[java-identity-provider] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Tue Jun 20 23:18:43 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0f032b95de42301feed064af7285bbd6871b45e5

The following commit(s) were added to refs/heads/main by this push:
     new 0f032b95d IDP-2083 - Treat NonnullElements as the default for collections
0f032b95d is described below

commit 0f032b95de42301feed064af7285bbd6871b45e5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jun 20 19:18:36 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Review idp-saml-api/impl.
---
 .../idp/saml/authn/principal/package-info.java     |  5 +-
 .../saml/nameid/AbstractSAML2NameIDGenerator.java  |  1 +
 .../NameIDCanonicalizationFlowDescriptor.java      |  9 ++-
 .../shibboleth/idp/saml/nameid/package-info.java   |  5 +-
 .../config/BrowserSSOProfileConfiguration.java     |  3 +-
 .../logic/ProxyAwareForceAuthnPredicate.java       |  1 -
 .../saml/profile/config/logic/package-info.java    |  4 +-
 .../saml/profile/config/navigate/package-info.java |  4 +-
 .../idp/saml/profile/config/package-info.java      |  4 +-
 .../DefaultNameIdentifierFormatStrategy.java       |  5 +-
 .../profile/context/navigate/package-info.java     |  4 +-
 .../shibboleth/idp/saml/profile/package-info.java  |  4 +-
 .../config/BrowserSSOProfileConfiguration.java     |  3 +-
 .../profile/config/ECPProfileConfiguration.java    |  5 +-
 .../saml2/profile/config/logic/package-info.java   |  5 +-
 ...DefaultAuthenticationMethodsLookupFunction.java | 11 ++--
 .../navigate/ProxyRestrictionLookupFunction.java   |  2 +-
 .../profile/config/navigate/package-info.java      |  4 +-
 .../saml/saml2/profile/config/package-info.java    |  4 +-
 .../shibboleth/idp/saml/session/package-info.java  |  5 +-
 .../saml/audit/impl/AssertionIDAuditExtractor.java |  8 ++-
 .../audit/impl/AssertionInstantAuditExtractor.java |  8 ++-
 .../audit/impl/ProxyAudienceAuditExtractor.java    |  8 ++-
 .../saml/audit/impl/ProxyCountAuditExtractor.java  |  3 +-
 .../audit/impl/ScopingIdPListAuditExtractor.java   |  5 +-
 .../impl/ScopingRequesterListAuditExtractor.java   |  5 +-
 .../audit/impl/SessionIndexAuditExtractor.java     |  4 +-
 .../audit/impl/SubStatusCodeAuditExtractor.java    |  4 +-
 .../idp/saml/audit/impl/WriteFTICKSLog.java        |  3 +-
 .../idp/saml/audit/impl/package-info.java          |  4 +-
 .../MapDrivenAuthnContextTranslationStrategy.java  |  9 +--
 .../principal/impl/NameIDPrincipalSerializer.java  |  1 -
 .../saml/authn/principal/impl/package-info.java    |  4 +-
 .../impl/AddAttributeConsumingServiceHandler.java  |  5 +-
 .../idp/saml/messaging/impl/package-info.java      |  4 +-
 ...tributeSourcedSAML1NameIdentifierGenerator.java | 14 +++--
 .../impl/AttributeSourcedSAML2NameIDGenerator.java | 16 ++---
 .../nameid/impl/BaseCryptoTransientDecoder.java    |  3 +-
 .../saml/nameid/impl/BaseTransformingDecoder.java  |  8 +--
 .../idp/saml/nameid/impl/BaseTransientDecoder.java |  3 +-
 .../saml/nameid/impl/LegacyCanonicalization.java   | 68 ----------------------
 .../impl/NameIdentifierGenerationServiceImpl.java  |  8 +--
 .../impl/PersistentSAML2NameIDGenerator.java       |  7 +--
 .../impl/ProxySAML1NameIdentifierGenerator.java    |  1 -
 .../nameid/impl/ProxySAML2NameIDGenerator.java     |  4 +-
 .../saml/nameid/impl/TransientIdParameters.java    | 13 +++--
 .../idp/saml/nameid/impl/package-info.java         |  4 +-
 .../idp/saml/profile/config/impl/package-info.java |  5 +-
 .../impl/BaseAddAttributeStatementToAssertion.java |  9 ++-
 .../profile/impl/ExtractSubjectFromRequest.java    |  1 -
 .../impl/InitializeAuthenticationContext.java      |  3 +-
 .../InitializeRelyingPartyContextFromSAMLPeer.java |  3 +-
 .../impl/PopulateBindingAndEndpointContexts.java   |  3 +-
 .../idp/saml/profile/impl/package-info.java        |  4 +-
 ...AML1AssertionProducingProfileConfiguration.java |  8 +--
 .../impl/BrowserSSOProfileConfiguration.java       | 18 +++---
 .../saml1/profile/config/impl/package-info.java    |  5 +-
 .../impl/FilterByQueriedAttributeDesignators.java  |  4 +-
 .../idp/saml/saml1/profile/impl/package-info.java  |  4 +-
 ...AML2AssertionProducingProfileConfiguration.java | 10 ++--
 .../impl/BrowserSSOProfileConfiguration.java       | 27 +++++----
 .../config/impl/ECPProfileConfiguration.java       |  5 +-
 .../impl/SingleLogoutProfileConfiguration.java     | 10 ++--
 .../saml2/profile/config/impl/package-info.java    |  5 +-
 .../impl/AddAttributeStatementToAssertion.java     |  4 +-
 .../saml/saml2/profile/impl/AddAuthnRequest.java   |  6 +-
 .../profile/impl/AddAuthnStatementToAssertion.java |  1 -
 .../profile/impl/EnforceDisallowedSSOFeatures.java |  3 +-
 .../profile/impl/FilterByQueriedAttributes.java    | 16 ++---
 .../impl/IdPInitiatedSSORequestMessageDecoder.java |  6 +-
 .../profile/impl/PopulateEncryptionParameters.java |  3 +-
 .../profile/impl/ProcessRequestedAuthnContext.java |  5 +-
 .../saml2/profile/impl/SAMLAuthnController.java    |  5 +-
 .../profile/impl/ValidateSAMLAuthentication.java   |  4 +-
 .../idp/saml/saml2/profile/impl/package-info.java  |  4 +-
 .../idp/saml/session/impl/package-info.java        |  5 +-
 76 files changed, 240 insertions(+), 258 deletions(-)

diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/package-info.java
index eb1638b35..b623bf2cb 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/authn/principal/package-info.java
@@ -18,4 +18,7 @@
 /**
  * SAML-specific classes for integration with idp-authn-api packages.
  */
-package net.shibboleth.idp.saml.authn.principal;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.authn.principal;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java
index a2cb9ffb1..8bac8f9da 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java
@@ -111,4 +111,5 @@ public class AbstractSAML2NameIDGenerator extends org.opensaml.saml.saml2.profil
         
         return super.getEffectiveSPNameQualifier(profileRequestContext);
     }
+    
 }
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIDCanonicalizationFlowDescriptor.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIDCanonicalizationFlowDescriptor.java
index 0522ddcf1..02d8608fe 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIDCanonicalizationFlowDescriptor.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/NameIDCanonicalizationFlowDescriptor.java
@@ -23,7 +23,6 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 
 import net.shibboleth.idp.authn.SubjectCanonicalizationFlowDescriptor;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -38,7 +37,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class NameIDCanonicalizationFlowDescriptor extends SubjectCanonicalizationFlowDescriptor {
 
     /** Store Set of acceptable formats. */
-    @Nonnull @NonnullElements private Set<String> formats;
+    @Nonnull private Set<String> formats;
 
     /** Constructor. */
     public NameIDCanonicalizationFlowDescriptor() {
@@ -50,7 +49,7 @@ public class NameIDCanonicalizationFlowDescriptor extends SubjectCanonicalizatio
      * 
      * @return Returns the formats. Never empty after initialization.
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<String> getFormats() {
+    @Nonnull @Unmodifiable @NotLive public Collection<String> getFormats() {
         return formats;
     }
 
@@ -59,8 +58,8 @@ public class NameIDCanonicalizationFlowDescriptor extends SubjectCanonicalizatio
      * 
      * @param theFormats The formats to set.
      */
-    public void setFormats(@Nonnull @NonnullElements final Collection<String> theFormats) {
-        formats = Set.copyOf(StringSupport.normalizeStringCollection(
+    public void setFormats(@Nonnull final Collection<String> theFormats) {
+        formats = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(
                 Constraint.isNotNull(theFormats, "Format collection cannot be null")));
     }
     
