[java-identity-provider] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Fri Jun 16 20:56:37 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=65e38d1cf153d02364115d2608d0ed36ade9cfde

The following commit(s) were added to refs/heads/main by this push:
     new 65e38d1cf IDP-2083 - Treat NonnullElements as the default for collections
65e38d1cf is described below

commit 65e38d1cf153d02364115d2608d0ed36ade9cfde
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jun 16 16:56:33 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Review idp-cas
    Cleanup missing annotations and javadocs.
---
 .../attribute/AbstractCASAttributeTranscoder.java  |  3 +-
 .../shibboleth/idp/cas/attribute/Attribute.java    |  5 +-
 .../shibboleth/idp/cas/attribute/package-info.java |  4 +-
 .../idp/cas/config/ConfigLookupFunction.java       | 12 ++--
 .../idp/cas/config/LoginConfiguration.java         | 17 +++---
 .../idp/cas/config/ProxyConfiguration.java         |  3 +-
 .../shibboleth/idp/cas/config/package-info.java    |  4 +-
 .../idp/cas/protocol/AbstractProtocolResponse.java |  3 +-
 .../idp/cas/protocol/ProtocolContext.java          | 15 +++--
 .../shibboleth/idp/cas/protocol/ProtocolError.java |  3 +-
 .../shibboleth/idp/cas/protocol/ProtocolParam.java |  9 ++-
 .../idp/cas/protocol/ProxyTicketRequest.java       |  3 +-
 .../idp/cas/protocol/ProxyTicketResponse.java      |  3 +-
 .../net/shibboleth/idp/cas/protocol/SamlParam.java |  3 +-
 .../idp/cas/protocol/ServiceTicketRequest.java     |  3 +-
 .../idp/cas/protocol/ServiceTicketResponse.java    |  5 +-
 .../idp/cas/protocol/TicketValidationRequest.java  |  3 +-
 .../idp/cas/protocol/TicketValidationResponse.java | 20 +++----
 .../shibboleth/idp/cas/protocol/package-info.java  |  4 +-
 .../shibboleth/idp/cas/proxy/ProxyIdentifiers.java |  3 +-
 .../shibboleth/idp/cas/proxy/ProxyValidator.java   |  4 +-
 .../net/shibboleth/idp/cas/proxy/package-info.java |  4 +-
 .../idp/cas/service/DefaultServiceComparator.java  | 20 +++++--
 .../idp/cas/service/PatternServiceRegistry.java    | 17 +++---
 .../shibboleth/idp/cas/service/ServiceContext.java |  4 +-
 .../idp/cas/service/ServiceDefinition.java         | 13 +++--
 .../idp/cas/service/ServiceRegistry.java           |  7 ++-
 .../shibboleth/idp/cas/service/package-info.java   |  4 +-
 .../idp/cas/ticket/ProxyGrantingTicket.java        |  4 +-
 .../net/shibboleth/idp/cas/ticket/ProxyTicket.java |  4 +-
 .../java/net/shibboleth/idp/cas/ticket/Ticket.java | 15 +++--
 .../shibboleth/idp/cas/ticket/TicketContext.java   |  4 +-
 .../idp/cas/ticket/TicketIdGenerator.java          |  6 +-
 .../ticket/TicketIdentifierGenerationStrategy.java | 25 ++++-----
 .../shibboleth/idp/cas/ticket/TicketService.java   | 28 ++++------
 .../net/shibboleth/idp/cas/ticket/TicketState.java | 13 +++--
 .../shibboleth/idp/cas/ticket/package-info.java    |  4 +-
 .../attribute/transcoding/impl/package-info.java   |  4 +-
 .../idp/cas/audit/impl/GatewayLookupFunction.java  |  2 +
 .../impl/ProxyGrantingTicketLookupFunction.java    |  1 +
 .../idp/cas/audit/impl/RenewLookupFunction.java    |  1 +
 .../idp/cas/audit/impl/ServiceLookupFunction.java  | 13 +++--
 .../cas/audit/impl/StatusCodeLookupFunction.java   |  7 ++-
 .../cas/audit/impl/StatusDetailLookupFunction.java |  1 +
 .../idp/cas/audit/impl/TicketLookupFunction.java   | 13 +++--
 .../idp/cas/audit/impl/package-info.java           |  4 +-
 .../cas/flow/impl/AbstractCASProtocolAction.java   |  1 +
 .../impl/AbstractOutgoingSamlMessageAction.java    |  8 ++-
 .../impl/BuildAuthenticationContextAction.java     |  2 +
 .../idp/cas/flow/impl/BuildProxyChainAction.java   |  2 +
 .../flow/impl/BuildRelyingPartyContextAction.java  |  8 ++-
 .../flow/impl/BuildSAMLMetadataContextAction.java  |  2 +
 .../BuildSamlValidationFailureMessageAction.java   |  1 +
 .../BuildSamlValidationSuccessMessageAction.java   | 24 ++++----
 .../flow/impl/CheckProxyAuthorizationAction.java   |  2 +
 .../net/shibboleth/idp/cas/flow/impl/Events.java   |  5 +-
 .../idp/cas/flow/impl/GrantProxyTicketAction.java  |  5 +-
 .../cas/flow/impl/GrantServiceTicketAction.java    |  4 +-
 .../idp/cas/flow/impl/InitializeLoginAction.java   |  4 +-
 .../idp/cas/flow/impl/InitializeProxyAction.java   |  1 +
 .../cas/flow/impl/InitializeValidateAction.java    |  1 +
 .../cas/flow/impl/PopulateProtocolErrorAction.java |  1 +
 .../PrepareTicketValidationResponseAction.java     | 14 +++--
 .../cas/flow/impl/ProcessSamlMessageAction.java    |  4 +-
 .../flow/impl/PublishProtocolMessageAction.java    |  1 +
 .../impl/UpdateIdPSessionWithSPSessionAction.java  |  2 +
 .../cas/flow/impl/ValidateProxyCallbackAction.java |  6 +-
 .../idp/cas/flow/impl/ValidateRenewAction.java     |  2 +
 .../idp/cas/flow/impl/ValidateTicketAction.java    |  2 +
 .../cas/flow/impl/WriteValidateResponseAction.java |  2 +
 .../shibboleth/idp/cas/flow/impl/package-info.java |  4 +-
 .../cas/proxy/impl/HttpClientProxyValidator.java   |  6 +-
 .../idp/cas/proxy/impl/package-info.java           |  4 +-
 .../cas/service/impl/DefaultServiceComparator.java | 61 ---------------------
 .../cas/service/impl/MetadataServiceRegistry.java  | 28 +++++-----
 .../cas/service/impl/ReloadingServiceRegistry.java |  4 +-
 .../cas/service/impl/ServiceEntityDescriptor.java  | 13 +++--
 .../idp/cas/service/impl/package-info.java         |  4 +-
 .../cas/session/impl/CASSPSessionSerializer.java   |  1 +
 .../idp/cas/session/impl/package-info.java         |  4 +-
 .../idp/cas/ticket/impl/AbstractTicketService.java | 58 ++++++++++----------
 .../idp/cas/ticket/impl/EncodingTicketService.java | 64 +++++++++++-----------
 .../idp/cas/ticket/impl/SimpleTicketService.java   | 15 ++---
 .../idp/cas/ticket/impl/package-info.java          |  4 +-
 .../impl/AbstractTicketSerializer.java             | 41 +++++++-------
 .../impl/ProxyGrantingTicketSerializer.java        | 13 +++--
 .../serialization/impl/ProxyTicketSerializer.java  | 13 +++--
 .../impl/ServiceTicketSerializer.java              | 10 ++--
 .../ticket/serialization/impl/package-info.java    |  4 +-
 89 files changed, 419 insertions(+), 383 deletions(-)

diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java
index f75ce4c10..e741496b4 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/AbstractCASAttributeTranscoder.java
@@ -36,7 +36,6 @@ import net.shibboleth.idp.attribute.IdPAttributeValue;
 import net.shibboleth.idp.attribute.transcoding.AbstractAttributeTranscoder;
 import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
 import net.shibboleth.idp.attribute.transcoding.TranscodingRule;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -188,7 +187,7 @@ public abstract class AbstractCASAttributeTranscoder<EncodedType extends IdPAttr
     @Nonnull protected IdPAttribute buildIdPAttribute(
             @Nullable final ProfileRequestContext profileRequestContext, @Nonnull final Attribute attribute,
             @Nonnull final TranscodingRule rule,
-            @Nonnull @NonnullElements final List<IdPAttributeValue> attributeValues)
+            @Nonnull final List<IdPAttributeValue> attributeValues)
                     throws AttributeDecodingException {
         
         final String id = rule.get(AttributeTranscoderRegistry.PROP_ID, String.class);
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/Attribute.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/Attribute.java
index df1aee0b0..7ffaab513 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/Attribute.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/Attribute.java
@@ -23,7 +23,6 @@ import java.util.Collection;
 import javax.annotation.Nonnull;
 
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -37,7 +36,7 @@ public class Attribute {
     @Nonnull @NotEmpty private String name;
     
     /** String values. */
-    @Nonnull @NonnullElements private final Collection<String> values;
+    @Nonnull private final Collection<String> values;
     
     /**
      * Constructor.
@@ -67,7 +66,7 @@ public class Attribute {
      * 
      * @return string value collection
      */
-    @Nonnull @NonnullElements @Live public Collection<String> getValues() {
+    @Nonnull @Live public Collection<String> getValues() {
         return values;
     }
     
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/package-info.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/package-info.java
index b087d3466..5e309122e 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/package-info.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/attribute/package-info.java
@@ -18,5 +18,7 @@
 /**
  * APIs for CAS attribute support.
  */
+ at NonnullElements
+package net.shibboleth.idp.cas.attribute;
 
-package net.shibboleth.idp.cas.attribute;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ConfigLookupFunction.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ConfigLookupFunction.java
index ae94f8a8b..5447910bc 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ConfigLookupFunction.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ConfigLookupFunction.java
@@ -19,11 +19,13 @@ package net.shibboleth.idp.cas.config;
 
 import java.util.function.Function;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 
 import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.logic.Constraint;
 
 /**
  * Lookup function for extracting CAS profile configuration from the profile request context.
@@ -36,15 +38,15 @@ public class ConfigLookupFunction<T extends AbstractProtocolConfiguration>
     implements Function<ProfileRequestContext, T> {
 
     /** Type of profile configuration class. */
-    private final Class<T> configClass;
+    @Nonnull private final Class<T> configClass;
 
     /**
      * Creates a new instance.
      *
      * @param clazz Profile configuration class.
      */
-    public ConfigLookupFunction(final Class<T> clazz) {
-        configClass = clazz;
+    public ConfigLookupFunction(@Nonnull final Class<T> clazz) {
+        configClass = Constraint.isNotNull(clazz, "Configuration class cannot be null");
     }
 
     /** {@inheritDoc} */
@@ -55,6 +57,8 @@ public class ConfigLookupFunction<T extends AbstractProtocolConfiguration>
                 return configClass.cast(rpContext.getProfileConfig());
             }
         }
+        
         return null;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/LoginConfiguration.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/LoginConfiguration.java
index ccbbddd0a..7c0ad04ba 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/LoginConfiguration.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/LoginConfiguration.java
@@ -33,7 +33,6 @@ import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
 import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
 import net.shibboleth.shared.annotation.ConfigurationSetting;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -96,7 +95,7 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
+    @Nonnull @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<AuthnContextClassRefPrincipal> methods =
                 defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
@@ -111,8 +110,7 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
      * 
      * @param contexts default authentication contexts to use
      */
-    public void setDefaultAuthenticationMethods(
-            @Nullable @NonnullElements final Collection<AuthnContextClassRefPrincipal> contexts) {
+    public void setDefaultAuthenticationMethods(@Nullable final Collection<AuthnContextClassRefPrincipal> contexts) {
         if (contexts != null) {
             defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(List.copyOf(contexts));
         } else {
@@ -131,7 +129,7 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
@@ -146,7 +144,7 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
      * 
      * @param flows   flow identifiers to use
      */
-    public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setAuthenticationFlows(@Nullable final Collection<String> flows) {
         if (flows != null) {
             authenticationFlowsLookupStrategy =
                     FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
@@ -166,7 +164,7 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
         if (flows != null) {
@@ -180,7 +178,7 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
      * 
      * @param flows   flow identifiers to enable
      */
-    public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setPostAuthenticationFlows(@Nullable final Collection<String> flows) {
         if (flows != null) {
             postAuthenticationFlowsLookupStrategy =
                     FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
@@ -306,4 +304,5 @@ public class LoginConfiguration extends AbstractProtocolConfiguration
     protected int getDefaultTicketLength() {
         return DEFAULT_TICKET_LENGTH;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ProxyConfiguration.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ProxyConfiguration.java
index 56b742592..71799db79 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ProxyConfiguration.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/ProxyConfiguration.java
@@ -57,4 +57,5 @@ public class ProxyConfiguration extends AbstractProtocolConfiguration {
     protected int getDefaultTicketLength() {
         return DEFAULT_TICKET_LENGTH;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/package-info.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/package-info.java
index b73d08d70..fec0453cf 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/package-info.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/config/package-info.java
@@ -18,5 +18,7 @@
 /**
  * CAS protocol configuration implementations.
  */
+ at NonnullElements
+package net.shibboleth.idp.cas.config;
 
