[java-opensaml] branch main updated: Replace Collections methods where possible.

Scott Cantor cantor.2 at osu.edu
Thu Apr 20 16:43:48 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=2c03dec924d250986359f32b509ccc94a26777e4

The following commit(s) were added to refs/heads/main by this push:
     new 2c03dec92 Replace Collections methods where possible.
2c03dec92 is described below

commit 2c03dec924d250986359f32b509ccc94a26777e4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Apr 20 12:43:45 2023 -0400

    Replace Collections methods where possible.
---
 .../opensaml/core/xml/schema/impl/XSAnyImpl.java   |  9 ++-
 .../core/xml/schema/impl/XSDateTimeImpl.java       |  7 +-
 .../impl/FilesystemLoadSaveManagerTest.java        | 15 ++---
 .../handler/impl/BasicMessageHandlerChain.java     |  6 +-
 .../PopulateClientTLSValidationParameters.java     |  6 +-
 .../action/impl/PopulateDecryptionParameters.java  |  5 +-
 .../PopulateSignatureValidationParameters.java     |  6 +-
 .../saml/common/assertion/ValidationContext.java   | 29 +++++---
 .../profile/logic/EntityAttributesPredicate.java   |  5 +-
 .../EncryptedElementTypeEncryptedKeyResolver.java  |  5 +-
 .../PopulateSignatureSigningParametersHandler.java |  6 +-
 .../impl/ChainingNameIdentifierGenerator.java      |  5 +-
 .../impl/PopulateSignatureSigningParameters.java   |  6 +-
 .../saml/ext/saml2alg/impl/DigestMethodImpl.java   |  4 +-
 .../saml2mdquery/impl/QueryDescriptorTypeImpl.java |  4 +-
 .../resolver/filter/impl/AlgorithmFilter.java      |  6 +-
 .../index/impl/SAMLArtifactMetadataIndex.java      |  3 +-
 .../profile/impl/AddNameIdentifierToSubjects.java  |  3 +-
 .../ExtractChannelBindingsExtensionsHandler.java   |  4 +-
 .../SAMLMetadataEncryptionParametersResolver.java  |  5 +-
 ...ocolMessageXMLSignatureSecurityHandlerTest.java |  5 +-
 .../logic/tests/EntityAttributesPredicateTest.java | 29 ++++----
 .../logic/tests/EntityGroupNamePredicateTest.java  | 13 ++--
 .../filter/impl/EntityAttributesFilterTest.java    |  3 +-
 .../resolver/filter/impl/PredicateFilterTest.java  | 10 +--
 .../resolver/filter/impl/ScriptedFunctionTest.java |  4 +-
 .../SignatureValidationFilterExplicitKeyTest.java  |  4 +-
 ...ctionDrivenDynamicHTTPMetadataResolverTest.java |  4 +-
 .../resolver/impl/HTTPMetadataResolverTest.java    |  8 +--
 .../impl/ConstantEntityDescriptorFunction.java     |  4 +-
 .../index/impl/EndpointMetadataIndexTest.java      | 12 ++--
 .../index/impl/MetadataIndexManagerTest.java       | 11 ++-
 .../index/impl/SimpleStringCriteriaFunction.java   |  4 +-
 .../AudienceRestrictionConditionValidatorTest.java |  9 +--
 .../tests/BaseAssertionValidationTest.java         | 11 ++-
 .../assertion/tests/MockAssertionValidator.java    |  4 +-
 .../tests/SAML20AssertionValidatorTest.java        |  8 +--
 ...SAML2HTTPPostSimpleSignSecurityHandlerTest.java |  4 +-
 ...edirectDeflateSignatureSecurityHandlerTest.java |  4 +-
 .../saml/saml2/encryption/tests/ECDHTest.java      |  4 +-
 ...cryptedElementTypeEncryptedKeyResolverTest.java | 15 +++--
 .../MockAssertionValidationContextBuilder.java     | 18 ++---
 .../saml2/profile/impl/ValidateAssertionsTest.java |  6 +-
 ...dataSignatureSigningParametersResolverTest.java | 28 ++++----
 .../httpclient/HttpClientSecuritySupport.java      |  6 +-
 .../httpclient/HttpClientSecuritySupportTest.java  | 22 +++---
 .../SecurityEnhancedHTTPResourceTest.java          |  5 +-
 .../impl/SecurityEnhancedHttpClientSupport.java    |  8 +--
 .../impl/SecurityEnhancedTLSSocketFactory.java     |  4 +-
 .../BasicHttpClientSecurityConfigurationTest.java  | 10 +--
 ...icHttpClientSecurityParametersResolverTest.java |  6 +-
 .../impl/BasicX509CredentialNameEvaluatorTest.java | 11 +--
 .../x509/impl/CertPathPKIXTrustEvaluatorTest.java  | 10 +--
 .../soap/common/AbstractExtensibleSOAPObject.java  |  9 ++-
 .../messaging/WSSecurityMessagingSupport.java      |  4 +-
 .../soap/wsaddressing/impl/MetadataImpl.java       | 18 ++---
 .../wsaddressing/impl/ReferenceParametersImpl.java | 23 +++----
 .../wsfed/impl/RequestedSecurityTokenImpl.java     | 19 ++----
 .../opensaml/soap/wspolicy/impl/AppliesToImpl.java | 19 +++---
 .../soap/wssecurity/impl/SecurityImpl.java         | 21 +++---
 .../impl/TransformationParametersImpl.java         | 21 +++---
 .../spring/trust/StaticPKIXFactoryBean.java        |  3 +-
 .../memcached/MemcachedStorageServiceTest.java     |  4 +-
 .../opensaml/core/xml/mock/SimpleXMLObject.java    |  4 +-
 .../support/ChainingEncryptedKeyResolver.java      |  3 +-
 .../support/InlineEncryptedKeyResolver.java        |  4 +-
 ...SimpleKeyInfoReferenceEncryptedKeyResolver.java |  4 +-
 .../SimpleRetrievalMethodEncryptedKeyResolver.java |  4 +-
 .../DefaultSecurityConfigurationBootstrap.java     | 17 +++--
 .../impl/AlgorithmIdentifierTypeImpl.java          | 10 +--
 .../encryption/impl/ConcatKDFParamsImpl.java       | 13 ++--
 .../xmlsec/encryption/impl/DerivedKeyImpl.java     | 15 ++---
 .../xmlsec/encryption/impl/PBKDF2ParamsImpl.java   | 15 ++---
 .../opensaml/xmlsec/encryption/impl/SaltImpl.java  | 17 +++--
 .../impl/BasicEncryptionParametersResolver.java    |  3 +-
 ...pulateSignatureValidationParametersHandler.java |  6 +-
 .../support/tests/DHWithExplicitKDFTest.java       |  4 +-
 .../support/tests/DHWithLegacyKDFTest.java         |  3 +-
 .../tests/InlineEncryptedKeyResolverTest.java      | 14 ++--
 .../support/tests/SimpleDecryptionTest.java        | 18 ++---
 ...leKeyInfoReferenceEncryptedKeyResolverTest.java | 11 ++-
 ...pleRetrievalMethodEncryptedKeyResolverTest.java | 13 ++--
 .../impl/BasicEncryptionConfigurationTest.java     | 13 ++--
 .../BasicEncryptionParametersResolverTest.java     | 78 +++++++++++-----------
 .../BasicSignatureSigningConfigurationTest.java    | 11 +--
 ...asicSignatureSigningParametersResolverTest.java | 44 ++++++------
 .../ChainingKeyInfoCredentialResolverTest.java     | 19 +++---
 .../xmlsec/mock/SignableSimpleXMLObject.java       | 12 +++-
 88 files changed, 466 insertions(+), 473 deletions(-)

diff --git a/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSAnyImpl.java b/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSAnyImpl.java
index ddebaca57..c74fb586d 100644
--- a/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSAnyImpl.java
+++ b/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSAnyImpl.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.core.xml.schema.impl;
 
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +29,10 @@ import org.opensaml.core.xml.schema.XSAny;
 import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Concrete implementation of {@link XSAny}.
  */
@@ -81,8 +84,8 @@ public class XSAnyImpl extends AbstractXMLObject implements XSAny {
     }
 
     /** {@inheritDoc} */
-    @Nullable public List<XMLObject> getOrderedChildren() {
-        return Collections.unmodifiableList(unknownXMLObjects);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownXMLObjects);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSDateTimeImpl.java b/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSDateTimeImpl.java
index bc4f4bce1..fdaba7bcc 100644
--- a/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSDateTimeImpl.java
+++ b/opensaml-core-impl/src/main/java/org/opensaml/core/xml/schema/impl/XSDateTimeImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.core.xml.schema.impl;
 
 import java.time.Instant;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -29,6 +28,8 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.schema.XSDateTime;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 
 /**
@@ -62,8 +63,8 @@ public class XSDateTimeImpl extends AbstractXMLObject implements XSDateTime {
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        return Collections.emptyList();
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return null;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-core-impl/src/test/java/org/opensaml/core/xml/persist/impl/FilesystemLoadSaveManagerTest.java b/opensaml-core-impl/src/test/java/org/opensaml/core/xml/persist/impl/FilesystemLoadSaveManagerTest.java
index e91111983..ca1e17992 100644
--- a/opensaml-core-impl/src/test/java/org/opensaml/core/xml/persist/impl/FilesystemLoadSaveManagerTest.java
+++ b/opensaml-core-impl/src/test/java/org/opensaml/core/xml/persist/impl/FilesystemLoadSaveManagerTest.java
@@ -23,7 +23,6 @@ import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.time.Instant;
-import java.util.Collections;
 import java.util.Comparator;
 import java.util.Iterator;
 import java.util.List;
@@ -89,7 +88,7 @@ public class FilesystemLoadSaveManagerTest extends XMLObjectBaseTestCase {
     
     @Test
     public void emptyDir() throws IOException {
-        testState(Collections.emptySet());
+        testState(CollectionSupport.emptySet());
     }
     
     @DataProvider
@@ -102,12 +101,12 @@ public class FilesystemLoadSaveManagerTest extends XMLObjectBaseTestCase {
     
     @Test(dataProvider="saveLoadUpdateRemoveParams")
     public void saveLoadUpdateRemove(Boolean buildWithObjectSourceByteArray) throws IOException {
-        testState(Collections.emptySet());
+        testState(CollectionSupport.emptySet());
         
         Assert.assertNull(manager.load("bogus"));
         
         manager.save("foo", (SimpleXMLObject) buildXMLObject(SimpleXMLObject.ELEMENT_NAME, buildWithObjectSourceByteArray));
-        testState(Collections.singleton("foo"));
+        testState(CollectionSupport.singleton("foo"));
         
         manager.save("bar", (SimpleXMLObject) buildXMLObject(SimpleXMLObject.ELEMENT_NAME, buildWithObjectSourceByteArray));
         manager.save("baz", (SimpleXMLObject) buildXMLObject(SimpleXMLObject.ELEMENT_NAME, buildWithObjectSourceByteArray));
@@ -154,20 +153,20 @@ public class FilesystemLoadSaveManagerTest extends XMLObjectBaseTestCase {
         
         Assert.assertTrue(manager.remove("bar"));
         Assert.assertTrue(manager.remove("baz"));
-        testState(Collections.emptySet());
+        testState(CollectionSupport.emptySet());
     }
     
     @Test(dataProvider="saveLoadUpdateRemoveParams")
     public void saveLoadUpdateRemoveWithIntermediateDirs(Boolean buildWithObjectSourceByteArray) throws IOException {
         manager = new FilesystemLoadSaveManager<>(baseDir, intermediateDirectoryStrategy);
         
-        testState(Collections.emptySet());
+        testState(CollectionSupport.emptySet());
         
         Assert.assertNull(manager.load("bogus"));
         
         Assert.assertFalse(new File(parentPath(baseDir, "fo"), "foo").exists());
         manager.save("foo", (SimpleXMLObject) buildXMLObject(SimpleXMLObject.ELEMENT_NAME, buildWithObjectSourceByteArray));
-        testState(Collections.singleton("foo"));
+        testState(CollectionSupport.singleton("foo"));
         Assert.assertTrue(new File(parentPath(baseDir, "fo"), "foo").exists());
         
         Assert.assertFalse(new File(parentPath(baseDir, "ba"), "bar").exists());
@@ -226,7 +225,7 @@ public class FilesystemLoadSaveManagerTest extends XMLObjectBaseTestCase {
         Assert.assertTrue(new File(parentPath(baseDir, "ba"), "baz").exists());
         Assert.assertTrue(manager.remove("bar"));
         Assert.assertTrue(manager.remove("baz"));
-        testState(Collections.emptySet());
+        testState(CollectionSupport.emptySet());
         Assert.assertFalse(new File(parentPath(baseDir, "ba"), "bar").exists());
         Assert.assertFalse(new File(parentPath(baseDir, "ba"), "baz").exists());
     }
diff --git a/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/BasicMessageHandlerChain.java b/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/BasicMessageHandlerChain.java
index 2fb551ecc..d468ec600 100644
--- a/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/BasicMessageHandlerChain.java
+++ b/opensaml-messaging-impl/src/main/java/org/opensaml/messaging/handler/impl/BasicMessageHandlerChain.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.messaging.handler.impl;
 
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -31,6 +30,7 @@ import org.opensaml.messaging.handler.MessageHandlerException;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * A basic implementation of {@link MessageHandlerChain}.
@@ -66,9 +66,9 @@ public class BasicMessageHandlerChain extends AbstractMessageHandler
      */
     public void setHandlers(@Nullable @NonnullElements final List<MessageHandler> handlers) {
         if (handlers != null) {
-            members = List.copyOf(handlers);
+            members = CollectionSupport.copyToList(handlers);
         } else {
-            members = Collections.emptyList();
+            members = CollectionSupport.emptyList();
         }
     }
 
diff --git a/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateClientTLSValidationParameters.java b/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateClientTLSValidationParameters.java
index 95311f95d..5d8c8e907 100644
--- a/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateClientTLSValidationParameters.java
+++ b/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateClientTLSValidationParameters.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.profile.action.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -38,6 +37,7 @@ import org.opensaml.security.x509.tls.ClientTLSValidationParametersResolver;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -127,8 +127,8 @@ public class PopulateClientTLSValidationParameters extends AbstractProfileAction
         } else if (configurationLookupStrategy == null) {
             configurationLookupStrategy = new Function<>() {
                 public List<ClientTLSValidationConfiguration> apply(final ProfileRequestContext input) {
-                    return Collections.singletonList(
-                            ConfigurationService.get(ClientTLSValidationConfiguration.class));
+                    return CollectionSupport.singletonList(
+                            ConfigurationService.ensure(ClientTLSValidationConfiguration.class));
                 }
             };
         }
diff --git a/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateDecryptionParameters.java b/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateDecryptionParameters.java
index 716bcbe36..8593e5df3 100644
--- a/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateDecryptionParameters.java
+++ b/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateDecryptionParameters.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.profile.action.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -38,6 +37,7 @@ import org.opensaml.xmlsec.criterion.DecryptionConfigurationCriterion;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -123,7 +123,8 @@ public class PopulateDecryptionParameters extends AbstractConditionalProfileActi
         } else if (configurationLookupStrategy == null) {
             configurationLookupStrategy = new Function<>() {
                 public List<DecryptionConfiguration> apply(final ProfileRequestContext input) {
-                    return Collections.singletonList(SecurityConfigurationSupport.getGlobalDecryptionConfiguration());
+                    return CollectionSupport.singletonList(
+                            SecurityConfigurationSupport.ensureGlobalDecryptionConfiguration());
                 }
             };
         }
diff --git a/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateSignatureValidationParameters.java b/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateSignatureValidationParameters.java
index 6d1e58da2..f4ab54651 100644
--- a/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateSignatureValidationParameters.java
+++ b/opensaml-profile-impl/src/main/java/org/opensaml/profile/action/impl/PopulateSignatureValidationParameters.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.profile.action.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -36,6 +35,7 @@ import org.opensaml.xmlsec.context.SecurityParametersContext;
 import org.opensaml.xmlsec.messaging.impl.PopulateSignatureValidationParametersHandler;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -120,8 +120,8 @@ public class PopulateSignatureValidationParameters
         } else if (configurationLookupStrategy == null) {
             configurationLookupStrategy = new Function<>() {
                 public List<SignatureValidationConfiguration> apply(final ProfileRequestContext input) {
-                    return Collections.singletonList(
-                            SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
+                    return CollectionSupport.singletonList(
+                            SecurityConfigurationSupport.ensureGlobalSignatureValidationConfiguration());
                 }
             };
         }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java
index ba3308385..16c0c3b72 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java
@@ -18,10 +18,17 @@
 package org.opensaml.saml.common.assertion;
 
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.Map;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.annotation.concurrent.NotThreadSafe;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyMap;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -32,13 +39,13 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class ValidationContext {
 
     /** Static parameters used as input to the validation process. */
-    private Map<String, Object> staticParameters;
+    @Nonnull private Map<String, Object> staticParameters;
 
     /** Dynamic parameters used as input to, and output from, the validation process. */
-    private Map<String, Object> dynamicParameters;
+    @Nonnull private Map<String, Object> dynamicParameters;
 
     /** Error messaging describing what validation check an assertion failed. */
-    private String validationFailureMessage;
+    @Nullable private String validationFailureMessage;
 
