df2d47a..9ac2fbadb 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfigurationTest.java
@@ -32,7 +32,7 @@ import java.time.Duration;
 import java.util.*;
 
 /** Unit test for {@link BrowserSSOProfileConfiguration}. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class BrowserSSOProfileConfigurationTest {
 
     @Test
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAttributeStatementToAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAttributeStatementToAssertionTest.java
index bac8d4ee9..09ed74684 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAttributeStatementToAssertionTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAttributeStatementToAssertionTest.java
@@ -97,6 +97,7 @@ public class AddAttributeStatementToAssertionTest extends OpenSAMLInitBaseTestCa
      * 
      * @throws ComponentInitializationException on error
      */
+    @SuppressWarnings("null")
     @BeforeMethod public void setUp() throws ComponentInitializationException {
         rc = new RequestContextBuilder().setOutboundMessage(
                 SAML1ActionTestingSupport.buildResponse()).buildRequestContext();
@@ -170,7 +171,7 @@ public class AddAttributeStatementToAssertionTest extends OpenSAMLInitBaseTestCa
 
         final AttributeContext attribCtx = buildAttributeContext();
         final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class);
-        assert rpCtx!=null;
+        assert rpCtx!=null && attribCtx!=null;
         rpCtx.addSubcontext(attribCtx);
 
         action.initialize();
@@ -307,7 +308,7 @@ public class AddAttributeStatementToAssertionTest extends OpenSAMLInitBaseTestCa
 
         final AttributeContext attribCtx = buildAttributeContext();
         final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class);
-        assert rpCtx!=null;
+        assert rpCtx!=null && attribCtx!=null;
         rpCtx.addSubcontext(attribCtx);
 
         action.setStatementInOwnAssertion(true);
@@ -345,7 +346,7 @@ public class AddAttributeStatementToAssertionTest extends OpenSAMLInitBaseTestCa
 
         final AttributeContext attribCtx = buildAttributeContext();
         final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class);
-        assert rpCtx!=null;
+        assert rpCtx!=null && attribCtx!=null;
         rpCtx.addSubcontext(attribCtx);
 
         action.initialize();
@@ -402,7 +403,7 @@ public class AddAttributeStatementToAssertionTest extends OpenSAMLInitBaseTestCa
      * @return the attribute context to be used as an input to the action
      * @throws ComponentInitializationException thrown if the attribute encoders can not be initialized
      */
-    private AttributeContext buildAttributeContext() throws ComponentInitializationException {
+    @Nonnull private AttributeContext buildAttributeContext() throws ComponentInitializationException {
 
         final IdPAttribute attribute1 = new IdPAttribute(MY_NAME_1);
         attribute1.setValues(Arrays.asList(new StringAttributeValue(MY_VALUE_1)));
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignatorsTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignatorsTest.java
index cd8ce4675..918e19687 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignatorsTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignatorsTest.java
@@ -23,6 +23,8 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
 import org.opensaml.core.xml.io.UnmarshallingException;
 import org.opensaml.profile.context.ProfileRequestContext;
@@ -47,6 +49,7 @@ import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileR
 import net.shibboleth.idp.profile.testing.ActionTestingSupport;
 import net.shibboleth.idp.profile.testing.RequestContextBuilder;
 import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.service.ReloadableService;
 import net.shibboleth.shared.spring.custom.SchemaTypeAwareXMLBeanDefinitionReader;
@@ -61,7 +64,7 @@ public class FilterByQueriedAttributeDesignatorsTest extends XMLObjectBaseTestCa
     
     private Request query;
     
-    private ReloadableService<AttributeTranscoderRegistry> registry;
+    @NonnullBeforeExec private ReloadableService<AttributeTranscoderRegistry> registry;
     
     private FilterByQueriedAttributeDesignators action;
     
@@ -71,7 +74,7 @@ public class FilterByQueriedAttributeDesignatorsTest extends XMLObjectBaseTestCa
 
     private List<GenericApplicationContext> contexts = new ArrayList<>();
 
