[java-opensaml] 02/02: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Wed Jun 7 15:46:42 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=ed997d56c437485e1cd8c5b3b30efd6531659187

commit ed997d56c437485e1cd8c5b3b30efd6531659187
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 7 11:46:37 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Review opensaml-saml-api/impl.
---
 .../opensaml/saml/common/SAMLObjectBuilder.java    |  2 +-
 .../saml/common/SAMLObjectContentReference.java    |  9 ++--
 .../opensaml/saml/common/SignableSAMLObject.java   |  3 +-
 .../saml/common/assertion/ValidationContext.java   | 11 +++--
 .../common/assertion/ValidationProcessingData.java |  2 +-
 .../common/binding/AbstractEndpointResolver.java   | 13 ++---
 .../saml/common/binding/SAMLBindingSupport.java    |  5 +-
 .../saml/common/binding/artifact/SAMLArtifact.java |  4 +-
 .../binding/artifact/SAMLSourceIDArtifact.java     |  2 +-
 .../artifact/SAMLSourceLocationArtifact.java       |  2 +-
 .../saml/common/binding/artifact/package-info.java |  5 +-
 .../saml/common/binding/decoding/package-info.java |  5 +-
 .../saml/common/binding/encoding/package-info.java |  3 ++
 .../opensaml/saml/common/binding/package-info.java |  5 +-
 .../messaging/context/ChannelBindingsContext.java  |  5 +-
 .../SAMLMessageReceivedEndpointContext.java        |  7 ++-
 .../messaging/context/navigate/package-info.java   |  4 +-
 .../common/messaging/context/package-info.java     |  5 +-
 .../messaging/logic/ProxiedRequesterPredicate.java |  5 +-
 .../saml/common/messaging/logic/package-info.java  |  4 +-
 .../saml/common/messaging/package-info.java        |  5 +-
 .../soap/SAMLSOAPClientContextBuilder.java         |  5 +-
 .../saml/common/messaging/soap/package-info.java   |  5 +-
 .../org/opensaml/saml/common/package-info.java     |  5 +-
 .../logic/AbstractNameIDPolicyPredicate.java       |  3 +-
 .../profile/logic/DefaultLocalErrorPredicate.java  |  3 +-
 .../profile/logic/EntityAttributesPredicate.java   | 28 +++++------
 .../profile/logic/EntityGroupNamePredicate.java    |  7 ++-
 .../common/profile/logic/EntityIdPredicate.java    |  5 +-
 .../MetadataNameIdentifierFormatStrategy.java      |  8 ++--
 .../logic/RegistrationAuthorityPredicate.java      |  5 +-
 .../profile/logic/RegistrationPolicyPredicate.java |  5 +-
 .../saml/common/profile/logic/package-info.java    |  4 +-
 .../opensaml/saml/common/profile/package-info.java |  4 +-
 .../saml/common/xml/SAMLSchemaBuilder.java         | 21 ++++-----
 .../org/opensaml/saml/common/xml/package-info.java |  3 ++
 .../opensaml/saml/config/SAMLConfiguration.java    | 24 ++--------
 .../saml/config/SAMLConfigurationSupport.java      |  3 +-
 .../org/opensaml/saml/config/package-info.java     |  3 ++
 .../opensaml/saml/criterion/ArtifactCriterion.java |  4 +-
 .../saml/criterion/BestMatchLocationCriterion.java |  4 +-
 .../opensaml/saml/criterion/BindingCriterion.java  | 12 ++---
 .../opensaml/saml/criterion/EndpointCriterion.java |  5 +-
 .../saml/criterion/EntityRoleCriterion.java        |  5 +-
 .../opensaml/saml/criterion/ProtocolCriterion.java |  5 +-
 .../saml/criterion/RoleDescriptorCriterion.java    |  5 +-
 .../criterion/StartsWithLocationCriterion.java     | 16 +++----
 .../org/opensaml/saml/criterion/package-info.java  |  4 +-
 .../opensaml/saml/ext/idpdisco/package-info.java   |  4 +-
 .../opensaml/saml/ext/reqattr/package-info.java    |  4 +-
 .../opensaml/saml/ext/saml1md/package-info.java    |  4 +-
 .../opensaml/saml/ext/saml2alg/package-info.java   |  4 +-
 .../opensaml/saml/ext/saml2aslo/package-info.java  |  4 +-
 .../opensaml/saml/ext/saml2cb/package-info.java    |  4 +-
 .../saml/ext/saml2delrestrict/package-info.java    |  4 +-
 .../saml/ext/saml2mdattr/package-info.java         |  4 +-
 .../saml/ext/saml2mdquery/package-info.java        |  4 +-
 .../saml/ext/saml2mdreqinit/package-info.java      |  4 +-
 .../opensaml/saml/ext/saml2mdrpi/package-info.java |  4 +-
 .../opensaml/saml/ext/saml2mdui/package-info.java  |  4 +-
 .../org/opensaml/saml/ext/samlec/package-info.java |  4 +-
 .../saml/ext/samlpthrpty/package-info.java         |  4 +-
 .../entity/DetectDuplicateEntityIDsCriterion.java  | 10 ++--
 .../metadata/criteria/entity/package-info.java     |  4 +-
 .../saml/metadata/criteria/role/package-info.java  |  4 +-
 .../org/opensaml/saml/metadata/package-info.java   |  4 +-
 .../metadata/resolver/BatchMetadataResolver.java   |  4 +-
 .../resolver/ChainingMetadataResolver.java         | 23 ++++-----
 .../resolver/RefreshableMetadataResolver.java      |  6 +--
 .../resolver/filter/MetadataFilterChain.java       |  9 ++--
 .../resolver/filter/MetadataNodeProcessor.java     |  2 +-
 .../metadata/resolver/filter/package-info.java     |  4 +-
 .../metadata/resolver/index/MetadataIndex.java     |  6 +--
 .../index/SimpleStringMetadataIndexKey.java        |  6 +--
 .../saml/metadata/resolver/index/package-info.java |  4 +-
 .../saml/metadata/resolver/package-info.java       |  4 +-
 .../support/AttributeConsumingServiceSelector.java |  4 +-
 .../saml/metadata/support/package-info.java        |  4 +-
 .../artifact/SAML1ArtifactType0001Builder.java     |  4 +-
 .../saml/saml1/binding/artifact/package-info.java  |  4 +-
 .../opensaml/saml/saml1/core/AttributeQuery.java   |  4 +-
 .../org/opensaml/saml/saml1/core/package-info.java |  4 +-
 .../profile/SAML1NameIdentifierGenerator.java      |  1 -
 .../opensaml/saml/saml1/profile/package-info.java  |  4 +-
 .../saml2/assertion/SAML20AssertionValidator.java  |  7 ++-
 .../saml/saml2/assertion/StatementValidator.java   |  5 +-
 .../assertion/SubjectConfirmationValidator.java    |  1 +
 .../saml/saml2/binding/artifact/SAML2Artifact.java |  2 +-
 .../artifact/SAML2ArtifactBuilderFactory.java      | 17 ++++---
 .../artifact/SAML2ArtifactType0004Builder.java     |  3 +-
 .../saml/saml2/binding/artifact/package-info.java  |  4 +-
 .../IsTimeboundSAMLObjectValidPredicate.java       |  2 +-
 .../opensaml/saml/saml2/common/SAML2Support.java   |  2 +-
 .../opensaml/saml/saml2/common/package-info.java   |  4 +-
 .../org/opensaml/saml/saml2/core/package-info.java |  4 +-
 .../org/opensaml/saml/saml2/ecp/package-info.java  |  4 +-
 .../opensaml/saml/saml2/encryption/Decrypter.java  |  4 +-
 .../opensaml/saml/saml2/encryption/Encrypter.java  | 54 ++++++++++-----------
 .../saml/saml2/encryption/package-info.java        |  4 +-
 .../opensaml/saml/saml2/metadata/package-info.java |  4 +-
 .../saml/saml2/profile/SAML2NameIDGenerator.java   |  1 -
 .../saml/saml2/profile/context/package-info.java   |  6 ++-
 .../opensaml/saml/saml2/profile/package-info.java  |  4 +-
 .../saml2/wssecurity/SAML20AssertionToken.java     |  2 +-
 .../saml/saml2/wssecurity/package-info.java        |  4 +-
 ...etadataKeyAgreementEncryptionConfiguration.java |  6 +--
 .../org/opensaml/saml/security/package-info.java   |  4 +-
 .../impl/ExpiringSAMLArtifactMapEntryFactory.java  |  1 -
 .../StorageServiceSAMLArtifactMapEntryFactory.java |  2 -
 .../common/binding/artifact/impl/package-info.java |  5 +-
 .../PopulateSignatureSigningParametersHandler.java |  3 +-
 .../SAMLAddAttributeConsumingServiceHandler.java   |  3 +-
 .../binding/impl/SAMLMetadataLookupHandler.java    |  2 +-
 .../saml/common/binding/impl/package-info.java     |  5 +-
 .../BaseSAMLSimpleSignatureSecurityHandler.java    | 12 +++--
 ...ecordServerTLSEntityAuthenticationtHandler.java |  2 -
 .../impl/OperationContextEntityIDLookup.java       |  2 +-
 .../impl/ReceivedEndpointSecurityHandler.java      |  5 +-
 .../SAMLOutboundProtocolMessageSigningHandler.java |  1 -
 .../common/binding/security/impl/package-info.java |  5 +-
 .../profile/impl/AddInResponseToToResponse.java    |  5 +-
 .../impl/ChainingNameIdentifierGenerator.java      |  4 +-
 .../saml/common/profile/impl/package-info.java     |  4 +-
 .../config/impl/SAMLConfigurationInitializer.java  |  9 ++--
 .../config/impl/XMLObjectProviderInitializer.java  |  2 +-
 .../opensaml/saml/config/impl/package-info.java    |  4 +-
 .../saml/ext/idpdisco/impl/package-info.java       |  4 +-
 .../saml/ext/reqattr/impl/package-info.java        |  5 +-
 .../saml/ext/saml1md/impl/package-info.java        |  4 +-
 .../saml/ext/saml2alg/impl/package-info.java       |  4 +-
 .../saml/ext/saml2aslo/impl/package-info.java      |  4 +-
 .../saml/ext/saml2cb/impl/package-info.java        |  4 +-
 .../ext/saml2delrestrict/impl/package-info.java    |  4 +-
 .../saml/ext/saml2mdattr/impl/package-info.java    |  4 +-
 .../saml/ext/saml2mdquery/impl/package-info.java   |  4 +-
 .../saml/ext/saml2mdreqinit/impl/package-info.java |  4 +-
 .../saml/ext/saml2mdrpi/impl/package-info.java     |  4 +-
 .../saml/ext/saml2mdui/impl/package-info.java      |  4 +-
 .../saml/ext/samlec/impl/package-info.java         |  4 +-
 .../saml/ext/samlpthrpty/impl/package-info.java    |  4 +-
 ...aluableEntityRoleEntityDescriptorCriterion.java | 15 +++---
 .../criteria/entity/impl/package-info.java         |  3 ++
 .../EvaluableEntityRoleDescriptorCriterion.java    | 13 ++---
 .../EvaluableProtocolRoleDescriptorCriterion.java  | 13 ++---
 .../RoleDescriptorCriterionPredicateRegistry.java  |  2 +-
 .../metadata/criteria/role/impl/package-info.java  |  3 ++
 .../resolver/filter/data/impl/package-info.java    |  4 +-
 .../resolver/filter/impl/AlgorithmFilter.java      |  3 +-
 .../filter/impl/ByReferenceMetadataFilter.java     |  5 +-
 .../filter/impl/EntityAttributesFilter.java        |  6 +--
 .../resolver/filter/impl/EntityRoleFilter.java     |  7 ++-
 .../resolver/filter/impl/NameIDFormatFilter.java   |  5 +-
 .../filter/impl/NodeProcessingMetadataFilter.java  |  3 +-
 .../resolver/filter/impl/package-info.java         |  6 ++-
 .../impl/AbstractBatchMetadataResolver.java        | 47 ++++++++++--------
 .../impl/AbstractDynamicMetadataResolver.java      | 55 ++++++++++------------
 .../resolver/impl/AbstractMetadataResolver.java    |  6 +--
 .../impl/AbstractReloadingMetadataResolver.java    |  2 +-
 .../resolver/impl/CompositeMetadataResolver.java   |  9 ++--
 .../DefaultLocalDynamicSourceKeyGenerator.java     |  3 +-
 .../impl/LocalDynamicMetadataResolver.java         |  2 +-
 .../MetadataQueryProtocolRequestURLBuilder.java    | 15 +++---
 .../impl/PredicateRoleDescriptorResolver.java      | 10 ++--
 .../resolver/impl/SAMLArtifactURLBuilder.java      |  4 +-
 .../saml/metadata/resolver/impl/package-info.java  | 13 ++---
 .../resolver/index/impl/EndpointMetadataIndex.java | 20 ++++----
 .../index/impl/FunctionDrivenMetadataIndex.java    |  9 ++--
 .../index/impl/LockableMetadataIndexManager.java   | 13 ++---
 .../resolver/index/impl/MetadataIndexManager.java  | 13 ++---
 .../resolver/index/impl/MetadataIndexStore.java    |  3 +-
 .../resolver/index/impl/RoleMetadataIndex.java     | 13 +++--
 .../index/impl/SAMLArtifactMetadataIndex.java      | 18 +++----
 .../metadata/resolver/index/impl/package-info.java |  4 +-
 .../binding/decoding/impl/HTTPArtifactDecoder.java |  8 ++--
 .../binding/decoding/impl/HTTPPostDecoder.java     |  2 +-
 .../impl/HttpClientResponseSOAP11Decoder.java      |  2 +-
 .../saml1/binding/decoding/impl/package-info.java  |  4 +-
 .../saml1/binding/encoding/impl/package-info.java  |  4 +-
 .../saml/saml1/binding/impl/package-info.java      |  4 +-
 .../saml/saml1/core/impl/package-info.java         |  4 +-
 .../profile/impl/AddNameIdentifierToSubjects.java  |  1 -
 .../saml1/profile/impl/AddStatusToResponse.java    | 12 ++---
 .../impl/AddSubjectConfirmationToSubjects.java     |  8 ++--
 .../saml/saml1/profile/impl/package-info.java      |  4 +-
 .../saml/saml2/assertion/impl/package-info.java    |  4 +-
 .../binding/decoding/impl/HTTPArtifactDecoder.java |  8 ++--
 .../binding/decoding/impl/HTTPPostDecoder.java     |  6 +--
 .../decoding/impl/HTTPPostSimpleSignDecoder.java   |  4 +-
 .../decoding/impl/HTTPRedirectDeflateDecoder.java  |  4 +-
 .../saml2/binding/decoding/impl/package-info.java  |  4 +-
 .../encoding/impl/HTTPPostSimpleSignEncoder.java   |  6 +--
 .../encoding/impl/HTTPRedirectDeflateEncoder.java  |  3 +-
 .../saml2/binding/encoding/impl/package-info.java  |  6 ++-
 .../impl/ExtractProxiedRequestersHandler.java      |  2 +-
 .../saml/saml2/binding/impl/package-info.java      |  6 ++-
 .../ExtractChannelBindingsExtensionsHandler.java   |  6 +--
 .../impl/ExtractChannelBindingsHeadersHandler.java |  5 +-
 .../SAML2HTTPPostSimpleSignSecurityHandler.java    | 10 ++--
 ...TTPRedirectDeflateSignatureSecurityHandler.java |  2 +-
 .../saml2/binding/security/impl/package-info.java  |  6 ++-
 .../saml/saml2/core/impl/package-info.java         |  4 +-
 .../opensaml/saml/saml2/ecp/impl/package-info.java |  4 +-
 .../saml/saml2/metadata/impl/package-info.java     | 13 ++---
 .../saml2/profile/impl/AddNameIDToSubjects.java    |  4 +-
 .../saml2/profile/impl/AddStatusToResponse.java    | 11 ++---
 .../DefaultAssertionValidationContextBuilder.java  | 17 ++++---
 .../saml2/profile/impl/ValidateAssertions.java     |  9 ++--
 .../saml/saml2/profile/impl/package-info.java      |  4 +-
 ...ultSAML20AssertionValidationContextBuilder.java | 10 ++--
 ...ecuritySAML20AssertionTokenSecurityHandler.java |  7 ++-
 .../wssecurity/messaging/impl/package-info.java    |  5 +-
 .../security/impl/MetadataCredentialResolver.java  | 14 ++++--
 .../SAMLMetadataEncryptionParametersResolver.java  |  7 +--
 ...MetadataSignatureSigningParametersResolver.java |  6 ++-
 .../impl/SAMLSignatureProfileValidator.java        | 30 +++++++-----
 .../opensaml/saml/security/impl/package-info.java  |  4 +-
 216 files changed, 768 insertions(+), 626 deletions(-)

diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectBuilder.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectBuilder.java
index d3fc7c293..71b8066c5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectBuilder.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectBuilder.java
@@ -33,5 +33,5 @@ public interface SAMLObjectBuilder<SAMLObjectType extends SAMLObject> extends XM
      * 
      * @return built SAMLObject
      */
-    @Nonnull public abstract SAMLObjectType buildObject();
+    @Nonnull abstract SAMLObjectType buildObject();
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectContentReference.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectContentReference.java
index d88d44b0f..69ef02d30 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectContentReference.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SAMLObjectContentReference.java
@@ -24,7 +24,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.LazyList;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -85,7 +84,7 @@ public class SAMLObjectContentReference implements ConfigurableContentReference,
     @Nullable private String digestAlgorithm;
 
     /** Transforms applied to the content. */
-    @Nonnull @NonnullElements private List<String> transforms;
+    @Nonnull private List<String> transforms;
 
     /**
      * Constructor.
@@ -108,7 +107,7 @@ public class SAMLObjectContentReference implements ConfigurableContentReference,
      * 
      * @return the transforms applied to the content prior to digest generation
      */
-    @Nonnull @NonnullElements @Live public List<String> getTransforms() {
+    @Nonnull @Live public List<String> getTransforms() {
         return transforms;
     }
 
@@ -180,9 +179,9 @@ public class SAMLObjectContentReference implements ConfigurableContentReference,
      * @param namespacePrefixes the namespace prefix set to be populated
      * @param signatureContent the XMLObject whose namespace prefixes will be used to populate the set
      */
-    private void populateNamespacePrefixes(@Nonnull @NonnullElements final Set<String> namespacePrefixes,
+    private void populateNamespacePrefixes(@Nonnull @Live final Set<String> namespacePrefixes,
             @Nonnull final XMLObject signatureContent) {
-        for (final String prefix: signatureContent.getNamespaceManager().getNonVisibleNamespacePrefixes()) {
+        for (final String prefix : signatureContent.getNamespaceManager().getNonVisibleNamespacePrefixes()) {
             if (prefix != null) {
                 // For the default namespace prefix, exclusive c14n uses the special token "#default".
                 // Apache xmlsec requires this to be represented in the set with the
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SignableSAMLObject.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SignableSAMLObject.java
index a9cd4b377..e6c0cedb4 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SignableSAMLObject.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/SignableSAMLObject.java
@@ -31,5 +31,6 @@ public interface SignableSAMLObject extends SignableXMLObject, SAMLObject {
      * 
      * @return the value of this SAMLObject ID attribute
      */
-    @Nullable public String getSignatureReferenceID();
+    @Nullable String getSignatureReferenceID();
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java
index b779d31a6..576638065 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationContext.java
@@ -29,6 +29,7 @@ import javax.annotation.concurrent.NotThreadSafe;
 
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyMap;
@@ -40,10 +41,10 @@ import net.shibboleth.shared.collection.LazyMap;
 public class ValidationContext {
 
     /** Static parameters used as input to the validation process. */
-    @Nonnull private Map<String, Object> staticParameters;
+    @Nonnull @NullableElements private Map<String, Object> staticParameters;
 
     /** Dynamic parameters used as input to, and output from, the validation process. */
-    @Nonnull private Map<String, Object> dynamicParameters;
+    @Nonnull @NullableElements private Map<String, Object> dynamicParameters;
 
     /** Error messaging describing what validation check an assertion failed. */
     @Nonnull private final List<String> validationFailureMessages;
@@ -58,7 +59,7 @@ public class ValidationContext {
      * 
      * @param newStaticParameters static parameters for the validation evaluation
      */
-    public ValidationContext(@Nullable final Map<String, Object> newStaticParameters) {
+    public ValidationContext(@Nullable @NullableElements final Map<String, Object> newStaticParameters) {
         if (newStaticParameters == null) {
             staticParameters = CollectionSupport.emptyMap();
         } else {
@@ -74,7 +75,7 @@ public class ValidationContext {
      * 
      * @return static parameters used as input to the validation process
      */
-    @Nonnull @Unmodifiable @NotLive public Map<String, Object> getStaticParameters() {
+    @Nonnull at NullableElements @Unmodifiable @NotLive public Map<String, Object> getStaticParameters() {
         return staticParameters;
     }
 
@@ -83,7 +84,7 @@ public class ValidationContext {
      * 
      * @return dynamic parameters used input to, and output from, the validation process
      */
-    @Nonnull @Live public Map<String, Object> getDynamicParameters() {
+    @Nonnull @NullableElements @Live public Map<String, Object> getDynamicParameters() {
         return dynamicParameters;
     }
 
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationProcessingData.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationProcessingData.java
index a4bbd160b..d6f05c402 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationProcessingData.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/assertion/ValidationProcessingData.java
@@ -67,4 +67,4 @@ public class ValidationProcessingData {
         return result;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
index 354867670..9c57c94b4 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
@@ -35,7 +35,6 @@ import org.opensaml.saml.saml2.metadata.Endpoint;
 import org.opensaml.saml.saml2.metadata.IndexedEndpoint;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -122,7 +121,7 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements public Iterable<EndpointType> resolve(@Nullable final CriteriaSet criteria)
+    @Nonnull public Iterable<EndpointType> resolve(@Nullable final CriteriaSet criteria)
             throws ResolverException {
         final EndpointCriterion<EndpointType> endpointCriterion = validateCriteria(criteria);
         assert criteria != null;
@@ -278,8 +277,7 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
      * 
      * @return mutable list of endpoints from the metadata
      */
-    @Nonnull @NonnullElements private List<EndpointType> getCandidatesFromMetadata(
-            @Nonnull final CriteriaSet criteria) {
+    @Nonnull private List<EndpointType> getCandidatesFromMetadata(@Nonnull final CriteriaSet criteria) {
         
         // Check for metadata.
         final RoleDescriptorCriterion role = criteria.get(RoleDescriptorCriterion.class);
@@ -339,8 +337,7 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
      */
     // Checkstyle: CyclomaticComplexity OFF
     @SuppressWarnings("unchecked")
-    @Nonnull @NonnullElements private List<EndpointType> sortCandidates(
-            @Nonnull @NonnullElements final List<Endpoint> candidates) {
+    @Nonnull private List<EndpointType> sortCandidates(@Nonnull final List<Endpoint> candidates) {
         
         // Use a linked list, and move the default endpoint to the head of the list.
         // SAML defaulting rules apply to IndexedEnpdoint types, and require checking
@@ -350,8 +347,8 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
         EndpointType softDefault = null;
         final LinkedList<EndpointType> toReturn = new LinkedList<>();
         for (final Endpoint endpoint : candidates) {
-            if (hardDefault == null && endpoint instanceof IndexedEndpoint) {
-                final Boolean flag = ((IndexedEndpoint) endpoint).isDefault();
+            if (hardDefault == null && endpoint instanceof IndexedEndpoint indexed) {
+                final Boolean flag = indexed.isDefault();
                 if (flag != null) {
                     if (flag.booleanValue()) {
                         hardDefault = (EndpointType) endpoint;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java
index 51db2f83d..4b867ee28 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/SAMLBindingSupport.java
@@ -331,9 +331,8 @@ public final class SAMLBindingSupport {
      * @throws MessageException thrown if the endpoint can not be looked up from the message
      *                              context and converted to a string representation
      */
-    @Nonnull public static String getActualReceiverEndpointURI(
-            @Nonnull final MessageContext messageContext,  @Nonnull final HttpServletRequest request)
-                    throws MessageException {
+    @Nonnull public static String getActualReceiverEndpointURI(@Nonnull final MessageContext messageContext,
+            @Nonnull final HttpServletRequest request) throws MessageException {
         Constraint.isNotNull(request, "HttpServletRequest cannot be null");
         
         final SAMLMessageReceivedEndpointContext receivedEnpointContext =
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLArtifact.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLArtifact.java
index 5b7e61a63..db8646cc5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLArtifact.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLArtifact.java
@@ -29,13 +29,13 @@ public interface SAMLArtifact {
      * 
      * @return the bytes for the artifact
      */
-    @Nonnull public byte[] getArtifactBytes();
+    @Nonnull byte[] getArtifactBytes();
 
