[java-identity-provider] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Thu Jun 15 21:11:44 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=ff95c9b8b4ac2c93bf6a0d043ff584ecbccdd73a

The following commit(s) were added to refs/heads/main by this push:
     new ff95c9b8b IDP-2083 - Treat NonnullElements as the default for collections
ff95c9b8b is described below

commit ff95c9b8b4ac2c93bf6a0d043ff584ecbccdd73a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Jun 15 17:11:40 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Reviewed idp-admin/idp-authn.
---
 .../admin/BasicAdministrativeFlowDescriptor.java   | 30 ++++++++---------
 .../net/shibboleth/idp/admin/package-info.java     |  4 ++-
 .../java/net/shibboleth/idp/log/package-info.java  |  5 ++-
 .../java/net/shibboleth/idp/module/IdPModule.java  |  7 ++--
 .../idp/module/PropertyDrivenIdPModule.java        |  9 ++---
 .../java/net/shibboleth/idp/plugin/IdPPlugin.java  |  3 +-
 .../net/shibboleth/idp/plugin/package-info.java    |  5 ++-
 .../impl/AdministrativeFlowDescriptorManager.java  |  3 +-
 .../idp/admin/impl/DoStorageOperation.java         | 33 +++++++++++--------
 .../net/shibboleth/idp/admin/impl/IdPInfo.java     | 14 ++++----
 ...InitializeAdministrativeProfileContextTree.java |  7 ++--
 .../shibboleth/idp/admin/impl/OutputMetrics.java   |  7 ++--
 .../idp/admin/impl/ReportUpdateStatus.java         |  6 ++--
 .../idp/admin/impl/UnlockDataSealers.java          |  7 ++--
 .../idp/admin/impl/UnlockPrivateKeys.java          |  9 +++--
 .../shibboleth/idp/admin/impl/package-info.java    |  4 ++-
 .../shibboleth/idp/module/impl/package-info.java   |  4 ++-
 .../idp/plugin/impl/FirstPartyIdPPlugin.java       |  3 +-
 .../shibboleth/idp/plugin/impl/package-info.java   |  4 ++-
 .../idp/authn/AbstractCredentialValidator.java     |  5 ++-
 .../idp/authn/AbstractExtractionAction.java        |  4 +--
 .../AbstractSubjectCanonicalizationAction.java     |  5 ++-
 ...bstractUsernamePasswordCredentialValidator.java |  5 ++-
 .../idp/authn/AbstractValidationAction.java        | 14 ++++----
 .../idp/authn/AuthenticationFlowDescriptor.java    | 18 +++++-----
 .../shibboleth/idp/authn/AuthenticationResult.java |  7 ++--
 .../authn/MultiFactorAuthenticationTransition.java |  7 ++--
 .../config/AuthenticationProfileConfiguration.java |  7 ++--
 .../AuthenticationFlowsLookupFunction.java         |  1 -
 .../PostAuthenticationFlowsLookupFunction.java     |  1 -
 .../idp/authn/config/navigate/package-info.java    |  4 ++-
 .../shibboleth/idp/authn/config/package-info.java  |  4 ++-
 .../idp/authn/context/AuthenticationContext.java   | 33 +++++++++----------
 .../authn/context/AuthenticationErrorContext.java  |  9 +++--
 .../context/AuthenticationWarningContext.java      |  5 ++-
 .../idp/authn/context/CertificateContext.java      |  7 ++--
 .../context/ExternalAuthenticationContext.java     |  5 ++-
 .../idp/authn/context/KerberosTicketContext.java   |  2 +-
 .../context/MultiFactorAuthenticationContext.java  |  9 +++--
 .../authn/context/PreferredPrincipalContext.java   | 10 +++---
 .../authn/context/RequestedPrincipalContext.java   | 10 +++---
 .../context/SubjectCanonicalizationContext.java    |  9 +++--
 .../idp/authn/context/SubjectContext.java          |  7 ++--
 ...tedPrincipalContextPrincipalLookupFunction.java |  4 ++-
 .../idp/authn/context/navigate/package-info.java   |  4 ++-
 .../shibboleth/idp/authn/context/package-info.java |  5 ++-
 .../idp/authn/duo/BasicDuoIntegration.java         |  9 +++--
 .../net/shibboleth/idp/authn/duo/DuoPrincipal.java |  4 +--
 .../duo/context/DuoAuthenticationContext.java      |  3 +-
 .../idp/authn/duo/context/package-info.java        |  5 ++-
 .../net/shibboleth/idp/authn/duo/package-info.java |  5 ++-
 .../net/shibboleth/idp/authn/package-info.java     |  4 ++-
 .../principal/AuthenticationResultPrincipal.java   |  1 -
 .../idp/authn/principal/CloneablePrincipal.java    |  4 ++-
 .../principal/GenericPrincipalSerializer.java      |  7 ++--
 .../idp/authn/principal/HOTPPrincipal.java         |  4 +--
 .../idp/authn/principal/IdPAttributePrincipal.java |  1 -
 .../idp/authn/principal/PasswordPrincipal.java     |  4 +--
 .../PrincipalEvalPredicateFactoryRegistry.java     | 10 +++---
 .../authn/principal/PrincipalServiceManager.java   |  9 +++--
 .../principal/PrincipalSupportingComponent.java    |  4 +--
 .../principal/ProxyAuthenticationPrincipal.java    | 11 +++----
 .../idp/authn/principal/TOTPPrincipal.java         |  4 +--
 .../idp/authn/principal/UsernamePrincipal.java     |  4 +--
 .../idp/authn/principal/package-info.java          |  4 ++-
 .../idp/authn/audit/impl/package-info.java         |  4 ++-
 .../impl/IdPAttributePrincipalValuesFunction.java  |  7 ++--
 .../SubjectDerivedAttributeValuesFunction.java     |  4 ++-
 .../impl/SubjectDerivedAttributesFunction.java     |  4 ++-
 .../context/impl/SubjectScriptContextExtender.java |  8 ++---
 .../idp/authn/context/impl/package-info.java       |  4 ++-
 .../idp/authn/duo/impl/ValidateDuoAuthAPI.java     |  8 +++--
 .../idp/authn/duo/impl/ValidateDuoWebResponse.java |  5 ++-
 .../idp/authn/duo/impl/package-info.java           |  4 ++-
 .../impl/AbstractAuditingValidationAction.java     |  5 +--
 .../AttributeSourcedSubjectCanonicalization.java   | 10 +++---
 .../impl/AuthenticationFlowDescriptorManager.java  |  4 +--
 .../DefaultPrincipalDeterminationStrategy.java     |  2 +-
 .../idp/authn/impl/DoLockoutManagerOperation.java  |  4 ++-
 .../impl/ExtractKerberosTicketFromWSSToken.java    | 38 ----------------------
 .../idp/authn/impl/ExtractRemoteUser.java          |  9 +++--
 .../ExtractUsernamePasswordFromFormRequest.java    |  3 +-
 .../impl/ExtractUsernamePasswordFromWSSToken.java  |  1 -
 .../idp/authn/impl/FinalizeAuthentication.java     |  3 +-
 .../authn/impl/HTPasswdCredentialValidator.java    |  9 ++---
 .../idp/authn/impl/JAASCredentialValidator.java    |  7 ++--
 .../authn/impl/PopulateAuthenticationContext.java  |  5 ++-
 .../PopulateMultiFactorAuthenticationContext.java  |  5 +--
 .../PopulateSubjectCanonicalizationContext.java    |  6 ++--
 .../impl/PreserveAuthenticationFlowState.java      |  8 ++---
 .../RelyingPartyMapJAASLoginConfigStrategy.java    |  6 ++--
 .../idp/authn/impl/RemoteUserAuthServlet.java      |  9 +++--
 .../idp/authn/impl/SelectAuthenticationFlow.java   |  3 +-
 .../authn/impl/SimpleSubjectCanonicalization.java  |  5 +--
 .../impl/StorageBackedAccountLockoutManager.java   |  6 ++--
 .../impl/TransitionMultiFactorAuthentication.java  |  2 +-
 .../idp/authn/impl/ValidateCredentials.java        | 15 +++++----
 .../authn/impl/ValidateExternalAuthentication.java |  5 ++-
 .../idp/authn/impl/ValidateFunctionResult.java     |  7 ++--
 .../idp/authn/impl/ValidateRemoteUser.java         |  9 +++--
 .../idp/authn/impl/ValidateUserAgentAddress.java   | 17 +++++-----
 .../authn/impl/X500SubjectCanonicalization.java    | 11 +++----
 .../shibboleth/idp/authn/impl/X509AuthServlet.java |  2 +-
 .../impl/X509CertificateCredentialValidator.java   |  2 +-
 .../shibboleth/idp/authn/impl/X509ProxyFilter.java |  5 ++-
 .../authn/impl/X509ResourceCredentialConfig.java   |  5 +--
 .../shibboleth/idp/authn/impl/package-info.java    |  5 ++-
 .../impl/InexactPrincipalEvalPredicateFactory.java |  7 ++--
 .../principal/impl/X500PrincipalSerializer.java    |  6 ++--
 .../idp/authn/principal/impl/package-info.java     |  5 ++-
 .../impl/DiscoveryProfileRequestFunction.java      |  4 +--
 .../idp/authn/proxy/impl/package-info.java         |  4 ++-
 .../impl/AttributeRevocationCondition.java         |  3 +-
 .../impl/DoRevocationCacheOperation.java           |  2 +-
 .../revocation/impl/RevocationCacheCondition.java  |  5 ++-
 .../idp/authn/revocation/impl/package-info.java    |  4 ++-
 .../idp/authn/spnego/impl/KerberosSettings.java    |  7 ++--
 .../idp/authn/spnego/impl/package-info.java        |  5 ++-
 .../principal/AuthenticationMethodPrincipal.java   |  4 +--
 .../principal/AuthnContextClassRefPrincipal.java   |  4 +--
 .../authn/principal/AuthnContextDeclPrincipal.java |  4 +--
 .../principal/AuthnContextDeclRefPrincipal.java    |  4 +--
 .../idp/saml/authn/principal/NameIDPrincipal.java  |  7 ++--
 .../authn/principal/NameIdentifierPrincipal.java   |  7 ++--
 124 files changed, 399 insertions(+), 426 deletions(-)

diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/admin/BasicAdministrativeFlowDescriptor.java b/idp-admin-api/src/main/java/net/shibboleth/idp/admin/BasicAdministrativeFlowDescriptor.java
index 5f173c2e7..e9429d098 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/admin/BasicAdministrativeFlowDescriptor.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/admin/BasicAdministrativeFlowDescriptor.java
@@ -45,7 +45,6 @@ import net.shibboleth.idp.authn.principal.PrincipalServiceManager;
 import net.shibboleth.idp.profile.config.AbstractInterceptorAwareProfileConfiguration;
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Positive;
@@ -223,7 +222,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      *  
      * @param displayNames utility class collection of language-annotated strings
      */
-    public void setDisplayNames(@Nonnull @NonnullElements final Collection<LangBearingString> displayNames) {
+    public void setDisplayNames(@Nonnull final Collection<LangBearingString> displayNames) {
         uiInfo.getDisplayNames().clear();
         for (final LangBearingString s : displayNames) {
             final DisplayName displayName =
@@ -240,7 +239,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      *  
      * @param descriptions utility class collection of language-annotated strings
      */
-    public void setDescriptions(@Nonnull @NonnullElements final Collection<LangBearingString> descriptions) {
+    public void setDescriptions(@Nonnull final Collection<LangBearingString> descriptions) {
         uiInfo.getDescriptions().clear();
         for (final LangBearingString s : descriptions) {
             final Description desc =
@@ -258,7 +257,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      * 
      * @param logos utility class collection of logo metadata
      */
-    public void setLogos(@Nonnull @NonnullElements final Collection<Logo> logos) {
+    public void setLogos(@Nonnull final Collection<Logo> logos) {
         uiInfo.getLogos().clear();
         for (final Logo src : logos) {
             final org.opensaml.saml.ext.saml2mdui.Logo logo =
@@ -278,7 +277,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      *  
      * @param urls utility class collection of language-annotated strings
      */
-    public void setInformationURLs(@Nonnull @NonnullElements final Collection<LangBearingString> urls) {
+    public void setInformationURLs(@Nonnull final Collection<LangBearingString> urls) {
         uiInfo.getInformationURLs().clear();
         for (final LangBearingString s : urls) {
             final InformationURL url =
@@ -295,7 +294,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      *  
      * @param urls utility class collection of language-annotated strings
      */
-    public void setPrivacyStatementURLs(@Nonnull @NonnullElements final Collection<LangBearingString> urls) {
+    public void setPrivacyStatementURLs(@Nonnull final Collection<LangBearingString> urls) {
         uiInfo.getPrivacyStatementURLs().clear();
         for (final LangBearingString s : urls) {
             final PrivacyStatementURL url =
@@ -354,13 +353,13 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getInboundInterceptorFlows(
+    @Nonnull @NotLive @Unmodifiable public List<String> getInboundInterceptorFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getOutboundInterceptorFlows(
+    @Nonnull @NotLive @Unmodifiable public List<String> getOutboundInterceptorFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         return CollectionSupport.emptyList();
     }
@@ -372,7 +371,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
+    @Nonnull @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         // Check for string-based representation first, then back off to native objects.
@@ -406,7 +405,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      * 
      * @param methods   default authentication methods to use
      */
-    public void setDefaultAuthenticationMethods(@Nullable @NonnullElements final Collection<Principal> methods) {
+    public void setDefaultAuthenticationMethods(@Nullable final Collection<Principal> methods) {
 
         if (methods != null) {
             defaultAuthenticationMethodsLookupStrategy = FunctionSupport.constant(List.copyOf(methods));
@@ -433,8 +432,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      * 
      * @since 4.2.0
      */
-    public void setDefaultAuthenticationMethodsByString(
-            @Nullable @NonnullElements final Collection<String> methods) {
+    public void setDefaultAuthenticationMethodsByString(@Nullable final Collection<String> methods) {
         if (methods != null) {
             stringBasedPrincipalsLookupStrategy = FunctionSupport.constant(List.copyOf(methods));
         } else {
@@ -456,7 +454,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
         if (flows != null) {
@@ -470,7 +468,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      * 
      * @param flows   flow identifiers to use
      */
-    public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setAuthenticationFlows(@Nullable final Collection<String> flows) {
 
         if (flows != null) {
             authenticationFlowsLookupStrategy =
@@ -491,7 +489,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
         if (flows != null) {
@@ -505,7 +503,7 @@ public class BasicAdministrativeFlowDescriptor extends AbstractInterceptorAwareP
      * 
      * @param flows   flow identifiers to enable
      */
-    public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setPostAuthenticationFlows(@Nullable final Collection<String> flows) {
 
         if (flows != null) {
             postAuthenticationFlowsLookupStrategy =
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/admin/package-info.java b/idp-admin-api/src/main/java/net/shibboleth/idp/admin/package-info.java
index 91c54f936..100e5cdbf 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/admin/package-info.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/admin/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes supporting administrative interface machinery. */
+ at NonnullElements
+package net.shibboleth.idp.admin;
 
-package net.shibboleth.idp.admin;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/log/package-info.java b/idp-admin-api/src/main/java/net/shibboleth/idp/log/package-info.java
index ddbceabb4..5a8e08cdc 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/log/package-info.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/log/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** IdP logging setup and management classes. */
-package net.shibboleth.idp.log;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.log;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/module/IdPModule.java b/idp-admin-api/src/main/java/net/shibboleth/idp/module/IdPModule.java
index 373f01b9a..278304932 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/module/IdPModule.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/module/IdPModule.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface IdPModule extends Module {
 
     /** Extension for preserving user files. */
-    @Nonnull @NotEmpty public static final String IDPSAVE_EXT = ".idpsave";
+    @Nonnull @NotEmpty static final String IDPSAVE_EXT = ".idpsave";
 
     /** Base extension for adding new default files. */
-    @Nonnull @NotEmpty public static final String IDPNEW_EXT_BASE = ".idpnew";
+    @Nonnull @NotEmpty static final String IDPNEW_EXT_BASE = ".idpnew";
 
