[java-opensaml] branch main updated: IDP-2069 - Null Handling Task

Scott Cantor cantor.2 at osu.edu
Mon Mar 27 16:38:28 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=2ecd2ca661177aebfe9bfd817da43f39e045772d

The following commit(s) were added to refs/heads/main by this push:
     new 2ecd2ca66 IDP-2069 - Null Handling Task
2ecd2ca66 is described below

commit 2ecd2ca661177aebfe9bfd817da43f39e045772d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 27 12:38:21 2023 -0400

    IDP-2069 - Null Handling Task
    
    https://shibboleth.atlassian.net/browse/IDP-2069
    
    Annotate SAML 2 core and metadata + cleanup.
---
 .../common/binding/AbstractEndpointResolver.java   | 12 ++-
 .../messaging/context/SAMLPeerEntityContext.java   |  6 +-
 .../profile/logic/DefaultLocalErrorPredicate.java  |  9 ++-
 .../profile/logic/EntityAttributesPredicate.java   |  9 ++-
 .../profile/logic/EntityGroupNamePredicate.java    | 17 ++--
 .../support/AttributeConsumingServiceSelector.java | 41 ++++++----
 .../metadata/support/SAML2MetadataSupport.java     |  3 +-
 .../saml2/assertion/SAML20AssertionValidator.java  | 20 +++--
 .../java/org/opensaml/saml/saml2/core/Advice.java  | 21 ++---
 .../opensaml/saml/saml2/core/ArtifactResolve.java  | 15 ++--
 .../opensaml/saml/saml2/core/ArtifactResponse.java | 16 ++--
 .../org/opensaml/saml/saml2/core/Assertion.java    | 42 +++++-----
 .../saml/saml2/core/AssertionIDRequest.java        | 10 ++-
 .../org/opensaml/saml/saml2/core/Attribute.java    | 36 +++++----
 .../opensaml/saml/saml2/core/AttributeQuery.java   | 11 +--
 .../saml/saml2/core/AttributeStatement.java        | 15 ++--
 .../saml/saml2/core/AudienceRestriction.java       | 11 +--
 .../org/opensaml/saml/saml2/core/AuthnContext.java | 90 +++++++++++++---------
 .../opensaml/saml/saml2/core/AuthnContextDecl.java |  4 +-
 .../org/opensaml/saml/saml2/core/AuthnQuery.java   | 19 ++---
 .../org/opensaml/saml/saml2/core/AuthnRequest.java | 83 ++++++++++----------
 .../opensaml/saml/saml2/core/AuthnStatement.java   | 33 ++++----
 .../saml/saml2/core/AuthzDecisionQuery.java        | 22 +++---
 .../saml/saml2/core/AuthzDecisionStatement.java    | 31 ++++----
 .../java/org/opensaml/saml/saml2/core/BaseID.java  | 24 +++---
 .../org/opensaml/saml/saml2/core/Condition.java    |  8 +-
 .../org/opensaml/saml/saml2/core/Conditions.java   | 30 ++++----
 .../saml/saml2/core/EncryptedAssertion.java        |  4 +-
 .../saml/saml2/core/EncryptedAttribute.java        |  4 +-
 .../saml/saml2/core/EncryptedElementType.java      | 12 +--
 .../org/opensaml/saml/saml2/core/EncryptedID.java  |  4 +-
 .../org/opensaml/saml/saml2/core/Evidence.java     | 19 ++---
 .../org/opensaml/saml/saml2/core/Extensions.java   |  8 +-
 .../org/opensaml/saml/saml2/core/IDPEntry.java     | 27 +++----
 .../java/org/opensaml/saml/saml2/core/IDPList.java | 16 ++--
 .../java/org/opensaml/saml/saml2/core/Issuer.java  |  8 +-
 .../saml2/core/KeyInfoConfirmationDataType.java    |  7 +-
 .../opensaml/saml/saml2/core/LogoutRequest.java    | 45 ++++++-----
 .../opensaml/saml/saml2/core/LogoutResponse.java   | 16 ++--
 .../saml/saml2/core/ManageNameIDRequest.java       | 31 ++++----
 .../saml/saml2/core/ManageNameIDResponse.java      |  8 +-
 .../java/org/opensaml/saml/saml2/core/NameID.java  |  8 +-
 .../saml/saml2/core/NameIDMappingRequest.java      | 25 +++---
 .../saml/saml2/core/NameIDMappingResponse.java     | 17 ++--
 .../org/opensaml/saml/saml2/core/NameIDPolicy.java | 33 ++++----
 .../org/opensaml/saml/saml2/core/NameIDType.java   | 45 +++++------
 .../opensaml/saml/saml2/core/NewEncryptedID.java   |  4 +-
 .../org/opensaml/saml/saml2/core/OneTimeUse.java   |  8 +-
 .../opensaml/saml/saml2/core/ProxyRestriction.java | 17 ++--
 .../saml/saml2/core/RequestAbstractType.java       | 16 ++--
 .../saml/saml2/core/RequestedAuthnContext.java     | 20 ++---
 .../org/opensaml/saml/saml2/core/Response.java     | 13 ++--
 .../java/org/opensaml/saml/saml2/core/Scoping.java | 25 +++---
 .../org/opensaml/saml/saml2/core/Statement.java    |  8 +-
 .../java/org/opensaml/saml/saml2/core/Status.java  | 24 +++---
 .../org/opensaml/saml/saml2/core/StatusCode.java   | 79 +++++++++++--------
 .../org/opensaml/saml/saml2/core/StatusDetail.java |  8 +-
 .../saml/saml2/core/StatusResponseType.java        | 52 ++++++-------
 .../java/org/opensaml/saml/saml2/core/Subject.java | 24 +++---
 .../saml/saml2/core/SubjectConfirmation.java       | 40 +++++-----
 .../saml/saml2/core/SubjectConfirmationData.java   | 38 +++++----
 .../opensaml/saml/saml2/core/SubjectLocality.java  | 21 ++---
 .../org/opensaml/saml/saml2/core/SubjectQuery.java | 14 ++--
 .../org/opensaml/saml/saml2/core/Terminate.java    |  8 +-
 .../org/opensaml/saml/saml2/ecp/RelayState.java    |  8 +-
 .../java/org/opensaml/saml/saml2/ecp/Request.java  | 33 ++++----
 .../saml/saml2/ecp/RequestAuthenticated.java       |  8 +-
 .../java/org/opensaml/saml/saml2/ecp/Response.java | 15 ++--
 .../saml/saml2/ecp/SubjectConfirmation.java        | 19 ++---
 .../opensaml/saml/saml2/encryption/Decrypter.java  |  6 +-
 .../saml/saml2/metadata/AffiliationDescriptor.java | 34 ++++----
 .../saml2/metadata/ArtifactResolutionService.java  |  6 +-
 .../saml2/metadata/AssertionConsumerService.java   |  6 +-
 .../saml2/metadata/AssertionIDRequestService.java  |  6 +-
 .../metadata/AttributeAuthorityDescriptor.java     | 21 ++---
 .../saml2/metadata/AttributeConsumingService.java  | 34 ++++----
 .../saml/saml2/metadata/AttributeService.java      |  6 +-
 .../saml2/metadata/AuthnAuthorityDescriptor.java   | 17 ++--
 .../saml/saml2/metadata/AuthnQueryService.java     |  6 +-
 .../opensaml/saml/saml2/metadata/AuthzService.java |  6 +-
 .../saml/saml2/metadata/ContactPerson.java         | 38 ++++-----
 .../saml/saml2/metadata/EncryptionMethod.java      |  4 +-
 .../org/opensaml/saml/saml2/metadata/Endpoint.java | 29 +++----
 .../saml/saml2/metadata/EntitiesDescriptor.java    | 34 ++++----
 .../saml/saml2/metadata/EntityDescriptor.java      | 63 ++++++++-------
 .../opensaml/saml/saml2/metadata/Extensions.java   | 10 +--
 .../opensaml/saml/saml2/metadata/GivenName.java    |  2 +-
 .../saml/saml2/metadata/IDPSSODescriptor.java      | 32 ++++----
 .../saml/saml2/metadata/IndexedEndpoint.java       | 27 +++----
 .../saml/saml2/metadata/KeyDescriptor.java         | 22 +++---
 .../saml/saml2/metadata/ManageNameIDService.java   |  4 +-
 .../saml/saml2/metadata/NameIDMappingService.java  |  4 +-
 .../opensaml/saml/saml2/metadata/Organization.java | 20 ++---
 .../saml2/metadata/OrganizationDisplayName.java    |  4 +-
 .../saml/saml2/metadata/PDPDescriptor.java         | 15 ++--
 .../saml/saml2/metadata/RequestedAttribute.java    | 19 ++---
 .../saml/saml2/metadata/RoleDescriptor.java        | 58 +++++++-------
 .../saml/saml2/metadata/SPSSODescriptor.java       | 43 ++++++-----
 .../saml/saml2/metadata/SSODescriptor.java         | 22 +++---
 .../saml/saml2/metadata/SingleLogoutService.java   |  4 +-
 .../saml/saml2/metadata/SingleSignOnService.java   |  4 +-
 .../profile/AbstractSAML2NameIDGenerator.java      | 12 ++-
 .../saml2/wssecurity/SAML20AssertionToken.java     |  2 +-
 103 files changed, 1130 insertions(+), 967 deletions(-)

diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
index 72ff60144..354867670 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/binding/AbstractEndpointResolver.java
@@ -174,8 +174,14 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
             if (doCheckEndpoint(criteria, candidate)) {
                 if (startsWith != null) {
                     // Evaluate how good a match it is.
-                    final String candidateLocation = candidate.getLocation() != null ?
-                            candidate.getLocation() : candidate.getResponseLocation();
+                    String candidateLocation = candidate.getLocation();
+                    if (candidateLocation == null) {
+                        candidateLocation = candidate.getResponseLocation();
+                    }
+                    if (candidateLocation == null) {
+                        log.debug("Skipping endpoint with no Location or ResponseLocation");
+                        continue;
+                    }
                     int i = 0;
                     for (; i < candidateLocation.length() && i < startsWith.getLocation().length(); ++i) {
                         if (candidateLocation.charAt(i) != startsWith.getLocation().charAt(i)) {
@@ -331,8 +337,8 @@ public abstract class AbstractEndpointResolver<EndpointType extends Endpoint>
      * 
      * @return a new list containing the endpoints such that the default is first
      */
-    @SuppressWarnings("unchecked")
     // Checkstyle: CyclomaticComplexity OFF
+    @SuppressWarnings("unchecked")
     @Nonnull @NonnullElements private List<EndpointType> sortCandidates(
             @Nonnull @NonnullElements final List<Endpoint> candidates) {
         
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLPeerEntityContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLPeerEntityContext.java
index 586e8ef18..2dad6e82f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLPeerEntityContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/messaging/context/SAMLPeerEntityContext.java
@@ -203,11 +203,11 @@ public final class SAMLPeerEntityContext extends AbstractAuthenticatableSAMLEnti
             return null;
         }
 
-        if (issuer.getFormat() == null || issuer.getFormat().equals(NameIDType.ENTITY)) {
+        final String format = issuer.getFormat();
+        if (format == null || format.equals(NameIDType.ENTITY)) {
             return issuer.getValue();
         }
-        log.warn("Couldn't dynamically resolve SAML 2 peer entity ID due to unsupported NameID format: {}", 
-                issuer.getFormat());
+        log.warn("Couldn't dynamically resolve SAML 2 peer entity ID due to unsupported NameID format: {}", format);
         return null;
     }
 
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java
index 1ef9ff409..7dc539c12 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/DefaultLocalErrorPredicate.java
@@ -154,9 +154,12 @@ public class DefaultLocalErrorPredicate implements Predicate<ProfileRequestConte
 
         final AuthnRequest authnRequest = new MessageLookup<>(AuthnRequest.class).apply(
                 new InboundMessageContextLookup().apply(input));
-        if (authnRequest != null && authnRequest.isPassive()) {
-            log.debug("Request was a SAML 2 AuthnRequest with IsPassive set, handling error with response");
-            return false;
+        if (authnRequest != null) {
+            final Boolean isPassive = authnRequest.isPassive();
+            if (isPassive != null && isPassive) {
+                log.debug("Request was a SAML 2 AuthnRequest with IsPassive set, handling error with response");
+                return false;
+            }
         }
         
         final EventContext eventCtx = eventContextLookupStrategy.apply(input);
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
index 1183f8dce..84978bde0 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityAttributesPredicate.java
@@ -343,8 +343,13 @@ public class EntityAttributesPredicate implements Predicate<EntityDescriptor> {
             // Check each attribute/tag in the populated set.
             for (final Attribute a : attributes) {
                 // Compare Name and NameFormat for a matching tag.
-                if (a.getName() != null && a.getName().equals(input.getName())
-                        && (input.getNameFormat() == null || a.getNameFormat().equals(input.getNameFormat()))) {
+                final String name = a.getName();
+                String nameFormat = a.getNameFormat();
+                if (nameFormat == null) {
+                    nameFormat = Attribute.UNSPECIFIED;
+                }
+                if (name != null && name.equals(input.getName())
+                        && (input.getNameFormat() == null || nameFormat.equals(input.getNameFormat()))) {
 
                     final List<String> attributeValues = getPossibleAttributeValuesAsStrings(a);
                     // Check each tag value's simple content for a value match.
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java
index 7511e0744..6d5ccf47c 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/common/profile/logic/EntityGroupNamePredicate.java
@@ -125,13 +125,16 @@ public class EntityGroupNamePredicate implements Predicate<EntityDescriptor> {
                 try {
                     assert metadataResolver != null;
                     final EntityDescriptor affiliation = metadataResolver.resolveSingle(criteria);
-                    if (affiliation != null && affiliation.getAffiliationDescriptor() != null) {
-                        for (final AffiliateMember member : affiliation.getAffiliationDescriptor().getMembers()) {
-                            final String uri = member.getURI();
-                            if (uri != null && uri.equals(input.getEntityID())) {
-                                log.debug("Found AffiliationDescriptor '{}' membership for entity '{}'",
-                                        affiliation.getEntityID(), input.getEntityID());
-                                return true;
+                    if (affiliation != null) {
+                        final AffiliationDescriptor descriptor = affiliation.getAffiliationDescriptor();
+                        if (descriptor != null) {
+                            for (final AffiliateMember member : descriptor.getMembers()) {
+                                final String uri = member.getURI();
+                                if (uri != null && uri.equals(input.getEntityID())) {
+                                    log.debug("Found AffiliationDescriptor '{}' membership for entity '{}'",
+                                            affiliation.getEntityID(), input.getEntityID());
+                                    return true;
+                                }
                             }
                         }
                     }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
index c0af03aca..d1a9e1ca2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/AttributeConsumingServiceSelector.java
@@ -19,12 +19,16 @@ package org.opensaml.saml.metadata.support;
 
 import java.util.List;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.opensaml.saml.ext.saml2mdquery.AttributeQueryDescriptorType;
 import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
 import org.opensaml.saml.saml2.metadata.RoleDescriptor;
 import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Metadata support class which selects an {@link AttributeConsumingService} based on input of a mandatory
@@ -60,13 +64,13 @@ import org.slf4j.LoggerFactory;
 public class AttributeConsumingServiceSelector {
 
     /** Class logger. */
-    private Logger log = LoggerFactory.getLogger(AttributeConsumingServiceSelector.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(AttributeConsumingServiceSelector.class);
 
     /** The requested service index. */
-    private Integer index;
+    @Nullable private Integer index;
 
     /** The AttributeConsumingService's parent role descriptor. */
-    private RoleDescriptor roleDescriptor;
+    @Nullable private RoleDescriptor roleDescriptor;
 
     /**
      * Flag which determines whether, in the case of an invalid index, to return the default AttributeConsumingService.
@@ -78,7 +82,7 @@ public class AttributeConsumingServiceSelector {
      * 
      * @return Returns the index.
      */
-    public Integer getIndex() {
+    @Nullable public Integer getIndex() {
         return index;
     }
 
@@ -87,7 +91,7 @@ public class AttributeConsumingServiceSelector {
      * 
      * @param requestedIndex The index to set.
      */
-    public void setIndex(final Integer requestedIndex) {
+    public void setIndex(@Nullable final Integer requestedIndex) {
         index = requestedIndex;
     }
 
@@ -96,7 +100,7 @@ public class AttributeConsumingServiceSelector {
      * 
      * @return Returns the spSSODescriptor.
      */
-    public RoleDescriptor getRoleDescriptor() {
+    @Nullable public RoleDescriptor getRoleDescriptor() {
         return roleDescriptor;
     }
 
@@ -105,7 +109,7 @@ public class AttributeConsumingServiceSelector {
      * 
      * @param descriptor The roleDescriptor to set.
      */
-    public void setRoleDescriptor(final RoleDescriptor descriptor) {
+    public void setRoleDescriptor(@Nullable final RoleDescriptor descriptor) {
         roleDescriptor = descriptor;
     }
 