     /** Constructor. Creates a validation context with no global environment. */
     public ValidationContext() {
@@ -50,11 +57,12 @@ public class ValidationContext {
      * 
      * @param newStaticParameters static parameters for the validation evaluation
      */
-    public ValidationContext(final Map<String, Object> newStaticParameters) {
+    public ValidationContext(@Nullable final Map<String, Object> newStaticParameters) {
         if (newStaticParameters == null) {
-            staticParameters = Collections.unmodifiableMap(Collections.emptyMap());
+            staticParameters = CollectionSupport.emptyMap();
         } else {
-            staticParameters = Collections.unmodifiableMap(newStaticParameters);
+            // TODO: are nulls actually allowed?
+            staticParameters = Collections.unmodifiableMap(new HashMap<>(newStaticParameters));
         }
         dynamicParameters = new LazyMap<>();
     }
@@ -64,7 +72,7 @@ public class ValidationContext {
      * 
      * @return static parameters used as input to the validation process
      */
-    public Map<String, Object> getStaticParameters() {
+    @Nonnull @Unmodifiable @NotLive public Map<String, Object> getStaticParameters() {
         return staticParameters;
     }
 
@@ -73,7 +81,7 @@ public class ValidationContext {
      * 
      * @return dynamic parameters used input to, and output from, the validation process
      */
-    public Map<String, Object> getDynamicParameters() {
+    @Nonnull @Live public Map<String, Object> getDynamicParameters() {
         return dynamicParameters;
     }
 
@@ -82,7 +90,7 @@ public class ValidationContext {
      * 
      * @return message describing why the validation process failed
      */
-    public String getValidationFailureMessage() {
+    @Nullable public String getValidationFailureMessage() {
         return validationFailureMessage;
     }
 
@@ -91,7 +99,8 @@ public class ValidationContext {
      * 
      * @param message message describing why the validation process failed
      */
-    public void setValidationFailureMessage(final String message) {
+    public void setValidationFailureMessage(@Nullable final String message) {
         validationFailureMessage = StringSupport.trimOrNull(message);
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
index 84978bde0..cc852e457 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
@@ -20,7 +20,6 @@ package org.opensaml.saml.common.profile.logic;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 import java.util.regex.Pattern;
 
@@ -463,11 +462,11 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
             if (toMatchAlt != null) {
                 return List.of(toMatch, toMatchAlt);
             } else if (toMatch != null) {
-                return Collections.singletonList(toMatch);
+                return CollectionSupport.singletonList(toMatch);
             }
             log.warn("Unrecognized XMLObject type ({}), unable to convert to a string for comparison",
                     object.getClass().getName());
-            return Collections.emptyList();
+            return CollectionSupport.emptyList();
         }
     }
 // Checkstyle: CyclomaticComplexity OFF
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolver.java
index 30f67a67c..6b96e59a5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/EncryptedElementTypeEncryptedKeyResolver.java
@@ -18,7 +18,6 @@
 package org.opensaml.saml.saml2.encryption;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Set;
 
@@ -30,6 +29,8 @@ import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.opensaml.xmlsec.encryption.support.AbstractEncryptedKeyResolver;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * An implementation of {@link org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver}
  * which resolves {@link EncryptedKey} elements which appear as immediate children of the
@@ -57,7 +58,7 @@ public class EncryptedElementTypeEncryptedKeyResolver extends AbstractEncryptedK
      * @param recipient the recipient
      */
     public EncryptedElementTypeEncryptedKeyResolver(@Nullable final String recipient) {
-        this(Collections.singleton(recipient));
+        this(recipient != null ? CollectionSupport.singleton(recipient) : null);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java
index 67e1101aa..440179e25 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.common.binding.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -41,6 +40,7 @@ import org.opensaml.xmlsec.criterion.SignatureSigningConfigurationCriterion;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -172,8 +172,8 @@ public class PopulateSignatureSigningParametersHandler extends AbstractMessageHa
         } else if (configurationLookupStrategy == null) {
             configurationLookupStrategy = new Function<>() {
                 public List<SignatureSigningConfiguration> apply(final MessageContext input) {
-                    return Collections.singletonList(
-                            SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration());
+                    return CollectionSupport.singletonList(
+                            SecurityConfigurationSupport.ensureGlobalSignatureSigningConfiguration());
                 }
             };
         }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java
index 34430775f..44bc650d2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.common.profile.impl;
 
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -25,6 +24,7 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NullableElements;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -103,7 +103,8 @@ public class ChainingNameIdentifierGenerator<NameIdType extends SAMLObject>
         List<NameIdentifierGenerator<NameIdType>> generators = nameIdGeneratorMap.get(format);
         if (generators.isEmpty() && defaultNameIdGenerator != null) {
             log.debug("No generators installed for Format {}, trying default/fallback method", format);
-            generators = Collections.singletonList(defaultNameIdGenerator);
+            assert defaultNameIdGenerator != null;
+            generators = CollectionSupport.singletonList(defaultNameIdGenerator);
         }
         
         for (final NameIdentifierGenerator<NameIdType> generator : generators) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/PopulateSignatureSigningParameters.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/PopulateSignatureSigningParameters.java
index c49cf9cd1..5059f0080 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/PopulateSignatureSigningParameters.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/PopulateSignatureSigningParameters.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.common.profile.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -40,6 +39,7 @@ import org.opensaml.xmlsec.context.SecurityParametersContext;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -179,8 +179,8 @@ public class PopulateSignatureSigningParameters
         } else if (configurationLookupStrategy == null) {
             configurationLookupStrategy = new Function<>() {
                 public List<SignatureSigningConfiguration> apply(final ProfileRequestContext input) {
-                    return Collections.singletonList(
-                            SecurityConfigurationSupport.getGlobalSignatureSigningConfiguration());
+                    return CollectionSupport.singletonList(
+                            SecurityConfigurationSupport.ensureGlobalSignatureSigningConfiguration());
                 }
             };
         }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/DigestMethodImpl.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/DigestMethodImpl.java
index cedb1fb1b..366b3bcdb 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/DigestMethodImpl.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/DigestMethodImpl.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.ext.saml2alg.impl;
 
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -32,6 +31,7 @@ import org.opensaml.saml.ext.saml2alg.DigestMethod;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * Implementation of {@link DigestMethod}.
@@ -82,7 +82,7 @@ public class DigestMethodImpl extends AbstractXMLObject implements DigestMethod
 
     /** {@inheritDoc} */
     @Nullable @NotLive @Unmodifiable public List<XMLObject> getOrderedChildren() {
-        return Collections.unmodifiableList(unknownChildren);
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/QueryDescriptorTypeImpl.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/QueryDescriptorTypeImpl.java
index d7c75dba8..75faade95 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/QueryDescriptorTypeImpl.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/QueryDescriptorTypeImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.saml.ext.saml2mdquery.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -33,6 +32,7 @@ import org.opensaml.saml.saml2.metadata.impl.RoleDescriptorImpl;
 
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * Concrete implementation of {@link QueryDescriptorType}.
@@ -100,7 +100,7 @@ public abstract class QueryDescriptorTypeImpl extends RoleDescriptorImpl impleme
         children.addAll(super.getOrderedChildren());
         children.addAll(nameIDFormats);
         
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
index 9e698d44e..875dc3698 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
@@ -18,7 +18,6 @@
 package org.opensaml.saml.metadata.resolver.filter.impl;
 
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -56,6 +55,7 @@ import com.google.common.collect.Multimap;
 
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -157,8 +157,8 @@ public class AlgorithmFilter extends AbstractInitializableComponent implements M
      */
     protected void filterEntityDescriptor(@Nonnull final EntityDescriptor descriptor) {
         
-        Set<String> existingDigests = Collections.emptySet();
-        Set<String> existingSignings = Collections.emptySet();
+        Set<String> existingDigests = CollectionSupport.emptySet();
+        Set<String> existingSignings = CollectionSupport.emptySet();
         final Extensions exts = descriptor.getExtensions();
         if (exts != null) {
             existingDigests = exts.getUnknownXMLObjects(DigestMethod.DEFAULT_ELEMENT_NAME)
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
index ff8d3aa71..57baea6af 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
@@ -22,7 +22,6 @@ import java.net.MalformedURLException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -163,7 +162,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
                 assert sourceID != null;
                 final ArtifactSourceIDMetadataIndexKey key = new ArtifactSourceIDMetadataIndexKey(sourceID);
                 log.trace("For entityID '{}' produced artifact SourceID index key: {}", entityID, key);
-                return Collections.<MetadataIndexKey>singleton(key);
+                return CollectionSupport.singleton(key);
             } catch (final NoSuchAlgorithmException e) {
                 // SHA-1 should be supported in every JVM, so this should never happen.
                 log.error("Digest algorithm '{}' was invalid for encoding artifact SourceID", 
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java
index f3c7978d4..5b1e63d4c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.saml1.profile.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -289,7 +288,7 @@ public class AddNameIdentifierToSubjects extends AbstractProfileAction {
                 if (outboundMessage == null) {
                     return null;
                 } else if (outboundMessage instanceof Assertion) {
-                    return Collections.singletonList((Assertion) outboundMessage);
+                    return CollectionSupport.singletonList((Assertion) outboundMessage);
                 } else if (outboundMessage instanceof Response) {
                     return ((Response) outboundMessage).getAssertions();
                 }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java
index 6925074ca..3c1853fe1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java
@@ -18,7 +18,6 @@
 package org.opensaml.saml.saml2.binding.security.impl;
 
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -35,6 +34,7 @@ import org.opensaml.saml.saml2.core.RequestAbstractType;
 import org.opensaml.saml.saml2.core.StatusResponseType;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -76,7 +76,7 @@ public class ExtractChannelBindingsExtensionsHandler extends AbstractMessageHand
         
         final List<XMLObject> bindings = extensions != null
                 ? extensions.getUnknownXMLObjects(ChannelBindings.DEFAULT_ELEMENT_NAME)
-                        : Collections.<XMLObject>emptyList();
+                        : CollectionSupport.emptyList();
         if (bindings.isEmpty()) {
             log.debug("{} Message did not contain any ChannelBindings extensions", getLogPrefix());
             return;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
index 815887d15..a0682d3b9 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
@@ -19,7 +19,6 @@ package org.opensaml.saml.security.impl;
 
 import java.security.Key;
 import java.security.PublicKey;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.function.Predicate;
@@ -287,8 +286,8 @@ public class SAMLMetadataEncryptionParametersResolver extends BasicEncryptionPar
         final SAMLMDCredentialContext metadataCredContext = 
                 credContextSet != null ? credContextSet.get(SAMLMDCredentialContext.class) : null;
         
-        List<String> metadataKeyWrapAlgorithms = Collections.emptyList();
-        List<String> metadataDataEncryptionAlgorithms = Collections.emptyList(); 
+        List<String> metadataKeyWrapAlgorithms = CollectionSupport.emptyList();
+        List<String> metadataDataEncryptionAlgorithms = CollectionSupport.emptyList(); 
         if (metadataCredContext != null) {
             final List<EncryptionMethod> methods = metadataCredContext.getEncryptionMethods();
             if (methods != null) {
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
index 0cab75121..046b7c962 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/binding/security/impl/SAMLProtocolMessageXMLSignatureSecurityHandlerTest.java
@@ -19,7 +19,6 @@ package org.opensaml.saml.common.binding.security.impl;
 
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
@@ -45,6 +44,8 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 
 /**
  * Test SAML protocol message XML signature message handler.
@@ -180,7 +181,7 @@ public class SAMLProtocolMessageXMLSignatureSecurityHandlerTest extends XMLObjec
      */
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testBlacklistedSigntureAlgorithm() throws MessageHandlerException {
-        sigValParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigValParams.setExcludedAlgorithms(CollectionSupport.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         
         trustedCredentials.add(signingX509Cred);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityAttributesPredicateTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityAttributesPredicateTest.java
index 854b65c5d..4cdccdba7 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityAttributesPredicateTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityAttributesPredicateTest.java
@@ -17,9 +17,9 @@
 
 package org.opensaml.saml.common.profile.logic.tests;
 
-import java.util.Collections;
 import java.util.regex.Pattern;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.spring.resource.ResourceHelper;
 
@@ -39,6 +39,7 @@ import org.testng.annotations.Test;
 /**
  * Unit tests for {@link EntityAttributesPredicate}.
  */
+ at SuppressWarnings("javadoc")
 public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
 
     private ResourceBackedMetadataResolver metadataProvider;
@@ -58,9 +59,9 @@ public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
     public void testWrongName() throws Exception {
 
         final Candidate candidate = new Candidate("urn:foo:bar", Attribute.URI_REFERENCE);
-        candidate.setValues(Collections.singletonList("bar"));
+        candidate.setValues(CollectionSupport.singletonList("bar"));
         final EntityAttributesPredicate condition =
-                new EntityAttributesPredicate(Collections.singletonList(candidate), false);
+                new EntityAttributesPredicate(CollectionSupport.singletonList(candidate), false);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
@@ -73,9 +74,9 @@ public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
     public void testWrongNameFormat() throws Exception {
 
         final Candidate candidate = new Candidate("urn:foo", Attribute.BASIC);
-        candidate.setValues(Collections.singletonList("bar"));
+        candidate.setValues(CollectionSupport.singletonList("bar"));
         final EntityAttributesPredicate condition =
-                new EntityAttributesPredicate(Collections.singletonList(candidate), false);
+                new EntityAttributesPredicate(CollectionSupport.singletonList(candidate), false);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
@@ -88,9 +89,9 @@ public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
     public void testGroupUnspecified() throws Exception {
 
         final Candidate candidate = new Candidate("urn:foo", null);
-        candidate.setValues(Collections.singletonList("bar"));
+        candidate.setValues(CollectionSupport.singletonList("bar"));
         final EntityAttributesPredicate condition =
-                new EntityAttributesPredicate(Collections.singletonList(candidate), false);
+                new EntityAttributesPredicate(CollectionSupport.singletonList(candidate), false);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
@@ -103,9 +104,9 @@ public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
     public void testGroupExact() throws Exception {
 
         final Candidate candidate = new Candidate("urn:foo", Attribute.URI_REFERENCE);
-        candidate.setValues(Collections.singletonList("bar"));
+        candidate.setValues(CollectionSupport.singletonList("bar"));
         final EntityAttributesPredicate condition =
-                new EntityAttributesPredicate(Collections.singletonList(candidate), false);
+                new EntityAttributesPredicate(CollectionSupport.singletonList(candidate), false);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
@@ -117,9 +118,9 @@ public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
     @Test
     public void testIdP1475()  throws Exception {
         final Candidate candidate = new Candidate("https://its.umich.edu/identity/activationCondition/isMemberOf");
-        candidate.setValues(Collections.singletonList("true"));
+        candidate.setValues(CollectionSupport.singletonList("true"));
         final EntityAttributesPredicate condition =
-                new EntityAttributesPredicate(Collections.singletonList(candidate));
+                new EntityAttributesPredicate(CollectionSupport.singletonList(candidate));
 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-1475.example.org")));
@@ -131,10 +132,10 @@ public class EntityAttributesPredicateTest extends XMLObjectBaseTestCase {
     public void testGroupAdditional() throws Exception {
 
         final Candidate candidate = new Candidate("urn:foo", Attribute.URI_REFERENCE);
-        candidate.setValues(Collections.singletonList("bar"));
-        candidate.setRegexps(Collections.singletonList(Pattern.compile("baz")));
+        candidate.setValues(CollectionSupport.singletonList("bar"));
+        candidate.setRegexps(CollectionSupport.singletonList(Pattern.compile("baz")));
         final EntityAttributesPredicate condition =
-                new EntityAttributesPredicate(Collections.singletonList(candidate), false);
+                new EntityAttributesPredicate(CollectionSupport.singletonList(candidate), false);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityGroupNamePredicateTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityGroupNamePredicateTest.java
index fb1106dd7..bc187c399 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityGroupNamePredicateTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/common/profile/logic/tests/EntityGroupNamePredicateTest.java
@@ -17,9 +17,6 @@
 
 package org.opensaml.saml.common.profile.logic.tests;
 
-import java.util.Arrays;
-import java.util.Collections;
-
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.spring.resource.ResourceHelper;
@@ -75,7 +72,7 @@ public class EntityGroupNamePredicateTest extends XMLObjectBaseTestCase {
     public void testNoMatch() throws Exception {
 
         final EntityGroupNamePredicate condition =
-                new EntityGroupNamePredicate(Collections.singletonList("GroupBad"), metadataProvider);
+                new EntityGroupNamePredicate(CollectionSupport.singletonList("GroupBad"), metadataProvider);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
@@ -88,7 +85,7 @@ public class EntityGroupNamePredicateTest extends XMLObjectBaseTestCase {
     public void testGroupMatch() throws Exception {
 
         final EntityGroupNamePredicate condition =
-                new EntityGroupNamePredicate(Collections.singletonList("GroupTop"), metadataProvider);
+                new EntityGroupNamePredicate(CollectionSupport.singletonList("GroupTop"), metadataProvider);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
@@ -101,7 +98,7 @@ public class EntityGroupNamePredicateTest extends XMLObjectBaseTestCase {
     public void testGroupsMatch() throws Exception {
 
         final EntityGroupNamePredicate condition =
-                new EntityGroupNamePredicate(Arrays.asList("GroupBad", "GroupSub2"), metadataProvider);
+                new EntityGroupNamePredicate(CollectionSupport.listOf("GroupBad", "GroupSub2"), metadataProvider);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-sub2a.example.org")));
@@ -114,7 +111,7 @@ public class EntityGroupNamePredicateTest extends XMLObjectBaseTestCase {
     public void testAffiliationMatch() throws Exception {
 
         final EntityGroupNamePredicate condition =
-                new EntityGroupNamePredicate(Collections.singletonList("https://affiliation.example.org"), metadataProvider);
+                new EntityGroupNamePredicate(CollectionSupport.singletonList("https://affiliation.example.org"), metadataProvider);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-sub2a.example.org")));
@@ -127,7 +124,7 @@ public class EntityGroupNamePredicateTest extends XMLObjectBaseTestCase {
     public void testAffiliationNoMatch() throws Exception {
 
         final EntityGroupNamePredicate condition =
-                new EntityGroupNamePredicate(Collections.singletonList("https://affiliation.example.org"), metadataProvider);
+                new EntityGroupNamePredicate(CollectionSupport.singletonList("https://affiliation.example.org"), metadataProvider);
                 
         final EntityDescriptor entity =
                 metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion("https://idp-top.example.org")));
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilterTest.java
index 1842e96c2..1177d9cbc 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilterTest.java
@@ -20,7 +20,6 @@ package org.opensaml.saml.metadata.resolver.filter.impl;
 import java.io.File;
 import java.net.URL;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Predicate;
 