     /** {@inheritDoc} */
     @Override
@@ -46,4 +46,5 @@ public interface IdPModule extends Module {
     @Nonnull default String getNewExtension() {
         return IDPNEW_EXT_BASE;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java b/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java
index cae6ddd00..328906519 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java
@@ -71,14 +71,15 @@ public class PropertyDrivenIdPModule extends PropertyDrivenModule implements IdP
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull
-    public String getSaveExtension() {
+    @Override
+    @Nonnull public String getSaveExtension() {
         return IdPModule.IDPSAVE_EXT;
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull
-    public String getNewExtension() {
+    @Override
+    @Nonnull public String getNewExtension() {
         return IdPModule.IDPNEW_EXT_BASE;
     }
+
 }
\ No newline at end of file
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/IdPPlugin.java b/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/IdPPlugin.java
index 0bab2a40b..b73d44658 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/IdPPlugin.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/IdPPlugin.java
@@ -26,4 +26,5 @@ import net.shibboleth.profile.plugin.Plugin;
  * @since 4.1.0
  */
 public interface IdPPlugin extends Plugin<IdPModule>{
-}
+    
+}
\ No newline at end of file
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/package-info.java b/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/package-info.java
index 47cbcce07..debd8ce84 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/package-info.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/plugin/package-info.java
@@ -14,8 +14,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 /**
  * A set of APIs of general use in building IdP plugins.
  */
+ at NonnullElements
+package net.shibboleth.idp.plugin;
 
-package net.shibboleth.idp.plugin;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java
index d1cb84d4b..99da04603 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/AdministrativeFlowDescriptorManager.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
 import org.springframework.beans.factory.annotation.Autowired;
 
 import net.shibboleth.idp.admin.AdministrativeFlowDescriptor;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.spring.config.IdentifiedComponentManager;
 
 /**
@@ -41,7 +40,7 @@ public class AdministrativeFlowDescriptorManager extends IdentifiedComponentMana
      */
     @Autowired
     public AdministrativeFlowDescriptorManager(
-            @Nullable @NonnullElements final Collection<AdministrativeFlowDescriptor> freeObjects) {
+            @Nullable final Collection<AdministrativeFlowDescriptor> freeObjects) {
         super(freeObjects);
     }
 
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/DoStorageOperation.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/DoStorageOperation.java
index acce008ee..64bea472e 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/DoStorageOperation.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/DoStorageOperation.java
@@ -201,8 +201,8 @@ public class DoStorageOperation extends AbstractProfileAction {
     @Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         
         try {
-            @Nonnull final HttpServletRequest request = Constraint.isNotNull(getHttpServletRequest(), "No Servlet request present");
-            @Nonnull final HttpServletResponse response = Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
+            final HttpServletRequest request = ensureHttpServletRequest();
+            final HttpServletResponse response = ensureHttpServletResponse();
             
             response.setContentType("application/json");
             response.setHeader("Cache-Control", "must-revalidate,no-cache,no-store");
@@ -252,8 +252,10 @@ public class DoStorageOperation extends AbstractProfileAction {
     private void doRead() throws IOException {
         final StorageRecord<?> record;
         try {
-            @Nonnull final StorageService storageServ = Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
-            @Nonnull final HttpServletResponse response = Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
+            final StorageService storageServ =
+                    Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
+            final HttpServletResponse response =
+                    Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
             record = storageServ.read(getContext(), getKey());
             if (record != null) {
                 response.setStatus(HttpServletResponse.SC_OK);
@@ -289,9 +291,10 @@ public class DoStorageOperation extends AbstractProfileAction {
      * @throws IOException if an error is raised
      */
     private void doCreate() throws IOException {
-        @Nonnull final StorageService storageServ = Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
-        @Nonnull final HttpServletResponse response = Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
-        @Nonnull final HttpServletRequest request = Constraint.isNotNull(getHttpServletRequest(), "No Servlet request present");
+        final StorageService storageServ =
+                Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
+        final HttpServletRequest request = ensureHttpServletRequest();
+        final HttpServletResponse response = ensureHttpServletResponse();
 
         final JsonFactory jsonFactory = new JsonFactory();
         final JsonParser parser = jsonFactory.createParser(request.getInputStream());
@@ -333,9 +336,10 @@ public class DoStorageOperation extends AbstractProfileAction {
      */
     private void doUpdate() throws IOException {
         final JsonFactory jsonFactory = new JsonFactory();
-        @Nonnull final StorageService storageServ = Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
-        @Nonnull final HttpServletResponse response = Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
-        @Nonnull final HttpServletRequest request = Constraint.isNotNull(getHttpServletRequest(), "No Servlet request present");
+        final StorageService storageServ =
+                Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
+        final HttpServletRequest request = ensureHttpServletRequest();
+        final HttpServletResponse response = ensureHttpServletResponse();
 
         final JsonParser parser = jsonFactory.createParser(request .getInputStream());
         
@@ -394,8 +398,9 @@ public class DoStorageOperation extends AbstractProfileAction {
      */
     private void doDelete() throws IOException {
         try {
-            @Nonnull final StorageService storageServ = Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
-            @Nonnull final HttpServletResponse response = Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
+            final StorageService storageServ =
+                    Constraint.isNotNull(storageService, "Null storge service not detected in preExecute");
+            final HttpServletResponse response = ensureHttpServletResponse();
 
             if (storageServ.delete(getContext(), getKey())) {
                 response.setStatus(HttpServletResponse.SC_NO_CONTENT);
@@ -420,7 +425,7 @@ public class DoStorageOperation extends AbstractProfileAction {
     private void sendError(final int status, @Nonnull @NotEmpty final String title,
             @Nonnull @NotEmpty final String detail) throws IOException {
         
-        @Nonnull final HttpServletResponse response = Constraint.isNotNull(getHttpServletResponse(), "No Servlet response present");
+        final HttpServletResponse response = ensureHttpServletResponse();
         response.setContentType("application/json");
         response.setHeader("Cache-Control", "must-revalidate,no-cache,no-store");
         response.setStatus(status);
@@ -435,4 +440,4 @@ public class DoStorageOperation extends AbstractProfileAction {
         objectMapper.writer().withDefaultPrettyPrinter().writeValue(response.getOutputStream(), errors);
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/IdPInfo.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/IdPInfo.java
index f2ba9fb01..c2bd546ba 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/IdPInfo.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/IdPInfo.java
@@ -30,28 +30,30 @@ import net.shibboleth.profile.installablecomponent.InstallableComponentVersion;
 public final class IdPInfo extends InstallableComponentInfo {
 
     /** The "plugin Id" to look up idp versions with. */
-    @Nonnull public static String IDP_PLUGIN_ID = "net.shibboleth.idp";
+    @Nonnull public static final String IDP_PLUGIN_ID = "net.shibboleth.idp";
 
      /**
       * Constructor.
       * @param props The property file to populate from
       */
-     public IdPInfo(@Nonnull Properties props) {
+     public IdPInfo(@Nonnull final Properties props) {
          super(IDP_PLUGIN_ID, props);
      }
 
      /** {@inheritDoc} */
      @Override
-     protected InstallableComponentVersion getMaxVersion(@Nonnull Properties props, @Nonnull String version) {
+     protected InstallableComponentVersion getMaxVersion(@Nonnull final Properties props,
+             @Nonnull final String version) {
          // The maximum version that version "us" can be installed in is "us" (a re-intall).
          return new InstallableComponentVersion(version);
      }
 
      /** {@inheritDoc} */
      @Override
-     @Nullable
-     protected InstallableComponentVersion getMinVersion(@Nonnull Properties props, @Nonnull String version) {
+     @Nullable protected InstallableComponentVersion getMinVersion(@Nonnull final Properties props,
+             final @Nonnull String version) {
          // We can always be on anything from V4.0.0
          return new InstallableComponentVersion(4,0,0);
      }
-}
+
+}
\ No newline at end of file
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java
index dda868b45..68e7c3b48 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/InitializeAdministrativeProfileContextTree.java
@@ -90,7 +90,9 @@ public class InitializeAdministrativeProfileContextTree extends AbstractProfileA
     }
 
     /**
-     * @return Returns the flowDescriptor.
+     * Get the {@link AdministrativeFlowDescriptor} to operate on.
+     * 
+     * @return the flowDescriptor
      */
     @SuppressWarnings("null")
     @Nonnull private AdministrativeFlowDescriptor getFlowDescriptor() {
@@ -152,4 +154,5 @@ public class InitializeAdministrativeProfileContextTree extends AbstractProfileA
             uiCtx.setFallbackLanguages(fallbackLanguages);
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/OutputMetrics.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/OutputMetrics.java
index 01a9e4bdc..fa47e9eba 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/OutputMetrics.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/OutputMetrics.java
@@ -51,7 +51,6 @@ import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.idp.profile.context.SpringRequestContext;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -100,7 +99,7 @@ public class OutputMetrics extends AbstractProfileAction {
     private boolean useDefaultTimeZone;
 
     /** Map of custom metric groups to filters. */
-    @Nonnull @NonnullElements private Map<String,MetricFilter> metricFilterMap;
+    @Nonnull private Map<String,MetricFilter> metricFilterMap;
     
     /** Metric ID to operate on. */
     @NonnullBeforeExec private String metricId;
@@ -166,7 +165,7 @@ public class OutputMetrics extends AbstractProfileAction {
         checkSetterPreconditions();
         
         if (format != null) {
-            DateTimeFormatter formatter = DateTimeFormatter.ofPattern(StringSupport.trimOrNull(format));
+            final DateTimeFormatter formatter = DateTimeFormatter.ofPattern(StringSupport.trimOrNull(format));
             assert formatter!=null;
             dateTimeFormatter = formatter;
         }
@@ -190,7 +189,7 @@ public class OutputMetrics extends AbstractProfileAction {
      * 
      * @param map group to filter map
      */
-    public void setMetricFilterMap(@Nonnull @NonnullElements final Map<String,MetricFilter> map) {
+    public void setMetricFilterMap(@Nonnull final Map<String,MetricFilter> map) {
         checkSetterPreconditions();
         
         Constraint.isNotNull(map, "MetricFilter map cannot be null");
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/ReportUpdateStatus.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/ReportUpdateStatus.java
index 5615b5cc5..dcae6dffb 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/ReportUpdateStatus.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/ReportUpdateStatus.java
@@ -121,7 +121,7 @@ public class ReportUpdateStatus  extends AbstractIdentifiableInitializableCompon
     @Override
     public void run() {
         try {
-            String versionStr = Version.getVersion();
+            final String versionStr = Version.getVersion();
             if (versionStr == null) {
                 log.error("Could not find Current IdP Version");
                 return;
@@ -135,7 +135,8 @@ public class ReportUpdateStatus  extends AbstractIdentifiableInitializableCompon
             }
             final InstallableComponentInfo info = new IdPInfo(properties);
         
-            final InstallableComponentVersion newIdPVersion = InstallableComponentSupport.getBestVersion(version, version, info);
+            final InstallableComponentVersion newIdPVersion =
+                    InstallableComponentSupport.getBestVersion(version, version, info);
             if (newIdPVersion == null) {
                 log.info("No Upgrade available from {}", version);
             } else {
@@ -162,4 +163,5 @@ public class ReportUpdateStatus  extends AbstractIdentifiableInitializableCompon
             log.error("Check for update status failed unexpectedly", t);
         }
     }
+    
 }
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockDataSealers.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockDataSealers.java
index d2317f9ee..386b573e3 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockDataSealers.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockDataSealers.java
@@ -30,7 +30,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -65,7 +64,7 @@ public class UnlockDataSealers extends AbstractProfileAction {
     @Nonnull private Logger log = LoggerFactory.getLogger(UnlockDataSealers.class);
     
     /** Key source(s) to operate on. */
-    @Nonnull @NonnullElements private Collection<BasicKeystoreKeyStrategy> keyStrategies;
+    @Nonnull private Collection<BasicKeystoreKeyStrategy> keyStrategies;
 
     /** Constructor. */
     public UnlockDataSealers() {
@@ -77,7 +76,7 @@ public class UnlockDataSealers extends AbstractProfileAction {
      * 
      * @param strategies objects to unlock
      */
-    public void setKeyStrategies(@Nullable @NonnullElements final Collection<BasicKeystoreKeyStrategy> strategies) {
+    public void setKeyStrategies(@Nullable final Collection<BasicKeystoreKeyStrategy> strategies) {
         checkSetterPreconditions();
         
         if (strategies != null) {
@@ -145,4 +144,4 @@ public class UnlockDataSealers extends AbstractProfileAction {
         }
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockPrivateKeys.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockPrivateKeys.java
index fe68cc7db..e7b74f306 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockPrivateKeys.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/UnlockPrivateKeys.java
@@ -36,7 +36,6 @@ import org.slf4j.Logger;
 import org.springframework.core.io.Resource;
 
 import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -65,10 +64,10 @@ public class UnlockPrivateKeys extends AbstractProfileAction {
     @Nonnull private Logger log = LoggerFactory.getLogger(UnlockPrivateKeys.class);
     
     /** Credentials to operate on. */
-    @Nonnull @NonnullElements private Collection<MutableCredential> credentials;
+    @Nonnull private Collection<MutableCredential> credentials;
 
     /** Keys to load. */
-    @Nonnull @NonnullElements private Collection<Resource> keyResources;
+    @Nonnull private Collection<Resource> keyResources;
 
     /** Constructor. */
     public UnlockPrivateKeys() {
@@ -81,7 +80,7 @@ public class UnlockPrivateKeys extends AbstractProfileAction {
      * 
      * @param creds credentials to load keys into
      */
-    public void setCredentials(@Nullable @NonnullElements final Collection<MutableCredential> creds) {
+    public void setCredentials(@Nullable final Collection<MutableCredential> creds) {
         checkSetterPreconditions();
         
         if (creds != null) {
@@ -96,7 +95,7 @@ public class UnlockPrivateKeys extends AbstractProfileAction {
      * 
      * @param keys key resources to load
      */
-    public void setKeyResources(@Nullable @NonnullElements final Collection<Resource> keys) {
+    public void setKeyResources(@Nullable final Collection<Resource> keys) {
         checkSetterPreconditions();
         
         if (keys != null) {
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/package-info.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/package-info.java
index ae64ca649..176d570d4 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/package-info.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/admin/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes for administrative profiles.
  */
+ at NonnullElements
+package net.shibboleth.idp.admin.impl;
 
-package net.shibboleth.idp.admin.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/module/impl/package-info.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/module/impl/package-info.java
index 5177c93fc..7da401cff 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/module/impl/package-info.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/module/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes supporting module system.
  */
-
+ at NonnullElements
 package net.shibboleth.idp.module.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/FirstPartyIdPPlugin.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/FirstPartyIdPPlugin.java
index 11d755205..8e347bd50 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/FirstPartyIdPPlugin.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/FirstPartyIdPPlugin.java
@@ -27,7 +27,6 @@ import javax.annotation.Nonnull;
 import net.shibboleth.idp.plugin.IdPPlugin;
 import net.shibboleth.idp.plugin.PropertyDrivenIdPPlugin;
 import net.shibboleth.profile.plugin.PluginException;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -53,7 +52,7 @@ public class FirstPartyIdPPlugin extends PropertyDrivenIdPPlugin {
     /** {@inheritDoc} 
      * @throws PluginException if the URLs cannot be resolved */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<URL> getDefaultUpdateURLs() throws PluginException {
+    @Nonnull @Unmodifiable @NotLive public List<URL> getDefaultUpdateURLs() throws PluginException {
         try {
             // The second location is a backup CNAME pointing into AWS S3 at present.
             return CollectionSupport.listOf(
diff --git a/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/package-info.java b/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/package-info.java
index b6a2ffacd..ea254d863 100644
--- a/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/package-info.java
+++ b/idp-admin-impl/src/main/java/net/shibboleth/idp/plugin/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes for plugins.
  */
+ at NonnullElements
+package net.shibboleth.idp.plugin.impl;
 
-package net.shibboleth.idp.plugin.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
index 4007d4cce..d5e0c1c04 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractCredentialValidator.java
@@ -34,7 +34,6 @@ import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
 import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -88,7 +87,7 @@ public abstract class AbstractCredentialValidator extends AbstractIdentifiedInit
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
+    @Nonnull @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
             @Nonnull final Class<T> c) {
         final Subject localCopy = customPrincipals;
         if (localCopy == null) {
@@ -107,7 +106,7 @@ public abstract class AbstractCredentialValidator extends AbstractIdentifiedInit
      * 
      * @param principals supported principals to include
      */
-    public void setSupportedPrincipals(@Nullable @NonnullElements final Collection<Principal> principals) {
+    public void setSupportedPrincipals(@Nullable final Collection<Principal> principals) {
         checkSetterPreconditions();
         
         if (principals != null) {
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java
index a484cbe87..effd27d43 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractExtractionAction.java
@@ -48,7 +48,7 @@ public abstract class AbstractExtractionAction extends AbstractAuthenticationAct
     @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractExtractionAction.class);
     
     /** Match patterns and replacement strings to apply. */
-    @Nonnull @NonnullElements private List<Pair<Pattern,String>> transforms;
+    @Nonnull private List<Pair<Pattern,String>> transforms;
 