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/package-info.java
index ad4fdeacd..e89a9c5b3 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/package-info.java
@@ -18,4 +18,7 @@
 /** 
  * Code for manipulating NameIDs and NameIdentifiers.
  */
-package net.shibboleth.idp.saml.nameid;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.nameid;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/BrowserSSOProfileConfiguration.java
index 4d44f23a7..6666264cb 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/BrowserSSOProfileConfiguration.java
@@ -27,7 +27,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
 import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
 import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -57,7 +56,7 @@ public interface BrowserSSOProfileConfiguration extends AuthenticationProfileCon
      * 
      * @return the formats to use
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(
+    @Nonnull @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(
             @Nullable final ProfileRequestContext profileRequestContext);
 
 }
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java
index 68ba1f48a..9275a6ba6 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/ProxyAwareForceAuthnPredicate.java
@@ -42,7 +42,6 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
  */
 public class ProxyAwareForceAuthnPredicate implements Predicate<ProfileRequestContext> {
     
-    
     /** {@inheritDoc} */
     public boolean test(@Nullable final ProfileRequestContext input) {
      
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/package-info.java
index 466ac0d78..356c1eb08 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/logic/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of logic/conditional SAML profile configuration components.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.profile.config.logic;
 
-package net.shibboleth.idp.saml.profile.config.logic;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/package-info.java
index b871f4ad5..b5d020402 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/navigate/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions to navigate into profile configuration information.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.profile.config.navigate;
 
-package net.shibboleth.idp.saml.profile.config.navigate;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/package-info.java
index bb6ee4336..f77dc5bc7 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/config/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Functionality and base classes common to both SAML 1 and 2 profile configuration. */
+ at NonnullElements
+package net.shibboleth.idp.saml.profile.config;
 
-package net.shibboleth.idp.saml.profile.config;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/DefaultNameIdentifierFormatStrategy.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/DefaultNameIdentifierFormatStrategy.java
index 7eaafb3c3..526b0d2d8 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/DefaultNameIdentifierFormatStrategy.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/DefaultNameIdentifierFormatStrategy.java
@@ -28,8 +28,9 @@ import net.shibboleth.idp.saml.profile.config.BrowserSSOProfileConfiguration;
 import net.shibboleth.profile.config.ProfileConfiguration;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.relyingparty.RelyingPartyConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -106,7 +107,7 @@ public class DefaultNameIdentifierFormatStrategy extends MetadataNameIdentifierF
 
     /** {@inheritDoc} */
     @Override
-    @Nonnull @NonnullElements public List<String> apply(@Nullable final ProfileRequestContext input) {
+    @Nonnull @Unmodifiable @NotLive public List<String> apply(@Nullable final ProfileRequestContext input) {
         final List<String> fromConfig = new ArrayList<>();
         final List<String> fromMetadata = super.apply(input);
 
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/package-info.java
index 37357967d..959748f05 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/context/navigate/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions for navigating SAML profile context objects.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.profile.context.navigate;
 
-package net.shibboleth.idp.saml.profile.context.navigate;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/package-info.java
index 0ee944b78..4fa92d11a 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/profile/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Common APIs for SAML profile actions. */
+ at NonnullElements
+package net.shibboleth.idp.saml.profile;
 
-package net.shibboleth.idp.saml.profile;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index b643840af..fa8379284 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -30,7 +30,6 @@ import net.shibboleth.idp.authn.config.AuthenticationProfileConfiguration;
 import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
 import net.shibboleth.shared.annotation.ConfigurationSetting;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -84,7 +83,7 @@ public interface BrowserSSOProfileConfiguration
      * @return audiences for a proxied assertion
      */
     @ConfigurationSetting(name="proxyAudiences")
-    @Nonnull @NonnullElements @NotLive @Unmodifiable Set<String> getProxyAudiences(
+    @Nonnull @NotLive @Unmodifiable Set<String> getProxyAudiences(
             @Nullable final ProfileRequestContext profileRequestContext);
     
     /**
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java
index 283f04997..93788bfc7 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/ECPProfileConfiguration.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
 import org.opensaml.profile.context.ProfileRequestContext;
 
 import net.shibboleth.shared.annotation.ConfigurationSetting;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -43,7 +42,7 @@ public interface ECPProfileConfiguration extends BrowserSSOProfileConfiguration,
      * @since 3.3.0
      */
     @ConfigurationSetting(name="localEvents")
-    @Nonnull @NonnullElements @NotLive @Unmodifiable
-    Set<String> getLocalEvents(@Nullable final ProfileRequestContext profileRequestContext);
+    @Nonnull @NotLive @Unmodifiable Set<String> getLocalEvents(
+            @Nullable final ProfileRequestContext profileRequestContext);
     
 }
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/package-info.java
index 6b65ad059..a311b4ff1 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Predicates related to SAML 2.0 profile configurations.
  */
-package net.shibboleth.idp.saml.saml2.profile.config.logic;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.saml2.profile.config.logic;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java
index 1916109f8..639a6491d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyAwareDefaultAuthenticationMethodsLookupFunction.java
@@ -34,7 +34,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.RequestedPrincipalContext;
 import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
@@ -55,7 +56,7 @@ public class ProxyAwareDefaultAuthenticationMethodsLookupFunction
         implements Function<ProfileRequestContext,Collection<AuthnContextClassRefPrincipal>> {
     
     /** Mappings to transform proxied Principals. */
-    @Nonnull @NonnullElements private Map<Principal,Collection<Principal>> principalMappings;
+    @Nonnull private Map<Principal,Collection<Principal>> principalMappings;
     
     /** Constructor. */
     public ProxyAwareDefaultAuthenticationMethodsLookupFunction() {
@@ -69,7 +70,7 @@ public class ProxyAwareDefaultAuthenticationMethodsLookupFunction
      * 
      * @param mappings {@link Principal} mappings
      */
-    public void setMappings(@Nullable @NonnullElements final Map<Principal,Collection<Principal>> mappings) {
+    public void setMappings(@Nullable final Map<Principal,Collection<Principal>> mappings) {
         if (mappings == null || mappings.isEmpty()) {
             principalMappings = CollectionSupport.emptyMap();
             return;
@@ -80,7 +81,7 @@ public class ProxyAwareDefaultAuthenticationMethodsLookupFunction
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements public Collection<AuthnContextClassRefPrincipal> apply(
+    @Nonnull @Unmodifiable @NotLive public Collection<AuthnContextClassRefPrincipal> apply(
             @Nullable final ProfileRequestContext input) {
         if (input != null) {
             final BaseContext parent = input.getParent();
@@ -99,7 +100,7 @@ public class ProxyAwareDefaultAuthenticationMethodsLookupFunction
                             .flatMap(Collection::stream)
                             .filter(AuthnContextClassRefPrincipal.class::isInstance)
                             .map(AuthnContextClassRefPrincipal.class::cast)
-                            .collect(Collectors.toUnmodifiableList());
+                            .collect(CollectionSupport.nonnullCollector(Collectors.toUnmodifiableList())).get();
                 }
             }
         }
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
index 4c511c9a2..2576cb90d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/ProxyRestrictionLookupFunction.java
@@ -134,7 +134,7 @@ public class ProxyRestrictionLookupFunction extends AbstractRelyingPartyLookupFu
             }
         }
         
-        return new Pair<>(proxyCount, Set.copyOf(audiences));
+        return new Pair<>(proxyCount, CollectionSupport.copyToSet(audiences));
     }
 // Checkstyle: CyclomaticComplexity|MethodLength ON
     
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/package-info.java
index 397bf998a..6feb745d0 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/navigate/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Functions to navigate into SAML 2 profile configuration information.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.saml2.profile.config.navigate;
 
-package net.shibboleth.idp.saml.saml2.profile.config.navigate;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/package-info.java
index bebd2470a..310b95e72 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Profile configurations for SAML 2 profiles. */
+ at NonnullElements
+package net.shibboleth.idp.saml.saml2.profile.config;
 
-package net.shibboleth.idp.saml.saml2.profile.config;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/session/package-info.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/session/package-info.java
index 9e6796d87..18b21b92d 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/session/package-info.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/session/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes related to use of SAML with the session layer.
  */
-package net.shibboleth.idp.saml.session;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.session;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionIDAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionIDAuditExtractor.java
index edbfaac5a..9a689f6a6 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionIDAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionIDAuditExtractor.java
@@ -28,6 +28,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.saml2.core.ArtifactResponse;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -48,13 +50,13 @@ public class AssertionIDAuditExtractor implements Function<ProfileRequestContext
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
+    @Nullable @Unmodifiable @NotLive public Collection<String> apply(@Nullable final ProfileRequestContext input) {
         SAMLObject message = responseLookupStrategy.apply(input);
         if (message != null) {
             