@@ -131,7 +130,7 @@ public class EntityAttributesFilterTest extends XMLObjectBaseTestCase implements
         final XSString value = valueBuilder.buildObject(AttributeValue.DEFAULT_ELEMENT_NAME, XSString.TYPE_NAME);
         value.setValue("bar");
         tag.getAttributeValues().add(value);
-        final Collection<Attribute> tags = Collections.singletonList(tag);
+        final Collection<Attribute> tags = CollectionSupport.singletonList(tag);
         
         final EntityAttributesFilter filter = new EntityAttributesFilter();
         filter.setRules(CollectionSupport.singletonMap(this, tags));
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilterTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilterTest.java
index 83e9cf5ca..2f0644ac2 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilterTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/PredicateFilterTest.java
@@ -17,8 +17,7 @@
 
 package org.opensaml.saml.metadata.resolver.filter.impl;
 
-import java.util.Collections;
-
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.spring.resource.ResourceHelper;
 
@@ -66,7 +65,7 @@ public class PredicateFilterTest extends XMLObjectBaseTestCase {
         final String denied = "urn:mace:incommon:osu.edu";
         final String osu = "urn:mace:incommon:osu.edu";
 
-        final EntityIdPredicate condition = new EntityIdPredicate(Collections.singletonList(denied));
+        final EntityIdPredicate condition = new EntityIdPredicate(CollectionSupport.singletonList(denied));
         
         metadataProvider.setMetadataFilter(new PredicateFilter(Direction.EXCLUDE, condition));
         metadataProvider.initialize();
@@ -92,7 +91,7 @@ public class PredicateFilterTest extends XMLObjectBaseTestCase {
         final String denied = "urn:mace:incommon:osu.edu";
         final String osu = "urn:mace:incommon:osu.edu";
 
-        final EntityIdPredicate condition = new EntityIdPredicate(Collections.singletonList(allowed));
+        final EntityIdPredicate condition = new EntityIdPredicate(CollectionSupport.singletonList(allowed));
         
         metadataProvider.setMetadataFilter(new PredicateFilter(Direction.INCLUDE, condition));
         metadataProvider.initialize();
@@ -103,7 +102,8 @@ public class PredicateFilterTest extends XMLObjectBaseTestCase {
         entity = metadataProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion(allowed)));
         Assert.assertNotNull(entity);
         
-        singleEntityProvider.setMetadataFilter(new PredicateFilter(Direction.INCLUDE,  new EntityIdPredicate(Collections.singletonList(osu))));
+        singleEntityProvider.setMetadataFilter(new PredicateFilter(Direction.INCLUDE,
+                new EntityIdPredicate(CollectionSupport.singletonList(osu))));
         singleEntityProvider.initialize();
         
         entity = singleEntityProvider.resolveSingle(new CriteriaSet(new EntityIdCriterion(osu)));
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ScriptedFunctionTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ScriptedFunctionTest.java
index 7e828c34c..696ee7a75 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ScriptedFunctionTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/ScriptedFunctionTest.java
@@ -18,7 +18,6 @@
 package org.opensaml.saml.metadata.resolver.filter.impl;
 
 import java.io.IOException;
-import java.util.Collections;
 import java.util.Set;
 
 import javax.script.ScriptException;
@@ -32,6 +31,7 @@ import org.springframework.core.io.ClassPathResource;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resource.Resource;
 import net.shibboleth.shared.spring.resource.ResourceHelper;
 
@@ -68,7 +68,7 @@ public class ScriptedFunctionTest extends XMLObjectBaseTestCase {
     @Test public void customScript() throws ScriptException {
         
         final ScriptedTrustedNamesFunction what = ScriptedTrustedNamesFunction.inlineScript("custom;");
-        what.setCustomObject(Collections.singleton("String"));
+        what.setCustomObject(CollectionSupport.singleton("String"));
         
         final Set<String> s = what.apply(makeObject());
         assert s != null;
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
index 118f2c916..34c3ee6be 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/filter/impl/SignatureValidationFilterExplicitKeyTest.java
@@ -19,8 +19,8 @@ package org.opensaml.saml.metadata.resolver.filter.impl;
 
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
-import java.util.Collections;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.xml.XMLParserException;
@@ -139,7 +139,7 @@ public class SignatureValidationFilterExplicitKeyTest extends XMLObjectBaseTestC
         SignatureValidationFilter filter = new SignatureValidationFilter(switchSigTrustEngine);
         
         SignatureValidationParameters sigParams = new SignatureValidationParameters();
-        sigParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigParams.setExcludedAlgorithms(CollectionSupport.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         CriteriaSet defaultCriteriaSet = new CriteriaSet(new SignatureValidationParametersCriterion(sigParams));
         filter.setDefaultCriteria(defaultCriteriaSet);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
index 8c8523874..bcc8a772d 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
@@ -20,7 +20,6 @@ package org.opensaml.saml.metadata.resolver.impl;
 import java.security.MessageDigest;
 import java.security.SecureRandom;
 import java.util.Arrays;
-import java.util.Collections;
 
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
@@ -40,6 +39,7 @@ import com.google.common.base.Predicates;
 
 import net.shibboleth.shared.codec.StringDigester;
 import net.shibboleth.shared.codec.StringDigester.OutputFormat;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.httpclient.HttpClientBuilder;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.testing.RepositorySupport;
@@ -274,7 +274,7 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
         String entityID = "urn:mace:incommon:osu.edu";
         
         MetadataQueryProtocolRequestURLBuilder requestURLBuilder = new MetadataQueryProtocolRequestURLBuilder(baseURL,
-                Collections.singletonList(new SAMLArtifactURLBuilder()));
+                CollectionSupport.singletonList(new SAMLArtifactURLBuilder()));
         
         httpClientBuilder.setConnectionDisregardTLSCertificate(true);
         resolver = new FunctionDrivenDynamicHTTPMetadataResolver(httpClientBuilder.buildClient());
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
index 90e23f025..bd71fd03f 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
@@ -22,7 +22,6 @@ import java.io.InputStream;
 import java.net.URISyntaxException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
-import java.util.Collections;
 import java.util.Set;
 
 import org.apache.hc.client5.http.socket.LayeredConnectionSocketFactory;
@@ -50,6 +49,7 @@ import org.testng.annotations.Test;
 
 import com.google.common.io.ByteStreams;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.httpclient.HttpClientBuilder;
 import net.shibboleth.shared.logic.PredicateSupport;
@@ -425,9 +425,9 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
     public static TrustEngine<? super X509Credential> buildPKIXTrustEngine(String cert, String name, boolean nameCheckEnabled) throws URISyntaxException, CertificateException, IOException {
         final InputStream certStream = FileBackedHTTPMetadataResolver.class.getResourceAsStream((HTTPMetadataResolverTest.DATA_PATH + cert));
         final X509Certificate rootCert = X509Support.decodeCertificate(ByteStreams.toByteArray(certStream));
-        final PKIXValidationInformation info = new BasicPKIXValidationInformation(Collections.singletonList(rootCert), null, 5);
-        final Set<String> trustedNames = name != null ? Collections.singleton(name) : Collections.emptySet();
-        final StaticPKIXValidationInformationResolver resolver = new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames);
+        final PKIXValidationInformation info = new BasicPKIXValidationInformation(CollectionSupport.singletonList(rootCert), null, 5);
+        final Set<String> trustedNames = name != null ? CollectionSupport.singleton(name) : CollectionSupport.emptySet();
+        final StaticPKIXValidationInformationResolver resolver = new StaticPKIXValidationInformationResolver(CollectionSupport.singletonList(info), trustedNames);
         return new PKIXX509CredentialTrustEngine(resolver,
                 new CertPathPKIXTrustEvaluator(),
                 (nameCheckEnabled ? new BasicX509CredentialNameEvaluator() : null));
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/ConstantEntityDescriptorFunction.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/ConstantEntityDescriptorFunction.java
index d0c3d3c40..893e0095e 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/ConstantEntityDescriptorFunction.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/ConstantEntityDescriptorFunction.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.metadata.resolver.index.impl;
 
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.function.Function;
@@ -28,6 +27,7 @@ import org.opensaml.saml.metadata.resolver.index.MetadataIndexKey;
 import org.opensaml.saml.metadata.resolver.index.SimpleStringMetadataIndexKey;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -43,7 +43,7 @@ public class ConstantEntityDescriptorFunction implements Function<EntityDescript
 
     @Nullable public Set<MetadataIndexKey> apply(@Nullable EntityDescriptor input) {
         if (input == null) {
-            return Collections.emptySet();
+            return CollectionSupport.emptySet();
         }
         HashSet<MetadataIndexKey> result = new HashSet<>();
         if (input != null) {
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndexTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndexTest.java
index a06d3e84c..45712b8b4 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndexTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndexTest.java
@@ -19,7 +19,6 @@ package org.opensaml.saml.metadata.resolver.index.impl;
 
 import java.io.UnsupportedEncodingException;
 import java.security.NoSuchAlgorithmException;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
@@ -45,6 +44,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.PredicateSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -225,7 +225,7 @@ public class EndpointMetadataIndexTest extends XMLObjectBaseTestCase {
     public void testGenerateKeysFromDescriptorIndexOnlyACS() {
         Map<QName, Set<QName>> indexableEndpoints = new HashMap<>();
         indexableEndpoints.put(SPSSODescriptor.DEFAULT_ELEMENT_NAME,
-                Collections.singleton(AssertionConsumerService.DEFAULT_ELEMENT_NAME));
+                CollectionSupport.singleton(AssertionConsumerService.DEFAULT_ELEMENT_NAME));
         EndpointMetadataIndex metadataIndex = 
                 new EndpointMetadataIndex(new EndpointMetadataIndex.DefaultEndpointSelectionPredicate(indexableEndpoints));
         
@@ -249,25 +249,25 @@ public class EndpointMetadataIndexTest extends XMLObjectBaseTestCase {
         predicate = new EndpointMetadataIndex.DefaultEndpointSelectionPredicate();
         Assert.assertFalse(predicate.test(endpoint));
         
-        indexableEndpoints = Collections.emptyMap();
+        indexableEndpoints = CollectionSupport.emptyMap();
         predicate = new EndpointMetadataIndex.DefaultEndpointSelectionPredicate(indexableEndpoints);
         Assert.assertFalse(predicate.test(endpoint));
         
         indexableEndpoints = new HashMap<>();
         indexableEndpoints.put(SPSSODescriptor.DEFAULT_ELEMENT_NAME,
-                Collections.singleton(ArtifactResolutionService.DEFAULT_ELEMENT_NAME));
+                CollectionSupport.singleton(ArtifactResolutionService.DEFAULT_ELEMENT_NAME));
         predicate = new EndpointMetadataIndex.DefaultEndpointSelectionPredicate(indexableEndpoints);
         Assert.assertFalse(predicate.test(endpoint));
         
         indexableEndpoints = new HashMap<>();
         indexableEndpoints.put(IDPSSODescriptor.DEFAULT_ELEMENT_NAME,
-                Collections.singleton(ArtifactResolutionService.DEFAULT_ELEMENT_NAME));
+                CollectionSupport.singleton(ArtifactResolutionService.DEFAULT_ELEMENT_NAME));
         predicate = new EndpointMetadataIndex.DefaultEndpointSelectionPredicate(indexableEndpoints);
         Assert.assertFalse(predicate.test(endpoint));
         
         indexableEndpoints = new HashMap<>();
         indexableEndpoints.put(SPSSODescriptor.DEFAULT_ELEMENT_NAME,
-                Collections.singleton(AssertionConsumerService.DEFAULT_ELEMENT_NAME));
+                CollectionSupport.singleton(AssertionConsumerService.DEFAULT_ELEMENT_NAME));
         predicate = new EndpointMetadataIndex.DefaultEndpointSelectionPredicate(indexableEndpoints);
         Assert.assertTrue(predicate.test(endpoint));
     }
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManagerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManagerTest.java
index 399ee60aa..b570ea724 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManagerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManagerTest.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.metadata.resolver.index.impl;
 
-import java.util.Collections;
 import java.util.Optional;
 import java.util.Set;
 import java.util.function.Function;
@@ -82,7 +81,7 @@ public class MetadataIndexManagerTest extends XMLObjectBaseTestCase {
                         new SimpleStringCriteriaFunction());
         
         MetadataIndexManager<EntityDescriptor> manager =
-                new MetadataIndexManager<>(Collections.singleton(functionIndex), extractionFunction);
+                new MetadataIndexManager<>(CollectionSupport.singleton(functionIndex), extractionFunction);
         
         criteriaSet.clear();
         criteriaSet.add(critAEntity);
@@ -184,7 +183,7 @@ public class MetadataIndexManagerTest extends XMLObjectBaseTestCase {
                         new SimpleStringCriteriaFunction());
         
         MetadataIndexManager<EntityDescriptor> manager =
-                new MetadataIndexManager<>(Collections.singleton(functionIndex), extractionFunction);
+                new MetadataIndexManager<>(CollectionSupport.singleton(functionIndex), extractionFunction);
         
         manager.indexEntityDescriptor(a);
         manager.indexEntityDescriptor(b);
@@ -202,7 +201,7 @@ public class MetadataIndexManagerTest extends XMLObjectBaseTestCase {
         RoleMetadataIndex roleIndex = new RoleMetadataIndex();
         
         MetadataIndexManager<EntityDescriptor> manager =
-                new MetadataIndexManager<>(Collections.singleton(roleIndex), extractionFunction);
+                new MetadataIndexManager<>(CollectionSupport.singleton(roleIndex), extractionFunction);
         
         manager.indexEntityDescriptor(a);
         manager.indexEntityDescriptor(b);
@@ -351,7 +350,7 @@ public class MetadataIndexManagerTest extends XMLObjectBaseTestCase {
     @Test
     public void testNoIndexes() {
         MetadataIndexManager<EntityDescriptor> manager =
-                new MetadataIndexManager<>(Collections.emptySet(), extractionFunction);
+                new MetadataIndexManager<>(CollectionSupport.emptySet(), extractionFunction);
         
         manager.indexEntityDescriptor(a);
         
@@ -368,7 +367,7 @@ public class MetadataIndexManagerTest extends XMLObjectBaseTestCase {
                         new SimpleStringCriteriaFunction());
         
         MetadataIndexManager<EntityDescriptor> manager =
-                new MetadataIndexManager<>(Collections.singleton(functionIndex), extractionFunction);
+                new MetadataIndexManager<>(CollectionSupport.singleton(functionIndex), extractionFunction);
         
         manager.indexEntityDescriptor(a);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SimpleStringCriteriaFunction.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SimpleStringCriteriaFunction.java
index fcdb2476b..b1ac21909 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SimpleStringCriteriaFunction.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/index/impl/SimpleStringCriteriaFunction.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.metadata.resolver.index.impl;
 
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.function.Function;
@@ -27,6 +26,7 @@ import javax.annotation.Nullable;
 import org.opensaml.saml.metadata.resolver.index.MetadataIndexKey;
 import org.opensaml.saml.metadata.resolver.index.SimpleStringMetadataIndexKey;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 @SuppressWarnings("javadoc")
@@ -34,7 +34,7 @@ public class SimpleStringCriteriaFunction implements Function<CriteriaSet, Set<M
     
     @Nullable public Set<MetadataIndexKey> apply(@Nullable CriteriaSet input) {
         if (input == null) {
-            return Collections.emptySet();
+            return CollectionSupport.emptySet();
         }
         SimpleStringCriterion crit = input.get(SimpleStringCriterion.class);
         HashSet<MetadataIndexKey> result = new HashSet<>();
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AudienceRestrictionConditionValidatorTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AudienceRestrictionConditionValidatorTest.java
index fa88f7716..f3f158841 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AudienceRestrictionConditionValidatorTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/impl/AudienceRestrictionConditionValidatorTest.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.saml2.assertion.impl;
 
-import java.util.Collections;
 import java.util.Map;
 
 import org.opensaml.saml.common.assertion.AssertionValidationException;
@@ -32,6 +31,8 @@ import org.opensaml.saml.saml2.core.OneTimeUse;
 import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
 @SuppressWarnings({"null", "javadoc"})
 public class AudienceRestrictionConditionValidatorTest extends BaseAssertionValidationTest {
     