     /** Convert to uppercase prior to transforms? */
     private boolean uppercase;
@@ -73,7 +73,7 @@ public abstract class AbstractExtractionAction extends AbstractAuthenticationAct
      * 
      * @param newTransforms collection of replacement transforms
      */
-    public void setTransforms(@Nullable @NonnullElements final Collection<Pair<String, String>> newTransforms) {
+    public void setTransforms(@Nullable final Collection<Pair<String, String>> newTransforms) {
         checkSetterPreconditions();
         if (newTransforms != null) {
             transforms = new ArrayList<>();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java
index 78b9425e8..21e135ae8 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractSubjectCanonicalizationAction.java
@@ -35,7 +35,6 @@ import org.slf4j.Logger;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
@@ -70,7 +69,7 @@ public abstract class AbstractSubjectCanonicalizationAction
     @NonnullBeforeExec private SubjectCanonicalizationContext scContext;
 
     /** Match patterns and replacement strings to apply. */
-    @Nonnull @NonnullElements private List<Pair<Pattern,String>> transforms;
+    @Nonnull private List<Pair<Pattern,String>> transforms;
 
     /** Convert to uppercase prior to transforms? */
     private boolean uppercase;
@@ -116,7 +115,7 @@ public abstract class AbstractSubjectCanonicalizationAction
      * 
      * @param newTransforms collection of replacement transforms
      */
-    public void setTransforms(@Nullable @NonnullElements final Collection<Pair<String, String>> newTransforms) {
+    public void setTransforms(@Nullable final Collection<Pair<String, String>> newTransforms) {
         checkSetterPreconditions();
         if (newTransforms != null) {
             transforms = new ArrayList<>();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java
index bdff45b39..4e7339ee7 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractUsernamePasswordCredentialValidator.java
@@ -37,7 +37,6 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernamePasswordContext;
 import net.shibboleth.idp.authn.principal.PasswordPrincipal;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -71,7 +70,7 @@ public abstract class AbstractUsernamePasswordCredentialValidator extends Abstra
     @Nullable private Pattern matchExpression;
     
     /** Match patterns and replacement strings to apply prior to use. */
-    @Nonnull @NonnullElements private List<Pair<Pattern,String>> transforms;
+    @Nonnull private List<Pair<Pattern,String>> transforms;
 
     /** Convert username to uppercase prior to transforms? */
     private boolean uppercase;
@@ -143,7 +142,7 @@ public abstract class AbstractUsernamePasswordCredentialValidator extends Abstra
      * 
      * @param newTransforms collection of replacement transforms
      */
-    public void setTransforms(@Nullable @NonnullElements final Collection<Pair<String,String>> newTransforms) {
+    public void setTransforms(@Nullable final Collection<Pair<String,String>> newTransforms) {
         checkSetterPreconditions();
         if (newTransforms != null) {
             transforms = new ArrayList<>();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
index 7e3a0ac22..1b047e638 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AbstractValidationAction.java
@@ -21,7 +21,6 @@ import java.security.Principal;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.LinkedHashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.function.BiConsumer;
@@ -52,7 +51,6 @@ import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
 import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -94,7 +92,7 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
     @Nullable private Consumer<ProfileRequestContext> cleanupHook;
     
     /** Error messages associated with a specific error condition token. */
-    @Nonnull @NonnullElements private Map<String,Collection<String>> classifiedMessages;
+    @Nonnull private Map<String,Collection<String>> classifiedMessages;
     
     /** Predicate to apply when setting AuthenticationResult cacheability. */
     @Nullable private Predicate<ProfileRequestContext> resultCachingPredicate;
@@ -168,7 +166,7 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
      * 
      * @return classified error message map
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Map<String,Collection<String>> getClassifiedErrors() {
+    @Nonnull @Unmodifiable @NotLive public Map<String,Collection<String>> getClassifiedErrors() {
         // For now this is using the older wrapper approach to guarding a live map to maintain the map insertion order.
         final Map<String,Collection<String>> result = Collections.unmodifiableMap(classifiedMessages);
         assert result != null;
@@ -182,14 +180,14 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
      * 
      * @param messages the error message / event mappings to set
      */
-    public void setClassifiedMessages(@Nullable @NonnullElements final Map<String,Collection<String>> messages) {
+    public void setClassifiedMessages(@Nullable final Map<String,Collection<String>> messages) {
         checkSetterPreconditions();
         if (messages != null) {
             classifiedMessages = new LinkedHashMap<>();
             for (final Map.Entry<String, Collection<String>> entry : messages.entrySet()) {
                 if (entry.getKey() != null && !entry.getKey().isEmpty()
                         && entry.getValue() != null && !entry.getValue().isEmpty()) {
-                    classifiedMessages.put(entry.getKey(), List.copyOf(entry.getValue()));
+                    classifiedMessages.put(entry.getKey(), CollectionSupport.copyToList(entry.getValue()));
                 }
             }
         } else {
@@ -284,7 +282,7 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
+    @Nonnull @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
             @Nonnull final Class<T> c) {
         final Set<T> result = getSubject().getPrincipals(c);
         assert result != null;
@@ -299,7 +297,7 @@ public abstract class AbstractValidationAction extends AbstractAuthenticationAct
      * 
      * @param principals supported principals to include
      */
-    public void setSupportedPrincipals(@Nullable @NonnullElements final Collection<Principal> principals) {
+    public void setSupportedPrincipals(@Nullable final Collection<Principal> principals) {
         checkSetterPreconditions();
         getSubject().getPrincipals().clear();
         
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
index f803e4abc..de3c72b4d 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationFlowDescriptor.java
@@ -45,7 +45,6 @@ import net.shibboleth.idp.authn.principal.PrincipalService;
 import net.shibboleth.idp.authn.principal.PrincipalServiceManager;
 import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.idp.profile.FlowDescriptor;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -126,7 +125,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
     @Nullable private StorageSerializer<AuthenticationResult> resultSerializer;
     
     /** Weighted sort oredering of custom Principals produced by flow(s). */
-    @Nonnull @NonnullElements private Map<Principal,Integer> principalWeightMap;
+    @Nonnull private Map<Principal,Integer> principalWeightMap;
     
     /** Access to principal services. */
     @Nullable private PrincipalServiceManager principalServiceManager;
@@ -446,7 +445,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
     }
 
     /** {@inheritDoc} */
-    @Override @Nonnull @NonnullElements @Unmodifiable public <T extends Principal> Set<T> getSupportedPrincipals(
+    @Override @Nonnull @Unmodifiable public <T extends Principal> Set<T> getSupportedPrincipals(
             @Nonnull final Class<T> c) {
         final Set<T> result = supportedPrincipals.getPrincipals(c);
         assert result != null;
@@ -462,7 +461,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
      * 
      * @return a live collection of supported principals
      */
-    @Nonnull @NonnullElements public Collection<Principal> getSupportedPrincipals() {
+    @Nonnull public Collection<Principal> getSupportedPrincipals() {
         final Collection<Principal> result = supportedPrincipals.getPrincipals();
         assert result != null;
         return result;
@@ -473,7 +472,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
      * 
      * @param principals supported principals to add
      */
-    public void setSupportedPrincipals(@Nonnull @NonnullElements final Collection<Principal> principals) {
+    public void setSupportedPrincipals(@Nonnull final Collection<Principal> principals) {
         checkSetterPreconditions();
         Constraint.isNotNull(principals, "Principal collection cannot be null.");
 
@@ -493,7 +492,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
      * 
      * @since 4.1.0
      */
-    public void setSupportedPrincipalsByString(@Nonnull @NonnullElements final Collection<String> principals) {
+    public void setSupportedPrincipalsByString(@Nonnull final Collection<String> principals) {
         checkSetterPreconditions();
         stringBasedPrincipals = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(principals));
     }
@@ -534,9 +533,9 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
      * 
      * @since 4.0.0
      */
-    public void setPrincipalWeightMap(@Nullable @NonnullElements final Map<Principal,Integer> map) {
+    public void setPrincipalWeightMap(@Nullable final Map<Principal,Integer> map) {
         checkSetterPreconditions();
-        principalWeightMap = map != null ? map : CollectionSupport.emptyMap();
+        principalWeightMap = map != null ? CollectionSupport.copyToMap(map) : CollectionSupport.emptyMap();
     }
     
     /**
@@ -638,8 +637,7 @@ public class AuthenticationFlowDescriptor extends AbstractIdentifiableInitializa
      * @since 4.0.0
      */
     @SuppressWarnings("unchecked")
-    @Nullable public <T extends Principal> T getHighestWeighted(
-            @Nonnull @NonnullElements final Collection<T> principals) {
+    @Nullable public <T extends Principal> T getHighestWeighted(@Nonnull final Collection<T> principals) {
         if (principals.isEmpty()) {
             return null;
         } else if (principalWeightMap.isEmpty() || principals.size() == 1) {
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
index a7003229a..7de47fe95 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/AuthenticationResult.java
@@ -37,7 +37,6 @@ import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -73,7 +72,7 @@ public class AuthenticationResult implements PrincipalSupportingComponent, Predi
     private boolean previousResult;
     
     /** A map of additional data to associate with the result. */
-    @Nonnull @NonnullElements private final Map<String,String> additionalData;
+    @Nonnull private final Map<String,String> additionalData;
     
     /** Whether this result can be reused. */
     @Nonnull private Predicate<ProfileRequestContext> reuseCondition;
@@ -172,7 +171,7 @@ public class AuthenticationResult implements PrincipalSupportingComponent, Predi
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
+    @Nonnull @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
             @Nonnull final Class<T> c) {
         final Set<T> result = subject.getPrincipals(c);
         assert result != null;
@@ -266,7 +265,7 @@ public class AuthenticationResult implements PrincipalSupportingComponent, Predi
      * 
      * @since 4.0.0
      */
-    @Nonnull @NonnullElements @Live public Map<String,String> getAdditionalData() {
+    @Nonnull @Live public Map<String,String> getAdditionalData() {
         return additionalData;
     }
 
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java
index daf0a3e82..620ebd950 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/MultiFactorAuthenticationTransition.java
@@ -27,7 +27,6 @@ import javax.annotation.Nullable;
 import org.opensaml.profile.context.ProfileRequestContext;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -51,7 +50,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class MultiFactorAuthenticationTransition {
 
     /** A function that determines the next flow to execute. */
-    @Nonnull @NonnullElements private Map<String,Function<ProfileRequestContext,String>> nextFlowStrategyMap;
+    @Nonnull private Map<String,Function<ProfileRequestContext,String>> nextFlowStrategyMap;
     
     /** Constructor. */
     public MultiFactorAuthenticationTransition() {
@@ -78,7 +77,7 @@ public class MultiFactorAuthenticationTransition {
      * 
      * @return a map of transition functions keyed by event ID
      */
-    @Nonnull @NonnullElements @Live Map<String,Function<ProfileRequestContext,String>> getNextFlowStrategyMap() {
+    @Nonnull @Live Map<String,Function<ProfileRequestContext,String>> getNextFlowStrategyMap() {
         return nextFlowStrategyMap;
     }
     
@@ -92,7 +91,7 @@ public class MultiFactorAuthenticationTransition {
      * @param map map of transition rules
      */
     @SuppressWarnings("unchecked")
-    public void setNextFlowStrategyMap(@Nonnull @NonnullElements final Map<String,Object> map) {
+    public void setNextFlowStrategyMap(@Nonnull final Map<String,Object> map) {
         Constraint.isNotNull(map, "Transition strategy map cannot be null");
         
         nextFlowStrategyMap.clear();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/AuthenticationProfileConfiguration.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/AuthenticationProfileConfiguration.java
index af4136a26..30283eaef 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/AuthenticationProfileConfiguration.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/AuthenticationProfileConfiguration.java
@@ -29,7 +29,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import net.shibboleth.profile.config.ProfileConfiguration;
 import net.shibboleth.shared.annotation.ConfigurationSetting;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -44,7 +43,7 @@ public interface AuthenticationProfileConfiguration extends ProfileConfiguration
      * @return  default authentication methods to use
      */
     @ConfigurationSetting(name="defaultAuthenticationMethods")
-    @Nonnull @NonnullElements @NotLive @Unmodifiable List<Principal> getDefaultAuthenticationMethods(
+    @Nonnull @NotLive @Unmodifiable List<Principal> getDefaultAuthenticationMethods(
             @Nullable final ProfileRequestContext profileRequestContext);
         
     /**
@@ -59,7 +58,7 @@ public interface AuthenticationProfileConfiguration extends ProfileConfiguration
      * @return  a set of authentication flow IDs to allow 
      */
     @ConfigurationSetting(name="authenticationFlows")
-    @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable Set<String> getAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext);
 
     /**
@@ -74,7 +73,7 @@ public interface AuthenticationProfileConfiguration extends ProfileConfiguration
      * @return  a set of interceptor flow IDs to enable
      */
     @ConfigurationSetting(name="postAuthenticationFlows")
-    @Nonnull @NonnullElements @NotLive @Unmodifiable List<String> getPostAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable List<String> getPostAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext);
 
     /**
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/AuthenticationFlowsLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/AuthenticationFlowsLookupFunction.java
index d2c05f1c5..b9cdc2eec 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/AuthenticationFlowsLookupFunction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/AuthenticationFlowsLookupFunction.java
@@ -41,7 +41,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
 public class AuthenticationFlowsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
 
     /** {@inheritDoc} */
-    @Override
     @Nullable @NotLive @Unmodifiable public Collection<String> apply(
             @Nullable final ProfileRequestContext input) {
         final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/PostAuthenticationFlowsLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/PostAuthenticationFlowsLookupFunction.java
index 45ca5e748..d250f775d 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/PostAuthenticationFlowsLookupFunction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/PostAuthenticationFlowsLookupFunction.java
@@ -41,7 +41,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
 public class PostAuthenticationFlowsLookupFunction extends AbstractRelyingPartyLookupFunction<Collection<String>> {
 
     /** {@inheritDoc} */
-    @Override
     @Nullable @NotLive @Unmodifiable public Collection<String> apply(
             @Nullable final ProfileRequestContext input) {
         final RelyingPartyContext rpc = getRelyingPartyContextLookupStrategy().apply(input);
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/package-info.java
index 024bbaf08..a8479089e 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/navigate/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions for traversing authentication configurations.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.config.navigate;
 
-package net.shibboleth.idp.authn.config.navigate;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/package-info.java
index 7f0a8dcd9..590957203 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Configuration touchpoints for authentication flows.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.config;
 
-package net.shibboleth.idp.authn.config;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
index ae9785eb6..dabb91225 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationContext.java
@@ -43,8 +43,8 @@ import net.shibboleth.idp.authn.principal.ProxyAuthenticationPrincipal;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -94,22 +94,22 @@ public final class AuthenticationContext extends BaseContext {
     @Nullable @NonNegative private Integer proxyCount;
 
     /** Allowable proxied sources of authority. */
-    @Nonnull @NonnullElements private Set<String> proxiableAuthorities;
+    @Nonnull private Set<String> proxiableAuthorities;
     
     /** Lookup strategy for a fixed event to return from validators for testing. */
     @Nullable private Function<ProfileRequestContext,String> fixedEventLookupStrategy;
     
     /** Flows that are known to the system. */
-    @Nonnull @NonnullElements private final Map<String,AuthenticationFlowDescriptor> availableFlows;
+    @Nonnull private final Map<String,AuthenticationFlowDescriptor> availableFlows;
 
     /** Flows that could potentially be used to authenticate the user. */
-    @Nonnull @NonnullElements private final Map<String,AuthenticationFlowDescriptor> potentialFlows;
+    @Nonnull private final Map<String,AuthenticationFlowDescriptor> potentialFlows;
 
     /** Authentication results associated with an active session and available for (re)use. */
-    @Nonnull @NonnullElements private final Map<String,AuthenticationResult> activeResults;
+    @Nonnull private final Map<String,AuthenticationResult> activeResults;
 
     /** Previously attempted flows (could be failures or intermediate results). */
-    @Nonnull @NonnullElements private final Map<String,AuthenticationFlowDescriptor> intermediateFlows;
+    @Nonnull private final Map<String,AuthenticationFlowDescriptor> intermediateFlows;
     
     /** Instance of registry used for auto-creation of {@link RequestedPrincipalContext}. */
     @Nullable private PrincipalEvalPredicateFactoryRegistry evalRegistry;
@@ -167,7 +167,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @return authentication results currently active for the subject
      */
-    @Nonnull @NonnullElements @Live public Map<String,AuthenticationResult> getActiveResults() {
+    @Nonnull @Live public Map<String,AuthenticationResult> getActiveResults() {
         return activeResults;
     }
 