@@ -134,7 +138,7 @@ public class AttributeConsumingServiceSelector {
      * 
      * @return the selected AttributeConsumingService, or null
      */
-    public AttributeConsumingService selectService() {
+    @Nullable public AttributeConsumingService selectService() {
         final List<AttributeConsumingService> candidates = getCandidates();
 
         if (candidates == null || candidates.isEmpty()) {
@@ -176,19 +180,20 @@ public class AttributeConsumingServiceSelector {
      * 
      * @return the list of candidate AttributeConsumingServices, or null if none could be resolved
      */
-    protected List<AttributeConsumingService> getCandidates() {
+    @Nullable protected List<AttributeConsumingService> getCandidates() {
         if (roleDescriptor == null) {
             log.debug("RoleDescriptor was not supplied, unable to select AttributeConsumingService");
             return null;
         }
 
-        if (roleDescriptor instanceof SPSSODescriptor) {
+        if (roleDescriptor instanceof SPSSODescriptor sprole) {
             log.debug("Resolving AttributeConsumingService candidates from SPSSODescriptor");
-            return ((SPSSODescriptor) roleDescriptor).getAttributeConsumingServices();
-        } else if (roleDescriptor instanceof AttributeQueryDescriptorType) {
+            return sprole.getAttributeConsumingServices();
+        } else if (roleDescriptor instanceof AttributeQueryDescriptorType queryrole) {
             log.debug("Resolving AttributeConsumingService candidates from AttributeQueryDescriptorType");
-            return ((AttributeQueryDescriptorType) roleDescriptor).getAttributeConsumingServices();
+            return queryrole.getAttributeConsumingServices();
         } else {
+            assert roleDescriptor != null;
             log.debug("Unable to resolve service candidates, role descriptor was of an unsupported type: {}",
                     roleDescriptor.getClass().getName());
             return null;
@@ -201,7 +206,7 @@ public class AttributeConsumingServiceSelector {
      * @param candidates the list of candiate services
      * @return the selected candidate or null
      */
-    private AttributeConsumingService selectByIndex(final List<AttributeConsumingService> candidates) {
+    @Nullable private AttributeConsumingService selectByIndex(final List<AttributeConsumingService> candidates) {
         log.debug("Selecting AttributeConsumingService by index");
         for (final AttributeConsumingService attribCS : candidates) {
             // Check for null b/c don't ever want to fail with an NPE due to autoboxing.
@@ -223,11 +228,12 @@ public class AttributeConsumingServiceSelector {
      * @param candidates the list of candiate services
      * @return the selected candidate or null
      */
-    private AttributeConsumingService selectDefault(final List<AttributeConsumingService> candidates) {
+    @Nonnull private AttributeConsumingService selectDefault(final List<AttributeConsumingService> candidates) {
         log.debug("Selecting default AttributeConsumingService");
         AttributeConsumingService firstNoDefault = null;
         for (final AttributeConsumingService attribCS : candidates) {
-            if (attribCS.isDefault()) {
+            final Boolean isDefault = attribCS.isDefault();
+            if (isDefault != null && isDefault) {
                 log.debug("Selected AttributeConsumingService with explicit isDefault of true");
                 return attribCS;
             }
@@ -245,4 +251,5 @@ public class AttributeConsumingServiceSelector {
         log.debug("Selected first AttributeConsumingService with explicit isDefault of false");
         return candidates.get(0);
     }
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/SAML2MetadataSupport.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/SAML2MetadataSupport.java
index 4fbe5353d..a085685ee 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/SAML2MetadataSupport.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/metadata/support/SAML2MetadataSupport.java
@@ -65,7 +65,8 @@ public final class SAML2MetadataSupport {
         
         T firstNoDefault = null;
         for (final T endpoint : candidates) {
-            if (endpoint.isDefault()) {
+            final Boolean isDefault = endpoint.isDefault();
+            if (isDefault != null && isDefault) {
                 LOG.debug("Selected IndexedEndpoint with explicit isDefault of true");
                 return endpoint;
             }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
index b0fe43be8..ccc5e2135 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/assertion/SAML20AssertionValidator.java
@@ -399,12 +399,13 @@ public class SAML20AssertionValidator {
     @Nonnull protected ValidationResult validateIssueInstant(@Nonnull final Assertion assertion,
             @Nonnull final ValidationContext context) throws AssertionValidationException {
         
-        if (assertion.getIssueInstant() == null) {
+        final Instant issueInstant = assertion.getIssueInstant();
+
+        if (issueInstant == null) {
             context.setValidationFailureMessage(String.format(
                     "Assertion '%s' did not contain the required IssueInstant", assertion.getID()));
             return ValidationResult.INVALID; 
         }
-        final Instant issueInstant = assertion.getIssueInstant();
         
         final Duration clockSkew = getClockSkew(context);
         final Duration lifetime = getLifetime(context);
@@ -447,8 +448,9 @@ public class SAML20AssertionValidator {
             @Nonnull final ValidationContext context) throws AssertionValidationException {
         
         String issuer = null;
-        if (assertion.getIssuer() != null) {
-            issuer = StringSupport.trimOrNull(assertion.getIssuer().getValue());
+        final Issuer issuerElement = assertion.getIssuer();
+        if (issuerElement != null) {
+            issuer = StringSupport.trimOrNull(issuerElement.getValue());
         }
         if (issuer == null) {
             log.warn("Assertion Issuer was missing and was required");
@@ -548,8 +550,9 @@ public class SAML20AssertionValidator {
         assert signature != null;
         
         String tokenIssuer = null;
-        if (token.getIssuer() != null) {
-            tokenIssuer = token.getIssuer().getValue();
+        final Issuer issuerElement = token.getIssuer();
+        if (issuerElement != null) {
+            tokenIssuer = issuerElement.getValue();
         }
         
         log.debug("Attempting signature validation on Assertion '{}' from Issuer '{}'",
@@ -651,8 +654,9 @@ public class SAML20AssertionValidator {
         
         if (!criteriaSet.contains(EntityIdCriterion.class)) {
             String issuer =  null;
-            if (token.getIssuer() != null) {
-                issuer = StringSupport.trimOrNull(token.getIssuer().getValue());
+            final Issuer issuerElement = token.getIssuer();
+            if (issuerElement != null) {
+                issuer = StringSupport.trimOrNull(issuerElement.getValue());
             }
             if (issuer != null) {
                 criteriaSet.add(new EntityIdCriterion(issuer));
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Advice.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Advice.java
index c3ee11bf9..d80304e81 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Advice.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Advice.java
@@ -26,6 +26,7 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -34,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Advice extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Advice";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Advice";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AdviceType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AdviceType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /**
@@ -52,7 +53,7 @@ public interface Advice extends SAMLObject {
      * 
      * @return the list of all child elements attached to this advice
      */
-    public List<XMLObject> getChildren();
+    @Nonnull @Live List<XMLObject> getChildren();
 
     /**
      * Gets the list of child elements attached to this advice that match a particular QName.
@@ -60,33 +61,33 @@ public interface Advice extends SAMLObject {
      * @param typeOrName the QName of the child elements to return
      * @return the list of matching child elements attached to this advice
      */
-    public List<XMLObject> getChildren(QName typeOrName);
+    @Nonnull @Live List<XMLObject> getChildren(@Nonnull final QName typeOrName);
 
     /**
      * Gets the list of AssertionID references used as advice.
      * 
      * @return the list of AssertionID references used as advice
      */
-    public List<AssertionIDRef> getAssertionIDReferences();
+    @Nonnull @Live List<AssertionIDRef> getAssertionIDReferences();
 
     /**
      * Gets the list of AssertionURI references used as advice.
      * 
      * @return the list of AssertionURI references used as advice
      */
-    public List<AssertionURIRef> getAssertionURIReferences();
+    @Nonnull @Live List<AssertionURIRef> getAssertionURIReferences();
 
     /**
      * Gets the list of Assertions used as advice.
      * 
      * @return the list of Assertions used as advice
      */
-    public List<Assertion> getAssertions();
+    @Nonnull @Live List<Assertion> getAssertions();
 
     /**
      * Gets the list of EncryptedAssertions used as advice.
      * 
      * @return the list of EncryptedAssertions used as advice
      */
-    public List<EncryptedAssertion> getEncryptedAssertions();
+    @Nonnull @Live List<EncryptedAssertion> getEncryptedAssertions();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResolve.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResolve.java
index d204696ad..e521c8402 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResolve.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResolve.java
@@ -22,6 +22,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
@@ -34,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ArtifactResolve extends RequestAbstractType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ArtifactResolve";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ArtifactResolve";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ArtifactResolveType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ArtifactResolveType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -52,13 +53,13 @@ public interface ArtifactResolve extends RequestAbstractType {
      * 
      * @return the Artifact child element
      */
-    public Artifact getArtifact();
+    @Nullable Artifact getArtifact();
 
     /**
      * Set Artifact child element.
      * 
      * @param newArtifact sets the new Artifact child element
      */
-    public void setArtifact(Artifact newArtifact);
+    void setArtifact(@Nullable final Artifact newArtifact);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResponse.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResponse.java
index 04b518f59..3dc371824 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResponse.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ArtifactResponse.java
@@ -22,6 +22,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -35,17 +36,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ArtifactResponse extends StatusResponseType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ArtifactResponse";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ArtifactResponse";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ArtifactResponseType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ArtifactResponseType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
     
     /**
@@ -53,12 +54,13 @@ public interface ArtifactResponse extends StatusResponseType {
      * 
      * @return protocol message from the artifact response
      */
-    public SAMLObject getMessage();
+    @Nullable SAMLObject getMessage();
     
     /**
      * Sets the protocol message from the artifact response.
      * 
      * @param message protocol message from the artifact response
      */
-    public void setMessage(SAMLObject message);
-}
+    void setMessage(@Nullable final SAMLObject message);
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Assertion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Assertion.java
index eaac81852..9e9815b95 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Assertion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Assertion.java
@@ -21,6 +21,7 @@ import java.time.Instant;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 
@@ -28,6 +29,8 @@ import org.opensaml.saml.common.SAMLVersion;
 import org.opensaml.saml.common.SignableSAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+
 /**
  * SAML 2.0 Core Assertion.
  */
@@ -65,105 +68,105 @@ public interface Assertion extends SignableSAMLObject, Evidentiary {
      * 
      * @return the SAML Version of this assertion.
      */
-    SAMLVersion getVersion();
+    @Nullable SAMLVersion getVersion();
 
     /**
      * Sets the SAML Version of this assertion.
      * 
      * @param newVersion the SAML Version of this assertion
      */
-    void setVersion(SAMLVersion newVersion);
+    void setVersion(@Nullable final SAMLVersion newVersion);
 
     /**
      * Gets the issue instance of this assertion.
      * 
      * @return the issue instance of this assertion
      */
-    Instant getIssueInstant();
+    @Nullable Instant getIssueInstant();
 
     /**
      * Sets the issue instance of this assertion.
      * 
      * @param newIssueInstance the issue instance of this assertion
      */
-    void setIssueInstant(Instant newIssueInstance);
+    void setIssueInstant(@Nullable final Instant newIssueInstance);
 
     /**
      * Sets the ID of this assertion.
      * 
      * @return the ID of this assertion
      */
-    String getID();
+    @Nullable String getID();
 
     /**
      * Sets the ID of this assertion.
      * 
      * @param newID the ID of this assertion
      */
-    void setID(String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets the Issuer of this assertion.
      * 
      * @return the Issuer of this assertion
      */
-    Issuer getIssuer();
+    @Nullable Issuer getIssuer();
 
     /**
      * Sets the Issuer of this assertion.
      * 
      * @param newIssuer the Issuer of this assertion
      */
-    void setIssuer(Issuer newIssuer);
+    void setIssuer(@Nullable final Issuer newIssuer);
 
     /**
      * Gets the Subject of this assertion.
      * 
      * @return the Subject of this assertion
      */
-    Subject getSubject();
+    @Nullable Subject getSubject();
 
     /**
      * Sets the Subject of this assertion.
      * 
      * @param newSubject the Subject of this assertion
      */
-    void setSubject(Subject newSubject);
+    void setSubject(@Nullable final Subject newSubject);
 
     /**
      * Gets the Conditions placed on this assertion.
      * 
      * @return the Conditions placed on this assertion
      */
-    Conditions getConditions();
+    @Nullable Conditions getConditions();
 
     /**
      * Sets the Conditions placed on this assertion.
      * 
      * @param newConditions the Conditions placed on this assertion
      */
-    void setConditions(Conditions newConditions);
+    void setConditions(@Nullable final Conditions newConditions);
 
     /**
      * Gets the Advice for this assertion.
      * 
      * @return the Advice for this assertion
      */
-    Advice getAdvice();
+    @Nullable Advice getAdvice();
 
     /**
      * Sets the Advice for this assertion.
      * 
      * @param newAdvice the Advice for this assertion
      */
-    void setAdvice(Advice newAdvice);
+    void setAdvice(@Nullable final Advice newAdvice);
 
     /**
      * Gets the list of statements attached to this assertion.
      * 
      * @return the list of statements attached to this assertion
      */
-    List<Statement> getStatements();
+    @Nonnull @Live List<Statement> getStatements();
 
     /**
      * Gets the list of statements attached to this assertion that match a particular QName.
@@ -171,26 +174,27 @@ public interface Assertion extends SignableSAMLObject, Evidentiary {
      * @param typeOrName the QName of the statements to return
      * @return the list of statements attached to this assertion
      */
-    List<Statement> getStatements(QName typeOrName);
+    @Nonnull @Live List<Statement> getStatements(@Nonnull final QName typeOrName);
 
     /**
      * Gets the list of AuthnStatements attached to this assertion.
      * 
      * @return the list of AuthnStatements attached to this assertion
      */
-    List<AuthnStatement> getAuthnStatements();
+    @Nonnull @Live List<AuthnStatement> getAuthnStatements();
 
     /**
      * Gets the list of AuthzDecisionStatements attached to this assertion.
      * 
      * @return the list of AuthzDecisionStatements attached to this assertion
      */
-    List<AuthzDecisionStatement> getAuthzDecisionStatements();
+    @Nonnull @Live List<AuthzDecisionStatement> getAuthzDecisionStatements();
 
     /**
      * Gets the list of AttributeStatement attached to this assertion.
      * 
      * @return the list of AttributeStatement attached to this assertion
      */
-    List<AttributeStatement> getAttributeStatements();
+    @Nonnull @Live List<AttributeStatement> getAttributeStatements();
+
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AssertionIDRequest.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AssertionIDRequest.java
index f3ee3e210..65e620b72 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AssertionIDRequest.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AssertionIDRequest.java
@@ -28,6 +28,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -36,10 +37,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AssertionIDRequest extends RequestAbstractType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AssertionIDRequest";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AssertionIDRequest";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -47,5 +48,6 @@ public interface AssertionIDRequest extends RequestAbstractType {
      * 
      * @return the list of child AssertionIDRef's
      */
-    public List<AssertionIDRef> getAssertionIDRefs();
-}
+    @Nonnull @Live List<AssertionIDRef> getAssertionIDRefs();
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Attribute.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Attribute.java
index 1546b97aa..ca57e757a 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Attribute.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Attribute.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
@@ -27,6 +28,7 @@ import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -35,83 +37,83 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Attribute extends SAMLObject, AttributeExtensibleXMLObject {
 
     /** Local name of the Attribute element. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Attribute";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Attribute";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AttributeType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AttributeType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Name of the Name attribute. */
-    @Nonnull @NotEmpty public static final String NAME_ATTTRIB_NAME = "Name";
+    @Nonnull @NotEmpty static final String NAME_ATTTRIB_NAME = "Name";
 
     /** Name for the NameFormat attribute. */
-    @Nonnull @NotEmpty public static final String NAME_FORMAT_ATTRIB_NAME = "NameFormat";
+    @Nonnull @NotEmpty static final String NAME_FORMAT_ATTRIB_NAME = "NameFormat";
 
     /** Name of the FriendlyName attribute. */
-    @Nonnull @NotEmpty public static final String FRIENDLY_NAME_ATTRIB_NAME = "FriendlyName";
+    @Nonnull @NotEmpty static final String FRIENDLY_NAME_ATTRIB_NAME = "FriendlyName";
 
     /** Unspecified attribute format ID. */
-    @Nonnull @NotEmpty public static final String UNSPECIFIED = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified";
+    @Nonnull @NotEmpty static final String UNSPECIFIED = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified";
 
     /** URI reference attribute format ID. */
-    @Nonnull @NotEmpty public static final String URI_REFERENCE = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri";
+    @Nonnull @NotEmpty static final String URI_REFERENCE = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri";
 