-    protected <Type> Type getBean(String fileName, Class<Type> claz) {
+    protected <Type> Type getBean(@Nonnull String fileName, Class<Type> claz) {
 
         final GenericApplicationContext context = new GenericApplicationContext();
         contexts.add(context);
@@ -99,6 +102,7 @@ public class FilterByQueriedAttributeDesignatorsTest extends XMLObjectBaseTestCa
         registry = new MockReloadableService<>(getBean(PATH + "saml1Mapper.xml", AttributeTranscoderRegistryImpl.class));
     }
     
+    @SuppressWarnings("null")
     @BeforeMethod public void setUpMethod() throws ComponentInitializationException, XMLParserException, UnmarshallingException {
         query = unmarshallElement(PATH + "AttributeQuerySaml1.xml", true);
 
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java
index 1dd1f1d49..002d25f3e 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java
@@ -57,6 +57,7 @@ public class IdPInitiatedSSORequestMessageDecoderTest {
     
     private Instant time;
     
+    @SuppressWarnings("null")
     @BeforeMethod
     public void setUp() throws ComponentInitializationException {
         time = Instant.now();
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java
index 33cbee488..3d48fc61c 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfigurationTest.java
@@ -17,14 +17,6 @@
 
 package net.shibboleth.idp.saml.saml2.profile.config.impl;
 
-import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
-import net.shibboleth.idp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration;
-import net.shibboleth.saml.profile.config.BasicSAMLArtifactConfiguration;
-import net.shibboleth.saml.profile.config.SAMLArtifactConfiguration;
-import net.shibboleth.shared.logic.ConstraintViolationException;
-import net.shibboleth.shared.logic.FunctionSupport;
-import net.shibboleth.shared.logic.PredicateSupport;
-
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -35,6 +27,13 @@ import java.util.Set;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
+import net.shibboleth.saml.profile.config.BasicSAMLArtifactConfiguration;
+import net.shibboleth.saml.profile.config.SAMLArtifactConfiguration;
+import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
+
 
 /** Unit test for {@link BrowserSSOProfileConfiguration}. */
 @SuppressWarnings("javadoc")
@@ -53,6 +52,7 @@ public class BrowserSSOProfileConfigurationTest {
         Assert.assertFalse(config.isSignAssertions(null));
     }
 
+    @SuppressWarnings("null")
     @Test public void testAssertionLifetime() {
         final BrowserSSOProfileConfiguration config = new BrowserSSOProfileConfiguration();
         Assert.assertTrue(config.getAssertionLifetime(null).toMillis() > 0);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SSOSProfileConfigurationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SSOSProfileConfigurationTest.java
index 329c9a193..6166d51b6 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SSOSProfileConfigurationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SSOSProfileConfigurationTest.java
@@ -21,10 +21,9 @@ import org.testng.Assert;
 import org.testng.annotations.Test;
 
 /** Unit test for {@link SSOSProfileConfiguration}. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "removal", "null", "deprecation"})
 public class SSOSProfileConfigurationTest {
 
-    @SuppressWarnings("removal")
     @Test
     public void testProfileId() {
         final SSOSProfileConfiguration config = new SSOSProfileConfiguration();
@@ -32,7 +31,6 @@ public class SSOSProfileConfigurationTest {
     }
     
     @Test
-    @SuppressWarnings("removal")
     public void testDelegationPredicate() {
         final SSOSProfileConfiguration config = new SSOSProfileConfiguration();
         Assert.assertFalse(config.isDelegation(null));
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/tests/ProxyRestrictionLookupFunctionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/tests/ProxyRestrictionLookupFunctionTest.java
index 45473e205..57963029d 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/tests/ProxyRestrictionLookupFunctionTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/tests/ProxyRestrictionLookupFunctionTest.java
@@ -177,6 +177,7 @@ public class ProxyRestrictionLookupFunctionTest extends OpenSAMLInitBaseTestCase
         Assert.assertTrue(second.isEmpty());
     }
 