@@ -56,7 +57,7 @@ public class AudienceRestrictionConditionValidatorTest extends BaseAssertionVali
     @Test
     public void testValid() throws AssertionValidationException {
         Map<String,Object> staticParams = buildBasicStaticParameters();
-        staticParams.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, Collections.singleton(expectedAudienceURI));
+        staticParams.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, CollectionSupport.singleton(expectedAudienceURI));
         
         ValidationContext validationContext = new ValidationContext(staticParams);
         
@@ -90,7 +91,7 @@ public class AudienceRestrictionConditionValidatorTest extends BaseAssertionVali
     public void testConditionWithNoAudiences() throws AssertionValidationException {
         // This is syntactically invalid per the schema, and should validate as invalid.
         Map<String,Object> staticParams = buildBasicStaticParameters();
-        staticParams.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, Collections.singleton(expectedAudienceURI));
+        staticParams.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, CollectionSupport.singleton(expectedAudienceURI));
         
         ((AudienceRestriction)condition).getAudiences().clear();
         
@@ -106,7 +107,7 @@ public class AudienceRestrictionConditionValidatorTest extends BaseAssertionVali
         getConditions().getConditions().add(condition);
         
         Map<String,Object> staticParams = buildBasicStaticParameters();
-        staticParams.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, Collections.singleton(expectedAudienceURI));
+        staticParams.put(SAML2AssertionValidationParameters.COND_VALID_AUDIENCES, CollectionSupport.singleton(expectedAudienceURI));
         
         ValidationContext validationContext = new ValidationContext(staticParams);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/BaseAssertionValidationTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/BaseAssertionValidationTest.java
index 426b4ddde..7a34b2be8 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/BaseAssertionValidationTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/BaseAssertionValidationTest.java
@@ -15,7 +15,6 @@
  * limitations under the License.
  */
 
-
 package org.opensaml.saml.saml2.assertion.tests;
 
 import java.io.File;
@@ -30,7 +29,6 @@ import java.security.cert.X509Certificate;
 import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -67,6 +65,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 @SuppressWarnings("javadoc")
@@ -175,15 +174,15 @@ public class BaseAssertionValidationTest extends XMLObjectBaseTestCase {
         
         params.put(SAML2AssertionValidationParameters.CLOCK_SKEW, CLOCK_SKEW);
         
-        params.put(SAML2AssertionValidationParameters.VALID_ISSUERS, Collections.singleton(ISSUER));
+        params.put(SAML2AssertionValidationParameters.VALID_ISSUERS, CollectionSupport.singleton(ISSUER));
         
         params.put(SAML2AssertionValidationParameters.SC_VALID_IN_RESPONSE_TO, SUBJECT_CONFIRMATION_IN_RESPONSE_TO);
         
         params.put(SAML2AssertionValidationParameters.SC_VALID_RECIPIENTS, 
-                Collections.singleton(SUBJECT_CONFIRMATION_RECIPIENT));
+                CollectionSupport.singleton(SUBJECT_CONFIRMATION_RECIPIENT));
         try {
             params.put(SAML2AssertionValidationParameters.SC_VALID_ADDRESSES, 
-                    Collections.singleton(InetAddress.getByName(SUBJECT_CONFIRMATION_ADDRESS)));
+                    CollectionSupport.singleton(InetAddress.getByName(SUBJECT_CONFIRMATION_ADDRESS)));
         } catch(UnknownHostException e) {
             Assert.fail("Invalid address: " + SUBJECT_CONFIRMATION_ADDRESS);
         }
@@ -192,7 +191,7 @@ public class BaseAssertionValidationTest extends XMLObjectBaseTestCase {
         
         try {
             params.put(SAML2AssertionValidationParameters.STMT_AUTHN_VALID_ADDRESSES, 
-                    Collections.singleton(InetAddress.getByName(AUTHN_STATEMENT_ADDRESS)));
+                    CollectionSupport.singleton(InetAddress.getByName(AUTHN_STATEMENT_ADDRESS)));
         } catch(UnknownHostException e) {
             Assert.fail("Invalid address: " + AUTHN_STATEMENT_ADDRESS);
         }
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/MockAssertionValidator.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/MockAssertionValidator.java
index 440c97606..0c511481c 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/MockAssertionValidator.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/MockAssertionValidator.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.saml2.assertion.tests;
 
-import java.util.Collections;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
@@ -28,6 +27,7 @@ import org.opensaml.saml.common.assertion.ValidationResult;
 import org.opensaml.saml.saml2.assertion.SAML20AssertionValidator;
 import org.opensaml.saml.saml2.core.Assertion;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -37,7 +37,7 @@ public class MockAssertionValidator extends SAML20AssertionValidator {
     private Map<Assertion, Object> resultsMap;
 
     public MockAssertionValidator(Map<Assertion, Object> results) {
-        super(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, null, null);
+        super(CollectionSupport.emptyList(), CollectionSupport.emptyList(), CollectionSupport.emptyList(), null, null, null);
         resultsMap = Constraint.isNotNull(results, "Results map was null");
     }
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/SAML20AssertionValidatorTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/SAML20AssertionValidatorTest.java
index ba8fd12a8..77d7ec6bb 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/SAML20AssertionValidatorTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/assertion/tests/SAML20AssertionValidatorTest.java
@@ -29,7 +29,6 @@ import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -76,6 +75,7 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 
@@ -393,7 +393,7 @@ public class SAML20AssertionValidatorTest extends BaseAssertionValidationTest {
         Map<String,Object> staticParams = buildBasicStaticParameters();
         staticParams.put(SAML2AssertionValidationParameters.SIGNATURE_REQUIRED, false);
         staticParams.put(SAML2AssertionValidationParameters.COND_REQUIRED_CONDITIONS,
-                Collections.singleton(MockCondition.ELEMENT_NAME));
+                CollectionSupport.singleton(MockCondition.ELEMENT_NAME));
         
         ValidationContext validationContext = new ValidationContext(staticParams);
         
@@ -415,7 +415,7 @@ public class SAML20AssertionValidatorTest extends BaseAssertionValidationTest {
         Map<String,Object> staticParams = buildBasicStaticParameters();
         staticParams.put(SAML2AssertionValidationParameters.SIGNATURE_REQUIRED, false);
         staticParams.put(SAML2AssertionValidationParameters.COND_REQUIRED_CONDITIONS,
-                Collections.singleton(MockCondition.ELEMENT_NAME));
+                CollectionSupport.singleton(MockCondition.ELEMENT_NAME));
         
         ValidationContext validationContext = new ValidationContext(staticParams);
         
@@ -436,7 +436,7 @@ public class SAML20AssertionValidatorTest extends BaseAssertionValidationTest {
         Map<String,Object> staticParams = buildBasicStaticParameters();
         staticParams.put(SAML2AssertionValidationParameters.SIGNATURE_REQUIRED, false);
         staticParams.put(SAML2AssertionValidationParameters.COND_REQUIRED_CONDITIONS,
-                Collections.singleton(MockCondition.ELEMENT_NAME));
+                CollectionSupport.singleton(MockCondition.ELEMENT_NAME));
         
         ValidationContext validationContext = new ValidationContext(staticParams);
         
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
index 42fa63d33..dc946e9b9 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandlerTest.java
@@ -22,7 +22,6 @@ import java.io.UnsupportedEncodingException;
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 
@@ -67,6 +66,7 @@ import org.w3c.dom.Element;
 
 import jakarta.servlet.http.HttpServletRequest;
 import net.shibboleth.shared.codec.DecodingException;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.testing.ConstantSupplier;
 import net.shibboleth.shared.xml.ElementSupport;
@@ -261,7 +261,7 @@ public class SAML2HTTPPostSimpleSignSecurityHandlerTest extends XMLObjectBaseTes
      */
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testBlacklistedSignatureAlgorithm() throws MessageHandlerException {
-        sigValParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigValParams.setExcludedAlgorithms(CollectionSupport.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         
         trustedCredentials.add(signingX509Cred);
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
index 7a635bb9c..64829e718 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest.java
@@ -23,7 +23,6 @@ import java.security.PrivateKey;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import org.opensaml.core.testing.XMLObjectBaseTestCase;
@@ -60,6 +59,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
 import jakarta.servlet.http.HttpServletRequest;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.net.URLBuilder;
@@ -240,7 +240,7 @@ public class SAML2HTTPRedirectDeflateSignatureSecurityHandlerTest extends XMLObj
      */
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testBlacklistedSignatureAlgorithm() throws MessageHandlerException {
-        sigValParams.setExcludedAlgorithms(Collections.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
+        sigValParams.setExcludedAlgorithms(CollectionSupport.singleton(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1));
         
         trustedCredentials.add(signingX509Cred);
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/ECDHTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/ECDHTest.java
index a42e65b4d..9af353684 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/ECDHTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/ECDHTest.java
@@ -25,7 +25,6 @@ import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
 import java.security.spec.ECGenParameterSpec;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -87,6 +86,7 @@ import org.testng.annotations.Test;
 import org.w3c.dom.Element;
 
 import net.shibboleth.shared.codec.EncodingException;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.xml.SerializeSupport;
@@ -252,7 +252,7 @@ public class ECDHTest extends XMLObjectBaseTestCase {
         
         DataEncryptionParameters dataEncParams = new DataEncryptionParameters(encParams);
         List<KeyEncryptionParameters> kekParams = encParams.getKeyTransportEncryptionCredential() != null ?
-                List.of(new KeyEncryptionParameters(encParams, null)) : Collections.emptyList();
+                List.of(new KeyEncryptionParameters(encParams, null)) : CollectionSupport.emptyList();
                 
         encrypter = new Encrypter(dataEncParams, kekParams);
         encrypter.setKeyPlacement(keyPlacement);
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/EncryptedElementTypeEncryptedKeyResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/EncryptedElementTypeEncryptedKeyResolverTest.java
index 90e343fed..133207027 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/EncryptedElementTypeEncryptedKeyResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/encryption/tests/EncryptedElementTypeEncryptedKeyResolverTest.java
@@ -18,11 +18,12 @@
 package org.opensaml.saml.saml2.encryption.tests;
 
 import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
+
 import org.testng.Assert;
 
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 
@@ -81,7 +82,7 @@ public class EncryptedElementTypeEncryptedKeyResolverTest extends XMLObjectBaseT
         List<EncryptedKey> allKeys = encAssertion.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new EncryptedElementTypeEncryptedKeyResolver(new HashSet<>(Arrays.asList("foo", "bar", "baz")));
+        resolver = new EncryptedElementTypeEncryptedKeyResolver(new HashSet<>(CollectionSupport.listOf("foo", "bar", "baz")));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -104,7 +105,7 @@ public class EncryptedElementTypeEncryptedKeyResolverTest extends XMLObjectBaseT
         List<EncryptedKey> allKeys = encAssertion.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new EncryptedElementTypeEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new EncryptedElementTypeEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -127,7 +128,7 @@ public class EncryptedElementTypeEncryptedKeyResolverTest extends XMLObjectBaseT
         List<EncryptedKey> allKeys = encAssertion.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new EncryptedElementTypeEncryptedKeyResolver(Collections.singleton("bar"));
+        resolver = new EncryptedElementTypeEncryptedKeyResolver(CollectionSupport.singleton("bar"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 0, "Incorrect number of resolved EncryptedKeys found");
@@ -173,7 +174,7 @@ public class EncryptedElementTypeEncryptedKeyResolverTest extends XMLObjectBaseT
         List<EncryptedKey> allKeys = encAssertion.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new EncryptedElementTypeEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new EncryptedElementTypeEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 2, "Incorrect number of resolved EncryptedKeys found");
@@ -196,7 +197,7 @@ public class EncryptedElementTypeEncryptedKeyResolverTest extends XMLObjectBaseT
         List<EncryptedKey> allKeys = encAssertion.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new EncryptedElementTypeEncryptedKeyResolver(new HashSet<>(Arrays.asList("foo", "baz")));
+        resolver = new EncryptedElementTypeEncryptedKeyResolver(new HashSet<>(CollectionSupport.listOf("foo", "baz")));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 3, "Incorrect number of resolved EncryptedKeys found");
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/MockAssertionValidationContextBuilder.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/MockAssertionValidationContextBuilder.java
index 56a536824..8cd3e3b16 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/MockAssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/MockAssertionValidationContextBuilder.java
@@ -17,33 +17,33 @@
 
 package org.opensaml.saml.saml2.profile.impl;
 
-import java.util.Collections;
 import java.util.Map;
 import java.util.function.Function;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.saml.common.assertion.ValidationContext;
 import org.opensaml.saml.saml2.profile.impl.ValidateAssertions.AssertionValidationInput;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
-/**
- *
- */
- at SuppressWarnings({"null", "javadoc"})
+ at SuppressWarnings("javadoc")
 public class MockAssertionValidationContextBuilder implements Function<AssertionValidationInput, ValidationContext> {
     
-    private Map<String,Object> staticParams;
+    @Nonnull private Map<String,Object> staticParams;
     
     public MockAssertionValidationContextBuilder() {
-       staticParams = Collections.emptyMap(); 
+       staticParams = CollectionSupport.emptyMap(); 
     }
     
-    public MockAssertionValidationContextBuilder(Map<String,Object> statics) {
+    public MockAssertionValidationContextBuilder(@Nonnull final Map<String,Object> statics) {
         staticParams = Constraint.isNotNull(statics, "Static params were null");
     }
 
     /** {@inheritDoc} */
-    public ValidationContext apply(AssertionValidationInput t) {
+    @Nullable public ValidationContext apply(@Nullable final AssertionValidationInput t) {
         return new ValidationContext(staticParams);
     }
 
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertionsTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertionsTest.java
index cd38a8ba0..bdaece95d 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertionsTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertionsTest.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.saml2.profile.impl;
 
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -40,6 +39,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.testing.ConstantSupplier;
 
@@ -207,7 +207,7 @@ public class ValidateAssertionsTest extends OpenSAMLInitBaseTestCase {
         Assertion assertion1 = SAML2ActionTestingSupport.buildAssertion();
         resultsMap.put(assertion1, ValidationResult.VALID);
         
-        action.setAssertionResolver(input -> {return Collections.singletonList(assertion1);});
+        action.setAssertionResolver(input -> {return CollectionSupport.singletonList(assertion1);});
         action.initialize();
         
         action.execute(prc);
@@ -218,7 +218,7 @@ public class ValidateAssertionsTest extends OpenSAMLInitBaseTestCase {
     
     @Test
     public void testNoAssertions() throws ComponentInitializationException {
-        action.setAssertionResolver(input -> {return Collections.emptyList();});
+        action.setAssertionResolver(input -> {return CollectionSupport.emptyList();});
         action.initialize();
         
         action.execute(prc);
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
index 1462252f8..7fdead06e 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolverTest.java
@@ -21,11 +21,11 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.crypto.SecretKey;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.ConstraintViolationException;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -123,7 +123,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
         
         // Set these as defaults on the last config in the chain, just so don't have to set in every test.
         config3.setSignatureAlgorithms(List.of(defaultRSAAlgo, defaultDSAAlgo, defaultECAlgo, defaultHMACAlgo));
-        config3.setSignatureReferenceDigestMethods(Collections.singletonList(defaultReferenceDigest));
+        config3.setSignatureReferenceDigestMethods(CollectionSupport.singletonList(defaultReferenceDigest));
         config3.setSignatureCanonicalizationAlgorithm(defaultC14N);
         config3.setSignatureHMACOutputLength(defaultHMACOutputLength);
         
@@ -144,7 +144,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testBasicRSA() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -159,7 +159,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testRSAWithRoleDescriptorSigningMethod() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, null, null));
         
@@ -176,7 +176,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
 
     @Test
     public void testRSAWithEntityDescriptorSigningMethod() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
         addEntityDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, null, null));
         
@@ -193,7 +193,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testRSAWithRoleDescriptorDigestMethod() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
         addRoleDescriptorExtension(roleDesc, buildDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256));
         
@@ -210,7 +210,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
 
     @Test
     public void testRSAWithEntityDescriptorDigestMethod() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
         addEntityDescriptorExtension(roleDesc, buildDigestMethod(SignatureConstants.ALGO_ID_DIGEST_SHA256));
         
@@ -227,9 +227,9 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testRSAWithSigningMethodBlacklisted() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
-        config1.setExcludedAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5));
+        config1.setExcludedAlgorithms(CollectionSupport.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5));
         
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5, null, null));
         addRoleDescriptorExtension(roleDesc, buildSigningMethod(SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA1, null, null));
@@ -248,9 +248,9 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
 
     @Test
     public void testRSAWithDigestMethodBlacklisted() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         
-        config1.setExcludedAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5));
+        config1.setExcludedAlgorithms(CollectionSupport.singletonList(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5));
         
         addRoleDescriptorExtension(roleDesc, buildDigestMethod(SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5));
         
@@ -348,7 +348,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testNoAlgorithms() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         config3.setSignatureAlgorithms(new ArrayList<String>());
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
@@ -358,7 +358,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testNoReferenceDigestMethods() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         config3.setSignatureReferenceDigestMethods(new ArrayList<String>());
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
@@ -368,7 +368,7 @@ public class SAMLMetadataSignatureSigningParametersResolverTest extends XMLObjec
     