     /**
      * Gets the 2 byte type code for this artifact.
      * 
      * @return the type code for this artifact
      */
-    @Nonnull public byte[] getTypeCode();
+    @Nonnull byte[] getTypeCode();
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceIDArtifact.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceIDArtifact.java
index d5b6c14d7..517100cb8 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceIDArtifact.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceIDArtifact.java
@@ -29,6 +29,6 @@ public interface SAMLSourceIDArtifact extends SAMLArtifact {
      * 
      * @return the source ID component of the artifact
      */
-    @Nonnull public byte[] getSourceID() ;
+    @Nonnull byte[] getSourceID() ;
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceLocationArtifact.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceLocationArtifact.java
index ecf93edf3..c26278dd2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceLocationArtifact.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/SAMLSourceLocationArtifact.java
@@ -29,6 +29,6 @@ public interface SAMLSourceLocationArtifact extends SAMLArtifact {
      * 
      * @return source location component of this artifact
      */
-    @Nonnull public String getSourceLocation(); 
+    @Nonnull String getSourceLocation(); 
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/package-info.java
index 806f70b08..d2668a12d 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/artifact/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes supporting SAML artifact use.
  */
-package org.opensaml.saml.common.binding.artifact;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.binding.artifact;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/decoding/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/decoding/package-info.java
index 88a2a9837..f2c7df50d 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/decoding/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/decoding/package-info.java
@@ -20,4 +20,7 @@
  * extracts the SAML message from it, and then evaluates that message
  * against a security policy.
  */
-package org.opensaml.saml.common.binding.decoding;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.binding.decoding;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/encoding/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/encoding/package-info.java
index 638afd52e..18e6356cc 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/encoding/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/encoding/package-info.java
@@ -20,4 +20,7 @@
  * and transforms it into a representation that may be transported over a
  * particular wire protocol (e.g. HTTP).
  */
+ at NonnullElements
 package org.opensaml.saml.common.binding.encoding;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/package-info.java
index 07c63b3e2..547081f6f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes related to SAML binding operations.
  */
-package org.opensaml.saml.common.binding;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.binding;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/ChannelBindingsContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/ChannelBindingsContext.java
index b11d4b18e..0d1f4c7ec 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/ChannelBindingsContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/ChannelBindingsContext.java
@@ -26,7 +26,6 @@ import org.opensaml.messaging.context.BaseContext;
 import org.opensaml.saml.ext.saml2cb.ChannelBindings;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 
 /**
  * Context, usually attached to a {@link org.opensaml.messaging.context.MessageContext}
@@ -35,7 +34,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
 public final class ChannelBindingsContext extends BaseContext {
 
     /** The set of ChannelBindings. */
-    @Nonnull @NonnullElements private Collection<ChannelBindings> channelBindings;
+    @Nonnull private Collection<ChannelBindings> channelBindings;
     
     /** Constructor. */
     public ChannelBindingsContext() {
@@ -47,7 +46,7 @@ public final class ChannelBindingsContext extends BaseContext {
      * 
      * @return the channel bindings
      */
-    @Nonnull @NonnullElements @Live public Collection<ChannelBindings> getChannelBindings() {
+    @Nonnull @Live public Collection<ChannelBindings> getChannelBindings() {
         return channelBindings;
     }
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMessageReceivedEndpointContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMessageReceivedEndpointContext.java
index 9e2f70a91..0e3523559 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMessageReceivedEndpointContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLMessageReceivedEndpointContext.java
@@ -40,11 +40,11 @@ import net.shibboleth.shared.logic.Constraint;
 public class SAMLMessageReceivedEndpointContext extends BaseContext {
 
     /** The request URL. */
-    private String requestURL;
+    @Nullable private String requestURL;
 
     /** Constructor. */
     public SAMLMessageReceivedEndpointContext() {
-        super();
+        
     }
 
     /**
@@ -59,7 +59,6 @@ public class SAMLMessageReceivedEndpointContext extends BaseContext {
      * @param request the HTTP request
      */
     public SAMLMessageReceivedEndpointContext(@Nonnull final HttpServletRequest request) {
-        super();
         Constraint.isNotNull(request, "HttpServletRequest was null");
         setRequestURL(request.getRequestURL().toString());
         //TODO add and populate other fields?
@@ -83,4 +82,4 @@ public class SAMLMessageReceivedEndpointContext extends BaseContext {
         requestURL = url;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/navigate/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/navigate/package-info.java
index 9127b5415..ab330a1b0 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/navigate/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/navigate/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions to navigate SAML message contexts.
  */
+ at NonnullElements
+package org.opensaml.saml.common.messaging.context.navigate;
 
-package org.opensaml.saml.common.messaging.context.navigate;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/package-info.java
index a09e04aa8..aa04543c9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Context classes for SAML-based messaging function.
  */
-package org.opensaml.saml.common.messaging.context;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.messaging.context;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/ProxiedRequesterPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/ProxiedRequesterPredicate.java
index e879bc23b..94eaa93aa 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/ProxiedRequesterPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/ProxiedRequesterPredicate.java
@@ -29,7 +29,6 @@ import javax.annotation.Nullable;
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.profile.context.ProxiedRequesterContext;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -42,14 +41,14 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class ProxiedRequesterPredicate implements Predicate<MessageContext> {
 
     /** Set of entityIDs to check for. */
-    @Nonnull @NonnullElements private final Set<String> entityIds;
+    @Nonnull private final Set<String> entityIds;
 
     /**
      * Constructor.
      * 
      * @param ids the entityIDs to check for
      */
-    public ProxiedRequesterPredicate(@Nonnull @NonnullElements final Collection<String> ids) {
+    public ProxiedRequesterPredicate(@Nonnull final Collection<String> ids) {
         Constraint.isNotNull(ids, "EntityID collection cannot be null");
         
         entityIds = new HashSet<>(StringSupport.normalizeStringCollection(ids));
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/package-info.java
index 7d8a0c0ce..c083cc71c 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/logic/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Predicates related to SAML message contexts.
  */
+ at NonnullElements
+package org.opensaml.saml.common.messaging.logic;
 
-package org.opensaml.saml.common.messaging.logic;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/package-info.java
index ef62624cb..40896cf75 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Support classes for SAML message security operations.
  */
-package org.opensaml.saml.common.messaging;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.messaging;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java
index b4b07a5d7..98834726b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/SAMLSOAPClientContextBuilder.java
@@ -415,6 +415,7 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
     /** Default TLS CriteriaSet strategy function. */
     public static class DefaultTLSCriteriaSetStrategy implements Function<MessageContext,CriteriaSet> {
 
+// Checkstyle: CyclomaticComplexity OFF
         /** {@inheritDoc} */
         @Nullable public CriteriaSet apply(@Nullable final MessageContext messageContext) {
             final CriteriaSet criteria = new CriteriaSet();
@@ -462,7 +463,7 @@ public class SAMLSOAPClientContextBuilder<InboundMessageType extends SAMLObject,
             
             return criteria;
         }
-        
+// Checkstyle: CyclomaticComplexity OFF
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java
index f8b2a6ab9..c660811a7 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/soap/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Support classes for SAML SOAP message operations.
  */
-package org.opensaml.saml.common.messaging.soap;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.messaging.soap;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/package-info.java
index 4409789c7..9208e8edb 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Base classes for working with SAML as Java objects.
  */
-package org.opensaml.saml.common;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/AbstractNameIDPolicyPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/AbstractNameIDPolicyPredicate.java
index a1d29a95d..40d2e9e36 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/AbstractNameIDPolicyPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/AbstractNameIDPolicyPredicate.java
@@ -35,7 +35,6 @@ import org.opensaml.saml.saml2.core.NameIDPolicy;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -62,7 +61,7 @@ public abstract class AbstractNameIDPolicyPredicate extends AbstractInitializabl
     @NonnullAfterInit private Function<ProfileRequestContext,SAMLObject> objectLookupStrategy;
 
     /** Formats to apply policy to. */
-    @Nonnull @NonnullElements private Set<String> formats;
+    @Nonnull private Set<String> formats;
     
     /** Constructor. */
     public AbstractNameIDPolicyPredicate() {
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java
index 7dc539c12..a4dbd9b91 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java
@@ -36,7 +36,6 @@ import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.metadata.Endpoint;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -71,7 +70,7 @@ public class DefaultLocalErrorPredicate implements Predicate<ProfileRequestConte
     @Nonnull private Function<ProfileRequestContext,EventContext> eventContextLookupStrategy;
     
     /** Error events to handle locally, even if possible to do so with a response. */
-    @Nonnull @NonnullElements private Set<String> localEvents;
+    @Nonnull private Set<String> localEvents;
     
     /** Constructor. */
     public DefaultLocalErrorPredicate() {
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
index e70dd397c..127fc0a54 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
@@ -46,7 +46,6 @@ import com.google.common.collect.Iterables;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -78,7 +77,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
     private final boolean matchAll;
     
     /** Candidates to check for. */
-    @Nonnull @NonnullElements private final Collection<Candidate> candidateSet;
+    @Nonnull private final Collection<Candidate> candidateSet;
 
     /**
      * Constructor.
@@ -86,7 +85,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
      * @param candidates the {@link Candidate} criteria to check for
      */
     public EntityAttributesPredicate(
-            @Nonnull @NonnullElements @ParameterName(name="candidates") final Collection<Candidate> candidates) {
+            @Nonnull @ParameterName(name="candidates") final Collection<Candidate> candidates) {
         this(candidates, true, false);
     }
 
@@ -97,7 +96,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
      * @param trim true iff the values found in the metadata should be trimmed before comparison
      */
     public EntityAttributesPredicate(
-            @Nonnull @NonnullElements @ParameterName(name="candidates") final Collection<Candidate> candidates,
+            @Nonnull @ParameterName(name="candidates") final Collection<Candidate> candidates,
             @ParameterName(name="trim") final boolean trim) {
         this(candidates, trim, false);
     }
@@ -110,9 +109,8 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
      * @param all true iff all the criteria must match to be a successful test
      */
     public EntityAttributesPredicate(
-            @Nonnull @NonnullElements @ParameterName(name="candidates") final Collection<Candidate> candidates,
-            @ParameterName(name="trim") final boolean trim,
-            @ParameterName(name="all") final boolean all) {
+            @Nonnull @ParameterName(name="candidates") final Collection<Candidate> candidates,
+            @ParameterName(name="trim") final boolean trim, @ParameterName(name="all") final boolean all) {
         
         candidateSet = CollectionSupport.copyToList(
                 Constraint.isNotNull(candidates, "Candidate collection cannot be null"));
@@ -144,7 +142,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
      * 
      * @return  the candidate criteria
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<Candidate> getCandidates() {
+    @Nonnull @Unmodifiable @NotLive public Collection<Candidate> getCandidates() {
         return candidateSet;
     }
 
@@ -222,10 +220,10 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
         @Nullable private final String nameFormat;
         
         /** Values that must match exactly. */
-        @Nonnull @NonnullElements private List<String> values;
+        @Nonnull private List<String> values;
         
         /** Regular expressions that must be satisfied. */
-        @Nonnull @NonnullElements private List<Pattern> regexps;
+        @Nonnull private List<Pattern> regexps;
 
         /**
          * Constructor.
@@ -282,7 +280,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
          * 
          * @return the exact values to match
          */
-        @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getValues() {
+        @Nonnull @Unmodifiable @NotLive public List<String> getValues() {
             return values;
         }
 
@@ -291,7 +289,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
          * 
          * @param vals the exact values to match
          */
-        public void setValues(@Nonnull @NonnullElements final Collection<String> vals) {
+        public void setValues(@Nonnull final Collection<String> vals) {
             values = CollectionSupport.copyToList(Constraint.isNotNull(vals, "Values collection cannot be null"));
         }
 
@@ -300,7 +298,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
          * 
          * @return the regular expressions to match.
          */
-        @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Pattern> getRegexps() {
+        @Nonnull @Unmodifiable @NotLive public List<Pattern> getRegexps() {
             return regexps;
         }
 
@@ -309,7 +307,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
          * 
          * @param exps the regular expressions to match
          */
-        public void setRegexps(@Nonnull @NonnullElements final Collection<Pattern> exps) {
+        public void setRegexps(@Nonnull final Collection<Pattern> exps) {
             regexps = CollectionSupport.copyToList(
                     Constraint.isNotNull(exps, "Regular expressions collection cannot be null"));
         }
@@ -329,7 +327,7 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
          *
          * @param attrs population to evaluate for a match
          */
-        public EntityAttributesMatcher(@Nonnull @NonnullElements final Collection<Attribute> attrs) {
+        public EntityAttributesMatcher(@Nonnull final Collection<Attribute> attrs) {
             attributes = Constraint.isNotNull(attrs, "Extension attributes cannot be null");
         }
 
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java
index 6d5ccf47c..f985754f6 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java
@@ -34,7 +34,6 @@ import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -53,13 +52,13 @@ public class EntityGroupNamePredicate implements Predicate<EntityDescriptor> {
     @Nonnull private final Logger log = LoggerFactory.getLogger(EntityGroupNamePredicate.class);
     
     /** Groups to match on. */
-    @Nonnull @NonnullElements private final Set<String> groupNames;
+    @Nonnull private final Set<String> groupNames;
     
     /** A supplemental resolver to allow for {@link AffiliationDescriptor} lookup. */
     @Nullable private MetadataResolver metadataResolver;
     
     /** Pre-created criteria sets for metadata lookup. */
-    @Nullable @NonnullElements private Collection<CriteriaSet> criteriaSets;
+    @Nullable private Collection<CriteriaSet> criteriaSets;
     
     /**
      * Constructor.
@@ -99,7 +98,7 @@ public class EntityGroupNamePredicate implements Predicate<EntityDescriptor> {
      * 
      * @return  the group name criteria
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getGroupNames() {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getGroupNames() {
         return groupNames;
     }
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityIdPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityIdPredicate.java
index 3685f0cc3..da19e2580 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityIdPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityIdPredicate.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -39,7 +38,7 @@ import java.util.function.Predicate;
 public class EntityIdPredicate implements Predicate<EntityDescriptor> {
     
     /** Set of entityIDs to check for. */
-    @Nonnull @NonnullElements private final Set<String> entityIds;
+    @Nonnull private final Set<String> entityIds;
     
     /**
      * Constructor.
@@ -55,7 +54,7 @@ public class EntityIdPredicate implements Predicate<EntityDescriptor> {
      * 
      * @return  the entityID criteria
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getEntityIds() {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getEntityIds() {
         return entityIds;
     }
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/MetadataNameIdentifierFormatStrategy.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/MetadataNameIdentifierFormatStrategy.java
index ae960999d..da9aa8638 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/MetadataNameIdentifierFormatStrategy.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/MetadataNameIdentifierFormatStrategy.java
@@ -33,7 +33,8 @@ import org.opensaml.saml.saml2.metadata.NameIDFormat;
 import org.opensaml.saml.saml2.metadata.SSODescriptor;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -65,7 +66,7 @@ public class MetadataNameIdentifierFormatStrategy implements Function<ProfileReq
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements public List<String> apply(@Nullable final ProfileRequestContext input) {
+    @Nonnull @Unmodifiable @NotLive public List<String> apply(@Nullable final ProfileRequestContext input) {
         final SSODescriptor role = ssoDescriptorLookupStrategy.apply(input);
         if (role != null) {
             final List<String> strings = new ArrayList<>();
@@ -80,7 +81,7 @@ public class MetadataNameIdentifierFormatStrategy implements Function<ProfileReq
             }
             
             log.debug("Metadata specifies the following formats: {}", strings);
-            return strings;
+            return CollectionSupport.copyToList(strings);
         }
         
         return CollectionSupport.emptyList();
@@ -92,7 +93,6 @@ public class MetadataNameIdentifierFormatStrategy implements Function<ProfileReq
     private class MetadataLookupStrategy implements Function<ProfileRequestContext,SSODescriptor> {
 
         /** {@inheritDoc} */
-        @Override
         @Nullable public SSODescriptor apply(@Nullable final ProfileRequestContext input) {
             if (input != null) {
                 final MessageContext mc = input.getInboundMessageContext();
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationAuthorityPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationAuthorityPredicate.java
index cfbcc403d..f08c45e1d 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationAuthorityPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationAuthorityPredicate.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 import org.opensaml.saml.ext.saml2mdrpi.RegistrationInfo;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -39,7 +38,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class RegistrationAuthorityPredicate  extends AbstractRegistrationInfoPredicate {
 
     /** Authorities to match on. */
-    @Nonnull @NonnullElements private final Set<String> authorities;
+    @Nonnull private final Set<String> authorities;
     
     /**
      * Constructor.
@@ -55,7 +54,7 @@ public class RegistrationAuthorityPredicate  extends AbstractRegistrationInfoPre
      * 
      * @return  the authority name criteria
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getAuthorities() {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getAuthorities() {
         return authorities;
     }
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationPolicyPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationPolicyPredicate.java
index 59e9b2934..c6896b77d 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationPolicyPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/RegistrationPolicyPredicate.java
@@ -27,7 +27,6 @@ import org.opensaml.saml.ext.saml2mdrpi.RegistrationInfo;
 import org.opensaml.saml.ext.saml2mdrpi.RegistrationPolicy;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -40,7 +39,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class RegistrationPolicyPredicate extends AbstractRegistrationInfoPredicate {
 
     /** Policies to match on. */
-    @Nonnull @NonnullElements private final Set<String> policySet;
+    @Nonnull private final Set<String> policySet;
     
     /**
      * Constructor.
@@ -56,7 +55,7 @@ public class RegistrationPolicyPredicate extends AbstractRegistrationInfoPredica
      * 
      * @return  the policy criteria
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getPolicies() {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getPolicies() {
         return policySet;
     }
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/package-info.java
index 9a19cee29..98a18cd21 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions and predicates supporting common SAML profile behavior.
  */
+ at NonnullElements
+package org.opensaml.saml.common.profile.logic;
 
-package org.opensaml.saml.common.profile.logic;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/package-info.java
index 8e426c8c5..423589bc5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes supporting general SAML profile behavior.
  */
+ at NonnullElements
+package org.opensaml.saml.common.profile;
 
-package org.opensaml.saml.common.profile;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/SAMLSchemaBuilder.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/SAMLSchemaBuilder.java
index 907cd9316..b922ed4b0 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/SAMLSchemaBuilder.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/SAMLSchemaBuilder.java
@@ -28,7 +28,6 @@ import javax.annotation.concurrent.ThreadSafe;
 import javax.xml.validation.Schema;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -51,7 +50,7 @@ import com.google.common.io.ByteStreams;
 public class SAMLSchemaBuilder {
     
     /** Classpath relative location of basic XML schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] baseXMLSchemas = {
+    @Nonnull @NotEmpty private static String[] baseXMLSchemas = {
         SAMLConstants.XML_SCHEMA_LOCATION,
         SAMLConstants.XSD_SCHEMA_LOCATION,
         SAMLConstants.XMLSIG_SCHEMA_LOCATION,
@@ -61,24 +60,24 @@ public class SAMLSchemaBuilder {
         };
 
     /** Classpath relative location of SOAP 1_1 schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] soapSchemas = {
+    @Nonnull @NotEmpty private static String[] soapSchemas = {
         SAMLConstants.SOAP11ENV_SCHEMA_LOCATION,
         };
 
     /** Classpath relative location of SAML 1_0 schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] saml10Schemas = {
+    @Nonnull @NotEmpty private static String[] saml10Schemas = {
         SAMLConstants.SAML10_SCHEMA_LOCATION,
         SAMLConstants.SAML10P_SCHEMA_LOCATION,
         };
 
     /** Classpath relative location of SAML 1_1 schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] saml11Schemas = {
+    @Nonnull @NotEmpty private static String[] saml11Schemas = {
         SAMLConstants.SAML11_SCHEMA_LOCATION,
         SAMLConstants.SAML11P_SCHEMA_LOCATION,
         };
 
     /** Classpath relative location of the invariant SAML 2.0 schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] saml20CommonSchemas = {
+    @Nonnull @NotEmpty private static String[] saml20CommonSchemas = {
         SAMLConstants.SAML20AC_SCHEMA_LOCATION,
         "/schema/saml-schema-authn-context-auth-telephony-2.0.xsd",
         "/schema/saml-schema-authn-context-ip-2.0.xsd",
@@ -107,7 +106,7 @@ public class SAMLSchemaBuilder {
         };
 
     /** Classpath relative location of SAML 2_0 schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] saml20Schemas = {
+    @Nonnull @NotEmpty private static String[] saml20Schemas = {
         SAMLConstants.SAML20_SCHEMA_LOCATION,
         SAMLConstants.SAML20P_SCHEMA_LOCATION,
         SAMLConstants.SAML20MD_SCHEMA_LOCATION,
@@ -123,7 +122,7 @@ public class SAMLSchemaBuilder {
         };
 
     /** Classpath relative location of SAML 2_0 schemas with strict string/anyURI types. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] saml20StrictSchemas = {
+    @Nonnull @NotEmpty private static String[] saml20StrictSchemas = {
         SAMLConstants.STRICT_SAML20_SCHEMA_LOCATION,
         SAMLConstants.STRICT_SAML20P_SCHEMA_LOCATION,
         SAMLConstants.STRICT_SAML20MD_SCHEMA_LOCATION,
@@ -139,7 +138,7 @@ public class SAMLSchemaBuilder {
         };
     
     /** Classpath relative location of SAML extension schemas. */
-    @Nonnull @NonnullElements @NotEmpty private static String[] baseExtSchemas = {
+    @Nonnull @NotEmpty private static String[] baseExtSchemas = {
         SAMLConstants.SAML1MD_SCHEMA_LOCATION,
         SAMLConstants.SAML_IDP_DISCO_SCHEMA_LOCATION,
         SAMLConstants.SAML20PTHRPTY_SCHEMA_LOCATION,
@@ -161,10 +160,10 @@ public class SAMLSchemaBuilder {
     @Nullable private Schema cachedSchema;
 
     /** Reference to SAML 1.x schemas to apply. */
-    @Nonnull @NonnullElements @NotEmpty private String[] saml1xSchemas;
+    @Nonnull private String[] saml1xSchemas;
 
     /** Reference to SAML 2.0 schemas to apply. */
-    @Nonnull @NonnullElements @NotEmpty private String[] saml2Schemas;
+    @Nonnull private String[] saml2Schemas;
 
     /** The builder to use. */
     private SchemaBuilder schemaBuilder;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/package-info.java
index b7709dbfe..789520d35 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/xml/package-info.java
@@ -18,4 +18,7 @@
 /**
  * SAML constants and and misc XML functionality.
  */
+ at NonnullElements
 package org.opensaml.saml.common.xml;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
index 74634d93e..71b2dafc4 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfiguration.java
@@ -18,7 +18,7 @@
 package org.opensaml.saml.config;
 
 import java.util.List;
-import java.util.function.Function;
+import java.util.Objects;
 import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
@@ -42,9 +42,6 @@ import net.shibboleth.shared.primitive.StringSupport;
  * 
  */
 public class SAMLConfiguration {
-    
-    /** Lowercase string function. */
-    @Nonnull private static final Function<String, String> LOWER = new LowercaseFunction();
 
     /** SAML 1 Artifact factory. */
     @Nullable private SAML1ArtifactBuilderFactory saml1ArtifactBuilderFactory;
@@ -138,23 +135,10 @@ public class SAMLConfiguration {
         } else {
             allowedBindingURLSchemes = StringSupport.normalizeStringCollection(schemes)
                     .stream()
-                    .map(LOWER::apply)
+                    .filter(Objects::nonNull)
+                    .map(String::toLowerCase)
                     .collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableList())).get();
         }
     }
-    
-    /**
-     * Function to lowercase a string input.
-     */
-    private static class LowercaseFunction implements Function<String, String> {
-
-        /** {@inheritDoc} */
-        public String apply(final String input) {
-            if (input == null) {
-                return null;
-            }
-            return input.toLowerCase();
-        }
-        
-    }
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfigurationSupport.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfigurationSupport.java
index 5dc1f0dc2..a83aa13d9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfigurationSupport.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/SAMLConfigurationSupport.java
@@ -26,7 +26,6 @@ import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactBuilderFactory;
 import org.opensaml.saml.saml2.binding.artifact.SAML2ArtifactBuilderFactory;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -81,7 +80,7 @@ public final class SAMLConfigurationSupport {
      * 
      * @return the list of allowed URL schemes
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public static List<String> getAllowedBindingURLSchemes() {
+    @Nonnull @Unmodifiable @NotLive public static List<String> getAllowedBindingURLSchemes() {
         return ConfigurationService.ensure(SAMLConfiguration.class).getAllowedBindingURLSchemes();
     }
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/package-info.java
index 51801bd16..6233b6bd2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/config/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/config/package-info.java
@@ -18,4 +18,7 @@
 /**
  * SAML library configuration.
  */
+ at NonnullElements
 package org.opensaml.saml.config;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java
index ea876c814..58ccc9b76 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ArtifactCriterion.java
@@ -78,8 +78,8 @@ public final class ArtifactCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof ArtifactCriterion) {
-            return Objects.equals(artifact, ((ArtifactCriterion)obj).artifact);
+        if (obj instanceof ArtifactCriterion other) {
+            return Objects.equals(artifact, other.artifact);
         }
 
         return false;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java
index db407fa97..417d2331f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BestMatchLocationCriterion.java
@@ -80,8 +80,8 @@ public final class BestMatchLocationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof BestMatchLocationCriterion) {
-            return location.equals(((BestMatchLocationCriterion) obj).location);
+        if (obj instanceof BestMatchLocationCriterion other) {
+            return location.equals(other.location);
         }
 
         return false;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BindingCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BindingCriterion.java
index 0235cdb7d..dd4e95915 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BindingCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/BindingCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -32,14 +31,14 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class BindingCriterion implements Criterion {
 
     /** The SAML binding URI. */
-    @Nonnull @NonnullElements private final List<String> bindings;
+    @Nonnull private final List<String> bindings;
 