     /** Basic attribute format ID. */
-    @Nonnull @NotEmpty public static final String BASIC = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic";
+    @Nonnull @NotEmpty static final String BASIC = "urn:oasis:names:tc:SAML:2.0:attrname-format:basic";
 
     /**
      * Get the name of this attribute.
      * 
      * @return the name of this attribute
      */
-    public String getName();
+    @Nullable String getName();
 
     /**
      * Sets the name of this attribute.
      * 
      * @param name the name of this attribute
      */
-    public void setName(String name);
+    void setName(@Nullable final String name);
 
     /**
      * Get the name format of this attribute.
      * 
      * @return the name format of this attribute
      */
-    public String getNameFormat();
+    @Nullable String getNameFormat();
 
     /**
      * Sets the name format of this attribute.
      * 
      * @param nameFormat the name format of this attribute
      */
-    public void setNameFormat(String nameFormat);
+    void setNameFormat(@Nullable final String nameFormat);
 
     /**
      * Get the friendly name of this attribute.
      * 
      * @return the friendly name of this attribute
      */
-    public String getFriendlyName();
+    @Nullable String getFriendlyName();
 
     /**
      * Sets the friendly name of this attribute.
      * 
      * @param friendlyName the friendly name of this attribute
      */
-    public void setFriendlyName(String friendlyName);
+    void setFriendlyName(@Nullable final String friendlyName);
 
     /**
      * Gets the list of attribute values for this attribute.
      * 
      * @return the list of attribute values for this attribute
      */
-    public List<XMLObject> getAttributeValues();
+    @Nonnull @Live List<XMLObject> getAttributeValues();
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeQuery.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeQuery.java
index b3de6a66f..27a5428a1 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeQuery.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeQuery.java
@@ -28,6 +28,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -36,17 +37,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AttributeQuery extends SubjectQuery {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeQuery";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeQuery";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AttributeQueryType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AttributeQueryType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -54,5 +55,5 @@ public interface AttributeQuery extends SubjectQuery {
      * 
      * @return the list of Attributes of this query
      */
-    public List<Attribute> getAttributes();
+    @Nonnull @Live List<Attribute> getAttributes();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeStatement.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeStatement.java
index a12297530..601f4abf9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeStatement.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AttributeStatement.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -32,17 +33,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AttributeStatement extends Statement {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeStatement";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeStatement";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AttributeStatementType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AttributeStatementType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
 
     /**
@@ -50,13 +51,13 @@ public interface AttributeStatement extends Statement {
      * 
      * @return the attributes expressed in this statement
      */
-    public List<Attribute> getAttributes();
+    @Nonnull @Live List<Attribute> getAttributes();
 
     /**
      * Gets the encrypted attributes expressed in this statement.
      * 
      * @return the encrypted attributes expressed in this statement
      */
-    public List<EncryptedAttribute> getEncryptedAttributes();
+    @Nonnull @Live List<EncryptedAttribute> getEncryptedAttributes();
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AudienceRestriction.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AudienceRestriction.java
index b9a8bdb3a..66b4b9892 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AudienceRestriction.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AudienceRestriction.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -32,17 +33,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AudienceRestriction extends Condition {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AudienceRestriction";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AudienceRestriction";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AudienceRestrictionType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AudienceRestrictionType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /**
@@ -50,5 +51,5 @@ public interface AudienceRestriction extends Condition {
      * 
      * @return the list of audiences for the assertion
      */
-    public List<Audience> getAudiences();
+    @Nonnull @Live List<Audience> getAudiences();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContext.java
index 5918652fc..e34d5fd75 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContext.java
@@ -20,154 +20,168 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /** SAML 2.0 Core AuthnContext. */
 public interface AuthnContext extends SAMLObject {
 
     /** Local Name of AuthnContext. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnContext";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnContext";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AuthnContextType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthnContextType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** URI for Internet Protocol authentication context. */
-    @Nonnull @NotEmpty public static final String IP_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol";
+    @Nonnull @NotEmpty static final String IP_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol";
 
     /** URI for Internet Protocol Password authentication context. */
-    @Nonnull @NotEmpty public static final String IP_PASSWORD_AUTHN_CTX =
+    @Nonnull @NotEmpty static final String IP_PASSWORD_AUTHN_CTX =
             "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword";
 
     /** URI for Kerberos authentication context. */
-    @Nonnull @NotEmpty public static final String KERBEROS_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos";
+    @Nonnull @NotEmpty static final String KERBEROS_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos";
 
     /** URI for Mobile One Factor Unregistered authentication context. */
-    @Nonnull @NotEmpty public static final String MOFU_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered";
+    @Nonnull @NotEmpty
+    static final String MOFU_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered";
 
     /** URI for Mobile Two Factor Unregistered authentication context. */
-    @Nonnull @NotEmpty public static final String MTFU_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered";
+    @Nonnull @NotEmpty
+    static final String MTFU_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered";
 
     /** URI for Mobile One Factor Contract authentication context. */
-    @Nonnull @NotEmpty public static final String MOFC_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract";
+    @Nonnull @NotEmpty
+    static final String MOFC_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract";
 
     /** URI for Mobile Two Factor Contract authentication context. */
-    @Nonnull @NotEmpty public static final String MTFC_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract";
+    @Nonnull @NotEmpty
+    static final String MTFC_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract";
 
     /** URI for Password authentication context. */
-    @Nonnull @NotEmpty public static final String PASSWORD_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Password";
+    @Nonnull @NotEmpty static final String PASSWORD_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Password";
 
     /** URI for Password Protected Transport authentication context. */
-    @Nonnull @NotEmpty public static final String PPT_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";
+    @Nonnull @NotEmpty
+    static final String PPT_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport";
 
     /** URI for Previous Session authentication context. */
-    @Nonnull @NotEmpty public static final String PREVIOUS_SESSION_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession";
+    @Nonnull @NotEmpty
+    static final String PREVIOUS_SESSION_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession";
 
     /** URI for X509 Public Key authentication context. */
-    @Nonnull @NotEmpty public static final String X509_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:X509";
+    @Nonnull @NotEmpty static final String X509_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:X509";
 
     /** URI for PGP authentication context. */
-    @Nonnull @NotEmpty public static final String PGP_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PGP";
+    @Nonnull @NotEmpty static final String PGP_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PGP";
 
     /** URI for SPKI authentication context. */
-    @Nonnull @NotEmpty public static final String SPKI_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI";
+    @Nonnull @NotEmpty static final String SPKI_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI";
 
     /** URI for XML Digital Signature authentication context. */
-    @Nonnull @NotEmpty public static final String XML_DSIG_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig";
+    @Nonnull @NotEmpty static final String XML_DSIG_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig";
 
     /** URI for Smart Card authentication context. */
-    @Nonnull @NotEmpty public static final String SMARTCARD_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard";
+    @Nonnull @NotEmpty static final String SMARTCARD_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard";
 
     /** URI for Smart Card PKI authentication context. */
-    @Nonnull @NotEmpty public static final String SMARTCARD_PKI_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI";
+    @Nonnull @NotEmpty
+    static final String SMARTCARD_PKI_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI";
 
     /** URI for Software PKU authentication context. */
-    @Nonnull @NotEmpty public static final String SOFTWARE_PKI_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI";
+    @Nonnull @NotEmpty
+    static final String SOFTWARE_PKI_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI";
 
     /** URI for Telephony authentication context. */
-    @Nonnull @NotEmpty public static final String TELEPHONY_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony";
+    @Nonnull @NotEmpty static final String TELEPHONY_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony";
 
     /** URI for Nomadic Telephony authentication context. */
-    @Nonnull @NotEmpty public static final String NOMAD_TELEPHONY_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony";
+    @Nonnull @NotEmpty
+    static final String NOMAD_TELEPHONY_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony";
 
     /** URI for Personalized Telephony authentication context. */
-    @Nonnull @NotEmpty public static final String PERSONAL_TELEPHONY_AUTHN_CTX =
-            "urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalTelephony";
+    @Nonnull @NotEmpty
+    static final String PERSONAL_TELEPHONY_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalTelephony";
 
     /** URI for Authenticated Telephony authentication context. */
-    @Nonnull @NotEmpty public static final String AUTHENTICATED_TELEPHONY_AUTHN_CTX =
+    @Nonnull @NotEmpty static final String AUTHENTICATED_TELEPHONY_AUTHN_CTX =
             "urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony";
 
     /** URI for Secure Remote Password authentication context. */
-    @Nonnull @NotEmpty public static final String SRP_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword";
+    @Nonnull @NotEmpty
+    static final String SRP_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword";
 
     /** URI for SSL/TLS Client authentication context. */
-    @Nonnull @NotEmpty public static final String TLS_CLIENT_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient";
+    @Nonnull @NotEmpty static final String TLS_CLIENT_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient";
 
     /** URI for Time Synchronized Token authentication context. */
-    @Nonnull @NotEmpty public static final String TIME_SYNC_TOKEN_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken";
+    @Nonnull @NotEmpty
+    static final String TIME_SYNC_TOKEN_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken";
 
     /** URI for unspecified authentication context. */
-    @Nonnull @NotEmpty public static final String UNSPECIFIED_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified";
+    @Nonnull @NotEmpty static final String UNSPECIFIED_AUTHN_CTX = "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified";
 
     /**
      * Gets the URI identifying the Context Class of this Authentication Context.
      * 
      * @return AuthnContext AuthnContextClassRef
      */
-    public AuthnContextClassRef getAuthnContextClassRef();
+    @Nullable AuthnContextClassRef getAuthnContextClassRef();
 
     /**
      * Sets the URI identifying the Context Class of this Authentication Context.
      * 
      * @param newAuthnContextClassRef the URI of this Authentication Context's Class.
      */
-    public void setAuthnContextClassRef(AuthnContextClassRef newAuthnContextClassRef);
+    void setAuthnContextClassRef(@Nullable final AuthnContextClassRef newAuthnContextClassRef);
 
     /**
      * Gets Declaration of this Authentication Context.
      * 
      * @return AuthnContext AuthnContextDecl
      */
-    public AuthnContextDecl getAuthContextDecl();
+    @Nullable AuthnContextDecl getAuthContextDecl();
 
     /**
      * Sets the Declaration of this Authentication Context.
      * 
      * @param newAuthnContextDecl the Declaration of this Authentication Context
      */
-    public void setAuthnContextDecl(AuthnContextDecl newAuthnContextDecl);
+    void setAuthnContextDecl(@Nullable final AuthnContextDecl newAuthnContextDecl);
 
     /**
      * Gets the URI of the Declaration of this Authentication Context.
      * 
      * @return AuthnContext AuthnContextDeclRef
      */
-    public AuthnContextDeclRef getAuthnContextDeclRef();
+    @Nullable AuthnContextDeclRef getAuthnContextDeclRef();
 
     /**
      * Sets the URI of the Declaration of this Authentication Context.
      * 
      * @param newAuthnContextDeclRef the URI of the Declaration of this Authentication Context
      */
-    public void setAuthnContextDeclRef(AuthnContextDeclRef newAuthnContextDeclRef);
+    void setAuthnContextDeclRef(@Nullable final AuthnContextDeclRef newAuthnContextDeclRef);
 
     /**
      * Gets the Authenticating Authorities of this Authentication Context.
      * 
      * @return AuthnContext AuthenticatingAuthorities
      */
-    public List<AuthenticatingAuthority> getAuthenticatingAuthorities();
-}
+    @Nonnull @Live List<AuthenticatingAuthority> getAuthenticatingAuthorities();
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContextDecl.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContextDecl.java
index 9b5b304be..ab6b88d43 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContextDecl.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnContextDecl.java
@@ -32,9 +32,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthnContextDecl extends SAMLObject, XSAny {
 
     /** Local Name of AuthnContextDecl. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnContextDecl";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnContextDecl";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnQuery.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnQuery.java
index c691f005b..0b5a65913 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnQuery.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnQuery.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
@@ -30,48 +31,48 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthnQuery extends SubjectQuery {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnQuery";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnQuery";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AuthnQueryType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthnQueryType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** SessionIndex attribute name. */
-    @Nonnull @NotEmpty public static final String SESSION_INDEX_ATTRIB_NAME = "SessionIndex";
+    @Nonnull @NotEmpty static final String SESSION_INDEX_ATTRIB_NAME = "SessionIndex";
     
     /**
      * Gets the SessionIndex of this request.
      * 
      * @return the SessionIndex of this request
      */
-    public String getSessionIndex();
+    @Nullable String getSessionIndex();
     
     /**
      * Sets the SessionIndex of this request.
      * 
      * @param newSessionIndex the SessionIndex of this request
      */
-    public void setSessionIndex(String newSessionIndex);
+    void setSessionIndex(@Nullable final String newSessionIndex);
     
     /**
      * Gets the RequestedAuthnContext of this request.
      * 
      * @return the RequestedAuthnContext of this request
      */
-    public RequestedAuthnContext getRequestedAuthnContext();
+    @Nullable RequestedAuthnContext getRequestedAuthnContext();
     
     /**
      * Sets the RequestedAuthnContext of this request.
      * 
      * @param newRequestedAuthnContext the RequestedAuthnContext of this request
      */
-    public void setRequestedAuthnContext(RequestedAuthnContext newRequestedAuthnContext);
+    void setRequestedAuthnContext(@Nullable final RequestedAuthnContext newRequestedAuthnContext);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnRequest.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnRequest.java
index a960a91bd..02fec68a3 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnRequest.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnRequest.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
@@ -31,53 +32,55 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthnRequest extends RequestAbstractType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnRequest";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnRequest";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AuthnRequestType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthnRequestType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** ForceAuthn attribute name. */
-    @Nonnull @NotEmpty public static final String FORCE_AUTHN_ATTRIB_NAME = "ForceAuthn";
+    @Nonnull @NotEmpty static final String FORCE_AUTHN_ATTRIB_NAME = "ForceAuthn";
 
     /** IsPassive attribute name. */
-    @Nonnull @NotEmpty public static final String IS_PASSIVE_ATTRIB_NAME = "IsPassive";
+    @Nonnull @NotEmpty static final String IS_PASSIVE_ATTRIB_NAME = "IsPassive";
 
     /** ProtocolBinding attribute name. */
-    @Nonnull @NotEmpty public static final String PROTOCOL_BINDING_ATTRIB_NAME = "ProtocolBinding";
+    @Nonnull @NotEmpty static final String PROTOCOL_BINDING_ATTRIB_NAME = "ProtocolBinding";
 
     /** AssertionConsumerServiceIndex attribute name. */
-    @Nonnull @NotEmpty public static final String ASSERTION_CONSUMER_SERVICE_INDEX_ATTRIB_NAME = "AssertionConsumerServiceIndex";
+    @Nonnull @NotEmpty
+    static final String ASSERTION_CONSUMER_SERVICE_INDEX_ATTRIB_NAME = "AssertionConsumerServiceIndex";
 
     /** AssertionConsumerServiceURL attribute name. */
-    @Nonnull @NotEmpty public static final String ASSERTION_CONSUMER_SERVICE_URL_ATTRIB_NAME = "AssertionConsumerServiceURL";
+    @Nonnull @NotEmpty static final String ASSERTION_CONSUMER_SERVICE_URL_ATTRIB_NAME = "AssertionConsumerServiceURL";
 
     /** AttributeConsumingServiceIndex attribute name. */
-    @Nonnull @NotEmpty public static final String ATTRIBUTE_CONSUMING_SERVICE_INDEX_ATTRIB_NAME = "AttributeConsumingServiceIndex";
+    @Nonnull @NotEmpty
+    static final String ATTRIBUTE_CONSUMING_SERVICE_INDEX_ATTRIB_NAME = "AttributeConsumingServiceIndex";
 
     /** ProviderName attribute name. */
-    @Nonnull @NotEmpty public static final String PROVIDER_NAME_ATTRIB_NAME = "ProviderName";
+    @Nonnull @NotEmpty static final String PROVIDER_NAME_ATTRIB_NAME = "ProviderName";
 
     /**
      * Gets whether the IdP should force the user to reauthenticate.
      * 
      * @return whether the IdP should force the user to reauthenticate
      */
-    public Boolean isForceAuthn();
+    @Nullable Boolean isForceAuthn();
 
     /**
      * Gets whether the IdP should force the user to reauthenticate.
      * 
      * @return whether the IdP should force the user to reauthenticate
      */
-    public XSBooleanValue isForceAuthnXSBoolean();
+    @Nullable XSBooleanValue isForceAuthnXSBoolean();
 
     /**
      * Sets whether the IdP should force the user to reauthenticate. Boolean values will be marshalled to either "true"
@@ -85,28 +88,28 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @param newForceAuthn whether the IdP should force the user to reauthenticate
      */
-    public void setForceAuthn(Boolean newForceAuthn);
+    void setForceAuthn(@Nullable final Boolean newForceAuthn);
 