             // Step down into ArtifactResponses.
-            if (message instanceof ArtifactResponse) {
-                message = ((ArtifactResponse) message).getMessage();
+            if (message instanceof ArtifactResponse m) {
+                message = m.getMessage();
             }
             
             if (message instanceof org.opensaml.saml.saml2.core.Response resp) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionInstantAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionInstantAuditExtractor.java
index 923ed0b5d..a17773077 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionInstantAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AssertionInstantAuditExtractor.java
@@ -29,6 +29,8 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.saml2.core.ArtifactResponse;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -49,13 +51,13 @@ public class AssertionInstantAuditExtractor implements Function<ProfileRequestCo
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Nullable public Collection<Instant> apply(@Nullable final ProfileRequestContext input) {
+    @Nullable @Unmodifiable @NotLive public Collection<Instant> apply(@Nullable final ProfileRequestContext input) {
         SAMLObject message = responseLookupStrategy.apply(input);
         if (message != null) {
             
             // Step down into ArtifactResponses.
-            if (message instanceof ArtifactResponse) {
-                message = ((ArtifactResponse) message).getMessage();
+            if (message instanceof ArtifactResponse m) {
+                message = m.getMessage();
             }
             
             if (message instanceof org.opensaml.saml.saml2.core.Response resp) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java
index 9f6be4de2..53898b1fb 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyAudienceAuditExtractor.java
@@ -30,6 +30,9 @@ import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.saml2.core.Audience;
 import org.opensaml.saml.saml2.core.ProxyRestriction;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
  * {@link Function} that returns {@link ProxyRestriction#getAudiences()}.
  * 
@@ -42,14 +45,13 @@ public class ProxyAudienceAuditExtractor extends AbstractProxyRestrictionAuditEx
      *
      * @param strategy lookup strategy for message
      */
-    public ProxyAudienceAuditExtractor(
-            @Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+    public ProxyAudienceAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
         super(strategy);
     }
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Collection<String> doApply(@Nullable final ProxyRestriction condition) {
+    @Nullable @Unmodifiable @NotLive protected Collection<String> doApply(@Nullable final ProxyRestriction condition) {
         if (condition != null) {
             final List<Audience> audiences = condition.getAudiences();
             assert audiences != null;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
index 1904cba18..62418c906 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ProxyCountAuditExtractor.java
@@ -38,8 +38,7 @@ public class ProxyCountAuditExtractor extends AbstractProxyRestrictionAuditExtra
      *
      * @param strategy lookup strategy for message
      */
-    public ProxyCountAuditExtractor(
-            @Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
+    public ProxyCountAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
         super(strategy);
     }
 
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
index c5d0d5712..ea8940902 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
@@ -30,6 +30,9 @@ import org.opensaml.saml.saml2.core.IDPEntry;
 import org.opensaml.saml.saml2.core.IDPList;
 import org.opensaml.saml.saml2.core.Scoping;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
  * {@link Function} that returns {@link Scoping#getIDPList()} from an {@link AuthnRequest}.
  * 
@@ -48,7 +51,7 @@ public class ScopingIdPListAuditExtractor extends AbstractScopingAuditExtractor<
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
+    @Nullable @Unmodifiable @NotLive protected Collection<String> doApply(@Nullable final Scoping scoping) {
         if (scoping != null) {
             final IDPList idpList = scoping.getIDPList();
             if (idpList != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
index e31dae1d4..695393d78 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingRequesterListAuditExtractor.java
@@ -29,6 +29,9 @@ import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.core.RequesterID;
 import org.opensaml.saml.saml2.core.Scoping;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+
 /**
  * {@link Function} that returns {@link Scoping#getRequesterIDs()} from an {@link AuthnRequest}.
  * 
@@ -47,7 +50,7 @@ public class ScopingRequesterListAuditExtractor extends AbstractScopingAuditExtr
 
     /** {@inheritDoc} */
     @Override
-    @Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
+    @Nullable @Unmodifiable @NotLive protected Collection<String> doApply(@Nullable final Scoping scoping) {
         if (scoping != null) {
             return scoping.getRequesterIDs().stream()
                     .map(RequesterID::getURI)
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SessionIndexAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SessionIndexAuditExtractor.java
index 89e0688e2..c367322eb 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SessionIndexAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SessionIndexAuditExtractor.java
@@ -33,6 +33,8 @@ import org.opensaml.saml.saml2.core.LogoutRequest;
 import org.opensaml.saml.saml2.core.Response;
 import org.opensaml.saml.saml2.core.SessionIndex;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -53,7 +55,7 @@ public class SessionIndexAuditExtractor implements Function<ProfileRequestContex
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
+    @Nullable @Unmodifiable @NotLive public Collection<String> apply(@Nullable final ProfileRequestContext input) {
         
         SAMLObject message = messageLookupStrategy.apply(input);
         if (message != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java
index 6d188b79a..ee174266f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java
@@ -30,6 +30,8 @@ import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.saml1.core.Response;
 import org.opensaml.saml.saml2.core.StatusResponseType;
 
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -50,7 +52,7 @@ public class SubStatusCodeAuditExtractor implements Function<ProfileRequestConte
 
 // Checkstyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
-    @Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
+    @Nullable @Unmodifiable @NotLive public Collection<String> apply(@Nullable final ProfileRequestContext input) {
         final SAMLObject response = responseLookupStrategy.apply(input);
         if (response != null) {
             if (response instanceof Response r) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
index e67543019..369bcda7d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
@@ -88,7 +88,8 @@ public class WriteFTICKSLog extends AbstractProfileAction {
         assert unls != null;
         usernameLookupStrategy = unls;
         
-        Function<ProfileRequestContext, SAMLObject> para = new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup());
+        Function<ProfileRequestContext, SAMLObject> para =
+                new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup());
         assert para != null;
         authenticationMethodLookupStrategy = new AuthnContextAuditExtractor(para);
         para = new MessageLookup<>(SAMLObject.class).compose(new OutboundMessageContextLookup());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/package-info.java
index e074bf0cb..4914f240b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Classes implementing SAML-specific audit log behavior.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.audit.impl;
 
-package net.shibboleth.idp.saml.audit.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java
index fc63b9228..ca0ff8d20 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/MapDrivenAuthnContextTranslationStrategy.java
@@ -35,7 +35,8 @@ import org.slf4j.Logger;
 
 import net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal;
 import net.shibboleth.idp.saml.authn.principal.AuthnContextDeclRefPrincipal;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
@@ -51,7 +52,7 @@ public class MapDrivenAuthnContextTranslationStrategy implements Function<AuthnC
     @Nonnull private final Logger log = LoggerFactory.getLogger(MapDrivenAuthnContextTranslationStrategy.class);
     
     /** Mappings to transform proxied Principals. */
-    @Nonnull @NonnullElements private Map<Principal,Collection<Principal>> principalMappings;
+    @Nonnull private Map<Principal,Collection<Principal>> principalMappings;
     
     /** Constructor. */
     public MapDrivenAuthnContextTranslationStrategy() {
@@ -65,7 +66,7 @@ public class MapDrivenAuthnContextTranslationStrategy implements Function<AuthnC
      * 
      * @param mappings {@link Principal} mappings
      */
-    public void setMappings(@Nullable @NonnullElements final Map<Principal,Collection<Principal>> mappings) {
+    public void setMappings(@Nullable final Map<Principal,Collection<Principal>> mappings) {
         if (mappings == null || mappings.isEmpty()) {
             principalMappings = CollectionSupport.emptyMap();
             return;
@@ -76,7 +77,7 @@ public class MapDrivenAuthnContextTranslationStrategy implements Function<AuthnC
     }
     
     /** {@inheritDoc} */
-    @Nullable public Collection<Principal> apply(@Nullable final AuthnContext input) {
+    @Nullable @Unmodifiable @NotLive public Collection<Principal> apply(@Nullable final AuthnContext input) {
         
         if (input != null) {
             final Principal principal;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
index d5f0de236..24f4479cb 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/NameIDPrincipalSerializer.java
@@ -174,5 +174,4 @@ public class NameIDPrincipalSerializer extends AbstractPrincipalSerializer<Strin
     }
 // Checkstyle: CyclomaticComplexity ON
     
-   
 }
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java
index d40a8e6f1..71adf307a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/authn/principal/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementation classes supporting SAML-related Principal objects.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.authn.principal.impl;
 
-package net.shibboleth.idp.saml.authn.principal.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java
index d19bd406a..616356911 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/AddAttributeConsumingServiceHandler.java
@@ -34,7 +34,8 @@ import org.opensaml.saml.saml2.metadata.RequestedAttribute;
 
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.logic.Constraint;
 
 /**
@@ -79,7 +80,7 @@ public class AddAttributeConsumingServiceHandler extends SAMLAddAttributeConsumi
 