@@ -178,8 +178,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @return this authentication context
      */
-    @Nonnull public AuthenticationContext setActiveResults(
-            @Nonnull @NonnullElements final Iterable<AuthenticationResult> results) {
+    @Nonnull public AuthenticationContext setActiveResults(@Nonnull final Iterable<AuthenticationResult> results) {
         Constraint.isNotNull(results, "AuthenticationResult collection cannot be null");
 
         activeResults.clear();
@@ -201,7 +200,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @since 3.3.0
      */
-    @Nonnull @NonnullElements @Live public Map<String,AuthenticationFlowDescriptor> getAvailableFlows() {
+    @Nonnull @Live public Map<String,AuthenticationFlowDescriptor> getAvailableFlows() {
         return availableFlows;
     }
     
@@ -212,7 +211,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @return the potential flows
      */
-    @Nonnull @NonnullElements @Live public Map<String,AuthenticationFlowDescriptor> getPotentialFlows() {
+    @Nonnull @Live public Map<String,AuthenticationFlowDescriptor> getPotentialFlows() {
         return potentialFlows;
     }
 
@@ -225,7 +224,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @return the intermediately executed flows
      */
-    @Nonnull @NonnullElements @Live public Map<String,AuthenticationFlowDescriptor> getIntermediateFlows() {
+    @Nonnull @Live public Map<String,AuthenticationFlowDescriptor> getIntermediateFlows() {
         return intermediateFlows;
     }
     
@@ -484,7 +483,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @since 4.0.0
      */
-    @Nonnull @NonnullElements @Live public Set<String> getProxiableAuthorities() {
+    @Nonnull @Live public Set<String> getProxiableAuthorities() {
         return proxiableAuthorities;
     }
     
@@ -578,7 +577,7 @@ public final class AuthenticationContext extends BaseContext {
      * 
      * @return the state map
      */
-    @Nonnull @Live public Map<String,Object> getAuthenticationStateMap() {
+    @Nonnull @NullableElements @Live public Map<String,Object> getAuthenticationStateMap() {
         return stateMap;
     }
     
@@ -675,7 +674,7 @@ public final class AuthenticationContext extends BaseContext {
      * @return true iff the input is compatible with the requested authentication requirements or if
      *  no such requirements have been imposed
      */
-    public boolean isAcceptable(@Nonnull @NonnullElements final Collection<Principal> principals) {
+    public boolean isAcceptable(@Nonnull final Collection<Principal> principals) {
         final RequestedPrincipalContext rpCtx = getSubcontext(RequestedPrincipalContext.class);
         if (rpCtx != null) {
             return rpCtx.isAcceptable(principals);
@@ -789,7 +788,7 @@ public final class AuthenticationContext extends BaseContext {
      * @return true iff a new context was created
      */
     public boolean addRequestedPrincipalContext(@Nonnull @NotEmpty final String operator,
-            @Nonnull @NonnullElements final List<Principal> principals, final boolean replace) {
+            @Nonnull final List<Principal> principals, final boolean replace) {
         
         RequestedPrincipalContext rpCtx = getSubcontext(RequestedPrincipalContext.class);
         if (rpCtx != null && !replace) {
@@ -838,7 +837,7 @@ public final class AuthenticationContext extends BaseContext {
      * @return true iff proxying is permissible or inapplicable
      */
     private boolean checkProxyRestrictions(
-            @Nullable @NonnullElements final Collection<ProxyAuthenticationPrincipal> principals) {
+            @Nullable final Collection<ProxyAuthenticationPrincipal> principals) {
         
         if (principals == null || principals.isEmpty()) {
             return true;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationErrorContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationErrorContext.java
index fe4eff372..de391cf82 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationErrorContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationErrorContext.java
@@ -26,7 +26,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 import org.opensaml.messaging.context.BaseContext;
@@ -45,10 +44,10 @@ import org.opensaml.messaging.context.BaseContext;
 public final class AuthenticationErrorContext extends BaseContext {
 
     /** Ordered list of exceptions encountered. */
-    @Nonnull @NonnullElements private List<Exception> exceptions;
+    @Nonnull private List<Exception> exceptions;
     
     /** Error conditions detected through classified error messages. */
-    @Nonnull @NonnullElements private Collection<String> classifiedErrors;
+    @Nonnull private Collection<String> classifiedErrors;
     
     /** Constructor. */
     public AuthenticationErrorContext() {
@@ -61,7 +60,7 @@ public final class AuthenticationErrorContext extends BaseContext {
      * 
      * @return  immutable list of exceptions
      */
-    @Nonnull @NonnullElements @Live public List<Exception> getExceptions() {
+    @Nonnull @Live public List<Exception> getExceptions() {
         return exceptions;
     }
     
@@ -70,7 +69,7 @@ public final class AuthenticationErrorContext extends BaseContext {
      * 
      * @return mutable collection of error strings
      */
-    @Nonnull @NonnullElements @Live public Collection<String> getClassifiedErrors() {
+    @Nonnull @Live public Collection<String> getClassifiedErrors() {
         return classifiedErrors;
     }
     
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationWarningContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationWarningContext.java
index 0963dbbc6..81a654732 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationWarningContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/AuthenticationWarningContext.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 import org.opensaml.messaging.context.BaseContext;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -43,7 +42,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public final class AuthenticationWarningContext extends BaseContext {
 
     /** Warning conditions detected through classified warning messages. */
-    @Nonnull @NonnullElements private Collection<String> classifiedWarnings;
+    @Nonnull private Collection<String> classifiedWarnings;
     
     /** Constructor. */
     public AuthenticationWarningContext() {
@@ -55,7 +54,7 @@ public final class AuthenticationWarningContext extends BaseContext {
      * 
      * @return mutable collection of warning strings
      */
-    @Nonnull @NonnullElements @Live public Collection<String> getClassifiedWarnings() {
+    @Nonnull @Live public Collection<String> getClassifiedWarnings() {
         return classifiedWarnings;
     }
     
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/CertificateContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/CertificateContext.java
index d28046b74..726a50cf3 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/CertificateContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/CertificateContext.java
@@ -26,7 +26,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 
 import org.opensaml.messaging.context.BaseContext;
@@ -43,7 +42,7 @@ public final class CertificateContext extends BaseContext {
     @Nullable private Certificate certificate;
     
     /** Additional certificates as input to validation. */
-    @Nonnull @NonnullElements private Collection<Certificate> intermediates;
+    @Nonnull private Collection<Certificate> intermediates;
 
     /** Constructor. */
     public CertificateContext() {
@@ -76,7 +75,7 @@ public final class CertificateContext extends BaseContext {
      * 
      * @return any additional certificates
      */
-    @Nonnull @NonnullElements @Live public Collection<Certificate> getIntermediates() {
+    @Nonnull @Live public Collection<Certificate> getIntermediates() {
         return intermediates;
     }
 
@@ -87,7 +86,7 @@ public final class CertificateContext extends BaseContext {
      * 
      * @return this context
      */
-    @Nonnull public CertificateContext setIntermediates(@Nonnull @NonnullElements final Collection<Certificate> certs) {
+    @Nonnull public CertificateContext setIntermediates(@Nonnull final Collection<Certificate> certs) {
         Constraint.isNotNull(certs, "Intermediate certificate collection cannot be null");
         
         intermediates.clear();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/ExternalAuthenticationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/ExternalAuthenticationContext.java
index b6847a549..99006c207 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/ExternalAuthenticationContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/ExternalAuthenticationContext.java
@@ -30,7 +30,6 @@ import org.opensaml.messaging.context.BaseContext;
 
 import net.shibboleth.idp.authn.ExternalAuthentication;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -61,7 +60,7 @@ public final class ExternalAuthenticationContext extends BaseContext {
     @Nullable private Instant authnInstant;
     
     /** Proxied authenticating sources. */
-    @Nonnull @NonnullElements private Collection<String> authenticatingAuthorities;
+    @Nonnull private Collection<String> authenticatingAuthorities;
     
     /** Error message. */
     @Nullable private String authnError;
@@ -214,7 +213,7 @@ public final class ExternalAuthenticationContext extends BaseContext {
      * 
      * @since 3.4.0
      */
-    @Nonnull @NonnullElements @Live public Collection<String> getAuthenticatingAuthorities() {
+    @Nonnull @Live public Collection<String> getAuthenticatingAuthorities() {
         return authenticatingAuthorities;
     }
 
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/KerberosTicketContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/KerberosTicketContext.java
index 7c0fbac06..1b184b392 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/KerberosTicketContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/KerberosTicketContext.java
@@ -31,7 +31,7 @@ import org.opensaml.messaging.context.BaseContext;
 public final class KerberosTicketContext extends BaseContext {
 
     /** Kerberos ticket to be validated. */
-    private KerberosTicket ticket;
+    @Nullable private KerberosTicket ticket;
 
     /**
      * Get the Kerberos ticket to be validated.
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/MultiFactorAuthenticationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/MultiFactorAuthenticationContext.java
index 524185b1b..11e1f52cb 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/MultiFactorAuthenticationContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/MultiFactorAuthenticationContext.java
@@ -29,7 +29,6 @@ import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
 import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.idp.authn.MultiFactorAuthenticationTransition;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -48,10 +47,10 @@ import org.opensaml.messaging.context.BaseContext;
 public final class MultiFactorAuthenticationContext extends BaseContext {
 
     /** Map of login "factors" (flows) and the transition rules to run after them. */
-    @Nonnull @NonnullElements private Map<String,MultiFactorAuthenticationTransition> transitionMap;
+    @Nonnull private Map<String,MultiFactorAuthenticationTransition> transitionMap;
     
     /** Authentication results that are active (may be generated earlier or during current request). */
-    @Nonnull @NonnullElements private final Map<String,AuthenticationResult> activeResults;
+    @Nonnull private final Map<String,AuthenticationResult> activeResults;
 
     /** Login flow descriptor for the MFA flow. */
     @Nullable private AuthenticationFlowDescriptor mfaFlowDescriptor;
@@ -73,7 +72,7 @@ public final class MultiFactorAuthenticationContext extends BaseContext {
      * 
      * @return  map of transition logic
      */
-    @Nonnull @NonnullElements @Live public Map<String,MultiFactorAuthenticationTransition> getTransitionMap() {
+    @Nonnull @Live public Map<String,MultiFactorAuthenticationTransition> getTransitionMap() {
         return transitionMap;
     }
     
@@ -104,7 +103,7 @@ public final class MultiFactorAuthenticationContext extends BaseContext {
      * 
      * @return list of results
      */
-    @Nonnull @NonnullElements @Live public Map<String,AuthenticationResult> getActiveResults() {
+    @Nonnull @Live public Map<String,AuthenticationResult> getActiveResults() {
         return activeResults;
     }
     
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/PreferredPrincipalContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/PreferredPrincipalContext.java
index f5872d5c3..efe2c85d2 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/PreferredPrincipalContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/PreferredPrincipalContext.java
@@ -25,7 +25,6 @@ import java.util.List;
 import javax.annotation.Nonnull;
 
 import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -50,7 +49,7 @@ import org.opensaml.messaging.context.BaseContext;
 public final class PreferredPrincipalContext extends BaseContext {
 
     /** The principals reflecting the preference. */
-    @Nonnull @NonnullElements private List<Principal> preferredPrincipals;
+    @Nonnull private List<Principal> preferredPrincipals;
     
     /** Constructor. */
     public PreferredPrincipalContext() {
@@ -62,7 +61,7 @@ public final class PreferredPrincipalContext extends BaseContext {
      * 
      * @return  immutable list of principals 
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Principal> getPreferredPrincipals() {
+    @Nonnull @Unmodifiable @NotLive public List<Principal> getPreferredPrincipals() {
         return preferredPrincipals;
     }
     
@@ -73,8 +72,7 @@ public final class PreferredPrincipalContext extends BaseContext {
      * 
      * @return this context
      */
-    @Nonnull public PreferredPrincipalContext setPreferredPrincipals(
-            @Nonnull @NonnullElements final List<Principal> principals) {
+    @Nonnull public PreferredPrincipalContext setPreferredPrincipals(@Nonnull final List<Principal> principals) {
         
         preferredPrincipals = CollectionSupport.copyToList(
                 Constraint.isNotNull(principals, "Principal list cannot be null"));
@@ -102,7 +100,7 @@ public final class PreferredPrincipalContext extends BaseContext {
      * 
      * @return true iff the input is compatible with the requested authentication preferences
      */
-    public boolean isAcceptable(@Nonnull @NonnullElements final Collection<Principal> principals) {
+    public boolean isAcceptable(@Nonnull final Collection<Principal> principals) {
         return !Collections.disjoint(preferredPrincipals, principals);
     }
 
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
index 03ecea46e..3c09edad6 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/RequestedPrincipalContext.java
@@ -30,7 +30,6 @@ import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry;
 import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -69,7 +68,7 @@ public final class RequestedPrincipalContext extends BaseContext {
     @Nullable private String operatorString;
 
     /** The principals reflecting the request requirements. */
-    @Nonnull @NonnullElements private List<Principal> requestedPrincipals;
+    @Nonnull private List<Principal> requestedPrincipals;
     
     /** The principal that satisfied the request, if any. */
     @Nullable private Principal matchingPrincipal;
@@ -134,7 +133,7 @@ public final class RequestedPrincipalContext extends BaseContext {
      * 
      * @return  immutable list of principals 
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Principal> getRequestedPrincipals() {
+    @Nonnull @Unmodifiable @NotLive public List<Principal> getRequestedPrincipals() {
         return requestedPrincipals;
     }
     
@@ -145,8 +144,7 @@ public final class RequestedPrincipalContext extends BaseContext {
      * 
      * @return this context
      */
-    @Nonnull public RequestedPrincipalContext setRequestedPrincipals(
-            @Nonnull @NonnullElements final List<Principal> principals) {
+    @Nonnull public RequestedPrincipalContext setRequestedPrincipals(@Nonnull final List<Principal> principals) {
         
         requestedPrincipals =
                 CollectionSupport.copyToList(Constraint.isNotNull(principals, "Principal list cannot be null"));
@@ -227,7 +225,7 @@ public final class RequestedPrincipalContext extends BaseContext {
      *  
      *  @since 3.3.0
      */
-    public boolean isAcceptable(@Nonnull @NonnullElements final Collection<Principal> principals) {
+    public boolean isAcceptable(@Nonnull final Collection<Principal> principals) {
         return isAcceptable(new PrincipalSupportingComponent() {
             @Nonnull public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull final Class<T> c) {
                 final HashSet<T> set = new HashSet<>();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectCanonicalizationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectCanonicalizationContext.java
index 6f6172f59..c87065a16 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectCanonicalizationContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectCanonicalizationContext.java
@@ -27,7 +27,6 @@ import javax.security.auth.Subject;
 
 import net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.opensaml.messaging.context.BaseContext;
@@ -57,10 +56,10 @@ public final class SubjectCanonicalizationContext extends BaseContext {
     @Nullable private String responderId;
 
     /** Flows that could potentially be used. */
-    @Nonnull @NonnullElements private final Map<String, SubjectCanonicalizationFlowDescriptor> potentialFlows;
+    @Nonnull private final Map<String, SubjectCanonicalizationFlowDescriptor> potentialFlows;
 
     /** Previously attempted flows (could be failures or intermediate results). */
-    @Nonnull @NonnullElements private final Map<String, SubjectCanonicalizationFlowDescriptor> intermediateFlows;
+    @Nonnull private final Map<String, SubjectCanonicalizationFlowDescriptor> intermediateFlows;
     
     /** The last c14 flow attempted. */
     @Nullable private SubjectCanonicalizationFlowDescriptor attemptedFlow;
@@ -183,7 +182,7 @@ public final class SubjectCanonicalizationContext extends BaseContext {
      * 
      * @return the potential flows
      */
-    @Nonnull @NonnullElements @Live public Map<String, SubjectCanonicalizationFlowDescriptor> getPotentialFlows() {
+    @Nonnull @Live public Map<String, SubjectCanonicalizationFlowDescriptor> getPotentialFlows() {
         return potentialFlows;
     }
 
@@ -193,7 +192,7 @@ public final class SubjectCanonicalizationContext extends BaseContext {
      * 
      * @return the intermediately executed flows
      */
-    @Nonnull @NonnullElements @Live public Map<String, SubjectCanonicalizationFlowDescriptor> getIntermediateFlows() {
+    @Nonnull @Live public Map<String, SubjectCanonicalizationFlowDescriptor> getIntermediateFlows() {
         return intermediateFlows;
     }
 
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
index 2a12223ca..9fecf8f82 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/SubjectContext.java
@@ -28,7 +28,6 @@ import javax.security.auth.Subject;
 
 import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -60,7 +59,7 @@ public final class SubjectContext extends BaseContext {
     @Nullable private String principalName;
 