-package net.shibboleth.idp.cas.config;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/AbstractProtocolResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/AbstractProtocolResponse.java
index 9de282938..291a1e2e9 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/AbstractProtocolResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/AbstractProtocolResponse.java
@@ -69,4 +69,5 @@ public class AbstractProtocolResponse {
     public void setErrorDetail(@Nonnull final String code) {
         errorDetail = code;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolContext.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolContext.java
index 5a0790eed..769e2af87 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolContext.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolContext.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.cas.protocol;
 
+import javax.annotation.Nullable;
+
 import org.opensaml.messaging.context.BaseContext;
 
 /**
@@ -28,18 +30,19 @@ import org.opensaml.messaging.context.BaseContext;
  * @param <ResponseType> response type
  */
 public final class ProtocolContext<RequestType, ResponseType> extends BaseContext {
+    
     /** CAS protocol request. */
-    private RequestType request;
+    @Nullable private RequestType request;
 
     /** CAS protocol response. */
-    private ResponseType response;
+    @Nullable private ResponseType response;
 
     /**
      * Get the CAS protocol request.
      * 
      * @return CAS protocol request
      */
-    public RequestType getRequest() {
+    @Nullable public RequestType getRequest() {
         return request;
     }
 
@@ -48,7 +51,7 @@ public final class ProtocolContext<RequestType, ResponseType> extends BaseContex
      *
      * @param req CAS protocol request.
      */
-    public void setRequest(final RequestType req) {
+    public void setRequest(@Nullable final RequestType req) {
         request = req;
     }
 
@@ -57,7 +60,7 @@ public final class ProtocolContext<RequestType, ResponseType> extends BaseContex
      * 
      * @return CAS protocol response
      */
-    public ResponseType getResponse() {
+    @Nullable public ResponseType getResponse() {
         return response;
     }
 
@@ -66,7 +69,7 @@ public final class ProtocolContext<RequestType, ResponseType> extends BaseContex
      *
      * @param resp CAS protocol response.
      */
-    public void setResponse(final ResponseType resp) {
+    public void setResponse(@Nullable final ResponseType resp) {
         response = resp;
     }
 }
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
index fa3a1a5f7..e847c3af1 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolError.java
@@ -138,4 +138,5 @@ public enum ProtocolError {
         attributes.put("detailCode", errorDetailCode);
         return new Event(source, name(), attributes);
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolParam.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolParam.java
index 1b72e08a0..09b0c427b 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolParam.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProtocolParam.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.idp.cas.protocol;
 
+import javax.annotation.Nonnull;
+
 /**
  * Protocol parameter name enumeration.
  *
@@ -64,7 +66,8 @@ public enum ProtocolParam {
      *
      * @return Enumeration name with first letter lower-cased.
      */
-    public String id() {
-        return this.name().substring(0, 1).toLowerCase() + this.name().substring(1);
+    @Nonnull public String id() {
+        return name().substring(0, 1).toLowerCase() + name().substring(1);
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketRequest.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketRequest.java
index e89079b87..02f618036 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketRequest.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketRequest.java
@@ -62,4 +62,5 @@ public class ProxyTicketRequest {
     @Nonnull public String getTargetService() {
         return proxyTargetService;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketResponse.java
index 107450775..47ed54ce4 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ProxyTicketResponse.java
@@ -52,4 +52,5 @@ public class ProxyTicketResponse extends AbstractProtocolResponse {
     @Nullable public String getPt() {
         return proxyTicket;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/SamlParam.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/SamlParam.java
index 6e12936ba..cbd9627e7 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/SamlParam.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/SamlParam.java
@@ -28,4 +28,5 @@ public enum SamlParam {
 
     /** SAMLart parameter used to convey service ticket. */
     SAMLart
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketRequest.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketRequest.java
index 31e0ff785..d0905bfe4 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketRequest.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketRequest.java
@@ -147,4 +147,5 @@ public class ServiceTicketRequest {
             throw new IllegalArgumentException("Unsupported method " + m);
         }
     }
-}
+    
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
index e1ccb2188..508fa0ce3 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/ServiceTicketResponse.java
@@ -107,9 +107,10 @@ public class ServiceTicketResponse {
      * 
      * @return URL that may be used to redirect to a service with a granted ticket
      */
-    public String getRedirectUrl() {
+    @Nonnull public String getRedirectUrl() {
         final UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(serviceURL);
         builder.queryParam(getTicketParameterName(), serviceTicket);
         return builder.build().toUriString();
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationRequest.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationRequest.java
index eb7157631..d27b31cd7 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationRequest.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationRequest.java
@@ -80,4 +80,5 @@ public class TicketValidationRequest extends ServiceTicketResponse {
     public void setPgtUrl(@Nullable final String url) {
         pgtUrl = StringSupport.trimOrNull(url);
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationResponse.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationResponse.java
index 618dd689b..5f53e5b87 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationResponse.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/TicketValidationResponse.java
@@ -18,7 +18,6 @@
 package net.shibboleth.idp.cas.protocol;
 
 import net.shibboleth.idp.cas.attribute.Attribute;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -44,13 +43,13 @@ public class TicketValidationResponse extends AbstractProtocolResponse {
     @Nullable private String userName;
 
     /** User attributes. */
-    @Nonnull @NonnullElements private final List<Attribute> attributes;
+    @Nonnull private final List<Attribute> attributes;
 
     /** Proxy granting ticket IOU. */
     @Nullable private String pgtIou;
 
     /** Proxies traversed. */
-    @Nonnull @NonnullElements private final List<String> proxies;
+    @Nonnull private final List<String> proxies;
 
     /** Constructor. */
     public TicketValidationResponse() {
@@ -81,10 +80,8 @@ public class TicketValidationResponse extends AbstractProtocolResponse {
      * 
      * @return immutable collection of user attributes
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<Attribute> getAttributes() {
-        final Collection<Attribute> result = CollectionSupport.copyToList(attributes);
-        assert result!=null;
-        return result;
+    @Nonnull @NotLive @Unmodifiable public Collection<Attribute> getAttributes() {
+        return CollectionSupport.copyToList(attributes);
     }
 
     /**
@@ -119,10 +116,8 @@ public class TicketValidationResponse extends AbstractProtocolResponse {
      * 
      * @return immutable list of proxies traversed in order of most recent to last recent
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getProxies() {
-        final List<String> result =  CollectionSupport.copyToList(proxies);
-        assert result!=null;
-        return result;
+    @Nonnull @NotLive @Unmodifiable public List<String> getProxies() {
+        return  CollectionSupport.copyToList(proxies);
     }
 
     /**
@@ -133,4 +128,5 @@ public class TicketValidationResponse extends AbstractProtocolResponse {
     public void addProxy(@Nonnull final String proxy) {
         proxies.add(proxy);
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/package-info.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/package-info.java
index 3e0e3f675..068c12460 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/package-info.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/protocol/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** APIs related to the CAS protocol. */
+ at NonnullElements
+package net.shibboleth.idp.cas.protocol;
 
-package net.shibboleth.idp.cas.protocol;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyIdentifiers.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyIdentifiers.java
index fd2315c2f..a900fddf1 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyIdentifiers.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyIdentifiers.java
@@ -62,4 +62,5 @@ public class ProxyIdentifiers {
     @Nonnull public String getPgtIou() {
         return pgTicketIOU;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyValidator.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyValidator.java
index 3b66e9d29..04dc49f16 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyValidator.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/ProxyValidator.java
@@ -29,6 +29,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  * @author Marvin S. Addison
  */
 public interface ProxyValidator {
+    
     /**
      * Validates the proxy callback endpoint.
      *
@@ -39,4 +40,5 @@ public interface ProxyValidator {
      */
     void validate(@Nonnull ProfileRequestContext profileRequestContext, @Nonnull URI proxyCallbackUri)
             throws GeneralSecurityException;
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/package-info.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/package-info.java
index 789c5afaa..00721ccbe 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/package-info.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/proxy/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** APIs related to CAS proxies. */
+ at NonnullElements
+package net.shibboleth.idp.cas.proxy;
 
-package net.shibboleth.idp.cas.proxy;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/DefaultServiceComparator.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/DefaultServiceComparator.java
index c3b1ea431..ac96048a9 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/DefaultServiceComparator.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/DefaultServiceComparator.java
@@ -39,10 +39,10 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class DefaultServiceComparator implements Comparator<String> {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(DefaultServiceComparator.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultServiceComparator.class);
 
     /** Ignored patterns in path part of URL. */
-    private final Pattern[] ignoredPatterns;
+    @Nonnull private final Pattern[] ignoredPatterns;
 
     /** Creates a new instance that ignores <em>;jsessionid=value</em>. */
     public DefaultServiceComparator() {
@@ -62,8 +62,17 @@ public class DefaultServiceComparator implements Comparator<String> {
         }
     }
 
-    @Override
+    /** {@inheritDoc} */
     public int compare(final String a, final String b) {
+        if (a == null || b == null) {
+            if (a == null && b == null) {
+                return 0;
+            } else if (a == null) {
+                return -1;
+            } else {
+                return 1;
+            }
+        }
         return stripPathParameters(a).compareToIgnoreCase(stripPathParameters(b));
     }
 
@@ -74,7 +83,7 @@ public class DefaultServiceComparator implements Comparator<String> {
      *
      * @return URI with named path parameters and any associated values removed.
      */
-    private String stripPathParameters(final String uriString) {
+    private String stripPathParameters(@Nonnull final String uriString) {
         try {
             final URI uri = new URI(uriString);
             String path = uri.getPath();
@@ -88,4 +97,5 @@ public class DefaultServiceComparator implements Comparator<String> {
             return uriString;
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/PatternServiceRegistry.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/PatternServiceRegistry.java
index ee747f125..c92073392 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/PatternServiceRegistry.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/PatternServiceRegistry.java
@@ -27,7 +27,6 @@ import javax.annotation.Nullable;
 
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
 import net.shibboleth.shared.logic.Constraint;
@@ -45,12 +44,10 @@ public class PatternServiceRegistry extends AbstractIdentifiableInitializableCom
         implements ServiceRegistry {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(PatternServiceRegistry.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(PatternServiceRegistry.class);
 
     /** Map of service definitions to compiled patterns. */
-    @Nonnull
-    @NonnullElements
-    private Map<ServiceDefinition, Pattern> definitions = CollectionSupport.emptyMap();
+    @Nonnull private Map<ServiceDefinition, Pattern> definitions = CollectionSupport.emptyMap();
 
     /**
      * Sets the list of service definitions that back the registry.
@@ -58,7 +55,7 @@ public class PatternServiceRegistry extends AbstractIdentifiableInitializableCom
      * @param serviceDefinitions List of service definitions, each of which defines a match pattern to evaluate a
      *            candidate service URL.
      */
-    public void setDefinitions(@Nonnull @NonnullElements final List<ServiceDefinition> serviceDefinitions) {
+    public void setDefinitions(@Nonnull final List<ServiceDefinition> serviceDefinitions) {
         Constraint.noNullItems(serviceDefinitions, "Definitions cannot be null or contain null items");
         // Preserve order of services in map
         definitions = new LinkedHashMap<>(serviceDefinitions.size());
@@ -67,9 +64,8 @@ public class PatternServiceRegistry extends AbstractIdentifiableInitializableCom
         }
     }
 