     /** {@inheritDoc} */
     @Override
-    @Nullable @NonnullElements protected Collection<RequestedAttribute> getRequestedAttributes(
+    @Nullable @Unmodifiable @NotLive protected Collection<RequestedAttribute> getRequestedAttributes(
             @Nonnull final MessageContext messageContext, @Nonnull final AuthnRequest authn) {
 
         final ProfileRequestContext prc = profileRequestContextLookupStrategy.apply(messageContext);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/package-info.java
index 7a1ebcf6c..757859055 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/messaging/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Message handlers common to SAML 1 and SAML 2 processing. */
+ at NonnullElements
+package net.shibboleth.idp.saml.messaging.impl;
 
-package net.shibboleth.idp.saml.messaging.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java
index c1ff9f741..7e7899d37 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML1NameIdentifierGenerator.java
@@ -43,7 +43,6 @@ import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -70,7 +69,7 @@ public class AttributeSourcedSAML1NameIdentifierGenerator extends AbstractSAML1N
     private char delimiter;
 
     /** Attribute(s) to use as an identifier source. */
-    @Nonnull @NonnullElements private List<String> attributeSourceIds;
+    @Nonnull private List<String> attributeSourceIds;
 
     /** Constructor. */
     public AttributeSourcedSAML1NameIdentifierGenerator() {
@@ -113,7 +112,7 @@ public class AttributeSourcedSAML1NameIdentifierGenerator extends AbstractSAML1N
      * 
      * @param ids attribute IDs to pull from
      */
-    public void setAttributeSourceIds(@Nonnull @NonnullElements final List<String> ids) {
+    public void setAttributeSourceIds(@Nonnull final List<String> ids) {
         checkSetterPreconditions();
         attributeSourceIds =
                 CollectionSupport.copyToList(Constraint.isNotNull(ids, "Attribute ID collection cannot be null"));
@@ -129,7 +128,8 @@ public class AttributeSourcedSAML1NameIdentifierGenerator extends AbstractSAML1N
     }
 
     /** {@inheritDoc} */
-    @Override protected void doInitialize() throws ComponentInitializationException {
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
 
         if (attributeSourceIds.isEmpty()) {
@@ -138,7 +138,8 @@ public class AttributeSourcedSAML1NameIdentifierGenerator extends AbstractSAML1N
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable protected NameIdentifier doGenerate(@Nonnull final ProfileRequestContext profileRequestContext)
+    @Override
+    @Nullable protected NameIdentifier doGenerate(@Nonnull final ProfileRequestContext profileRequestContext)
             throws SAMLException {
 
         // Check for a natively generated NameIdentifier attribute value.
@@ -182,7 +183,8 @@ public class AttributeSourcedSAML1NameIdentifierGenerator extends AbstractSAML1N
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable protected String getIdentifier(@Nonnull final ProfileRequestContext profileRequestContext)
+    @Override
+    @Nullable protected String getIdentifier(@Nonnull final ProfileRequestContext profileRequestContext)
             throws SAMLException {
 
         final AttributeContext attributeCtx = attributeContextLookupStrategy.apply(profileRequestContext);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java
index ee0300dbb..65a83e010 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/AttributeSourcedSAML2NameIDGenerator.java
@@ -42,7 +42,6 @@ import net.shibboleth.idp.saml.nameid.AbstractSAML2NameIDGenerator;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -69,7 +68,7 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
     private char delimiter;
 
     /** Attribute(s) to use as an identifier source. */
-    @Nonnull @NonnullElements private List<String> attributeSourceIds;
+    @Nonnull private List<String> attributeSourceIds;
 
     /** Constructor. */
     public AttributeSourcedSAML2NameIDGenerator() {
@@ -112,7 +111,7 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
      * 
      * @param ids attribute IDs to pull from
      */
-    public void setAttributeSourceIds(@Nonnull @NonnullElements final List<String> ids) {
+    public void setAttributeSourceIds(@Nonnull final List<String> ids) {
         checkSetterPreconditions();
         attributeSourceIds =
                 CollectionSupport.copyToList(Constraint.isNotNull(ids, "Attribute ID collection cannot be null"));
@@ -128,7 +127,8 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
     }
 
     /** {@inheritDoc} */
-    @Override protected void doInitialize() throws ComponentInitializationException {
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
 
         if (attributeSourceIds.isEmpty()) {
@@ -137,7 +137,8 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable protected NameID doGenerate(@Nonnull final ProfileRequestContext profileRequestContext)
+    @Override
+    @Nullable protected NameID doGenerate(@Nonnull final ProfileRequestContext profileRequestContext)
             throws SAMLException {
 
         // Check for a natively generated NameIdentifier attribute value.
@@ -178,7 +179,8 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
     }
 
     /** {@inheritDoc} */
-    @Override @Nullable protected String getIdentifier(@Nonnull final ProfileRequestContext profileRequestContext)
+    @Override
+    @Nullable protected String getIdentifier(@Nonnull final ProfileRequestContext profileRequestContext)
             throws SAMLException {
 
         final AttributeContext attributeCtx = attributeContextLookupStrategy.apply(profileRequestContext);
@@ -221,4 +223,4 @@ public class AttributeSourcedSAML2NameIDGenerator extends AbstractSAML2NameIDGen
         return null;
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
index 5abff7e5a..3d651db61 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
@@ -113,7 +113,8 @@ public abstract class BaseCryptoTransientDecoder extends AbstractIdentifiableIni
     }
 
     /** {@inheritDoc} */
-    @Override protected void doInitialize() throws ComponentInitializationException {
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
 
         if (null == dataSealer) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransformingDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransformingDecoder.java
index 6ff7416dc..be244b715 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransformingDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransformingDecoder.java
@@ -28,7 +28,6 @@ import javax.annotation.Nullable;
 
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
@@ -44,7 +43,7 @@ public abstract class BaseTransformingDecoder extends AbstractIdentifiableInitia
     @Nonnull private final Logger log = LoggerFactory.getLogger(BaseTransformingDecoder.class);
     
     /** Match patterns and replacement strings to apply. */
-    @Nonnull @NonnullElements private List<Pair<Pattern,String>> transforms;
+    @Nonnull private List<Pair<Pattern,String>> transforms;
     
     /** Convert to uppercase prior to transforms? */
     private boolean uppercase;
@@ -86,7 +85,7 @@ public abstract class BaseTransformingDecoder extends AbstractIdentifiableInitia
      * 
      * @param newTransforms collection of replacement transforms
      */
-    public void setTransforms(@Nonnull @NonnullElements final Collection<Pair<String,String>> newTransforms) {
+    public void setTransforms(@Nonnull final Collection<Pair<String,String>> newTransforms) {
         checkSetterPreconditions();
         Constraint.isNotNull(newTransforms, "Transforms collection cannot be null");
         
@@ -130,4 +129,5 @@ public abstract class BaseTransformingDecoder extends AbstractIdentifiableInitia
         
         return s;
     }
-}
+    
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java
index 70ee3135d..03990f838 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java
@@ -103,7 +103,8 @@ public abstract class BaseTransientDecoder extends AbstractIdentifiableInitializ
     }
 
     /** {@inheritDoc} */
-    @Override protected void doInitialize() throws ComponentInitializationException {
+    @Override
+    protected void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
 
         if (null == idStore) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
deleted file mode 100644
index da492364a..000000000
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements.  See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License.  You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.saml.nameid.impl;
-
-import javax.annotation.Nonnull;
-
-import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.context.ProfileRequestContext;
-import org.slf4j.Logger;
-
-import net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction;
-import net.shibboleth.idp.authn.AuthnEventIds;
-import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
-import net.shibboleth.idp.saml.nameid.NameIDCanonicalizationFlowDescriptor;
-import net.shibboleth.shared.logic.PredicateSupport;
-import net.shibboleth.shared.primitive.DeprecationSupport;
-import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
-import net.shibboleth.shared.primitive.LoggerFactory;
-
-/**
- * Action to fail if asked to perform C14N ..
- * 
- * @deprecated
- */
- at Deprecated
-public class LegacyCanonicalization extends AbstractSubjectCanonicalizationAction {
-
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(LegacyCanonicalization.class);
-    
-    /** {@inheritDoc} */
-    @Override protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
-            @Nonnull final SubjectCanonicalizationContext c14nContext) {
-
-        log.error("Legacy PrincipalConnectors no longer supported");
-        ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT_C14N_CTX);
-        
-        return false;
-    }
-    
-    /** Factory used to generate a disabled flow descriptor for backward compatibility.
-     * 
-     * @return an appropriate FlowDescriptor 
-     */
-    public static NameIDCanonicalizationFlowDescriptor c14LegacyPrincipalConnectorFactory() {
-        // V4 deprecation, remove this class in V5.
-        DeprecationSupport.warn(ObjectType.BEAN, "c14n/LegacyPrincipalConnector", "c14n/subject-c14n.xml", "<remove>");
-        final NameIDCanonicalizationFlowDescriptor result = new NameIDCanonicalizationFlowDescriptor();
-        result.setActivationCondition(PredicateSupport.alwaysFalse());
-        return result;
-    }
-    
-}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierGenerationServiceImpl.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierGenerationServiceImpl.java
index 0d6ae659e..800b0fed5 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierGenerationServiceImpl.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierGenerationServiceImpl.java
@@ -57,7 +57,7 @@ public class NameIdentifierGenerationServiceImpl extends AbstractIdentifiableIni
     }
     