     /**
      * Constructor.
      * 
      * @param bindingURIs list of SAML binding URIs
      */
-    public BindingCriterion(@Nonnull @NonnullElements final List<String> bindingURIs) {
+    public BindingCriterion(@Nonnull final List<String> bindingURIs) {
         bindings = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(bindingURIs));
     }
 
@@ -48,7 +47,7 @@ public final class BindingCriterion implements Criterion {
      * 
      * @return ordered list of SAML binding URIs
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getBindings() {
+    @Nonnull @Unmodifiable @NotLive public List<String> getBindings() {
         return bindings;
     }
 
@@ -79,10 +78,11 @@ public final class BindingCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof BindingCriterion) {
-            return bindings.equals(((BindingCriterion) obj).bindings);
+        if (obj instanceof BindingCriterion other) {
+            return bindings.equals(other.bindings);
         }
 
         return false;
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java
index d7c9a468a..dbc19d528 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EndpointCriterion.java
@@ -121,8 +121,8 @@ public final class EndpointCriterion<EndpointType extends Endpoint> implements C
             return false;
         }
 
-        if (obj instanceof EndpointCriterion) {
-            final Endpoint endpoint2 = ((EndpointCriterion<?>) obj).getEndpoint();
+        if (obj instanceof EndpointCriterion<?> other) {
+            final Endpoint endpoint2 = other.getEndpoint();
             if (!Objects.equals(endpoint.getElementQName(), endpoint2.getElementQName())) {
                 return false;
             } else if (!Objects.equals(endpoint.getBinding(), endpoint2.getBinding())) {
@@ -138,4 +138,5 @@ public final class EndpointCriterion<EndpointType extends Endpoint> implements C
 
         return false;
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EntityRoleCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EntityRoleCriterion.java
index 2e4d8e624..9ed1e1398 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EntityRoleCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/EntityRoleCriterion.java
@@ -74,10 +74,11 @@ public final class EntityRoleCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof EntityRoleCriterion) {
-            return role.equals(((EntityRoleCriterion) obj).role);
+        if (obj instanceof EntityRoleCriterion other) {
+            return role.equals(other.role);
         }
 
         return false;
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ProtocolCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ProtocolCriterion.java
index f5454f244..13e1ef5f1 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ProtocolCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/ProtocolCriterion.java
@@ -76,10 +76,11 @@ public final class ProtocolCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof ProtocolCriterion) {
-            return protocol.equals(((ProtocolCriterion) obj).protocol);
+        if (obj instanceof ProtocolCriterion other) {
+            return protocol.equals(other.protocol);
         }
 
         return false;
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/RoleDescriptorCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/RoleDescriptorCriterion.java
index 11a194145..c96236559 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/RoleDescriptorCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/RoleDescriptorCriterion.java
@@ -75,10 +75,11 @@ public final class RoleDescriptorCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof RoleDescriptorCriterion) {
-            return role.equals(((RoleDescriptorCriterion) obj).role);
+        if (obj instanceof RoleDescriptorCriterion other) {
+            return role.equals(other.role);
         }
 
         return false;
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/StartsWithLocationCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/StartsWithLocationCriterion.java
index db4d9da35..4d044be0a 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/StartsWithLocationCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/StartsWithLocationCriterion.java
@@ -30,13 +30,13 @@ import net.shibboleth.shared.resolver.Criterion;
 public class StartsWithLocationCriterion implements Criterion {
     
     /** The matchStartsWith criterion value. */
-    private Boolean matchStartsWith;
+    private boolean matchStartsWith;
     
     /**
      * Constructor.
      */
     public StartsWithLocationCriterion() {
-        matchStartsWith = Boolean.TRUE;
+        matchStartsWith = true;
     }
     
     /**
@@ -59,17 +59,17 @@ public class StartsWithLocationCriterion implements Criterion {
 
     /** {@inheritDoc} */
     public int hashCode() {
-        return matchStartsWith.hashCode();
+        return Boolean.valueOf(matchStartsWith).hashCode();
     }
 
     /** {@inheritDoc} */
-    public boolean equals(final Object other) {
-        if (this == other) {
+    public boolean equals(final Object obj) {
+        if (this == obj) {
             return true;
         }
         
-        if (other instanceof StartsWithLocationCriterion) {
-            return Objects.equals(matchStartsWith, ((StartsWithLocationCriterion)other).matchStartsWith);
+        if (obj instanceof StartsWithLocationCriterion other) {
+            return Objects.equals(matchStartsWith, other.matchStartsWith);
         }
         
         return false;
@@ -81,4 +81,4 @@ public class StartsWithLocationCriterion implements Criterion {
                 .addValue(matchStartsWith).toString();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/package-info.java
index db19d66bd..3838bbffc 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/criterion/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** {@link net.shibboleth.shared.resolver.Criterion} based on SAML message/protocol information. */
+ at NonnullElements
+package org.opensaml.saml.criterion;
 
-package org.opensaml.saml.criterion;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/idpdisco/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/idpdisco/package-info.java
index e75ecc0fa..c3057c6c9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/idpdisco/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/idpdisco/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Extension Identity Provider Discovery.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.idpdisco;
 
-package org.opensaml.saml.ext.idpdisco;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/reqattr/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/reqattr/package-info.java
index 0d2b718d8..20ded52e6 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/reqattr/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/reqattr/package-info.java
@@ -17,5 +17,7 @@
 /**
  * Interface for SAML V2.0 Protocol Extension For Requesting Attributes Per Request.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.reqattr;
 
-package org.opensaml.saml.ext.reqattr;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml1md/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml1md/package-info.java
index 7e018d175..d447fae9b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml1md/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml1md/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Profile for SAML 1.x.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml1md;
 
-package org.opensaml.saml.ext.saml1md;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2alg/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2alg/package-info.java
index 66ff89397..df8e12c67 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2alg/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2alg/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML v2.0 Metadata Profile for Algorithm Support Version 1.0.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2alg;
 
-package org.opensaml.saml.ext.saml2alg;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2aslo/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2aslo/package-info.java
index e5ce946b7..7f21fae70 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2aslo/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2aslo/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Protocol Extension for Async Logout.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2aslo;
 
-package org.opensaml.saml.ext.saml2aslo;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2cb/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2cb/package-info.java
index e32ac222b..b7108ed97 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2cb/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2cb/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Channel Binding Extensions.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2cb;
 
-package org.opensaml.saml.ext.saml2cb;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2delrestrict/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2delrestrict/package-info.java
index 816503ef6..cefd24f4b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2delrestrict/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2delrestrict/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Condition for Delegation Restriction.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2delrestrict;
 
-package org.opensaml.saml.ext.saml2delrestrict;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdattr/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdattr/package-info.java
index 34b717974..b93137c09 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdattr/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdattr/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Extension for Entity Attributes.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdattr;
 
-package org.opensaml.saml.ext.saml2mdattr;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdquery/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdquery/package-info.java
index f6436a83b..757d4c124 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdquery/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdquery/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Profile for Standalone Query Requesters.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdquery;
 
-package org.opensaml.saml.ext.saml2mdquery;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/package-info.java
index ad0c08c94..73b9dd314 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Extension for SSO Service Provider Request Initiation.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdreqinit;
 
-package org.opensaml.saml.ext.saml2mdreqinit;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdrpi/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdrpi/package-info.java
index 6845b5a28..282da7f6e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdrpi/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdrpi/package-info.java
@@ -19,5 +19,7 @@
  * The package to define the 
  * <em>SAML V2.0 Metadata Extensions for Registration and Publication Information Version 1.0</em>.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdrpi;
 
-package org.opensaml.saml.ext.saml2mdrpi;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdui/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdui/package-info.java
index 1f118f422..442376968 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdui/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/saml2mdui/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Extensions for Login UI and Discovery.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdui;
 
-package org.opensaml.saml.ext.saml2mdui;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlec/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlec/package-info.java
index f87c11145..ecd4ac33b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlec/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlec/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML-EC GSS-API Mechanism.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.samlec;
 
-package org.opensaml.saml.ext.samlec;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlpthrpty/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlpthrpty/package-info.java
index d91fe0800..1a2768288 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlpthrpty/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/ext/samlpthrpty/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 Metadata Extension for Third-Party Request Protocol Extension.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.samlpthrpty;
 
-package org.opensaml.saml.ext.samlpthrpty;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/DetectDuplicateEntityIDsCriterion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/DetectDuplicateEntityIDsCriterion.java
index 3e4711c02..0ff483026 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/DetectDuplicateEntityIDsCriterion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/DetectDuplicateEntityIDsCriterion.java
@@ -60,13 +60,13 @@ public class DetectDuplicateEntityIDsCriterion implements Criterion {
     }
 
     /** {@inheritDoc} */
-    public boolean equals(final Object other) {
-        if (this == other) {
+    public boolean equals(final Object obj) {
+        if (this == obj) {
             return true;
         }
         
-        if (other instanceof DetectDuplicateEntityIDsCriterion) {
-            return Objects.equals(this.value, ((DetectDuplicateEntityIDsCriterion)other).value);
+        if (obj instanceof DetectDuplicateEntityIDsCriterion other) {
+            return Objects.equals(this.value, other.value);
         }
         
         return false;
@@ -77,4 +77,4 @@ public class DetectDuplicateEntityIDsCriterion implements Criterion {
         return MoreObjects.toStringHelper(this).add("value", value).toString();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/package-info.java
index 8c05dfd5a..f9a2387d5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/entity/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for SAML metadata entity criteria. */
+ at NonnullElements
+package org.opensaml.saml.metadata.criteria.entity;
 
-package org.opensaml.saml.metadata.criteria.entity;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/role/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/role/package-info.java
index 6a7639a3c..f0183fa30 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/role/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/criteria/role/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for SAML metadata role criteria. */
+ at NonnullElements
+package org.opensaml.saml.metadata.criteria.role;
 
-package org.opensaml.saml.metadata.criteria.role;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/package-info.java
index bc378567c..727513cac 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for fetching and querying SAML metadata. */
+ at NonnullElements
+package org.opensaml.saml.metadata;
 
-package org.opensaml.saml.metadata;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/BatchMetadataResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/BatchMetadataResolver.java
index 0546a4c53..0195c56d0 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/BatchMetadataResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/BatchMetadataResolver.java
@@ -34,13 +34,13 @@ public interface BatchMetadataResolver extends MetadataResolver {
      *
      * @return the validUntil date/time of the root element, or null if not available
      */
-    @Nullable public Instant getRootValidUntil();
+    @Nullable Instant getRootValidUntil();
 
     /**
      * Get the validity state of the metadata batch root element, as determined in an implementation-specific manner.
      *
      * @return true if root element is valid, false if not valid, null if indeterminate
      */
-    @Nullable public Boolean isRootValid();
+    @Nullable Boolean isRootValid();
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/ChainingMetadataResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/ChainingMetadataResolver.java
index 48bc80341..48ef2b21f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/ChainingMetadataResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/ChainingMetadataResolver.java
@@ -36,7 +36,6 @@ import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -63,7 +62,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
     @Nullable @NotEmpty private String resolverType;
     
     /** Registered resolvers. */
-    @Nonnull @NonnullElements private List<MetadataResolver> resolvers;
+    @Nonnull private List<MetadataResolver> resolvers;
     
     /** Strategy for detecting duplicate entityIDs across resolvers. */
     @Nonnull private DetectDuplicateEntityIDs detectDuplicateEntityIDs;
@@ -98,7 +97,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
      * 
      * @return list of currently registered resolvers
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<MetadataResolver> getResolvers() {
+    @Nonnull @Unmodifiable @NotLive public List<MetadataResolver> getResolvers() {
         return resolvers;
     }
 
@@ -109,8 +108,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
      * 
      * @throws ResolverException thrown if there is a problem adding the metadata resolvers
      */
-    public void setResolvers(@Nonnull @NonnullElements final List<? extends MetadataResolver> newResolvers)
-            throws ResolverException {
+    public void setResolvers(@Nonnull final List<? extends MetadataResolver> newResolvers) throws ResolverException {
         checkSetterPreconditions();
 
         if (newResolvers == null || newResolvers.isEmpty()) {
@@ -263,10 +261,9 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
      * @param detectDuplicates the effective strategy for duplicate detection
      */
 // Checkstyle: CyclomaticComplexity OFF
-    private void detectDuplicateEntityIDs(final @Nonnull MetadataResolver resolver,
-            final @Nullable CriteriaSet criteria,
-            final @Nullable Set<String> resultEntityIDs,
-            final @Nonnull DetectDuplicateEntityIDs detectDuplicates) {
+    private void detectDuplicateEntityIDs(@Nonnull final MetadataResolver resolver,
+            @Nullable final CriteriaSet criteria, @Nullable final Set<String> resultEntityIDs,
+            @Nonnull final DetectDuplicateEntityIDs detectDuplicates) {
         
         if (resultEntityIDs == null || resultEntityIDs.isEmpty()) {
             return;
@@ -323,7 +320,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
      * @param descriptors
      * @return the unique entityIDs from the supplied descriptors
      */
-    private Set<String> collectEntityIDs(final @Nonnull Iterable<EntityDescriptor> descriptors) {
+    private Set<String> collectEntityIDs(@Nonnull final Iterable<EntityDescriptor> descriptors) {
         return StreamSupport.stream(descriptors.spliterator(), false)
                 .map(EntityDescriptor::getEntityID)
                 .filter(Objects::nonNull)
@@ -398,7 +395,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
     /** {@inheritDoc}
     * We iterate over all the children and return the earliest instant or null if one of them
     * hasn't ever refreshed successfully. */
-    public Instant getLastSuccessfulRefresh() {
+    @Nullable public Instant getLastSuccessfulRefresh() {
         Instant ret = null;
         for (final MetadataResolver resolver : resolvers) {
             if (resolver instanceof RefreshableMetadataResolver) {
@@ -417,7 +414,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
 
     /** {@inheritDoc}
      * We iterate over all children - a failure of any is a failure. */
-    public Boolean wasLastRefreshSuccess() {
+    @Nullable public Boolean wasLastRefreshSuccess() {
         for (final MetadataResolver resolver : resolvers) {
             if (resolver instanceof RefreshableMetadataResolver downcast) {
                 final Boolean flag = downcast.wasLastRefreshSuccess();
@@ -432,7 +429,7 @@ public class ChainingMetadataResolver extends AbstractIdentifiableInitializableC
     
     /** {@inheritDoc}
      * We iterate over all children and return the first failure we find. */
-    public Throwable getLastFailureCause() {
+    @Nullable public Throwable getLastFailureCause() {
         for (final MetadataResolver resolver : resolvers) {
             if (resolver instanceof RefreshableMetadataResolver) {
                 final RefreshableMetadataResolver refreshable = (RefreshableMetadataResolver) resolver;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/RefreshableMetadataResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/RefreshableMetadataResolver.java
index 0a1c1d0c3..691892d6e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/RefreshableMetadataResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/RefreshableMetadataResolver.java
@@ -61,20 +61,20 @@ public interface RefreshableMetadataResolver extends MetadataResolver {
      * 
      * @return time the last successful refresh cycle occurred
      */
-    @Nullable public Instant getLastSuccessfulRefresh();
+    @Nullable Instant getLastSuccessfulRefresh();
 
     /**
      * Gets whether the last refresh cycle was successful.
      * 
      * @return true if last refresh cycle was successful, false if not
      */
-    @Nullable public Boolean wasLastRefreshSuccess();
+    @Nullable Boolean wasLastRefreshSuccess();
     
     /**
      * Gets the reason the last refresh failed.
      *
      * @return reason the last refresh failed or null if the last refresh was successful
      */
-    @Nullable public Throwable getLastFailureCause();
+    @Nullable Throwable getLastFailureCause();
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataFilterChain.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataFilterChain.java
index 3a3c46b31..a5c4fb497 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataFilterChain.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataFilterChain.java
@@ -24,7 +24,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -41,7 +40,7 @@ public class MetadataFilterChain extends AbstractMetadataFilter {
     @Nonnull private Logger log = LoggerFactory.getLogger(MetadataFilterChain.class);
     
     /** Registered filters. */
-    @Nonnull @NonnullElements private List<MetadataFilter> filters;
+    @Nonnull private List<MetadataFilter> filters;
 
     /**
      * Constructor.
@@ -82,7 +81,7 @@ public class MetadataFilterChain extends AbstractMetadataFilter {
      * 
      * @return the filters that make up this chain
      */
-    @Nonnull @NonnullElements @Live public List<MetadataFilter> getFilters() {
+    @Nonnull @Live public List<MetadataFilter> getFilters() {
         return filters;
     }
 
@@ -91,10 +90,10 @@ public class MetadataFilterChain extends AbstractMetadataFilter {
      * 
      * @param newFilters list of {@link MetadataFilter}s that make up this chain
      */
-    public void setFilters(@Nonnull @NonnullElements final List<MetadataFilter> newFilters) {
+    public void setFilters(@Nonnull final List<MetadataFilter> newFilters) {
         Constraint.isNotNull(newFilters, "Filter collection cannot be null");
         
-        filters = new ArrayList<>(List.copyOf(newFilters));
+        filters = new ArrayList<>(newFilters);
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataNodeProcessor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataNodeProcessor.java
index 80240e000..990caf24f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataNodeProcessor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/MetadataNodeProcessor.java
@@ -33,6 +33,6 @@ public interface MetadataNodeProcessor {
      * @param metadataNode the metadata node to process
      * @throws FilterException if a fatal error is encountered while processing the node
      */
-    public void process(@Nonnull XMLObject metadataNode) throws FilterException;
+    void process(@Nonnull XMLObject metadataNode) throws FilterException;
     
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/package-info.java
index a7bfcfb94..c65e7dd1f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/filter/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for SAML metadata filtering. */
+ at NonnullElements
+package org.opensaml.saml.metadata.resolver.filter;
 
-package org.opensaml.saml.metadata.resolver.filter;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java
index 03f3d6329..522ff137e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/MetadataIndex.java
@@ -48,8 +48,7 @@ public interface MetadataIndex {
      * @return the set of index keys generated from the criteria.  May be null or empty, 
      *         but will not contain null elements.
      */
-    @Nullable @Unmodifiable @NotLive 
-    public Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor);
+    @Nullable @Unmodifiable @NotLive Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor);
     
     /**
      * Generate a set of one or more {@link MetadataIndexKey} instances based on the input {@link CriteriaSet}.
@@ -64,7 +63,6 @@ public interface MetadataIndex {
      * @return the set of index keys generated from the criteria.  May be null or empty, 
      *         but will not contain null elements.
      */
-    @Nullable @Unmodifiable @NotLive 
-    public Set<MetadataIndexKey> generateKeys(@Nullable final CriteriaSet criteriaSet);
+    @Nullable @Unmodifiable @NotLive Set<MetadataIndexKey> generateKeys(@Nullable final CriteriaSet criteriaSet);
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/SimpleStringMetadataIndexKey.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/SimpleStringMetadataIndexKey.java
index 321e6c116..da943d9dd 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/SimpleStringMetadataIndexKey.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/SimpleStringMetadataIndexKey.java
@@ -69,11 +69,11 @@ public class SimpleStringMetadataIndexKey implements MetadataIndexKey {
             return true;
         }
 
-        if (obj instanceof SimpleStringMetadataIndexKey) {
-            return value.equals(((SimpleStringMetadataIndexKey) obj).value);
+        if (obj instanceof SimpleStringMetadataIndexKey other) {
+            return value.equals(other.value);
         }
 
         return false;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/package-info.java
index c05ba1900..e8d7f4857 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/index/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for SAML metadata indexing. */
+ at NonnullElements
+package org.opensaml.saml.metadata.resolver.index;
 
-package org.opensaml.saml.metadata.resolver.index;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/package-info.java
index 55ced7c79..f259bed20 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/resolver/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for SAML metadata resolution. */
+ at NonnullElements
+package org.opensaml.saml.metadata.resolver;
 
-package org.opensaml.saml.metadata.resolver;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
index d1a9e1ca2..4dc8cc70a 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
@@ -28,6 +28,8 @@ import org.opensaml.saml.saml2.metadata.RoleDescriptor;
 import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -180,7 +182,7 @@ public class AttributeConsumingServiceSelector {
      * 
      * @return the list of candidate AttributeConsumingServices, or null if none could be resolved
      */
-    @Nullable protected List<AttributeConsumingService> getCandidates() {
+    @Nullable @Unmodifiable @NotLive protected List<AttributeConsumingService> getCandidates() {
         if (roleDescriptor == null) {
             log.debug("RoleDescriptor was not supplied, unable to select AttributeConsumingService");
             return null;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/package-info.java
index 320fa0771..d1591ff48 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes in support of SAML metadata. */
+ at NonnullElements
+package org.opensaml.saml.metadata.support;
 
-package org.opensaml.saml.metadata.support;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactType0001Builder.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactType0001Builder.java
index 3881a68ed..241ba69f7 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactType0001Builder.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/SAML1ArtifactType0001Builder.java
@@ -40,7 +40,6 @@ public class SAML1ArtifactType0001Builder implements SAML1ArtifactBuilder<SAML1A
     @Nonnull private final Logger log = LoggerFactory.getLogger(SAML1ArtifactType0001Builder.class);
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public SAML1ArtifactType0001 buildArtifact(@Nonnull final byte[] artifact) {
         try {
             return SAML1ArtifactType0001.parseArtifact(artifact);
@@ -51,7 +50,6 @@ public class SAML1ArtifactType0001Builder implements SAML1ArtifactBuilder<SAML1A
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public SAML1ArtifactType0001 buildArtifact(@Nonnull final MessageContext requestContext,
             @Nonnull final Assertion assertion) {
         final String sourceId = getSourceEntityId(requestContext);
@@ -70,7 +68,7 @@ public class SAML1ArtifactType0001Builder implements SAML1ArtifactBuilder<SAML1A
             assert source != null;
             return new SAML1ArtifactType0001(source, assertionHandle);
         } catch (final NoSuchAlgorithmException e) {
-            log.warn("JVM does not support required cryptography algorithms.", e);
+            log.warn("JVM does not support required cryptography algorithms", e);
             return null;
         }
     }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/package-info.java
index 745065036..a26f7dcdd 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/binding/artifact/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes that may be used to create and manipulate SAML 1 artifacts. */
+ at NonnullElements
+package org.opensaml.saml.saml1.binding.artifact;
 
-package org.opensaml.saml.saml1.binding.artifact;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/AttributeQuery.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/AttributeQuery.java
index 29c0ec50c..13176e3fa 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/AttributeQuery.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/AttributeQuery.java
@@ -28,7 +28,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -58,7 +58,7 @@ public interface AttributeQuery extends SubjectQuery {
      * 
      * @return the list of AttributeDesignators
      */
-    @Nonnull @NonnullElements List<AttributeDesignator> getAttributeDesignators();
+    @Nonnull @Live List<AttributeDesignator> getAttributeDesignators();
     
     /**
      * Get Resource attribute.
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/package-info.java
index c3b3a1b7b..78c023672 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/core/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Interfaces for SAML 1.0 and 1.1 types and elements. */
+ at NonnullElements
+package org.opensaml.saml.saml1.core;
 
-package org.opensaml.saml.saml1.core;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/SAML1NameIdentifierGenerator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/SAML1NameIdentifierGenerator.java
index 467b03b9e..0930a2b23 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/SAML1NameIdentifierGenerator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/SAML1NameIdentifierGenerator.java
@@ -31,7 +31,6 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SAML1NameIdentifierGenerator extends NameIdentifierGenerator<NameIdentifier> {
 
     /** {@inheritDoc} */
-    @Override
     @Nullable NameIdentifier generate(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull @NotEmpty final String format) throws SAMLException;
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/package-info.java
index 99bda8d11..27dd3a5e8 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml1/profile/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes for SAML 1.x profile behavior.
  */
+ at NonnullElements
+package org.opensaml.saml.saml1.profile;
 
-package org.opensaml.saml.saml1.profile;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
index a1a67f140..11a3b0ebd 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
@@ -27,7 +27,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.LazyMap;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -136,13 +135,13 @@ public class SAML20AssertionValidator {
     @Nonnull private final Logger log = LoggerFactory.getLogger(SAML20AssertionValidator.class);
 
     /** Registered {@link Condition} validators. */
-    @Nonnull @NonnullElements private LazyMap<QName, ConditionValidator> conditionValidators;
+    @Nonnull private LazyMap<QName, ConditionValidator> conditionValidators;
 
     /** Registered {@link SubjectConfirmation} validators. */
-    @Nonnull @NonnullElements private LazyMap<String, SubjectConfirmationValidator> subjectConfirmationValidators;
+    @Nonnull private LazyMap<String, SubjectConfirmationValidator> subjectConfirmationValidators;
 
     /** Registered {@link Statement} validators. */
-    @Nonnull @NonnullElements private LazyMap<QName, StatementValidator> statementValidators;
+    @Nonnull private LazyMap<QName, StatementValidator> statementValidators;
     