     /**
      * Sets whether the IdP should force the user to reauthenticate.
      * 
      * @param newForceAuthn whether the IdP should force the user to reauthenticate
      */
-    public void setForceAuthn(XSBooleanValue newForceAuthn);
+    void setForceAuthn(@Nullable final XSBooleanValue newForceAuthn);
 
     /**
      * Gets whether the IdP should refrain from interacting with the user during the authentication process.
      * 
      * @return whether the IdP should refrain from interacting with the user during the authentication process
      */
-    public Boolean isPassive();
+    @Nullable Boolean isPassive();
 
     /**
      * Gets whether the IdP should refrain from interacting with the user during the authentication process.
      * 
      * @return whether the IdP should refrain from interacting with the user during the authentication process
      */
-    public XSBooleanValue isPassiveXSBoolean();
+    @Nullable XSBooleanValue isPassiveXSBoolean();
 
     /**
      * Sets whether the IdP should refrain from interacting with the user during the authentication process. Boolean
@@ -115,7 +118,7 @@ public interface AuthnRequest extends RequestAbstractType {
      * @param newIsPassive whether the IdP should refrain from interacting with the user during the authentication
      *            process
      */
-    public void setIsPassive(Boolean newIsPassive);
+    void setIsPassive(@Nullable final Boolean newIsPassive);
 
     /**
      * Sets whether the IdP should refrain from interacting with the user during the authentication process.
@@ -123,21 +126,21 @@ public interface AuthnRequest extends RequestAbstractType {
      * @param newIsPassive whether the IdP should refrain from interacting with the user during the authentication
      *            process
      */
-    public void setIsPassive(XSBooleanValue newIsPassive);
+    void setIsPassive(@Nullable final XSBooleanValue newIsPassive);
 
     /**
      * Gets the protocol binding URI for the request.
      * 
      * @return the value of the ProtocolBinding attribute
      */
-    public String getProtocolBinding();
+    @Nullable String getProtocolBinding();
 
     /**
      * Sets the protocol binding URI for the request.
      * 
      * @param newProtocolBinding the new value of the ProtocolBinding attribute
      */
-    public void setProtocolBinding(String newProtocolBinding);
+    void setProtocolBinding(@Nullable final String newProtocolBinding);
 
     /**
      * Gets the index of the particular Assertion Consumer Service to which the response to this request should be
@@ -145,7 +148,7 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @return the value of the AssertionConsumerServiceIndex attribute
      */
-    public Integer getAssertionConsumerServiceIndex();
+    @Nullable Integer getAssertionConsumerServiceIndex();
 
     /**
      * Sets the index of the particular Assertion Consumer Service to which the response to this request should be
@@ -153,7 +156,7 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @param newAssertionConsumerServiceIndex the new value of the AssertionConsumerServiceIndex attribute
      */
-    public void setAssertionConsumerServiceIndex(Integer newAssertionConsumerServiceIndex);
+    void setAssertionConsumerServiceIndex(@Nullable final Integer newAssertionConsumerServiceIndex);
 
     /**
      * Gets the URL of the particular Assertion Consumer Service to which the response to this request should be
@@ -161,7 +164,7 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @return the value of the AssertionConsumerServiceURL attribute
      */
-    public String getAssertionConsumerServiceURL();
+    @Nullable String getAssertionConsumerServiceURL();
 
     /**
      * Sets the URL of the particular Assertion Consumer Service to which the response to this request should be
@@ -169,7 +172,7 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @param newAssertionConsumerServiceURL the new value of the AssertionConsumerServiceURL attribute
      */
-    public void setAssertionConsumerServiceURL(String newAssertionConsumerServiceURL);
+    void setAssertionConsumerServiceURL(@Nullable final String newAssertionConsumerServiceURL);
 
     /**
      * Gets the index of the Attribute Consuming Service which describes the SAML attributes the requester desires or
@@ -178,7 +181,7 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @return the value of the AssertionConsumerServiceIndex attribute
      */
-    public Integer getAttributeConsumingServiceIndex();
+    @Nullable Integer getAttributeConsumingServiceIndex();
 
     /**
      * 
@@ -187,90 +190,90 @@ public interface AuthnRequest extends RequestAbstractType {
      * 
      * @param newAttributeConsumingServiceIndex the new value of the AttributeConsumingServiceIndex attribute
      */
-    public void setAttributeConsumingServiceIndex(Integer newAttributeConsumingServiceIndex);
+    void setAttributeConsumingServiceIndex(@Nullable final Integer newAttributeConsumingServiceIndex);
 
     /**
      * Gets the human-readable name of the requester for use by the presenter's user agent or the identity provider.
      * 
      * @return the value of the ProviderName attribute
      */
-    public String getProviderName();
+    @Nullable String getProviderName();
 
     /**
      * Sets the human-readable name of the requester for use by the presenter's user agent or the identity provider.
      * 
      * @param newProviderName the new value of the ProviderName attribute
      */
-    public void setProviderName(String newProviderName);
+    void setProviderName(@Nullable final String newProviderName);
 
     /**
      * Gets the {@link Subject} of the request.
      * 
      * @return the Subject of the request
      */
-    public Subject getSubject();
+    @Nullable Subject getSubject();
 
     /**
      * Sets the {@link Subject} of the request.
      * 
      * @param newSubject the new value of the Subject of the request
      */
-    public void setSubject(Subject newSubject);
+    void setSubject(@Nullable final Subject newSubject);
 
     /**
      * Gets the {@link NameIDPolicy} of the request.
      * 
      * @return the NameIDPolicy of the request
      */
-    public NameIDPolicy getNameIDPolicy();
+    @Nullable NameIDPolicy getNameIDPolicy();
 
     /**
      * Sets the {@link NameIDPolicy} of the request.
      * 
      * @param newNameIDPolicy the new value of the NameIDPolicy of the request
      */
-    public void setNameIDPolicy(NameIDPolicy newNameIDPolicy);
+    void setNameIDPolicy(@Nullable final NameIDPolicy newNameIDPolicy);
 
     /**
      * Gets the {@link Conditions} of the request.
      * 
      * @return the Conditions of the request
      */
-    public Conditions getConditions();
+    @Nullable Conditions getConditions();
 
     /**
      * Sets the {@link Conditions} of the request.
      * 
      * @param newConditions the new value of the Conditions of the request
      */
-    public void setConditions(Conditions newConditions);
+    void setConditions(@Nullable final Conditions newConditions);
 
     /**
      * Gets the {@link RequestedAuthnContext} of the request.
      * 
      * @return the RequestedAuthnContext of the request
      */
-    public RequestedAuthnContext getRequestedAuthnContext();
+    @Nullable RequestedAuthnContext getRequestedAuthnContext();
 
     /**
      * Sets the {@link RequestedAuthnContext} of the request.
      * 
      * @param newRequestedAuthnContext the new value of the RequestedAuthnContext of the request
      */
-    public void setRequestedAuthnContext(RequestedAuthnContext newRequestedAuthnContext);
+    void setRequestedAuthnContext(@Nullable final RequestedAuthnContext newRequestedAuthnContext);
 
     /**
      * Gets the {@link Scoping} of the request.
      * 
      * @return the Scoping of the request
      */
-    public Scoping getScoping();
+    @Nullable Scoping getScoping();
 
     /**
      * Sets the {@link Scoping} of the request.
      * 
      * @param newScoping the new value of the Scoping of the request
      */
-    public void setScoping(Scoping newScoping);
+    void setScoping(@Nullable final Scoping newScoping);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnStatement.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnStatement.java
index bcf2c5406..bc11c4de9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnStatement.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthnStatement.java
@@ -20,42 +20,45 @@ package org.opensaml.saml.saml2.core;
 import java.time.Instant;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /**
  * SAML 2.0 Core AuthnStatement.
  */
 public interface AuthnStatement extends Statement {
 
     /** Element local name. */
-    @Nonnull static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnStatement";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnStatement";
 
     /** Default element name. */
     @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull static final String TYPE_LOCAL_NAME = "AuthnStatementType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthnStatementType";
 
     /** QName of the XSI type. */
     @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** AuthnInstant attribute name. */
-    @Nonnull static final String AUTHN_INSTANT_ATTRIB_NAME = "AuthnInstant";
+    @Nonnull @NotEmpty static final String AUTHN_INSTANT_ATTRIB_NAME = "AuthnInstant";
 
     /** AuthnInstant attribute QName. */
     @Nonnull static final QName AUTHN_INSTANT_ATTRIB_QNAME =
             new QName(null, "AuthnInstant", XMLConstants.DEFAULT_NS_PREFIX);
     
     /** SessionIndex attribute name. */
-    @Nonnull static final String SESSION_INDEX_ATTRIB_NAME = "SessionIndex";
+    @Nonnull @NotEmpty static final String SESSION_INDEX_ATTRIB_NAME = "SessionIndex";
 
     /** SessionNoOnOrAfter attribute name. */
-    @Nonnull static final String SESSION_NOT_ON_OR_AFTER_ATTRIB_NAME = "SessionNotOnOrAfter";
+    @Nonnull @NotEmpty static final String SESSION_NOT_ON_OR_AFTER_ATTRIB_NAME = "SessionNotOnOrAfter";
 
     /** SessionNotOnOrAfter attribute QName. */
     @Nonnull static final QName SESSION_NOT_ON_OR_AFTER_ATTRIB_QNAME =
@@ -66,68 +69,68 @@ public interface AuthnStatement extends Statement {
      * 
      * @return the time when the authentication took place
      */
-    Instant getAuthnInstant();
+    @Nullable Instant getAuthnInstant();
 
     /**
      * Sets the time when the authentication took place.
      * 
      * @param newAuthnInstant the time when the authentication took place
      */
-    void setAuthnInstant(Instant newAuthnInstant);
+    void setAuthnInstant(@Nullable final Instant newAuthnInstant);
 
     /**
      * Get the session index between the principal and the authenticating authority.
      * 
      * @return the session index between the principal and the authenticating authority
      */
-    String getSessionIndex();
+    @Nullable String getSessionIndex();
 
     /**
      * Sets the session index between the principal and the authenticating authority.
      * 
      * @param newIndex the session index between the principal and the authenticating authority
      */
-    void setSessionIndex(String newIndex);
+    void setSessionIndex(@Nullable final String newIndex);
 
     /**
      * Get the time when the session between the principal and the SAML authority ends.
      * 
      * @return the time when the session between the principal and the SAML authority ends
      */
-    Instant getSessionNotOnOrAfter();
+    @Nullable Instant getSessionNotOnOrAfter();
 
     /**
      * Set the time when the session between the principal and the SAML authority ends.
      * 
      * @param newSessionNotOnOrAfter the time when the session between the principal and the SAML authority ends
      */
-    void setSessionNotOnOrAfter(Instant newSessionNotOnOrAfter);
+    void setSessionNotOnOrAfter(@Nullable final Instant newSessionNotOnOrAfter);
 
     /**
      * Get the DNS domain and IP address of the system where the principal was authenticated.
      * 
      * @return the DNS domain and IP address of the system where the principal was authenticated
      */
-    SubjectLocality getSubjectLocality();
+    @Nullable SubjectLocality getSubjectLocality();
 
     /**
      * Set the DNS domain and IP address of the system where the principal was authenticated.
      * 
      * @param newLocality the DNS domain and IP address of the system where the principal was authenticated
      */
-    void setSubjectLocality(SubjectLocality newLocality);
+    void setSubjectLocality(@Nullable final SubjectLocality newLocality);
 
     /**
      * Gets the context used to authenticate the subject.
      * 
      * @return the context used to authenticate the subject
      */
-    AuthnContext getAuthnContext();
+    @Nullable AuthnContext getAuthnContext();
 
     /**
      * Sets the context used to authenticate the subject.
      * 
      * @param newAuthnContext the context used to authenticate the subject
      */
-    void setAuthnContext(AuthnContext newAuthnContext);
+    void setAuthnContext(@Nullable final AuthnContext newAuthnContext);
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionQuery.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionQuery.java
index 6afc723c9..1555d49b2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionQuery.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionQuery.java
@@ -24,10 +24,12 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -36,55 +38,55 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthzDecisionQuery extends SubjectQuery {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthzDecisionQuery";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthzDecisionQuery";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AuthzDecisionQueryType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthzDecisionQueryType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Resource attribute name. */
-    @Nonnull @NotEmpty public static final String RESOURCE_ATTRIB_NAME = "Resource";
+    @Nonnull @NotEmpty static final String RESOURCE_ATTRIB_NAME = "Resource";
 
     /**
      * Gets the Resource attrib value of this query.
      * 
      * @return the Resource attrib value of this query
      */
-    public String getResource();
+    @Nullable String getResource();
 
     /**
      * Sets the Resource attrib value of this query.
      * 
      * @param newResource the new Resource attrib value of this query
      */
-    public void setResource(String newResource);
+    void setResource(@Nullable final String newResource);
 
     /**
      * Gets the Actions of this query.
      * 
      * @return the Actions of this query
      */
-    public List<Action> getActions();
+    @Nonnull @Live List<Action> getActions();
 
     /**
      * Gets the Evidence of this query.
      * 
      * @return the Evidence of this query
      */
-    public Evidence getEvidence();
+    @Nullable Evidence getEvidence();
 
     /**
      * Sets the Evidence of this query.
      * 
      * @param newEvidence the new Evidence of this query
      */
-    public void setEvidence(Evidence newEvidence);
+    void setEvidence(@Nullable final Evidence newEvidence);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionStatement.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionStatement.java
index d0e8f1340..f14ffe212 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionStatement.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/AuthzDecisionStatement.java
@@ -20,10 +20,12 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -32,71 +34,72 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthzDecisionStatement extends Statement {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthzDecisionStatement";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthzDecisionStatement";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AuthzDecisionStatementType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthzDecisionStatementType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Resource attribute name. */
-    @Nonnull @NotEmpty public static final String RESOURCE_ATTRIB_NAME = "Resource";
+    @Nonnull @NotEmpty static final String RESOURCE_ATTRIB_NAME = "Resource";
 
     /** Decision attribute name. */
-    @Nonnull @NotEmpty public static final String DECISION_ATTRIB_NAME = "Decision";
+    @Nonnull @NotEmpty static final String DECISION_ATTRIB_NAME = "Decision";
 
     /**
      * Get URI of the resource to which authorization is saught.
      * 
      * @return URI of the resource to which authorization is saught
      */
-    public String getResource();
+    @Nullable String getResource();
 
     /**
      * Sets URI of the resource to which authorization is saught.
      * 
      * @param newResourceURI URI of the resource to which authorization is saught
      */
-    public void setResource(String newResourceURI);
+    void setResource(@Nullable final String newResourceURI);
 
     /**
      * Gets the decision of the authorization request.
      * 
      * @return the decision of the authorization request
      */
-    public DecisionTypeEnumeration getDecision();
+    @Nullable DecisionTypeEnumeration getDecision();
 
     /**
      * Sets the decision of the authorization request.
      * 
      * @param newDecision the decision of the authorization request
      */
-    public void setDecision(DecisionTypeEnumeration newDecision);
+    void setDecision(@Nullable final DecisionTypeEnumeration newDecision);
 
     /**
      * Gets the actions authorized to be performed.
      * 
      * @return the actions authorized to be performed
      */
-    public List<Action> getActions();
+    @Nonnull @Live List<Action> getActions();
 
     /**
      * Get the SAML assertion the authority relied on when making the authorization decision.
      * 
      * @return the SAML assertion the authority relied on when making the authorization decision
      */
-    public Evidence getEvidence();
+    @Nullable Evidence getEvidence();
 
     /**
      * Sets the SAML assertion the authority relied on when making the authorization decision.
      * 
      * @param newEvidence the SAML assertion the authority relied on when making the authorization decision
      */
-    public void setEvidence(Evidence newEvidence);
-}
+    void setEvidence(@Nullable final Evidence newEvidence);
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/BaseID.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/BaseID.java
index 5c16a48e1..e64cb7bc1 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/BaseID.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/BaseID.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -31,50 +32,51 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface BaseID extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "BaseID";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "BaseID";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "BaseIDAbstractType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "BaseIDAbstractType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** NameQualifier attribute name. */
-    @Nonnull @NotEmpty public static final String NAME_QUALIFIER_ATTRIB_NAME = "NameQualifier";
+    @Nonnull @NotEmpty static final String NAME_QUALIFIER_ATTRIB_NAME = "NameQualifier";
 
     /** SPNameQualifier attribute name. */
-    @Nonnull @NotEmpty public static final String SP_NAME_QUALIFIER_ATTRIB_NAME = "SPNameQualifier";
+    @Nonnull @NotEmpty static final String SP_NAME_QUALIFIER_ATTRIB_NAME = "SPNameQualifier";
 