     /** {@inheritDoc} */
-   @Override
+    @Override
     protected void doInitialize() throws ComponentInitializationException {
         super.doInitialize();
         
@@ -67,16 +67,14 @@ public class NameIdentifierGenerationServiceImpl extends AbstractIdentifiableIni
     }
 
     /** {@inheritDoc} */
-    @Override
-    public @Nonnull SAML1NameIdentifierGenerator getSAML1NameIdentifierGenerator() {
+   @Nonnull public SAML1NameIdentifierGenerator getSAML1NameIdentifierGenerator() {
         checkComponentActive();
         assert saml1Generator!=null;
         return saml1Generator;
     }
 
     /** {@inheritDoc} */
-    @Override
-    public @Nonnull SAML2NameIDGenerator getSAML2NameIDGenerator() {
+    @Nonnull public SAML2NameIDGenerator getSAML2NameIDGenerator() {
         checkComponentActive();
         assert saml2Generator!=null;
         return saml2Generator;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java
index 8e1b2b94f..00800e861 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGenerator.java
@@ -46,7 +46,6 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -71,7 +70,7 @@ public class PersistentSAML2NameIDGenerator extends AbstractSAML2NameIDGenerator
     @Nonnull private Function<ProfileRequestContext,AttributeContext> attributeContextLookupStrategy;
 
     /** Attribute(s) to use as an identifier source. */
-    @Nonnull @NonnullElements private List<String> attributeSourceIds;
+    @Nonnull private List<String> attributeSourceIds;
 
     /** Store for IDs. */
     @NonnullAfterInit private PairwiseIdStore pidStore;
@@ -125,7 +124,7 @@ public class PersistentSAML2NameIDGenerator extends AbstractSAML2NameIDGenerator
      * 
      * @param ids attribute IDs to pull from
      */
-    public void setAttributeSourceIds(@Nonnull @NonnullElements final List<String> ids) {
+    public void setAttributeSourceIds(@Nonnull final List<String> ids) {
         checkSetterPreconditions();
         attributeSourceIds = CollectionSupport.copyToList(
                 Constraint.isNotNull(ids, "Attribute ID collection cannot be null"));
@@ -273,4 +272,4 @@ public class PersistentSAML2NameIDGenerator extends AbstractSAML2NameIDGenerator
     }
     // Checkstyle: CyclomaticComplexity|MethodLength ON
 
-}
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML1NameIdentifierGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML1NameIdentifierGenerator.java
index aa8530c44..c0adf3705 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML1NameIdentifierGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML1NameIdentifierGenerator.java
@@ -52,7 +52,6 @@ public class ProxySAML1NameIdentifierGenerator implements SAML1NameIdentifierGen
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public NameIdentifier generate(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull @NotEmpty final String format) throws SAMLException {
         
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML2NameIDGenerator.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML2NameIDGenerator.java
index c33771573..25c989586 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML2NameIDGenerator.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ProxySAML2NameIDGenerator.java
@@ -46,13 +46,11 @@ public class ProxySAML2NameIDGenerator implements SAML2NameIDGenerator {
      *
      * @param service the service providing the generator to proxy
      */
-    public ProxySAML2NameIDGenerator(
-            @Nonnull final ReloadableService<NameIdentifierGenerationService> service) {
+    public ProxySAML2NameIDGenerator(@Nonnull final ReloadableService<NameIdentifierGenerationService> service) {
         generatorService = Constraint.isNotNull(service, "NameIdentifierGenerationService cannot be null");
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public NameID generate(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull @NotEmpty final String format) throws SAMLException {
         
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/TransientIdParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/TransientIdParameters.java
index b84f5d960..de31ddb1d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/TransientIdParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/TransientIdParameters.java
@@ -46,19 +46,19 @@ public class TransientIdParameters {
     @Nonnull @NotEmpty public static final String CONTEXT = "TransientId";
     
     /** Field name of creation instant. */
-    private static final String ATTRIBUTE_RECIPIENT_FIELD = "sp";
+    @Nonnull @NotEmpty private static final String ATTRIBUTE_RECIPIENT_FIELD = "sp";
 
     /** Field name of principal name. */
-    private static final String PRINCIPAL_FIELD = "princ";
+    @Nonnull @NotEmpty private static final String PRINCIPAL_FIELD = "princ";
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(TransientIdParameters.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(TransientIdParameters.class);
 
     /** The Attribute Recipient. */
-    private final String attributeRecipient;
+    @Nullable private final String attributeRecipient;
 
     /** The principal. */
-    private final String principal;
+    @Nullable private final String principal;
 
     /**
      * Constructor for the attribute definition.
@@ -131,4 +131,5 @@ public class TransientIdParameters {
             throw new IOException("Exception while serializing TransientID", e);
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/package-info.java
index f839aa81c..55a4f466a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/package-info.java
@@ -19,5 +19,7 @@
  * Implementation of SAML {@link org.opensaml.saml.saml2.core.NameID} and
  * {@link org.opensaml.saml.saml1.core.NameIdentifier} generation and consumption.
  */
+ at NonnullElements
+package net.shibboleth.idp.saml.nameid.impl;
 
-package net.shibboleth.idp.saml.nameid.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/package-info.java
index 5656e3acf..55474e6dc 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/config/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementations of SAML profile configuration interfaces.
  */
-package net.shibboleth.idp.saml.profile.config.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.profile.config.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java
index 2d492d75e..c45d48353 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseAddAttributeStatementToAssertion.java
@@ -43,7 +43,6 @@ import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -106,8 +105,9 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
     public BaseAddAttributeStatementToAssertion() {
         statementInOwnAssertion = false;
         ignoringUnencodableAttributes = true;
-        final Function<ProfileRequestContext,AttributeContext> acls = new ChildContextLookup<>(AttributeContext.class).compose(
-                new ChildContextLookup<>(RelyingPartyContext.class));
+        final Function<ProfileRequestContext,AttributeContext> acls =
+                new ChildContextLookup<>(AttributeContext.class).compose(
+                        new ChildContextLookup<>(RelyingPartyContext.class));
         assert acls !=null;
         attributeContextLookupStrategy = acls; 
         idGeneratorLookupStrategy = new IdentifierGenerationStrategyLookupFunction();
@@ -290,7 +290,6 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
         return true;
     }
 
-
     /**
      * Access the registry of transcoding rules to transform the input attribute into a target type.
      * 
@@ -306,7 +305,7 @@ public abstract class BaseAddAttributeStatementToAssertion<T extends SAMLObject>
      */
     protected int encodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
             @Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final IdPAttribute attribute,
-            @Nonnull final Class<T> to, @Nonnull @NonnullElements @Live final Collection<T> results)
+            @Nonnull final Class<T> to, @Nonnull @Live final Collection<T> results)
                     throws AttributeEncodingException {
         
         final Collection<TranscodingRule> transcodingRules = registry.getTranscodingRules(attribute, to);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
index d7224a2d9..edecfec31 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequest.java
@@ -200,7 +200,6 @@ public class ExtractSubjectFromRequest extends AbstractProfileAction {
     public static class SubjectNameLookupFunction implements Function<ProfileRequestContext,SAMLObject> {
         
         /** {@inheritDoc} */
-        @Override
         @Nullable public SAMLObject apply(@Nullable final ProfileRequestContext profileRequestContext) {
             
             if (profileRequestContext != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
index 9e8996537..098a1c973 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
@@ -90,7 +90,8 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
         forceAuthnPredicate = new ForceAuthnProfileConfigPredicate();
         ignoreScopingPredicate = new IgnoreScopingProfileConfigPredicate();
         proxyCountLookupStrategy = new ProxyCountLookupFunction();
-        final Function<ProfileRequestContext,AuthnRequest> rls = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AuthnRequest> rls =
+                new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
         assert rls != null;
         requestLookupStrategy = rls;
     }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java
index d51591c2c..8aa195da2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeRelyingPartyContextFromSAMLPeer.java
@@ -126,7 +126,8 @@ public class InitializeRelyingPartyContextFromSAMLPeer extends AbstractProfileAc
             return;
         }
 