     /** Generic validator. */
     @Nullable private AssertionValidator assertionValidator;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java
index bedf46348..e875695cc 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/StatementValidator.java
@@ -50,7 +50,6 @@ public interface StatementValidator {
      * 
      * @throws AssertionValidationException if there is a problem processing the validation operation
      */
-    @Nonnull ValidationResult validate(@Nonnull final Statement statement, 
-            @Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
-            throws AssertionValidationException;
+    @Nonnull ValidationResult validate(@Nonnull final Statement statement, @Nonnull final Assertion assertion,
+            @Nonnull final ValidationContext context) throws AssertionValidationException;
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java
index 438d22267..4033b3442 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SubjectConfirmationValidator.java
@@ -57,4 +57,5 @@ public interface SubjectConfirmationValidator {
     @Nonnull ValidationResult validate(@Nonnull final SubjectConfirmation confirmation, 
             @Nonnull final Assertion assertion, @Nonnull final ValidationContext context)
             throws AssertionValidationException;
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2Artifact.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2Artifact.java
index 32d16fc3f..ea0caa84d 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2Artifact.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2Artifact.java
@@ -31,6 +31,6 @@ public interface SAML2Artifact extends SAMLArtifact {
      * 
      * @return 2 byte endpoint index for this artifact
      */
-    @Nonnull public byte[] getEndpointIndex();
+    @Nonnull byte[] getEndpointIndex();
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactBuilderFactory.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactBuilderFactory.java
index 6911831c5..eec3fda55 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactBuilderFactory.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactBuilderFactory.java
@@ -22,9 +22,11 @@ import java.util.Map;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
-import net.shibboleth.shared.collection.LazyMap;
+import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
  * Factory used to construct SAML 2 artifact builders.
@@ -32,12 +34,12 @@ import net.shibboleth.shared.collection.LazyMap;
 public class SAML2ArtifactBuilderFactory {
 
     /** Registered artifact builders. */
-    private Map<String, SAML2ArtifactBuilder<?>> artifactBuilders;
+    @Nonnull private Map<String, SAML2ArtifactBuilder<?>> artifactBuilders;
 
     /** Constructor. */
     public SAML2ArtifactBuilderFactory() {
-        artifactBuilders = new LazyMap<>();
-        artifactBuilders.put(new String(SAML2ArtifactType0004.TYPE_CODE), new SAML2ArtifactType0004Builder());
+        artifactBuilders = CollectionSupport.singletonMap(
+                new String(SAML2ArtifactType0004.TYPE_CODE), new SAML2ArtifactType0004Builder());
     }
 
     /**
@@ -45,7 +47,7 @@ public class SAML2ArtifactBuilderFactory {
      * 
      * @return currently registered artifact builders
      */
-    public Map<String, SAML2ArtifactBuilder<?>> getArtifactBuilders() {
+    @Nonnull @NotLive @Unmodifiable public Map<String, SAML2ArtifactBuilder<?>> getArtifactBuilders() {
         return artifactBuilders;
     }
 
@@ -56,7 +58,7 @@ public class SAML2ArtifactBuilderFactory {
      * 
      * @return artifact builder for the given type
      */
-    public SAML2ArtifactBuilder<?> getArtifactBuilder(final byte[] type) {
+    @Nullable public SAML2ArtifactBuilder<?> getArtifactBuilder(@Nonnull final byte[] type) {
         return artifactBuilders.get(new String(type));
     }
     
@@ -69,7 +71,7 @@ public class SAML2ArtifactBuilderFactory {
      * 
      * @throws DecodingException if the <code>base64Artifact</code> could not be base64-decoded.
      */
-    public SAML2Artifact buildArtifact(@Nonnull final String base64Artifact) throws DecodingException{
+    @Nullable public SAML2Artifact buildArtifact(@Nonnull final String base64Artifact) throws DecodingException{
         return buildArtifact(Base64Support.decode(base64Artifact));
     }
 
@@ -95,4 +97,5 @@ public class SAML2ArtifactBuilderFactory {
         }
         return artifactBuilder.buildArtifact(artifact);
     }
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactType0004Builder.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactType0004Builder.java
index b214980e9..aff04ad9e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactType0004Builder.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/SAML2ArtifactType0004Builder.java
@@ -40,13 +40,11 @@ public class SAML2ArtifactType0004Builder implements SAML2ArtifactBuilder<SAML2A
     @Nonnull private final Logger log = LoggerFactory.getLogger(SAML2ArtifactType0004Builder.class);
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public SAML2ArtifactType0004 buildArtifact(@Nonnull @NotEmpty final byte[] artifact) {
         return SAML2ArtifactType0004.parseArtifact(artifact);
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public SAML2ArtifactType0004 buildArtifact(@Nonnull final MessageContext requestContext) {
         try {
             final String sourceId = getSourceEntityId(requestContext);
@@ -66,6 +64,7 @@ public class SAML2ArtifactType0004Builder implements SAML2ArtifactBuilder<SAML2A
 
             final MessageDigest sha1Digester = MessageDigest.getInstance("SHA-1");
             final byte[] source = sha1Digester.digest(sourceId.getBytes());
+            assert source != null;
 
             final SecureRandom handleGenerator = SecureRandom.getInstance("SHA1PRNG");
             final byte[] assertionHandle = new byte[20];
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/package-info.java
index 943b69216..cc5dc32de 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/binding/artifact/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes that may be used to create and manipulate SAML 2 artifacts. */
+ at NonnullElements
+package org.opensaml.saml.saml2.binding.artifact;
 
-package org.opensaml.saml.saml2.binding.artifact;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/IsTimeboundSAMLObjectValidPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/IsTimeboundSAMLObjectValidPredicate.java
index d305a6e98..a84332318 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/IsTimeboundSAMLObjectValidPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/IsTimeboundSAMLObjectValidPredicate.java
@@ -37,4 +37,4 @@ public class IsTimeboundSAMLObjectValidPredicate implements Predicate<XMLObject>
         return SAML2Support.isValid(input);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/SAML2Support.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/SAML2Support.java
index 9daf6dce0..241e89ab4 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/SAML2Support.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/SAML2Support.java
@@ -42,7 +42,7 @@ public final class SAML2Support {
      * 
      * @return true of the tree is valid, false if not
      */
-    public static boolean isValid(final XMLObject xmlObject) {
+    public static boolean isValid(@Nonnull final XMLObject xmlObject) {
         if (xmlObject instanceof TimeBoundSAMLObject) {
             final TimeBoundSAMLObject timeBoundObject = (TimeBoundSAMLObject) xmlObject;
             if (!timeBoundObject.isValid()) {
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/package-info.java
index 03460eb3b..446f6ccf2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/common/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Interfaces for elements and attributes used in multiple SAML 2.0 specification. */
+ at NonnullElements
+package org.opensaml.saml.saml2.common;
 
-package org.opensaml.saml.saml2.common;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/package-info.java
index 8c0ea76e5..bb1bb2820 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2.0 core and protocol interfaces.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.core;
 
-package org.opensaml.saml.saml2.core;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/package-info.java
index 0f2a9472f..51fcbe197 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Interfaces for SAML 2 ECP Elements.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.ecp;
 
-package org.opensaml.saml.saml2.ecp;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java
index 222a5a736..96f62d076 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java
@@ -40,9 +40,9 @@ import org.opensaml.xmlsec.encryption.support.DecryptionException;
 import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.w3c.dom.Element;
 
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.xml.SerializeSupport;
 
 /**
@@ -56,7 +56,7 @@ import net.shibboleth.shared.xml.SerializeSupport;
 public class Decrypter extends org.opensaml.xmlsec.encryption.support.Decrypter {
     
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(Decrypter.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(Decrypter.class);
     
     /**
      * Constructor.
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Encrypter.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Encrypter.java
index 3e67561aa..05174f314 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Encrypter.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Encrypter.java
@@ -26,6 +26,7 @@ import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.security.IdentifierGenerationStrategy;
 import net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType;
 import net.shibboleth.shared.xml.SerializeSupport;
@@ -64,7 +65,6 @@ import org.opensaml.xmlsec.signature.KeyName;
 import org.opensaml.xmlsec.signature.RetrievalMethod;
 import org.opensaml.xmlsec.signature.XMLSignatureBuilder;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
@@ -107,6 +107,9 @@ import com.google.common.base.Strings;
  */
 public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter {
 
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(Encrypter.class);
+    
     /**
      * Options for where to place the resulting EncryptedKey elements with respect to the associated EncryptedData
      * element.
@@ -150,10 +153,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
     private List<KeyEncryptionParameters> kekParamsList;
 
     /** The option for where to place the generated EncryptedKey elements. */
-    private KeyPlacement keyPlacement;
-
-    /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(Encrypter.class);
+    @Nonnull private KeyPlacement keyPlacement = KeyPlacement.PEER;
 
     /**
      * Constructor.
@@ -221,8 +221,6 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
                         CarriedKeyName.DEFAULT_ELEMENT_NAME);
 
         idGenerator = IdentifierGenerationStrategy.getInstance(ProviderType.RANDOM);
-
-        keyPlacement = KeyPlacement.PEER;
     }
 
     /**
@@ -239,7 +237,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * 
      * @return returns the key placement option.
      */
-    public KeyPlacement getKeyPlacement() {
+    @Nonnull public KeyPlacement getKeyPlacement() {
         return keyPlacement;
     }
 
@@ -248,8 +246,8 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * 
      * @param newKeyPlacement The new key placement option to set
      */
-    public void setKeyPlacement(final KeyPlacement newKeyPlacement) {
-        keyPlacement = newKeyPlacement;
+    public void setKeyPlacement(@Nonnull final KeyPlacement newKeyPlacement) {
+        keyPlacement = Constraint.isNotNull(newKeyPlacement, "KeyPlacement cannot be null");
     }
 
     /**
@@ -259,7 +257,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return an EncryptedAssertion
      * @throws EncryptionException thrown when encryption generates an error
      */
-    public EncryptedAssertion encrypt(@Nonnull final Assertion assertion) throws EncryptionException {
+    @Nonnull public EncryptedAssertion encrypt(@Nonnull final Assertion assertion) throws EncryptionException {
         logPreEncryption(assertion, "Assertion");
         return (EncryptedAssertion) encrypt(assertion, EncryptedAssertion.DEFAULT_ELEMENT_NAME);
     }
@@ -271,7 +269,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return an EncryptedID
      * @throws EncryptionException thrown when encryption generates an error
      */
-    public EncryptedID encryptAsID(@Nonnull final Assertion assertion) throws EncryptionException {
+    @Nonnull public EncryptedID encryptAsID(@Nonnull final Assertion assertion) throws EncryptionException {
         logPreEncryption(assertion, "Assertion (as EncryptedID)");
         return (EncryptedID) encrypt(assertion, EncryptedID.DEFAULT_ELEMENT_NAME);
     }
@@ -283,7 +281,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return an EncryptedAttribute
      * @throws EncryptionException thrown when encryption generates an error
      */
-    public EncryptedAttribute encrypt(@Nonnull final Attribute attribute) throws EncryptionException {
+    @Nonnull public EncryptedAttribute encrypt(@Nonnull final Attribute attribute) throws EncryptionException {
         logPreEncryption(attribute, "Attribute");
         return (EncryptedAttribute) encrypt(attribute, EncryptedAttribute.DEFAULT_ELEMENT_NAME);
     }
@@ -295,7 +293,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return an EncryptedID
      * @throws EncryptionException thrown when encryption generates an error
      */
-    public EncryptedID encrypt(@Nonnull final NameID nameID) throws EncryptionException {
+    @Nonnull public EncryptedID encrypt(@Nonnull final NameID nameID) throws EncryptionException {
         logPreEncryption(nameID, "NameID");
         return (EncryptedID) encrypt(nameID, EncryptedID.DEFAULT_ELEMENT_NAME);
     }
@@ -307,7 +305,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return an EncryptedID
      * @throws EncryptionException thrown when encryption generates an error
      */
-    public EncryptedID encrypt(@Nonnull final BaseID baseID) throws EncryptionException {
+    @Nonnull public EncryptedID encrypt(@Nonnull final BaseID baseID) throws EncryptionException {
         logPreEncryption(baseID, "BaseID");
         return (EncryptedID) encrypt(baseID, EncryptedID.DEFAULT_ELEMENT_NAME);
     }
@@ -319,7 +317,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return a NewEncryptedID
      * @throws EncryptionException thrown when encryption generates an error
      */
-    public NewEncryptedID encrypt(@Nonnull final NewID newID) throws EncryptionException {
+    @Nonnull public NewEncryptedID encrypt(@Nonnull final NewID newID) throws EncryptionException {
         logPreEncryption(newID, "NewID");
         return (NewEncryptedID) encrypt(newID, NewEncryptedID.DEFAULT_ELEMENT_NAME);
     }
@@ -350,8 +348,8 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @return a specialization of {@link org.opensaml.saml.saml2.core.EncryptedElementType}
      * @throws EncryptionException thrown when encryption generates an error
      */
-    private EncryptedElementType encrypt(@Nonnull final XMLObject xmlObject, @Nonnull final QName encElementName)
-            throws EncryptionException {
+    @Nonnull private EncryptedElementType encrypt(@Nonnull final XMLObject xmlObject,
+            @Nonnull final QName encElementName) throws EncryptionException {
 
         checkParams(encParams, kekParamsList);
 
@@ -406,8 +404,9 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * 
      * @throws EncryptionException thrown when processing encounters an error
      */
-    protected EncryptedElementType processElements(final EncryptedElementType encElement, final EncryptedData encData,
-            final List<EncryptedKey> encKeys) throws EncryptionException {
+    @Nonnull protected EncryptedElementType processElements(@Nonnull final EncryptedElementType encElement,
+            @Nonnull final EncryptedData encData, @Nonnull final List<EncryptedKey> encKeys)
+                    throws EncryptionException {
         // First ensure certain elements/attributes are non-null, common to all cases.
         if (encData.getID() == null) {
             encData.setID(idGenerator.generateIdentifier());
@@ -450,8 +449,8 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @param encKeys the list of EncryptedKey objects
      * @return the processed EncryptedElementType instance
      */
-    protected EncryptedElementType placeKeysInline(final EncryptedElementType encElement, final EncryptedData encData,
-            final List<EncryptedKey> encKeys) {
+    @Nonnull protected EncryptedElementType placeKeysInline(@Nonnull final EncryptedElementType encElement,
+            @Nonnull final EncryptedData encData, @Nonnull final List<EncryptedKey> encKeys) {
 
         log.debug("Placing EncryptedKey elements inline inside EncryptedData");
 
@@ -473,8 +472,8 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @param encKeys the EncryptedKey(s) to store
      * @return the resulting specialization of EncryptedElementType
      */
-    protected EncryptedElementType placeKeysAsPeers(final EncryptedElementType encElement, final EncryptedData encData,
-            final List<EncryptedKey> encKeys) {
+    @Nonnull protected EncryptedElementType placeKeysAsPeers(@Nonnull final EncryptedElementType encElement,
+            @Nonnull final EncryptedData encData, @Nonnull final List<EncryptedKey> encKeys) {
 
         log.debug("Placing EncryptedKey elements as peers of EncryptedData in EncryptedElementType");
 
@@ -505,7 +504,7 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @param encData the EncryptedData
      * @param encKey the EncryptedKey
      */
-    protected void linkSinglePeerKey(final EncryptedData encData, final EncryptedKey encKey) {
+    protected void linkSinglePeerKey(@Nonnull final EncryptedData encData, @Nonnull final EncryptedKey encKey) {
         log.debug("Linking single peer EncryptedKey with RetrievalMethod and DataReference");
         
         final KeyInfo keyInfo = encData.getKeyInfo();
@@ -532,7 +531,8 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
      * @param encData the EncryptedData
      * @param encKeys the list of EncryptedKeys
      */
-    protected void linkMultiplePeerKeys(final EncryptedData encData, final List<EncryptedKey> encKeys) {
+    protected void linkMultiplePeerKeys(@Nonnull final EncryptedData encData,
+            @Nonnull final List<EncryptedKey> encKeys) {
         log.debug("Linking multiple peer EncryptedKeys with CarriedKeyName and DataReference");
         // Get the name of the data encryption key
         final List<KeyName> dataEncKeyNames;
@@ -581,4 +581,4 @@ public class Encrypter extends org.opensaml.xmlsec.encryption.support.Encrypter
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/package-info.java
index 4d0f3b138..310e3a9ed 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes for encrypting and decrypting SAML.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.encryption;
 
-package org.opensaml.saml.saml2.encryption;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/package-info.java
index 664d2b798..1a7c26154 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/package-info.java
@@ -26,5 +26,7 @@
  *  Developer's Manual.</a> see <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OpenSAML">
  *  OpenSAML</a> Wiki. 
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.metadata;
 
-package org.opensaml.saml.saml2.metadata;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2NameIDGenerator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2NameIDGenerator.java
index f5c048aad..4e41a6131 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2NameIDGenerator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/SAML2NameIDGenerator.java
@@ -31,7 +31,6 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SAML2NameIDGenerator extends NameIdentifierGenerator<NameID> {
 
     /** {@inheritDoc} */
-    @Override
     @Nullable NameID generate(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull @NotEmpty final String format) throws SAMLException;
     
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/context/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/context/package-info.java
index 33505afaf..6fdd69fed 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/context/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/context/package-info.java
@@ -16,7 +16,9 @@
  */
 
 /**
- * Context classes supporting SAML 2 profile behavior.
+ * Context classes supporting SAML 2 profiles.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.profile.context;
 
-package org.opensaml.saml.saml2.profile.context;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/package-info.java
index fdc162a48..dddd59d14 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes for SAML 2.0 profile behavior.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.profile;
 
-package org.opensaml.saml.saml2.profile;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java
index def929f39..2ef3b28ee 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java
@@ -60,4 +60,4 @@ public class SAML20AssertionToken extends AbstractToken<Assertion> {
         subjectConfirmation = newSubjectConfirmation;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/package-info.java
index 388c4fd9a..95c936a6e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for SAML WS-Security. */
+ at NonnullElements
+package org.opensaml.saml.saml2.wssecurity;
 
-package org.opensaml.saml.saml2.wssecurity;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/security/SAMLMetadataKeyAgreementEncryptionConfiguration.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/security/SAMLMetadataKeyAgreementEncryptionConfiguration.java
index 9bd85f01b..3faab364e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/security/SAMLMetadataKeyAgreementEncryptionConfiguration.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/security/SAMLMetadataKeyAgreementEncryptionConfiguration.java
@@ -52,7 +52,7 @@ public class SAMLMetadataKeyAgreementEncryptionConfiguration extends KeyAgreemen
     }
     
     /** Option which determines whether symmetric key wrap is to be used with metadata credentials. */
-    private KeyWrap metadataUseKeyWrap;
+    @Nullable private KeyWrap metadataUseKeyWrap;
     
     /**
      * Get the option which determines whether symmetric key wrap is to be used with metadata credentials.
@@ -72,6 +72,4 @@ public class SAMLMetadataKeyAgreementEncryptionConfiguration extends KeyAgreemen
         metadataUseKeyWrap = option;
     }
     
-}
-
-
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/security/package-info.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/security/package-info.java
index ffecede7d..2aa986e9c 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/security/package-info.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/security/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes related to general security components within a SAML system.
  */
+ at NonnullElements
+package org.opensaml.saml.security;
 
-package org.opensaml.saml.security;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/ExpiringSAMLArtifactMapEntryFactory.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/ExpiringSAMLArtifactMapEntryFactory.java
index 0aa839af6..8bb7547a5 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/ExpiringSAMLArtifactMapEntryFactory.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/ExpiringSAMLArtifactMapEntryFactory.java
@@ -36,7 +36,6 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public class ExpiringSAMLArtifactMapEntryFactory implements SAMLArtifactMapEntryFactory {
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull public SAMLArtifactMapEntry newEntry(@Nonnull @NotEmpty final String artifact,
             @Nonnull @NotEmpty final String issuerId, @Nonnull @NotEmpty final String relyingPartyId,
             @Nonnull final SAMLObject samlMessage) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/StorageServiceSAMLArtifactMapEntryFactory.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/StorageServiceSAMLArtifactMapEntryFactory.java
index 78ad6b7df..69829b901 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/StorageServiceSAMLArtifactMapEntryFactory.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/StorageServiceSAMLArtifactMapEntryFactory.java
@@ -92,7 +92,6 @@ public class StorageServiceSAMLArtifactMapEntryFactory extends AbstractInitializ
     
     
     /** {@inheritDoc} */
-    @Override
     @Nonnull public SAMLArtifactMapEntry newEntry(@Nonnull @NotEmpty final String artifact,
             @Nonnull @NotEmpty final String issuerId, @Nonnull @NotEmpty final String relyingPartyId,
             @Nonnull final SAMLObject samlMessage) {
@@ -105,7 +104,6 @@ public class StorageServiceSAMLArtifactMapEntryFactory extends AbstractInitializ
     }
     
     /** {@inheritDoc} */
-    @Override
     @Nonnull public String serialize(@Nonnull final SAMLArtifactMapEntry instance) throws IOException {        
         log.debug("Serializing SAMLArtifactMapEntry for storage");
         
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/package-info.java
index 7ae2e7c66..fbdcb60bf 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/artifact/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation of SAML artifact mapping.
  */
-package org.opensaml.saml.common.binding.artifact.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.binding.artifact.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java
index 440179e25..c1aafa5d8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/PopulateSignatureSigningParametersHandler.java
@@ -228,7 +228,8 @@ public class PopulateSignatureSigningParametersHandler extends AbstractMessageHa
             if (metadataCtx != null) {
                 final RoleDescriptor role = metadataCtx.getRoleDescriptor();
                 if (role != null) {
-                    log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms", getLogPrefix());
+                    log.debug("{} Adding metadata to resolution criteria for signing/digest algorithms",
+                            getLogPrefix());
                     criteria.add(new RoleDescriptorCriterion(role));
                 }
             }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java
index c0c264d5e..c40b885e8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLAddAttributeConsumingServiceHandler.java
@@ -44,7 +44,6 @@ import org.opensaml.saml.saml2.metadata.RequestedAttribute;
 import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -207,7 +206,7 @@ public class SAMLAddAttributeConsumingServiceHandler extends AbstractMessageHand
      * 
      * @return null or the list
      */
-    @Nullable @NonnullElements protected Collection<RequestedAttribute> getRequestedAttributes(
+    @Nullable protected Collection<RequestedAttribute> getRequestedAttributes(
             @Nonnull final MessageContext messageContext, @Nonnull final AuthnRequest authn) {
         final Extensions extensions = authn.getExtensions();
         if (extensions == null) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java
index 74959b404..0edfd8fa8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/SAMLMetadataLookupHandler.java
@@ -216,7 +216,7 @@ public class SAMLMetadataLookupHandler extends AbstractMessageHandler {
      * 
      * @return the new lookup criteria
      */
-    protected CriteriaSet buildLookupCriteria(@Nonnull final MessageContext messageContext,
+    @Nonnull protected CriteriaSet buildLookupCriteria(@Nonnull final MessageContext messageContext,
             @Nonnull final String entityID, @Nonnull final QName role) {
         
         final EntityIdCriterion entityIdCriterion = new EntityIdCriterion(entityID);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/package-info.java
index 2a5c40df4..820bbf8af 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation of SAML binding-level functionality, such as MessageHandlers.
  */
-package org.opensaml.saml.common.binding.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.binding.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java
index 6cb2f7239..b2474cd3e 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/BaseSAMLSimpleSignatureSecurityHandler.java
@@ -45,8 +45,9 @@ import com.google.common.base.Strings;
 
 import jakarta.servlet.http.HttpServletRequest;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -283,7 +284,7 @@ public abstract class BaseSAMLSimpleSignatureSecurityHandler extends AbstractMes
     protected boolean validateSignature(@Nonnull @NotEmpty final byte[] signature,
             @Nonnull @NotEmpty final byte[] signedContent, @Nonnull @NotEmpty final String algorithmURI,
             @Nonnull final CriteriaSet criteriaSet,
-            @Nonnull @NonnullElements final List<Credential> candidateCredentials) throws MessageHandlerException {
+            @Nonnull final List<Credential> candidateCredentials) throws MessageHandlerException {
 
         final SignatureTrustEngine engine = getTrustEngine();
         assert engine != null;
@@ -326,8 +327,9 @@ public abstract class BaseSAMLSimpleSignatureSecurityHandler extends AbstractMes
      * @return a list of candidate validation credentials in the request, or null if none were present
      * @throws MessageHandlerException thrown if there is an error during request processing
      */
-    @Nonnull @NonnullElements protected List<Credential> getRequestCredentials(
-            @Nonnull final MessageContext messageContext) throws MessageHandlerException {
+    @Nonnull @Unmodifiable @NotLive protected List<Credential> getRequestCredentials(
+            @Nonnull final MessageContext messageContext)
+            throws MessageHandlerException {
         // This will be specific to the binding and message types, so no default.
         return CollectionSupport.emptyList();
     }
@@ -432,4 +434,4 @@ public abstract class BaseSAMLSimpleSignatureSecurityHandler extends AbstractMes
     protected abstract boolean ruleHandles(@Nonnull final MessageContext messageContext)
             throws MessageHandlerException;
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java
index f3ab1551b..8d1041a76 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/CheckAndRecordServerTLSEntityAuthenticationtHandler.java
@@ -68,8 +68,6 @@ public class CheckAndRecordServerTLSEntityAuthenticationtHandler extends Abstrac
         entityIDLookup = new OperationContextEntityIDLookup(entityContextClass);
     }
     
-    
-    
     /**
      * Set the strategy function for resolving the {@link HttpClientContext to evaluate}.
      * 
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java
index 6ed3a8c9e..506cb16ff 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/OperationContextEntityIDLookup.java
@@ -77,4 +77,4 @@ public class OperationContextEntityIDLookup implements ContextDataLookupFunction
         return entityContext.getEntityId();
     }
         