-    @Override
-    @Nullable
-    public Service lookup(@Nonnull final String serviceURL) {
+    /** {@inheritDoc} */
+    @Nullable public Service lookup(@Nonnull final String serviceURL) {
         Constraint.isNotNull(serviceURL, "Service URL cannot be null");
         for (final ServiceDefinition def : definitions.keySet()) {
             log.debug("Evaluating whether {} matches {}", serviceURL, def);
@@ -81,4 +77,5 @@ public class PatternServiceRegistry extends AbstractIdentifiableInitializableCom
         }
         return null;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceContext.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceContext.java
index 282709274..04842dc50 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceContext.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceContext.java
@@ -30,6 +30,7 @@ import javax.annotation.Nonnull;
  * @author Marvin S. Addison
  */
 public final class ServiceContext extends BaseContext {
+    
     /** Service metadata held by context. */
     @Nonnull private final Service serviceMetadata;
 
@@ -50,4 +51,5 @@ public final class ServiceContext extends BaseContext {
     @Nonnull public Service getService() {
         return serviceMetadata;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceDefinition.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceDefinition.java
index c6f1d8443..2f5b4ebbc 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceDefinition.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceDefinition.java
@@ -31,13 +31,12 @@ import net.shibboleth.shared.primitive.StringSupport;
  * @author Marvin S. Addison
  */
 public class ServiceDefinition {
+    
     /** Service identifier. */
-    @Nonnull
-    private final String id;
+    @Nonnull private final String id;
 
     /** Logical group to which service belongs. */
-    @Nullable
-    private String group;
+    @Nullable private String group;
 
     /** Proxy authorization flag. */
     private boolean authorizedToProxy;
@@ -119,6 +118,7 @@ public class ServiceDefinition {
         this.singleLogoutParticipant = wantsSLO;
     }
 
+    /** {@inheritDoc} */
     @Override
     public boolean equals(final Object o) {
         if (this == o) {
@@ -129,13 +129,16 @@ public class ServiceDefinition {
         return o instanceof ServiceDefinition && id.equals(((ServiceDefinition) o).getId());
     }
 
+    /** {@inheritDoc} */
     @Override
     public int hashCode() {
         return 97 + id.hashCode();
     }
 
+    /** {@inheritDoc} */
     @Override
     public String toString() {
         return id;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceRegistry.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceRegistry.java
index acc14031e..b9ccd3caf 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceRegistry.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/ServiceRegistry.java
@@ -26,6 +26,7 @@ import javax.annotation.Nullable;
  * @author Marvin S. Addison
  */
 public interface ServiceRegistry {
+
     /**
      * Looks up a service entry from a service URL.
      *
@@ -33,6 +34,6 @@ public interface ServiceRegistry {
      *
      * @return Service found in registry or null if no match found.
      */
-    @Nullable
-    Service lookup(@Nonnull String serviceURL);
-}
+    @Nullable Service lookup(@Nonnull String serviceURL);
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/package-info.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/package-info.java
index da56744f9..3e8a3aad5 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/package-info.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/service/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** APIs related to CAS services. */
+ at NonnullElements
+package net.shibboleth.idp.cas.service;
 
-package net.shibboleth.idp.cas.service;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyGrantingTicket.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyGrantingTicket.java
index b1e768b96..5d8d3885e 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyGrantingTicket.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyGrantingTicket.java
@@ -35,8 +35,7 @@ public class ProxyGrantingTicket extends Ticket {
     @Nonnull private String proxyCallbackUrl;
 
     /** The ID of the parent proxy-granting ticket. */
-    @Nullable
-    private String parentPgTicketId;
+    @Nullable private String parentPgTicketId;
 
     /**
      * Creates a proxy-granting ticket with the given values.
@@ -81,6 +80,7 @@ public class ProxyGrantingTicket extends Ticket {
         return getParentId() == null;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected Ticket newInstance(@Nonnull final String newId) {
         return new ProxyGrantingTicket(
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyTicket.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyTicket.java
index 5242ddc78..3a7da4627 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyTicket.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/ProxyTicket.java
@@ -31,8 +31,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class ProxyTicket extends Ticket {
 
     /** Proxy-granting ticket ID used to create ticket. */
-    @Nonnull
-    private final String pgTicketId;
+    @Nonnull private final String pgTicketId;
 
     /**
      * Creates a new authenticated ticket with an identifier, service, and expiration date.
@@ -60,6 +59,7 @@ public class ProxyTicket extends Ticket {
         return pgTicketId;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected Ticket newInstance(@Nonnull final String newId) {
         return new ProxyTicket(newId, getService(), getExpirationInstant(), pgTicketId);
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/Ticket.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/Ticket.java
index 2e16e6ee9..25e99d04c 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/Ticket.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/Ticket.java
@@ -33,20 +33,16 @@ import net.shibboleth.shared.logic.Constraint;
 public class Ticket {
 
     /** Ticket identifier. */
-    @Nonnull
-    private final String ticketId;
+    @Nonnull private final String ticketId;
 
     /** Service/relying party that requested the ticket. */
-    @Nonnull
-    private final String ticketService;
+    @Nonnull private final String ticketService;
 
     /** Expiration instant. */
-    @Nonnull
-    private final Instant expirationInstant;
+    @Nonnull private final Instant expirationInstant;
 
     /** Supplemental ticket state data. */
-    @Nullable
-    private TicketState ticketState;
+    @Nullable private TicketState ticketState;
 
     /**
      * Creates a new ticket with the given parameters.
@@ -121,6 +117,7 @@ public class Ticket {
         ticketState = state;
     }
 
+    /** {@inheritDoc} */
     @Override
     public boolean equals(final Object o) {
         if (o == null || !o.getClass().equals(getClass())) {
@@ -130,11 +127,13 @@ public class Ticket {
         return other.ticketId.equals(ticketId);
     }
 
+    /** {@inheritDoc} */
     @Override
     public int hashCode() {
         return 23 + 31 * ticketId.hashCode();
     }
 
+    /** {@inheritDoc} */
     @Override
     public String toString() {
         return ticketId;
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketContext.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketContext.java
index a4fb00d06..854c7d3f0 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketContext.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketContext.java
@@ -30,6 +30,7 @@ import javax.annotation.Nonnull;
  * @author Marvin S. Addison
  */
 public final class TicketContext extends BaseContext {
+
     /** Ticket held by this context. */
     @Nonnull private final Ticket t;
 
@@ -50,4 +51,5 @@ public final class TicketContext extends BaseContext {
     @Nonnull public Ticket getTicket() {
         return t;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdGenerator.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdGenerator.java
index 440ca59f2..785167b3e 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdGenerator.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdGenerator.java
@@ -31,6 +31,6 @@ public interface TicketIdGenerator {
      *
      * @return Ticket identifier.
      */
-    @Nonnull
-    String generate();
-}
+    @Nonnull String generate();
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdentifierGenerationStrategy.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdentifierGenerationStrategy.java
index 73a064041..1ee28f2a3 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdentifierGenerationStrategy.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketIdentifierGenerationStrategy.java
@@ -47,20 +47,16 @@ import org.cryptacular.generator.RandomIdGenerator;
 public class TicketIdentifierGenerationStrategy implements IdentifierGenerationStrategy {
 
     /** Generator for random part of the ticket. */
-    private final IdGenerator idGenerator;
+    @Nonnull private final IdGenerator idGenerator;
 
     /** Ticket prefix. */
-    @Nonnull
-    @NotEmpty
-    private String ticketPrefix;
+    @Nonnull @NotEmpty private String ticketPrefix;
 
     /** Ticket suffix. */
-    @Nullable
-    private String ticketSuffix;
+    @Nullable private String ticketSuffix;
 
     /** Number of characters in random part of generated ticket. */
-    @Positive
-    private int ticketLength;
+    @Positive private int ticketLength;
 
 
     /**
@@ -91,9 +87,9 @@ public class TicketIdentifierGenerationStrategy implements IdentifierGenerationS
         }
     }
 
+    /** {@inheritDoc} */
     @Override
-    @Nonnull
-    public String generateIdentifier() {
+    @Nonnull public String generateIdentifier() {
         final StringBuilder builder = new StringBuilder(ticketLength * 2);
         builder.append(ticketPrefix).append('-');
         builder.append(System.currentTimeMillis()).append('-');
@@ -106,9 +102,9 @@ public class TicketIdentifierGenerationStrategy implements IdentifierGenerationS
         return result;
     }
 
+    /** {@inheritDoc} */
     @Override
-    @Nonnull
-    public String generateIdentifier(final boolean xmlSafe) {
+    @Nonnull public String generateIdentifier(final boolean xmlSafe) {
         return generateIdentifier();
     }
 
@@ -118,11 +114,12 @@ public class TicketIdentifierGenerationStrategy implements IdentifierGenerationS
      * @param s URL
      * @return whether the URL is safe
      */
-    private static boolean isUrlSafe(final String s) {
+    private static boolean isUrlSafe(@Nonnull final String s) {
         try {
             return URLEncoder.encode(s, StandardCharsets.US_ASCII.name()).equals(s);
         } catch (final Exception e) {
             return false;
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketService.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketService.java
index 36f90d024..b5b29efca 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketService.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketService.java
@@ -28,6 +28,7 @@ import javax.annotation.Nullable;
  * @author Marvin S. Addison
  */
 public interface TicketService {
+    
     /**
      * Creates and stores a ticket for the given service.
      *
@@ -39,8 +40,7 @@ public interface TicketService {
      *
      * @return Created service ticket.
      */
-    @Nonnull
-    ServiceTicket createServiceTicket(
+    @Nonnull ServiceTicket createServiceTicket(
             @Nonnull String id,
             @Nonnull Instant expiry,
             @Nonnull String service,
@@ -54,8 +54,7 @@ public interface TicketService {
      *
      * @return Removed ticket or null if not found.
      */
-    @Nullable
-    ServiceTicket removeServiceTicket(@Nonnull String id);
+    @Nullable ServiceTicket removeServiceTicket(@Nonnull String id);
 
     /**
      * Creates a top-level proxy-granting ticket from a service ticket.
@@ -67,8 +66,7 @@ public interface TicketService {
      *
      * @return Created proxy-granting ticket.
      */
-    @Nonnull
-    ProxyGrantingTicket createProxyGrantingTicket(
+    @Nonnull ProxyGrantingTicket createProxyGrantingTicket(
             @Nonnull String id,
             @Nonnull Instant expiry,
             @Nonnull ServiceTicket serviceTicket,
@@ -85,8 +83,7 @@ public interface TicketService {
      *
      * @return Created proxy-granting ticket.
      */
-    @Nonnull
-    ProxyGrantingTicket createProxyGrantingTicket(
+    @Nonnull ProxyGrantingTicket createProxyGrantingTicket(
             @Nonnull String id,
             @Nonnull Instant expiry,
             @Nonnull ProxyTicket proxyTicket,
@@ -99,8 +96,7 @@ public interface TicketService {
      *
      * @return Proxy-granting ticket or null if not found.
      */
-    @Nullable
-    ProxyGrantingTicket fetchProxyGrantingTicket(@Nonnull String id);
+    @Nullable ProxyGrantingTicket fetchProxyGrantingTicket(@Nonnull String id);
 
     /**
      * Removes the proxy-granting ticket with the given identifier.
@@ -109,8 +105,7 @@ public interface TicketService {
      *
      * @return Removed ticket or null if not found.
      */
-    @Nullable
-    ProxyGrantingTicket removeProxyGrantingTicket(@Nonnull String id);
+    @Nullable ProxyGrantingTicket removeProxyGrantingTicket(@Nonnull String id);
 
     /**
      * Creates and stores a proxy ticket for the given service.
@@ -122,8 +117,7 @@ public interface TicketService {
      *
      * @return Created proxy ticket.
      */
-    @Nonnull
-    ProxyTicket createProxyTicket(
+    @Nonnull ProxyTicket createProxyTicket(
             @Nonnull String id,
             @Nonnull Instant expiry,
             @Nonnull ProxyGrantingTicket pgt,
@@ -136,6 +130,6 @@ public interface TicketService {
      *
      * @return Removed ticket or null if not found.
      */
-    @Nullable
-    ProxyTicket removeProxyTicket(@Nonnull String id);
-}
+    @Nullable ProxyTicket removeProxyTicket(@Nonnull String id);
+
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketState.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketState.java
index aafc0a37a..7585deb70 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketState.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/TicketState.java
@@ -25,9 +25,9 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -51,7 +51,7 @@ public class TicketState {
     @Nonnull private String authenticationMethod;
 