-        log.debug("{} Attaching RelyingPartyContext based on SAML peer {}", getLogPrefix(), peerEntityCtx.getEntityId());
+        log.debug("{} Attaching RelyingPartyContext based on SAML peer {}", getLogPrefix(),
+                peerEntityCtx.getEntityId());
         rpContext.setRelyingPartyIdContextTree(peerEntityCtx);
         rpContext.setRelyingPartyIdLookupStrategy(RPID_LOOKUP);
         rpContext.setVerificationLookupStrategy(VERIFY_LOOKUP);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
index cd661ddd2..82899987e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
@@ -62,7 +62,6 @@ import net.shibboleth.saml.profile.config.SAMLArtifactAwareProfileConfiguration;
 import net.shibboleth.saml.profile.config.SAMLArtifactConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -127,7 +126,7 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
     @Nullable private Function<ProfileRequestContext,BestMatchLocationCriterion> bestMatchCriterionLookupStrategy;
     
     /** List of possible bindings, in preference order. */
-    @NonnullBeforeExec @NonnullElements private List<BindingDescriptor> bindingDescriptors;
+    @NonnullBeforeExec private List<BindingDescriptor> bindingDescriptors;
     
     /** Whether an artifact-based binding implies the use of a secure channel. */
     private boolean artifactImpliesSecureChannel;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/package-info.java
index 90e93cb1c..97adf3c1e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Actions common to SAML 1 and SAML 2 processing. */
+ at NonnullElements
+package net.shibboleth.idp.saml.profile.impl;
 
-package net.shibboleth.idp.saml.profile.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/AbstractSAML1AssertionProducingProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/AbstractSAML1AssertionProducingProfileConfiguration.java
index c22752b97..e79789ac2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/AbstractSAML1AssertionProducingProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/AbstractSAML1AssertionProducingProfileConfiguration.java
@@ -27,9 +27,9 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -152,7 +152,7 @@ public abstract class AbstractSAML1AssertionProducingProfileConfiguration
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive public Set<String> getAssertionAudiences(
+    @Nonnull @Unmodifiable @NotLive public Set<String> getAssertionAudiences(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         final Set<String> audiences = additionalAudiencesLookupStrategy.apply(profileRequestContext);
@@ -170,7 +170,7 @@ public abstract class AbstractSAML1AssertionProducingProfileConfiguration
      * @deprecated
      */
     @Deprecated(since="5.0.0", forRemoval=true)
-    public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
+    public void setAdditionalAudiencesForAssertion(@Nullable final Collection<String> audiences) {
         DeprecationSupport.warn(ObjectType.METHOD, "setAdditionalAudiencesForAssertion", "relying-party.xml",
                 "setAdditionalAudiences");
         setAssertionAudiences(audiences);
@@ -197,7 +197,7 @@ public abstract class AbstractSAML1AssertionProducingProfileConfiguration
      * 
      * @param audiences the additional audiences
      */
-    public void setAssertionAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
+    public void setAssertionAudiences(@Nullable final Collection<String> audiences) {
 
         if (audiences == null || audiences.isEmpty()) {
             additionalAudiencesLookupStrategy = FunctionSupport.constant(null);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfiguration.java
index 3f08e1eeb..4c7405a9f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -34,7 +34,6 @@ import net.shibboleth.idp.saml.authn.principal.AuthenticationMethodPrincipal;
 import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
 import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -174,7 +173,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
+    @Nonnull @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<AuthenticationMethodPrincipal> methods =
                 defaultAuthenticationMethodsLookupStrategy.apply(profileRequestContext);
@@ -189,8 +188,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
      * 
      * @param methods   default authentication methods to use
      */
-    public void setDefaultAuthenticationMethods(
-            @Nullable @NonnullElements final Collection<AuthenticationMethodPrincipal> methods) {
+    public void setDefaultAuthenticationMethods(@Nullable final Collection<AuthenticationMethodPrincipal> methods) {
 
         if (methods != null) {
             defaultAuthenticationMethodsLookupStrategy = FunctionSupport.constant(List.copyOf(methods));
@@ -212,7 +210,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
@@ -227,7 +225,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
      * 
      * @param flows   flow identifiers to use
      */
-    public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setAuthenticationFlows(@Nullable final Collection<String> flows) {
         if (flows != null) {
             authenticationFlowsLookupStrategy =
                     FunctionSupport.constant(Set.copyOf(StringSupport.normalizeStringCollection(flows)));
@@ -249,7 +247,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
         if (flows != null) {
@@ -263,7 +261,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
      * 
      * @param flows   flow identifiers to enable
      */
-    public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setPostAuthenticationFlows(@Nullable final Collection<String> flows) {
         if (flows != null) {
             postAuthenticationFlowsLookupStrategy =
                     FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
@@ -285,7 +283,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(
+    @Nonnull @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> formats = nameIDFormatPrecedenceLookupStrategy.apply(profileRequestContext);
         if (formats != null) {
@@ -299,7 +297,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML1AssertionProduc
      * 
      * @param formats   name identifier formats to use
      */
-    public void setNameIDFormatPrecedence(@Nonnull @NonnullElements final Collection<String> formats) {
+    public void setNameIDFormatPrecedence(@Nonnull final Collection<String> formats) {
         Constraint.isNotNull(formats, "List of formats cannot be null");
         
         nameIDFormatPrecedenceLookupStrategy =
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/package-info.java
index 10f69ba0f..97a9218f5 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/config/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation of SAML 1.x profile configurations.
  */
-package net.shibboleth.idp.saml.saml1.profile.config.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.saml1.profile.config.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
index 0e4cd4a2f..88d825e6f 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
@@ -49,7 +49,6 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -222,8 +221,7 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
      */
     private void decodeAttributeDesignator(@Nonnull final AttributeTranscoderRegistry registry,
             @Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final AttributeDesignator input,
-            @Nonnull @NonnullElements @Live final Collection<String> results)
-                    throws AttributeDecodingException {
+            @Nonnull @Live final Collection<String> results) throws AttributeDecodingException {
         
         final Collection<TranscodingRule> transcodingRules = registry.getTranscodingRules(input);
         if (transcodingRules.isEmpty()) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/package-info.java
index 85503ec82..a73dca966 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Profile processing actions related to SAML 1 messages. */
+ at NonnullElements
+package net.shibboleth.idp.saml.saml1.profile.impl;
 
-package net.shibboleth.idp.saml.saml1.profile.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2AssertionProducingProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2AssertionProducingProfileConfiguration.java
index 43b2caca8..0983cb148 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2AssertionProducingProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AbstractSAML2AssertionProducingProfileConfiguration.java
@@ -28,9 +28,9 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.saml.profile.config.SAMLAssertionProducingProfileConfiguration;
 import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileConfiguration;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.logic.FunctionSupport;
@@ -163,7 +163,7 @@ public abstract class AbstractSAML2AssertionProducingProfileConfiguration
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive public Set<String> getAssertionAudiences(
+    @Nonnull @Unmodifiable @NotLive public Set<String> getAssertionAudiences(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         final Set<String> audiences = additionalAudiencesLookupStrategy.apply(profileRequestContext);
@@ -181,7 +181,7 @@ public abstract class AbstractSAML2AssertionProducingProfileConfiguration
      * @deprecated
      */
     @Deprecated(since="5.0.0", forRemoval=true)
-    public void setAdditionalAudiencesForAssertion(@Nullable @NonnullElements final Collection<String> audiences) {
+    public void setAdditionalAudiencesForAssertion(@Nullable final Collection<String> audiences) {
         DeprecationSupport.warn(ObjectType.METHOD, "setAdditionalAudiencesForAssertion", "relying-party.xml",
                 "setAdditionalAudiences");
         setAssertionAudiences(audiences);
@@ -208,13 +208,13 @@ public abstract class AbstractSAML2AssertionProducingProfileConfiguration
      * 
      * @param audiences the additional audiences
      */
-    public void setAssertionAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
+    public void setAssertionAudiences(@Nullable final Collection<String> audiences) {
 
         if (audiences == null || audiences.isEmpty()) {
             additionalAudiencesLookupStrategy = FunctionSupport.constant(null);
         } else {
             additionalAudiencesLookupStrategy = FunctionSupport.constant(
-                    Set.copyOf(StringSupport.normalizeStringCollection(audiences)));
+                    CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(audiences)));
         }
     }
 