     @Test
     public void testNoC14NAlgorithm() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred2048));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred2048));
         config3.setSignatureCanonicalizationAlgorithm(null);
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
index bcbb6c13c..0a35254f1 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecuritySupport.java
@@ -27,7 +27,6 @@ import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTE
 import static org.opensaml.security.httpclient.HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL;
 
 import java.net.URISyntaxException;
-import java.util.Collections;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -42,6 +41,7 @@ import org.opensaml.security.x509.TrustedNamesCriterion;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -89,8 +89,8 @@ public final class HttpClientSecuritySupport {
 
             if (!criteria.contains(TrustedNamesCriterion.class)) {
                 try {
-                    criteria.add(new TrustedNamesCriterion(Collections.singleton(request.getUri().getHost())));
-                } catch (URISyntaxException e) {
+                    criteria.add(new TrustedNamesCriterion(CollectionSupport.singleton(request.getUri().getHost())));
+                } catch (final URISyntaxException e) {
                     LOG.error("HttpRequest URI was invalid, got not extract hostname for TrustedNamesCriterion", e);
                 }
             }
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
index b6bd14952..08bd692f5 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
@@ -32,7 +32,6 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -40,6 +39,7 @@ import javax.annotation.Nullable;
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLPeerUnverifiedException;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 import org.apache.hc.client5.http.auth.CredentialsProvider;
@@ -100,8 +100,8 @@ public class HttpClientSecuritySupportTest {
         params.setCredentialsProvider(new BasicCredentialsProvider());
         params.setTLSTrustEngine(new MockTrustEngine());
         params.setTLSCriteriaSet(new CriteriaSet());
-        params.setTLSProtocols(Collections.singletonList("foo"));
-        params.setTLSCipherSuites(Collections.singletonList("foo"));
+        params.setTLSProtocols(CollectionSupport.singletonList("foo"));
+        params.setTLSCipherSuites(CollectionSupport.singletonList("foo"));
         params.setClientTLSCredential(new BasicX509Credential(cert));
         params.setHostnameVerifier(new DefaultHostnameVerifier());
         params.setServerTLSFailureFatal(Boolean.TRUE);
@@ -126,8 +126,8 @@ public class HttpClientSecuritySupportTest {
         context.setCredentialsProvider(new BasicCredentialsProvider());
         context.setAttribute(CONTEXT_KEY_TRUST_ENGINE, new MockTrustEngine());
         context.setAttribute(CONTEXT_KEY_CRITERIA_SET, new CriteriaSet());
-        context.setAttribute(CONTEXT_KEY_TLS_PROTOCOLS, Collections.singletonList("foo"));
-        context.setAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES, Collections.singletonList("foo"));
+        context.setAttribute(CONTEXT_KEY_TLS_PROTOCOLS, CollectionSupport.singletonList("foo"));
+        context.setAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES, CollectionSupport.singletonList("foo"));
         context.setAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL, new BasicX509Credential(cert));
         context.setAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER, new DefaultHostnameVerifier());
         context.setAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
@@ -136,8 +136,8 @@ public class HttpClientSecuritySupportTest {
         params.setCredentialsProvider(new BasicCredentialsProvider());
         params.setTLSTrustEngine(new MockTrustEngine());
         params.setTLSCriteriaSet(new CriteriaSet());
-        params.setTLSProtocols(Collections.singletonList("foo"));
-        params.setTLSCipherSuites(Collections.singletonList("foo"));
+        params.setTLSProtocols(CollectionSupport.singletonList("foo"));
+        params.setTLSCipherSuites(CollectionSupport.singletonList("foo"));
         params.setClientTLSCredential(new BasicX509Credential(cert));
         params.setHostnameVerifier(new DefaultHostnameVerifier());
         params.setServerTLSFailureFatal(Boolean.TRUE);
@@ -161,8 +161,8 @@ public class HttpClientSecuritySupportTest {
         CredentialsProvider credProvider = new BasicCredentialsProvider();
         TrustEngine<X509Credential> trustEngine = new MockTrustEngine();
         CriteriaSet criteriaSet = new CriteriaSet();
-        List<String> protocols = Collections.singletonList("foo");
-        List<String> cipherSuites = Collections.singletonList("foo");
+        List<String> protocols = CollectionSupport.singletonList("foo");
+        List<String> cipherSuites = CollectionSupport.singletonList("foo");
         X509Credential clientTLSCred = new BasicX509Credential(cert);
         HostnameVerifier verifier = new DefaultHostnameVerifier();
         
@@ -179,8 +179,8 @@ public class HttpClientSecuritySupportTest {
         params.setCredentialsProvider(new BasicCredentialsProvider());
         params.setTLSTrustEngine(new MockTrustEngine());
         params.setTLSCriteriaSet(new CriteriaSet());
-        params.setTLSProtocols(Collections.singletonList("foo"));
-        params.setTLSCipherSuites(Collections.singletonList("foo"));
+        params.setTLSProtocols(CollectionSupport.singletonList("foo"));
+        params.setTLSCipherSuites(CollectionSupport.singletonList("foo"));
         params.setClientTLSCredential(new BasicX509Credential(cert));
         params.setHostnameVerifier(new DefaultHostnameVerifier());
         params.setServerTLSFailureFatal(Boolean.TRUE);
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
index e7b8bdf37..eb411e497 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
@@ -18,11 +18,11 @@
 package org.opensaml.security.httpclient;
 
 import java.io.IOException;
-import java.util.Collections;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLSession;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.httpclient.HttpClientBuilder;
 import net.shibboleth.shared.spring.httpclient.resource.HTTPResource;
@@ -39,6 +39,7 @@ import org.testng.annotations.Test;
 /**
  * Test for HTTPResource with security support added.
  */
+ at SuppressWarnings("javadoc")
 public class SecurityEnhancedHTTPResourceTest {
 
     private final String path = "data/org/opensaml/security/httpclient/document.xml";
@@ -85,7 +86,7 @@ public class SecurityEnhancedHTTPResourceTest {
         final HTTPResource existsResource = new HTTPResource(client, existsHttps);
         existsResource.setHttpClientContextHandler(handler);
         
-        params.setTLSProtocols(Collections.singletonList("SSLv3"));
+        params.setTLSProtocols(CollectionSupport.singletonList("SSLv3"));
         
         Assert.assertFalse(existsResource.exists());
     }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
index bc3a07260..7935b0691 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
@@ -17,11 +17,8 @@
 
 package org.opensaml.security.httpclient.impl;
 
-import java.util.Collections;
 
 import javax.annotation.Nonnull;
-import javax.net.ssl.KeyManager;
-import javax.net.ssl.TrustManager;
 import javax.net.ssl.X509KeyManager;
 import javax.net.ssl.X509TrustManager;
 
@@ -30,6 +27,7 @@ import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509CredentialKeyManager;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustManager;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.httpclient.HttpClientSupport;
 import net.shibboleth.shared.httpclient.TLSSocketFactoryBuilder;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -134,12 +132,12 @@ public final class SecurityEnhancedHttpClientSupport {
             
             if (supportTrustEngine) {
                 wrappedFactoryBuilder.setTrustManagers(
-                        Collections.<TrustManager>singletonList(new ThreadLocalX509TrustManager()));
+                        CollectionSupport.singletonList(new ThreadLocalX509TrustManager()));
             }
 
             if (supportClientTLS) {
                 wrappedFactoryBuilder.setKeyManagers(
-                        Collections.<KeyManager>singletonList(new ThreadLocalX509CredentialKeyManager()));
+                        CollectionSupport.singletonList(new ThreadLocalX509CredentialKeyManager()));
             }
             
             return new SecurityEnhancedTLSSocketFactory(wrappedFactoryBuilder.build());
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 97246aea8..44254e6ea 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -20,7 +20,6 @@ package org.opensaml.security.httpclient.impl;
 import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.Socket;
-import java.util.Collections;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -45,6 +44,7 @@ import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustEngineSupport;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustManager;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.httpclient.HttpClientSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -266,7 +266,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
                 log.debug("No CriteriaSet supplied by caller, building new instance with signing " 
                         + "and trusted names criteria");
                 criteriaSet = new CriteriaSet(new UsageCriterion(UsageType.SIGNING));
-                criteriaSet.add(new TrustedNamesCriterion(Collections.singleton(hostname)));
+                criteriaSet.add(new TrustedNamesCriterion(CollectionSupport.singleton(hostname)));
             } else {
                 log.trace("Saw CriteriaSet: {}", criteriaSet);
             }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
index 33d656447..e434a380b 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
@@ -20,7 +20,6 @@ package org.opensaml.security.httpclient.impl;
 import java.io.File;
 import java.net.URISyntaxException;
 import java.security.cert.CertificateException;
-import java.util.Collections;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -37,6 +36,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 @SuppressWarnings("javadoc")
@@ -56,8 +56,8 @@ public class BasicHttpClientSecurityConfigurationTest {
         config.setClientTLSCredential(x509Credential);
         config.setCredentialsProvider(new BasicCredentialsProvider());
         config.setHostnameVerifier(new DefaultHostnameVerifier());
-        config.setTLSCipherSuites(Collections.singletonList("test"));
-        config.setTLSProtocols(Collections.singletonList("test"));
+        config.setTLSCipherSuites(CollectionSupport.singletonList("test"));
+        config.setTLSProtocols(CollectionSupport.singletonList("test"));
         config.setTLSTrustEngine(new MockTrustEngine());
         
         Assert.assertNotNull(config.getClientTLSCredential());
@@ -71,8 +71,8 @@ public class BasicHttpClientSecurityConfigurationTest {
     @Test
     public void testEmptyLists() {
         BasicHttpClientSecurityConfiguration config = new BasicHttpClientSecurityConfiguration();
-        config.setTLSCipherSuites(Collections.emptyList());
-        config.setTLSProtocols(Collections.emptyList());
+        config.setTLSCipherSuites(CollectionSupport.emptyList());
+        config.setTLSProtocols(CollectionSupport.emptyList());
         
         Assert.assertNull(config.getTLSCipherSuites());
         Assert.assertNull(config.getTLSProtocols());
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index 3f5cc8142..4d4db0cfc 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -21,7 +21,6 @@ import java.io.File;
 import java.net.URISyntaxException;
 import java.security.KeyException;
 import java.security.cert.CertificateException;
-import java.util.Collections;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -41,6 +40,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -233,8 +233,8 @@ public class BasicHttpClientSecurityParametersResolverTest {
         config.setClientTLSCredential(x509Credential);
         config.setCredentialsProvider(new BasicCredentialsProvider());
         config.setHostnameVerifier(new DefaultHostnameVerifier());
-        config.setTLSCipherSuites(Collections.singletonList("test"));
-        config.setTLSProtocols(Collections.singletonList("test"));
+        config.setTLSCipherSuites(CollectionSupport.singletonList("test"));
+        config.setTLSProtocols(CollectionSupport.singletonList("test"));
         config.setTLSTrustEngine(new MockTrustEngine());
         config.setServerTLSFailureFatal(true);
         return config;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
index 774fc3a65..2fb0e8889 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
@@ -19,7 +19,6 @@ package org.opensaml.security.x509.impl;
 
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -32,6 +31,8 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Tests the {@link CertPathPKIXTrustEvaluator} implementation.
  */
@@ -152,7 +153,7 @@ public class BasicX509CredentialNameEvaluatorTest extends XMLObjectBaseTestCase
         evaluator.setCheckSubjectAltNames(true);
         evaluator.setCheckSubjectDN(false);
         evaluator.setCheckSubjectDNCommonName(false);
-        evaluator.setSubjectAltNameTypes(Collections.singleton(X509Support.DNS_ALT_NAME));
+        evaluator.setSubjectAltNameTypes(CollectionSupport.singleton(X509Support.DNS_ALT_NAME));
         
         names.add(altNameDNS);
         
@@ -164,7 +165,7 @@ public class BasicX509CredentialNameEvaluatorTest extends XMLObjectBaseTestCase
         evaluator.setCheckSubjectAltNames(true);
         evaluator.setCheckSubjectDN(false);
         evaluator.setCheckSubjectDNCommonName(false);
-        evaluator.setSubjectAltNameTypes(Collections.singleton(X509Support.DNS_ALT_NAME));
+        evaluator.setSubjectAltNameTypes(CollectionSupport.singleton(X509Support.DNS_ALT_NAME));
         
         names.add("wacky.internet2.edu");
         
@@ -176,7 +177,7 @@ public class BasicX509CredentialNameEvaluatorTest extends XMLObjectBaseTestCase
         evaluator.setCheckSubjectAltNames(true);
         evaluator.setCheckSubjectDN(false);
         evaluator.setCheckSubjectDNCommonName(false);
-        evaluator.setSubjectAltNameTypes(Collections.singleton(X509Support.URI_ALT_NAME));
+        evaluator.setSubjectAltNameTypes(CollectionSupport.singleton(X509Support.URI_ALT_NAME));
         
         names.add(altNameURL);
         
@@ -188,7 +189,7 @@ public class BasicX509CredentialNameEvaluatorTest extends XMLObjectBaseTestCase
         evaluator.setCheckSubjectAltNames(true);
         evaluator.setCheckSubjectDN(false);
         evaluator.setCheckSubjectDNCommonName(false);
-        evaluator.setSubjectAltNameTypes(Collections.singleton(X509Support.URI_ALT_NAME));
+        evaluator.setSubjectAltNameTypes(CollectionSupport.singleton(X509Support.URI_ALT_NAME));
         
         names.add("http://wacky.internet2.edu/idp");
         
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
index ae1f2a5cd..1992005aa 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
@@ -18,13 +18,15 @@
 package org.opensaml.security.x509.impl;
 
 import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
+
 import org.testng.annotations.BeforeMethod;
 import org.testng.Assert;
 import java.io.InputStream;
 import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -35,8 +37,6 @@ import org.opensaml.security.x509.PKIXTrustEvaluator;
 import org.opensaml.security.x509.PKIXValidationInformation;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509Support;
-import org.opensaml.security.x509.impl.BasicPKIXValidationInformation;
-import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
 
 /**
  * Tests the {@link CertPathPKIXTrustEvaluator} implementation.
@@ -60,8 +60,8 @@ public class CertPathPKIXTrustEvaluatorTest extends XMLObjectBaseTestCase {
     
     private CertPathPKIXValidationOptions opts;
        
-    private static Set<String> testPolicy1 = Collections.singleton("1.3.6.1.4.1.32473.2011.6.20");
-    private static Set<String> testPolicy2 = Collections.singleton("1.3.6.1.4.1.32473.2011.6.21");
+    private static Set<String> testPolicy1 = CollectionSupport.singleton("1.3.6.1.4.1.32473.2011.6.20");
+    private static Set<String> testPolicy2 = CollectionSupport.singleton("1.3.6.1.4.1.32473.2011.6.21");
     
     @BeforeMethod
     protected void setUp() throws Exception {
diff --git a/opensaml-soap-api/src/main/java/org/opensaml/soap/common/AbstractExtensibleSOAPObject.java b/opensaml-soap-api/src/main/java/org/opensaml/soap/common/AbstractExtensibleSOAPObject.java
index 803510bf9..e8a08da0d 100644
--- a/opensaml-soap-api/src/main/java/org/opensaml/soap/common/AbstractExtensibleSOAPObject.java
+++ b/opensaml-soap-api/src/main/java/org/opensaml/soap/common/AbstractExtensibleSOAPObject.java
@@ -18,7 +18,6 @@
 package org.opensaml.soap.common;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -32,6 +31,10 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Abstract class implementing element and attribute extensibility.
  */
@@ -59,12 +62,12 @@ public abstract class AbstractExtensibleSOAPObject extends AbstractXMLObject imp
     }
 
     /** {@inheritDoc} */
-    @Nullable public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
 
         children.addAll(unknownXMLObjects);
 
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-soap-api/src/main/java/org/opensaml/soap/wssecurity/messaging/WSSecurityMessagingSupport.java b/opensaml-soap-api/src/main/java/org/opensaml/soap/wssecurity/messaging/WSSecurityMessagingSupport.java
index 813c7c2f6..7fa586298 100644
--- a/opensaml-soap-api/src/main/java/org/opensaml/soap/wssecurity/messaging/WSSecurityMessagingSupport.java
+++ b/opensaml-soap-api/src/main/java/org/opensaml/soap/wssecurity/messaging/WSSecurityMessagingSupport.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.soap.wssecurity.messaging;
 
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -29,6 +28,7 @@ import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.soap.messaging.SOAPMessagingSupport;
 import org.opensaml.soap.wssecurity.Security;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 
@@ -76,7 +76,7 @@ public final class WSSecurityMessagingSupport {
 
         final List<XMLObject> securityHeaders =
                 SOAPMessagingSupport.getHeaderBlock(messageContext, Security.ELEMENT_NAME,
-                targetNode != null ? Collections.singleton(targetNode) : null, 
+                targetNode != null ? CollectionSupport.singleton(targetNode) : null, 
                 isFinalDestination);
         
         Security security = null;
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/MetadataImpl.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/MetadataImpl.java
index 897261aad..54a95feef 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/MetadataImpl.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/MetadataImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.soap.wsaddressing.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +28,10 @@ import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.soap.wsaddressing.Metadata;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * MetadataImpl.
  * 
@@ -73,14 +75,8 @@ public class MetadataImpl extends AbstractWSAddressingObject implements Metadata
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-
-        if (!getUnknownXMLObjects().isEmpty()) {
-            children.addAll(getUnknownXMLObjects());
-        }
-
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/ReferenceParametersImpl.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/ReferenceParametersImpl.java
index bd800a137..95d9c3bbd 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/ReferenceParametersImpl.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsaddressing/impl/ReferenceParametersImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.soap.wsaddressing.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +28,11 @@ import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.soap.wsaddressing.ReferenceParameters;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * ReferenceParametersImpl.
  * 
@@ -62,25 +65,19 @@ public class ReferenceParametersImpl extends AbstractWSAddressingObject implemen
     }
 