     /** Attribute IDs that were consented to during the ticket request. */
-    @Nullable @NonnullElements private Set<String> consentedAttributeIds;
+    @Nullable private Set<String> consentedAttributeIds;
 
     /**
      * Creates a new instance with required fields.
@@ -115,7 +115,7 @@ public class TicketState {
      * 
      * @since 4.2.0
      */
-    @Nullable @NonnullElements @Unmodifiable @NotLive public Set<String> getConsentedAttributeIds() {
+    @Nullable @Unmodifiable @NotLive public Set<String> getConsentedAttributeIds() {
         return consentedAttributeIds;
     }
     
@@ -126,9 +126,9 @@ public class TicketState {
      * 
      * @since 4.2.0
      */
-    public void setConsentedAttributeIds(@Nullable @NonnullElements final Collection<String> attributeIds) {
+    public void setConsentedAttributeIds(@Nullable final Collection<String> attributeIds) {
         if (attributeIds != null) {
-            consentedAttributeIds = Set.copyOf(StringSupport.normalizeStringCollection(attributeIds));
+            consentedAttributeIds = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(attributeIds));
         } else {
             consentedAttributeIds = null;
         }
@@ -150,4 +150,5 @@ public class TicketState {
     public int hashCode() {
         return Objects.hash(sessId, authenticatedPrincipalName, authenticationInstant, authenticationMethod);
     }
-}
+    
+}
\ No newline at end of file
diff --git a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/package-info.java b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/package-info.java
index fb524d2c9..c928dd6cc 100644
--- a/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/package-info.java
+++ b/idp-cas-api/src/main/java/net/shibboleth/idp/cas/ticket/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** APIs related to CAS tickets. */
+ at NonnullElements
+package net.shibboleth.idp.cas.ticket;
 
-package net.shibboleth.idp.cas.ticket;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/package-info.java
index 0a7d8e3d5..4eb0fcfa1 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/attribute/transcoding/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes for CAS attribute support. 
  */
+ at NonnullElements
+package net.shibboleth.idp.cas.attribute.transcoding.impl;
 
-package net.shibboleth.idp.cas.attribute.transcoding.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/GatewayLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/GatewayLookupFunction.java
index 45b3588cc..cb0ddaf66 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/GatewayLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/GatewayLookupFunction.java
@@ -34,7 +34,9 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class GatewayLookupFunction implements Function<ProfileRequestContext,Boolean> {
+    
     /** Lookup strategy for protocol context. */
     @Nonnull private final Function<ProfileRequestContext,ProtocolContext> protocolContextFunction;
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ProxyGrantingTicketLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ProxyGrantingTicketLookupFunction.java
index 4e6068194..a38f70d88 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ProxyGrantingTicketLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ProxyGrantingTicketLookupFunction.java
@@ -34,6 +34,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class ProxyGrantingTicketLookupFunction implements Function<ProfileRequestContext,String> {
     
     /** Lookup strategy for protocol context. */
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/RenewLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/RenewLookupFunction.java
index 0b0176dcb..65c642cf5 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/RenewLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/RenewLookupFunction.java
@@ -34,6 +34,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class RenewLookupFunction implements Function<ProfileRequestContext, Boolean> {
     
     /** Lookup strategy for protocol context. */
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ServiceLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ServiceLookupFunction.java
index 8a354f8f6..4c34d8063 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ServiceLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/ServiceLookupFunction.java
@@ -36,6 +36,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class ServiceLookupFunction implements Function<ProfileRequestContext, String> {
     
     /** Lookup strategy for protocol context. */
@@ -67,12 +68,12 @@ public class ServiceLookupFunction implements Function<ProfileRequestContext, St
         }
         final Object request = protocolContext.getRequest();
         final String service;
-        if (request instanceof ServiceTicketRequest) {
-            service = ((ServiceTicketRequest) request).getService();
-        } else if (request instanceof ProxyTicketRequest) {
-            service = ((ProxyTicketRequest) request).getTargetService();
-        } else if (request instanceof TicketValidationRequest) {
-            service = ((TicketValidationRequest) request).getService();
+        if (request instanceof ServiceTicketRequest req) {
+            service = req.getService();
+        } else if (request instanceof ProxyTicketRequest req) {
+            service = req.getTargetService();
+        } else if (request instanceof TicketValidationRequest req) {
+            service = req.getService();
         } else {
             service = null;
         }
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusCodeLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusCodeLookupFunction.java
index b369f88a8..a4cac506b 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusCodeLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusCodeLookupFunction.java
@@ -36,6 +36,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class StatusCodeLookupFunction implements Function<ProfileRequestContext, String> {
 
     /** Synthetic success result code. */
@@ -68,9 +69,9 @@ public class StatusCodeLookupFunction implements Function<ProfileRequestContext,
         if (protocolContext == null || protocolContext.getRequest() ==  null) {
             return null;
         }
-        final Object response = protocolContext.getResponse();
-        if (response instanceof AbstractProtocolResponse) {
-            final String code = ((AbstractProtocolResponse) response).getErrorCode();
+        
+        if (protocolContext.getResponse() instanceof AbstractProtocolResponse resp) {
+            final String code = resp.getErrorCode();
             return code == null ? SUCCESS_CODE : code;
         }
         return null;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusDetailLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusDetailLookupFunction.java
index 9150fb2de..7ba451010 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusDetailLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/StatusDetailLookupFunction.java
@@ -35,6 +35,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class StatusDetailLookupFunction implements Function<ProfileRequestContext,String> {
 
     /** Lookup strategy for protocol context. */
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/TicketLookupFunction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/TicketLookupFunction.java
index faa9a2bef..f7e418f79 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/TicketLookupFunction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/TicketLookupFunction.java
@@ -36,6 +36,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
  *
  * @author Marvin S. Addison
  */
+ at SuppressWarnings("rawtypes")
 public class TicketLookupFunction implements Function<ProfileRequestContext, String> {
     
     /** Lookup strategy for protocol context. */
@@ -68,12 +69,12 @@ public class TicketLookupFunction implements Function<ProfileRequestContext, Str
         final Object request = protocolContext.getRequest();
         final Object response = protocolContext.getResponse();
         final String ticket;
-        if (response instanceof ServiceTicketResponse) {
-            ticket = ((ServiceTicketResponse) response).getTicket();
-        } else if (response instanceof ProxyTicketResponse) {
-            ticket = ((ProxyTicketResponse) response).getPt();
-        } else if (request instanceof TicketValidationRequest) {
-            ticket = ((TicketValidationRequest) request).getTicket();
+        if (response instanceof ServiceTicketResponse resp) {
+            ticket = resp.getTicket();
+        } else if (response instanceof ProxyTicketResponse resp) {
+            ticket = resp.getPt();
+        } else if (request instanceof TicketValidationRequest req) {
+            ticket = req.getTicket();
         } else {
             ticket = null;
         }
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/package-info.java
index ce5ac60da..1413fd666 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/audit/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol audit implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.audit.impl;
 
-package net.shibboleth.idp.cas.audit.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
index 649740bd6..3ccfee2d9 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractCASProtocolAction.java
@@ -36,6 +36,7 @@ import net.shibboleth.idp.cas.ticket.TicketContext;
 import net.shibboleth.idp.profile.AbstractProfileAction;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
+
 /**
  * Base class for CAS protocol actions.
  * 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java
index 21ac99a6c..42465de0d 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/AbstractOutgoingSamlMessageAction.java
@@ -96,12 +96,14 @@ public abstract class AbstractOutgoingSamlMessageAction extends
      * 
      * @return SAML object
      */
-    @Nonnull protected static <T extends SAMLObject> T newSAMLObject(final Class<T> type, @Nonnull final QName elementName) {
+    @Nonnull protected static <T extends SAMLObject> T newSAMLObject(final Class<T> type,
+            @Nonnull final QName elementName) {
         final SAMLObjectBuilder<T> builder = (SAMLObjectBuilder<T>) XMLObjectProviderRegistrySupport.getBuilderFactory()
                 .<T> ensureBuilder(elementName);
         return builder.buildObject();
     }
 
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
@@ -136,7 +138,7 @@ public abstract class AbstractOutgoingSamlMessageAction extends
      * 
      * @throws EventException to signal an event
      */
-    @Nonnull protected abstract Response buildSamlResponse(
-            @Nonnull final ProfileRequestContext profileRequestContext) throws EventException;
+    @Nonnull protected abstract Response buildSamlResponse(@Nonnull final ProfileRequestContext profileRequestContext)
+            throws EventException;
 
 }
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
index 14ccda0d4..d16f9dc92 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildAuthenticationContextAction.java
@@ -49,6 +49,7 @@ public class BuildAuthenticationContextAction
         configLookupFunction = new ConfigLookupFunction<>(LoginConfiguration.class);
     }
     
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -65,6 +66,7 @@ public class BuildAuthenticationContextAction
         return true;
     }
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java
index cc7f445e9..60179d429 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildProxyChainAction.java
@@ -71,6 +71,7 @@ public class BuildProxyChainAction
         casTicketService = Constraint.isNotNull(ticketService, "TicketService cannot be null");
     }
     
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -88,6 +89,7 @@ public class BuildProxyChainAction
         return true;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java
index 6e962b026..927017811 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildRelyingPartyContextAction.java
@@ -35,7 +35,6 @@ import net.shibboleth.idp.cas.service.Service;
 import net.shibboleth.idp.cas.service.ServiceRegistry;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -61,7 +60,7 @@ public class BuildRelyingPartyContextAction<RequestType,ResponseType>
     @Nonnull private final Logger log = LoggerFactory.getLogger(BuildRelyingPartyContextAction.class);
 
     /** List of registries to query for verified CAS services (relying parties). */
-    @Nonnull @NonnullElements @NotEmpty private final List<ServiceRegistry> serviceRegistries;
+    @Nonnull @NotEmpty private final List<ServiceRegistry> serviceRegistries;
     
     /** Request. */
     @NonnullBeforeExec private Object request;
@@ -72,9 +71,11 @@ public class BuildRelyingPartyContextAction<RequestType,ResponseType>
      * @param registries One or more service registries to query for CAS services.
      */
     public BuildRelyingPartyContextAction(@Nonnull @NotEmpty final ServiceRegistry ... registries) {
-        serviceRegistries = CollectionSupport.listOf(Constraint.isNotEmpty(registries, "Service registries cannot be null"));
+        serviceRegistries = CollectionSupport.listOf(
+                Constraint.isNotEmpty(registries, "Service registries cannot be null"));
     }
     
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -92,6 +93,7 @@ public class BuildRelyingPartyContextAction<RequestType,ResponseType>
     }
     
 
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(final @Nonnull ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
index 9f705b57c..9fb3bbab9 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSAMLMetadataContextAction.java
@@ -81,6 +81,7 @@ public class BuildSAMLMetadataContextAction<RequestType,ResponseType>
         return service;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -103,6 +104,7 @@ public class BuildSAMLMetadataContextAction<RequestType,ResponseType>
         return true;
     }    
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(final @Nonnull ProfileRequestContext profileRequestContext) {
         
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationFailureMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationFailureMessageAction.java
index c40275811..876692542 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationFailureMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationFailureMessageAction.java
@@ -39,6 +39,7 @@ import org.opensaml.saml.saml1.core.StatusMessage;
  */
 public class BuildSamlValidationFailureMessageAction extends AbstractOutgoingSamlMessageAction {
 
+    /** {@inheritDoc} */
     @Override
     @Nonnull protected Response buildSamlResponse(@Nonnull final ProfileRequestContext profileRequestContext)
             throws EventException {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationSuccessMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationSuccessMessageAction.java
index 0f3f05b82..f937bcfa9 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationSuccessMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/BuildSamlValidationSuccessMessageAction.java
@@ -20,6 +20,7 @@ package net.shibboleth.idp.cas.flow.impl;
 import java.time.Instant;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.XMLObjectBuilder;
 import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
@@ -62,22 +63,19 @@ import net.shibboleth.shared.security.IdentifierGenerationStrategy;
 public class BuildSamlValidationSuccessMessageAction extends AbstractOutgoingSamlMessageAction {
 