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandler.java
index c4f74492f..26f80da71 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/ReceivedEndpointSecurityHandler.java
@@ -140,8 +140,7 @@ public class ReceivedEndpointSecurityHandler extends AbstractMessageHandler {
      * @throws URIException if one of the URI's to evaluate is invalid 
      */
     protected boolean compareEndpointURIs(@Nonnull @NotEmpty final String messageDestination, 
-            @Nullable final String receiverEndpoint, 
-            @Nonnull final URIComparator comparator) throws URIException {
+            @Nullable final String receiverEndpoint, @Nonnull final URIComparator comparator) throws URIException {
         Constraint.isNotNull(messageDestination, "Message destination URI was null");
         Constraint.isNotNull(comparator, "URIComparator was null");
         return comparator.compare(messageDestination, receiverEndpoint);
@@ -210,4 +209,4 @@ public class ReceivedEndpointSecurityHandler extends AbstractMessageHandler {
         log.debug("{} SAML message intended destination endpoint matched recipient endpoint", getLogPrefix());
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java
index 3b0702db0..1673c25e1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/SAMLOutboundProtocolMessageSigningHandler.java
@@ -49,7 +49,6 @@ public class SAMLOutboundProtocolMessageSigningHandler extends AbstractMessageHa
     
     /** Constructor. */
     public SAMLOutboundProtocolMessageSigningHandler() {
-        super();
         signErrorResponses = true;
     }
     
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/package-info.java
index ff04e7333..81092250e 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/binding/security/impl/package-info.java
@@ -19,4 +19,7 @@
  * Classes responsible for performing transport-related and basic message
  * validation of decoded SAML messages.
  */
-package org.opensaml.saml.common.binding.security.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.common.binding.security.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/AddInResponseToToResponse.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/AddInResponseToToResponse.java
index a987deb9c..aa6112ab9 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/AddInResponseToToResponse.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/AddInResponseToToResponse.java
@@ -40,7 +40,6 @@ import org.opensaml.saml.saml2.core.StatusResponseType;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -149,7 +148,7 @@ public class AddInResponseToToResponse extends AbstractConditionalProfileAction
         @Nonnull private final Logger log = LoggerFactory.getLogger(AddInResponseToToResponse.class);
         
         /** Set of bindings to ignore request ID for. */
-        @Nonnull @NonnullElements private Set<String> suppressForBindings;
+        @Nonnull private Set<String> suppressForBindings;
         
         /** Constructor. */
         public DefaultRequestIdLookupStrategy() {
@@ -161,7 +160,7 @@ public class AddInResponseToToResponse extends AbstractConditionalProfileAction
          * 
          * @param bindings collection of bindings
          */
-        public void setSuppressForBindings(@Nonnull @NonnullElements final Collection<String> bindings) {
+        public void setSuppressForBindings(@Nonnull final Collection<String> bindings) {
             Constraint.isNotNull(bindings, "Bindings collection cannot be null");
             
             suppressForBindings = new HashSet<>();
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java
index 44bc650d2..124cff26c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/ChainingNameIdentifierGenerator.java
@@ -23,7 +23,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -69,8 +68,7 @@ public class ChainingNameIdentifierGenerator<NameIdType extends SAMLObject>
      * 
      * @param generators generators to use
      */
-    public void setGenerators(
-            @Nonnull @NullableElements final List<NameIdentifierGenerator<NameIdType>> generators) {
+    public void setGenerators(@Nonnull final List<NameIdentifierGenerator<NameIdType>> generators) {
         Constraint.isNotNull(generators, "NameIdentifierGenerator list cannot be null");
         
         nameIdGeneratorMap.clear();
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/package-info.java
index 8f9d12194..1115fca93 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/common/profile/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Actions and classes common to both SAML versions. 
  */
+ at NonnullElements
+package org.opensaml.saml.common.profile.impl;
 
-package org.opensaml.saml.common.profile.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/SAMLConfigurationInitializer.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/SAMLConfigurationInitializer.java
index 73653adca..5a87202b8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/SAMLConfigurationInitializer.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/SAMLConfigurationInitializer.java
@@ -17,6 +17,8 @@
 
 package org.opensaml.saml.config.impl;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.core.config.ConfigurationService;
 import org.opensaml.core.config.InitializationException;
 import org.opensaml.core.config.Initializer;
@@ -24,7 +26,8 @@ import org.opensaml.saml.config.SAMLConfiguration;
 import org.opensaml.saml.saml1.binding.artifact.SAML1ArtifactBuilderFactory;
 import org.opensaml.saml.saml2.binding.artifact.SAML2ArtifactBuilderFactory;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An initializer which initializes the {@link SAMLConfiguration} instance held
@@ -37,7 +40,7 @@ import org.slf4j.LoggerFactory;
 public class SAMLConfigurationInitializer implements Initializer {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(SAMLConfigurationInitializer.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(SAMLConfigurationInitializer.class);
 
     /** {@inheritDoc} */
     public void init() throws InitializationException {
@@ -56,4 +59,4 @@ public class SAMLConfigurationInitializer implements Initializer {
         config.setSAML2ArtifactBuilderFactory(new SAML2ArtifactBuilderFactory());
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/XMLObjectProviderInitializer.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/XMLObjectProviderInitializer.java
index 5dd9a4635..4af99f135 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/XMLObjectProviderInitializer.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/XMLObjectProviderInitializer.java
@@ -56,4 +56,4 @@ public class XMLObjectProviderInitializer extends AbstractXMLObjectProviderIniti
         return configs;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/package-info.java
index c622f25cb..acaf4febe 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/config/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * SAML configuration initializers.
  */
+ at NonnullElements
+package org.opensaml.saml.config.impl;
 
-package org.opensaml.saml.config.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/idpdisco/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/idpdisco/impl/package-info.java
index 6759712c7..644273787 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/idpdisco/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/idpdisco/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML v2.0 Identity Provider Discovery Profile.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.idpdisco.impl;
 
-package org.opensaml.saml.ext.idpdisco.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/reqattr/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/reqattr/impl/package-info.java
index 70266c88b..385d30e37 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/reqattr/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/reqattr/impl/package-info.java
@@ -14,8 +14,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 /**
  * Implementations for SAML V2.0 Protocol Extension For Requesting Attributes Per Request.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.reqattr.impl;
 
-package org.opensaml.saml.ext.reqattr.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml1md/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml1md/impl/package-info.java
index 53fc1f0ec..b862cd583 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml1md/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml1md/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML 1.x Metadata Profile.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml1md.impl;
 
-package org.opensaml.saml.ext.saml1md.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/package-info.java
index 1ba097702..26278f4d0 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2alg/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML v2.0 Metadata Profile for Algorithm Support Version 1.0.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2alg.impl;
 
-package org.opensaml.saml.ext.saml2alg.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2aslo/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2aslo/impl/package-info.java
index 63fc2cabd..f1679704f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2aslo/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2aslo/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML 2 Protocol Extension for Async Logout objects.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2aslo.impl;
 
-package org.opensaml.saml.ext.saml2aslo.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2cb/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2cb/impl/package-info.java
index ace33784f..b9e538972 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2cb/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2cb/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML v2.0 Channel Binding Extensions Version 1.0.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2cb.impl;
 
-package org.opensaml.saml.ext.saml2cb.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2delrestrict/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2delrestrict/impl/package-info.java
index 01b007650..96cbf34f7 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2delrestrict/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2delrestrict/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML v2.0 Condition for Delegation Restriction Version 1.0.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2delrestrict.impl;
 
-package org.opensaml.saml.ext.saml2delrestrict.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdattr/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdattr/impl/package-info.java
index ccc1ac612..7bb56fb04 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdattr/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdattr/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML v2.0 Metadata Extension for Entity Attributes Version 1.0.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdattr.impl;
 
-package org.opensaml.saml.ext.saml2mdattr.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/package-info.java
index e9cd0d73f..0fdf6d134 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdquery/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML v2.0 Metadata Extension for Stand-Alone Query Requesters.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdquery.impl;
 
-package org.opensaml.saml.ext.saml2mdquery.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/impl/package-info.java
index 977d2361a..6836abb8e 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdreqinit/impl/package-info.java
@@ -19,5 +19,7 @@
  * Concrete implementations of the interfaces for the 
  * <em>SAML 2 Metadata Extension for SSO Service Provider Request Initiation</em>.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdreqinit.impl;
 
-package org.opensaml.saml.ext.saml2mdreqinit.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdrpi/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdrpi/impl/package-info.java
index bd2a99af8..9890ce8bc 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdrpi/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdrpi/impl/package-info.java
@@ -19,5 +19,7 @@
  * Concrete implementations of the interfaces for the 
  * <em>SAML V2.0 Metadata Extensions for Registration and Publication Information Version 1.0</em>.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdrpi.impl;
 
-package org.opensaml.saml.ext.saml2mdrpi.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdui/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdui/impl/package-info.java
index c03a0bd49..7f8c101ba 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdui/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/saml2mdui/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML V2 Metadata Extensions for UI and Discovery.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.saml2mdui.impl;
 
-package org.opensaml.saml.ext.saml2mdui.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlec/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlec/impl/package-info.java
index 879fa458b..8c10db19c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlec/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlec/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML-EC GSS-API schema content.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.samlec.impl;
 
-package org.opensaml.saml.ext.samlec.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlpthrpty/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlpthrpty/impl/package-info.java
index c49f833b8..cd975f1bc 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlpthrpty/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/ext/samlpthrpty/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation for SAML V2 Protocol Extension for Third-Party Requests.
  */
+ at NonnullElements
+package org.opensaml.saml.ext.samlpthrpty.impl;
 
-package org.opensaml.saml.ext.samlpthrpty.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/EvaluableEntityRoleEntityDescriptorCriterion.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/EvaluableEntityRoleEntityDescriptorCriterion.java
index 596207419..072cfb034 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/EvaluableEntityRoleEntityDescriptorCriterion.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/EvaluableEntityRoleEntityDescriptorCriterion.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.metadata.criteria.entity.impl;
 import java.util.Objects;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.criterion.EntityRoleCriterion;
@@ -44,7 +45,7 @@ public class EvaluableEntityRoleEntityDescriptorCriterion implements EvaluableEn
      *
      * @param criterion the entity role criterion
      */
-    public EvaluableEntityRoleEntityDescriptorCriterion(final EntityRoleCriterion criterion) {
+    public EvaluableEntityRoleEntityDescriptorCriterion(@Nonnull final EntityRoleCriterion criterion) {
         Constraint.isNotNull(criterion, "EntityRoleCriterion was null");
         role = Constraint.isNotNull(criterion.getRole(), "Criterion role QName was null");
     }
@@ -54,12 +55,12 @@ public class EvaluableEntityRoleEntityDescriptorCriterion implements EvaluableEn
      *
      * @param entityRole the entity
      */
-    public EvaluableEntityRoleEntityDescriptorCriterion(final QName entityRole) {
+    public EvaluableEntityRoleEntityDescriptorCriterion(@Nonnull final QName entityRole) {
         role = Constraint.isNotNull(entityRole, "Entity Role QName was null");
     }
 
     /** {@inheritDoc} */
-    public boolean test(final EntityDescriptor entityDescriptor) {
+    public boolean test(@Nullable final EntityDescriptor entityDescriptor) {
         if (entityDescriptor == null) {
             return false;
         }
@@ -73,13 +74,13 @@ public class EvaluableEntityRoleEntityDescriptorCriterion implements EvaluableEn
     }
 
     /** {@inheritDoc} */
-    public boolean equals(final Object other) {
-        if (this == other) {
+    public boolean equals(final Object obj) {
+        if (this == obj) {
             return true;
         }
         
-        if (other instanceof EvaluableEntityRoleEntityDescriptorCriterion) {
-            return Objects.equals(this.role, ((EvaluableEntityRoleEntityDescriptorCriterion)other).role);
+        if (obj instanceof EvaluableEntityRoleEntityDescriptorCriterion other) {
+            return Objects.equals(role, other.role);
         }
         
         return false;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/package-info.java
index c213069de..4c2ed1a56 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/entity/impl/package-info.java
@@ -19,4 +19,7 @@
  * Implementation classes related to {@link org.opensaml.saml.saml2.metadata.EntityDescriptor} criteria, 
  * particularly evaluable (predicate) criteria.
  */
+ at NonnullElements
 package org.opensaml.saml.metadata.criteria.entity.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableEntityRoleDescriptorCriterion.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableEntityRoleDescriptorCriterion.java
index f4c0b8ec2..54b6670aa 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableEntityRoleDescriptorCriterion.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableEntityRoleDescriptorCriterion.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.metadata.criteria.role.impl;
 import java.util.Objects;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.criterion.EntityRoleCriterion;
@@ -60,7 +61,7 @@ public class EvaluableEntityRoleDescriptorCriterion implements EvaluableRoleDesc
     }
     
     /** {@inheritDoc} */
-    public boolean test(final RoleDescriptor input) {
+    public boolean test(@Nullable final RoleDescriptor input) {
         if (input == null) {
             return false;
         }
@@ -79,13 +80,13 @@ public class EvaluableEntityRoleDescriptorCriterion implements EvaluableRoleDesc
     }
 
     /** {@inheritDoc} */
-    public boolean equals(final Object other) {
-        if (this == other) {
+    public boolean equals(final Object obj) {
+        if (this == obj) {
             return true;
         }
         
-        if (other instanceof EvaluableEntityRoleDescriptorCriterion) {
-            return Objects.equals(this.role, ((EvaluableEntityRoleDescriptorCriterion)other).role);
+        if (obj instanceof EvaluableEntityRoleDescriptorCriterion other) {
+            return Objects.equals(role, other.role);
         }
         
         return false;
@@ -98,4 +99,4 @@ public class EvaluableEntityRoleDescriptorCriterion implements EvaluableRoleDesc
                 .toString();
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableProtocolRoleDescriptorCriterion.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableProtocolRoleDescriptorCriterion.java
index 32389350c..9c8f3680f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableProtocolRoleDescriptorCriterion.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/EvaluableProtocolRoleDescriptorCriterion.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.metadata.criteria.role.impl;
 import java.util.Objects;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.saml.criterion.ProtocolCriterion;
 import org.opensaml.saml.metadata.criteria.role.EvaluableRoleDescriptorCriterion;
@@ -61,7 +62,7 @@ public class EvaluableProtocolRoleDescriptorCriterion implements EvaluableRoleDe
     }
     
     /** {@inheritDoc} */
-    public boolean test(final RoleDescriptor input) {
+    public boolean test(@Nullable final RoleDescriptor input) {
         if (input == null) {
             return false;
         }
@@ -75,13 +76,13 @@ public class EvaluableProtocolRoleDescriptorCriterion implements EvaluableRoleDe
     }
 
     /** {@inheritDoc} */
-    public boolean equals(final Object other) {
-        if (this == other) {
+    public boolean equals(final Object obj) {
+        if (this == obj) {
             return true;
         }
         
-        if (other instanceof EvaluableProtocolRoleDescriptorCriterion) {
-            return Objects.equals(this.protocol, ((EvaluableProtocolRoleDescriptorCriterion)other).protocol);
+        if (obj instanceof EvaluableProtocolRoleDescriptorCriterion other) {
+            return Objects.equals(protocol, other.protocol);
         }
         
         return false;
@@ -94,4 +95,4 @@ public class EvaluableProtocolRoleDescriptorCriterion implements EvaluableRoleDe
                 .toString();
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/RoleDescriptorCriterionPredicateRegistry.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/RoleDescriptorCriterionPredicateRegistry.java
index abb2b881d..434764b49 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/RoleDescriptorCriterionPredicateRegistry.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/RoleDescriptorCriterionPredicateRegistry.java
@@ -31,4 +31,4 @@ public class RoleDescriptorCriterionPredicateRegistry extends CriterionPredicate
         loadMappings("/roledescriptor-criterion-predicate-registry.properties");
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/package-info.java
index d6d5a050a..40ef2cfba 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/criteria/role/impl/package-info.java
@@ -19,4 +19,7 @@
  * Implementation classes related to {@link org.opensaml.saml.saml2.metadata.RoleDescriptor} criteria, 
  * particularly evaluable (predicate) criteria.
  */
+ at NonnullElements
 package org.opensaml.saml.metadata.criteria.role.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/data/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/data/impl/package-info.java
index 8a268493b..69de3d936 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/data/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/data/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Data classes for use with {@link org.opensaml.saml.metadata.resolver.filter.MetadataFilterContext}.
  */
-
+ at NonnullElements
 package org.opensaml.saml.metadata.resolver.filter.data.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
index f2daefdd2..014271131 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/AlgorithmFilter.java
@@ -53,7 +53,6 @@ import org.slf4j.Logger;
 import com.google.common.collect.ArrayListMultimap;
 import com.google.common.collect.Multimap;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -75,7 +74,7 @@ public class AlgorithmFilter extends AbstractMetadataFilter {
     @Nullable private AlgorithmRegistry registry = AlgorithmSupport.getGlobalAlgorithmRegistry();
     
     /** Rules for adding algorithms. */
-    @Nonnull @NonnullElements private Multimap<Predicate<EntityDescriptor>,XMLObject> applyMap;
+    @Nonnull private Multimap<Predicate<EntityDescriptor>,XMLObject> applyMap;
     
     /** Builder for {@link Extensions}. */
     @Nonnull private final SAMLObjectBuilder<Extensions> extBuilder;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilter.java
index e8db17c75..49adb3b14 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilter.java
@@ -32,7 +32,6 @@ import org.opensaml.saml.metadata.resolver.filter.MetadataFilterContext;
 import org.opensaml.saml.metadata.resolver.filter.data.impl.MetadataSource;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -53,7 +52,7 @@ public class ByReferenceMetadataFilter extends AbstractMetadataFilter {
     @Nonnull private Logger log = LoggerFactory.getLogger(ByReferenceMetadataFilter.class);
     
     /** Map of resolver names to filters. */
-    @Nonnull @NonnullElements private Map<String,MetadataFilter> filterMap;
+    @Nonnull private Map<String,MetadataFilter> filterMap;
     
     /** Constructor. */
     public ByReferenceMetadataFilter() {
@@ -65,7 +64,7 @@ public class ByReferenceMetadataFilter extends AbstractMetadataFilter {
      * 
      * @param map filter mappings
      */
-    public void setFilterMappings(@Nonnull @NonnullElements final Map<Object,MetadataFilter> map) {
+    public void setFilterMappings(@Nonnull final Map<Object,MetadataFilter> map) {
         checkSetterPreconditions();
         Constraint.isNotNull(map, "Filter mappings cannot be null");
         
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java
index 79b24cef6..4c8298d81 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityAttributesFilter.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.metadata.resolver.filter.impl;
 
-
 import java.util.Collection;
 import java.util.Iterator;
 import java.util.List;
@@ -48,7 +47,6 @@ import org.slf4j.Logger;
 import com.google.common.collect.ArrayListMultimap;
 import com.google.common.collect.Multimap;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -68,7 +66,7 @@ public class EntityAttributesFilter extends AbstractMetadataFilter {
     @Nonnull private final Logger log = LoggerFactory.getLogger(EntityAttributesFilter.class);
 
     /** Rules for adding attributes. */
-    @Nonnull @NonnullElements private Multimap<Predicate<EntityDescriptor>,Attribute> applyMap;
+    @Nonnull private Multimap<Predicate<EntityDescriptor>,Attribute> applyMap;
 
     /** A condition to apply to pre-existing tags to determine their legitimacy. */
     @Nullable private Predicate<Attribute> attributeFilter;
@@ -95,7 +93,7 @@ public class EntityAttributesFilter extends AbstractMetadataFilter {
      * 
      * @param rules rules to apply
      */
-    public void setRules(@Nonnull @NonnullElements final Map<Predicate<EntityDescriptor>,Collection<Attribute>> rules) {
+    public void setRules(@Nonnull final Map<Predicate<EntityDescriptor>,Collection<Attribute>> rules) {
         checkSetterPreconditions();
         Constraint.isNotNull(rules, "Rules map cannot be null");
         
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java
index 294c73b27..4bd18ba65 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/EntityRoleFilter.java
@@ -36,7 +36,6 @@ import org.opensaml.saml.saml2.metadata.RoleDescriptor;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -61,7 +60,7 @@ public class EntityRoleFilter extends AbstractMetadataFilter {
     @Nonnull private final Logger log = LoggerFactory.getLogger(EntityRoleFilter.class);
 
     /** List of roles that are NOT removed by this filter. */
-    @Nonnull @NonnullElements private List<QName> retainedRoles;
+    @Nonnull private List<QName> retainedRoles;
 
     /** Whether to keep entity descriptors that contain no roles; default value: true. */
     private boolean removeRolelessEntityDescriptors;
@@ -95,7 +94,7 @@ public class EntityRoleFilter extends AbstractMetadataFilter {
      * 
      * @return unmodifiable list of roles that are NOT removed by this filter
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<QName> getRetainedRoles() {
+    @Nonnull @Unmodifiable @NotLive public List<QName> getRetainedRoles() {
         return retainedRoles;
     }
 
@@ -250,7 +249,7 @@ public class EntityRoleFilter extends AbstractMetadataFilter {
      * 
      * @throws FilterException thrown if the effective role name can not be determined
      */
-    protected QName getRoleName(@Nonnull final RoleDescriptor role) throws FilterException {
+    @Nonnull protected QName getRoleName(@Nonnull final RoleDescriptor role) throws FilterException {
         QName roleName = role.getElementQName();
 
         if (extRoleDescriptor.equals(roleName)) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
index c0635429b..85252f340 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NameIDFormatFilter.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.saml.metadata.resolver.filter.impl;
 
-
 import java.util.Collection;
 import java.util.Map;
 import java.util.Set;
@@ -45,7 +44,6 @@ import org.slf4j.Logger;
 import com.google.common.collect.ArrayListMultimap;
 import com.google.common.collect.Multimap;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -149,8 +147,7 @@ public class NameIDFormatFilter extends AbstractMetadataFilter {
      * @param role role to modify
      * @param formats formats to attach
      */
-    protected void filterRoleDescriptor(@Nonnull final RoleDescriptor role,
-            @Nonnull @NonnullElements final Collection<String> formats) {
+    protected void filterRoleDescriptor(@Nonnull final RoleDescriptor role, @Nonnull final Collection<String> formats) {
         
         final Collection<NameIDFormat> roleFormats;
         
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NodeProcessingMetadataFilter.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NodeProcessingMetadataFilter.java
index 8b48d4b20..362b5f520 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NodeProcessingMetadataFilter.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/NodeProcessingMetadataFilter.java
@@ -31,7 +31,6 @@ import org.opensaml.saml.metadata.resolver.filter.MetadataFilterContext;
 import org.opensaml.saml.metadata.resolver.filter.MetadataNodeProcessor;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -67,7 +66,7 @@ public class NodeProcessingMetadataFilter extends AbstractMetadataFilter {
         checkSetterPreconditions();
         Constraint.isNotNull(newProcessors, "MetadataNodeProcessor list cannot be null");
 
-        processors = new ArrayList<>(CollectionSupport.copyToList(newProcessors));
+        processors = new ArrayList<>(newProcessors);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/package-info.java
index 163d4d001..a63e9eb47 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/package-info.java
@@ -15,6 +15,8 @@
  * limitations under the License.
  */
 
-/** Implementation of the resolver filters. */
+/** Implementation of Metadata Filters. */
+ at NonnullElements
+package org.opensaml.saml.metadata.resolver.filter.impl;
 
-package org.opensaml.saml.metadata.resolver.filter.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractBatchMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractBatchMetadataResolver.java
index 3d95599dd..a22bc1292 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractBatchMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractBatchMetadataResolver.java
@@ -39,7 +39,6 @@ import org.slf4j.Logger;
 
 import com.google.common.collect.Iterables;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -105,7 +104,7 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
      * 
      * @return the set of configured indexes
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<MetadataIndex> getIndexes() {
+    @Nonnull @Unmodifiable @NotLive public Set<MetadataIndex> getIndexes() {
         return indexes;
     }
 
@@ -213,8 +212,7 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
      *          by any indexes.  If 'present' is indicated, then there were applicable/understood criteria,
      *          and the wrapped set contains the indexed data, which may be empty.
      */
-    @Nonnull @NonnullElements 
-    protected Optional<Set<EntityDescriptor>> lookupByIndexes(@Nullable final CriteriaSet criteria) {
+    @Nonnull protected Optional<Set<EntityDescriptor>> lookupByIndexes(@Nullable final CriteriaSet criteria) {
         return ensureBackingStore().getSecondaryIndexManager().lookupIndexedItems(criteria);
     }
     
@@ -327,24 +325,22 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
     protected class BatchEntityBackingStore extends EntityBackingStore {
         
         /** The cached original source metadata document. */
-        private XMLObject cachedOriginalMetadata;
+        @Nullable private XMLObject cachedOriginalMetadata;
         
         /** The cached original source metadata document. */
-        private XMLObject cachedFilteredMetadata;
+        @Nullable private XMLObject cachedFilteredMetadata;
         
         /** Manager for secondary indexes. */
-        private MetadataIndexManager<EntityDescriptor> secondaryIndexManager;
+        @Nonnull private final MetadataIndexManager<EntityDescriptor> secondaryIndexManager;
         
         /**
          * Constructor.
          *
          * @param initIndexes secondary indexes for which to initialize storage
          */
-        protected BatchEntityBackingStore(
-                @Nullable @NonnullElements @Unmodifiable @NotLive final Set<MetadataIndex> initIndexes) {
-            super();
-            secondaryIndexManager = new MetadataIndexManager<>(initIndexes, 
-                    new MetadataIndexManager.IdentityExtractionFunction());
+        protected BatchEntityBackingStore(@Nullable final Set<MetadataIndex> initIndexes) {
+            secondaryIndexManager =
+                    new MetadataIndexManager<>(initIndexes, new MetadataIndexManager.IdentityExtractionFunction());
         }
 