     /** The active authentication results for the subject. */
-    @Nonnull @NonnullElements private final Map<String,AuthenticationResult> authenticationResults;
+    @Nonnull private final Map<String,AuthenticationResult> authenticationResults;
     
     /** Constructor. */
     public SubjectContext() {
@@ -120,7 +119,7 @@ public final class SubjectContext extends BaseContext {
      * 
      * @return  mutable map of authentication flow IDs to authentication results
      */
-    @Nonnull @NonnullElements @Live public Map<String,AuthenticationResult> getAuthenticationResults() {
+    @Nonnull @Live public Map<String,AuthenticationResult> getAuthenticationResults() {
         return authenticationResults;
     }
     
@@ -130,7 +129,7 @@ public final class SubjectContext extends BaseContext {
      * 
      * @return immutable list of Subjects 
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<Subject> getSubjects() {
+    @Nonnull @Unmodifiable @NotLive public List<Subject> getSubjects() {
         return authenticationResults.values()
                 .stream()
                 .map(AuthenticationResult::getSubject)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
index 38bf55f16..9f9db4804 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/RequestedPrincipalContextPrincipalLookupFunction.java
@@ -24,6 +24,8 @@ import java.util.stream.Collectors;
 import javax.annotation.Nullable;
 
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
 
@@ -35,7 +37,7 @@ public class RequestedPrincipalContextPrincipalLookupFunction
         implements ContextDataLookupFunction<RequestedPrincipalContext,Collection<String>> {
 
     /** {@inheritDoc} */
-    @Nullable public Collection<String> apply(@Nullable final RequestedPrincipalContext input) {
+    @Nullable @NotLive @Unmodifiable public Collection<String> apply(@Nullable final RequestedPrincipalContext input) {
         
         if (input != null) {
             return input.getRequestedPrincipals()
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/package-info.java
index 80b95366c..2ffc2a025 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/navigate/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions for traversing authentication contexts.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.context.navigate;
 
-package net.shibboleth.idp.authn.context.navigate;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/package-info.java
index 54f2ec95e..48272fa3f 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/context/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Context classes for managing authentication-related state.
  */
-package net.shibboleth.idp.authn.context;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.authn.context;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java
index 7c578c9c6..5d2fdc1f3 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/BasicDuoIntegration.java
@@ -26,8 +26,8 @@ import javax.annotation.Nullable;
 import javax.security.auth.Subject;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -128,8 +128,8 @@ public class BasicDuoIntegration extends AbstractInitializableComponent implemen
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @Unmodifiable
-    public <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull final Class<T> c) {
+    @Nonnull @Unmodifiable @NotLive public <T extends Principal> Set<T> getSupportedPrincipals(
+            @Nonnull final Class<T> c) {
         final Set<T> result = supportedPrincipals.getPrincipals(c);
         assert result != null;
         return result;
@@ -144,8 +144,7 @@ public class BasicDuoIntegration extends AbstractInitializableComponent implemen
      * @param <T> a type of principal to add, if not generic
      * @param principals supported principals to include
      */
-    public <T extends Principal> void setSupportedPrincipals(
-            @Nullable @NonnullElements final Collection<T> principals) {
+    public <T extends Principal> void setSupportedPrincipals(@Nullable final Collection<T> principals) {
         checkSetterPreconditions();
 
         supportedPrincipals.getPrincipals().clear();
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoPrincipal.java
index f3673bf8d..a4ff6a0c8 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/DuoPrincipal.java
@@ -43,7 +43,6 @@ public class DuoPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return username;
     }
@@ -79,8 +78,7 @@ public class DuoPrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public DuoPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public DuoPrincipal clone() throws CloneNotSupportedException {
         final DuoPrincipal copy = (DuoPrincipal) super.clone();
         copy.username = username;
         return copy;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/DuoAuthenticationContext.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/DuoAuthenticationContext.java
index 5a7648ba1..a43d2cb16 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/DuoAuthenticationContext.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/DuoAuthenticationContext.java
@@ -27,7 +27,6 @@ import org.opensaml.messaging.context.BaseContext;
 
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 
 /**
  * Context that carries Duo factor and device or passcode to be used in validation.
@@ -173,7 +172,7 @@ public final class DuoAuthenticationContext extends BaseContext {
      * 
      * @return the pushinfo
      */
-    @Nonnull @NonnullElements @Live public Map<String,String> getPushInfo() {
+    @Nonnull @Live public Map<String,String> getPushInfo() {
         return pushInfo;
     }
     
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/package-info.java
index 3ebfebd7a..7c10173ca 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/context/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Context classes related to Duo authentication.
  */
-package net.shibboleth.idp.authn.duo.context;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.authn.duo.context;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/package-info.java
index 5c8c9a6d9..1e08c7224 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/duo/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Public APIs related to Duo authentication.
  */
-package net.shibboleth.idp.authn.duo;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.authn.duo;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/package-info.java
index 4c88bc798..8563bc6c5 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** APIs related to the authentication of a subject. */
+ at NonnullElements
+package net.shibboleth.idp.authn;
 
-package net.shibboleth.idp.authn;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/AuthenticationResultPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/AuthenticationResultPrincipal.java
index 675a36f7e..f2395410e 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/AuthenticationResultPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/AuthenticationResultPrincipal.java
@@ -44,7 +44,6 @@ public class AuthenticationResultPrincipal implements Principal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return authnResult.getAuthenticationFlowId();
     }
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/CloneablePrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/CloneablePrincipal.java
index 044a34217..f34f735c5 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/CloneablePrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/CloneablePrincipal.java
@@ -19,6 +19,8 @@ package net.shibboleth.idp.authn.principal;
 
 import java.security.Principal;
 
+import javax.annotation.Nonnull;
+
 /** Principal that can be cloned without knowledge of the underlying type. */
 public interface CloneablePrincipal extends Principal, Cloneable {
 
@@ -31,5 +33,5 @@ public interface CloneablePrincipal extends Principal, Cloneable {
      *
      * @see java.lang.Object#clone
      */
-    Object clone() throws CloneNotSupportedException;
+    @Nonnull Object clone() throws CloneNotSupportedException;
 }
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/GenericPrincipalSerializer.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/GenericPrincipalSerializer.java
index eedcfadd3..5f15bc303 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/GenericPrincipalSerializer.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/GenericPrincipalSerializer.java
@@ -47,7 +47,6 @@ import com.google.common.collect.BiMap;
 import com.google.common.collect.HashBiMap;
 import com.google.common.collect.ImmutableBiMap;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
 import net.shibboleth.shared.logic.Constraint;
@@ -75,10 +74,10 @@ public class GenericPrincipalSerializer extends AbstractPrincipalSerializer<Stri
     @Nonnull private final Logger log = LoggerFactory.getLogger(GenericPrincipalSerializer.class);
 
     /** Shrinkage of long constants into symbolic numbers. */
-    @Nonnull @NonnullElements private BiMap<String,Integer> symbolics;
+    @Nonnull private BiMap<String,Integer> symbolics;
     
     /** A cache of Principal types that support string-based construction. */
-    @Nonnull @NonnullElements private final Set<Class<? extends Principal>> compatiblePrincipalTypes;
+    @Nonnull private final Set<Class<? extends Principal>> compatiblePrincipalTypes;
 
     /**
      * Constructor.
@@ -98,7 +97,7 @@ public class GenericPrincipalSerializer extends AbstractPrincipalSerializer<Stri
      * 
      * @param mappings  string to symbolic mappings
      */
-    public void setSymbolics(@Nonnull @NonnullElements final Map<String,Integer> mappings) {
+    public void setSymbolics(@Nonnull final Map<String,Integer> mappings) {
         checkSetterPreconditions();
         final BiMap<String,Integer> s = HashBiMap.create(Constraint.isNotNull(mappings, "Mappings cannot be null"));
         assert s!=null;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/HOTPPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/HOTPPrincipal.java
index 9579d5646..4a93f2f26 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/HOTPPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/HOTPPrincipal.java
@@ -46,7 +46,6 @@ public class HOTPPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return username;
     }
@@ -82,8 +81,7 @@ public class HOTPPrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public HOTPPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public HOTPPrincipal clone() throws CloneNotSupportedException {
         final HOTPPrincipal copy = (HOTPPrincipal) super.clone();
         copy.username = username;
         return copy;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/IdPAttributePrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/IdPAttributePrincipal.java
index c28b692c4..91bf4bcaa 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/IdPAttributePrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/IdPAttributePrincipal.java
@@ -44,7 +44,6 @@ public class IdPAttributePrincipal implements Principal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return attribute.getId();
     }
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PasswordPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PasswordPrincipal.java
index 3b621ea5c..bd44ae4fd 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PasswordPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PasswordPrincipal.java
@@ -41,7 +41,6 @@ public class PasswordPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return password;
     }
@@ -77,8 +76,7 @@ public class PasswordPrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public PasswordPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public PasswordPrincipal clone() throws CloneNotSupportedException {
         final PasswordPrincipal copy = (PasswordPrincipal) super.clone();
         copy.password = password;
         return copy;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
index 68304542d..a23a028e6 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalEvalPredicateFactoryRegistry.java
@@ -26,7 +26,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
@@ -48,8 +47,7 @@ public final class PrincipalEvalPredicateFactoryRegistry {
     @Nonnull private final Logger log = LoggerFactory.getLogger(PrincipalEvalPredicateFactoryRegistry.class);
     
     /** Storage for the registry mappings. */
-    @Nonnull @NonnullElements
-    private Map<Pair<Class<? extends Principal>, String>, PrincipalEvalPredicateFactory> registry;
+    @Nonnull private Map<Pair<Class<? extends Principal>, String>, PrincipalEvalPredicateFactory> registry;
 
     /** Constructor. */
     public PrincipalEvalPredicateFactoryRegistry() {
@@ -66,7 +64,7 @@ public final class PrincipalEvalPredicateFactoryRegistry {
      * @since 4.1.0
      */
     @Autowired
-    public PrincipalEvalPredicateFactoryRegistry(@Nullable @NonnullElements @ParameterName(name="registrations")
+    public PrincipalEvalPredicateFactoryRegistry(@Nullable @ParameterName(name="registrations")
             final Collection<PrincipalEvalPredicateFactoryRegistration> registrations) {
         registry = new ConcurrentHashMap<>();
         if (registrations != null) {
@@ -82,8 +80,8 @@ public final class PrincipalEvalPredicateFactoryRegistry {
      * 
      * @since 4.1.0
      */
-    public void setRegistrations(@Nullable @NonnullElements
-            final Map<Pair<Class<? extends Principal>, String>, PrincipalEvalPredicateFactory> fromMap) {
+    public void setRegistrations(
+            @Nullable final Map<Pair<Class<? extends Principal>, String>, PrincipalEvalPredicateFactory> fromMap) {
         if (fromMap != null) {
             fromMap.entrySet().forEach(entry -> {
                 if (registry.containsKey(entry.getKey())) {
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalServiceManager.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalServiceManager.java
index 925375301..e8938b981 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalServiceManager.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalServiceManager.java
@@ -29,7 +29,6 @@ import org.slf4j.Logger;
 import org.springframework.beans.factory.annotation.Autowired;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -47,10 +46,10 @@ public class PrincipalServiceManager {
     @Nonnull private final Logger log = LoggerFactory.getLogger(PrincipalServiceManager.class);
     
     /** Service index by class. */
-    @Nonnull @NonnullElements private final Map<Class<?>,PrincipalService<?>> classIndexedMap;
+    @Nonnull private final Map<Class<?>,PrincipalService<?>> classIndexedMap;
 
     /** Service index by ID. */
-    @Nonnull @NonnullElements private final Map<String,PrincipalService<?>> idIndexedMap;
+    @Nonnull private final Map<String,PrincipalService<?>> idIndexedMap;
 
     /**
      * Constructor.
@@ -59,7 +58,7 @@ public class PrincipalServiceManager {
      */
     @Autowired
     public PrincipalServiceManager(
-            @Nullable @NonnullElements @ParameterName(name="services") final Collection<PrincipalService<?>> services) {
+            @Nullable @ParameterName(name="services") final Collection<PrincipalService<?>> services) {
         if (services != null) {
             classIndexedMap = new HashMap<>(services.size());
             idIndexedMap = new HashMap<>(services.size());
@@ -78,7 +77,7 @@ public class PrincipalServiceManager {
      * 
      * @return all registered services
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<PrincipalService<?>> all() {
+    @Nonnull @NotLive @Unmodifiable public Collection<PrincipalService<?>> all() {
         final Collection<PrincipalService<?>> values = classIndexedMap.values();
         assert values!=null;
         return CollectionSupport.copyToList(values);
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalSupportingComponent.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalSupportingComponent.java
index 134590c0e..d324c9f13 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalSupportingComponent.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/PrincipalSupportingComponent.java
@@ -22,7 +22,6 @@ import java.util.Set;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -44,6 +43,5 @@ public interface PrincipalSupportingComponent {
      * 
      * @return a set of matching principals
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive <T extends Principal> Set<T> getSupportedPrincipals(
-            @Nonnull final Class<T> c);
+    @Nonnull @Unmodifiable @NotLive <T extends Principal> Set<T> getSupportedPrincipals(@Nonnull final Class<T> c);
 }
\ No newline at end of file
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
index 70b9cb670..5de28a589 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/ProxyAuthenticationPrincipal.java
@@ -36,7 +36,6 @@ import net.shibboleth.profile.config.ProfileConfiguration;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -54,10 +53,10 @@ import com.google.common.base.MoreObjects;
 public class ProxyAuthenticationPrincipal implements Principal, Predicate<ProfileRequestContext> {
 
     /** The authorities. */
-    @Nonnull @NonnullElements private Collection<String> authorities;
+    @Nonnull private Collection<String> authorities;
 
     /** The audiences. */
-    @Nonnull @NonnullElements private Set<String> audiences;
+    @Nonnull private Set<String> audiences;
 
     /** Constrains additional proxy hops. */
     @Nullable private Integer proxyCount;
@@ -73,7 +72,7 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
      *
      * @param proxiedAuthorities initial set of authorities
      */
-    public ProxyAuthenticationPrincipal(@Nonnull @NonnullElements final Collection<String> proxiedAuthorities) {
+    public ProxyAuthenticationPrincipal(@Nonnull final Collection<String> proxiedAuthorities) {
         Constraint.isNotNull(proxiedAuthorities, "Proxied authority collection cannot be null");
         
         authorities = new ArrayList<>(List.copyOf(proxiedAuthorities));
@@ -92,7 +91,7 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
      * 
      * @return the authorities
      */
-    @Nonnull @NonnullElements @Live public Collection<String> getAuthorities() {
+    @Nonnull @Live public Collection<String> getAuthorities() {
         return authorities;
     }
 
@@ -102,7 +101,7 @@ public class ProxyAuthenticationPrincipal implements Principal, Predicate<Profil
      * 
      * @return the audiences
      */
-    @Nonnull @NonnullElements @Live public Set<String> getAudiences() {
+    @Nonnull @Live public Set<String> getAudiences() {
         return audiences;
     }
     
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/TOTPPrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/TOTPPrincipal.java
index 5afb8064c..a49b4ac25 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/TOTPPrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/TOTPPrincipal.java
@@ -46,7 +46,6 @@ public class TOTPPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return username;
     }
@@ -82,8 +81,7 @@ public class TOTPPrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public TOTPPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public TOTPPrincipal clone() throws CloneNotSupportedException {
         final TOTPPrincipal copy = (TOTPPrincipal) super.clone();
         copy.username = username;
         return copy;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/UsernamePrincipal.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/UsernamePrincipal.java
index e5ebf8406..1c7a556b2 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/UsernamePrincipal.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/UsernamePrincipal.java
@@ -42,7 +42,6 @@ public class UsernamePrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return username;
     }
@@ -78,8 +77,7 @@ public class UsernamePrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public UsernamePrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public UsernamePrincipal clone() throws CloneNotSupportedException {
         final UsernamePrincipal copy = (UsernamePrincipal) super.clone();
         copy.username = username;
         return copy;
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/package-info.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/package-info.java
index dae941731..4f2877440 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/package-info.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/principal/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes supporting Java {@link java.security.Principal} usage.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.principal;
 
-package net.shibboleth.idp.authn.principal;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/audit/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/audit/impl/package-info.java
index d1a6ca55c..cd7eaa778 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/audit/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/audit/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Audit implementation classes.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.audit.impl;
 
-package net.shibboleth.idp.authn.audit.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/IdPAttributePrincipalValuesFunction.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/IdPAttributePrincipalValuesFunction.java
index 9aca8fc8c..def798d58 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/IdPAttributePrincipalValuesFunction.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/IdPAttributePrincipalValuesFunction.java
@@ -29,6 +29,8 @@ import net.shibboleth.idp.attribute.IdPAttributeValue;
 import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -61,10 +63,9 @@ public class IdPAttributePrincipalValuesFunction extends AbstractInitializableCo
     }
 