     /**
      * Gets the NameQualifier value.
      * 
      * @return the NameQualifier value
      */
-    public String getNameQualifier();
+    @Nullable String getNameQualifier();
 
     /**
      * Sets the NameQualifier value.
      * 
      * @param newNameQualifier the NameQualifier value
      */
-    public void setNameQualifier(String newNameQualifier);
+    void setNameQualifier(@Nullable final String newNameQualifier);
 
     /**
      * Gets the SPNameQualifier value.
      * 
      * @return the SPNameQualifier value
      */
-    public String getSPNameQualifier();
+    @Nullable String getSPNameQualifier();
 
     /**
      * Sets the SPNameQualifier value.
      * 
      * @param newSPNameQualifier the SPNameQualifier value
      */
-    public void setSPNameQualifier(String newSPNameQualifier);
-}
+    void setSPNameQualifier(@Nullable final String newSPNameQualifier);
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Condition.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Condition.java
index a04b39ece..0a3130ccf 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Condition.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Condition.java
@@ -31,16 +31,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Condition extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Condition";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Condition";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ConditionAbstractType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ConditionAbstractType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Conditions.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Conditions.java
index 8bb839818..5b399dfbf 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Conditions.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Conditions.java
@@ -21,39 +21,43 @@ import java.time.Instant;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /**
  * SAML 2.0 Core Conditions.
  */
 public interface Conditions extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull static final String DEFAULT_ELEMENT_LOCAL_NAME = "Conditions";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Conditions";
 
     /** Default element name. */
     @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull static final String TYPE_LOCAL_NAME = "ConditionsType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ConditionsType";
 
     /** QName of the XSI type. */
     @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** NotBefore attribute name. */
-    @Nonnull static final String NOT_BEFORE_ATTRIB_NAME = "NotBefore";
+    @Nonnull @NotEmpty static final String NOT_BEFORE_ATTRIB_NAME = "NotBefore";
 
     /** QName for the NotBefore attribute. */
     @Nonnull static final QName NOT_BEFORE_ATTRIB_QNAME = new QName(null, "NotBefore", XMLConstants.DEFAULT_NS_PREFIX);
 
     /** Name for the NotOnOrAfter attribute. */
-    @Nonnull static final String NOT_ON_OR_AFTER_ATTRIB_NAME = "NotOnOrAfter";
+    @Nonnull @NotEmpty static final String NOT_ON_OR_AFTER_ATTRIB_NAME = "NotOnOrAfter";
 
     /** QName for the NotOnOrAfter attribute. */
     @Nonnull static final QName NOT_ON_OR_AFTER_ATTRIB_QNAME =
@@ -64,35 +68,35 @@ public interface Conditions extends SAMLObject {
      * 
      * @return the date/time before which the assertion is invalid
      */
-    Instant getNotBefore();
+    @Nullable Instant getNotBefore();
 
     /**
      * Sets the date/time before which the assertion is invalid.
      * 
      * @param newNotBefore the date/time before which the assertion is invalid
      */
-    void setNotBefore(Instant newNotBefore);
+    void setNotBefore(@Nullable final Instant newNotBefore);
 
     /**
      * Gets the date/time on, or after, which the assertion is invalid.
      * 
      * @return the date/time on, or after, which the assertion is invalid
      */
-    Instant getNotOnOrAfter();
+    @Nullable Instant getNotOnOrAfter();
 
     /**
      * Sets the date/time on, or after, which the assertion is invalid.
      * 
      * @param newNotOnOrAfter the date/time on, or after, which the assertion is invalid
      */
-    void setNotOnOrAfter(Instant newNotOnOrAfter);
+    void setNotOnOrAfter(@Nullable final Instant newNotOnOrAfter);
 
     /**
      * Gets all the conditions on the assertion.
      * 
      * @return all the conditions on the assertion
      */
-    List<Condition> getConditions();
+    @Nonnull @Live List<Condition> getConditions();
 
     /**
      * Gets the list of conditions that match a particular QName.
@@ -101,26 +105,26 @@ public interface Conditions extends SAMLObject {
      * 
      * @return the list of conditions that match the specified QName
      */
-    List<Condition> getConditions(@Nonnull final QName typeOrName);
+    @Nonnull @Live List<Condition> getConditions(@Nonnull final QName typeOrName);
 
     /**
      * Gets the audience restriction conditions for the assertion.
      * 
      * @return the audience restriction conditions for the assertion
      */
-    List<AudienceRestriction> getAudienceRestrictions();
+    @Nonnull @Live List<AudienceRestriction> getAudienceRestrictions();
 
     /**
      * Gets the OneTimeUse condition for the assertion.
      * 
      * @return the OneTimeUse condition for the assertion
      */
-    OneTimeUse getOneTimeUse();
+    @Nullable OneTimeUse getOneTimeUse();
 
     /**
      * Gets the ProxyRestriction condition for the assertion.
      * 
      * @return the ProxyRestriction condition for the assertion
      */
-    ProxyRestriction getProxyRestriction();
+    @Nullable ProxyRestriction getProxyRestriction();
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAssertion.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAssertion.java
index db04937d7..d783bf6fa 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAssertion.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAssertion.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface EncryptedAssertion extends EncryptedElementType, Evidentiary {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptedAssertion";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptedAssertion";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAttribute.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAttribute.java
index 47f262c4e..35b439ed5 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAttribute.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedAttribute.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface EncryptedAttribute extends EncryptedElementType {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptedAttribute";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptedAttribute";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =  
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =  
         new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedElementType.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedElementType.java
index a03d9a451..9ec2aebe3 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedElementType.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedElementType.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -27,6 +28,7 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.EncryptedKey;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -35,10 +37,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface EncryptedElementType extends SAMLObject {
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "EncryptedElementType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "EncryptedElementType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
     
     /**
@@ -46,20 +48,20 @@ public interface EncryptedElementType extends SAMLObject {
      * 
      * @return the EncryptedData child element
      */
-    public EncryptedData getEncryptedData();
+    @Nullable EncryptedData getEncryptedData();
     
     /**
      * Set the EncryptedData child element.
      * 
      * @param newEncryptedData the new EncryptedData child element
      */
-    public void setEncryptedData(EncryptedData newEncryptedData);
+    void setEncryptedData(@Nullable final EncryptedData newEncryptedData);
     
     /**
      * A list of EncryptedKey child elements.
      * 
      * @return a list of EncryptedKey child elements
      */
-    public List<EncryptedKey> getEncryptedKeys();
+    @Nonnull @Live List<EncryptedKey> getEncryptedKeys();
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedID.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedID.java
index 22ec3fd68..08686ddd9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedID.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/EncryptedID.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface EncryptedID extends EncryptedElementType {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptedID";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptedID";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =  
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =  
         new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Evidence.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Evidence.java
index 9ef2acb52..56c0bc2f2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Evidence.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Evidence.java
@@ -25,6 +25,7 @@ import javax.xml.namespace.QName;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -33,17 +34,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Evidence extends SAMLObject {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Evidence";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Evidence";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "EvidenceType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "EvidenceType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
 
     /**
@@ -51,33 +52,33 @@ public interface Evidence extends SAMLObject {
      * 
      * @return the list of AssertionID references used as evidence
      */
-    public List<AssertionIDRef> getAssertionIDReferences();
+    @Nonnull @Live List<AssertionIDRef> getAssertionIDReferences();
 
     /**
      * Gets the list of AssertionURI references used as evidence.
      * 
      * @return the list of AssertionURI references used as evidence
      */
-    public List<AssertionURIRef> getAssertionURIReferences();
+    @Nonnull @Live List<AssertionURIRef> getAssertionURIReferences();
 
     /**
      * Gets the list of Assertions used as evidence.
      * 
      * @return the list of Assertions used as evidence
      */
-    public List<Assertion> getAssertions();
+    @Nonnull @Live List<Assertion> getAssertions();
 
     /**
      * Gets the list of EncryptedAssertions used as evidence.
      * 
      * @return the list of EncryptedAssertions used as evidence
      */
-    public List<EncryptedAssertion> getEncryptedAssertions();
+    @Nonnull @Live List<EncryptedAssertion> getEncryptedAssertions();
 
     /**
      * Gets the list of all elements used as evidence.
      * 
      * @return the list of Evidentiary objects used as evidence
      */
-    public List<Evidentiary> getEvidence();
+    @Nonnull @Live List<Evidentiary> getEvidence();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Extensions.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Extensions.java
index f702170b6..689a17866 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Extensions.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Extensions.java
@@ -32,17 +32,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Extensions extends SAMLObject, ElementExtensibleXMLObject {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Extensions";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Extensions";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ExtensionsType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ExtensionsType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
     
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPEntry.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPEntry.java
index ebf9e662d..a0b3ee430 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPEntry.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPEntry.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -31,68 +32,68 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface IDPEntry extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "IDPEntry";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "IDPEntry";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "IDPEntryType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "IDPEntryType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** ProviderID attribute name. */
-    @Nonnull @NotEmpty public static final String PROVIDER_ID_ATTRIB_NAME = "ProviderID";
+    @Nonnull @NotEmpty static final String PROVIDER_ID_ATTRIB_NAME = "ProviderID";
 
     /** Name attribute name. */
-    @Nonnull @NotEmpty public static final String NAME_ATTRIB_NAME = "Name";
+    @Nonnull @NotEmpty static final String NAME_ATTRIB_NAME = "Name";
 
     /** Loc attribute name. */
-    @Nonnull @NotEmpty public static final String LOC_ATTRIB_NAME = "Loc";
+    @Nonnull @NotEmpty static final String LOC_ATTRIB_NAME = "Loc";
 
     /**
      * Gets ProviderID URI.
      * 
      * @return the ProviderID URI
      */
-    public String getProviderID();
+    @Nullable String getProviderID();
 
     /**
      * Sets the ProviderID URI.
      * 
      * @param newProviderID the new ProviderID URI
      */
-    public void setProviderID(String newProviderID);
+    void setProviderID(@Nullable final String newProviderID);
 
     /**
      * Gets the Name value.
      * 
      * @return the Name value
      */
-    public String getName();
+    @Nullable String getName();
 
     /**
      * Sets the Name value.
      * 
      * @param newName the Name value
      */
-    public void setName(String newName);
+    void setName(@Nullable final String newName);
 
     /**
      * Gets the Loc value.
      * 
      * @return the Loc value
      */
-    public String getLoc();
+    @Nullable String getLoc();
 
     /**
      * Sets the Loc value.
      * 
      * @param newLoc the new Loc value
      */
-    public void setLoc(String newLoc);
+    void setLoc(@Nullable final String newLoc);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPList.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPList.java
index 7a00e71d5..ccd38fdc7 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPList.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/IDPList.java
@@ -24,11 +24,13 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -37,17 +39,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface IDPList extends SAMLObject {
 
     /** Element Local Name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "IDPList";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "IDPList";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "IDPListType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "IDPListType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -55,19 +57,19 @@ public interface IDPList extends SAMLObject {
      * 
      * @return the IDPEntry list
      */
-    public List<IDPEntry> getIDPEntrys();
+    @Nonnull @Live List<IDPEntry> getIDPEntrys();
 
     /**
      * Gets the GetComplete URI.
      * 
      * @return GetComplete URI
      */
-    public GetComplete getGetComplete();
+    @Nullable GetComplete getGetComplete();
 
     /**
      * Sets the GetComplete URI.
      * 
      * @param newGetComplete the new GetComplete URI
      */
-    public void setGetComplete(GetComplete newGetComplete);
+    void setGetComplete(@Nullable final GetComplete newGetComplete);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Issuer.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Issuer.java
index 5e76e1c06..93d68e87f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Issuer.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Issuer.java
@@ -31,16 +31,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Issuer extends NameIDType, SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Issuer";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Issuer";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "IssuerType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "IssuerType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/KeyInfoConfirmationDataType.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/KeyInfoConfirmationDataType.java
index 3d565fab7..1307f7694 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/KeyInfoConfirmationDataType.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/KeyInfoConfirmationDataType.java
@@ -25,6 +25,7 @@ import javax.xml.namespace.QName;
 import org.opensaml.core.xml.XMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -33,10 +34,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface KeyInfoConfirmationDataType extends SubjectConfirmationData {
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "KeyInfoConfirmationDataType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "KeyInfoConfirmationDataType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
     
     /**
@@ -44,6 +45,6 @@ public interface KeyInfoConfirmationDataType extends SubjectConfirmationData {
      * 
      * @return list of child KeyInfo elements
      */
-    public List<XMLObject> getKeyInfos();
+    @Nonnull @Live List<XMLObject> getKeyInfos();
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutRequest.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutRequest.java
index 61f3d07d7..cf95c637a 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutRequest.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutRequest.java
@@ -24,121 +24,125 @@ import java.time.Instant;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /**
  * SAML 2.0 Core LogoutRequest.
  */
 public interface LogoutRequest extends RequestAbstractType {
     
     /** Element local name. */
-    @Nonnull static final String DEFAULT_ELEMENT_LOCAL_NAME = "LogoutRequest";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "LogoutRequest";
     
     /** Default element name. */
     @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull static final String TYPE_LOCAL_NAME = "LogoutRequestType"; 
+    @Nonnull @NotEmpty  static final String TYPE_LOCAL_NAME = "LogoutRequestType"; 
         
     /** QName of the XSI type. */
     @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** Reason attribute name. */
-    @Nonnull static final String REASON_ATTRIB_NAME = "Reason";
+    @Nonnull @NotEmpty static final String REASON_ATTRIB_NAME = "Reason";
     
     /** NotOnOrAfter attribute name. */
-    @Nonnull static final String NOT_ON_OR_AFTER_ATTRIB_NAME = "NotOnOrAfter";
+    @Nonnull @NotEmpty static final String NOT_ON_OR_AFTER_ATTRIB_NAME = "NotOnOrAfter";
 
     /** QName for the NotOnOrAfter attribute. */
     @Nonnull static final QName NOT_ON_OR_AFTER_ATTRIB_QNAME =
             new QName(null, "NotOnOrAfter", XMLConstants.DEFAULT_NS_PREFIX);
     
     /** User-initiated logout reason. */
-    @Nonnull static final String USER_REASON = "urn:oasis:names:tc:SAML:2.0:logout:user";
+    @Nonnull @NotEmpty static final String USER_REASON = "urn:oasis:names:tc:SAML:2.0:logout:user";
 
     /** Admin-initiated logout reason. */
-    @Nonnull static final String ADMIN_REASON = "urn:oasis:names:tc:SAML:2.0:logout:admin";
+    @Nonnull @NotEmpty static final String ADMIN_REASON = "urn:oasis:names:tc:SAML:2.0:logout:admin";
     
     /** Global timeout logout reason. */
-    @Nonnull static final String GLOBAL_TIMEOUT_REASON = "urn:oasis:names:tc:SAML:2.0:logout:global-timeout";
+    @Nonnull @NotEmpty static final String GLOBAL_TIMEOUT_REASON = "urn:oasis:names:tc:SAML:2.0:logout:global-timeout";
     
     /** SP timeout logout reason. */
-    @Nonnull static final String SP_TIMEOUT_REASON = "urn:oasis:names:tc:SAML:2.0:logout:sp-timeout";
+    @Nonnull @NotEmpty static final String SP_TIMEOUT_REASON = "urn:oasis:names:tc:SAML:2.0:logout:sp-timeout";
     
     /**
      * Get the Reason attrib value of the request.
      * 
      * @return the Reason value of the request
      */
-    String getReason();
+    @Nullable String getReason();
 
     /**
      * Set the Reason attrib value of the request.
      * 
      * @param newReason the new Reason value of the request
      */
-    void setReason(String newReason);
+    void setReason(@Nullable final String newReason);
     
     /**
      * Get the NotOnOrAfter attrib value of the request.
      * 
      * @return the NotOnOrAfter value of the request
      */
-    Instant getNotOnOrAfter();
+    @Nullable Instant getNotOnOrAfter();
 
     /**
      * Set the NotOnOrAfter attrib value of the request.
      * 
      * @param newNotOnOrAfter the new NotOnOrAfter value of the request
      */
-    void setNotOnOrAfter(Instant newNotOnOrAfter);
+    void setNotOnOrAfter(@Nullable final Instant newNotOnOrAfter);
     
     /**
      * Gets the base identifier of the principal for this request.
      * 
      * @return the base identifier of the principal for this request
      */
-    BaseID getBaseID();
+    @Nullable BaseID getBaseID();
     
     /**
      * Sets the base identifier of the principal for this request.
      * 
      * @param newBaseID the base identifier of the principal for this request
      */
-    void setBaseID(BaseID newBaseID);
+    void setBaseID(@Nullable final BaseID newBaseID);
     
     /**
      * Gets the name identifier of the principal for this request.
      * 
      * @return the name identifier of the principal for this request
      */
-    NameID getNameID();
+    @Nullable NameID getNameID();
     