         /**
@@ -352,16 +348,30 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
          * 
          * @return the cached metadata
          */
-        public XMLObject getCachedOriginalMetadata() {
+        @Nullable public XMLObject getCachedOriginalMetadata() {
             return cachedOriginalMetadata;
         }
 
+        /**
+         * Get the cached original source metadata, raising an {@link IllegalStateException} if null.
+         * 
+         * @return the cached metadata
+         * 
+         * @since 5.0.0
+         */
+        @Nonnull public XMLObject ensureCachedOriginalMetadata() {
+            if (cachedOriginalMetadata != null) {
+                return cachedOriginalMetadata;
+            }
+            throw new IllegalStateException("Original metadata was absent.");
+        }
+
         /**
          * Set the cached original source metadata.
          * 
          * @param metadata The new cached metadata
          */
-        public void setCachedOriginalMetadata(final XMLObject metadata) {
+        public void setCachedOriginalMetadata(@Nullable final XMLObject metadata) {
             cachedOriginalMetadata = metadata;
         }
         
@@ -370,7 +380,7 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
          * 
          * @return the cached metadata
          */
-        public XMLObject getCachedFilteredMetadata() {
+        @Nullable public XMLObject getCachedFilteredMetadata() {
             return cachedFilteredMetadata;
         }
 
@@ -379,7 +389,7 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
          * 
          * @param metadata The new cached metadata
          */
-        public void setCachedFilteredMetadata(final XMLObject metadata) {
+        public void setCachedFilteredMetadata(@Nullable final XMLObject metadata) {
             cachedFilteredMetadata = metadata;
         }
         
@@ -388,10 +398,9 @@ public abstract class AbstractBatchMetadataResolver extends AbstractMetadataReso
          * 
          * @return the manager for secondary indexes
          */
-        public MetadataIndexManager<EntityDescriptor> getSecondaryIndexManager() {
+        @Nonnull public MetadataIndexManager<EntityDescriptor> getSecondaryIndexManager() {
             return secondaryIndexManager;
         }
-        
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
index 5bcb85227..831d30760 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractDynamicMetadataResolver.java
@@ -66,7 +66,6 @@ import com.codahale.metrics.Timer.Context;
 import com.google.common.base.MoreObjects;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Positive;
@@ -573,7 +572,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
      * 
      * @return the set of configured indexes
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<MetadataIndex> getIndexes() {
+    @Nonnull @Unmodifiable @NotLive public Set<MetadataIndex> getIndexes() {
         return indexes;
     }
 
@@ -771,8 +770,8 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
      * @return the resolved metadata
      * @throws ResolverException  if there is a fatal error attempting to resolve the metadata
      */
-    @Nonnull @NonnullElements protected Iterable<EntityDescriptor> resolveFromOriginSource(
-            @Nullable final CriteriaSet criteria, @Nullable final String entityID) throws ResolverException {
+    @Nonnull protected Iterable<EntityDescriptor> resolveFromOriginSource(@Nullable final CriteriaSet criteria,
+            @Nullable final String entityID) throws ResolverException {
         
         if (entityID != null) {
             log.debug("{} Resolving from origin source based on entityID: {}", getLogPrefix(), entityID);
@@ -792,8 +791,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
      * @return the resolved metadata
      * @throws ResolverException  if there is a fatal error attempting to resolve the metadata
      */
-    @Nonnull @NonnullElements
-    protected Iterable<EntityDescriptor> resolveFromOriginSourceWithEntityID(
+    @Nonnull protected Iterable<EntityDescriptor> resolveFromOriginSourceWithEntityID(
             @Nullable final CriteriaSet criteria, @Nonnull final String entityID) throws ResolverException {
         
         final EntityManagementData mgmtData = ensureBackingStore().getManagementData(entityID);
@@ -859,8 +857,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
      * @return the resolved metadata
      * @throws ResolverException if there is a fatal error attempting to resolve the metadata
      */
-    @Nonnull @NonnullElements 
-    protected Iterable<EntityDescriptor> resolveFromOriginSourceWithoutEntityID(@Nullable final CriteriaSet criteria) 
+    @Nonnull protected Iterable<EntityDescriptor> resolveFromOriginSourceWithoutEntityID(@Nullable final CriteriaSet criteria) 
             throws ResolverException {
         
         XMLObject root = null;
@@ -897,8 +894,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
      * @return the resolved metadata
      * @throws ResolverException if there is a fatal error attempting to resolve the metadata
      */
-    @Nonnull @NonnullElements 
-    protected Iterable<EntityDescriptor> lookupCriteria(@Nullable final CriteriaSet criteria) throws ResolverException {
+    @Nonnull protected Iterable<EntityDescriptor> lookupCriteria(@Nullable final CriteriaSet criteria) throws ResolverException {
         final List<EntityDescriptor> entities = new ArrayList<>();
         final Set<String> entityIDs = resolveEntityIDs(criteria);
         for (final String entityID : entityIDs) {
@@ -983,8 +979,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements protected List<EntityDescriptor> lookupEntityID(@Nonnull final String entityID) 
-            throws ResolverException {
+    @Nonnull protected List<EntityDescriptor> lookupEntityID(@Nonnull final String entityID) throws ResolverException {
         ensureBackingStore().getManagementData(entityID).recordEntityAccess();
         return super.lookupEntityID(entityID);
     }
@@ -1002,7 +997,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
      * 
      * @throws FilterException if there is a problem filtering the metadata
      */
-    protected void processNewMetadata(@Nonnull final XMLObject root, @Nonnull final String expectedEntityID) 
+    protected void processNewMetadata(@Nonnull final XMLObject root, @Nonnull final String expectedEntityID)
             throws FilterException {
         try {
             processNewMetadata(root, expectedEntityID, false);
@@ -1553,19 +1548,17 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
     protected class DynamicEntityBackingStore extends EntityBackingStore {
         
         /** Map holding management data for each entityID. */
-        private Map<String, EntityManagementData> mgmtDataMap;
+        @Nonnull private Map<String, EntityManagementData> mgmtDataMap;
         
         /** Manager for secondary indexes. */
-        private LockableMetadataIndexManager<String> secondaryIndexManager;
+        @Nonnull private LockableMetadataIndexManager<String> secondaryIndexManager;
         
         /** 
          * Constructor.
          * 
          *  @param initIndexes secondary indexes for which to initialize storage
          */
-        protected DynamicEntityBackingStore(
-                @Nullable @NonnullElements @Unmodifiable @NotLive final Set<MetadataIndex> initIndexes) {
-            super();
+        protected DynamicEntityBackingStore(@Nullable final Set<MetadataIndex> initIndexes) {
             mgmtDataMap = new ConcurrentHashMap<>();
             secondaryIndexManager = new LockableMetadataIndexManager<>(initIndexes, 
                     new LockableMetadataIndexManager.EntityIDExtractionFunction()); 
@@ -1577,7 +1570,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
          * 
          * @return the manager for secondary indexes
          */
-        public LockableMetadataIndexManager<String> getSecondaryIndexManager() {
+        @Nonnull public LockableMetadataIndexManager<String> getSecondaryIndexManager() {
             return secondaryIndexManager;
         }
         
@@ -1586,10 +1579,9 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
          *
          * @return set of entityIDs, may be empty
          */
-        @Nonnull @NonnullElements @Unmodifiable @NotLive
-        public Set<String> getManagementDataEntityIDs() {
+        @Nonnull @Unmodifiable @NotLive public Set<String> getManagementDataEntityIDs() {
             synchronized (this) {
-                return Set.copyOf(mgmtDataMap.keySet());
+                return CollectionSupport.copyToSet(mgmtDataMap.keySet());
             }
         }
 
@@ -1640,25 +1632,25 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
     protected class EntityManagementData {
         
         /** The entity ID managed by this instance. */
-        private String entityID;
+        @Nonnull private String entityID;
         
         /** Last update time of the associated metadata. */
-        private Instant lastUpdateTime;
+        @Nullable private Instant lastUpdateTime;
         
         /** Expiration time of the associated metadata. */
-        private Instant expirationTime;
+        @Nonnull private Instant expirationTime;
         
         /** Time at which should start attempting to refresh the metadata. */
-        private Instant refreshTriggerTime;
+        @Nonnull private Instant refreshTriggerTime;
         
         /** The last time at which the entity's backing store data was accessed. */
-        private Instant lastAccessedTime;
+        @Nonnull private Instant lastAccessedTime;
         
         /** The time at which the negative lookup cache flag expires, if set. */
-        private Instant negativeLookupCacheExpiration;
+        @Nullable private Instant negativeLookupCacheExpiration;
         
         /** Read-write lock instance which governs access to the entity's backing store data. */
-        private ReadWriteLock readWriteLock;
+        @Nonnull private ReadWriteLock readWriteLock;
         
         /** Constructor. 
          * 
@@ -1696,7 +1688,7 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
          * 
          * @param dateTime the last update time
          */
-        public void setLastUpdateTime(@Nonnull final Instant dateTime) {
+        public void setLastUpdateTime(@Nullable final Instant dateTime) {
             lastUpdateTime = dateTime;
         }
         
@@ -1766,8 +1758,9 @@ public abstract class AbstractDynamicMetadataResolver extends AbstractMetadataRe
          * 
          * @return the time before which no further lookups for the entity will be performed
          */
-        public Instant initNegativeLookupCache() {
+        @Nonnull public Instant initNegativeLookupCache() {
             negativeLookupCacheExpiration = Instant.now().plus(getNegativeLookupCacheDuration());
+            assert negativeLookupCacheExpiration != null;
             return negativeLookupCacheExpiration;
         }
         
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractMetadataResolver.java
index 51bd69c57..e213206b8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractMetadataResolver.java
@@ -55,7 +55,6 @@ import com.google.common.base.Strings;
 import com.google.common.collect.Iterables;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
@@ -530,7 +529,7 @@ public abstract class AbstractMetadataResolver extends AbstractIdentifiableIniti
      * @return  a list of descriptors
      * @throws ResolverException if an error occurs
      */
-    @Nonnull @NonnullElements protected List<EntityDescriptor> lookupEntityID(@Nonnull @NotEmpty final String entityID)
+    @Nonnull protected List<EntityDescriptor> lookupEntityID(@Nonnull @NotEmpty final String entityID)
             throws ResolverException {
         if (!isInitialized()) {
             throw new ResolverException("Metadata resolver has not been initialized");
@@ -569,8 +568,7 @@ public abstract class AbstractMetadataResolver extends AbstractIdentifiableIniti
      * 
      * @return list copy of indexed entityID's, may be empty, will never be null
      */
-    @Nonnull @NonnullElements protected List<EntityDescriptor> lookupIndexedEntityID(
-            @Nonnull @NotEmpty final String entityID) {
+    @Nonnull protected List<EntityDescriptor> lookupIndexedEntityID(@Nonnull @NotEmpty final String entityID) {
         final List<EntityDescriptor> descriptors = ensureBackingStore().getIndexedDescriptors().get(entityID);
         if (descriptors != null) {
             return new ArrayList<>(descriptors);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java
index 8de994b1e..669805dcc 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/AbstractReloadingMetadataResolver.java
@@ -596,7 +596,7 @@ public abstract class AbstractReloadingMetadataResolver extends AbstractBatchMet
         releaseMetadataDOM(newBackingStore.getCachedFilteredMetadata());
 
         log.debug("{} Post-processing metadata from '{}'", getLogPrefix(), metadataIdentifier);
-        postProcessMetadata(metadataBytes, metadataDom, newBackingStore.getCachedOriginalMetadata(), 
+        postProcessMetadata(metadataBytes, metadataDom, newBackingStore.ensureCachedOriginalMetadata(), 
                 newBackingStore.getCachedFilteredMetadata());
 
         log.debug("{} Computing expiration time for metadata from '{}'", getLogPrefix(), metadataIdentifier);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/CompositeMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/CompositeMetadataResolver.java
index 5fb6e1492..78a7a4d9c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/CompositeMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/CompositeMetadataResolver.java
@@ -32,7 +32,6 @@ import org.opensaml.saml.metadata.resolver.filter.MetadataFilter;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -43,7 +42,6 @@ import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
-
 /**
  * A {@link MetadataResolver} implementation that answers requests by composing the answers of child
  * {@link MetadataResolver}s.
@@ -61,7 +59,7 @@ public class CompositeMetadataResolver extends AbstractIdentifiedInitializableCo
     @Nullable @NotEmpty private String resolverType;
 
     /** Resolvers composed by this resolver. */
-    @Nonnull @NonnullElements private List<MetadataResolver> resolvers;
+    @Nonnull private List<MetadataResolver> resolvers;
 
     /** Constructor. */
     public CompositeMetadataResolver() {
@@ -73,7 +71,7 @@ public class CompositeMetadataResolver extends AbstractIdentifiedInitializableCo
      * 
      * @return list of currently registered resolvers
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<MetadataResolver> getResolvers() {
+    @Nonnull @Unmodifiable @NotLive public List<MetadataResolver> getResolvers() {
         return resolvers;
     }
 
@@ -84,7 +82,7 @@ public class CompositeMetadataResolver extends AbstractIdentifiedInitializableCo
      * 
      * @throws ResolverException thrown if there is a problem adding the metadata provider
      */
-    public void setResolvers(@Nullable @NonnullElements final List<MetadataResolver> newResolvers) 
+    public void setResolvers(@Nullable final List<MetadataResolver> newResolvers) 
             throws ResolverException {
         checkSetterPreconditions();
 
@@ -349,4 +347,5 @@ public class CompositeMetadataResolver extends AbstractIdentifiedInitializableCo
             }
         }
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/DefaultLocalDynamicSourceKeyGenerator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/DefaultLocalDynamicSourceKeyGenerator.java
index d701096d5..d62695191 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/DefaultLocalDynamicSourceKeyGenerator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/DefaultLocalDynamicSourceKeyGenerator.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.saml.metadata.resolver.impl;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.core.criterion.EntityIdCriterion;
@@ -43,7 +44,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 public class DefaultLocalDynamicSourceKeyGenerator extends EntityIDDigestGenerator {
     
     /** Hex encoder. */
-    private static final BaseEncoding HEX = BaseEncoding.base16().lowerCase();
+    @Nonnull private static final BaseEncoding HEX = BaseEncoding.base16().lowerCase();
 
     /**
      * Constructor.
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/LocalDynamicMetadataResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/LocalDynamicMetadataResolver.java
index c94afc803..762e2acd8 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/LocalDynamicMetadataResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/LocalDynamicMetadataResolver.java
@@ -115,7 +115,7 @@ public class LocalDynamicMetadataResolver extends AbstractDynamicMetadataResolve
 
     /** {@inheritDoc} */
     @Override
-    protected XMLObject fetchFromOriginSource(@Nullable final CriteriaSet criteria) throws IOException {
+    @Nullable protected XMLObject fetchFromOriginSource(@Nullable final CriteriaSet criteria) throws IOException {
         final String key = sourceKeyGenerator.apply(criteria);
         if (key != null) {
             log.trace("{} Attempting to load from local source manager with generated key '{}'", getLogPrefix(), key);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/MetadataQueryProtocolRequestURLBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/MetadataQueryProtocolRequestURLBuilder.java
index 040fcca5c..51ff40937 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/MetadataQueryProtocolRequestURLBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/MetadataQueryProtocolRequestURLBuilder.java
@@ -30,7 +30,6 @@ import com.google.common.escape.Escaper;
 import com.google.common.net.UrlEscapers;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -101,8 +100,8 @@ public class MetadataQueryProtocolRequestURLBuilder implements Function<Criteria
      */
     public MetadataQueryProtocolRequestURLBuilder(
             @ParameterName(name="baseURL") @Nonnull @NotEmpty final String baseURL,
-            @ParameterName(name="secondaryURLBuilders") @Nullable @NonnullElements
-                final List<MetadataQueryProtocolURLBuilder> secondaryURLBuilders) {
+            @ParameterName(name="secondaryURLBuilders")
+            @Nullable final List<MetadataQueryProtocolURLBuilder> secondaryURLBuilders) {
         this(baseURL, null, secondaryURLBuilders);
     }
     
@@ -116,8 +115,8 @@ public class MetadataQueryProtocolRequestURLBuilder implements Function<Criteria
     public MetadataQueryProtocolRequestURLBuilder(
             @ParameterName(name="baseURL") @Nonnull @NotEmpty final String baseURL, 
             @ParameterName(name="transform") @Nullable final Function<String,String> transform,
-            @ParameterName(name="secondaryURLBuilders") @Nullable @NonnullElements
-                final List<MetadataQueryProtocolURLBuilder> secondaryURLBuilders
+            @ParameterName(name="secondaryURLBuilders")
+            @Nullable final List<MetadataQueryProtocolURLBuilder> secondaryURLBuilders
             ) {
         base = Constraint.isNotNull(StringSupport.trimOrNull(baseURL), "Base URL was null or empty");
         if (!base.endsWith("/")) {
@@ -166,7 +165,7 @@ public class MetadataQueryProtocolRequestURLBuilder implements Function<Criteria
      * @param inputEntityID the entityID
      * @return the request URL, or null
      */
-    private String buildFromEntityID(@Nonnull final String inputEntityID) {
+    @Nullable private String buildFromEntityID(@Nonnull final String inputEntityID) {
         String entityID = inputEntityID;
         if (transformer != null) {
             entityID = transformer.apply(inputEntityID);
@@ -189,7 +188,7 @@ public class MetadataQueryProtocolRequestURLBuilder implements Function<Criteria
      * @param criteria the criteria
      * @return the request URL, or null
      */
-    private String buildFromSecondaryLookups(@Nullable final CriteriaSet criteria) {
+    @Nullable private String buildFromSecondaryLookups(@Nullable final CriteriaSet criteria) {
         if (urlBuilders != null) {
             for (final MetadataQueryProtocolURLBuilder builder : urlBuilders) {
                 final String url = builder.buildURL(base, criteria);
@@ -217,7 +216,7 @@ public class MetadataQueryProtocolRequestURLBuilder implements Function<Criteria
          * @return a URL based on the supplied inputs, or null if the implementation did not support
          *     or understand any of the supplied criteria 
          */
-        @Nullable public String buildURL(@Nonnull final String baseURL, @Nullable final CriteriaSet criteria);
+        @Nullable String buildURL(@Nonnull final String baseURL, @Nullable final CriteriaSet criteria);
         
     }
 
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/PredicateRoleDescriptorResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/PredicateRoleDescriptorResolver.java
index ed80f6201..a2be75cb1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/PredicateRoleDescriptorResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/PredicateRoleDescriptorResolver.java
@@ -307,7 +307,7 @@ public class PredicateRoleDescriptorResolver extends AbstractIdentifiedInitializ
      * 
      * @return the role descriptors corresponding to the input entity role and protocol
      */
-    protected Iterable<RoleDescriptor> getCandidatesByRoleAndProtocol(
+    @Nonnull protected Iterable<RoleDescriptor> getCandidatesByRoleAndProtocol(
             @Nonnull final Iterable<EntityDescriptor> entityDescriptors, @Nullable final CriteriaSet criteria) {
         
         final EntityRoleCriterion roleCriterion =
@@ -336,7 +336,7 @@ public class PredicateRoleDescriptorResolver extends AbstractIdentifiedInitializ
      * 
      * @return all role descriptors contained by the input entity descriptors
      */
-    protected Iterable<RoleDescriptor> getAllCandidates(
+    @Nonnull protected Iterable<RoleDescriptor> getAllCandidates(
             @Nonnull final Iterable<EntityDescriptor> entityDescriptors) {
         
         final ArrayList<Iterable<RoleDescriptor>> aggregate = new ArrayList<>();
@@ -359,9 +359,9 @@ public class PredicateRoleDescriptorResolver extends AbstractIdentifiedInitializ
      * 
      * @throws ResolverException if there is a fatal error during resolution
      */
-    protected Iterable<RoleDescriptor> predicateFilterCandidates(@Nonnull final Iterable<RoleDescriptor> candidates,
-            @Nullable final CriteriaSet criteria, final boolean onEmptyPredicatesReturnEmpty)
-                    throws ResolverException {
+    @Nonnull protected Iterable<RoleDescriptor> predicateFilterCandidates(
+            @Nonnull final Iterable<RoleDescriptor> candidates, @Nullable final CriteriaSet criteria,
+            final boolean onEmptyPredicatesReturnEmpty) throws ResolverException {
         
         if (!candidates.iterator().hasNext()) {
             log.debug("Candidates iteration was empty, nothing to filter via predicates");
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/SAMLArtifactURLBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/SAMLArtifactURLBuilder.java
index 205a21ab5..b4e421118 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/SAMLArtifactURLBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/SAMLArtifactURLBuilder.java
@@ -37,7 +37,7 @@ public class SAMLArtifactURLBuilder implements MetadataQueryProtocolURLBuilder {
     @Nonnull private static final BaseEncoding HEX = BaseEncoding.base16().lowerCase();
 
     /** {@inheritDoc} */
-    public String buildURL(@Nonnull final String baseURL, @Nullable final CriteriaSet criteria) {
+    @Nullable public String buildURL(@Nonnull final String baseURL, @Nullable final CriteriaSet criteria) {
         
         final ArtifactCriterion artifactCriterion = criteria != null ? criteria.get(ArtifactCriterion.class) : null;
         if (artifactCriterion == null) {
@@ -59,7 +59,7 @@ public class SAMLArtifactURLBuilder implements MetadataQueryProtocolURLBuilder {
      * @return the request URL
      * 
      */
-    private String buildFromSourceID(@Nonnull final String baseURL, 
+    @Nullable private String buildFromSourceID(@Nonnull final String baseURL, 
             @Nonnull final SAMLSourceIDArtifact sourceIDArtifact) {
         
         // We just statically escape "{sha1}" here
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/package-info.java
index 55dd4ee3e..0801a6434 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/impl/package-info.java
@@ -17,15 +17,8 @@
 
 /**
  * Classes for retrieving, filtering, and querying metadata.
- *
- * <p>
- * Information on using this library can be found in the
- * <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OSTwoUserManual">User's Manual</a>
- * and information on extending its functionality can be found in the
- * <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OSTwoDeveloperManual">Developer's Manual</a>.
- * </p>
- *
- * @see <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OpenSAML">OpenSAML Wiki</a>
  */
-
+ at NonnullElements
 package org.opensaml.saml.metadata.resolver.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java
index b8db798ff..279a79785 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/EndpointMetadataIndex.java
@@ -41,7 +41,6 @@ import org.slf4j.Logger;
 import com.google.common.base.MoreObjects;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -93,8 +92,8 @@ public class EndpointMetadataIndex implements MetadataIndex {
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive
-    public Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nonnull final EntityDescriptor descriptor) {
         Constraint.isNotNull(descriptor, "EntityDescriptor was null");
         final HashSet<MetadataIndexKey> result = new HashSet<>();
         for (final RoleDescriptor role : descriptor.getRoleDescriptors()) {
@@ -129,8 +128,8 @@ public class EndpointMetadataIndex implements MetadataIndex {
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive
-    public Set<MetadataIndexKey> generateKeys(@Nullable final CriteriaSet criteriaSet) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nullable final CriteriaSet criteriaSet) {
         final EntityRoleCriterion roleCrit = criteriaSet != null ? criteriaSet.get(EntityRoleCriterion.class) : null;
         final EndpointCriterion<Endpoint> endpointCrit =
             criteriaSet != null ? criteriaSet.get(EndpointCriterion.class) : null;
@@ -316,10 +315,8 @@ public class EndpointMetadataIndex implements MetadataIndex {
          * @param endpointLocation the endpoint location
          * @param isResponse flag indicating whether location is a response or not
          */
-        public EndpointMetadataIndexKey(@Nonnull final QName roleType, 
-                @Nonnull final QName endpointType, 
-                @Nonnull @NotEmpty final String endpointLocation,
-                final boolean isResponse) {
+        public EndpointMetadataIndexKey(@Nonnull final QName roleType, @Nonnull final QName endpointType,
+                @Nonnull @NotEmpty final String endpointLocation, final boolean isResponse) {
             role = Constraint.isNotNull(roleType, "SAML role cannot be null");
             endpoint = Constraint.isNotNull(endpointType, "SAML endpoint type cannot be null");
             location = Constraint.isNotNull(StringSupport.trimOrNull(endpointLocation),
@@ -410,8 +407,7 @@ public class EndpointMetadataIndex implements MetadataIndex {
                 return true;
             }
 
-            if (obj instanceof EndpointMetadataIndexKey) {
-                final EndpointMetadataIndexKey other = (EndpointMetadataIndexKey) obj;
+            if (obj instanceof EndpointMetadataIndexKey other) {
                 String thisLocation = this.canonicalizedLocation;
                 String otherLocation = other.canonicalizedLocation;
                 if (this.isCanonicalizedLowerCase != other.isCanonicalizedLowerCase) {
@@ -432,4 +428,4 @@ public class EndpointMetadataIndex implements MetadataIndex {
 