     /** {@inheritDoc} */
-    @Nullable public List<IdPAttributeValue> apply(@Nullable final Principal principal) {
+    @Nullable @Unmodifiable @NotLive public List<IdPAttributeValue> apply(@Nullable final Principal principal) {
 
-        if (null != principal && principal instanceof IdPAttributePrincipal) {
-            final IdPAttributePrincipal attributePrincipal = (IdPAttributePrincipal) principal;
+        if (principal instanceof IdPAttributePrincipal attributePrincipal) {
             final IdPAttribute attribute = attributePrincipal.getAttribute();
             if (attributeName.equals(attribute.getId())) {
                 return attribute.getValues();
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributeValuesFunction.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributeValuesFunction.java
index d36e31295..60e4d72ca 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributeValuesFunction.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributeValuesFunction.java
@@ -36,6 +36,8 @@ import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -137,7 +139,7 @@ public class SubjectDerivedAttributeValuesFunction extends AbstractIdentifiableI
     }
 
     /** {@inheritDoc} */
-    @Nullable public List<IdPAttributeValue> apply(@Nullable final ProfileRequestContext prc) {
+    @Nullable @Unmodifiable @NotLive public List<IdPAttributeValue> apply(@Nullable final ProfileRequestContext prc) {
         
         Collection<Subject> subjects = CollectionSupport.emptyList();
         
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributesFunction.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributesFunction.java
index a560a211c..7943189d4 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributesFunction.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectDerivedAttributesFunction.java
@@ -36,6 +36,8 @@ import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.context.SubjectContext;
 import net.shibboleth.idp.authn.context.navigate.SubjectCanonicalizationContextSubjectLookupFunction;
 import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -125,7 +127,7 @@ public class SubjectDerivedAttributesFunction extends AbstractIdentifiableInitia
     }
 
     /** {@inheritDoc} */
-    @Nullable public List<IdPAttribute> apply(@Nullable final ProfileRequestContext prc) {
+    @Nullable @Unmodifiable @NotLive public List<IdPAttribute> apply(@Nullable final ProfileRequestContext prc) {
         
         Collection<Subject> subjects = CollectionSupport.emptyList();
         
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java
index ce25458c2..f369e01c3 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/SubjectScriptContextExtender.java
@@ -75,12 +75,8 @@ public class SubjectScriptContextExtender extends AbstractInitializableComponent
             log.debug("SubjectScriptContextExtender could not locate SubjectContext");
         } else {
             final List<Subject> subjects = sc.getSubjects();
-            if (null == subjects) {
-                scriptContext.setAttribute("subjects", null, ScriptContext.ENGINE_SCOPE);
-            } else {
-                scriptContext.setAttribute(
-                        "subjects", subjects.toArray(new Subject[subjects.size()]), ScriptContext.ENGINE_SCOPE);
-            }
+            scriptContext.setAttribute(
+                    "subjects", subjects.toArray(new Subject[subjects.size()]), ScriptContext.ENGINE_SCOPE);
         }
     }
 
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java
index 2faa71cc8..8845e5e2b 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/context/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes related to authentication contexts.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.context.impl;
 
-package net.shibboleth.idp.authn.context.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoAuthAPI.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoAuthAPI.java
index 05dd42335..1722f20e7 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoAuthAPI.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoAuthAPI.java
@@ -50,6 +50,9 @@ import net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrate
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -336,7 +339,8 @@ public class ValidateDuoAuthAPI extends AbstractAuditingValidationAction {
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Map<String,String> getAuditFields(@Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
+            @Nonnull final ProfileRequestContext profileRequestContext) {
         final Map<String,String> fields = new HashMap<>();
         
         if (username != null) {
@@ -356,7 +360,7 @@ public class ValidateDuoAuthAPI extends AbstractAuditingValidationAction {
             }
         }
         
-        return Map.copyOf(fields);
+        return CollectionSupport.copyToMap(fields);
     }
     
 }
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoWebResponse.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoWebResponse.java
index 8525c2203..2530e1bb3 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoWebResponse.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/ValidateDuoWebResponse.java
@@ -47,6 +47,8 @@ import net.shibboleth.idp.profile.IdPAuditFields;
 import net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -233,7 +235,8 @@ public class ValidateDuoWebResponse extends AbstractAuditingValidationAction {
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Map<String,String> getAuditFields(@Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
+            @Nonnull final ProfileRequestContext profileRequestContext) {
         
         if (username != null) {
             if (duoIntegration != null) {
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/package-info.java
index eb1684d79..d8616a9b3 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/duo/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation of Duo authentication.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.duo.impl;
 
-package net.shibboleth.idp.authn.duo.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AbstractAuditingValidationAction.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AbstractAuditingValidationAction.java
index ad3a76a55..33c3d0c33 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AbstractAuditingValidationAction.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AbstractAuditingValidationAction.java
@@ -36,7 +36,8 @@ import net.shibboleth.idp.authn.context.AuthenticationErrorContext;
 import net.shibboleth.idp.profile.audit.impl.PopulateAuditContext;
 import net.shibboleth.idp.profile.audit.impl.WriteAuditLog;
 import net.shibboleth.profile.context.AuditContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -201,7 +202,7 @@ public abstract class AbstractAuditingValidationAction extends AbstractValidatio
      * @param profileRequestContext profile request context
      * @return audit fields
      */
-    @Nullable @NonnullElements protected Map<String,String> getAuditFields(
+    @Nullable @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
             @Nonnull final ProfileRequestContext profileRequestContext) {
         return null;
     }
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java
index 2ce0cab24..b9d985b30 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AttributeSourcedSubjectCanonicalization.java
@@ -43,7 +43,6 @@ import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.SubjectCanonicalizationException;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.idp.authn.principal.IdPAttributePrincipal;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -78,10 +77,10 @@ public class AttributeSourcedSubjectCanonicalization extends AbstractSubjectCano
     private boolean resolveFromSubject;
     
     /** Indexed attributes pulled from subject. */
-    @Nonnull @NonnullElements private Map<String,IdPAttribute> subjectSourcedAttributes;
+    @Nonnull private Map<String,IdPAttribute> subjectSourcedAttributes;
     
     /** Ordered list of attributes to look for and read from. */
-    @Nonnull @NonnullElements private List<String> attributeSourceIds;
+    @Nonnull private List<String> attributeSourceIds;
         
     /** Lookup strategy for {@link AttributeContext} to read from. */
     @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
@@ -128,7 +127,7 @@ public class AttributeSourcedSubjectCanonicalization extends AbstractSubjectCano
      * 
      * @param ids   attribute IDs to read from
      */
-    public void setAttributeSourceIds(@Nonnull @NonnullElements final List<String> ids) {
+    public void setAttributeSourceIds(@Nonnull final List<String> ids) {
         checkSetterPreconditions();
         attributeSourceIds = new ArrayList<>(StringSupport.normalizeStringCollection(ids));
     }
@@ -165,7 +164,8 @@ public class AttributeSourcedSubjectCanonicalization extends AbstractSubjectCano
         }
         
         if (resolveFromSubject) {
-            @Nonnull final Subject subject = Constraint.isNotNull(c14nContext.getSubject(), "Expected a non-null Subject");
+            final Subject subject =
+                    Constraint.isNotNull(c14nContext.getSubject(), "Expected a non-null Subject");
             final Set<IdPAttributePrincipal> subjectSourced = subject.getPrincipals(IdPAttributePrincipal.class);
             if (subjectSourced != null && !subjectSourced.isEmpty()) {
                 subjectSourcedAttributes = new HashMap<>(subjectSourced.size());
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AuthenticationFlowDescriptorManager.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AuthenticationFlowDescriptorManager.java
index 8d6c70d19..e66ed78b0 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AuthenticationFlowDescriptorManager.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/AuthenticationFlowDescriptorManager.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
 import org.springframework.beans.factory.annotation.Autowired;
 
 import net.shibboleth.idp.authn.AuthenticationFlowDescriptor;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.spring.config.IdentifiedComponentManager;
 
 /**
@@ -40,8 +39,7 @@ public class AuthenticationFlowDescriptorManager extends IdentifiedComponentMana
      * @param freeObjects  free-standing objects
      */
     @Autowired
-    public AuthenticationFlowDescriptorManager(
-            @Nullable @NonnullElements final List<AuthenticationFlowDescriptor> freeObjects) {
+    public AuthenticationFlowDescriptorManager(@Nullable final List<AuthenticationFlowDescriptor> freeObjects) {
         super(freeObjects);
     }
 
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DefaultPrincipalDeterminationStrategy.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DefaultPrincipalDeterminationStrategy.java
index 8060a98ff..0e5f4bdbc 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DefaultPrincipalDeterminationStrategy.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DefaultPrincipalDeterminationStrategy.java
@@ -83,7 +83,7 @@ public class DefaultPrincipalDeterminationStrategy<T extends Principal> implemen
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable public T apply(@Nullable final ProfileRequestContext input) {
+    @Nullable public T apply(@Nullable final ProfileRequestContext input) {
         final AuthenticationContext ac = authnContextLookupStrategy.apply(input);
         if (ac == null || ac.getAuthenticationResult() == null) {
             return defaultPrincipal;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DoLockoutManagerOperation.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DoLockoutManagerOperation.java
index 9b442d61d..b3cdee506 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DoLockoutManagerOperation.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/DoLockoutManagerOperation.java
@@ -166,6 +166,7 @@ public class DoLockoutManagerOperation extends AbstractProfileAction {
         return true;
     }
 
+// Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
     @Override protected void doExecute(final @Nonnull ProfileRequestContext profileRequestContext) {
 
@@ -233,6 +234,7 @@ public class DoLockoutManagerOperation extends AbstractProfileAction {
             ActionSupport.buildEvent(profileRequestContext, EventIds.IO_ERROR);
         }
     }
+// Checkstyle: CyclomaticComplexity ON
 
     /**
      * Helper method to get the manager bean to operate on.
@@ -299,4 +301,4 @@ public class DoLockoutManagerOperation extends AbstractProfileAction {
         objectMapper.writer().withDefaultPrettyPrinter().writeValue(response.getOutputStream(), errors);
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractKerberosTicketFromWSSToken.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractKerberosTicketFromWSSToken.java
deleted file mode 100644
index 76d8bf6d7..000000000
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractKerberosTicketFromWSSToken.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements.  See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License.  You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.authn.impl;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.idp.authn.AbstractExtractionAction;
-import net.shibboleth.idp.authn.context.AuthenticationContext;
-
-import org.opensaml.profile.context.ProfileRequestContext;
-
-/**
- * TODO.
- */
-public class ExtractKerberosTicketFromWSSToken extends AbstractExtractionAction {
-
-    /** {@inheritDoc} */
-    protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
-            @Nonnull final AuthenticationContext authenticationContext) {
-        throw new UnsupportedOperationException("Not implemented.");
-    }
-
-}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java
index d235301ea..8f65f77e6 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractRemoteUser.java
@@ -31,7 +31,6 @@ import net.shibboleth.idp.authn.AbstractExtractionAction;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernameContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -56,10 +55,10 @@ public class ExtractRemoteUser extends AbstractExtractionAction {
     private boolean checkRemoteUser;
     
     /** List of request attributes to check for an identity. */
-    @Nonnull @NonnullElements private Collection<String> checkAttributes;
+    @Nonnull private Collection<String> checkAttributes;
 
     /** List of request headers to check for an identity. */
-    @Nonnull @NonnullElements private Collection<String> checkHeaders;
+    @Nonnull private Collection<String> checkHeaders;
     
     /** Constructor. */
     public ExtractRemoteUser() {
@@ -83,7 +82,7 @@ public class ExtractRemoteUser extends AbstractExtractionAction {
      * 
      * @param attributes    list of request attributes to check
      */
-    public void setCheckAttributes(@Nullable @NonnullElements final Collection<String> attributes) {
+    public void setCheckAttributes(@Nullable final Collection<String> attributes) {
         checkSetterPreconditions();
         checkAttributes = StringSupport.normalizeStringCollection(attributes);
     }
@@ -93,7 +92,7 @@ public class ExtractRemoteUser extends AbstractExtractionAction {
      * 
      * @param headers list of request headers to check
      */
-    public void setCheckHeaders(@Nullable @NonnullElements final Collection<String> headers) {
+    public void setCheckHeaders(@Nullable final Collection<String> headers) {
         checkSetterPreconditions();
         checkHeaders = StringSupport.normalizeStringCollection(headers);
     }
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java
index 0c10c3ca7..444ce6121 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromFormRequest.java
@@ -99,7 +99,6 @@ public class ExtractUsernamePasswordFromFormRequest extends AbstractExtractionAc
     }
     
     /** {@inheritDoc} */
-    // CheckStyle: ReturnCount OFF
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
@@ -140,5 +139,5 @@ public class ExtractUsernamePasswordFromFormRequest extends AbstractExtractionAc
             authenticationContext.setResultCacheable(false);
         }
     }
-    // CheckStyle: ReturnCount ON
+
 }
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromWSSToken.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromWSSToken.java
index ef0cf1457..788bfa358 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromWSSToken.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ExtractUsernamePasswordFromWSSToken.java
@@ -17,7 +17,6 @@
 
 package net.shibboleth.idp.authn.impl;
 
-
 import java.util.Iterator;
 import java.util.List;
 
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
index c5d4cc0db..cd1438c76 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/FinalizeAuthentication.java
@@ -280,7 +280,8 @@ public class FinalizeAuthentication extends AbstractAuthenticationAction {
             return null;
         }
         
-        final AuthenticationFlowDescriptor flowDescriptor = authenticationContext.getAvailableFlows().get(ar.getAuthenticationFlowId());
+        final AuthenticationFlowDescriptor flowDescriptor =
+                authenticationContext.getAvailableFlows().get(ar.getAuthenticationFlowId());
         return flowDescriptor.getHighestWeighted(matches);
     }
 
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
index d110dc50d..2508d53c4 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
@@ -46,7 +46,9 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernamePasswordContext;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.StringDigester;
 import net.shibboleth.shared.codec.StringDigester.OutputFormat;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -75,7 +77,7 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
     private long lastModified;
     
     /** In-memory copy of entries. */
-    @Nonnull @NonnullElements private final Map<String,String> credentialMap;
+    @Nonnull private final Map<String,String> credentialMap;
     
     /** Constructor. */
     public HTPasswdCredentialValidator() {
@@ -204,8 +206,7 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
         }
         
         try {
-            if (resource.isFile() && resource.exists()
-                    && (resource.lastModified() > lastModified)) {
+            if (resource.isFile() && resource.exists() && resource.lastModified() > lastModified) {
                 try (final InputStream is = resource.getInputStream()) {
                     credentialMap.clear();
                     credentialMap.putAll(readCredentials(is));
@@ -223,7 +224,7 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
      * 
      * @return map of credentials
      */
-    @Nonnull @NonnullElements private Map<String,String> readCredentials(@Nonnull final InputStream is) {
+    @Nonnull @Unmodifiable @NotLive private Map<String,String> readCredentials(@Nonnull final InputStream is) {
         
         final Map<String,String> credentials = new HashMap<>();
         
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java
index a0a54d430..a29e717f9 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/JAASCredentialValidator.java
@@ -46,7 +46,6 @@ import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.context.UsernamePasswordContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -80,10 +79,10 @@ public class JAASCredentialValidator extends AbstractUsernamePasswordCredentialV
     @Nullable private Configuration.Parameters loginConfigParameters;
     
     /** Holder for simple configurations defined by name. */
-    @Nonnull @NonnullElements private Collection<String> loginConfigNames;
+    @Nonnull private Collection<String> loginConfigNames;
     
     /** Application name(s) in JAAS configuration to use. */
-    @Nonnull @NonnullElements private Collection<Pair<String,Subject>> loginConfigurations;
+    @Nonnull private Collection<Pair<String,Subject>> loginConfigurations;
     
     /** Strategy function to dynamically derive the login config(s) to use. */
     @Nullable private Function<ProfileRequestContext,Collection<Pair<String,Subject>>> loginConfigStrategy;
@@ -180,7 +179,7 @@ public class JAASCredentialValidator extends AbstractUsernamePasswordCredentialV
      * 
      * @param names list of JAAS application names to use
      */
-    public void setLoginConfigNames(@Nullable @NonnullElements final Collection<String> names) {
+    public void setLoginConfigNames(@Nullable final Collection<String> names) {
         checkSetterPreconditions();
         loginConfigNames = StringSupport.normalizeStringCollection(names);
     }
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
index 49109bce1..e75454c7a 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateAuthenticationContext.java
@@ -32,7 +32,6 @@ import net.shibboleth.idp.authn.config.navigate.AuthenticationFlowsLookupFunctio
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -57,7 +56,7 @@ public class PopulateAuthenticationContext extends AbstractAuthenticationAction
     @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateAuthenticationContext.class);
     