     /**
      * Sets the name identifier of the principal for this request.
      * 
      * @param newNameID the name identifier of the principal for this request
      */
-    void setNameID(NameID newNameID);
+    void setNameID(@Nullable final NameID newNameID);
     
     /**
      * Gets the encrytped name identifier of the principal for this request.
      * 
      * @return the encrytped name identifier of the principal for this request
      */
-    EncryptedID getEncryptedID();
+    @Nullable EncryptedID getEncryptedID();
     
     /**
      * Sets the encrypted name identifier of the principal for this request.
      * 
      * @param newEncryptedID the new encrypted name identifier of the principal for this request
      */
-    void setEncryptedID(EncryptedID newEncryptedID);
+    void setEncryptedID(@Nullable final EncryptedID newEncryptedID);
        
     /**
      *  Get the list of SessionIndexes for the request.
@@ -146,7 +150,6 @@ public interface LogoutRequest extends RequestAbstractType {
      * 
      * @return the list of SessionIndexes
      */
-    List<SessionIndex> getSessionIndexes();
-
+    @Nonnull @Live List<SessionIndex> getSessionIndexes();
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutResponse.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutResponse.java
index 6fe419918..ff9902356 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutResponse.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/LogoutResponse.java
@@ -34,29 +34,29 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface LogoutResponse extends StatusResponseType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "LogoutResponse";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "LogoutResponse";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "LogoutResponseType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "LogoutResponseType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** URI for User logout reason. */
-    @Nonnull @NotEmpty public static final String USER_LOGOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:user";
+    @Nonnull @NotEmpty static final String USER_LOGOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:user";
 
     /** URI for Admin logout reason. */
-    @Nonnull @NotEmpty public static final String ADMIN_LOGOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:admin";
+    @Nonnull @NotEmpty static final String ADMIN_LOGOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:admin";
 
     /** URI for global timeout logout reason. */
-    @Nonnull @NotEmpty public static final String GLOBAL_TIMEOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:global-timeout";
+    @Nonnull @NotEmpty static final String GLOBAL_TIMEOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:global-timeout";
 
     /** URI for SP timeout logout reason. */
-    @Nonnull @NotEmpty public static final String SP_TIMEOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:sp-timeout";
+    @Nonnull @NotEmpty static final String SP_TIMEOUT_URI = "urn:oasis:names:tc:SAML:2.0:logout:sp-timeout";
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDRequest.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDRequest.java
index deea05804..bdd36f592 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDRequest.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDRequest.java
@@ -21,6 +21,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
@@ -34,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ManageNameIDRequest extends RequestAbstractType {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ManageNameIDRequest";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ManageNameIDRequest";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ManageNameIDRequestType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ManageNameIDRequestType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /**
@@ -52,69 +53,69 @@ public interface ManageNameIDRequest extends RequestAbstractType {
      * 
      * @return the NameID of the request
      */
-    public NameID getNameID();
+    @Nullable NameID getNameID();
 
     /**
      * Set the NameID of the request.
      * 
      * @param newNameID the new NameID of the request
      */
-    public void setNameID(NameID newNameID);
+    void setNameID(@Nullable final NameID newNameID);
 
     /**
      * Get the EncryptedID of the request.
      * 
      * @return the EncryptedID of the request
      */
-    public EncryptedID getEncryptedID();
+    @Nullable EncryptedID getEncryptedID();
 
     /**
      * Set the EncryptedID of the request.
      * 
      * @param newEncryptedID the new EncryptedID of the request
      */
-    public void setEncryptedID(EncryptedID newEncryptedID);
+    void setEncryptedID(@Nullable final EncryptedID newEncryptedID);
 
     /**
      * Get the NewID of the request.
      * 
      * @return the NewID of the request
      */
-    public NewID getNewID();
+    @Nullable NewID getNewID();
 
     /**
      * Set the NewID of the request.
      * 
      * @param newNewID the new NewID of the request
      */
-    public void setNewID(NewID newNewID);
+    void setNewID(@Nullable final NewID newNewID);
 
     /**
      * Get the NewEncryptedID of the request.
      * 
      * @return the NewEncryptedID of the request
      */
-    public NewEncryptedID getNewEncryptedID();
+    @Nullable NewEncryptedID getNewEncryptedID();
 
     /**
      * Set the NewEncryptedID of the request.
      * 
      * @param newNewEncryptedID the new NewEncryptedID of the request
      */
-    public void setNewEncryptedID(NewEncryptedID newNewEncryptedID);
+    void setNewEncryptedID(@Nullable final NewEncryptedID newNewEncryptedID);
 
     /**
      * Get the Terminate of the request.
      * 
      * @return the Terminate of the request
      */
-    public Terminate getTerminate();
+    @Nullable Terminate getTerminate();
 
     /**
      * Set the Terminate of the request.
      * 
      * @param newTerminate the new NewID Terminate of the request
      */
-    public void setTerminate(Terminate newTerminate);
+    void setTerminate(@Nullable final Terminate newTerminate);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDResponse.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDResponse.java
index a6896a6c0..facd91c83 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDResponse.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ManageNameIDResponse.java
@@ -34,16 +34,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ManageNameIDResponse extends StatusResponseType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ManageNameIDResponse";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ManageNameIDResponse";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ManageNameIDResponseType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ManageNameIDResponseType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameID.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameID.java
index e784306fb..6bc7807a2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameID.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameID.java
@@ -31,16 +31,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NameID extends SAMLObject, NameIDType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameID";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameID";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "NameIDType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "NameIDType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingRequest.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingRequest.java
index 1fb92f525..6a99e6506 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingRequest.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingRequest.java
@@ -21,6 +21,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
@@ -34,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NameIDMappingRequest extends RequestAbstractType {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDMappingRequest";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDMappingRequest";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "NameIDMappingRequestType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "NameIDMappingRequestType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /**
@@ -52,56 +53,56 @@ public interface NameIDMappingRequest extends RequestAbstractType {
      * 
      * @return the base identifier of the principal for this request
      */
-    public BaseID getBaseID();
+    @Nullable BaseID getBaseID();
     
     /**
      * Sets the base identifier of the principal for this request.
      * 
      * @param newBaseID the base identifier of the principal for this request
      */
-    public void setBaseID(BaseID newBaseID);
+    void setBaseID(@Nullable final BaseID newBaseID);
     
     /**
      * Gets the name identifier of the principal for this request.
      * 
      * @return the name identifier of the principal for this request
      */
-    public NameID getNameID();
+    @Nullable NameID getNameID();
     
     /**
      * Sets the name identifier of the principal for this request.
      * 
      * @param newNameID the name identifier of the principal for this request
      */
-    public void setNameID(NameID newNameID);
+    void setNameID(@Nullable final NameID newNameID);
     
     /**
      * Gets the encrypted name identifier of the principal for this request.
      * 
      * @return the encrypted name identifier of the principal for this request
      */
-    public EncryptedID getEncryptedID();
+    @Nullable EncryptedID getEncryptedID();
     
     /**
      * Sets the encrypted name identifier of the principal for this request.
      * 
      * @param newEncryptedID the new encrypted name identifier of the principal for this request
      */
-    public void setEncryptedID(EncryptedID newEncryptedID);
+    void setEncryptedID(@Nullable final EncryptedID newEncryptedID);
     
     /**
      * Get the NameIDPolicy of the request.
      * 
      * @return the NameIDPolicy of the request
      */
-    public NameIDPolicy getNameIDPolicy();
+    @Nullable NameIDPolicy getNameIDPolicy();
 
     /**
      * Set the NameIDPolicy of the request.
      * 
      * @param newNameIDPolicy the new NameIDPolicy of the request
      */
-    public void setNameIDPolicy(NameIDPolicy newNameIDPolicy);
+    void setNameIDPolicy(@Nullable final NameIDPolicy newNameIDPolicy);
 
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingResponse.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingResponse.java
index 26aecc052..d8a0099b2 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingResponse.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDMappingResponse.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
@@ -30,17 +31,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NameIDMappingResponse extends StatusResponseType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDMappingResponse";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDMappingResponse";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull public static String TYPE_LOCAL_NAME = "NameIDMappingResponseType";
+    @Nonnull static String TYPE_LOCAL_NAME = "NameIDMappingResponseType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -48,26 +49,26 @@ public interface NameIDMappingResponse extends StatusResponseType {
      * 
      * @return the name identifier of the principal for this response
      */
-    public NameID getNameID();
+    @Nullable NameID getNameID();
 
     /**
      * Sets the name identifier of the principal for this response.
      * 
      * @param newNameID the name identifier of the principal for this response
      */
-    public void setNameID(NameID newNameID);
+    void setNameID(@Nullable final NameID newNameID);
 
     /**
      * Gets the encrypted name identifier of the principal for this response.
      * 
      * @return the encrypted name identifier of the principal for this response
      */
-    public EncryptedID getEncryptedID();
+    @Nullable EncryptedID getEncryptedID();
 
     /**
      * Sets the encrypted name identifier of the principal for this response.
      * 
      * @param newEncryptedID the new encrypted name identifier of the principal for this response
      */
-    public void setEncryptedID(EncryptedID newEncryptedID);
+    void setEncryptedID(@Nullable final EncryptedID newEncryptedID);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDPolicy.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDPolicy.java
index 16e63b8be..6db506043 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDPolicy.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDPolicy.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
@@ -32,82 +33,82 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NameIDPolicy extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDPolicy";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDPolicy";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "NameIDPolicyType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "NameIDPolicyType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Format attribute name. */
-    @Nonnull @NotEmpty public static final String FORMAT_ATTRIB_NAME = "Format";
+    @Nonnull @NotEmpty static final String FORMAT_ATTRIB_NAME = "Format";
 
     /** SPNameQualifier attribute name. */
-    @Nonnull @NotEmpty public static final String SP_NAME_QUALIFIER_ATTRIB_NAME = "SPNameQualifier";
+    @Nonnull @NotEmpty static final String SP_NAME_QUALIFIER_ATTRIB_NAME = "SPNameQualifier";
 
     /** AllowCreate attribute name. */
-    @Nonnull @NotEmpty public static final String ALLOW_CREATE_ATTRIB_NAME = "AllowCreate";
+    @Nonnull @NotEmpty static final String ALLOW_CREATE_ATTRIB_NAME = "AllowCreate";
 
     /**
      * Gets the format of the NameIDPolicy.
      * 
      * @return the format of the NameIDPolicy
      */
-    public String getFormat();
+    @Nullable String getFormat();
 
     /**
      * Sets the format of the NameIDPolicy.
      * 
      * @param newFormat the format of the NameIDPolicy
      */
-    public void setFormat(String newFormat);
+    void setFormat(@Nullable final String newFormat);
 
     /**
      * Gets the SPNameQualifier value.
      * 
      * @return the SPNameQualifier value
      */
-    public String getSPNameQualifier();
+    @Nullable String getSPNameQualifier();
 
     /**
      * Sets the SPNameQualifier value.
      * 
      * @param newSPNameQualifier the SPNameQualifier value
      */
-    public void setSPNameQualifier(String newSPNameQualifier);
+    void setSPNameQualifier(@Nullable final String newSPNameQualifier);
 
     /**
      * Gets the AllowCreate value.
      * 
      * @return the AllowCreate value
      */
-    public Boolean getAllowCreate();
+    @Nullable Boolean getAllowCreate();
 
     /**
      * Gets the AllowCreate value.
      * 
      * @return the AllowCreate value
      */
-    public XSBooleanValue getAllowCreateXSBoolean();
+    @Nullable XSBooleanValue getAllowCreateXSBoolean();
 
     /**
      * Sets the AllowCreate value. Boolean values will be marshalled to either "true" or "false".
      * 
      * @param newAllowCreate the AllowCreate value
      */
-    public void setAllowCreate(Boolean newAllowCreate);
+    void setAllowCreate(@Nullable final Boolean newAllowCreate);
 
     /**
      * Sets the AllowCreate value.
      * 
      * @param newAllowCreate the AllowCreate value
      */
-    public void setAllowCreate(XSBooleanValue newAllowCreate);
+    void setAllowCreate(@Nullable final XSBooleanValue newAllowCreate);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDType.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDType.java
index 7916e4c71..50c52d528 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDType.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NameIDType.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.core.xml.schema.XSString;
 
@@ -29,99 +30,99 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NameIDType extends XSString {
 
     /** NameQualifier attribute name. */
-    @Nonnull @NotEmpty public static final String NAME_QUALIFIER_ATTRIB_NAME = "NameQualifier";
+    @Nonnull @NotEmpty static final String NAME_QUALIFIER_ATTRIB_NAME = "NameQualifier";
 
     /** SPNameQualifier attribute name. */
-    @Nonnull @NotEmpty public static final String SP_NAME_QUALIFIER_ATTRIB_NAME = "SPNameQualifier";
+    @Nonnull @NotEmpty static final String SP_NAME_QUALIFIER_ATTRIB_NAME = "SPNameQualifier";
 
     /** Format attribute name. */
-    @Nonnull @NotEmpty public static final String FORMAT_ATTRIB_NAME = "Format";
+    @Nonnull @NotEmpty static final String FORMAT_ATTRIB_NAME = "Format";
 
     /** SPProviderID attribute name. */
-    @Nonnull @NotEmpty public static final String SPPROVIDED_ID_ATTRIB_NAME = "SPProvidedID";
+    @Nonnull @NotEmpty static final String SPPROVIDED_ID_ATTRIB_NAME = "SPProvidedID";
 
     /** URI for unspecified name format. */
-    @Nonnull @NotEmpty public static final String UNSPECIFIED = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+    @Nonnull @NotEmpty static final String UNSPECIFIED = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
 
     /** URI for email name format. */
-    @Nonnull @NotEmpty public static final String EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+    @Nonnull @NotEmpty static final String EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
 
     /** URI for X509 subject name format. */
-    @Nonnull @NotEmpty public static final String X509_SUBJECT = "urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName";
+    @Nonnull @NotEmpty static final String X509_SUBJECT = "urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName";
 
     /** URI for windows domain qualified name name format. */
-    @Nonnull @NotEmpty public static final String WIN_DOMAIN_QUALIFIED =
+    @Nonnull @NotEmpty static final String WIN_DOMAIN_QUALIFIED =
             "urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName";
 
     /** URI for kerberos name format. */
-    @Nonnull @NotEmpty public static final String KERBEROS = "urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos";
+    @Nonnull @NotEmpty static final String KERBEROS = "urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos";
 
     /** URI for SAML entity name format. */
-    @Nonnull @NotEmpty public static final String ENTITY = "urn:oasis:names:tc:SAML:2.0:nameid-format:entity";
+    @Nonnull @NotEmpty static final String ENTITY = "urn:oasis:names:tc:SAML:2.0:nameid-format:entity";
 
     /** URI for persistent name format. */
-    @Nonnull @NotEmpty public static final String PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
+    @Nonnull @NotEmpty static final String PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
 
     /** URI for transient name format. */
-    @Nonnull @NotEmpty public static final String TRANSIENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+    @Nonnull @NotEmpty static final String TRANSIENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
 
     /** Special URI used by NameIDPolicy to indicate a NameID should be encrypted. */
-    @Nonnull @NotEmpty public static final String ENCRYPTED = "urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted";
+    @Nonnull @NotEmpty static final String ENCRYPTED = "urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted";
 
     /**
      * Gets the NameQualifier value.
      * 
      * @return the NameQualifier value
      */
-    public String getNameQualifier();
+    @Nullable String getNameQualifier();
 
     /**
      * Sets the NameQualifier value.
      * 
      * @param newNameQualifier the NameQualifier value
      */
-    public void setNameQualifier(String newNameQualifier);
+    void setNameQualifier(@Nullable final String newNameQualifier);
 
     /**
      * Gets the SPNameQualifier value.
      * 
      * @return the SPNameQualifier value
      */
-    public String getSPNameQualifier();
+    @Nullable String getSPNameQualifier();
 
     /**
      * Sets the SPNameQualifier value.
      * 
      * @param newSPNameQualifier the SPNameQualifier value
      */
-    public void setSPNameQualifier(String newSPNameQualifier);
+    void setSPNameQualifier(@Nullable final String newSPNameQualifier);
 
     /**
      * Gets the format of the NameID.
      * 
      * @return the format of the NameID
      */
-    public String getFormat();
+    @Nullable String getFormat();
 
     /**
      * Sets the format of the NameID.
      * 
      * @param newFormat the format of the NameID
      */
-    public void setFormat(String newFormat);
+    void setFormat(@Nullable final String newFormat);
 
     /**
      * Gets the SPProvidedID of this NameID.
      * 
      * @return the SPProvidedID of this NameID
      */
-    public String getSPProvidedID();
+    @Nullable String getSPProvidedID();
 