     /** {@inheritDoc} */
-    @Nonnull public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
 
     /** {@inheritDoc} */
     @SuppressWarnings("unchecked")
-    @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-
-        if (!getUnknownXMLObjects().isEmpty()) {
-            children.addAll(getUnknownXMLObjects());
-        }
-
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsfed/impl/RequestedSecurityTokenImpl.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsfed/impl/RequestedSecurityTokenImpl.java
index 24663d72a..b213146be 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsfed/impl/RequestedSecurityTokenImpl.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wsfed/impl/RequestedSecurityTokenImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.soap.wsfed.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -29,6 +27,10 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
 import org.opensaml.soap.wsfed.RequestedSecurityToken;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /** Implementation of the {@link RequestedSecurityToken} object. */
 public class RequestedSecurityTokenImpl extends AbstractXMLObject implements RequestedSecurityToken {
 
@@ -54,15 +56,8 @@ public class RequestedSecurityTokenImpl extends AbstractXMLObject implements Req
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>(1 + tokens.size());
-
-        children.addAll(tokens);
-
-        if (children.size() == 0) {
-            return null;
-        }
-
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(tokens);
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wspolicy/impl/AppliesToImpl.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wspolicy/impl/AppliesToImpl.java
index 423e06cb3..bdb9007c0 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wspolicy/impl/AppliesToImpl.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wspolicy/impl/AppliesToImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.soap.wspolicy.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +28,11 @@ import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.soap.wspolicy.AppliesTo;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * AppliesToImpl.
  * 
@@ -57,13 +60,13 @@ public class AppliesToImpl extends AbstractWSPolicyObject implements AppliesTo {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
 
     /** {@inheritDoc} */
     @SuppressWarnings("unchecked")
-    @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
@@ -73,10 +76,8 @@ public class AppliesToImpl extends AbstractWSPolicyObject implements AppliesTo {
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        children.addAll(unknownChildren);
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/SecurityImpl.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/SecurityImpl.java
index 2b8e63c13..2e955faea 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/SecurityImpl.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/SecurityImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.soap.wssecurity.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +28,11 @@ import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.soap.wssecurity.Security;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * SecurityImpl implements the <wsse:Security> header.
  * 
@@ -57,13 +60,13 @@ public class SecurityImpl extends AbstractWSSecurityObject implements Security {
     }
 
     /** {@inheritDoc} */
-    @Nonnull public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
 
     /** {@inheritDoc} */
     @SuppressWarnings("unchecked")
-    @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
@@ -73,12 +76,8 @@ public class SecurityImpl extends AbstractWSSecurityObject implements Security {
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        if (!getUnknownXMLObjects().isEmpty()) {
-            children.addAll(getUnknownXMLObjects());
-        }
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/TransformationParametersImpl.java b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/TransformationParametersImpl.java
index d4b98bfbf..83c773b24 100644
--- a/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/TransformationParametersImpl.java
+++ b/opensaml-soap-impl/src/main/java/org/opensaml/soap/wssecurity/impl/TransformationParametersImpl.java
@@ -17,8 +17,6 @@
 
 package org.opensaml.soap.wssecurity.impl;
 
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +28,11 @@ import org.opensaml.core.xml.util.AttributeMap;
 import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.soap.wssecurity.TransformationParameters;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * TransformationParametersImpl implements the <wsse:TransformationParameters> element.
  * 
@@ -57,13 +60,13 @@ public class TransformationParametersImpl extends AbstractWSSecurityObject imple
     }
 
     /** {@inheritDoc} */
-    @Nonnull public List<XMLObject> getUnknownXMLObjects() {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects() {
         return unknownChildren;
     }
 
     /** {@inheritDoc} */
     @SuppressWarnings("unchecked")
-    @Nonnull public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
+    @Nonnull @Live public List<XMLObject> getUnknownXMLObjects(@Nonnull final QName typeOrName) {
         return (List<XMLObject>) unknownChildren.subList(typeOrName);
     }
 
@@ -73,12 +76,8 @@ public class TransformationParametersImpl extends AbstractWSSecurityObject imple
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
-        final ArrayList<XMLObject> children = new ArrayList<>();
-        if (!getUnknownXMLObjects().isEmpty()) {
-            children.addAll(getUnknownXMLObjects());
-        }
-        return Collections.unmodifiableList(children);
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
+        return CollectionSupport.copyToList(unknownChildren);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java b/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java
index eab84d3ee..fa12d6f0c 100644
--- a/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java
+++ b/opensaml-spring/src/main/java/org/opensaml/spring/trust/StaticPKIXFactoryBean.java
@@ -26,7 +26,6 @@ import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 import java.util.Set;
 
@@ -237,7 +236,7 @@ public class StaticPKIXFactoryBean extends AbstractComponentAwareFactoryBean<PKI
                 new BasicPKIXValidationInformation(getCertificates(), getCRLs(), verifyDepth);
         
         final StaticPKIXValidationInformationResolver resolver =
-                new StaticPKIXValidationInformationResolver(Collections.singletonList(info), trustedNames, checkNames);
+                new StaticPKIXValidationInformationResolver(CollectionSupport.singletonList(info), trustedNames, checkNames);
 
         final PKIXTrustEvaluator pkixTrustEvaluator =
                 trustEvaluator != null ? trustEvaluator : new CertPathPKIXTrustEvaluator();
diff --git a/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/memcached/MemcachedStorageServiceTest.java b/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/memcached/MemcachedStorageServiceTest.java
index b0c129a07..da47d5cb2 100644
--- a/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/memcached/MemcachedStorageServiceTest.java
+++ b/opensaml-storage-impl/src/test/java/org/opensaml/storage/impl/memcached/MemcachedStorageServiceTest.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.storage.impl.memcached;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
 import net.spy.memcached.BinaryConnectionFactory;
@@ -32,7 +33,6 @@ import org.testng.annotations.Test;
 
 import java.io.IOException;
 import java.net.InetSocketAddress;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
@@ -59,7 +59,7 @@ public class MemcachedStorageServiceTest {
     public void setUp() throws IOException {
         final MemcachedClient client = new MemcachedClient(
                 new BinaryConnectionFactory(),
-                Collections.singletonList(new InetSocketAddress("localhost", 11211)));
+                CollectionSupport.singletonList(new InetSocketAddress("localhost", 11211)));
         try {
             client.asyncGet("does_not_exist").get(500, TimeUnit.MILLISECONDS);
         } catch (Exception e) {
diff --git a/opensaml-testing/src/main/java/org/opensaml/core/xml/mock/SimpleXMLObject.java b/opensaml-testing/src/main/java/org/opensaml/core/xml/mock/SimpleXMLObject.java
index a61502337..fa5ff4931 100644
--- a/opensaml-testing/src/main/java/org/opensaml/core/xml/mock/SimpleXMLObject.java
+++ b/opensaml-testing/src/main/java/org/opensaml/core/xml/mock/SimpleXMLObject.java
@@ -20,7 +20,6 @@
  */
 package org.opensaml.core.xml.mock;
 
-import java.util.Collections;
 import java.util.LinkedList;
 import java.util.List;
 
@@ -37,6 +36,7 @@ import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * Simple XMLObject that can be used for testing
@@ -153,7 +153,7 @@ public class SimpleXMLObject extends AbstractXMLObject  implements ElementExtens
         children.addAll(simpleXMLObjects);
         children.addAll(unknownXMLObjects);
         
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java
index 7cb42804d..d1ed885fd 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/ChainingEncryptedKeyResolver.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.xmlsec.encryption.support;
 
-import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 import java.util.NoSuchElementException;
@@ -87,7 +86,7 @@ public class ChainingEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
             @Nonnull @NonnullElements @ParameterName(name="encKeyResolvers")
             final List<EncryptedKeyResolver> encKeyResolvers,
             @Nullable @ParameterName(name="recipient") final String recipient) {
-        this(encKeyResolvers, Collections.singleton(recipient));
+        this(encKeyResolvers, recipient != null ? CollectionSupport.singleton(recipient) : null);
     }
 
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolver.java
index dcf35a941..c54b0b7a5 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/InlineEncryptedKeyResolver.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.support;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Set;
 
@@ -29,6 +28,7 @@ import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -57,7 +57,7 @@ public class InlineEncryptedKeyResolver extends AbstractEncryptedKeyResolver {
      * @param recipient the recipient
      */
     public InlineEncryptedKeyResolver(@Nullable final String recipient) {
-        this(Collections.singleton(recipient));
+        this(recipient != null ? CollectionSupport.singleton(recipient) : null);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleKeyInfoReferenceEncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleKeyInfoReferenceEncryptedKeyResolver.java
index 5c2cdb54d..190ae0ac6 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleKeyInfoReferenceEncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleKeyInfoReferenceEncryptedKeyResolver.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.support;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Set;
 
@@ -32,6 +31,7 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.KeyInfoReference;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -74,7 +74,7 @@ public class SimpleKeyInfoReferenceEncryptedKeyResolver extends AbstractEncrypte
      * @param recipient the recipient
      */
     public SimpleKeyInfoReferenceEncryptedKeyResolver(@Nullable final String recipient) {
-        this(Collections.singleton(recipient));
+        this(recipient != null ? CollectionSupport.singleton(recipient) : null);
     }
     
     /**
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolver.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolver.java
index 6fec278a2..48b989719 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolver.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/SimpleRetrievalMethodEncryptedKeyResolver.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.support;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
@@ -33,6 +32,7 @@ import org.opensaml.xmlsec.signature.KeyInfo;
 import org.opensaml.xmlsec.signature.RetrievalMethod;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -71,7 +71,7 @@ public class SimpleRetrievalMethodEncryptedKeyResolver extends AbstractEncrypted
      * @param recipient the recipient
      */
     public SimpleRetrievalMethodEncryptedKeyResolver(@Nullable final String recipient) {
-        this(Collections.singleton(recipient));
+        this(recipient != null ? CollectionSupport.singleton(recipient) : null);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
index ad638523a..f43387add 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/config/impl/DefaultSecurityConfigurationBootstrap.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.config.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -96,11 +95,11 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicEncryptionConfiguration buildDefaultEncryptionConfiguration() {
         final BasicEncryptionConfiguration config = new BasicEncryptionConfiguration();
         
-        config.setExcludedAlgorithms(Collections.singletonList(
+        config.setExcludedAlgorithms(CollectionSupport.singletonList(
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15
                 ));
         
-        config.setDataEncryptionAlgorithms(List.of(
+        config.setDataEncryptionAlgorithms(CollectionSupport.listOf(
                 // The order of these is significant.
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192,
@@ -108,7 +107,7 @@ public class DefaultSecurityConfigurationBootstrap {
                 EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES
                 ));
         
-        config.setKeyTransportEncryptionAlgorithms(List.of(
+        config.setKeyTransportEncryptionAlgorithms(CollectionSupport.listOf(
                 // The order of the RSA algos is significant.
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP,
                 
@@ -168,7 +167,7 @@ public class DefaultSecurityConfigurationBootstrap {
                 ecConfig.setParameters(Set.of(ecPBKDF2));
             } else {
                 LOG.warn("Saw unknown value for ECDH KDF '{}', omitting global ECDH KDF configuration", ecKDF);
-                ecConfig.setParameters(Collections.emptySet());
+                ecConfig.setParameters(CollectionSupport.emptySet());
             }
             kaConfigs.put(JCAConstants.KEY_ALGO_EC, ecConfig);
             
@@ -199,7 +198,7 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicDecryptionConfiguration buildDefaultDecryptionConfiguration() {
         final BasicDecryptionConfiguration config = new BasicDecryptionConfiguration();
         
-        config.setExcludedAlgorithms(Collections.singletonList(
+        config.setExcludedAlgorithms(CollectionSupport.singletonList(
                 EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15
                 ));
         
@@ -216,13 +215,13 @@ public class DefaultSecurityConfigurationBootstrap {
     @Nonnull public static BasicSignatureSigningConfiguration buildDefaultSignatureSigningConfiguration() {
         final BasicSignatureSigningConfiguration config = new BasicSignatureSigningConfiguration();
         
-        config.setExcludedAlgorithms(List.of(
+        config.setExcludedAlgorithms(CollectionSupport.listOf(
                 SignatureConstants.ALGO_ID_DIGEST_NOT_RECOMMENDED_MD5,
                 SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5,
                 SignatureConstants.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5
                 ));
         
-        config.setSignatureAlgorithms(List.of(
+        config.setSignatureAlgorithms(CollectionSupport.listOf(
                 // The order within each key group is significant.
                 // The order of the key groups themselves is not significant.
                 
@@ -398,4 +397,4 @@ public class DefaultSecurityConfigurationBootstrap {
         return namedManager;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java
index becd74c2b..f72fca2b3 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/AlgorithmIdentifierTypeImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,6 +29,7 @@ import org.opensaml.xmlsec.encryption.AlgorithmIdentifierType;
 
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * Abstract implementation of {@link AlgorithmIdentifierType}.
@@ -37,10 +37,10 @@ import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 public abstract class AlgorithmIdentifierTypeImpl extends AbstractXMLObject implements AlgorithmIdentifierType {
     
     /** Algorithm attribute value. */
-    private String algorithm;
+    @Nullable private String algorithm;
     
     /** Parameters child element. */
-    private XMLObject parameters;
+    @Nullable private XMLObject parameters;
     
     /**
      * Constructor.
@@ -82,7 +82,7 @@ public abstract class AlgorithmIdentifierTypeImpl extends AbstractXMLObject impl
             children.add(parameters);
         }
         
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
index 818f8275b..dc86fbc93 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/ConcatKDFParamsImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -32,13 +31,15 @@ import org.opensaml.core.xml.XMLRuntimeException;
 import org.opensaml.xmlsec.encryption.ConcatKDFParams;
 import org.opensaml.xmlsec.signature.DigestMethod;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Concrete implementation of {@link ConcatKDFParams}.
  */
 public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFParams {
     
     /** DigestMethod. */
-    private DigestMethod digestMethod;
+    @Nullable private DigestMethod digestMethod;
     
     /** AlgorithmID. */
     @Nullable private String algorithmID;
@@ -205,11 +206,7 @@ public class ConcatKDFParamsImpl extends AbstractXMLObject implements ConcatKDFP
             children.add(digestMethod); 
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java
index 962ae05fc..d0f4a0621 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/DerivedKeyImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -32,6 +31,10 @@ import org.opensaml.xmlsec.encryption.KeyDerivationMethod;
 import org.opensaml.xmlsec.encryption.MasterKeyName;
 import org.opensaml.xmlsec.encryption.ReferenceList;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Concrete implementation of {@link DerivedKey}.
  */
@@ -143,7 +146,7 @@ public class DerivedKeyImpl extends AbstractXMLObject implements DerivedKey {
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
 
         if (keyDerivationMethod != null) {
@@ -162,11 +165,7 @@ public class DerivedKeyImpl extends AbstractXMLObject implements DerivedKey {
             children.add(masterKeyName);
         }
 
-        if (children.size() == 0) {
-            return null;
-        }
-
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java
index 613e00b2c..12cba6fbb 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/PBKDF2ParamsImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -32,6 +31,10 @@ import org.opensaml.xmlsec.encryption.PBKDF2Params;
 import org.opensaml.xmlsec.encryption.PRF;
 import org.opensaml.xmlsec.encryption.Salt;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Concrete implementation of {@link PBKDF2Params}.
  */
@@ -102,7 +105,7 @@ public class PBKDF2ParamsImpl extends AbstractXMLObject implements PBKDF2Params
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
        final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (salt != null) {
@@ -118,11 +121,7 @@ public class PBKDF2ParamsImpl extends AbstractXMLObject implements PBKDF2Params
             children.add(prf);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java
index bbf8063eb..c6b9904af 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/encryption/impl/SaltImpl.java
@@ -18,7 +18,6 @@
 package org.opensaml.xmlsec.encryption.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -30,16 +29,20 @@ import org.opensaml.xmlsec.encryption.OtherSource;
 import org.opensaml.xmlsec.encryption.Salt;
 import org.opensaml.xmlsec.encryption.Specified;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Concrete implementation of {@link Salt}.
  */
 public class SaltImpl extends AbstractXMLObject implements Salt {
     
     /** Specified child element value. */
-    private Specified specified;
+    @Nullable private Specified specified;
     
     /** OtherSource child element value. */
-    private OtherSource otherSource;
+    @Nullable private OtherSource otherSource;
     
     /**
      * Constructor.
@@ -74,7 +77,7 @@ public class SaltImpl extends AbstractXMLObject implements Salt {
     }
 
     /** {@inheritDoc} */
-    public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         final ArrayList<XMLObject> children = new ArrayList<>();
         
         if (specified != null) {
@@ -84,11 +87,7 @@ public class SaltImpl extends AbstractXMLObject implements Salt {
             children.add(otherSource);
         }
         