     /** Attribute namespace. */
-    private static final String NAMESPACE = "http://www.ja-sig.org/products/cas/";
+    @Nonnull private static final String NAMESPACE = "http://www.ja-sig.org/products/cas/";
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(BuildSamlValidationSuccessMessageAction.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(BuildSamlValidationSuccessMessageAction.class);
 
     /** Attribute value node builder. */
-    private final XMLObjectBuilder<XSString> attrValueBuilder;
+    @Nonnull private final XMLObjectBuilder<XSString> attrValueBuilder;
 
     /** SAML identifier generation strategy. */
-    @Nonnull
-    private final IdentifierGenerationStrategy identifierGenerationStrategy;
+    @Nonnull private final IdentifierGenerationStrategy identifierGenerationStrategy;
 
     /** IdP entity ID used to set issuer field of generated assertions. */
-    @Nonnull
-    private final String entityID;
-
+    @Nonnull private final String entityID;
 
     /**
      * Constructor.
@@ -95,6 +93,7 @@ public class BuildSamlValidationSuccessMessageAction extends AbstractOutgoingSam
                 XSString.TYPE_NAME);
     }
 
+    /** {@inheritDoc} */
     @Override
     @Nonnull protected Response buildSamlResponse(@Nonnull final ProfileRequestContext profileRequestContext)
             throws EventException {
@@ -164,7 +163,7 @@ public class BuildSamlValidationSuccessMessageAction extends AbstractOutgoingSam
      * @param identifier subject identifier
      * @return new subject
      */
-    @Nonnull private Subject newSubject(final String identifier) {
+    @Nonnull private Subject newSubject(@Nullable final String identifier) {
         final SubjectConfirmation confirmation = newSAMLObject(
                 SubjectConfirmation.class, SubjectConfirmation.DEFAULT_ELEMENT_NAME);
         final ConfirmationMethod method = newSAMLObject(
@@ -187,8 +186,9 @@ public class BuildSamlValidationSuccessMessageAction extends AbstractOutgoingSam
      * @param principal authenticated principal
      * @return new authentication statement
      */
-    private AuthenticationStatement newAuthenticationStatement(
-            final Instant authnInstant, final String authnMethod, final String principal) {
+    @Nonnull private AuthenticationStatement newAuthenticationStatement(
+            @Nullable final Instant authnInstant, @Nullable final String authnMethod,
+            @Nullable final String principal) {
         final AuthenticationStatement authnStatement = newSAMLObject(
                 AuthenticationStatement.class, AuthenticationStatement.DEFAULT_ELEMENT_NAME);
         authnStatement.setAuthenticationInstant(authnInstant);
@@ -203,7 +203,7 @@ public class BuildSamlValidationSuccessMessageAction extends AbstractOutgoingSam
      * @param value attribute value
      * @return new attribute value
      */
-    private XSString newAttributeValue(final String value) {
+    @Nonnull private XSString newAttributeValue(@Nullable final String value) {
         final XSString stringValue = attrValueBuilder.buildObject(
                 AttributeValue.DEFAULT_ELEMENT_NAME, XSString.TYPE_NAME);
         stringValue.setValue(value);
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java
index 7ba781a99..4b15bb0ae 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/CheckProxyAuthorizationAction.java
@@ -52,6 +52,7 @@ public class CheckProxyAuthorizationAction<RequestType,ResponseType>
     /** CAS service. */
     @NonnullBeforeExec private Service service;
     
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -68,6 +69,7 @@ public class CheckProxyAuthorizationAction<RequestType,ResponseType>
         return true;
     }    
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/Events.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/Events.java
index 4ddeb34e8..e7901fc43 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/Events.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/Events.java
@@ -48,7 +48,8 @@ public enum Events {
      *
      * @return Spring webflow event.
      */
-    @Nonnull public Event event(final Object source) {
+    @Nonnull public Event event(@Nonnull final Object source) {
         return new Event(source, name());
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java
index 15a8b4029..8483d9319 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantProxyTicketAction.java
@@ -119,6 +119,7 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
         validateIdPSessionPredicate = Constraint.isNotNull(predicate, "Session validation condition cannot be null");
     }
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -159,6 +160,7 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
         return proxyGrantingTicket;
     }
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
@@ -172,7 +174,8 @@ public class GrantProxyTicketAction extends AbstractCASProtocolAction<ProxyTicke
             try {
                 log.debug("{} Attempting to retrieve session {}", getLogPrefix(), proxyGrantingTicket.getSessionId());
                 session = sessionResolver.resolveSingle(new CriteriaSet(new SessionIdCriterion(
-                        Constraint.isNotNull(proxyGrantingTicket.getSessionId(), "ProxyGrantingTicket session id was null"))));
+                        Constraint.isNotNull(proxyGrantingTicket.getSessionId(),
+                                "ProxyGrantingTicket session id was null"))));
             } catch (final ResolverException e) {
                 log.warn("{} IdPSession resolution error: {}", getLogPrefix(), e);
             }
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
index f83c23d25..ccbf5b727 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/GrantServiceTicketAction.java
@@ -263,7 +263,7 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
      * 
      * @return IdP session
      */
-    @Nullable private IdPSession getIdPSession(final ProfileRequestContext prc) {
+    @Nullable private IdPSession getIdPSession(@Nonnull final ProfileRequestContext prc) {
         final SessionContext sessionContext = sessionContextFunction.apply(prc);
         return sessionContext != null ? sessionContext.getIdPSession() : null;
     }
@@ -274,7 +274,7 @@ public class GrantServiceTicketAction extends AbstractCASProtocolAction<ServiceT
      * @param prc profile request context.
      * @return Principal name.
      */
-    @Nonnull private String getPrincipalName(final ProfileRequestContext prc) {
+    @Nonnull private String getPrincipalName(@Nonnull final ProfileRequestContext prc) {
         final String principal = principalLookupFunction.apply(prc);
         if (principal == null ) {
             throw new IllegalStateException("Cannot determine IdP subject principal name.");
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java
index c97b6f047..d1e95fcf9 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeLoginAction.java
@@ -44,6 +44,7 @@ import org.springframework.webflow.execution.RequestContext;
  */
 public class InitializeLoginAction extends AbstractCASProtocolAction<ServiceTicketRequest, ServiceTicketResponse> {
 
+    /** {@inheritDoc} */
     @Override
     @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
             @Nonnull final ProfileRequestContext profileRequestContext) {
@@ -86,4 +87,5 @@ public class InitializeLoginAction extends AbstractCASProtocolAction<ServiceTick
 
         return ActionSupport.buildProceedEvent(this);
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
index eb882c34d..aa6939923 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeProxyAction.java
@@ -73,6 +73,7 @@ public class InitializeProxyAction extends AbstractCASProtocolAction<ProxyTicket
         casTicketService = Constraint.isNotNull(ticketService, "Ticket service cannot be null.");
     }
 
+    /** {@inheritDoc} */
     @Override
     @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
             @Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
index 4cfa2582a..b297fce34 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/InitializeValidateAction.java
@@ -46,6 +46,7 @@ import org.springframework.webflow.execution.RequestContext;
 public class InitializeValidateAction extends
         AbstractCASProtocolAction<TicketValidationRequest, TicketValidationResponse> {
 
+    /** {@inheritDoc} */
     @Override
     @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
             @Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java
index 535e9fd0b..2e3c89db3 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PopulateProtocolErrorAction.java
@@ -49,6 +49,7 @@ public class PopulateProtocolErrorAction<RequestType>
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(PopulateProtocolErrorAction.class);
     
+    /** {@inheritDoc} */
     @Override
     @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
             @Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java
index cf3c91218..04a31250c 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PrepareTicketValidationResponseAction.java
@@ -55,7 +55,6 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -142,6 +141,7 @@ public class PrepareTicketValidationResponseAction extends
                 CollectionSupport.singletonMap(AttributeTranscoderRegistry.PROP_TRANSCODER, transcoder));
     }
     
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -176,7 +176,8 @@ public class PrepareTicketValidationResponseAction extends
         return true;
     }    
     
-    // Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity OFF
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
@@ -234,9 +235,12 @@ public class PrepareTicketValidationResponseAction extends
             return;
         }
         
-        encodedAttributes.forEach(a -> {assert a!=null; ticketValidationResponse.addAttribute(a);});
+        encodedAttributes.forEach(a -> {
+            assert a!=null; ticketValidationResponse.addAttribute(a);
+            }
+        );
     }
-    // Checkstyle: CyclomaticComplexity ON
+// Checkstyle: CyclomaticComplexity ON
 
     /**
      * Access the registry of transcoding rules to transform the input attribute into a target type.
@@ -250,7 +254,7 @@ public class PrepareTicketValidationResponseAction extends
      */
     protected int encodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
             @Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final IdPAttribute attribute,
-            @Nonnull @NonnullElements @Live final Collection<Attribute> results) {
+            @Nonnull @Live final Collection<Attribute> results) {
         
         Collection<TranscodingRule> transcodingRules = registry.getTranscodingRules(attribute, Attribute.class);
         if (transcodingRules.isEmpty()) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java
index 1122f2079..3966a6870 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ProcessSamlMessageAction.java
@@ -37,7 +37,6 @@ import net.shibboleth.idp.cas.protocol.SamlParam;
 import net.shibboleth.idp.cas.protocol.TicketValidationRequest;
 import net.shibboleth.idp.cas.protocol.TicketValidationResponse;
 import net.shibboleth.idp.profile.ActionSupport;
-import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -58,6 +57,7 @@ public class ProcessSamlMessageAction extends
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(ProcessSamlMessageAction.class);
 
+    /** {@inheritDoc} */
     @Override
     @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
             @Nonnull final ProfileRequestContext profileRequestContext) {
@@ -71,7 +71,7 @@ public class ProcessSamlMessageAction extends
         }
 
         // Extract ticket from SAML request
-        @Nonnull final MessageContext msgContext = Constraint.isNotNull(profileRequestContext.getInboundMessageContext(), "no inbound Context");
+        final MessageContext msgContext = profileRequestContext.ensureInboundMessageContext();
         String ticket = null;
         final Object message = msgContext.getMessage();
         if (message != null && message instanceof Request) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java
index a67142485..f7ea4664f 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/PublishProtocolMessageAction.java
@@ -54,6 +54,7 @@ public class PublishProtocolMessageAction<RequestType,ResponseType>
         requestFlag = isRequest;
     }
 
+    /** {@inheritDoc} */
     @Override
     @Nullable protected Event doExecute(@Nonnull final RequestContext springRequestContext,
             @Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java
index c17b5ea17..c1df6b4cc 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/UpdateIdPSessionWithSPSessionAction.java
@@ -100,6 +100,7 @@ public class UpdateIdPSessionWithSPSessionAction<RequestType,ResponseType>
         relyingPartyIdLookupStrategy = Constraint.isNotNull(strategy, "RelyingParty ID lookup strategy cannot be null");
     }
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -121,6 +122,7 @@ public class UpdateIdPSessionWithSPSessionAction<RequestType,ResponseType>
         return true;
     }
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java
index 7e7b05efa..9f54ad904 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateProxyCallbackAction.java
@@ -116,6 +116,7 @@ public class ValidateProxyCallbackAction
         return ticket;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -146,11 +147,12 @@ public class ValidateProxyCallbackAction
         return true;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         
-        @Nonnull final IdentifierGenerationStrategy pgtGenerator = securityConfig.getIdGenerator();
-        @Nonnull final IdentifierGenerationStrategy pgtIOUGenerator = validateConfig.getPGTIOUGenerator(profileRequestContext);
+        final IdentifierGenerationStrategy pgtGenerator = securityConfig.getIdGenerator();
+        final IdentifierGenerationStrategy pgtIOUGenerator = validateConfig.getPGTIOUGenerator(profileRequestContext);
         final Instant expiration = Instant.now().plus(validateConfig.getTicketValidityPeriod(profileRequestContext));
         assert expiration!=null;
         @Nonnull final String pgtId = pgtGenerator.generateIdentifier();
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateRenewAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateRenewAction.java
index be1455508..52acc8110 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateRenewAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateRenewAction.java
@@ -53,6 +53,7 @@ public class ValidateRenewAction extends AbstractCASProtocolAction<TicketValidat
     /** CAS request. */
     @NonnullBeforeExec private TicketValidationRequest request;
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -70,6 +71,7 @@ public class ValidateRenewAction extends AbstractCASProtocolAction<TicketValidat
         return true;
     }
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateTicketAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateTicketAction.java
index bb8c015b7..0d91265f5 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateTicketAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/ValidateTicketAction.java
@@ -82,6 +82,7 @@ public class ValidateTicketAction extends AbstractCASProtocolAction<TicketValida
         configLookupFunction = new ConfigLookupFunction<>(ValidateConfiguration.class);
     }
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -104,6 +105,7 @@ public class ValidateTicketAction extends AbstractCASProtocolAction<TicketValida
         return true;
     }
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/WriteValidateResponseAction.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/WriteValidateResponseAction.java
index 250dece6f..6845383f1 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/WriteValidateResponseAction.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/WriteValidateResponseAction.java
@@ -59,6 +59,7 @@ public class WriteValidateResponseAction extends
         success = successFlag;
     }
 