     /** All of the known flows in the system. */
-    @Nonnull @NonnullElements private Collection<AuthenticationFlowDescriptor> availableFlows;
+    @Nonnull private Collection<AuthenticationFlowDescriptor> availableFlows;
 
     /** Lookup function for the flows to make available for possible use. */
     @Nonnull
@@ -84,7 +83,7 @@ public class PopulateAuthenticationContext extends AbstractAuthenticationAction
      * 
      * @param flows the flows known to the system
      */
-    public void setAvailableFlows(@Nonnull @NonnullElements final Collection<AuthenticationFlowDescriptor> flows) {
+    public void setAvailableFlows(@Nonnull final Collection<AuthenticationFlowDescriptor> flows) {
         checkSetterPreconditions();
         availableFlows = CollectionSupport.copyToList(Constraint.isNotNull(flows, "Flow collection cannot be null"));
     }
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
index c3457df7c..ba0a3d3eb 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateMultiFactorAuthenticationContext.java
@@ -240,7 +240,8 @@ public class PopulateMultiFactorAuthenticationContext extends AbstractAuthentica
             if (descriptor != null) {
                 if (descriptor.test(profileRequestContext)) {
                     if (descriptor.isResultActive(candidate)) {
-                        final BiPredicate<ProfileRequestContext, AuthenticationResult> revocationCondition = descriptor.getRevocationCondition();
+                        final BiPredicate<ProfileRequestContext, AuthenticationResult> revocationCondition =
+                                descriptor.getRevocationCondition();
                         if (authenticationContext.getMaxAge() != null
                                 && candidate.getAuthenticationInstant().plus(
                                         authenticationContext.getMaxAge()).isBefore(Instant.now())) {
@@ -268,4 +269,4 @@ public class PopulateMultiFactorAuthenticationContext extends AbstractAuthentica
         }
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateSubjectCanonicalizationContext.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateSubjectCanonicalizationContext.java
index df5562346..762fb2824 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateSubjectCanonicalizationContext.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PopulateSubjectCanonicalizationContext.java
@@ -27,7 +27,6 @@ import org.slf4j.Logger;
 import net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction;
 import net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -46,7 +45,7 @@ public class PopulateSubjectCanonicalizationContext extends AbstractSubjectCanon
     @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateSubjectCanonicalizationContext.class);
     
     /** The flows to make available for possible use. */
-    @Nonnull @NonnullElements private Collection<SubjectCanonicalizationFlowDescriptor> availableFlows;
+    @Nonnull private Collection<SubjectCanonicalizationFlowDescriptor> availableFlows;
 
     /** Constructor. */
     PopulateSubjectCanonicalizationContext() {
@@ -58,8 +57,7 @@ public class PopulateSubjectCanonicalizationContext extends AbstractSubjectCanon
      * 
      * @param flows the flows available for possible use
      */
-    public void setAvailableFlows(
-            @Nonnull @NonnullElements final Collection<SubjectCanonicalizationFlowDescriptor> flows) {
+    public void setAvailableFlows(@Nonnull final Collection<SubjectCanonicalizationFlowDescriptor> flows) {
         checkSetterPreconditions();
         availableFlows = CollectionSupport.copyToList(Constraint.isNotNull(flows, "Flow collection cannot be null"));
     }
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PreserveAuthenticationFlowState.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PreserveAuthenticationFlowState.java
index 233b31024..36372ff08 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PreserveAuthenticationFlowState.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/PreserveAuthenticationFlowState.java
@@ -31,7 +31,6 @@ import org.slf4j.Logger;
 import jakarta.servlet.http.HttpServletRequest;
 import net.shibboleth.idp.authn.AbstractAuthenticationAction;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -53,7 +52,7 @@ public class PreserveAuthenticationFlowState extends AbstractAuthenticationActio
     @Nonnull private final Logger log = LoggerFactory.getLogger(PreserveAuthenticationFlowState.class);
     
     /** Parameter names to look for. */
-    @Nonnull @NonnullElements private Collection<String> parameterNames;
+    @Nonnull private Collection<String> parameterNames;
     
     /** Constructor. */
     PreserveAuthenticationFlowState() {
@@ -65,7 +64,7 @@ public class PreserveAuthenticationFlowState extends AbstractAuthenticationActio
      * 
      * @param names parameter names
      */
-    public void setParameterNames(@Nullable @NonnullElements final Collection<String> names) {
+    public void setParameterNames(@Nullable final Collection<String> names) {
         checkSetterPreconditions();
         if (names == null) {
             parameterNames = CollectionSupport.emptyList();
@@ -97,8 +96,7 @@ public class PreserveAuthenticationFlowState extends AbstractAuthenticationActio
 
         final Map<String,Object> state = authenticationContext.getAuthenticationStateMap();
         state.clear();
-        final HttpServletRequest request = getHttpServletRequest();
-        assert request != null;
+        final HttpServletRequest request = ensureHttpServletRequest();
 
         final Map<String,String[]> params = request.getParameterMap();
         for (final String name : parameterNames) {
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java
index 1df06af79..876d0261b 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RelyingPartyMapJAASLoginConfigStrategy.java
@@ -31,6 +31,8 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.AbstractRelyingPartyLookupFunction;
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.logic.Constraint;
@@ -84,7 +86,7 @@ public class RelyingPartyMapJAASLoginConfigStrategy
     }
 
     /** {@inheritDoc} */
-    @Nonnull public Collection<Pair<String, Subject>> apply(
+    @Nonnull @Unmodifiable @NotLive public Collection<Pair<String, Subject>> apply(
             final @Nullable ProfileRequestContext profileRequestContext) {
 
         final RelyingPartyContext relyingPartyContext =
@@ -109,4 +111,4 @@ public class RelyingPartyMapJAASLoginConfigStrategy
         return CollectionSupport.singleton(new Pair<>(defaultConfigName, (Subject)null));
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java
index 03fe1407b..8e3148d37 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/RemoteUserAuthServlet.java
@@ -43,7 +43,6 @@ import net.shibboleth.idp.authn.ExternalAuthentication;
 import net.shibboleth.idp.authn.ExternalAuthenticationException;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -91,10 +90,10 @@ public class RemoteUserAuthServlet extends HttpServlet {
     private boolean checkRemoteUser;
     
     /** List of request attributes to check for an identity. */
-    @Nonnull @NonnullElements private Collection<String> checkAttributes;
+    @Nonnull private Collection<String> checkAttributes;
 
     /** List of request headers to check for an identity. */
-    @Nonnull @NonnullElements private Collection<String> checkHeaders;
+    @Nonnull private Collection<String> checkHeaders;
     
     /** Request attribute to check for a {@link Subject}. */
     @Nullable @NotEmpty private String subjectAttribute;
@@ -126,7 +125,7 @@ public class RemoteUserAuthServlet extends HttpServlet {
      * 
      * @param attributes    list of request attributes to check
      */
-    public void setCheckAttributes(@Nonnull @NonnullElements final Collection<String> attributes) {
+    public void setCheckAttributes(@Nonnull final Collection<String> attributes) {
         checkAttributes = CollectionSupport.copyToList(attributes);
     }
 
@@ -135,7 +134,7 @@ public class RemoteUserAuthServlet extends HttpServlet {
      * 
      * @param headers list of request headers to check
      */
-    public void setCheckHeaders(@Nonnull @NonnullElements final Collection<String> headers) {
+    public void setCheckHeaders(@Nonnull final Collection<String> headers) {
         checkHeaders = CollectionSupport.copyToList(headers);
     }
     
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
index 74839b7e0..f5bcbd70f 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SelectAuthenticationFlow.java
@@ -36,7 +36,6 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.PreferredPrincipalContext;
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 
 /**
  * An authentication action that selects an authentication flow to invoke, or re-uses an
@@ -477,7 +476,7 @@ public class SelectAuthenticationFlow extends AbstractAuthenticationAction {
      */
     private void selectRequestedFlow(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext,
-            @Nonnull @NonnullElements final Map<String,AuthenticationResult> activeResults) {
+            @Nonnull final Map<String,AuthenticationResult> activeResults) {
 
         final RequestedPrincipalContext rpCtx = requestedPrincipalCtx;
         assert rpCtx != null;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SimpleSubjectCanonicalization.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SimpleSubjectCanonicalization.java
index 0a4dc87b9..dc792f190 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SimpleSubjectCanonicalization.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/SimpleSubjectCanonicalization.java
@@ -46,9 +46,6 @@ import net.shibboleth.idp.authn.principal.UsernamePrincipal;
  */
 public class SimpleSubjectCanonicalization extends AbstractSubjectCanonicalizationAction {
 
-    /** Class logger. */
-   // @Nonnull private final Logger log = LoggerFactory.getLogger(SelectAuthenticationFlow.class);
-
     /** Supplies logic for pre-execute test. */
     @Nonnull private final ActivationCondition embeddedPredicate;
     
@@ -142,4 +139,4 @@ public class SimpleSubjectCanonicalization extends AbstractSubjectCanonicalizati
         
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
index 7486e6ffe..f191c58b6 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/StorageBackedAccountLockoutManager.java
@@ -297,7 +297,7 @@ public class StorageBackedAccountLockoutManager extends AbstractIdentifiableInit
         return false;
     }
     
-// Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity|MethodLength OFF
     /**
      * Implement invalid login attempt counter via storage service, retrying as necessary.
      * 
@@ -379,7 +379,7 @@ public class StorageBackedAccountLockoutManager extends AbstractIdentifiableInit
         
         return doIncrement(profileRequestContext, key, retries-1);
     }
-// Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity|MethodLength ON
     
     /**
      * A function to generate a key for lockout storage. This effectively defines
@@ -454,4 +454,4 @@ public class StorageBackedAccountLockoutManager extends AbstractIdentifiableInit
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
index d02a767a0..ffb23def9 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/TransitionMultiFactorAuthentication.java
@@ -323,4 +323,4 @@ public class TransitionMultiFactorAuthentication extends AbstractAuthenticationA
     }
 // Checkstyle: CyclomaticComplexity ON
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java
index 7a36492c0..e8c3b0122 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateCredentials.java
@@ -41,8 +41,9 @@ import net.shibboleth.idp.authn.CredentialValidator.ErrorHandler;
 import net.shibboleth.idp.authn.CredentialValidator.WarningHandler;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernamePasswordContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -64,7 +65,7 @@ public class ValidateCredentials extends AbstractAuditingValidationAction implem
     @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateCredentials.class);
     
     /** Ordered list of validators. */
-    @Nonnull @NonnullElements private List<CredentialValidator> credentialValidators;
+    @Nonnull private List<CredentialValidator> credentialValidators;
     
     /** Whether all validators must succeed. */
     private boolean requireAll;
@@ -73,7 +74,7 @@ public class ValidateCredentials extends AbstractAuditingValidationAction implem
     @Nullable private AccountLockoutManager lockoutManager;
     
     /** Results from successful validators. */
-    @Nonnull @NonnullElements private Collection<Subject> results;
+    @Nonnull private Collection<Subject> results;
     
     /** Currently executing validator. */
     @Nullable private CredentialValidator currentValidator;
@@ -106,7 +107,7 @@ public class ValidateCredentials extends AbstractAuditingValidationAction implem
      * 
      * @param validators validators to use
      */
-    public void setValidators(@Nullable @NonnullElements final List<CredentialValidator> validators) {
+    public void setValidators(@Nullable final List<CredentialValidator> validators) {
         checkSetterPreconditions();
         if (validators != null) {
             credentialValidators = CollectionSupport.copyToList(validators);
@@ -270,11 +271,11 @@ public class ValidateCredentials extends AbstractAuditingValidationAction implem
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements protected Map<String,String> getAuditFields(
+    @Nonnull @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
             @Nonnull final ProfileRequestContext profileRequestContext) {
         // only called in execute when we know the field is non-null
         assert currentValidator!=null;
-        return Map.of(AuthnAuditFields.CREDENTIAL_VALIDATOR, currentValidator.getId());
+        return CollectionSupport.singletonMap(AuthnAuditFields.CREDENTIAL_VALIDATOR, currentValidator.getId());
     }
     
     /**
@@ -301,4 +302,4 @@ public class ValidateCredentials extends AbstractAuditingValidationAction implem
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
index 488153709..5d6230c4e 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateExternalAuthentication.java
@@ -53,6 +53,8 @@ import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.idp.profile.IdPAuditFields;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -320,7 +322,8 @@ public class ValidateExternalAuthentication extends AbstractAuditingValidationAc
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Map<String,String> getAuditFields(@Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
+            @Nonnull final ProfileRequestContext profileRequestContext) {
         final Subject subject;
         if (extContext != null) {
             subject = extContext.getSubject();
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateFunctionResult.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateFunctionResult.java
index 2dfc52fc3..c58ab16df 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateFunctionResult.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateFunctionResult.java
@@ -36,6 +36,8 @@ import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.idp.profile.IdPAuditFields;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -159,7 +161,8 @@ public class ValidateFunctionResult extends AbstractAuditingValidationAction {
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Map<String,String> getAuditFields(@Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
+            @Nonnull final ProfileRequestContext profileRequestContext) {
         
         if (result instanceof String) {
             return CollectionSupport.singletonMap(IdPAuditFields.USERNAME, (String) result);
@@ -192,4 +195,4 @@ public class ValidateFunctionResult extends AbstractAuditingValidationAction {
         return null;
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
index f4fead2b2..d8d357697 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateRemoteUser.java
@@ -34,7 +34,6 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernameContext;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -62,10 +61,10 @@ public class ValidateRemoteUser extends AbstractAuditingValidationAction {
     @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateRemoteUser.class);
     
     /** Usernames to accept. */
-    @Nonnull @NonnullElements private Set<String> allowedUsernames;
+    @Nonnull private Set<String> allowedUsernames;
 
     /** Usernames to deny. */
-    @Nonnull @NonnullElements private Set<String> deniedUsernames;
+    @Nonnull private Set<String> deniedUsernames;
 
     /** A regular expression to apply for acceptance testing. */
     @Nullable private Pattern matchExpression;
@@ -85,7 +84,7 @@ public class ValidateRemoteUser extends AbstractAuditingValidationAction {
      * 
      * @param allowed usernames to allow
      */
-    public void setAllowedUsernames(@Nullable @NonnullElements final Collection<String> allowed) {
+    public void setAllowedUsernames(@Nullable final Collection<String> allowed) {
         checkSetterPreconditions();
         allowedUsernames = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(allowed));
     }
@@ -95,7 +94,7 @@ public class ValidateRemoteUser extends AbstractAuditingValidationAction {
      * 
      * @param denied usernames to deny
      */
-    public void setDeniedUsernames(@Nullable @NonnullElements final Collection<String> denied) {
+    public void setDeniedUsernames(@Nullable final Collection<String> denied) {
         checkSetterPreconditions();
         deniedUsernames = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(denied));
     }
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
index c0b0230ff..edfd1220f 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUserAgentAddress.java
@@ -39,8 +39,9 @@ import net.shibboleth.idp.authn.context.UserAgentContext;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
 import net.shibboleth.idp.profile.IdPAuditFields;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.net.IPRange;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -66,7 +67,7 @@ public class ValidateUserAgentAddress extends AbstractAuditingValidationAction {
     @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateUserAgentAddress.class);
 
     /** Map of IP ranges to principal names. */
-    @Nonnull @NonnullElements private Map<String,Collection<IPRange>> mappings;
+    @Nonnull private Map<String,Collection<IPRange>> mappings;
 