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
index f9938c305..834950495 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -35,7 +35,6 @@ import net.shibboleth.idp.saml.saml2.profile.config.navigate.ProxyAwareAuthnCont
 import net.shibboleth.idp.saml.saml2.profile.config.navigate.ProxyAwareDefaultAuthenticationMethodsLookupFunction;
 import net.shibboleth.profile.config.AttributeResolvingProfileConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonNegative;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -377,7 +376,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getProxyAudiences(
+    @Nonnull @NotLive @Unmodifiable public Set<String> getProxyAudiences(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> audiences = proxyAudiencesLookupStrategy.apply(profileRequestContext);
         if (audiences != null) {
@@ -391,12 +390,12 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
      * 
      * @param audiences proxy audiences to be added to responses
      */
-    public void setProxyAudiences(@Nullable @NonnullElements final Collection<String> audiences) {
+    public void setProxyAudiences(@Nullable final Collection<String> audiences) {
         if (audiences == null || audiences.isEmpty()) {
             proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
         } else {
             proxyAudiencesLookupStrategy = FunctionSupport.constant(
-                    List.copyOf(StringSupport.normalizeStringCollection(audiences)));
+                    CollectionSupport.copyToList(StringSupport.normalizeStringCollection(audiences)));
         }
     }
 
@@ -784,7 +783,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
+    @Nonnull @NotLive @Unmodifiable public List<Principal> getDefaultAuthenticationMethods(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<AuthnContextClassRefPrincipal> methods =
                 defaultAuthenticationContextsLookupStrategy.apply(profileRequestContext);
@@ -800,7 +799,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
      * @param contexts default authentication contexts to use
      */
     public void setDefaultAuthenticationMethods(
-            @Nullable @NonnullElements final Collection<AuthnContextClassRefPrincipal> contexts) {
+            @Nullable final Collection<AuthnContextClassRefPrincipal> contexts) {
         if (contexts != null) {
             defaultAuthenticationContextsLookupStrategy = FunctionSupport.constant(List.copyOf(contexts));
         } else {
@@ -821,7 +820,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public Set<String> getAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Set<String> flows = authenticationFlowsLookupStrategy.apply(profileRequestContext);
         if (flows != null) {
@@ -835,7 +834,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
      * 
      * @param flows   flow identifiers to use
      */
-    public void setAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setAuthenticationFlows(@Nullable final Collection<String> flows) {
         if (flows != null) {
             authenticationFlowsLookupStrategy =
                     FunctionSupport.constant(
@@ -858,7 +857,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
+    @Nonnull @NotLive @Unmodifiable public List<String> getPostAuthenticationFlows(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> flows = postAuthenticationFlowsLookupStrategy.apply(profileRequestContext);
         if (flows != null) {
@@ -872,7 +871,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
      * 
      * @param flows   flow identifiers to enable
      */
-    public void setPostAuthenticationFlows(@Nullable @NonnullElements final Collection<String> flows) {
+    public void setPostAuthenticationFlows(@Nullable final Collection<String> flows) {
         if (flows != null) {
             postAuthenticationFlowsLookupStrategy =
                     FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(flows)));
@@ -894,7 +893,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(
+    @Nonnull @NotLive @Unmodifiable public List<String> getNameIDFormatPrecedence(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         final Collection<String> formats = nameIDFormatPrecedenceLookupStrategy.apply(profileRequestContext);
@@ -909,7 +908,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
      * 
      * @param formats   name identifier formats to use
      */
-    public void setNameIDFormatPrecedence(@Nullable @NonnullElements final Collection<String> formats) {
+    public void setNameIDFormatPrecedence(@Nullable final Collection<String> formats) {
         if (formats != null) {
             nameIDFormatPrecedenceLookupStrategy =
                     FunctionSupport.constant(
@@ -986,7 +985,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Collection<RequestedAttribute> getRequestedAttributes(
+    @Nonnull @NotLive @Unmodifiable public Collection<RequestedAttribute> getRequestedAttributes(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<RequestedAttribute> attrs = requestedAttributesLookupStrategy.apply(profileRequestContext);
         if (attrs != null) {
@@ -1002,7 +1001,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
      * 
      * @since 5.0.0
      */
-    public void setRequestedAttributes(@Nullable @NonnullElements final Collection<RequestedAttribute> attrs) {
+    public void setRequestedAttributes(@Nullable final Collection<RequestedAttribute> attrs) {
         if (attrs != null) {
             requestedAttributesLookupStrategy = FunctionSupport.constant(CollectionSupport.copyToList(attrs));
         } else {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java
index e87a05a6e..c710a526e 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/ECPProfileConfiguration.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 
 import org.opensaml.profile.context.ProfileRequestContext;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -72,7 +71,7 @@ public class ECPProfileConfiguration extends BrowserSSOProfileConfiguration
      * 
      * @since 3.3.0
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getLocalEvents(
+    @Nonnull @NotLive @Unmodifiable public Set<String> getLocalEvents(
             @Nullable final ProfileRequestContext profileRequestContext) {
         
         final Set<String> events = localEventsLookupStrategy.apply(profileRequestContext);
@@ -89,7 +88,7 @@ public class ECPProfileConfiguration extends BrowserSSOProfileConfiguration
      * 
      * @since 3.3.0
      */
-    public void setLocalEvents(@Nullable @NonnullElements final Collection<String> events) {
+    public void setLocalEvents(@Nullable final Collection<String> events) {
 
         if (events != null && !events.isEmpty()) {
             localEventsLookupStrategy = FunctionSupport.constant(
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
index 8418999e6..0d0e25f69 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/SingleLogoutProfileConfiguration.java
@@ -18,7 +18,6 @@
 package net.shibboleth.idp.saml.saml2.profile.config.impl;
 
 import java.util.Collection;
-import java.util.List;
 import java.util.function.Function;
 import java.util.function.Predicate;
 
@@ -30,7 +29,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
 import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -137,7 +135,7 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @NotLive public Collection<String> getQualifiedNameIDFormats(
+    @Nonnull @NotLive public Collection<String> getQualifiedNameIDFormats(
             @Nullable final ProfileRequestContext profileRequestContext) {
         final Collection<String> formats = qualifiedNameIDFormatsLookupStrategy.apply(profileRequestContext);
         if (formats != null) {
@@ -159,12 +157,12 @@ public class SingleLogoutProfileConfiguration extends AbstractSAML2ArtifactAware
      * 
      * @since 3.4.0
      */
-    public void setQualifiedNameIDFormats(@Nullable @NonnullElements final Collection<String> formats) {
+    public void setQualifiedNameIDFormats(@Nullable final Collection<String> formats) {
         if (formats == null || formats.isEmpty()) {
             qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(null);
         } else {
-            qualifiedNameIDFormatsLookupStrategy =
-                    FunctionSupport.constant(List.copyOf(StringSupport.normalizeStringCollection(formats)));
+            qualifiedNameIDFormatsLookupStrategy = FunctionSupport.constant(
+                    CollectionSupport.copyToList(StringSupport.normalizeStringCollection(formats)));
         }
     }
 
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/package-info.java
index 25eae9650..0297a3cfa 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementatio of SAML 2.0 profile configurations.
  */
-package net.shibboleth.idp.saml.saml2.profile.config.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.saml2.profile.config.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
index 54744bf45..44063c547 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
@@ -46,7 +46,6 @@ import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.service.ServiceException;
@@ -213,7 +212,7 @@ public class AddAttributeStatementToAssertion extends BaseAddAttributeStatementT
      */
     private void encodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
             @Nonnull final ProfileRequestContext profileRequestContext,
-            @Nonnull final IdPAttribute attribute, @Nonnull @NonnullElements final Collection<Attribute> results)
+            @Nonnull final IdPAttribute attribute, @Nonnull final Collection<Attribute> results)
                     throws AttributeEncodingException {
 
         log.debug("{} Attempting to encode attribute {} as a SAML 2 Attribute", getLogPrefix(), attribute.getId());
@@ -236,7 +235,6 @@ public class AddAttributeStatementToAssertion extends BaseAddAttributeStatementT
     private class AssertionStrategy implements Function<ProfileRequestContext,Assertion> {
 
         /** {@inheritDoc} */
-        @Override
         @Nullable public Assertion apply(@Nullable final ProfileRequestContext input) {
             final MessageContext omc = input != null ? input.getOutboundMessageContext() : null;  
             if (omc != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
index 37b3a4e02..66ce36818 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequest.java
@@ -38,7 +38,6 @@ import net.shibboleth.profile.config.navigate.IdentifierGenerationStrategyLookup
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.security.IdentifierGenerationStrategy;
 
@@ -470,7 +469,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
      * @return populated {@link Scoping}
      */
     @Nullable private Scoping buildScoping(@Nonnull final ProfileRequestContext profileRequestContext,
-            @Nullable final Integer count, @Nonnull @NonnullElements final Set<String> idplist) {
+            @Nullable final Integer count, @Nonnull final Set<String> idplist) {
 
         boolean include = false;
         