+    /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
         if (!super.doPreExecute(profileRequestContext)) {
@@ -75,6 +76,7 @@ public class WriteValidateResponseAction extends
         return true;
     }
     
+    /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/package-info.java
index e9f457bfa..5cf90a85a 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/flow/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol flow implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.flow.impl;
 
-package net.shibboleth.idp.cas.flow.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
index 0e473bbd4..bde8fa258 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
@@ -37,7 +37,6 @@ import net.shibboleth.idp.cas.protocol.ProtocolContext;
 import net.shibboleth.idp.cas.proxy.ProxyValidator;
 import net.shibboleth.idp.cas.service.Service;
 import net.shibboleth.idp.cas.service.ServiceContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -100,7 +99,7 @@ public class HttpClientProxyValidator implements ProxyValidator {
     @Nonnull private final HttpClientSecurityParameters securityParameters;
 
     /** List of HTTP response codes permitted for successful proxy callback. */
-    @NotEmpty @NonnullElements private Set<Integer> allowedResponseCodes;
+    @NotEmpty private Set<Integer> allowedResponseCodes;
 
     /**
      * 
@@ -121,9 +120,8 @@ public class HttpClientProxyValidator implements ProxyValidator {
      *
      * @param responseCodes One or more HTTP response codes.
      */
-    public void setAllowedResponseCodes(@NotEmpty @NonnullElements final Set<Integer> responseCodes) {
+    public void setAllowedResponseCodes(@Nonnull @NotEmpty final Set<Integer> responseCodes) {
         Constraint.isNotEmpty(responseCodes, "Response codes cannot be null or empty.");
-        Constraint.noNullItems(responseCodes.toArray(), "Response codes cannot contain null elements.");
         allowedResponseCodes = CollectionSupport.copyToSet(responseCodes);
     }
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/package-info.java
index f85cf5746..b74f06865 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol proxy implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.proxy.impl;
 
-package net.shibboleth.idp.cas.proxy.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/DefaultServiceComparator.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/DefaultServiceComparator.java
deleted file mode 100644
index 2330759bd..000000000
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/DefaultServiceComparator.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements.  See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License.  You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.cas.service.impl;
-
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.primitive.DeprecationSupport;
-import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
-
-/**
- * Default comparator implementation for comparing CAS service URLs. URL comparison is case-insensitive and supports
- * ignoring predefined URL path parameters. The common session marker <em>;jessionid=value</em> is ignored by default.
- *
- * @author Marvin S. Addison
- * 
- * @deprecated
- */
- at Deprecated(forRemoval=true, since="4.0.0")
-public class DefaultServiceComparator extends net.shibboleth.idp.cas.service.DefaultServiceComparator {
-
-    /** Creates a new instance that ignores <em>;jsessionid=value</em>. */
-    public DefaultServiceComparator() {
-        final Class<? extends DefaultServiceComparator> claz = getClass();
-        assert claz!=null;
-        final String className = claz.getName();
-        assert className!=null;
-        DeprecationSupport.warn(ObjectType.CLASS, className, "cas-protocol.xml",
-                "net.shibboleth.idp.cas.service.DefaultServiceComparator");
-    }
-
-    /**
-     * Creates a new instance that ignores the given path parameter names (and any associated values).
-     *
-     * @param  parameterNames  List of path parameter names to ignore.
-     */
-    public DefaultServiceComparator(@Nonnull final String ... parameterNames) {
-        super(parameterNames);
-        final Class<? extends DefaultServiceComparator> claz = getClass();
-        assert claz!=null;
-        final String className = claz.getName();
-        assert className!=null;
-        DeprecationSupport.warn(ObjectType.CLASS, className, "cas-protocol.xml",
-                "net.shibboleth.idp.cas.service.DefaultServiceComparator");
-    }
-    
-}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
index a9bd76a5a..2e8a2763a 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/MetadataServiceRegistry.java
@@ -48,6 +48,7 @@ import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
+
 /**
  * CAS service registry implementation that queries SAML metadata for a CAS service given a CAS service URL using
  * the following strategy. A {@link MetadataResolver} is queried for an {@link EntityDescriptor} that meets the
@@ -81,23 +82,22 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class MetadataServiceRegistry implements ServiceRegistry {
 
     /** URI identifying an ACS endpoint that requests CAS service tickets. */
-    public static final String LOGIN_BINDING = LoginConfiguration.PROFILE_ID;
+    @Nonnull public static final String LOGIN_BINDING = LoginConfiguration.PROFILE_ID;
 
     /** URI identifying a CAS SLO endpoint. */
-    public static final String LOGOUT_BINDING = AbstractProtocolConfiguration.PROTOCOL_URI + "/logout";
+    @Nonnull public static final String LOGOUT_BINDING = AbstractProtocolConfiguration.PROTOCOL_URI + "/logout";
 
     /** URN marking that SLO endpoint is dynamic based on service ticket URL. */
-    public static final String LOGOUT_LOCATION= "urn:mace:shibboleth:profile:CAS:logout";
+    @Nonnull public static final String LOGOUT_LOCATION= "urn:mace:shibboleth:profile:CAS:logout";
 
     /** URI identifying a CAS proxy callback endoint. */
-    public static final String PROXY_BINDING = ProxyConfiguration.PROFILE_ID;
+    @Nonnull public static final String PROXY_BINDING = ProxyConfiguration.PROFILE_ID;
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(MetadataServiceRegistry.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(MetadataServiceRegistry.class);
 
     /** SAML metadata resolver. */
-    @Nonnull
-    private final RoleDescriptorResolver metadataResolver;
+    @Nonnull private final RoleDescriptorResolver metadataResolver;
 
 
     /**
@@ -109,9 +109,8 @@ public class MetadataServiceRegistry implements ServiceRegistry {
         metadataResolver = resolver;
     }
 
-    @Nullable
-    @Override
-    public Service lookup(final @Nonnull String serviceURL) {
+    /** {@inheritDoc} */
+    @Nullable public Service lookup(final @Nonnull String serviceURL) {
         try {
             final RoleDescriptor role = metadataResolver.resolveSingle(criteria(serviceURL));
             if (role instanceof SPSSODescriptor) {
@@ -131,8 +130,7 @@ public class MetadataServiceRegistry implements ServiceRegistry {
      *
      * @return Metadata resolver criteria set.
      */
-    @Nonnull
-    protected CriteriaSet criteria(@Nonnull final String serviceURL) {
+    @Nonnull protected CriteriaSet criteria(@Nonnull final String serviceURL) {
         final AssertionConsumerService loginACS = new AssertionConsumerServiceBuilder().buildObject();
         loginACS.setBinding(LOGIN_BINDING);
         loginACS.setLocation(serviceURL);
@@ -152,8 +150,7 @@ public class MetadataServiceRegistry implements ServiceRegistry {
      *
      * @return CAS service created from inputs.
      */
-    @Nonnull
-    protected Service create(@Nonnull final String serviceURL, @Nonnull final SPSSODescriptor role) {
+    @Nonnull protected Service create(@Nonnull final String serviceURL, @Nonnull final SPSSODescriptor role) {
         
         final EntityDescriptor entity = (EntityDescriptor) role.getParent();
         assert entity!=null;
@@ -212,4 +209,5 @@ public class MetadataServiceRegistry implements ServiceRegistry {
             return LOGIN_BINDING.equals(endpoint.getBinding());
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java
index b8b6a58df..72190399e 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java
@@ -43,7 +43,7 @@ public class ReloadingServiceRegistry extends AbstractIdentifiableInitializableC
     @Nonnull private final Logger log = LoggerFactory.getLogger(ReloadingServiceRegistry.class);
 
     /** The service that manages the reloading. */
-    private final ReloadableService<ServiceRegistry> service;
+    @Nonnull private final ReloadableService<ServiceRegistry> service;
 
     /**
      * Creates a new instance.
@@ -55,7 +55,7 @@ public class ReloadingServiceRegistry extends AbstractIdentifiableInitializableC
         service = Constraint.isNotNull(delegate, "ReloadableService cannot be null");
     }
 
-    @Override
+    /** {@inheritDoc} */
     @Nullable public Service lookup(@Nonnull final String serviceURL) {
         try (final ServiceableComponent<ServiceRegistry> component = service.getServiceableComponent()) {
             return component.getComponent().lookup(serviceURL);
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java
index 8eb8fa212..dcffc1671 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java
@@ -28,6 +28,8 @@ import javax.xml.namespace.QName;
 
 import net.shibboleth.idp.cas.service.Service;
 import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -79,7 +81,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
     }
 
     /** {@inheritDoc} */
-    public String getEntityID() {
+    @Nullable public String getEntityID() {
         return svc.getName();
     }
 
@@ -93,7 +95,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
     }
 
     /** {@inheritDoc} */
-    public String getID() {
+    @Nullable public String getID() {
         return null;
     }
 
@@ -107,7 +109,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
     }
 
     /** {@inheritDoc} */
-    public Extensions getExtensions() {
+    @Nullable public Extensions getExtensions() {
         return null;
     }
 
@@ -163,7 +165,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
     }
 
     /** {@inheritDoc} */
-    public AffiliationDescriptor getAffiliationDescriptor() {
+    @Nullable public AffiliationDescriptor getAffiliationDescriptor() {
         return null;
     }
 
@@ -255,8 +257,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
     }
 
     /** {@inheritDoc} */
-    @Override
-    @Nullable public List<XMLObject> getOrderedChildren() {
+    @Nullable @Unmodifiable @NotLive public List<XMLObject> getOrderedChildren() {
         return null;
     }
 
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/package-info.java
index 4a60771c2..9d62d4a4c 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol service implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.service.impl;
 
-package net.shibboleth.idp.cas.service.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/CASSPSessionSerializer.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/CASSPSessionSerializer.java
index 4aaec425a..7e58f0c75 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/CASSPSessionSerializer.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/CASSPSessionSerializer.java
@@ -53,6 +53,7 @@ public class CASSPSessionSerializer extends AbstractSPSessionSerializer {
         super(offset);
     }
 
+    /** {@inheritDoc} */
     @Override
     protected void doSerializeAdditional(@Nonnull final SPSession instance, @Nonnull final JsonGenerator generator) {
         if (!(instance instanceof CASSPSession)) {
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/package-info.java
index 9a9555959..c397154dd 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/session/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol session implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.session.impl;
 
-package net.shibboleth.idp.cas.session.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/AbstractTicketService.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/AbstractTicketService.java
index f8868d77b..6dac24b2c 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/AbstractTicketService.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/AbstractTicketService.java
@@ -52,27 +52,26 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public abstract class AbstractTicketService implements TicketService {
 
     /** Map of ticket classes to context names. */
-    private static final Map<Class<? extends Ticket>, String> CONTEXT_CLASS_MAP = new HashMap<>();
+    @Nonnull private static final Map<Class<? extends Ticket>, String> CONTEXT_CLASS_MAP = new HashMap<>();
 
     /** Map of ticket classes to serializers. */
-    private static final Map<Class<? extends Ticket>, StorageSerializer<? extends Ticket>> SERIALIZER_MAP =
+    @Nonnull  private static final Map<Class<? extends Ticket>, StorageSerializer<? extends Ticket>> SERIALIZER_MAP =
             new HashMap<>();
 
     /** Service ticket serializer. */
-    private static final ServiceTicketSerializer ST_SERIALIZER = new ServiceTicketSerializer();
+    @Nonnull private static final ServiceTicketSerializer ST_SERIALIZER = new ServiceTicketSerializer();
     