     /**
      * Sets the SPProvddedID of this NameID.
      * 
      * @param newSPProvidedID the SPProvidedID of this NameID
      */
-    public void setSPProvidedID(String newSPProvidedID);
+    void setSPProvidedID(@Nullable final String newSPProvidedID);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NewEncryptedID.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NewEncryptedID.java
index 7c35b8625..505e17e77 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NewEncryptedID.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/NewEncryptedID.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NewEncryptedID extends EncryptedElementType {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "NewEncryptedID";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "NewEncryptedID";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/OneTimeUse.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/OneTimeUse.java
index 708aca78b..2704b8069 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/OneTimeUse.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/OneTimeUse.java
@@ -31,16 +31,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface OneTimeUse extends Condition {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "OneTimeUse";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "OneTimeUse";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "OneTimeUseType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "OneTimeUseType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ProxyRestriction.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ProxyRestriction.java
index c47117189..5b02ffb66 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ProxyRestriction.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/ProxyRestriction.java
@@ -25,6 +25,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -33,40 +34,40 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ProxyRestriction extends Condition {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ProxyRestriction";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ProxyRestriction";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
             new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ProxyRestrictionType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ProxyRestrictionType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Count attribute name. */
-    @Nonnull @NotEmpty public static final String COUNT_ATTRIB_NAME = "Count";
+    @Nonnull @NotEmpty static final String COUNT_ATTRIB_NAME = "Count";
 
     /**
      * Gets the number of times the assertion may be proxied.
      * 
      * @return the number of times the assertion may be proxied
      */
-    @Nullable public Integer getProxyCount();
+    @Nullable Integer getProxyCount();
 
     /**
      * Sets the number of times the assertion may be proxied.
      * 
      * @param newProxyCount the number of times the assertion may be proxied
      */
-    public void setProxyCount(@Nullable Integer newProxyCount);
+    void setProxyCount(@Nullable final Integer newProxyCount);
 
     /**
      * Gets the list of audiences to whom the assertion may be proxied.
      * 
      * @return the list of audiences to whom the assertion may be proxied
      */
-    @Nullable public List<Audience> getAudiences();
+    @Nonnull @Live List<Audience> getAudiences();
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestAbstractType.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestAbstractType.java
index 774859265..2c9e02107 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestAbstractType.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestAbstractType.java
@@ -92,7 +92,7 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newVersion the SAML Version of this request
      */
-    void setVersion(@Nullable SAMLVersion newVersion);
+    void setVersion(@Nullable final SAMLVersion newVersion);
 
     /**
      * Gets the unique identifier of the request.
@@ -106,15 +106,13 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newID the unique identifier of the request
      */
-
-    void setID(@Nullable String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets the date/time the request was issued.
      * 
      * @return the date/time the request was issued
      */
-
     @Nullable Instant getIssueInstant();
 
     /**
@@ -122,7 +120,7 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newIssueInstant the date/time the request was issued
      */
-    void setIssueInstant(@Nullable Instant newIssueInstant);
+    void setIssueInstant(@Nullable final Instant newIssueInstant);
 
     /**
      * Gets the URI of the destination of the request.
@@ -136,7 +134,7 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newDestination the URI of the destination of the request
      */
-    void setDestination(@Nullable String newDestination);
+    void setDestination(@Nullable final String newDestination);
 
     /**
      * Gets the consent obtained from the principal for sending this request.
@@ -150,7 +148,7 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newConsent the new consent obtained from the principal for sending this request
      */
-    void setConsent(@Nullable String newConsent);
+    void setConsent(@Nullable final String newConsent);
 
     /**
      * Gets the issuer of this request.
@@ -164,7 +162,7 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newIssuer the issuer of this request
      */
-    void setIssuer(@Nullable Issuer newIssuer);
+    void setIssuer(@Nullable final Issuer newIssuer);
 
     /**
      * Gets the Extensions of this request.
@@ -178,6 +176,6 @@ public interface RequestAbstractType extends SignableSAMLObject {
      * 
      * @param newExtensions the Extensions of this request
      */
-    void setExtensions(@Nullable Extensions newExtensions);
+    void setExtensions(@Nullable final Extensions newExtensions);
 
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestedAuthnContext.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestedAuthnContext.java
index bd71e825e..964f6f139 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestedAuthnContext.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/RequestedAuthnContext.java
@@ -24,11 +24,13 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -37,48 +39,48 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface RequestedAuthnContext extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "RequestedAuthnContext";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "RequestedAuthnContext";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "RequestedAuthnContextType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "RequestedAuthnContextType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** SessionIndex attribute name. */
-    @Nonnull @NotEmpty public static final String COMPARISON_ATTRIB_NAME = "Comparison";
+    @Nonnull @NotEmpty static final String COMPARISON_ATTRIB_NAME = "Comparison";
 
     /**
      * Gets the Comparison attribute value of the requested authn context.
      * 
      * @return the Comparison attribute value of the requested authn context
      */
-    public AuthnContextComparisonTypeEnumeration getComparison();
+    @Nullable AuthnContextComparisonTypeEnumeration getComparison();
 
     /**
      * Sets the Comparison attribute value of the requested authn context.
      * 
      * @param newComparison the SessionIndex of this request
      */
-    public void setComparison(AuthnContextComparisonTypeEnumeration newComparison);
+    void setComparison(@Nullable final AuthnContextComparisonTypeEnumeration newComparison);
 
     /**
      * Gets the AuthnContextClassRefs of this request.
      * 
      * @return the AuthnContextClassRefs of this request
      */
-    public List<AuthnContextClassRef> getAuthnContextClassRefs();
+    @Nonnull @Live List<AuthnContextClassRef> getAuthnContextClassRefs();
 
     /**
      * Gets the AuthnContextDeclRefs of this request.
      * 
      * @return the AuthnContextDeclRef of this request
      */
-    public List<AuthnContextDeclRef> getAuthnContextDeclRefs();
+    @Nonnull @Live List<AuthnContextDeclRef> getAuthnContextDeclRefs();
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Response.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Response.java
index bf328167a..50ffc2d37 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Response.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Response.java
@@ -27,6 +27,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -35,17 +36,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Response extends StatusResponseType {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Response";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Response";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ResponseType"; 
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ResponseType"; 
         
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = 
+    @Nonnull static final QName TYPE_NAME = 
         new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20P_PREFIX);
     
     /**
@@ -53,12 +54,12 @@ public interface Response extends StatusResponseType {
      * 
      * @return  the list of Assertion child elements
      */
-    public List<Assertion> getAssertions();
+    @Nonnull @Live List<Assertion> getAssertions();
 
     /**
      * Return the list of EncryptedAssertion child elements.
      * 
      * @return  the list of EncryptedAssertion child elements
      */
-    public List<EncryptedAssertion> getEncryptedAssertions();
+    @Nonnull @Live List<EncryptedAssertion> getEncryptedAssertions();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Scoping.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Scoping.java
index f7211e362..c0244b2d9 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Scoping.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Scoping.java
@@ -24,11 +24,13 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -37,54 +39,55 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Scoping extends SAMLObject {
 
     /** Element Local Name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Scoping";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Scoping";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ScopingType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ScopingType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** ProxyCount attribute name. */
-    @Nonnull @NotEmpty public static final String PROXY_COUNT_ATTRIB_NAME = "ProxyCount";
+    @Nonnull @NotEmpty static final String PROXY_COUNT_ATTRIB_NAME = "ProxyCount";
 
     /**
      * Gets the ProxyCount attrib value.
      * 
      * @return the ProxyCount attrib value
      */
-    public Integer getProxyCount();
+    @Nullable Integer getProxyCount();
 
     /**
      * Sets the ProxyCount attrib value.
      * 
      * @param newProxyCount the new ProxyCount attrib value
      */
-    public void setProxyCount(Integer newProxyCount);
+    void setProxyCount(@Nullable final Integer newProxyCount);
 
     /**
      * Gets the IDPList.
      * 
      * @return IDPList
      */
-    public IDPList getIDPList();
+    @Nullable IDPList getIDPList();
 
     /**
      * Sets the IDPList.
      * 
      * @param newIDPList the new IDPList
      */
-    public void setIDPList(IDPList newIDPList);
+    void setIDPList(@Nullable final IDPList newIDPList);
 
     /**
      * Gets the list of RequesterID's.
      * 
      * @return list of RequesterID's
      */
-    public List<RequesterID> getRequesterIDs();
-}
+    @Nonnull @Live List<RequesterID> getRequesterIDs();
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Statement.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Statement.java
index 2b6c942e5..e7771345a 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Statement.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Statement.java
@@ -31,16 +31,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Statement extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Statement";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Statement";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "StatementAbstractType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "StatementAbstractType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Status.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Status.java
index a4959778a..f4c497bec 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Status.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Status.java
@@ -22,6 +22,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -35,17 +36,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Status extends SAMLObject {
 
     /** Local Name of Status. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Status";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Status";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "StatusType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "StatusType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -53,40 +54,41 @@ public interface Status extends SAMLObject {
      * 
      * @return Status StatusCode
      */
-    public StatusCode getStatusCode();
+    @Nullable StatusCode getStatusCode();
 
     /**
      * Sets the Code of this Status.
      * 
      * @param newStatusCode the Code of this Status
      */
-    public void setStatusCode(StatusCode newStatusCode);
+    void setStatusCode(@Nullable final StatusCode newStatusCode);
 
     /**
      * Gets the Message of this Status.
      * 
      * @return Status StatusMessage
      */
-    public StatusMessage getStatusMessage();
+    @Nullable StatusMessage getStatusMessage();
 
     /**
      * Sets the Message of this Status.
      * 
      * @param newStatusMessage the Message of this Status
      */
-    public void setStatusMessage(StatusMessage newStatusMessage);
+    void setStatusMessage(@Nullable final StatusMessage newStatusMessage);
 
     /**
      * Gets the Detail of this Status.
      * 
      * @return Status StatusDetail
      */
-    public StatusDetail getStatusDetail();
+    @Nullable StatusDetail getStatusDetail();
 
     /**
      * Sets the Detail of this Status.
      * 
      * @param newStatusDetail the Detail of this Status
      */
-    public void setStatusDetail(StatusDetail newStatusDetail);
-}
+    void setStatusDetail(@Nullable final StatusDetail newStatusDetail);
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusCode.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusCode.java
index aa583a3cd..9520e9518 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusCode.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusCode.java
@@ -22,6 +22,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -35,117 +36,127 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface StatusCode extends SAMLObject {
 
     /** Local Name of StatusCode. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "StatusCode";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "StatusCode";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "StatusCodeType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "StatusCodeType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local Name of the Value attribute. */
-    @Nonnull @NotEmpty public static final String VALUE_ATTRIB_NAME = "Value";
+    @Nonnull @NotEmpty static final String VALUE_ATTRIB_NAME = "Value";
 
     /** URI for Success status code. */
-    @Nonnull @NotEmpty public static final String SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success";
+    @Nonnull @NotEmpty static final String SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success";
 
     /** URI for Requester status code. */
-    @Nonnull @NotEmpty public static final String REQUESTER = "urn:oasis:names:tc:SAML:2.0:status:Requester";
+    @Nonnull @NotEmpty static final String REQUESTER = "urn:oasis:names:tc:SAML:2.0:status:Requester";
 
     /** URI for Responder status code. */
-    @Nonnull @NotEmpty public static final String RESPONDER = "urn:oasis:names:tc:SAML:2.0:status:Responder";
+    @Nonnull @NotEmpty static final String RESPONDER = "urn:oasis:names:tc:SAML:2.0:status:Responder";
 
     /** URI for VersionMismatch status code. */
-    @Nonnull @NotEmpty public static final String VERSION_MISMATCH = "urn:oasis:names:tc:SAML:2.0:status:VersionMismatch";
+    @Nonnull @NotEmpty static final String VERSION_MISMATCH = "urn:oasis:names:tc:SAML:2.0:status:VersionMismatch";
 
     /** URI for AuthnFailed status code. */
-    @Nonnull @NotEmpty public static final String AUTHN_FAILED = "urn:oasis:names:tc:SAML:2.0:status:AuthnFailed";
+    @Nonnull @NotEmpty static final String AUTHN_FAILED = "urn:oasis:names:tc:SAML:2.0:status:AuthnFailed";
 
     /** URI for InvalidAttrNameOrValue status code. */
-    @Nonnull @NotEmpty public static final String INVALID_ATTR_NAME_OR_VALUE = "urn:oasis:names:tc:SAML:2.0:status:InvalidAttrNameOrValue";
+    @Nonnull @NotEmpty
+    static final String INVALID_ATTR_NAME_OR_VALUE = "urn:oasis:names:tc:SAML:2.0:status:InvalidAttrNameOrValue";
 
     /** URI for InvalidNameIDPolicy status code. */
-    @Nonnull @NotEmpty public static final String INVALID_NAMEID_POLICY = "urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy";
+    @Nonnull @NotEmpty
+    static final String INVALID_NAMEID_POLICY = "urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy";
 
     /** URI for NoAuthnContext status code. */
-    @Nonnull @NotEmpty public static final String NO_AUTHN_CONTEXT = "urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext";
+    @Nonnull @NotEmpty static final String NO_AUTHN_CONTEXT = "urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext";
 
     /** URI for NoAvailableIDP status code. */
-    @Nonnull @NotEmpty public static final String NO_AVAILABLE_IDP = "urn:oasis:names:tc:SAML:2.0:status:NoAvailableIDP";
+    @Nonnull @NotEmpty static final String NO_AVAILABLE_IDP = "urn:oasis:names:tc:SAML:2.0:status:NoAvailableIDP";
 
     /** URI for NoPassive status code. */
-    @Nonnull @NotEmpty public static final String NO_PASSIVE = "urn:oasis:names:tc:SAML:2.0:status:NoPassive";
+    @Nonnull @NotEmpty static final String NO_PASSIVE = "urn:oasis:names:tc:SAML:2.0:status:NoPassive";
 
     /** URI for NoSupportedIDP status code. */
-    @Nonnull @NotEmpty public static final String NO_SUPPORTED_IDP = "urn:oasis:names:tc:SAML:2.0:status:NoSupportedIDP";
+    @Nonnull @NotEmpty static final String NO_SUPPORTED_IDP = "urn:oasis:names:tc:SAML:2.0:status:NoSupportedIDP";
 
     /** URI for PartialLogout status code. */
-    @Nonnull @NotEmpty public static final String PARTIAL_LOGOUT = "urn:oasis:names:tc:SAML:2.0:status:PartialLogout";
+    @Nonnull @NotEmpty static final String PARTIAL_LOGOUT = "urn:oasis:names:tc:SAML:2.0:status:PartialLogout";
 
     /** URI for ProxyCountExceeded status code. */
-    @Nonnull @NotEmpty public static final String PROXY_COUNT_EXCEEDED = "urn:oasis:names:tc:SAML:2.0:status:ProxyCountExceeded";
+    @Nonnull @NotEmpty
+    static final String PROXY_COUNT_EXCEEDED = "urn:oasis:names:tc:SAML:2.0:status:ProxyCountExceeded";
 
     /** URI for RequestDenied status code. */
-    @Nonnull @NotEmpty public static final String REQUEST_DENIED = "urn:oasis:names:tc:SAML:2.0:status:RequestDenied";
+    @Nonnull @NotEmpty static final String REQUEST_DENIED = "urn:oasis:names:tc:SAML:2.0:status:RequestDenied";
 
     /** URI for RequestUnsupported status code. */
-    @Nonnull @NotEmpty public static final String REQUEST_UNSUPPORTED = "urn:oasis:names:tc:SAML:2.0:status:RequestUnsupported";
+    @Nonnull @NotEmpty
+    static final String REQUEST_UNSUPPORTED = "urn:oasis:names:tc:SAML:2.0:status:RequestUnsupported";
 
     /** URI for RequestVersionDeprecated status code. */
-    @Nonnull @NotEmpty public static final String REQUEST_VERSION_DEPRECATED =
-            "urn:oasis:names:tc:SAML:2.0:status:RequestVersionDeprecated";
+    @Nonnull @NotEmpty
+    static final String REQUEST_VERSION_DEPRECATED = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionDeprecated";
 
     /** URI for RequestVersionTooHigh status code. */
-    @Nonnull @NotEmpty public static final String REQUEST_VERSION_TOO_HIGH = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooHigh";
+    @Nonnull @NotEmpty
+    static final String REQUEST_VERSION_TOO_HIGH = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooHigh";
     
     /** URI for RequestVersionTooLow status code. */
-    @Nonnull @NotEmpty public static final String REQUEST_VERSION_TOO_LOW = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooLow";
+    @Nonnull @NotEmpty
+    static final String REQUEST_VERSION_TOO_LOW = "urn:oasis:names:tc:SAML:2.0:status:RequestVersionTooLow";
 