     /** User Agent context containing address to evaluate. */
     @NonnullBeforeExec private UserAgentContext uaContext;
@@ -85,7 +86,7 @@ public class ValidateUserAgentAddress extends AbstractAuditingValidationAction {
      * 
      * @param newMappings the IP range(s) to authenticate as particular principals
      */
-    public void setMappings(@Nullable @NonnullElements final Map<String,Collection<IPRange>> newMappings) {
+    public void setMappings(@Nullable final Map<String,Collection<IPRange>> newMappings) {
         checkSetterPreconditions();
         if (newMappings != null) {
             mappings = new HashMap<>(newMappings.size());
@@ -161,8 +162,7 @@ public class ValidateUserAgentAddress extends AbstractAuditingValidationAction {
      * 
      * @return true if the given IP address meets this stage's IP range requirements, false otherwise
      */
-    private boolean isAuthenticated(@Nonnull final InetAddress address,
-            @Nonnull @NonnullElements final Collection<IPRange> ranges) {
+    private boolean isAuthenticated(@Nonnull final InetAddress address, @Nonnull final Collection<IPRange> ranges) {
         final byte[] resolvedAddress = address.getAddress();
         assert resolvedAddress != null;
         for (final IPRange range : ranges) {
@@ -185,12 +185,13 @@ public class ValidateUserAgentAddress extends AbstractAuditingValidationAction {
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Map<String, String> getAuditFields(@Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable @Unmodifiable @NotLive protected Map<String,String> getAuditFields(
+            @Nonnull final ProfileRequestContext profileRequestContext) {
         if (principalName != null) {
-            return Map.of(IdPAuditFields.USERNAME, principalName);
+            return CollectionSupport.singletonMap(IdPAuditFields.USERNAME, principalName);
         }
         
         return super.getAuditFields(profileRequestContext);
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java
index ee87bb4c3..f68b480a6 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X500SubjectCanonicalization.java
@@ -41,7 +41,6 @@ import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.SubjectCanonicalizationException;
 import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -75,10 +74,10 @@ public class X500SubjectCanonicalization extends AbstractSubjectCanonicalization
     @Nonnull private final Logger log = LoggerFactory.getLogger(X500SubjectCanonicalization.class);
     
     /** subjectAltName types to search for. */
-    @Nonnull @NonnullElements private List<Integer> subjectAltNameTypes;
+    @Nonnull private List<Integer> subjectAltNameTypes;
     
     /** OIDs to search for. */
-    @Nonnull @NonnullElements private List<String> objectIds;
+    @Nonnull private List<String> objectIds;
     
     /** The certificate to operate on. */
     @Nullable private X509Certificate certificate;
@@ -97,7 +96,7 @@ public class X500SubjectCanonicalization extends AbstractSubjectCanonicalization
      * 
      * @param types types to search for
      */
-    public void setSubjectAltNameTypes(@Nullable @NonnullElements final List<Integer> types) {
+    public void setSubjectAltNameTypes(@Nullable final List<Integer> types) {
         checkSetterPreconditions();
         if (types != null) {
             subjectAltNameTypes = CollectionSupport.copyToList(types);
@@ -111,7 +110,7 @@ public class X500SubjectCanonicalization extends AbstractSubjectCanonicalization
      * 
      * @param ids RDN OIDs to search for
      */
-    public void setObjectIds(@Nullable @NonnullElements final List<String> ids) {
+    public void setObjectIds(@Nullable final List<String> ids) {
         checkSetterPreconditions();
         objectIds = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(ids));
     }
@@ -270,4 +269,4 @@ public class X500SubjectCanonicalization extends AbstractSubjectCanonicalization
         
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java
index fbcf60ff4..590c3fbb8 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509AuthServlet.java
@@ -229,4 +229,4 @@ public class X509AuthServlet extends HttpServlet {
     }
 // Checkstyle: CyclomaticComplexity|MethodLength ON
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java
index ffeaee668..116dc9048 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509CertificateCredentialValidator.java
@@ -184,4 +184,4 @@ public class X509CertificateCredentialValidator extends AbstractCredentialValida
         return super.populateSubject(subject);
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ProxyFilter.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ProxyFilter.java
index a0c62d597..303a5180f 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ProxyFilter.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ProxyFilter.java
@@ -30,7 +30,6 @@ import javax.annotation.Nullable;
 import org.opensaml.security.x509.X509Support;
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -65,7 +64,7 @@ public class X509ProxyFilter implements Filter {
     @Nullable @NotEmpty private String leafHeader;
 
     /** Name of headers containing chain certificates. */
-    @Nonnull @NonnullElements private Collection<String> chainHeaders;
+    @Nonnull private Collection<String> chainHeaders;
 
     /** Constructor. */
     public X509ProxyFilter() {
@@ -146,4 +145,4 @@ public class X509ProxyFilter implements Filter {
         
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ResourceCredentialConfig.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ResourceCredentialConfig.java
index 08a7bb686..6f59d428c 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ResourceCredentialConfig.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/X509ResourceCredentialConfig.java
@@ -89,7 +89,7 @@ public class X509ResourceCredentialConfig implements CredentialConfig {
     }
 
     /** {@inheritDoc} */
-    @Override public SSLContextInitializer createSSLContextInitializer() throws GeneralSecurityException {
+    @Nonnull public SSLContextInitializer createSSLContextInitializer() throws GeneralSecurityException {
         final X509SSLContextInitializer sslInit = new X509SSLContextInitializer();
         try {
             if (trustCertificates != null) {
@@ -109,4 +109,5 @@ public class X509ResourceCredentialConfig implements CredentialConfig {
         }
         return sslInit;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/package-info.java
index 707d18c63..1d13ca04a 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementation of various authentication actions. */
-package net.shibboleth.idp.authn.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.authn.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/InexactPrincipalEvalPredicateFactory.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/InexactPrincipalEvalPredicateFactory.java
index fd8be4a6d..5a803d11f 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/InexactPrincipalEvalPredicateFactory.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/InexactPrincipalEvalPredicateFactory.java
@@ -30,7 +30,6 @@ import net.shibboleth.idp.authn.principal.PrincipalEvalPredicate;
 import net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactory;
 import net.shibboleth.idp.authn.principal.PrincipalSupportingComponent;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 
 import com.google.common.base.Strings;
@@ -53,7 +52,7 @@ import com.google.common.collect.Multimap;
 public class InexactPrincipalEvalPredicateFactory implements PrincipalEvalPredicateFactory {
 
     /** Rules for matching. */
-    @Nonnull @NonnullElements private final HashMultimap<String,String> matchingRules;
+    @Nonnull private final HashMultimap<String,String> matchingRules;
 
     /** Constructor. */
     InexactPrincipalEvalPredicateFactory() {
@@ -67,7 +66,7 @@ public class InexactPrincipalEvalPredicateFactory implements PrincipalEvalPredic
      * 
      * @return  a mutable multimap of the matching rules to apply
      */
-    @Nonnull @NonnullElements @Live Multimap<String,String> getMatchingRules() {
+    @Nonnull @Live Multimap<String,String> getMatchingRules() {
         return matchingRules;
     }
     
@@ -78,7 +77,7 @@ public class InexactPrincipalEvalPredicateFactory implements PrincipalEvalPredic
      * 
      * @param rules matching rules
      */
-    public void setMatchingRules(@Nonnull @NonnullElements final Map<String,Collection<String>> rules) {
+    public void setMatchingRules(@Nonnull final Map<String,Collection<String>> rules) {
         Constraint.isNotNull(rules, "Map cannot be null");
         matchingRules.clear();
         
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java
index 7fbefc5ab..afc05f5d1 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/X500PrincipalSerializer.java
@@ -69,7 +69,7 @@ public class X500PrincipalSerializer extends AbstractPrincipalSerializer<String>
 
         final String name;
         try {
-            final byte encoded[] = x500Principal.getEncoded();
+            final byte[] encoded = x500Principal.getEncoded();
             assert encoded != null;
             name = Base64Support.encode(encoded, false);
         } catch (final EncodingException e) {
@@ -113,5 +113,5 @@ public class X500PrincipalSerializer extends AbstractPrincipalSerializer<String>
             throw new IOException("Found invalid data while parsing X500Principal", e);
         }
     }    
-}
- 
+
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/package-info.java
index 5b32bc508..4359a9f18 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/principal/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementation of functionality related to Java Principals. */
-package net.shibboleth.idp.authn.principal.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.authn.principal.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/DiscoveryProfileRequestFunction.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/DiscoveryProfileRequestFunction.java
index 5284da8aa..56a72cb0c 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/DiscoveryProfileRequestFunction.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/DiscoveryProfileRequestFunction.java
@@ -101,7 +101,7 @@ public class DiscoveryProfileRequestFunction extends AbstractInitializableCompon
     }
     
     /** {@inheritDoc} */
-    @Nullable public String apply(final @Nullable Pair<RequestContext,ProfileRequestContext> input) {
+    @Nullable public String apply(@Nullable final Pair<RequestContext,ProfileRequestContext> input) {
         
         assert input != null;
         final RelyingPartyContext rpCtx = relyingPartyContextLookupStrategy.apply(input.getSecond());
@@ -149,4 +149,4 @@ public class DiscoveryProfileRequestFunction extends AbstractInitializableCompon
         return builder.toString();
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/package-info.java
index 01021bc61..1c2c4ab6d 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/proxy/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes implementing proxied authentication flows.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.proxy.impl;
 
-package net.shibboleth.idp.authn.proxy.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/AttributeRevocationCondition.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/AttributeRevocationCondition.java
index 52a862857..6192b06c4 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/AttributeRevocationCondition.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/AttributeRevocationCondition.java
@@ -41,7 +41,6 @@ import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
@@ -250,7 +249,7 @@ public class AttributeRevocationCondition extends AbstractInitializableComponent
      * @return true iff the revocation applies to this result
      */
     protected boolean isRevoked(@Nonnull @NotEmpty final String principal, @Nonnull final AuthenticationResult result,
-            @Nonnull @NonnullElements final Collection<Instant> revocationRecords) {
+            @Nonnull final Collection<Instant> revocationRecords) {
         
         for (final Instant i : revocationRecords) {
             if (result.getAuthenticationInstant().isBefore(i)) {
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/DoRevocationCacheOperation.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/DoRevocationCacheOperation.java
index d762d8773..fdbc1abb2 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/DoRevocationCacheOperation.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/DoRevocationCacheOperation.java
@@ -369,4 +369,4 @@ public class DoRevocationCacheOperation extends AbstractProfileAction {
         objectMapper.writer().withDefaultPrettyPrinter().writeValue(response.getOutputStream(), errors);
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java
index 52cc8852b..cdfe19618 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/RevocationCacheCondition.java
@@ -34,7 +34,6 @@ import org.slf4j.Logger;
 
 import net.shibboleth.idp.authn.AuthenticationResult;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -178,7 +177,7 @@ public class RevocationCacheCondition extends AbstractInitializableComponent
      * @return true iff the revocation applies to this result
      */
     protected boolean isRevoked(@Nonnull @NotEmpty final String principal, @Nonnull final AuthenticationResult result,
-            @Nonnull @NonnullElements final Collection<String> revocationRecords) {
+            @Nonnull final Collection<String> revocationRecords) {
         
         for (final String r : revocationRecords) {
             if (result.getAuthenticationInstant().isBefore(Instant.ofEpochSecond(Long.valueOf(r)))) {
@@ -191,4 +190,4 @@ public class RevocationCacheCondition extends AbstractInitializableComponent
         return false;
     }
     
-}
+}
\ No newline at end of file
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java
index 8c0471a45..89a976f84 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/revocation/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Predicates related to authentication.
  */
+ at NonnullElements
+package net.shibboleth.idp.authn.revocation.impl;
 
-package net.shibboleth.idp.authn.revocation.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/KerberosSettings.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/KerberosSettings.java
index 9232753b8..1a1a7d5e4 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/KerberosSettings.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/KerberosSettings.java
@@ -22,7 +22,6 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -42,7 +41,7 @@ public class KerberosSettings {
     private boolean refreshKrb5Config;
 
     /** List of realms (KerberosRealmSettings objects). */
-    @Nonnull @NonnullElements private Collection<KerberosRealmSettings> realmSettings;
+    @Nonnull private Collection<KerberosRealmSettings> realmSettings;
 
     /** Constructor. */
     public KerberosSettings() {
@@ -92,7 +91,7 @@ public class KerberosSettings {
      * 
      * @param realms realms to set.
      */
-    public void setRealms(@Nullable @NonnullElements final Collection<KerberosRealmSettings> realms) {
+    public void setRealms(@Nullable final Collection<KerberosRealmSettings> realms) {
         if (realms != null) {
             realmSettings = CollectionSupport.copyToList(realms);
         } else {
@@ -105,7 +104,7 @@ public class KerberosSettings {
      * 
      * @return list of realms
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<KerberosRealmSettings> getRealms() {
+    @Nonnull @NotLive @Unmodifiable public Collection<KerberosRealmSettings> getRealms() {
         return realmSettings;
     }
     
diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/package-info.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/package-info.java
index 67caa4bb4..8c93edcb4 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/package-info.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementation of SPNEGO authentication flow. */
-package net.shibboleth.idp.authn.spnego.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.authn.spnego.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthenticationMethodPrincipal.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthenticationMethodPrincipal.java
index 26893b3f2..aa9eda283 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthenticationMethodPrincipal.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthenticationMethodPrincipal.java
@@ -44,7 +44,6 @@ public final class AuthenticationMethodPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return authnMethod;
     }
@@ -80,8 +79,7 @@ public final class AuthenticationMethodPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
-    public AuthenticationMethodPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public AuthenticationMethodPrincipal clone() throws CloneNotSupportedException {
         final AuthenticationMethodPrincipal copy = (AuthenticationMethodPrincipal) super.clone();
         copy.authnMethod = authnMethod;
         return copy;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextClassRefPrincipal.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextClassRefPrincipal.java
index bf2c9392b..ae15414c2 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextClassRefPrincipal.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextClassRefPrincipal.java
@@ -47,7 +47,6 @@ public final class AuthnContextClassRefPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return authnContextClassRef;
     }
@@ -96,8 +95,7 @@ public final class AuthnContextClassRefPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
-    public AuthnContextClassRefPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public AuthnContextClassRefPrincipal clone() throws CloneNotSupportedException {
         final AuthnContextClassRefPrincipal copy = (AuthnContextClassRefPrincipal) super.clone();
         copy.authnContextClassRef = authnContextClassRef;
         return copy;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclPrincipal.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclPrincipal.java
index 5ed488886..92860c36f 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclPrincipal.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclPrincipal.java
@@ -58,7 +58,6 @@ public final class AuthnContextDeclPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return name;
     }
@@ -103,8 +102,7 @@ public final class AuthnContextDeclPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
-    public AuthnContextDeclPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public AuthnContextDeclPrincipal clone() throws CloneNotSupportedException {
         final AuthnContextDeclPrincipal copy = (AuthnContextDeclPrincipal) super.clone();
         try {
             copy.authnContextDecl = XMLObjectSupport.cloneXMLObject(authnContextDecl, 
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclRefPrincipal.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclRefPrincipal.java
index e919f595e..fa1438d83 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclRefPrincipal.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/AuthnContextDeclRefPrincipal.java
@@ -47,7 +47,6 @@ public final class AuthnContextDeclRefPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nonnull @NotEmpty public String getName() {
         return authnContextDeclRef;
     }
@@ -96,8 +95,7 @@ public final class AuthnContextDeclRefPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override
-    public AuthnContextDeclRefPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public AuthnContextDeclRefPrincipal clone() throws CloneNotSupportedException {
         final AuthnContextDeclRefPrincipal copy = (AuthnContextDeclRefPrincipal) super.clone();
         copy.authnContextDeclRef = authnContextDeclRef;
         return copy;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIDPrincipal.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIDPrincipal.java
index 85e1d99d0..a28fd40fd 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIDPrincipal.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIDPrincipal.java
@@ -57,7 +57,7 @@ public class NameIDPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override public String getName() {
+    @Nonnull public String getName() {
         return name;
     }
     
@@ -93,8 +93,7 @@ public class NameIDPrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public NameIDPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public NameIDPrincipal clone() throws CloneNotSupportedException {
         final NameIDPrincipal copy = (NameIDPrincipal) super.clone();
         try {
             copy.nameID = XMLObjectSupport.cloneXMLObject(nameID, CloneOutputOption.RootDOMInNewDocument);
@@ -107,4 +106,4 @@ public class NameIDPrincipal implements CloneablePrincipal {
         return copy;
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIdentifierPrincipal.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIdentifierPrincipal.java
index 7d8216440..62a11ca6d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIdentifierPrincipal.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/NameIdentifierPrincipal.java
@@ -58,7 +58,7 @@ public class NameIdentifierPrincipal implements CloneablePrincipal {
     }
 
     /** {@inheritDoc} */
-    @Override public String getName() {
+    @Nonnull public String getName() {
         return name;
     }
     
@@ -94,8 +94,7 @@ public class NameIdentifierPrincipal implements CloneablePrincipal {
     }
     
     /** {@inheritDoc} */
-    @Override
-    public NameIdentifierPrincipal clone() throws CloneNotSupportedException {
+    @Nonnull public NameIdentifierPrincipal clone() throws CloneNotSupportedException {
         final NameIdentifierPrincipal copy = (NameIdentifierPrincipal) super.clone();
         try {
             copy.nameIdentifier = XMLObjectSupport.cloneXMLObject(nameIdentifier, 
@@ -109,4 +108,4 @@ public class NameIdentifierPrincipal implements CloneablePrincipal {
         return copy;
     }
 
-}
+}
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list