     /** Proxy ticket serialize. */
-    private static final ProxyTicketSerializer PT_SERIALIZER = new ProxyTicketSerializer();
+    @Nonnull private static final ProxyTicketSerializer PT_SERIALIZER = new ProxyTicketSerializer();
     
     /** Proxy granting ticket serializer. */
-    private static final ProxyGrantingTicketSerializer PGT_SERIALIZER = new ProxyGrantingTicketSerializer();
+    @Nonnull private static final ProxyGrantingTicketSerializer PGT_SERIALIZER = new ProxyGrantingTicketSerializer();
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(AbstractTicketService.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(AbstractTicketService.class);
 
     /** Storage service to which ticket persistence operations are delegated. */
-    @Nonnull
-    private final StorageService storageService;
+    @Nonnull private final StorageService storageService;
 
 
     static {
@@ -90,12 +89,11 @@ public abstract class AbstractTicketService implements TicketService {
      * @param service Storage service to which tickets are persisted.
      */
     public AbstractTicketService(@Nonnull final StorageService service) {
-        this.storageService = Constraint.isNotNull(service, "StorageService cannot be null.");
+        storageService = Constraint.isNotNull(service, "StorageService cannot be null.");
     }
 
-    @Override
-    @Nonnull
-    public ProxyGrantingTicket createProxyGrantingTicket(
+    /** {@inheritDoc} */
+    @Nonnull public ProxyGrantingTicket createProxyGrantingTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final ServiceTicket serviceTicket,
@@ -112,9 +110,8 @@ public abstract class AbstractTicketService implements TicketService {
         return pgt;
     }
 
-    @Override
-    @Nonnull
-    public ProxyGrantingTicket createProxyGrantingTicket(
+    /** {@inheritDoc} */
+    @Nonnull public ProxyGrantingTicket createProxyGrantingTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final ProxyTicket proxyTicket,
@@ -131,16 +128,14 @@ public abstract class AbstractTicketService implements TicketService {
         return pgt;
     }
 
-    @Override
-    @Nullable
-    public ProxyGrantingTicket fetchProxyGrantingTicket(@Nonnull final String id) {
+    /** {@inheritDoc} */
+    @Nullable public ProxyGrantingTicket fetchProxyGrantingTicket(@Nonnull final String id) {
         Constraint.isNotNull(id, "Id cannot be null");
         return read(id, ProxyGrantingTicket.class);
     }
 
-    @Override
-    @Nullable
-    public ProxyGrantingTicket removeProxyGrantingTicket(@Nonnull final String id) {
+    /** {@inheritDoc} */
+    @Nullable public ProxyGrantingTicket removeProxyGrantingTicket(@Nonnull final String id) {
         Constraint.isNotNull(id, "Id cannot be null");
         final ProxyGrantingTicket pgt = delete(id, ProxyGrantingTicket.class);
         return pgt;
@@ -153,7 +148,7 @@ public abstract class AbstractTicketService implements TicketService {
      *
      * @return Context name for ticket type.
      */
-    protected static String context(final Class<? extends Ticket> clazz) {
+    @Nullable protected static String context(@Nonnull final Class<? extends Ticket> clazz) {
         return CONTEXT_CLASS_MAP.get(clazz);
     }
 
@@ -166,7 +161,8 @@ public abstract class AbstractTicketService implements TicketService {
      * @return Storage service serializer.
      */
     @Nonnull protected static <T extends Ticket> StorageSerializer<T> serializer(@Nonnull final Class<T> clazz) {
-        final StorageSerializer<T> result = (StorageSerializer<T>) Constraint.isNotNull(SERIALIZER_MAP.get(clazz), "Serializer for " + clazz + " not found");
+        final StorageSerializer<T> result = (StorageSerializer<T>) Constraint.isNotNull(SERIALIZER_MAP.get(clazz),
+                "Serializer for " + clazz + " not found");
         return result;
     }
 
@@ -177,7 +173,8 @@ public abstract class AbstractTicketService implements TicketService {
      * @param <T> Type of ticket.
      */
     protected <T extends Ticket> void store(@Nonnull final T ticket) {
-        final String context = Constraint.isNotNull(context(ticket.getClass()), "Could not find context for ticket of type " + ticket.getClass());
+        final String context = Constraint.isNotNull(context(ticket.getClass()),
+                "Could not find context for ticket of type " + ticket.getClass());
         try {
             final String sessionId = Constraint.isNotNull(ticket.getSessionId(), "No session Id");
             final long expiry = ticket.getExpirationInstant().toEpochMilli();
@@ -204,11 +201,12 @@ public abstract class AbstractTicketService implements TicketService {
      *
      * @return Ticket or null if ticket not found.
      */
-    protected <T extends Ticket> T read(@Nonnull final String id, @Nonnull final Class<T> clazz) {
+    @Nullable protected <T extends Ticket> T read(@Nonnull final String id, @Nonnull final Class<T> clazz) {
         log.debug("Reading {}", id);
         final T ticket;
         try {
-            final String context = Constraint.isNotNull(context(clazz), "Could not find context for ticket of type " + clazz);
+            final String context = Constraint.isNotNull(context(clazz),
+                    "Could not find context for ticket of type " + clazz);
             final StorageRecord<T> sessionRecord = storageService.read(context, id);
             if (sessionRecord == null) {
                 log.debug("{} not found in context {}", id, context);
@@ -236,13 +234,14 @@ public abstract class AbstractTicketService implements TicketService {
      *
      * @return Deleted ticket or null if ticket not found.
      */
-    protected <T extends Ticket> T delete(@Nonnull final String id, @Nonnull final Class<T> clazz) {
+    @Nullable protected <T extends Ticket> T delete(@Nonnull final String id, @Nonnull final Class<T> clazz) {
         final T ticket = read(id, clazz);
         if (ticket == null) {
             return null;
         }
         try {
-            final String context = Constraint.isNotNull(context(clazz), "Could not find context for ticket of type " + clazz);
+            final String context = Constraint.isNotNull(context(clazz),
+                    "Could not find context for ticket of type " + clazz);
             log.debug("Attempting to delete {} from context {}", id, context);
             if (!storageService.delete(context, id)) {
                 log.info("Failed deleting {} from context {}.", id, context);
@@ -258,5 +257,4 @@ public abstract class AbstractTicketService implements TicketService {
         return ticket;
     }
 
-
-}
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
index b2f32e1d3..a62225da2 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/EncodingTicketService.java
@@ -63,35 +63,31 @@ import net.shibboleth.shared.security.DataSealer;
 public class EncodingTicketService extends AbstractTicketService {
 
     /** Default service ticket prefix. */
-    public static final String SERVICE_TICKET_PREFIX = "ST";
+    @Nonnull public static final String SERVICE_TICKET_PREFIX = "ST";
 
     /** Default proxy ticket prefix. */
-    public static final String PROXY_TICKET_PREFIX = "PT";
+    @Nonnull public static final String PROXY_TICKET_PREFIX = "PT";
 
     /** Default proxy granting ticket prefix. */
-    public static final String PROXY_GRANTING_TICKET_PREFIX = "PGT-E";
+    @Nonnull public static final String PROXY_GRANTING_TICKET_PREFIX = "PGT-E";
 
     /** Non-null marker value for unused ServiceTicket#id field and storage context name. */
-    private static final String NOT_USED = "na";
+    @Nonnull private static final String NOT_USED = "na";
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(EncodingTicketService.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EncodingTicketService.class);
 
     /** Data sealer that handles encryption of serialized service ticket data. */
-    @Nonnull
-    private final DataSealer dataSealer;
+    @Nonnull private final DataSealer dataSealer;
 
     /** Service ticket prefix. */
-    @Nonnull @NotEmpty
-    private String serviceTicketPrefix = SERVICE_TICKET_PREFIX;
+    @Nonnull @NotEmpty private String serviceTicketPrefix = SERVICE_TICKET_PREFIX;
 
     /** Proxy ticket prefix. */
-    @Nonnull @NotEmpty
-    private String proxyTicketPrefix = PROXY_TICKET_PREFIX;
+    @Nonnull @NotEmpty private String proxyTicketPrefix = PROXY_TICKET_PREFIX;
 
     /** Proxy granting ticket prefix. */
-    @Nonnull @NotEmpty
-    private String proxyGrantingTicketPrefix = PROXY_GRANTING_TICKET_PREFIX;
+    @Nonnull @NotEmpty private String proxyGrantingTicketPrefix = PROXY_GRANTING_TICKET_PREFIX;
 
     /**
      * Creates a new instance.
@@ -110,7 +106,7 @@ public class EncodingTicketService extends AbstractTicketService {
      *
      * @param prefix Service ticket prefix.
      */
-    public void setServiceTicketPrefix(final String prefix) {
+    public void setServiceTicketPrefix(@Nonnull @NotEmpty final String prefix) {
         serviceTicketPrefix = Constraint.isNotEmpty(prefix, "Prefix cannot be null or empty");
     }
 
@@ -119,7 +115,7 @@ public class EncodingTicketService extends AbstractTicketService {
      *
      * @param prefix Proxy ticket prefix.
      */
-    public void setProxyTicketPrefix(final String prefix) {
+    public void setProxyTicketPrefix(@Nonnull @NotEmpty final String prefix) {
         proxyTicketPrefix = Constraint.isNotEmpty(prefix, "Prefix cannot be null or empty");
     }
 
@@ -129,13 +125,13 @@ public class EncodingTicketService extends AbstractTicketService {
      *
      * @param prefix Proxy granting ticket prefix.
      */
-    public void setProxyGrantingTicketPrefix(final String prefix) {
+    public void setProxyGrantingTicketPrefix(@Nonnull @NotEmpty final String prefix) {
         proxyGrantingTicketPrefix = Constraint.isNotEmpty(prefix, "Prefix cannot be null or empty");
     }
 
+    /** {@inheritDoc} */
     @Override
-    @Nonnull
-    public ServiceTicket createServiceTicket(
+    @Nonnull public ServiceTicket createServiceTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final String service,
@@ -151,16 +147,16 @@ public class EncodingTicketService extends AbstractTicketService {
         return encode(ServiceTicket.class, st, serviceTicketPrefix);
     }
 
+    /** {@inheritDoc} */
     @Override
-    @Nullable
-    public ServiceTicket removeServiceTicket(@Nonnull final String id) {
+    @Nullable public ServiceTicket removeServiceTicket(@Nonnull final String id) {
         Constraint.isNotNull(id, "Id cannot be null");
         return decode(ServiceTicket.class, id, serviceTicketPrefix);
     }
 
-    @Nonnull
+    /** {@inheritDoc} */
     @Override
-    public ProxyTicket createProxyTicket(
+    @Nonnull public ProxyTicket createProxyTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final ProxyGrantingTicket pgt,
@@ -175,14 +171,15 @@ public class EncodingTicketService extends AbstractTicketService {
         return encode(ProxyTicket.class, pt, proxyTicketPrefix);
     }
 
-    @Nullable
+    /** {@inheritDoc} */
     @Override
-    public ProxyTicket removeProxyTicket(final @Nonnull String id) {
+    @Nullable public ProxyTicket removeProxyTicket(final @Nonnull String id) {
         return decode(ProxyTicket.class, id, proxyTicketPrefix);
     }
 
+    /** {@inheritDoc} */
     @Override
-    public @Nonnull ProxyGrantingTicket createProxyGrantingTicket(
+    @Nonnull public ProxyGrantingTicket createProxyGrantingTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final ServiceTicket serviceTicket,
@@ -198,9 +195,9 @@ public class EncodingTicketService extends AbstractTicketService {
         return encode(ProxyGrantingTicket.class, pgt, proxyGrantingTicketPrefix);
     }
 
-    @Nullable
+    /** {@inheritDoc} */
     @Override
-    public ProxyGrantingTicket fetchProxyGrantingTicket(@Nonnull final String id) {
+    @Nullable public ProxyGrantingTicket fetchProxyGrantingTicket(@Nonnull final String id) {
         Constraint.isNotNull(id, "Id cannot be null");
         if (id.startsWith(proxyGrantingTicketPrefix + "-")) {
             return decode(ProxyGrantingTicket.class, id, proxyGrantingTicketPrefix);
@@ -208,9 +205,9 @@ public class EncodingTicketService extends AbstractTicketService {
         return super.fetchProxyGrantingTicket(id);
     }
 