+    @SuppressWarnings("null")
     @Test
     public void testConfigOnly() {
         config.setProxyCount(5);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
index d2907ce6e..62689dc8d 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
@@ -86,6 +86,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
      * 
      * @throws ComponentInitializationException on error
      */
+    @SuppressWarnings("null")
     @BeforeMethod public void setUp() throws ComponentInitializationException {
         rc = new RequestContextBuilder().buildRequestContext();
         prc1 = new WebflowRequestContextProfileRequestContextLookup().apply(rc);
@@ -410,6 +411,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
     }
 
     /** Test that the action works for RequestedAuthnContext. */
+    @SuppressWarnings("null")
     @Test public void testAuthnContext() {
         final RequestedPrincipalContext reqctx = ac.ensureSubcontext(RequestedPrincipalContext.class);
         reqctx.setOperator("exact");
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java
index 3d5adb0f7..819425697 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java
@@ -57,7 +57,7 @@ import net.shibboleth.shared.testing.ConstantSupplier;
 /**
  * Unit test for {@link ProcessAssertionsForAuthentication} action.
  */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null", "unchecked"})
 public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTestCase {
     
     private ProcessAssertionsForAuthentication action;
@@ -75,7 +75,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
     
     @BeforeMethod
     public void beforeMethod() {
-        final MockHttpServletRequest req = httpRequest = new MockHttpServletRequest();
+        httpRequest = new MockHttpServletRequest();
         httpResponse = new MockHttpServletResponse();
         
         action = new ProcessAssertionsForAuthentication();
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
index a6d6a6d2b..df26d8f65 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequestTest.java
@@ -70,7 +70,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** {@link ProcessLogoutRequest} unit test. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class ProcessLogoutRequestTest extends SessionManagerBaseTestCase {
 
     private SAMLObjectBuilder<SessionIndex> sessionIndexBuilder;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java
index fa4124c4b..de64e2dca 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/SessionManagerBaseTestCase.java
@@ -40,7 +40,7 @@ import org.testng.annotations.AfterClass;
 import org.testng.annotations.BeforeClass;
 
 /** Base class for tests requiring a SessionManager component to be set up. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class SessionManagerBaseTestCase extends OpenSAMLInitBaseTestCase {
     
     protected MemoryStorageService storageService;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContextTest.java
index 9da0a22b9..5cdcafa01 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/PrepareInboundMessageContextTest.java
@@ -17,15 +17,6 @@
 
 package net.shibboleth.idp.saml.session.impl;
 
-import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
-import net.shibboleth.idp.profile.testing.ActionTestingSupport;
-import net.shibboleth.idp.profile.testing.RequestContextBuilder;
-import net.shibboleth.idp.saml.session.SAML2SPSession;
-import net.shibboleth.idp.session.SPSession;
-import net.shibboleth.idp.session.context.LogoutPropagationContext;
-import net.shibboleth.profile.context.RelyingPartyContext;
-import net.shibboleth.shared.component.ComponentInitializationException;
-
 import java.time.Instant;
 
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
@@ -40,8 +31,16 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.idp.profile.context.navigate.WebflowRequestContextProfileRequestContextLookup;
+import net.shibboleth.idp.profile.testing.ActionTestingSupport;
+import net.shibboleth.idp.profile.testing.RequestContextBuilder;
+import net.shibboleth.idp.saml.session.SAML2SPSession;
+import net.shibboleth.idp.session.SPSession;
+import net.shibboleth.idp.session.context.LogoutPropagationContext;
+import net.shibboleth.shared.component.ComponentInitializationException;
+
 /** {@link PrepareInboundMessageContext} unit test. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null"})
 public class PrepareInboundMessageContextTest extends OpenSAMLInitBaseTestCase {
 
     private RequestContext src;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializerTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializerTest.java
index a9f73e58c..e618da149 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializerTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializerTest.java
@@ -34,7 +34,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 /** {@link SAML2SPSessionSerializer} unit test. */
- at SuppressWarnings("javadoc")
+ at SuppressWarnings({"javadoc", "null",})
 public class SAML2SPSessionSerializerTest extends OpenSAMLInitBaseTestCase {
 
     private static final String DATAPATH = "/net/shibboleth/idp/saml/impl/session/";

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list