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/FunctionDrivenMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/FunctionDrivenMetadataIndex.java
index d9ad5b7ab..163b33872 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/FunctionDrivenMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/FunctionDrivenMetadataIndex.java
@@ -23,7 +23,6 @@ import java.util.function.Function;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.logic.Constraint;
@@ -57,15 +56,15 @@ public class FunctionDrivenMetadataIndex implements MetadataIndex {
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive 
-    public Set<MetadataIndexKey> generateKeys(@Nullable final CriteriaSet criteriaSet) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nullable final CriteriaSet criteriaSet) {
         Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
         return criteriaStrategy.apply(criteriaSet);
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive 
-    public Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nonnull final EntityDescriptor descriptor) {
         Constraint.isNotNull(descriptor, "EntityDescriptor was null");
         return descriptorStrategy.apply(descriptor);
     }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/LockableMetadataIndexManager.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/LockableMetadataIndexManager.java
index 984990b60..e1a321630 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/LockableMetadataIndexManager.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/LockableMetadataIndexManager.java
@@ -28,10 +28,6 @@ import javax.annotation.Nullable;
 import org.opensaml.saml.metadata.resolver.index.MetadataIndex;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-import net.shibboleth.shared.annotation.constraint.NotLive;
-import net.shibboleth.shared.annotation.constraint.Unmodifiable;
-
 /**
  * A specialization of {@link MetadataIndexManager} capable of read/write locking.
  * 
@@ -48,10 +44,8 @@ public class LockableMetadataIndexManager<T> extends MetadataIndexManager<T> {
      * @param initIndexes indexes for which to initialize storage
      * @param extractionFunction function to extract the indexed data item from an EntityDescriptor
      */
-    public LockableMetadataIndexManager(
-            @Nullable @NonnullElements @Unmodifiable @NotLive final Set<MetadataIndex> initIndexes,
-            @Nonnull final Function<EntityDescriptor, T> extractionFunction
-            ) {
+    public LockableMetadataIndexManager(@Nullable final Set<MetadataIndex> initIndexes,
+            @Nonnull final Function<EntityDescriptor, T> extractionFunction) {
         super(initIndexes, extractionFunction);
         readWriteLock = new ReentrantReadWriteLock(true);
     }
@@ -69,6 +63,5 @@ public class LockableMetadataIndexManager<T> extends MetadataIndexManager<T> {
     @Nonnull public ReadWriteLock getReadWriteLock() {
         return readWriteLock;
     }
-
-
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java
index 96dff09a5..437cc4323 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexManager.java
@@ -32,7 +32,6 @@ import org.opensaml.saml.metadata.resolver.index.MetadataIndexKey;
 import org.opensaml.saml.saml2.metadata.EntityDescriptor;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -66,10 +65,8 @@ public class MetadataIndexManager<T> {
      * @param initIndexes indexes for which to initialize storage
      * @param extractionFunction function to extract the indexed data item from an EntityDescriptor
      */
-    public MetadataIndexManager(
-            @Nullable @NonnullElements @Unmodifiable @NotLive final Set<MetadataIndex> initIndexes,
-            @Nonnull final Function<EntityDescriptor, T> extractionFunction
-            ) {
+    public MetadataIndexManager(@Nullable final Set<MetadataIndex> initIndexes,
+            @Nonnull final Function<EntityDescriptor, T> extractionFunction) {
         
         entityDescriptorFunction = Constraint.isNotNull(extractionFunction, 
                 "EntityDescriptor extraction function was null");
@@ -88,6 +85,7 @@ public class MetadataIndexManager<T> {
      * 
      * @return the set of all current indexes
      */
+    @SuppressWarnings("null")
     @Nonnull @Unmodifiable @NotLive public Set<MetadataIndex> getIndexes() {
         return CollectionSupport.copyToSet(indexes.keySet());
     }
@@ -115,8 +113,7 @@ public class MetadataIndexManager<T> {
      *          by any indexes.  If 'present' is indicated, then there were applicable/understood criteria,
      *          and the wrapped set contains the indexed data, which may be empty.
      */
-    @Nonnull @NonnullElements
-    public Optional<Set<T>> lookupIndexedItems(@Nullable final CriteriaSet criteria) {
+    @Nonnull public Optional<Set<T>> lookupIndexedItems(@Nullable final CriteriaSet criteria) {
         final Set<T> items = new HashSet<>();
         for (final MetadataIndex index : indexes.keySet()) {
             final Set<MetadataIndexKey> keys = index.generateKeys(criteria);
@@ -232,4 +229,4 @@ public class MetadataIndexManager<T> {
         
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java
index 0d10315dc..78ab8db6c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/MetadataIndexStore.java
@@ -55,6 +55,7 @@ public class MetadataIndexStore<T> {
      * 
      * @return the set of all currently indexed keys
      */
+    @SuppressWarnings("null")
     @Nonnull @Unmodifiable @NotLive public Set<MetadataIndexKey> getKeys() {
         return CollectionSupport.copyToSet(index.keySet());
     }
@@ -124,4 +125,4 @@ public class MetadataIndexStore<T> {
         index.clear();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/RoleMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/RoleMetadataIndex.java
index 253fffafe..3b8462b5f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/RoleMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/RoleMetadataIndex.java
@@ -24,7 +24,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.logic.Constraint;
@@ -44,8 +43,8 @@ import com.google.common.base.MoreObjects;
 public class RoleMetadataIndex implements MetadataIndex {
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive 
-    public Set<MetadataIndexKey> generateKeys(@Nullable final CriteriaSet criteriaSet) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nullable final CriteriaSet criteriaSet) {
         final EntityRoleCriterion roleCrit = criteriaSet != null ? criteriaSet.get(EntityRoleCriterion.class) : null;
         if (roleCrit != null) {
             final HashSet<MetadataIndexKey> result = new HashSet<>();
@@ -56,8 +55,8 @@ public class RoleMetadataIndex implements MetadataIndex {
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive 
-    public Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nonnull final EntityDescriptor descriptor) {
         Constraint.isNotNull(descriptor, "EntityDescriptor was null");
         final HashSet<MetadataIndexKey> result = new HashSet<>();
         for (final RoleDescriptor role : descriptor.getRoleDescriptors()) {
@@ -115,8 +114,8 @@ public class RoleMetadataIndex implements MetadataIndex {
                 return true;
             }
 
-            if (obj instanceof RoleMetadataIndexKey) {
-                return role.equals(((RoleMetadataIndexKey) obj).role);
+            if (obj instanceof RoleMetadataIndexKey other) {
+                return role.equals(other.role);
             }
 
             return false;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
index 57baea6af..efca2ea28 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/SAMLArtifactMetadataIndex.java
@@ -51,8 +51,9 @@ import org.slf4j.Logger;
 
 import com.google.common.base.MoreObjects;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.logic.Constraint;
@@ -66,7 +67,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 public class SAMLArtifactMetadataIndex implements MetadataIndex {
     
     /** Indexing function instance to use. */
-    @Nonnull @NonnullElements private List<Function<EntityDescriptor, Set<MetadataIndexKey>>> indexingFunctions;
+    @Nonnull private List<Function<EntityDescriptor, Set<MetadataIndexKey>>> indexingFunctions;
     
     /**
      * Constructor.
@@ -102,7 +103,8 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Set<MetadataIndexKey> generateKeys(@Nonnull final EntityDescriptor descriptor) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nonnull final EntityDescriptor descriptor) {
         Constraint.isNotNull(descriptor, "EntityDescriptor was null");
         final HashSet<MetadataIndexKey> results = new HashSet<>();
         for (final Function<EntityDescriptor, Set<MetadataIndexKey>> indexingFunction : indexingFunctions) {
@@ -115,7 +117,8 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
     }
 
     /** {@inheritDoc} */
-    @Nullable public Set<MetadataIndexKey> generateKeys(@Nullable final CriteriaSet criteriaSet) {
+    @Nullable @Unmodifiable @NotLive public Set<MetadataIndexKey> generateKeys(
+            @Nullable final CriteriaSet criteriaSet) {
         final ArtifactCriterion artifactCrit = criteriaSet != null ? criteriaSet.get(ArtifactCriterion.class) : null;
         if (artifactCrit != null) {
             final LazySet<MetadataIndexKey> results = new LazySet<>();
@@ -328,8 +331,8 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
                 return true;
             }
 
-            if (obj instanceof ArtifactSourceIDMetadataIndexKey) {
-                return Arrays.equals(sourceID, ((ArtifactSourceIDMetadataIndexKey) obj).getSourceID());
+            if (obj instanceof ArtifactSourceIDMetadataIndexKey other) {
+                return Arrays.equals(sourceID, other.getSourceID());
             }
 
             return false;
@@ -416,8 +419,7 @@ public class SAMLArtifactMetadataIndex implements MetadataIndex {
                 return true;
             }
 
-            if (obj instanceof ArtifactSourceLocationMetadataIndexKey) {
-                final ArtifactSourceLocationMetadataIndexKey other = (ArtifactSourceLocationMetadataIndexKey) obj;
+            if (obj instanceof ArtifactSourceLocationMetadataIndexKey other) {
                 if (this.isCanonicalizedLowerCase == other.isCanonicalizedLowerCase) {
                     return this.canonicalizedLocation.equals(other.canonicalizedLocation);
                 }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/package-info.java
index ca9f7b57e..ef16a1bbf 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/index/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Implementation of the metadata resolver indexes. */
+ at NonnullElements
+package org.opensaml.saml.metadata.resolver.index.impl;
 
-package org.opensaml.saml.metadata.resolver.index.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java
index 9607b98c8..81940b17d 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPArtifactDecoder.java
@@ -113,8 +113,8 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
      * 
      * @throws MessageDecodingException thrown if there is a problem decoding or dereferencing the artifacts
      */
-    protected void processArtifacts(final MessageContext messageContext, final HttpServletRequest request) 
-            throws MessageDecodingException {
+    protected void processArtifacts(@Nonnull final MessageContext messageContext,
+            @Nonnull final HttpServletRequest request) throws MessageDecodingException {
         final String[] encodedArtifacts = request.getParameterValues("SAMLart");
         if (encodedArtifacts == null || encodedArtifacts.length == 0) {
             log.error("URL SAMLart parameter was missing or did not contain a value");
@@ -131,7 +131,7 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
      * 
      * @param messageContext the current message context
      */
-    protected void populateBindingContext(final MessageContext messageContext) {
+    protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
         final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
         bindingContext.setBindingUri(getBindingURI());
         bindingContext.setBindingDescriptor(bindingDescriptor);
@@ -139,4 +139,4 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
         bindingContext.setIntendedDestinationEndpointURIRequired(false);
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java
index 0dfeb72cb..50fd52d7f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HTTPPostDecoder.java
@@ -112,7 +112,7 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
      * 
      * @param messageContext the current message context
      */
-    protected void populateBindingContext(final MessageContext messageContext) {
+    protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
         final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
         bindingContext.setBindingUri(getBindingURI());
         bindingContext.setBindingDescriptor(bindingDescriptor);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java
index 2d5edcb60..1fccf6ef3 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/HttpClientResponseSOAP11Decoder.java
@@ -99,7 +99,7 @@ public class HttpClientResponseSOAP11Decoder
      * 
      * @param messageContext the current message context
      */
-    protected void populateBindingContext(final MessageContext messageContext) {
+    protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
         final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
         bindingContext.setBindingUri(getBindingURI());
         bindingContext.setBindingDescriptor(bindingDescriptor);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/package-info.java
index 1f31e7c05..f8541d415 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/decoding/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * SAML 1.x message decoders. 
  */
+ at NonnullElements
+package org.opensaml.saml.saml1.binding.decoding.impl;
 
-package org.opensaml.saml.saml1.binding.decoding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/package-info.java
index a8eb0cb66..8d6060de9 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/encoding/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * SAML 1.x message encoders. 
  */
+ at NonnullElements
+package org.opensaml.saml.saml1.binding.encoding.impl;
 
-package org.opensaml.saml.saml1.binding.encoding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/package-info.java
index 889079708..3768d1323 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/binding/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * General message handlers for SAML 1.x. 
  */
+ at NonnullElements
+package org.opensaml.saml.saml1.binding.impl;
 
-package org.opensaml.saml.saml1.binding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/package-info.java
index 709ae9817..591c4b9f1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/core/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of SAML 1.x core specification types and elements.
  */
+ at NonnullElements
+package org.opensaml.saml.saml1.core.impl;
 
-package org.opensaml.saml.saml1.core.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java
index 5b1e63d4c..59d9988bf 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddNameIdentifierToSubjects.java
@@ -281,7 +281,6 @@ public class AddNameIdentifierToSubjects extends AbstractProfileAction {
     private class AssertionStrategy implements Function<ProfileRequestContext,List<Assertion>> {
 
         /** {@inheritDoc} */
-        @Override
         @Nullable public List<Assertion> apply(@Nullable final ProfileRequestContext input) {
             if (input != null && input.getOutboundMessageContext() != null) {
                 final Object outboundMessage = input.ensureOutboundMessageContext().getMessage();
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddStatusToResponse.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddStatusToResponse.java
index 7c9eeb29c..e08d975b3 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddStatusToResponse.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddStatusToResponse.java
@@ -45,7 +45,6 @@ import org.opensaml.saml.saml1.core.StatusMessage;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -83,7 +82,7 @@ public class AddStatusToResponse extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,String> statusMessageLookupStrategy;
     
     /** One or more default status codes to insert. */
-    @Nonnull @NonnullElements private List<QName> defaultStatusCodes;
+    @Nonnull private List<QName> defaultStatusCodes;
     
     /** A default status message to include. */
     @Nullable private String statusMessage;
@@ -235,7 +234,7 @@ public class AddStatusToResponse extends AbstractProfileAction {
      * @param status    the element to attach to
      * @param codes     the status codes to use
      */
-    private void buildStatusCode(@Nonnull final Status status, @Nonnull @NonnullElements final List<QName> codes) {
+    private void buildStatusCode(@Nonnull final Status status, @Nonnull final List<QName> codes) {
         final SAMLObjectBuilder<StatusCode> statusCodeBuilder = (SAMLObjectBuilder<StatusCode>)
                 XMLObjectProviderRegistrySupport.getBuilderFactory().<StatusCode>ensureBuilder(
                         StatusCode.TYPE_NAME);
@@ -277,7 +276,7 @@ public class AddStatusToResponse extends AbstractProfileAction {
     public static class StatusCodeMappingFunction implements Function<ProfileRequestContext,List<QName>> {
 
         /** Code mappings. */
-        @Nonnull @NonnullElements private Map<String,List<QName>> codeMappings;
+        @Nonnull private Map<String,List<QName>> codeMappings;
         
         /** Strategy function for access to {@link EventContext} to check. */
         @Nonnull private Function<ProfileRequestContext,EventContext> eventContextLookupStrategy;
@@ -287,14 +286,14 @@ public class AddStatusToResponse extends AbstractProfileAction {
          *
          * @param mappings the status code mappings to use
          */
-        public StatusCodeMappingFunction(@Nonnull @NonnullElements final Map<String,List<QName>> mappings) {
+        public StatusCodeMappingFunction(@Nonnull final Map<String,List<QName>> mappings) {
             Constraint.isNotNull(mappings, "Status code mappings cannot be null");
             
             codeMappings = new HashMap<>(mappings.size());
             for (final Map.Entry<String,List<QName>> entry : mappings.entrySet()) {
                 final String event = StringSupport.trimOrNull(entry.getKey());
                 if (event != null && entry.getValue() != null) {
-                    codeMappings.put(event, List.copyOf(entry.getValue()));
+                    codeMappings.put(event, CollectionSupport.copyToList(entry.getValue()));
                 }
             }
             
@@ -312,7 +311,6 @@ public class AddStatusToResponse extends AbstractProfileAction {
         }
         
         /** {@inheritDoc} */
-        @Override
         @Nullable public List<QName> apply(@Nullable final ProfileRequestContext input) {
             final EventContext eventCtx = eventContextLookupStrategy.apply(input);
             if (eventCtx != null && eventCtx.getEvent() != null) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddSubjectConfirmationToSubjects.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddSubjectConfirmationToSubjects.java
index b26d10a2a..4d3198d5c 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddSubjectConfirmationToSubjects.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/AddSubjectConfirmationToSubjects.java
@@ -43,11 +43,11 @@ import org.opensaml.saml.saml1.core.SubjectStatement;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.StringSupport;
 
 /**
  * Action that builds {@link SubjectConfirmation} and adds it to the {@link Subject} of all the statements
@@ -81,7 +81,7 @@ public class AddSubjectConfirmationToSubjects extends AbstractProfileAction {
     @Nonnull private Function<ProfileRequestContext,Response> responseLookupStrategy;
     
     /** Methods to add. */
-    @Nonnull @NonnullElements private Collection<String> confirmationMethods;
+    @Nonnull private Collection<String> confirmationMethods;
     
     /** Response to modify. */
     @NonnullBeforeExec private Response response;
@@ -132,11 +132,11 @@ public class AddSubjectConfirmationToSubjects extends AbstractProfileAction {
      * 
      * @param methods   confirmation methods to use
      */
-    public void setMethods(@Nonnull @NonnullElements final Collection<String> methods) {
+    public void setMethods(@Nonnull final Collection<String> methods) {
         checkSetterPreconditions();
         Constraint.isNotEmpty(methods, "Confirmation method collection cannot be null or empty");
         
-        confirmationMethods = CollectionSupport.copyToList(methods);
+        confirmationMethods = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(methods));
     }
     
     /** {@inheritDoc} */
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/package-info.java
index fc59d385f..60370fb44 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml1/profile/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of SAML 1.x profile behavior.
  */
+ at NonnullElements
+package org.opensaml.saml.saml1.profile.impl;
 
-package org.opensaml.saml.saml1.profile.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/package-info.java
index a0f61e698..1d10f502a 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/assertion/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes for validating SAML 2 Assertions.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.assertion.impl;
 
-package org.opensaml.saml.saml2.assertion.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
index a2589dabc..33270d2b2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPArtifactDecoder.java
@@ -382,8 +382,8 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
      * 
      * @throws MessageDecodingException thrown if there is a problem decoding or dereferencing the artifact
      */
-    private void processArtifact(final MessageContext messageContext, final HttpServletRequest request) 
-            throws MessageDecodingException {
+    private void processArtifact(@Nonnull final MessageContext messageContext,
+            @Nonnull final HttpServletRequest request)  throws MessageDecodingException {
         
         final String encodedArtifact = StringSupport.trimOrNull(request.getParameter("SAMLart"));
         if (encodedArtifact == null) {
@@ -640,7 +640,7 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
      * 
      * @param messageContext the current message context
      */
-    protected void populateBindingContext(final MessageContext messageContext) {
+    protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
         final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
         bindingContext.setBindingUri(getBindingURI());
         bindingContext.setBindingDescriptor(bindingDescriptor);
@@ -648,4 +648,4 @@ public class HTTPArtifactDecoder extends BaseHttpServletRequestXMLMessageDecoder
         bindingContext.setIntendedDestinationEndpointURIRequired(false);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java
index f8cfef0fb..3565b639a 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostDecoder.java
@@ -113,7 +113,7 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
      * @throws MessageDecodingException thrown if the message does not contain a base64 encoded SAML message, 
      *                                      or the message can not be base64-decoded.
      */
-    @Nonnull protected InputStream getBase64DecodedMessage(final HttpServletRequest request)
+    @Nonnull protected InputStream getBase64DecodedMessage(@Nonnull final HttpServletRequest request)
             throws MessageDecodingException {
         log.debug("Getting Base64 encoded message from request");
         String encodedMessage = request.getParameter("SAMLRequest");
@@ -145,7 +145,7 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
      * 
      * @param messageContext the current message context
      */
-    protected void populateBindingContext(final MessageContext messageContext) {
+    protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
         final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
         bindingContext.setBindingUri(getBindingURI());
         bindingContext.setBindingDescriptor(bindingDescriptor);
@@ -153,4 +153,4 @@ public class HTTPPostDecoder extends BaseHttpServletRequestXMLMessageDecoder imp
         bindingContext.setIntendedDestinationEndpointURIRequired(SAMLBindingSupport.isMessageSigned(messageContext));
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java
index 082814724..b27aa6d53 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPPostSimpleSignDecoder.java
@@ -41,7 +41,7 @@ public class HTTPPostSimpleSignDecoder extends HTTPPostDecoder {
      * 
      * @param messageContext the current message context
      */
-    protected void populateBindingContext(final MessageContext messageContext) {
+    protected void populateBindingContext(@Nonnull final MessageContext messageContext) {
         final SAMLBindingContext bindingContext = messageContext.ensureSubcontext(SAMLBindingContext.class);
         bindingContext.setBindingUri(getBindingURI());
         bindingContext.setBindingDescriptor(getBindingDescriptor());
@@ -50,4 +50,4 @@ public class HTTPPostSimpleSignDecoder extends HTTPPostDecoder {
         bindingContext.setIntendedDestinationEndpointURIRequired(SAMLBindingSupport.isMessageSigned(messageContext));
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
index 35d3aba5a..95bc301a7 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/HTTPRedirectDeflateDecoder.java
@@ -165,7 +165,7 @@ public class HTTPRedirectDeflateDecoder extends BaseHttpServletRequestXMLMessage
          *
          * @param is the input stream
          */
-        public NoWrapAutoEndInflaterInputStream(final InputStream is) {
+        public NoWrapAutoEndInflaterInputStream(@Nonnull final InputStream is) {
             super(is, new Inflater(true));
         }
 
@@ -179,4 +179,4 @@ public class HTTPRedirectDeflateDecoder extends BaseHttpServletRequestXMLMessage
 
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/package-info.java
index 394876cc0..16220a3e9 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/decoding/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * SAML 2.0 message decoders. 
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.binding.decoding.impl;
 
-package org.opensaml.saml.saml2.binding.decoding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPPostSimpleSignEncoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPPostSimpleSignEncoder.java
index d0c8fe156..3b14cb9fb 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPPostSimpleSignEncoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPPostSimpleSignEncoder.java
@@ -152,8 +152,8 @@ public class HTTPPostSimpleSignEncoder extends HTTPPostEncoder {
      * @return the form control data string for signature computation
      */
     @Nonnull protected String buildFormDataToSign(@Nonnull final VelocityContext velocityContext,
-            @Nonnull final MessageContext messageContext,
-            final String sigAlgURI) throws MessageEncodingException {
+            @Nonnull final MessageContext messageContext, @Nonnull final String sigAlgURI)
+                    throws MessageEncodingException {
         final StringBuilder builder = new StringBuilder();
 
         boolean isRequest = false;
@@ -208,7 +208,7 @@ public class HTTPPostSimpleSignEncoder extends HTTPPostEncoder {
      * @throws MessageEncodingException thrown if the algorithm URI is not supplied explicitly and 
      *          could not be derived from the supplied credential
      */
-    @Nonnull protected String getSignatureAlgorithmURI(final SignatureSigningParameters signingParameters)
+    @Nonnull protected String getSignatureAlgorithmURI(@Nonnull final SignatureSigningParameters signingParameters)
             throws MessageEncodingException {
         
         final String alg = signingParameters.getSignatureAlgorithm();
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java
index 478a5d0fb..74963f6d7 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/HTTPRedirectDeflateEncoder.java
@@ -49,7 +49,6 @@ import org.slf4j.Logger;
 import com.google.common.collect.Lists;
 
 import jakarta.servlet.http.HttpServletResponse;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.EncodingException;
@@ -69,7 +68,7 @@ import net.shibboleth.shared.xml.SerializeSupport;
 public class HTTPRedirectDeflateEncoder extends BaseSAML2MessageEncoder {
     
     /** Params which are disallowed from appearing in the input endpoint URL. */
-    @Nonnull @NonnullElements private static final Set<String> DISALLOWED_ENDPOINT_QUERY_PARAMS = 
+    @Nonnull private static final Set<String> DISALLOWED_ENDPOINT_QUERY_PARAMS = 
             CollectionSupport.setOf("SAMLEncoding", "SAMLRequest", "SAMLResponse", "RelayState", "SigAlg", "Signature");
 
     /** Class logger. */
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/package-info.java
index b062ceb95..0b49a6d57 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/encoding/impl/package-info.java
@@ -16,7 +16,9 @@
  */
 
 /**
- * SAML 1.x message encoders. 
+ * SAML 2.0 message encoders. 
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.binding.encoding.impl;
 
-package org.opensaml.saml.saml2.binding.encoding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/ExtractProxiedRequestersHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/ExtractProxiedRequestersHandler.java
index dea74f8a8..465affe5a 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/ExtractProxiedRequestersHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/ExtractProxiedRequestersHandler.java
@@ -78,7 +78,7 @@ public class ExtractProxiedRequestersHandler extends AbstractMessageHandler {
             }
             
             for (final RequesterID id : scoping.getRequesterIDs()) {
-                if (id != null && id.getURI() != null) {
+                if (id.getURI() != null) {
                     proxyContext.getRequesters().add(id.getURI());
                 }
             }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/package-info.java
index 6cec0eb3f..f9b8ae5d1 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/impl/package-info.java
@@ -16,7 +16,9 @@
  */
 
 /**
- * General message handlers for SAML 2.
+ * General message handlers for SAML 2.0.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.binding.impl;
 
-package org.opensaml.saml.saml2.binding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java
index 3c1853fe1..1f3f1dcd2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsExtensionsHandler.java
@@ -59,7 +59,6 @@ public class ExtractChannelBindingsExtensionsHandler extends AbstractMessageHand
         return true;
     }
     
-// Checkstyle: ReturnCount OFF
     /** {@inheritDoc} */
     @Override
     protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
@@ -85,13 +84,12 @@ public class ExtractChannelBindingsExtensionsHandler extends AbstractMessageHand
         final Collection<ChannelBindings> channelBindings =
                 messageContext.ensureSubcontext(ChannelBindingsContext.class).getChannelBindings();
         for (final XMLObject cb : bindings) {
-            if (cb instanceof ChannelBindings) {
-                channelBindings.add((ChannelBindings) cb);
+            if (cb instanceof ChannelBindings downcast) {
+                channelBindings.add(downcast);
             }
         }
         
         log.debug("{} {} ChannelBindings extension(s) found", getLogPrefix(), channelBindings.size());
     }
-// Checkstyle: ReturnCount ON
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsHeadersHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsHeadersHandler.java
index 11ec498f2..4be81c042 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsHeadersHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/ExtractChannelBindingsHeadersHandler.java
@@ -53,7 +53,6 @@ public class ExtractChannelBindingsHeadersHandler extends AbstractMessageHandler
     