-        if (children.size() == 0) {
-            return null;
-        }
-        
-        return Collections.unmodifiableList(children);
+        return CollectionSupport.copyToList(children);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
index 77b6b6653..8ebb8b9fe 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolver.java
@@ -22,7 +22,6 @@ import java.security.KeyException;
 import java.security.NoSuchAlgorithmException;
 import java.security.PublicKey;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.function.Predicate;
@@ -528,7 +527,7 @@ public class BasicEncryptionParametersResolver extends AbstractSecurityParameter
                     .filter(Objects::nonNull)
                     .map(KeyAgreementEncryptionConfiguration::getParameters)
                     .filter(Objects::nonNull)
-                    .findFirst().orElse(Collections.emptySet())
+                    .findFirst().orElse(CollectionSupport.emptySet())
                 );
         
         if (config.getAlgorithm() == null) {
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
index 609d141c1..5daadc662 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/messaging/impl/PopulateSignatureValidationParametersHandler.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.xmlsec.messaging.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 
@@ -36,6 +35,7 @@ import org.opensaml.xmlsec.criterion.SignatureValidationConfigurationCriterion;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -118,8 +118,8 @@ public class PopulateSignatureValidationParametersHandler extends AbstractMessag
         } else if (configurationLookupStrategy == null) {
             configurationLookupStrategy = new Function<>() {
                 public List<SignatureValidationConfiguration> apply(final MessageContext input) {
-                    return Collections.singletonList(
-                            SecurityConfigurationSupport.getGlobalSignatureValidationConfiguration());
+                    return CollectionSupport.singletonList(
+                            SecurityConfigurationSupport.ensureGlobalSignatureValidationConfiguration());
                 }
             };
         }
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java
index 9e2d19a0a..6348f0029 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithExplicitKDFTest.java
@@ -21,7 +21,6 @@ import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.security.KeyPair;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -73,6 +72,7 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.xml.ParserPool;
 import net.shibboleth.shared.xml.SerializeSupport;
@@ -200,7 +200,7 @@ public class DHWithExplicitKDFTest extends XMLObjectBaseTestCase {
         
         final DataEncryptionParameters dataEncParams = new DataEncryptionParameters(encParams);
         final List<KeyEncryptionParameters> kekParams = encParams.getKeyTransportEncryptionCredential() != null ?
-                List.of(new KeyEncryptionParameters(encParams, null)) : Collections.emptyList();
+                List.of(new KeyEncryptionParameters(encParams, null)) : CollectionSupport.emptyList();
         
         final EncryptedData encryptedDataOrig = encrypter.encryptElement(sxoOrig, dataEncParams, kekParams);
         Assert.assertNotNull(encryptedDataOrig);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java
index 11a5f6cfd..6bc500d4f 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/DHWithLegacyKDFTest.java
@@ -21,7 +21,6 @@ import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.security.KeyPair;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -197,7 +196,7 @@ public class DHWithLegacyKDFTest extends XMLObjectBaseTestCase {
         
         final DataEncryptionParameters dataEncParams = new DataEncryptionParameters(encParams);
         final List<KeyEncryptionParameters> kekParams = encParams.getKeyTransportEncryptionCredential() != null ?
-                List.of(new KeyEncryptionParameters(encParams, null)) : Collections.emptyList();
+                List.of(new KeyEncryptionParameters(encParams, null)) : CollectionSupport.emptyList();
         
         final EncryptedData encryptedDataOrig = encrypter.encryptElement(sxoOrig, dataEncParams, kekParams);
         Assert.assertNotNull(encryptedDataOrig);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/InlineEncryptedKeyResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/InlineEncryptedKeyResolverTest.java
index 180be3a15..c101aac6f 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/InlineEncryptedKeyResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/InlineEncryptedKeyResolverTest.java
@@ -18,12 +18,12 @@
 package org.opensaml.xmlsec.encryption.support.tests;
 
 import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
+
 import org.testng.Assert;
 
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -76,7 +76,7 @@ public class InlineEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
         final List<EncryptedKey> allKeys = keyInfo.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new InlineEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new InlineEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -96,7 +96,7 @@ public class InlineEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
         final List<EncryptedKey> allKeys = keyInfo.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new InlineEncryptedKeyResolver(Collections.singleton("bar"));
+        resolver = new InlineEncryptedKeyResolver(CollectionSupport.singleton("bar"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 0, "Incorrect number of resolved EncryptedKeys found");
@@ -138,7 +138,7 @@ public class InlineEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
         final List<EncryptedKey> allKeys = keyInfo.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new InlineEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new InlineEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 2, "Incorrect number of resolved EncryptedKeys found");
@@ -159,7 +159,7 @@ public class InlineEncryptedKeyResolverTest extends XMLObjectBaseTestCase {
         final List<EncryptedKey> allKeys = keyInfo.getEncryptedKeys();
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new InlineEncryptedKeyResolver(new HashSet<>(Arrays.asList("foo", "baz")));
+        resolver = new InlineEncryptedKeyResolver(CollectionSupport.setOf("foo", "baz"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 3, "Incorrect number of resolved EncryptedKeys found");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java
index 6ed8d4685..295b9e29e 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleDecryptionTest.java
@@ -23,7 +23,6 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.Arrays;
-import java.util.Collections;
 
 import javax.crypto.SecretKey;
 
@@ -58,12 +57,13 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 import org.w3c.dom.Document;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.xml.XMLParserException;
 
 /**
  * Simple tests for decryption.
  */
- at SuppressWarnings({"javadoc", "null"})
+ at SuppressWarnings("null")
 public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
     
     private KeyInfoCredentialResolver keyResolver;
@@ -250,7 +250,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
      */
     @Test(expectedExceptions=DecryptionException.class)
     public void testEncryptedDataAlgorithmBlacklistFail() throws DecryptionException {
-        Decrypter decrypter = new Decrypter(keyResolver, null, null, null, Collections.singleton(encURI));
+        Decrypter decrypter = new Decrypter(keyResolver, null, null, null, CollectionSupport.singleton(encURI));
         decrypter.decryptData(encryptedData);
     }
     
@@ -261,7 +261,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
      */
     @Test(expectedExceptions=DecryptionException.class)
     public void testEncryptedDataAlgorithmWhitelistFail() throws DecryptionException {
-        Decrypter decrypter = new Decrypter(keyResolver, null, null, Collections.singleton("urn-x:some:bogus:algo"), null);
+        Decrypter decrypter = new Decrypter(keyResolver, null, null, CollectionSupport.singleton("urn-x:some:bogus:algo"), null);
         decrypter.decryptData(encryptedData);
     }
     
@@ -273,7 +273,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
      */
     @Test()
     public void testEncryptedDataAlgorithmWhitelistPass() throws DecryptionException {
-        Decrypter decrypter = new Decrypter(keyResolver, null, null, Collections.singleton(encURI), null);
+        Decrypter decrypter = new Decrypter(keyResolver, null, null, CollectionSupport.singleton(encURI), null);
         decrypter.decryptData(encryptedData);
     }
     
@@ -285,7 +285,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
     @Test(expectedExceptions=DecryptionException.class)
     public void testEncryptedKeyAlgorithmBlacklistFail() throws DecryptionException {
         // Note: here testing the implicit digest method and MGF, which are the SHA-1 variants.
-        Decrypter decrypter = new Decrypter(null, kekResolver, null, null, Collections.singleton(kekURI));
+        Decrypter decrypter = new Decrypter(null, kekResolver, null, null, CollectionSupport.singleton(kekURI));
         decrypter.decryptKey(encryptedKey, encURI);
     }
     
@@ -310,7 +310,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
             Encrypter encrypter = new Encrypter();
             encryptedKey = encrypter.encryptKey(encKey, params, parserPool.newDocument());
             
-            Decrypter decrypter = new Decrypter(null, kekResolver, null, null, Collections.singleton(EncryptionConstants.ALGO_ID_DIGEST_SHA256));
+            Decrypter decrypter = new Decrypter(null, kekResolver, null, null, CollectionSupport.singleton(EncryptionConstants.ALGO_ID_DIGEST_SHA256));
             decrypter.decryptKey(encryptedKey, encURI);
         } finally {
             providerSupport.unloadBC();
@@ -338,7 +338,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
             Encrypter encrypter = new Encrypter();
             encryptedKey = encrypter.encryptKey(encKey, params, parserPool.newDocument());
             
-            Decrypter decrypter = new Decrypter(null, kekResolver, null, null, Collections.singleton(EncryptionConstants.ALGO_ID_MGF1_SHA256));
+            Decrypter decrypter = new Decrypter(null, kekResolver, null, null, CollectionSupport.singleton(EncryptionConstants.ALGO_ID_MGF1_SHA256));
             decrypter.decryptKey(encryptedKey, encURI);
         } finally {
             providerSupport.unloadBC();
@@ -355,7 +355,7 @@ public class SimpleDecryptionTest extends XMLObjectBaseTestCase {
     @Test(expectedExceptions=DecryptionException.class)
     public void testEncryptedKeyAlgorithmWhitelistFail() throws DecryptionException, EncryptionException, XMLParserException {
         // Note: here testing the implicit digest method and MGF, which are the SHA-1 variants.
-        Decrypter decrypter = new Decrypter(null, kekResolver, null, Collections.singleton("urn-x:some:bogus:algo"), null);
+        Decrypter decrypter = new Decrypter(null, kekResolver, null, CollectionSupport.singleton("urn-x:some:bogus:algo"), null);
         decrypter.decryptKey(encryptedKey, encURI);
     }
     
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleKeyInfoReferenceEncryptedKeyResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleKeyInfoReferenceEncryptedKeyResolverTest.java
index 89d241706..6da63d532 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleKeyInfoReferenceEncryptedKeyResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleKeyInfoReferenceEncryptedKeyResolverTest.java
@@ -18,9 +18,6 @@
 package org.opensaml.xmlsec.encryption.support.tests;
 
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -37,6 +34,8 @@ import org.opensaml.xmlsec.signature.KeyInfoReference;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 /**
  * Test the encrypted key resolver which dereferences KeyInfoReferences.
  */
@@ -89,7 +88,7 @@ public class SimpleKeyInfoReferenceEncryptedKeyResolverTest extends XMLObjectBas
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleKeyInfoReferenceEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new SimpleKeyInfoReferenceEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -115,7 +114,7 @@ public class SimpleKeyInfoReferenceEncryptedKeyResolverTest extends XMLObjectBas
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleKeyInfoReferenceEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new SimpleKeyInfoReferenceEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -144,7 +143,7 @@ public class SimpleKeyInfoReferenceEncryptedKeyResolverTest extends XMLObjectBas
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleKeyInfoReferenceEncryptedKeyResolver(new HashSet<>(Arrays.asList("foo", "baz")));
+        resolver = new SimpleKeyInfoReferenceEncryptedKeyResolver(CollectionSupport.setOf("foo", "baz"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 2, "Incorrect number of resolved EncryptedKeys found");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleRetrievalMethodEncryptedKeyResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleRetrievalMethodEncryptedKeyResolverTest.java
index df2583447..ba12d2209 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleRetrievalMethodEncryptedKeyResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/tests/SimpleRetrievalMethodEncryptedKeyResolverTest.java
@@ -18,11 +18,12 @@
 package org.opensaml.xmlsec.encryption.support.tests;
 
 import org.testng.annotations.Test;
+
+import net.shibboleth.shared.collection.CollectionSupport;
+
 import org.testng.Assert;
 
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 
@@ -89,7 +90,7 @@ public class SimpleRetrievalMethodEncryptedKeyResolverTest extends XMLObjectBase
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -116,7 +117,7 @@ public class SimpleRetrievalMethodEncryptedKeyResolverTest extends XMLObjectBase
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 0, "Incorrect number of resolved EncryptedKeys found");
@@ -141,7 +142,7 @@ public class SimpleRetrievalMethodEncryptedKeyResolverTest extends XMLObjectBase
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(Collections.singleton("foo"));
+        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(CollectionSupport.singleton("foo"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 1, "Incorrect number of resolved EncryptedKeys found");
@@ -168,7 +169,7 @@ public class SimpleRetrievalMethodEncryptedKeyResolverTest extends XMLObjectBase
         List<EncryptedKey> allKeys = getEncryptedKeys(sxo);
         Assert.assertFalse(allKeys.isEmpty());
         
-        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(new HashSet<>(Arrays.asList("foo", "baz")));
+        resolver = new SimpleRetrievalMethodEncryptedKeyResolver(CollectionSupport.setOf("foo", "baz"));
         
         List<EncryptedKey> resolved = generateList(encData, resolver);
         Assert.assertEquals(resolved.size(), 2, "Incorrect number of resolved EncryptedKeys found");
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionConfigurationTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionConfigurationTest.java
index 702c9e49f..bb31b57fa 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionConfigurationTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionConfigurationTest.java
@@ -21,7 +21,6 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.Arrays;
-import java.util.Collections;
 
 import javax.annotation.Nullable;
 
@@ -37,6 +36,8 @@ import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 @SuppressWarnings({"javadoc", "null"})
 public class BasicEncryptionConfigurationTest {
     
@@ -98,7 +99,7 @@ public class BasicEncryptionConfigurationTest {
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testDataEncryptionCredentialsImmutable() {
-        config.setDataEncryptionCredentials(Collections.singletonList(cred1));
+        config.setDataEncryptionCredentials(CollectionSupport.singletonList(cred1));
         config.getDataEncryptionCredentials().add(cred2);
     }
     
@@ -107,7 +108,7 @@ public class BasicEncryptionConfigurationTest {
         Assert.assertNotNull(config.getDataEncryptionAlgorithms());
         Assert.assertEquals(config.getDataEncryptionAlgorithms().size(), 0);
         
-        config.setDataEncryptionAlgorithms(Arrays.asList("   A   ", "   B    ", "   C    "));
+        config.setDataEncryptionAlgorithms(CollectionSupport.listOf("   A   ", "   B    ", "   C    "));
         
         Assert.assertNotNull(config.getDataEncryptionAlgorithms());
         Assert.assertEquals(config.getDataEncryptionAlgorithms().size(), 3);
@@ -123,7 +124,7 @@ public class BasicEncryptionConfigurationTest {
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testDataEncryptionAlgorithmURIsImmutable() {
-        config.setDataEncryptionAlgorithms(Arrays.asList("A", "B", "C"));
+        config.setDataEncryptionAlgorithms(CollectionSupport.listOf("A", "B", "C"));
         config.getDataEncryptionAlgorithms().add("D");
     }
     
@@ -132,7 +133,7 @@ public class BasicEncryptionConfigurationTest {
         Assert.assertNotNull(config.getKeyTransportEncryptionCredentials());
         Assert.assertEquals(config.getKeyTransportEncryptionCredentials().size(), 0);
         
-        config.setKeyTransportEncryptionCredentials(Arrays.asList(cred1, cred2));
+        config.setKeyTransportEncryptionCredentials(CollectionSupport.listOf(cred1, cred2));
         
         Assert.assertNotNull(config.getKeyTransportEncryptionCredentials());
         Assert.assertEquals(config.getKeyTransportEncryptionCredentials().size(), 2);
@@ -145,7 +146,7 @@ public class BasicEncryptionConfigurationTest {
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testKeyTransportEncryptionCredentialsImmutable() {
-        config.setKeyTransportEncryptionCredentials(Collections.singletonList(cred1));
+        config.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(cred1));
         config.getKeyTransportEncryptionCredentials().add(cred2);
     }
     
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
index d59b854e3..d2ee80e91 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicEncryptionParametersResolverTest.java
@@ -24,9 +24,7 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.spec.ECGenParameterSpec;
-import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
@@ -178,7 +176,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
 
     @Test
     public void testBasicRSA() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;        
@@ -194,10 +192,10 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testRSAWithAlgorithmOverrides() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         
-        config2.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
-        config2.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
+        config2.setDataEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
+        config2.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;        
@@ -213,7 +211,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testRSAWithBlacklist() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         config1.setExcludedAlgorithms(CollectionSupport.listOf(defaultRSAKeyTransportAlgo, defaultAES128DataAlgo, defaultAES192DataAlgo));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
@@ -230,7 +228,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testRSAWithWhitelist() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         config1.setIncludedAlgorithms(CollectionSupport.listOf(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
@@ -247,7 +245,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testRSAWithGeneratedDataCredential() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         
         resolver.setAutoGenerateDataEncryptionCredential(true);
         
@@ -271,16 +269,16 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     @Test
     public void testRSAOAEPParameters() throws ResolverException {
         EncryptionParameters params;
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         
         // Shouldn't resolve since not RSA OAEP
-        config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
+        config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
         params = resolver.resolveSingle(criteriaSet);
         assert params != null;
         assertNull(params.getRSAOAEPParameters());
         
         // Should resolve an empty instance
-        config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
+        config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
         params = resolver.resolveSingle(criteriaSet);
         assert params != null;
         
@@ -289,7 +287,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         assertTrue(oaep.isEmpty());
         
         // Should resolve full set of values from config3
-        config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
+        config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
         config3.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA1, EncryptionConstants.ALGO_ID_MGF1_SHA1, "dummy-oaep-params-3"));
         params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -300,7 +298,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         assertEquals(oaep.getOAEPParams(), "dummy-oaep-params-3");
         
         // Should resolve digest and mgf from config2, OAEPParams from config3 (merged)
-        config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
+        config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
         config2.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA256, EncryptionConstants.ALGO_ID_MGF1_SHA256, null));
         config3.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA1, EncryptionConstants.ALGO_ID_MGF1_SHA1, "dummy-oaep-params-3"));
         params = resolver.resolveSingle(criteriaSet);
@@ -313,7 +311,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         assertEquals(oaep.getOAEPParams(), "dummy-oaep-params-3");
         