@@ -539,8 +538,7 @@ public class AddAuthnRequest extends AbstractAuthenticationAction {
      * 
      * @return extension or null
      */
-    @Nullable private Extensions buildExtensions(
-            @Nonnull final ProfileRequestContext profileRequestContext) {
+    @Nullable private Extensions buildExtensions(@Nonnull final ProfileRequestContext profileRequestContext) {
         
         assert profileConfiguration!=null;
         final Collection<RequestedAttribute> attrs = profileConfiguration.getRequestedAttributes(profileRequestContext);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java
index 761eb82c1..f292b5d14 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertion.java
@@ -290,7 +290,6 @@ public class AddAuthnStatementToAssertion extends BaseAddAuthenticationStatement
     private class AssertionStrategy implements Function<ProfileRequestContext,Assertion> {
 
         /** {@inheritDoc} */
-        @Override
         @Nullable public Assertion apply(@Nullable final ProfileRequestContext input) {
             final MessageContext omc = input != null ? input.getOutboundMessageContext() : null;  
 
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java
index c42003db8..411be3bd5 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/EnforceDisallowedSSOFeatures.java
@@ -65,7 +65,8 @@ public class EnforceDisallowedSSOFeatures extends AbstractProfileAction {
     /** Constructor. */
     public EnforceDisallowedSSOFeatures() {
         relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
-        final Function<ProfileRequestContext,AuthnRequest> arls = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AuthnRequest> arls =
+                new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
         assert arls!=null;
         authnRequestLookupStrategy = arls;
     }
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
index e7f3e6b39..133795e01 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
@@ -50,7 +50,6 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -86,12 +85,14 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
 
     /** Constructor. */
     public FilterByQueriedAttributes() {
-        final Function<ProfileRequestContext,AttributeContext> acls = new ChildContextLookup<>(AttributeContext.class).compose(
-                new ChildContextLookup<>(RelyingPartyContext.class));
+        final Function<ProfileRequestContext,AttributeContext> acls =
+                new ChildContextLookup<>(AttributeContext.class).compose(
+                        new ChildContextLookup<>(RelyingPartyContext.class));
         assert acls != null;
         attributeContextLookupStrategy = acls;
         
-        final Function<ProfileRequestContext,AttributeQuery> qls =  new MessageLookup<>(AttributeQuery.class).compose(new InboundMessageContextLookup());
+        final Function<ProfileRequestContext,AttributeQuery> qls = 
+                new MessageLookup<>(AttributeQuery.class).compose(new InboundMessageContextLookup());
         assert qls != null;
         queryLookupStrategy = qls;
     }
@@ -232,8 +233,7 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
      */
     protected void decodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
             @Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final Attribute input,
-            @Nonnull @NonnullElements @Live final Multimap<String,IdPAttribute> results)
-                    throws AttributeDecodingException {
+            @Nonnull @Live final Multimap<String,IdPAttribute> results) throws AttributeDecodingException {
         
         final Collection<TranscodingRule> transcodingRules = registry.getTranscodingRules(input);
         if (transcodingRules.isEmpty()) {
@@ -259,7 +259,7 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
      * @return  the number of values left in the input attribute
      */
     private int filterRequestedValues(@Nonnull final IdPAttribute attribute,
-            @Nonnull @NonnullElements final Collection<IdPAttribute> requestedAttributes) {
+            @Nonnull final Collection<IdPAttribute> requestedAttributes) {
         
         boolean requestedValues = false;
 
@@ -286,4 +286,4 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
         return keepers.size();
     }
 
-}
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoder.java
index d3d81c5da..8a900d955 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoder.java
@@ -54,13 +54,13 @@ public class IdPInitiatedSSORequestMessageDecoder extends BaseIdPInitiatedSSOReq
     @Nonnull private final Logger log = LoggerFactory.getLogger(IdPInitiatedSSORequestMessageDecoder.class);
 
     /** Builder of SAML 2 {@link AuthnRequest} objects. */
-    private final SAMLObjectBuilder<AuthnRequest> requestBuilder;
+    @Nonnull private final SAMLObjectBuilder<AuthnRequest> requestBuilder;
 
     /** Builder of SAML 2 {@link Issuer} objects. */
-    private final SAMLObjectBuilder<Issuer> issuerBuilder;
+    @Nonnull private final SAMLObjectBuilder<Issuer> issuerBuilder;
     
     /** Builder of SAML 2 {@link NameIDPolicy} objects. */
-    private final SAMLObjectBuilder<NameIDPolicy> nipBuilder;
+    @Nonnull private final SAMLObjectBuilder<NameIDPolicy> nipBuilder;
     
     /** The IdP-initiated request structure parsed from the inbound request. */
     @Nullable private IdPInitiatedSSORequest ssoRequest;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 597d3fa75..065a1b477 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -57,7 +57,6 @@ import net.shibboleth.saml.saml2.profile.config.SAML2AssertionProducingProfileCo
 import net.shibboleth.saml.saml2.profile.config.SAML2ProfileConfiguration;
 import net.shibboleth.saml.saml2.profile.config.SingleLogoutProfileConfiguration;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -111,7 +110,7 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
     @NonnullAfterInit private EncryptionParametersResolver encParamsresolver;
     
     /** Active configurations to feed into resolver. */
-    @Nullable @NonnullElements private List<EncryptionConfiguration> encryptionConfigurations;
+    @Nullable private List<EncryptionConfiguration> encryptionConfigurations;
     
     /** Is encryption optional in the case no parameters can be resolved? */
     private boolean encryptionOptional;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
index 7496fc54e..862646671 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
@@ -49,7 +49,6 @@ import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfigurati
 import net.shibboleth.profile.config.ProfileConfiguration;
 import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -80,7 +79,7 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
     @Nonnull private Function<ProfileRequestContext,AuthnRequest> authnRequestLookupStrategy;
 
     /** Context URIs to ignore in a request. */
-    @Nonnull @NonnullElements private Set<String> ignoredContexts;
+    @Nonnull private Set<String> ignoredContexts;
     
     /** The request message to read from. */
     @NonnullBeforeExec private AuthnRequest authnRequest;
@@ -126,7 +125,7 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
      * 
      * @param contexts  contexts to ignore
      */
-    public void setIgnoredContexts(@Nonnull @NonnullElements final Collection<String> contexts) {
+    public void setIgnoredContexts(@Nonnull final Collection<String> contexts) {
         checkSetterPreconditions();
         final Collection<String> trimmed = StringSupport.normalizeStringCollection(contexts);
         
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index 07df74328..f3cc39918 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -51,7 +51,6 @@ import jakarta.servlet.http.HttpServletResponse;
 import net.shibboleth.idp.authn.ExternalAuthentication;
 import net.shibboleth.idp.authn.ExternalAuthenticationException;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
@@ -82,7 +81,7 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
     @Nonnull private Function<ProfileRequestContext,SAMLAuthnContext> samlContextLookupStrategy;
     
     /** Map of binding short names to deduce inbound binding constant. */
-    @Nonnull @NonnullElements private Map<String,BindingDescriptor> bindingMap;
+    @Nonnull private Map<String,BindingDescriptor> bindingMap;
     
     /** Constructor. */
     public SAMLAuthnController() {
@@ -131,7 +130,7 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
      * 
      * @param bindings the bindings to set
      */
-    public void setInboundBindings(@Nullable @NonnullElements final Collection<BindingDescriptor> bindings) {
+    public void setInboundBindings(@Nullable final Collection<BindingDescriptor> bindings) {
         checkSetterPreconditions();
         if (bindings != null) {
             bindingMap = new HashMap<>(bindings.size());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index a804350ff..c8e5de0ed 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -83,7 +83,6 @@ import net.shibboleth.profile.context.RelyingPartyContext;
 import net.shibboleth.saml.profile.context.navigate.SAMLMetadataContextLookupFunction;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -536,8 +535,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
      */
     private void decodeAttribute(@Nonnull final AttributeTranscoderRegistry registry,
             @Nonnull final ProfileRequestContext profileRequestContext, @Nonnull final Attribute input,
-            @Nonnull @NonnullElements @Live final Multimap<String,IdPAttribute> results)
-                    throws AttributeDecodingException {
+            @Nonnull @Live final Multimap<String,IdPAttribute> results) throws AttributeDecodingException {
         
         final Collection<TranscodingRule> transcodingRules = registry.getTranscodingRules(input);
         if (transcodingRules.isEmpty()) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/package-info.java
index c14cd08b1..8fc6667ca 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Profile processing actions related to SAML 2 messages. */
+ at NonnullElements
+package net.shibboleth.idp.saml.saml2.profile.impl;
 
-package net.shibboleth.idp.saml.saml2.profile.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/package-info.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/package-info.java
index 685f4b87a..1454f364a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/package-info.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation classes for SAML-specific session functionality.
  */
-package net.shibboleth.idp.saml.session.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.idp.saml.session.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list