     /** Constructor. */
     public ExtractChannelBindingsHeadersHandler() {
-        super();
         nextDestination = true;
     }
     
@@ -88,9 +87,9 @@ public class ExtractChannelBindingsHeadersHandler extends AbstractMessageHandler
         final List<XMLObject> headers = SOAPMessagingSupport.getHeaderBlock(messageContext,
                 ChannelBindings.DEFAULT_ELEMENT_NAME, null, finalDestination);
         for (final XMLObject header : headers) {
-            if (header instanceof ChannelBindings) {
+            if (header instanceof ChannelBindings cb) {
                 if (null == ((ActorBearing) header).getSOAP11Actor() || nextDestination) {
-                    channelBindings.add((ChannelBindings) header);
+                    channelBindings.add(cb);
                 }
             }
         }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandler.java
index 9656296b5..01fd824d2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPPostSimpleSignSecurityHandler.java
@@ -42,7 +42,8 @@ import com.google.common.base.Strings;
 
 import jakarta.servlet.http.HttpServletRequest;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -171,8 +172,9 @@ public class SAML2HTTPPostSimpleSignSecurityHandler extends BaseSAMLSimpleSignat
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements protected List<Credential> getRequestCredentials(
-            @Nonnull final MessageContext samlContext) throws MessageHandlerException {
+    @Nonnull @Unmodifiable @NotLive protected List<Credential> getRequestCredentials(
+            @Nonnull final MessageContext samlContext)
+            throws MessageHandlerException {
 
         final String kiBase64 = getHttpServletRequest().getParameter("KeyInfo");
         if (Strings.isNullOrEmpty(kiBase64)) {
@@ -220,4 +222,4 @@ public class SAML2HTTPPostSimpleSignSecurityHandler extends BaseSAMLSimpleSignat
         return credentials;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandler.java
index 819112ff4..283a6abaf 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/SAML2HTTPRedirectDeflateSignatureSecurityHandler.java
@@ -80,7 +80,7 @@ public class SAML2HTTPRedirectDeflateSignatureSecurityHandler extends BaseSAMLSi
      * @return a string representation of the signed content
      * @throws MessageHandlerException thrown if there is an error during request processing
      */
-    @Nonnull @NotEmpty private String buildSignedContentString(final String queryString)
+    @Nonnull @NotEmpty private String buildSignedContentString(@Nullable final String queryString)
             throws MessageHandlerException {
         final StringBuilder builder = new StringBuilder();
 
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/package-info.java
index e1ea72d8d..e88791d61 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/binding/security/impl/package-info.java
@@ -16,7 +16,9 @@
  */
 
 /**
- * Security-related message handlers for SAML 2.
+ * Security-related message handlers for SAML 2.0.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.binding.security.impl;
 
-package org.opensaml.saml.saml2.binding.security.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/core/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/core/impl/package-info.java
index 4046804fe..76782b8c2 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/core/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/core/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of SAML 2.0 core specification types and elements.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.core.impl;
 
-package org.opensaml.saml.saml2.core.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/ecp/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/ecp/impl/package-info.java
index dd3fa80f2..937995c6f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/ecp/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/ecp/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of SAML 2.0 ECP types and elements.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.ecp.impl;
 
-package org.opensaml.saml.saml2.ecp.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/package-info.java
index 1364b1485..e3075cc6f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/metadata/impl/package-info.java
@@ -17,14 +17,9 @@
 
 /**
  * 
- * Concrete implementations of the metadata APIs.
- * 
- * Information on using this library can be found in the 
- * <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OSTwoUserManual">User's Manual</a>
- * and information on extending its functionality can be found in the 
- * <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OSTwoDeveloperManual">
- *  Developer's Manual.</a> see <a href="https://wiki.shibboleth.net/confluence/display/SHIB/OpenSAML">
- *  OpenSAML</a> Wiki. 
+ * Concrete implementations of SAML 2.0 metadata objects.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.metadata.impl;
 
-package org.opensaml.saml.saml2.metadata.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddNameIDToSubjects.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddNameIDToSubjects.java
index cba0e3d3c..002a84dfd 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddNameIDToSubjects.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddNameIDToSubjects.java
@@ -54,6 +54,8 @@ import com.google.common.base.Strings;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -450,7 +452,7 @@ public class AddNameIDToSubjects extends AbstractProfileAction {
 
         /** {@inheritDoc} */
         @Override
-        @Nullable public List<Assertion> apply(@Nullable final ProfileRequestContext input) {
+        @Nullable @Unmodifiable @NotLive public List<Assertion> apply(@Nullable final ProfileRequestContext input) {
             final MessageContext outboundContext = input != null ? input.getOutboundMessageContext() : null;
             if (outboundContext != null) {
                 final Object outboundMessage = outboundContext.getMessage();
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddStatusToResponse.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddStatusToResponse.java
index 0ac7b34aa..42e9e3063 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddStatusToResponse.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/AddStatusToResponse.java
@@ -44,7 +44,6 @@ import org.opensaml.saml.saml2.core.StatusResponseType;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -82,7 +81,7 @@ public class AddStatusToResponse extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,String> statusMessageLookupStrategy;
     
     /** One or more status codes to insert. */
-    @Nonnull @NonnullElements private List<String> defaultStatusCodes;
+    @Nonnull private List<String> defaultStatusCodes;
     
     /** A default status message to include. */
     @Nullable private String statusMessage;
@@ -244,7 +243,7 @@ public class AddStatusToResponse extends AbstractProfileAction {
      * @param status    the element to attach to
      * @param codes     the status codes to use
      */
-    private void buildStatusCode(@Nonnull final Status status, @Nonnull @NonnullElements final List<String> codes) {
+    private void buildStatusCode(@Nonnull final Status status, @Nonnull final List<String> codes) {
         final SAMLObjectBuilder<StatusCode> statusCodeBuilder = (SAMLObjectBuilder<StatusCode>)
                 XMLObjectProviderRegistrySupport.getBuilderFactory().<StatusCode>ensureBuilder(
                         StatusCode.TYPE_NAME);
@@ -286,7 +285,7 @@ public class AddStatusToResponse extends AbstractProfileAction {
     public static class StatusCodeMappingFunction implements Function<ProfileRequestContext,List<String>> {
 
         /** Code mappings. */
-        @Nonnull @NonnullElements private Map<String,List<String>> codeMappings;
+        @Nonnull private Map<String,List<String>> codeMappings;
         
         /** Strategy function for access to {@link EventContext} to check. */
         @Nonnull private Function<ProfileRequestContext,EventContext> eventContextLookupStrategy;
@@ -296,14 +295,14 @@ public class AddStatusToResponse extends AbstractProfileAction {
          *
          * @param mappings the status code mappings to use
          */
-        public StatusCodeMappingFunction(@Nonnull @NonnullElements final Map<String,List<String>> mappings) {
+        public StatusCodeMappingFunction(@Nonnull final Map<String,List<String>> mappings) {
             Constraint.isNotNull(mappings, "Status code mappings cannot be null");
             
             codeMappings = new HashMap<>(mappings.size());
             for (final Map.Entry<String,List<String>> entry : mappings.entrySet()) {
                 final String event = StringSupport.trimOrNull(entry.getKey());
                 if (event != null && entry.getValue() != null) {
-                    codeMappings.put(event, List.copyOf(entry.getValue()));
+                    codeMappings.put(event, CollectionSupport.copyToList(entry.getValue()));
                 }
             }
             
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
index bbf5dfa00..7e02069ee 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/DefaultAssertionValidationContextBuilder.java
@@ -71,6 +71,8 @@ import org.opensaml.xmlsec.signature.support.SignatureValidationParametersCriter
 import org.slf4j.Logger;
 
 import jakarta.servlet.http.HttpServletRequest;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.collection.Pair;
@@ -977,7 +979,8 @@ public class DefaultAssertionValidationContextBuilder
      * 
      * @return set of recipient endpoint URI's
      */
-    @Nonnull protected Set<String> getValidRecipients(@Nonnull final AssertionValidationInput input) {
+    @Nonnull @Unmodifiable @NotLive protected Set<String> getValidRecipients(
+            @Nonnull final AssertionValidationInput input) {
         final LazySet<String> validRecipients = new LazySet<>();
         
         try {
@@ -1014,7 +1017,8 @@ public class DefaultAssertionValidationContextBuilder
      * 
      * @return the set of valid addresses
      */
-    @Nonnull protected Set<InetAddress> getValidAddresses(@Nonnull final AssertionValidationInput input) {
+    @Nonnull @Unmodifiable @NotLive protected Set<InetAddress> getValidAddresses(
+            @Nonnull final AssertionValidationInput input) {
         try {
             final LazySet<InetAddress> validAddresses = new LazySet<>();
             InetAddress[] addresses = null;
@@ -1065,7 +1069,8 @@ public class DefaultAssertionValidationContextBuilder
      * 
      * @return set of audience URI's
      */
-    @Nonnull protected Set<String> getValidAudiences(@Nonnull final AssertionValidationInput input) {
+    @Nonnull @Unmodifiable @NotLive protected Set<String> getValidAudiences(
+            @Nonnull final AssertionValidationInput input) {
         final LazySet<String> validAudiences = new LazySet<>();
         
         final String selfEntityID = getSelfEntityID(input);
@@ -1118,7 +1123,7 @@ public class DefaultAssertionValidationContextBuilder
         }
 
         /** {@inheritDoc} */
-        public String apply(@Nullable final ProfileRequestContext prc) {
+        @Nullable public String apply(@Nullable final ProfileRequestContext prc) {
             if (prc == null || prc.getInboundMessageContext() == null) {
                 return null;
             }
@@ -1149,7 +1154,7 @@ public class DefaultAssertionValidationContextBuilder
         }
 
         /** {@inheritDoc} */
-        public Set<String> apply(@Nullable final ProfileRequestContext prc) {
+        @Nullable @Unmodifiable @NotLive public Set<String> apply(@Nullable final ProfileRequestContext prc) {
             if (prc == null || prc.getInboundMessageContext() == null) {
                 return null;
             }
@@ -1164,4 +1169,4 @@ public class DefaultAssertionValidationContextBuilder
         
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertions.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertions.java
index 538246b2b..f6a8038af 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertions.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/ValidateAssertions.java
@@ -40,6 +40,8 @@ import org.slf4j.Logger;
 
 import jakarta.servlet.http.HttpServletRequest;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -309,11 +311,12 @@ public class ValidateAssertions extends AbstractProfileAction {
     public class DefaultAssertionResolver implements Function<ProfileRequestContext, List<Assertion>> {
 
         /** {@inheritDoc} */
-        public List<Assertion> apply(@Nullable final ProfileRequestContext profileContext) {
+        @Nullable @Unmodifiable @NotLive public List<Assertion> apply(
+                @Nullable final ProfileRequestContext profileContext) {
             final SAMLObject message = profileContext != null
                     ? (SAMLObject) profileContext.ensureInboundMessageContext().getMessage() : null;
-            if (message instanceof Response) {
-                return ((Response) message).getAssertions();
+            if (message instanceof Response r) {
+                return r.getAssertions();
             }
             
             return null;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/package-info.java
index bcb371e24..f4a1536dc 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/profile/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of SAML 2.0 profile behavior.
  */
+ at NonnullElements
+package org.opensaml.saml.saml2.profile.impl;
 
-package org.opensaml.saml.saml2.profile.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
index 85939929d..6127b3c32 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/DefaultSAML20AssertionValidationContextBuilder.java
@@ -30,6 +30,8 @@ import java.util.function.Function;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazySet;
 import net.shibboleth.shared.collection.Pair;
@@ -147,7 +149,7 @@ public class DefaultSAML20AssertionValidationContextBuilder
      * 
      * @return the static parameters map
      */
-    @Nonnull protected Map<String,Object> buildStaticParameters(
+    @Nonnull @Unmodifiable @NotLive protected Map<String,Object> buildStaticParameters(
             @Nonnull final SAML20AssertionTokenValidationInput input) {
         
         final HashMap<String, Object> staticParams = new HashMap<>();
@@ -324,7 +326,8 @@ public class DefaultSAML20AssertionValidationContextBuilder
      * 
      * @return the set of valid addresses
      */
-    @Nonnull protected Set<InetAddress> getValidAddresses(@Nonnull final SAML20AssertionTokenValidationInput input) {
+    @Nonnull @Unmodifiable @NotLive protected Set<InetAddress> getValidAddresses(
+            @Nonnull final SAML20AssertionTokenValidationInput input) {
         try {
             final LazySet<InetAddress> validAddresses = new LazySet<>();
             InetAddress[] addresses = null;
@@ -371,7 +374,8 @@ public class DefaultSAML20AssertionValidationContextBuilder
      * 
      * @return set of audience URI's
      */
-    @Nonnull protected Set<String> getValidAudiences(@Nonnull final SAML20AssertionTokenValidationInput input) {
+    @Nonnull @Unmodifiable @NotLive protected Set<String> getValidAudiences(
+            @Nonnull final SAML20AssertionTokenValidationInput input) {
         final LazySet<String> validAudiences = new LazySet<>();
         
         final SAMLSelfEntityContext selfContext = input.getMessageContext().getSubcontext(SAMLSelfEntityContext.class);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/WSSecuritySAML20AssertionTokenSecurityHandler.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/WSSecuritySAML20AssertionTokenSecurityHandler.java
index d101c06ca..e84082b62 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/WSSecuritySAML20AssertionTokenSecurityHandler.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/WSSecuritySAML20AssertionTokenSecurityHandler.java
@@ -45,6 +45,8 @@ import org.slf4j.Logger;
 
 import jakarta.servlet.http.HttpServletRequest;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyList;
 import net.shibboleth.shared.collection.Pair;
@@ -373,7 +375,8 @@ public class WSSecuritySAML20AssertionTokenSecurityHandler extends AbstractMessa
      * 
      * @return the list of resolved Assertions, or an empty list
      */
-    @Nonnull protected List<Assertion> resolveAssertions(@Nonnull final MessageContext messageContext) {
+    @Nonnull @Unmodifiable @NotLive protected List<Assertion> resolveAssertions(
+            @Nonnull final MessageContext messageContext) {
         final List<XMLObject> securityHeaders = SOAPMessagingSupport.getInboundHeaderBlock(messageContext,
                 Security.ELEMENT_NAME);
         if (securityHeaders == null || securityHeaders.isEmpty()) {
@@ -387,7 +390,7 @@ public class WSSecuritySAML20AssertionTokenSecurityHandler extends AbstractMessa
         for (final XMLObject header : securityHeaders) {
             final Security securityHeader = (Security) header;
             final List<XMLObject> xmlObjects = securityHeader.getUnknownXMLObjects(Assertion.DEFAULT_ELEMENT_NAME);
-            if (xmlObjects != null && !xmlObjects.isEmpty()) {
+            if (!xmlObjects.isEmpty()) {
                 for (final XMLObject xmlObject : xmlObjects) {
                     assertions.add((Assertion) xmlObject);
                 }
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/package-info.java
index 9bea2b9e5..4cc88a25f 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/saml2/wssecurity/messaging/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation of SAML WS-Security message handler functionality.
  */
-package org.opensaml.saml.saml2.wssecurity.messaging.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.saml.saml2.wssecurity.messaging.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java
index 236d831a4..4a3674e9d 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/MetadataCredentialResolver.java
@@ -47,6 +47,8 @@ import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.LockableClassToInstanceMultiMap;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.component.InitializableComponent;
@@ -276,8 +278,9 @@ public class MetadataCredentialResolver extends AbstractCriteriaFilteringCredent
      * @throws ResolverException thrown if the key, certificate, or CRL information is represented in an unsupported
      *             format
      */
-    @Nonnull protected Collection<Credential> resolveFromRoleDescriptor(@Nullable final CriteriaSet criteriaSet, 
-            @Nonnull final RoleDescriptor roleDescriptor, @Nonnull final UsageType usage) throws ResolverException {
+    @Nonnull @Unmodifiable @NotLive protected Collection<Credential> resolveFromRoleDescriptor(
+            @Nullable final CriteriaSet criteriaSet, @Nonnull final RoleDescriptor roleDescriptor,
+            @Nonnull final UsageType usage) throws ResolverException {
         
         // EntityID here is optional. Not used in resolution, just info stored on the resolved credential(s).
         String entityID = null;
@@ -308,9 +311,10 @@ public class MetadataCredentialResolver extends AbstractCriteriaFilteringCredent
      * @throws ResolverException thrown if the key, certificate, or CRL information is represented in an unsupported
      *             format
      */
-    @Nonnull protected Collection<Credential> resolveFromMetadata(@Nullable final CriteriaSet criteriaSet, 
-            @Nonnull @NotEmpty final String entityID, @Nonnull final QName role, 
-            @Nullable final String protocol, @Nonnull final UsageType usage) throws ResolverException {
+    @Nonnull @Unmodifiable @NotLive protected Collection<Credential> resolveFromMetadata(
+            @Nullable final CriteriaSet criteriaSet, @Nonnull @NotEmpty final String entityID,
+            @Nonnull final QName role, @Nullable final String protocol, @Nonnull final UsageType usage)
+                    throws ResolverException {
 
         log.debug("Resolving credentials from metadata using entityID: {}, role: {}, protocol: {}, usage: {}", 
                 entityID, role, protocol, usage);
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
index a0682d3b9..9beff93eb 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataEncryptionParametersResolver.java
@@ -29,6 +29,7 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
@@ -393,7 +394,7 @@ public class SAMLMetadataEncryptionParametersResolver extends BasicEncryptionPar
         return Stream.of(lists)
                 .filter(Objects::nonNull)
                 .flatMap(x -> x.stream())
-                .collect(Collectors.toList());
+                .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
     }
     
     /**
@@ -522,7 +523,7 @@ public class SAMLMetadataEncryptionParametersResolver extends BasicEncryptionPar
      * @param metadataCredContext the credential context extracted from metadata
      * @return the selected algorithm URI and the associated encryption method from metadata, if any. 
      */
-    @Nonnull protected Pair<String, EncryptionMethod> resolveKeyTransportAlgorithm(
+    @Nonnull @NullableElements protected Pair<String, EncryptionMethod> resolveKeyTransportAlgorithm(
             @Nonnull final Credential keyTransportCredential, 
             @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate,
             @Nullable final String dataEncryptionAlgorithm,
@@ -585,7 +586,7 @@ public class SAMLMetadataEncryptionParametersResolver extends BasicEncryptionPar
      * @param metadataCredContext the credential context extracted from metadata
      * @return the selected algorithm URI and the associated encryption method from metadata, if any
      */
-    @Nonnull protected Pair<String, EncryptionMethod> resolveDataEncryptionAlgorithm(
+    @Nonnull @NullableElements protected Pair<String, EncryptionMethod> resolveDataEncryptionAlgorithm(
             @Nonnull final CriteriaSet criteria, 
             @Nonnull final Predicate<String> includeExcludePredicate,
             @Nullable final SAMLMDCredentialContext metadataCredContext) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java
index 868b4787c..a82f06887 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLMetadataSignatureSigningParametersResolver.java
@@ -26,6 +26,8 @@ import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -214,8 +216,8 @@ public class SAMLMetadataSignatureSigningParametersResolver extends BasicSignatu
      * @param extensionName the extension name for which to search
      * @return the list of extension XMLObjects found, or null
      */
-    @Nullable protected List<XMLObject> getExtensions(@Nonnull final RoleDescriptor roleDescriptor, 
-            @Nonnull final QName extensionName) {
+    @Nullable @Unmodifiable @NotLive protected List<XMLObject> getExtensions(
+            @Nonnull final RoleDescriptor roleDescriptor, @Nonnull final QName extensionName) {
         List<XMLObject> result;
         Extensions extensions = roleDescriptor.getExtensions();
         if (extensions != null) {
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidator.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidator.java
index 503728813..c85a01156 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidator.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/SAMLSignatureProfileValidator.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.security.impl;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.apache.xml.security.exceptions.XMLSecurityException;
 import org.apache.xml.security.signature.Reference;
@@ -31,13 +32,13 @@ import org.opensaml.xmlsec.signature.impl.SignatureImpl;
 import org.opensaml.xmlsec.signature.support.SignatureException;
 import org.opensaml.xmlsec.signature.support.SignaturePrevalidator;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
 import com.google.common.base.Strings;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A validator for instances of {@link Signature}, which validates that the signature meets security-related
@@ -46,7 +47,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(SAMLSignatureProfileValidator.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(SAMLSignatureProfileValidator.class);
 
     /** {@inheritDoc} */
     @Override
@@ -69,13 +70,13 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
      * @param sigImpl the signature implementation object to validate
      * @throws SignatureException thrown if the signature is not valid with respect to the profile
      */
-    protected void validateSignatureImpl(final SignatureImpl sigImpl) throws SignatureException {
+    protected void validateSignatureImpl(@Nonnull final SignatureImpl sigImpl) throws SignatureException {
 
-        if (sigImpl.getXMLSignature() == null) {
+        final XMLSignature apacheSig = sigImpl.getXMLSignature();
+        if (apacheSig == null) {
             log.error("SignatureImpl did not contain the an Apache XMLSignature child");
             throw new SignatureException("Apache XMLSignature does not exist on SignatureImpl");
         }
-        final XMLSignature apacheSig = sigImpl.getXMLSignature();
 
         if (!(sigImpl.getParent() instanceof SignableSAMLObject)) {
             log.error("Signature is not an immedidate child of a SignableSAMLObject");
@@ -85,6 +86,7 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
 
         final Reference ref = validateReference(apacheSig);
 
+        assert signableObject != null;
         validateReferenceURI(ref.getURI(), signableObject);
 
         validateTransforms(ref);
@@ -102,7 +104,7 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
      * @throws SignatureException thrown if the Signature does not contain exactly 1 Reference, or if there is an error
      *             obtaining the Reference instance
      */
-    protected Reference validateReference(final XMLSignature apacheSig) throws SignatureException {
+    @Nonnull protected Reference validateReference(@Nonnull final XMLSignature apacheSig) throws SignatureException {
         final int numReferences = apacheSig.getSignedInfo().getLength();
         if (numReferences != 1) {
             log.error("Signature SignedInfo had invalid number of References: " + numReferences);
@@ -134,7 +136,7 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
      * @param signableObject the SignableSAMLObject whose signature is being validated
      * @throws SignatureException  if the URI is invalid or doesn't resolve to the expected DOM node
      */
-    protected void validateReferenceURI(final String uri, final SignableSAMLObject signableObject)
+    protected void validateReferenceURI(final String uri, @Nonnull final SignableSAMLObject signableObject)
             throws SignatureException {
         final String id = signableObject.getSignatureReferenceID();
         validateReferenceURI(uri, id);
@@ -175,12 +177,13 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
      * @param id the Signature parents ID attribute value
      * @throws SignatureException thrown if the URI or ID attribute values are invalid
      */
-    protected void validateReferenceURI(final String uri, final String id) throws SignatureException {
-        if (!Strings.isNullOrEmpty(uri)) {
+    protected void validateReferenceURI(@Nullable final String uri, @Nullable final String id)
+            throws SignatureException {
+        if (uri != null && !uri.isEmpty()) {
             if (!uri.startsWith("#")) {
                 log.error("Signature Reference URI was not a document fragment reference: " + uri);
                 throw new SignatureException("Signature Reference URI was not a document fragment reference");
-            } else if (Strings.isNullOrEmpty(id)) {
+            } else if (id == null || id.isEmpty()) {
                 log.error("SignableSAMLObject did not contain an ID attribute");
                 throw new SignatureException("SignableSAMLObject did not contain an ID attribute");
             } else if (uri.length() < 2 || !id.equals(uri.substring(1))) {
@@ -200,7 +203,7 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
      * @param reference the Signature reference containing the transforms to evaluate
      * @throws SignatureException thrown if the set of transforms is invalid
      */
-    protected void validateTransforms(final Reference reference) throws SignatureException {
+    protected void validateTransforms(@Nonnull final Reference reference) throws SignatureException {
         Transforms transforms = null;
         try {
             transforms = reference.getTransforms();
@@ -254,10 +257,11 @@ public class SAMLSignatureProfileValidator implements SignaturePrevalidator {
      * @param apacheSig the Apache XML Signature instance
      * @throws SignatureException if the signature contains ds:Object children
      */
-    protected void validateObjectChildren(final XMLSignature apacheSig) throws SignatureException {
+    protected void validateObjectChildren(@Nonnull final XMLSignature apacheSig) throws SignatureException {
         if (apacheSig.getObjectLength() > 0) {
             log.error("Signature contained {} ds:Object child element(s)", apacheSig.getObjectLength());
             throw new SignatureException("Signature contained illegal ds:Object children");
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/package-info.java b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/package-info.java
index d551ff4ac..e689802ec 100644
--- a/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/package-info.java
+++ b/opensaml-saml-impl/src/main/java/org/opensaml/saml/security/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes related to verifying various credentials within a SAML system.
  */
+ at NonnullElements
+package org.opensaml.saml.security.impl;
 
-package org.opensaml.saml.security.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list