         // Should resolve digest from config1, and mgf from config2 (merged), but with no merging from config3 
-        config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
+        config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
         config1.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA512, null, null));
         config2.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA256, EncryptionConstants.ALGO_ID_MGF1_SHA256, null));
         config2.setRSAOAEPParametersMerge(false);
@@ -328,7 +326,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         assertNull(oaep.getOAEPParams());
         
         // Should resolve empty instance based on config1 only, with no merging
-        config1.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
+        config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
         config1.setRSAOAEPParameters(null);
         config1.setRSAOAEPParametersMerge(false);
         config2.setRSAOAEPParameters(new RSAOAEPParameters(SignatureConstants.ALGO_ID_DIGEST_SHA256, EncryptionConstants.ALGO_ID_MGF1_SHA256, "dummy-oaep-params2"));
@@ -342,7 +340,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testECDHWithDirectDataEncryption() throws ResolverException {
-        config1.setDataEncryptionCredentials(Collections.singletonList(ecCred1));
+        config1.setDataEncryptionCredentials(CollectionSupport.singletonList(ecCred1));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -366,9 +364,9 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testECDHWithDirectDataEncryptionAndAlgorithmOverrides() throws ResolverException {
-        config1.setDataEncryptionCredentials(Collections.singletonList(ecCred1));
+        config1.setDataEncryptionCredentials(CollectionSupport.singletonList(ecCred1));
         
-        config2.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
+        config2.setDataEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -393,7 +391,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testECDHWithKeyWrap() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(ecCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(ecCred1));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -417,10 +415,10 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testECDHWithKeyWrapAndAlgorithmOverrides() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(ecCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(ecCred1));
         
-        config2.setKeyTransportEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_KEYWRAP_AES256));
-        config2.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192));
+        config2.setKeyTransportEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_KEYWRAP_AES256));
+        config2.setDataEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;        
@@ -445,7 +443,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testECDHWithKeyWrapAndGeneratedDataCredential() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(ecCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(ecCred1));
         
         resolver.setAutoGenerateDataEncryptionCredential(true);
         
@@ -478,7 +476,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testECDHWithKDFOverride() throws ResolverException {
-        config1.setDataEncryptionCredentials(Collections.singletonList(ecCred1));
+        config1.setDataEncryptionCredentials(CollectionSupport.singletonList(ecCred1));
         
         KeyAgreementEncryptionConfiguration ecConfig = new KeyAgreementEncryptionConfiguration();
         PBKDF2 kdf = new PBKDF2();
@@ -542,7 +540,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testAES128KeyWrap() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(aes128Cred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(aes128Cred1));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;        
@@ -558,7 +556,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testDataCredOnly() throws ResolverException {
-        config1.setDataEncryptionCredentials(Collections.singletonList(aes256Cred1));
+        config1.setDataEncryptionCredentials(CollectionSupport.singletonList(aes256Cred1));
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;        
@@ -612,9 +610,9 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testKeyTransportAlgorithmPredicate() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         config1.setKeyTransportEncryptionAlgorithms(CollectionSupport.listOf(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15, EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
-        config1.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128));
+        config1.setDataEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128));
         
         // Data algorithm -> key transport algorithm preferences mappings
         final HashMap<String,String> algoMap = new HashMap<>();
@@ -638,7 +636,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
         assertEquals(params.getDataEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128);
         assertEquals(params.getKeyTransportEncryptionAlgorithm(), EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP);
         
-        config1.setDataEncryptionAlgorithms(Collections.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
+        config1.setDataEncryptionAlgorithms(CollectionSupport.singletonList(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
         
         // Explicit preference with predicate, mapping # 2
         params = resolver.resolveSingle(criteriaSet);
@@ -650,8 +648,8 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testKeyInfoGenerationProfile() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config1.setDataEncryptionCredentials(Collections.singletonList(aes128Cred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
+        config1.setDataEncryptionCredentials(CollectionSupport.singletonList(aes128Cred1));
         
         criteriaSet.add(new KeyInfoGenerationProfileCriterion("testKeyInfoProfile"));
         
@@ -687,7 +685,7 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testResolve() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
         
         Iterable<EncryptionParameters> paramsIter = resolver.resolve(criteriaSet);
         assertNotNull(paramsIter);
@@ -720,8 +718,8 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testNoKeyTransportAlgorithms() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config3.setKeyTransportEncryptionAlgorithms(new ArrayList<>());
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
+        config3.setKeyTransportEncryptionAlgorithms(CollectionSupport.emptyList());
         
         EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -730,9 +728,9 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testNoDataEncryptionAlgorithmForResolvedDataCredential() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config1.setDataEncryptionCredentials(Collections.singletonList(aes128Cred1));
-        config3.setDataEncryptionAlgorithms(new ArrayList<>());
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
+        config1.setDataEncryptionCredentials(CollectionSupport.singletonList(aes128Cred1));
+        config3.setDataEncryptionAlgorithms(CollectionSupport.emptyList());
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
@@ -741,8 +739,8 @@ public class BasicEncryptionParametersResolverTest extends XMLObjectBaseTestCase
     
     @Test
     public void testNoDataEncryptionAlgorithmForEncrypterAutoGen() throws ResolverException {
-        config1.setKeyTransportEncryptionCredentials(Collections.singletonList(rsaCred1));
-        config3.setDataEncryptionAlgorithms(new ArrayList<>());
+        config1.setKeyTransportEncryptionCredentials(CollectionSupport.singletonList(rsaCred1));
+        config3.setDataEncryptionAlgorithms(CollectionSupport.emptyList());
         
         final EncryptionParameters params = resolver.resolveSingle(criteriaSet);
         
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfigurationTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfigurationTest.java
index 5aa2d2af6..c0abfeb12 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfigurationTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningConfigurationTest.java
@@ -21,7 +21,6 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.Arrays;
-import java.util.Collections;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
@@ -33,6 +32,8 @@ import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
+
 @SuppressWarnings({"javadoc", "null"})
 public class BasicSignatureSigningConfigurationTest {
     
@@ -75,7 +76,7 @@ public class BasicSignatureSigningConfigurationTest {
         Assert.assertNotNull(config.getSigningCredentials());
         Assert.assertEquals(config.getSigningCredentials().size(), 0);
         
-        config.setSigningCredentials(Arrays.asList(cred1, cred2));
+        config.setSigningCredentials(CollectionSupport.listOf(cred1, cred2));
         
         Assert.assertNotNull(config.getSigningCredentials());
         Assert.assertEquals(config.getSigningCredentials().size(), 2);
@@ -88,7 +89,7 @@ public class BasicSignatureSigningConfigurationTest {
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testSigningCredentialsImmutable() throws NoSuchAlgorithmException, NoSuchProviderException {
-        config.setSigningCredentials(Collections.singletonList(cred1));
+        config.setSigningCredentials(CollectionSupport.singletonList(cred1));
         config.getSigningCredentials().add(cred2);
     }
 
@@ -113,7 +114,7 @@ public class BasicSignatureSigningConfigurationTest {
 
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testSignatureAlgorithmURIsImmutable() {
-        config.setSignatureAlgorithms(Arrays.asList("A", "B", "C"));
+        config.setSignatureAlgorithms(CollectionSupport.listOf("A", "B", "C"));
         config.getSignatureAlgorithms().add("D");
     }
 
@@ -138,7 +139,7 @@ public class BasicSignatureSigningConfigurationTest {
 
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testSignatureReferenceDigestMethodsImmutable() {
-        config.setSignatureReferenceDigestMethods(Arrays.asList("A", "B", "C"));
+        config.setSignatureReferenceDigestMethods(CollectionSupport.listOf("A", "B", "C"));
         config.getSignatureReferenceDigestMethods().add("D");
     }
 
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
index 15660a5fa..d43b2fcac 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/impl/BasicSignatureSigningParametersResolverTest.java
@@ -23,12 +23,12 @@ import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 
 import javax.crypto.SecretKey;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.ConstraintViolationException;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -105,7 +105,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
         
         // Set these as defaults on the last config in the chain, just so don't have to set in every test.
         config3.setSignatureAlgorithms(List.of(defaultRSAAlgo, defaultDSAAlgo, defaultECAlgo, defaultHMACAlgo));
-        config3.setSignatureReferenceDigestMethods(Collections.singletonList(defaultReferenceDigest));
+        config3.setSignatureReferenceDigestMethods(CollectionSupport.singletonList(defaultReferenceDigest));
         config3.setSignatureCanonicalizationAlgorithm(defaultC14N);
         config3.setSignatureHMACOutputLength(defaultHMACOutputLength);
         
@@ -123,7 +123,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testBasicRSA() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -139,9 +139,9 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testRSAWithAlgorithmOverride() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         
-        config2.setSignatureAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        config2.setSignatureAlgorithms(CollectionSupport.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -157,7 +157,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testRSAWithBlacklist() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         config1.setExcludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1, SignatureConstants.ALGO_ID_DIGEST_SHA1));
         
         // Deliberately putting SHA-1 variants first here.  They should be filtered out.
@@ -178,7 +178,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testRSAWithWhitelist() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         config1.setIncludedAlgorithms(List.of(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256, SignatureConstants.ALGO_ID_DIGEST_SHA256));
         
         // Deliberately putting SHA-1 variants first here.  They should be filtered out.
@@ -199,7 +199,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testBasicDSA() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(dsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(dsaCred));
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -217,7 +217,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     public void testBasicEC() throws ResolverException {
         // EC support isn't universal
         if (ecCred != null) {
-            config1.setSigningCredentials(Collections.singletonList(ecCred));
+            config1.setSigningCredentials(CollectionSupport.singletonList(ecCred));
             
             final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
             assert params != null;
@@ -234,7 +234,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testBasicHMAC() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(hmacCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(hmacCred));
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -250,10 +250,10 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testHMACWithOverrides() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(hmacCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(hmacCred));
         
-        config2.setSignatureAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_MAC_HMAC_SHA256));
-        config2.setSignatureReferenceDigestMethods(Collections.singletonList(SignatureConstants.ALGO_ID_DIGEST_SHA256));
+        config2.setSignatureAlgorithms(CollectionSupport.singletonList(SignatureConstants.ALGO_ID_MAC_HMAC_SHA256));
+        config2.setSignatureReferenceDigestMethods(CollectionSupport.singletonList(SignatureConstants.ALGO_ID_DIGEST_SHA256));
         config2.setSignatureHMACOutputLength(160);
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
@@ -270,7 +270,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testC14NOverride() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         
         config2.setSignatureCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N11_WITH_COMMENTS);
         
@@ -288,7 +288,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testReferenceC14NOverride() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         
         config2.setSignatureReferenceCanonicalizationAlgorithm(SignatureConstants.TRANSFORM_C14N_EXCL_WITH_COMMENTS);
         
@@ -364,10 +364,10 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testCredOverrides() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(dsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(dsaCred));
         
         config2.setSigningCredentials(List.of(rsaCred, dsaCred, hmacCred));
-        config2.setSignatureAlgorithms(Collections.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
+        config2.setSignatureAlgorithms(CollectionSupport.singletonList(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
         
         final SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
         assert params != null;
@@ -383,7 +383,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testKeyInfoGenerationProfile() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         
         criteriaSet.add(new KeyInfoGenerationProfileCriterion("testKeyInfoProfile"));
         
@@ -412,7 +412,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testResolve() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         
         Iterable<SignatureSigningParameters> paramsIter = resolver.resolve(criteriaSet);
         assertNotNull(paramsIter);
@@ -444,7 +444,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testNoAlgorithms() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         config3.setSignatureAlgorithms(new ArrayList<String>());
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
@@ -454,7 +454,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testNoReferenceDigestMethods() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         config3.setSignatureReferenceDigestMethods(new ArrayList<String>());
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
@@ -464,7 +464,7 @@ public class BasicSignatureSigningParametersResolverTest extends XMLObjectBaseTe
     
     @Test
     public void testNoC14NAlgorithm() throws ResolverException {
-        config1.setSigningCredentials(Collections.singletonList(rsaCred));
+        config1.setSigningCredentials(CollectionSupport.singletonList(rsaCred));
         config3.setSignatureCanonicalizationAlgorithm(null);
         
         SignatureSigningParameters params = resolver.resolveSingle(criteriaSet);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/ChainingKeyInfoCredentialResolverTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/ChainingKeyInfoCredentialResolverTest.java
index 17924496d..ff21a4a6c 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/ChainingKeyInfoCredentialResolverTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/keyinfo/impl/ChainingKeyInfoCredentialResolverTest.java
@@ -19,8 +19,6 @@ package org.opensaml.xmlsec.keyinfo.impl;
 
 import java.security.KeyPair;
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 import java.util.NoSuchElementException;
@@ -34,6 +32,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -95,7 +94,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
      */
     @Test
     public void testOneEmptyMember() throws ResolverException {
-        chainingResolver = new ChainingKeyInfoCredentialResolver(Collections.singletonList(staticResolverEmpty));
+        chainingResolver = new ChainingKeyInfoCredentialResolver(CollectionSupport.singletonList(staticResolverEmpty));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 0);
@@ -109,7 +108,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
     @Test
     public void testMultipleEmptyMember() throws ResolverException {
         chainingResolver = new ChainingKeyInfoCredentialResolver(
-                Arrays.asList(staticResolverEmpty, staticResolverEmpty, staticResolverEmpty));
+                CollectionSupport.listOf(staticResolverEmpty, staticResolverEmpty, staticResolverEmpty));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 0);
@@ -122,7 +121,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
      */
     @Test
     public void testOneMember() throws ResolverException {
-        chainingResolver = new ChainingKeyInfoCredentialResolver(Collections.singletonList(staticResolver12));
+        chainingResolver = new ChainingKeyInfoCredentialResolver(CollectionSupport.singletonList(staticResolver12));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 2, cred1, cred2);
@@ -136,7 +135,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
     @Test
     public void testMultipleMembers() throws ResolverException {
         chainingResolver = new ChainingKeyInfoCredentialResolver(
-                Arrays.asList(staticResolver12, staticResolver3, staticResolverEmpty, staticResolver45));
+                CollectionSupport.listOf(staticResolver12, staticResolver3, staticResolverEmpty, staticResolver45));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 5, cred1, cred2, cred3, cred4, cred5);
@@ -151,7 +150,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
     @Test
     public void testOrderingMultipleMembers() throws ResolverException {
         chainingResolver = new ChainingKeyInfoCredentialResolver(
-                Arrays.asList(staticResolverEmpty, staticResolver45, staticResolverEmpty, staticResolver3, staticResolver12));
+                CollectionSupport.listOf(staticResolverEmpty, staticResolver45, staticResolverEmpty, staticResolver3, staticResolver12));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 5, cred1, cred2, cred3, cred4, cred5);
@@ -181,7 +180,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
      */
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testRemove() throws ResolverException {
-        chainingResolver = new ChainingKeyInfoCredentialResolver(Collections.singletonList(staticResolver12));
+        chainingResolver = new ChainingKeyInfoCredentialResolver(CollectionSupport.singletonList(staticResolver12));
         
         final Iterator<Credential> iter = chainingResolver.resolve(criteriaSet).iterator();
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
@@ -196,7 +195,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
      */
     @Test(expectedExceptions=NoSuchElementException.class)
     public void testNoMoreMembers() throws ResolverException {
-        chainingResolver = new ChainingKeyInfoCredentialResolver(Arrays.asList(staticResolver12, staticResolver3));
+        chainingResolver = new ChainingKeyInfoCredentialResolver(CollectionSupport.listOf(staticResolver12, staticResolver3));
         
         final Iterator<Credential> iter = chainingResolver.resolve(criteriaSet).iterator();
         Assert.assertTrue(iter.hasNext(), "Should have next member");
@@ -212,7 +211,7 @@ public class ChainingKeyInfoCredentialResolverTest extends XMLObjectBaseTestCase
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testChainUnmodifiable() {
-        chainingResolver = new ChainingKeyInfoCredentialResolver(Collections.singletonList(staticResolver12));
+        chainingResolver = new ChainingKeyInfoCredentialResolver(CollectionSupport.singletonList(staticResolver12));
         chainingResolver.getResolverChain().add(staticResolver3);
     }
     
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java
index eb952783a..6350795ad 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/mock/SignableSimpleXMLObject.java
@@ -20,7 +20,6 @@
  */
 package org.opensaml.xmlsec.mock;
 
-import java.util.Collections;
 import java.util.LinkedList;
 import java.util.List;
 
@@ -36,6 +35,9 @@ import org.opensaml.core.xml.util.IndexedXMLObjectChildrenList;
 import org.opensaml.core.xml.util.XMLObjectChildrenList;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.signature.AbstractSignableXMLObject;
+import org.opensaml.xmlsec.signature.Signature;
+
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * Simple XMLObject that can be used for testing
@@ -177,9 +179,13 @@ public class SignableSimpleXMLObject extends AbstractSignableXMLObject implement
             children.add(encryptedData);
         }
         children.addAll(unknownXMLObjects);
-        children.add(getSignature());
         
-        return Collections.unmodifiableList(children);
+        final Signature sig = getSignature();
+        if (sig != null) {
+            children.add(sig);
+        }
+        
+        return CollectionSupport.copyToList(children);
     }
 
     /** {@inheritDoc} */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list