+    /** {@inheritDoc} */
     @Override
-    @Nullable
-    public ProxyGrantingTicket removeProxyGrantingTicket(@Nonnull final String id) {
+    @Nullable public ProxyGrantingTicket removeProxyGrantingTicket(@Nonnull final String id) {
         Constraint.isNotNull(id, "Id cannot be null");
         if (id.startsWith(proxyGrantingTicketPrefix + "-")) {
             return decode(ProxyGrantingTicket.class, id, proxyGrantingTicketPrefix);
@@ -228,7 +225,8 @@ public class EncodingTicketService extends AbstractTicketService {
      * 
      * @return ticket encoded ticket
      */
-    @Nonnull  <T extends Ticket> T encode(@Nonnull final Class<T> ticketClass, @Nonnull final T ticket, @Nonnull final String prefix) {
+    @Nonnull <T extends Ticket> T encode(@Nonnull final Class<T> ticketClass, @Nonnull final T ticket,
+            @Nonnull final String prefix) {
         final String opaque;
         try {
             opaque = dataSealer.wrap(serializer(ticketClass).serialize(ticket), ticket.getExpirationInstant());
@@ -250,7 +248,8 @@ public class EncodingTicketService extends AbstractTicketService {
      * 
      * @return decoded ticket
      */
-    private <T extends Ticket> T decode(@Nonnull final Class<T> ticketClass, @Nonnull final String id, @Nonnull final String prefix) {
+    @Nullable private <T extends Ticket> T decode(@Nonnull final Class<T> ticketClass, @Nonnull final String id,
+            @Nonnull final String prefix) {
         try {
             final String subString = id.substring(prefix.length() + 1);
             assert subString != null;
@@ -262,4 +261,5 @@ public class EncodingTicketService extends AbstractTicketService {
         }
         return null;
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/SimpleTicketService.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/SimpleTicketService.java
index 764f071a2..98182e24f 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/SimpleTicketService.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/SimpleTicketService.java
@@ -49,8 +49,7 @@ public class SimpleTicketService extends AbstractTicketService {
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull
-    public ServiceTicket createServiceTicket(
+    @Nonnull public ServiceTicket createServiceTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final String service,
@@ -69,16 +68,14 @@ public class SimpleTicketService extends AbstractTicketService {
 
     /** {@inheritDoc} */
     @Override
-    @Nullable
-    public ServiceTicket removeServiceTicket(@Nonnull final String id) {
+    @Nullable public ServiceTicket removeServiceTicket(@Nonnull final String id) {
         Constraint.isNotNull(id, "Id cannot be null");
         return delete(id, ServiceTicket.class);
     }
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull
-    public ProxyTicket createProxyTicket(
+    @Nonnull public ProxyTicket createProxyTicket(
             @Nonnull final String id,
             @Nonnull final Instant expiry,
             @Nonnull final ProxyGrantingTicket pgt,
@@ -96,8 +93,8 @@ public class SimpleTicketService extends AbstractTicketService {
 
     /** {@inheritDoc} */
     @Override
-    @Nullable
-    public ProxyTicket removeProxyTicket(final @Nonnull String id) {
+    @Nullable public ProxyTicket removeProxyTicket(final @Nonnull String id) {
         return delete(id, ProxyTicket.class);
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/package-info.java
index 3c8f45867..1c5198ac4 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol ticket implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.ticket.impl;
 
-package net.shibboleth.idp.cas.ticket.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/AbstractTicketSerializer.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/AbstractTicketSerializer.java
index e689f2928..a75facefa 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/AbstractTicketSerializer.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/AbstractTicketSerializer.java
@@ -89,25 +89,22 @@ public abstract class AbstractTicketSerializer<T extends Ticket> implements Stor
 
     /** JSON generator factory. */
     @SuppressWarnings("null")
-    @Nonnull
-    private final JsonGeneratorFactory generatorFactory = Json.createGeneratorFactory(null);
+    @Nonnull private final JsonGeneratorFactory generatorFactory = Json.createGeneratorFactory(null);
 
     /** JSON reader factory. */
     @SuppressWarnings("null")
-    @Nonnull
-    private final JsonReaderFactory readerFactory = Json.createReaderFactory(null);
+    @Nonnull private final JsonReaderFactory readerFactory = Json.createReaderFactory(null);
 
-    @Override
+    /** {@inheritDoc} */
     public void initialize() throws ComponentInitializationException {}
 
-    @Override
+    /** {@inheritDoc} */
     public boolean isInitialized() {
         return true;
     }
 
-    @Override
-    @Nonnull
-    public String serialize(@Nonnull final T ticket) throws IOException {
+    /** {@inheritDoc} */
+    @Nonnull public String serialize(@Nonnull final T ticket) throws IOException {
         final StringWriter buffer = new StringWriter(200);
         try (final JsonGenerator gen = generatorFactory.createGenerator(buffer)) {
             gen.writeStartObject()
@@ -143,9 +140,8 @@ public abstract class AbstractTicketSerializer<T extends Ticket> implements Stor
         return result;
     }
 
-    @Override
-    @Nonnull
-    public T deserialize(
+    /** {@inheritDoc} */
+    @Nonnull public T deserialize(
             final long version,
             @Nonnull @NotEmpty final String context,
             @Nonnull @NotEmpty final String key,
@@ -155,17 +151,23 @@ public abstract class AbstractTicketSerializer<T extends Ticket> implements Stor
         try (final JsonReader reader = readerFactory.createReader(new StringReader(value))) {
             final JsonObject to = reader.readObject();
             final String service = Constraint.isNotNull(to.getString(SERVICE_FIELD), "Service field was not present");
-            final Instant expiry = Instant.ofEpochMilli(Constraint.isNotNull(to.getJsonNumber(EXPIRATION_FIELD), "Expriation Field was not present").longValueExact());
+            final Instant expiry = Instant.ofEpochMilli(Constraint.isNotNull(to.getJsonNumber(EXPIRATION_FIELD),
+                    "Expriation Field was not present").longValueExact());
             assert expiry != null;
             final JsonObject so = to.getJsonObject(STATE_FIELD);
             final TicketState state;
             if (so != null) {
-                final String sessionField = Constraint.isNotNull(so.getString(SESSION_FIELD), "Session field was not present");
-                final String principalField = Constraint.isNotNull(so.getString(PRINCIPAL_FIELD), "Principal field was not present");
-                final JsonNumber authnInstantField = Constraint.isNotNull(so.getJsonNumber(AUTHN_INSTANT_FIELD), "Authn Instant field was not present");
+                final String sessionField =
+                        Constraint.isNotNull(so.getString(SESSION_FIELD), "Session field was not present");
+                final String principalField =
+                        Constraint.isNotNull(so.getString(PRINCIPAL_FIELD), "Principal field was not present");
+                final JsonNumber authnInstantField =
+                        Constraint.isNotNull(so.getJsonNumber(AUTHN_INSTANT_FIELD),
+                                "Authn Instant field was not present");
                 final Instant authnInstant = Instant.ofEpochMilli(authnInstantField.longValueExact());
                 assert authnInstant!=null;
-                final String authnMethodField = Constraint.isNotNull(so.getString(AUTHN_METHOD_FIELD), "Authn Method field was not present");
+                final String authnMethodField =
+                        Constraint.isNotNull(so.getString(AUTHN_METHOD_FIELD), "Authn Method field was not present");
                 state = new TicketState(
                         sessionField, 
                         principalField,
@@ -203,7 +205,7 @@ public abstract class AbstractTicketSerializer<T extends Ticket> implements Stor
      * 
      * @return the newly created ticket
      */
-    protected abstract T createTicket(
+    @Nonnull protected abstract T createTicket(
             @Nonnull final JsonObject o,
             @Nonnull final String id,
             @Nonnull final String service,
@@ -216,4 +218,5 @@ public abstract class AbstractTicketSerializer<T extends Ticket> implements Stor
      * @param ticket ticket
      */
     protected abstract void serializeInternal(@Nonnull final JsonGenerator generator, @Nonnull final T ticket);
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyGrantingTicketSerializer.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyGrantingTicketSerializer.java
index 60f71a4a7..c2a9601ca 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyGrantingTicketSerializer.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyGrantingTicketSerializer.java
@@ -34,13 +34,12 @@ import net.shibboleth.shared.logic.Constraint;
 public class ProxyGrantingTicketSerializer extends AbstractTicketSerializer<ProxyGrantingTicket> {
 
     /** Parent PGT ID field name. */
-    private static final String PARENT_FIELD = "parent";
+    @Nonnull private static final String PARENT_FIELD = "parent";
 
     /** PGT URL field name. */
-    private static final String PGTURL_FIELD = "pgtUrl";
-
-
+    @Nonnull private static final String PGTURL_FIELD = "pgtUrl";
 
+    /** {@inheritDoc} */
     @Override
     protected void serializeInternal(@Nonnull final JsonGenerator generator,
             @Nonnull final ProxyGrantingTicket ticket) {
@@ -50,8 +49,9 @@ public class ProxyGrantingTicketSerializer extends AbstractTicketSerializer<Prox
         }
     }
 
+    /** {@inheritDoc} */
     @Override
-    protected ProxyGrantingTicket createTicket(
+    @Nonnull protected ProxyGrantingTicket createTicket(
             @Nonnull final JsonObject o,
             @Nonnull final String id,
             @Nonnull final String service,
@@ -62,4 +62,5 @@ public class ProxyGrantingTicketSerializer extends AbstractTicketSerializer<Prox
                 Constraint.isNotNull(o.getString(PGTURL_FIELD), "pgtUrl was not present"),
                 o.getString(PARENT_FIELD, null));
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyTicketSerializer.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyTicketSerializer.java
index 5b583e039..ad4e5c5cf 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyTicketSerializer.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ProxyTicketSerializer.java
@@ -34,20 +34,23 @@ import net.shibboleth.shared.logic.Constraint;
 public class ProxyTicketSerializer extends AbstractTicketSerializer<ProxyTicket> {
 
     /** PGT ID field name. */
-    private static final String PGTID_FIELD = "pgt";
-
+    @Nonnull private static final String PGTID_FIELD = "pgt";
 
+    /** {@inheritDoc} */
     @Override
     protected void serializeInternal(@Nonnull final JsonGenerator generator, @Nonnull final ProxyTicket ticket) {
         generator.write(PGTID_FIELD, ticket.getPgtId());
     }
 
+    /** {@inheritDoc} */
     @Override
-    protected ProxyTicket createTicket(
+    @Nonnull protected ProxyTicket createTicket(
             @Nonnull final JsonObject o,
             @Nonnull final String id,
             @Nonnull final String service,
             @Nonnull final Instant expiry) {
-        return new ProxyTicket(id, service, expiry, Constraint.isNotNull(o.getString(PGTID_FIELD), "pgtId was not present"));
+        return new ProxyTicket(id, service, expiry,
+                Constraint.isNotNull(o.getString(PGTID_FIELD), "pgtId was not present"));
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ServiceTicketSerializer.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ServiceTicketSerializer.java
index d0a9ffa65..d2090254a 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ServiceTicketSerializer.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/ServiceTicketSerializer.java
@@ -33,20 +33,22 @@ import net.shibboleth.idp.cas.ticket.ServiceTicket;
 public class ServiceTicketSerializer extends AbstractTicketSerializer<ServiceTicket> {
 
     /** Renew field name. */
-    private static final String RENEW_FIELD = "r";
-
+    @Nonnull private static final String RENEW_FIELD = "r";
 
+    /** {@inheritDoc} */
     @Override
     protected void serializeInternal(@Nonnull final JsonGenerator generator, @Nonnull final ServiceTicket ticket) {
         generator.write(RENEW_FIELD, ticket.isRenew());
     }
 
+    /** {@inheritDoc} */
     @Override
-    protected ServiceTicket createTicket(
+    @Nonnull protected ServiceTicket createTicket(
             @Nonnull final JsonObject o,
             @Nonnull final String id,
             @Nonnull final String service,
             @Nonnull final Instant expiry) {
         return new ServiceTicket(id, service, expiry, o.getBoolean(RENEW_FIELD));
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/package-info.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/package-info.java
index ad6ac3eb1..78c5d571c 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/package-info.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/ticket/serialization/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** CAS protocol ticket serialization implementations. */
+ at NonnullElements
+package net.shibboleth.idp.cas.ticket.serialization.impl;
 
-package net.shibboleth.idp.cas.ticket.serialization.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list