     /** URI for ResourceNotRecognized status code. */
-    @Nonnull @NotEmpty public static final String RESOURCE_NOT_RECOGNIZED = "urn:oasis:names:tc:SAML:2.0:status:ResourceNotRecognized";
+    @Nonnull @NotEmpty
+    static final String RESOURCE_NOT_RECOGNIZED = "urn:oasis:names:tc:SAML:2.0:status:ResourceNotRecognized";
 
     /** URI for TooManyResponses status code. */
-    @Nonnull @NotEmpty public static final String TOO_MANY_RESPONSES = "urn:oasis:names:tc:SAML:2.0:status:TooManyResponses";
+    @Nonnull @NotEmpty static final String TOO_MANY_RESPONSES = "urn:oasis:names:tc:SAML:2.0:status:TooManyResponses";
 
     /** URI for UnknownAttrProfile status code. */
-    @Nonnull @NotEmpty public static final String UNKNOWN_ATTR_PROFILE = "urn:oasis:names:tc:SAML:2.0:status:UnknownAttrProfile";
+    @Nonnull @NotEmpty
+    static final String UNKNOWN_ATTR_PROFILE = "urn:oasis:names:tc:SAML:2.0:status:UnknownAttrProfile";
 
     /** URI for UnknownPrincipal status code. */
-    @Nonnull @NotEmpty public static final String UNKNOWN_PRINCIPAL = "urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal";
+    @Nonnull @NotEmpty static final String UNKNOWN_PRINCIPAL = "urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal";
 
     /** URI for UnsupportedBinding status code. */
-    @Nonnull @NotEmpty public static final String UNSUPPORTED_BINDING = "urn:oasis:names:tc:SAML:2.0:status:UnsupportedBinding";
+    @Nonnull @NotEmpty
+    static final String UNSUPPORTED_BINDING = "urn:oasis:names:tc:SAML:2.0:status:UnsupportedBinding";
 
     /**
      * Gets the Status Code of this Status Code.
      * 
      * @return StatusCode StatusCode
      */
-    public StatusCode getStatusCode();
+    @Nullable StatusCode getStatusCode();
 
     /**
      * Sets the Status Code of this Status Code.
      * 
      * @param newStatusCode the Status Code of this Status Code.
      */
-    public void setStatusCode(StatusCode newStatusCode);
+    void setStatusCode(@Nullable final StatusCode newStatusCode);
 
     /**
      * Gets the Value of this Status Code.
      * 
      * @return StatusCode Value
      */
-    public String getValue();
+    @Nullable String getValue();
 
     /**
      * Sets the Value of this Status Code.
      * 
      * @param newValue the Value of this Status Code
      */
-    public void setValue(String newValue);
-}
+    void setValue(@Nullable final String newValue);
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusDetail.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusDetail.java
index 4af7e7fef..a88da21a6 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusDetail.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusDetail.java
@@ -36,16 +36,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface StatusDetail extends SAMLObject, ElementExtensibleXMLObject {
 
     /** Local Name of StatusDetail. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "StatusDetail";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "StatusDetail";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "StatusDetailType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "StatusDetailType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusResponseType.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusResponseType.java
index 89fd0aab2..7f1b25758 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusResponseType.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/StatusResponseType.java
@@ -32,60 +32,62 @@ import org.opensaml.saml.common.SAMLVersion;
 import org.opensaml.saml.common.SignableSAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /**
  * SAML 2.0 Core StatusResponseType.
  */
 public interface StatusResponseType extends SignableSAMLObject {
 
     /** Local name of the XSI type. */
-    @Nonnull static final String TYPE_LOCAL_NAME = "StatusResponseType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "StatusResponseType";
 
     /** QName of the XSI type. */
     @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** ID attribute name. */
-    @Nonnull static final String ID_ATTRIB_NAME = "ID";
+    @Nonnull @NotEmpty static final String ID_ATTRIB_NAME = "ID";
 
     /** InResponseTo attribute name. */
-    @Nonnull static final String IN_RESPONSE_TO_ATTRIB_NAME = "InResponseTo";
+    @Nonnull @NotEmpty static final String IN_RESPONSE_TO_ATTRIB_NAME = "InResponseTo";
 
     /** Version attribute name. */
-    @Nonnull static final String VERSION_ATTRIB_NAME = "Version";
+    @Nonnull @NotEmpty static final String VERSION_ATTRIB_NAME = "Version";
 
     /** IssueInstant attribute name. */
-    @Nonnull static final String ISSUE_INSTANT_ATTRIB_NAME = "IssueInstant";
+    @Nonnull @NotEmpty static final String ISSUE_INSTANT_ATTRIB_NAME = "IssueInstant";
 
     /** QName for the attribute which defines the IssueInstant. */
     @Nonnull static final QName ISSUE_INSTANT_ATTRIB_QNAME =
             new QName(null, "IssueInstant", XMLConstants.DEFAULT_NS_PREFIX);
     
     /** Destination attribute name. */
-    @Nonnull static final String DESTINATION_ATTRIB_NAME = "Destination";
+    @Nonnull @NotEmpty static final String DESTINATION_ATTRIB_NAME = "Destination";
 
     /** Consent attribute name. */
-    @Nonnull static final String CONSENT_ATTRIB_NAME = "Consent";
+    @Nonnull @NotEmpty static final String CONSENT_ATTRIB_NAME = "Consent";
 
     /** Unspecified consent URI. */
-    @Nonnull static final String UNSPECIFIED_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:unspecified";
+    @Nonnull @NotEmpty static final String UNSPECIFIED_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:unspecified";
 
     /** Obtained consent URI. */
-    @Nonnull static final String OBTAINED_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:obtained";
+    @Nonnull @NotEmpty static final String OBTAINED_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:obtained";
 
     /** Prior consent URI. */
-    @Nonnull static final String PRIOR_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:prior";
+    @Nonnull @NotEmpty static final String PRIOR_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:prior";
 
     /** Implicit consent URI. */
-    @Nonnull static final String IMPLICIT_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:current-implicit";
+    @Nonnull @NotEmpty static final String IMPLICIT_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:current-implicit";
 
     /** Explicit consent URI. */
-    @Nonnull static final String EXPLICIT_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:current-explicit";
+    @Nonnull @NotEmpty static final String EXPLICIT_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:current-explicit";
 
     /** Unavailable consent URI. */
-    @Nonnull static final String UNAVAILABLE_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:unavailable";
+    @Nonnull @NotEmpty static final String UNAVAILABLE_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:unavailable";
 
     /** Inapplicable consent URI. */
-    @Nonnull static final String INAPPLICABLE_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:inapplicable";
+    @Nonnull @NotEmpty static final String INAPPLICABLE_CONSENT = "urn:oasis:names:tc:SAML:2.0:consent:inapplicable";
 
     /**
      * Gets the SAML Version of this response.
@@ -99,7 +101,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newVersion the SAML Version of this response
      */
-    void setVersion(@Nullable SAMLVersion newVersion);
+    void setVersion(@Nullable final SAMLVersion newVersion);
 
     /**
      * Gets the unique identifier of the response.
@@ -113,8 +115,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newID the unique identifier of the response
      */
-
-    void setID(@Nullable String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets the unique request identifier for which this is a response.
@@ -128,8 +129,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newInResponseTo the unique identifier of the originating request
      */
-
-    void setInResponseTo(@Nullable String newInResponseTo);
+    void setInResponseTo(@Nullable final String newInResponseTo);
 
     /**
      * Gets the date/time the response was issued.
@@ -143,7 +143,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newIssueInstant the date/time the response was issued
      */
-    void setIssueInstant(@Nullable Instant newIssueInstant);
+    void setIssueInstant(@Nullable final Instant newIssueInstant);
 
     /**
      * Gets the URI of the destination of the response.
@@ -157,7 +157,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newDestination the URI of the destination of the response
      */
-    void setDestination(@Nullable String newDestination);
+    void setDestination(@Nullable final String newDestination);
 
     /**
      * Gets the consent obtained from the principal for sending this response.
@@ -171,7 +171,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newConsent the consent obtained from the principal for sending this response
      */
-    void setConsent(@Nullable String newConsent);
+    void setConsent(@Nullable final String newConsent);
 
     /**
      * Gets the issuer of this response.
@@ -185,7 +185,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newIssuer the issuer of this response
      */
-    void setIssuer(@Nullable Issuer newIssuer);
+    void setIssuer(@Nullable final Issuer newIssuer);
 
     /**
      * Gets the Status of this response.
@@ -199,7 +199,7 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newStatus the Status of this response
      */
-    void setStatus(@Nullable Status newStatus);
+    void setStatus(@Nullable final Status newStatus);
 
     /**
      * Gets the Extensions of this response.
@@ -213,6 +213,6 @@ public interface StatusResponseType extends SignableSAMLObject {
      * 
      * @param newExtensions the Extensions of this response
      */
-    void setExtensions(@Nullable Extensions newExtensions);
+    void setExtensions(@Nullable final Extensions newExtensions);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Subject.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Subject.java
index 868cd0f13..cc4dd95c3 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Subject.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Subject.java
@@ -20,11 +20,13 @@ package org.opensaml.saml.saml2.core;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -33,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Subject extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Subject";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Subject";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SubjectType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SubjectType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /**
@@ -51,47 +53,47 @@ public interface Subject extends SAMLObject {
      * 
      * @return the base identifier of the principal for this request
      */
-    public BaseID getBaseID();
+    @Nullable BaseID getBaseID();
 
     /**
      * Sets the base identifier of the principal for this request.
      * 
      * @param newBaseID the base identifier of the principal for this request
      */
-    public void setBaseID(BaseID newBaseID);
+    void setBaseID(@Nullable final BaseID newBaseID);
 
     /**
      * Gets the name identifier of the principal for this request.
      * 
      * @return the name identifier of the principal for this request
      */
-    public NameID getNameID();
+    @Nullable NameID getNameID();
 
     /**
      * Sets the name identifier of the principal for this request.
      * 
      * @param newNameID the name identifier of the principal for this request
      */
-    public void setNameID(NameID newNameID);
+    void setNameID(@Nullable final NameID newNameID);
 
     /**
      * Gets the encrypted name identifier of the principal for this request.
      * 
      * @return the encrypted name identifier of the principal for this request
      */
-    public EncryptedID getEncryptedID();
+    @Nullable EncryptedID getEncryptedID();
 
     /**
      * Sets the encrypted name identifier of the principal for this request.
      * 
      * @param newEncryptedID the new encrypted name identifier of the principal for this request
      */
-    public void setEncryptedID(EncryptedID newEncryptedID);
+    void setEncryptedID(@Nullable final EncryptedID newEncryptedID);
 
     /**
      * Gets the confirmations made about this subject.
      * 
      * @return the confirmations made about this subject
      */
-    public List<SubjectConfirmation> getSubjectConfirmations();
+    @Nonnull @Live List<SubjectConfirmation> getSubjectConfirmations();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmation.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmation.java
index 513aee99b..7b4976781 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmation.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmation.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -31,93 +32,93 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SubjectConfirmation extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectConfirmation";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectConfirmation";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SubjectConfirmationType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SubjectConfirmationType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Method attribute name. */
-    @Nonnull @NotEmpty public static final String METHOD_ATTRIB_NAME = "Method";
+    @Nonnull @NotEmpty static final String METHOD_ATTRIB_NAME = "Method";
     
     /** URI for the Holder of Key subject confirmation method, {@value}. */
-    @Nonnull @NotEmpty public static final String METHOD_HOLDER_OF_KEY = "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key";
+    @Nonnull @NotEmpty static final String METHOD_HOLDER_OF_KEY = "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key";
     
     /** URI for the Sender Vouches subject confirmation method, {@value}. */
-    @Nonnull @NotEmpty public static final String METHOD_SENDER_VOUCHES = "urn:oasis:names:tc:SAML:2.0:cm:sender-vouches";
+    @Nonnull @NotEmpty static final String METHOD_SENDER_VOUCHES = "urn:oasis:names:tc:SAML:2.0:cm:sender-vouches";
     
     /** URI for the Bearer subject confirmation method, {@value}. */
-    @Nonnull @NotEmpty public static final String METHOD_BEARER = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
+    @Nonnull @NotEmpty static final String METHOD_BEARER = "urn:oasis:names:tc:SAML:2.0:cm:bearer";
 
     /**
      * Get the method used to confirm this subject.
      * 
      * @return the method used to confirm this subject
      */
-    public String getMethod();
+    @Nullable String getMethod();
 
     /**
      * Sets the method used to confirm this subject.
      * 
      * @param newMethod the method used to confirm this subject
      */
-    public void setMethod(String newMethod);
+    void setMethod(@Nullable final String newMethod);
 
     /**
      * Gets the base identifier of the principal for this request.
      * 
      * @return the base identifier of the principal for this request
      */
-    public BaseID getBaseID();
+    @Nullable BaseID getBaseID();
 
     /**
      * Sets the base identifier of the principal for this request.
      * 
      * @param newBaseID the base identifier of the principal for this request
      */
-    public void setBaseID(BaseID newBaseID);
+    void setBaseID(@Nullable final BaseID newBaseID);
 
     /**
      * Gets the name identifier of the principal for this request.
      * 
      * @return the name identifier of the principal for this request
      */
-    public NameID getNameID();
+    @Nullable NameID getNameID();
 
     /**
      * Sets the name identifier of the principal for this request.
      * 
      * @param newNameID the name identifier of the principal for this request
      */
-    public void setNameID(NameID newNameID);
+    void setNameID(@Nullable final NameID newNameID);
 
     /**
      * Gets the encrypted name identifier of the principal for this request.
      * 
      * @return the encrypted name identifier of the principal for this request
      */
-    public EncryptedID getEncryptedID();
+    @Nullable EncryptedID getEncryptedID();
 
     /**
      * Sets the encrypted name identifier of the principal for this request.
      * 
      * @param newEncryptedID the new encrypted name identifier of the principal for this request
      */
-    public void setEncryptedID(EncryptedID newEncryptedID);
+    void setEncryptedID(@Nullable final EncryptedID newEncryptedID);
 
     /**
      * Gets the data about how this subject was confirmed or constraints on the confirmation.
      * 
      * @return the data about how this subject was confirmed or constraints on the confirmation
      */
-    public SubjectConfirmationData getSubjectConfirmationData();
+    @Nullable SubjectConfirmationData getSubjectConfirmationData();
 
     /**
      * Sets the data about how this subject was confirmed or constraints on the confirmation.
@@ -125,5 +126,6 @@ public interface SubjectConfirmation extends SAMLObject {
      * @param newSubjectConfirmationData the data about how this subject was confirmed or constraints on the
      *            confirmation
      */
-    public void setSubjectConfirmationData(SubjectConfirmationData newSubjectConfirmationData);
-}
+    void setSubjectConfirmationData(@Nullable final SubjectConfirmationData newSubjectConfirmationData);
+
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmationData.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmationData.java
index 44a417f42..3b62e5f52 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmationData.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectConfirmationData.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.core;
 import java.time.Instant;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 
@@ -28,114 +29,117 @@ import org.opensaml.core.xml.ElementExtensibleXMLObject;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
+
 /**
  * SAML 2.0 Core SubjectConfirmationData.
  */
 public interface SubjectConfirmationData extends SAMLObject, ElementExtensibleXMLObject, AttributeExtensibleXMLObject {
 
     /** Element local name. */
-    @Nonnull static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectConfirmationData";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectConfirmationData";
 
     /** Default element name. */
     @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull static final String TYPE_LOCAL_NAME = "SubjectConfirmationDataType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SubjectConfirmationDataType";
 
     /** QName of the XSI type. */
     @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** NotBefore attribute name. */
-    @Nonnull static final String NOT_BEFORE_ATTRIB_NAME = "NotBefore";
+    @Nonnull @NotEmpty static final String NOT_BEFORE_ATTRIB_NAME = "NotBefore";
 
     /** QName for the NotBefore attribute. */
     @Nonnull static final QName NOT_BEFORE_ATTRIB_QNAME = new QName(null, "NotBefore", XMLConstants.DEFAULT_NS_PREFIX);
 
     /** Name for the NotOnOrAfter attribute. */
-    @Nonnull static final String NOT_ON_OR_AFTER_ATTRIB_NAME = "NotOnOrAfter";
+    @Nonnull @NotEmpty static final String NOT_ON_OR_AFTER_ATTRIB_NAME = "NotOnOrAfter";
 
     /** QName for the NotOnOrAfter attribute. */
     @Nonnull static final QName NOT_ON_OR_AFTER_ATTRIB_QNAME =
             new QName(null, "NotOnOrAfter", XMLConstants.DEFAULT_NS_PREFIX);
 
     /** Recipient attribute name. */
-    @Nonnull static final String RECIPIENT_ATTRIB_NAME = "Recipient";
+    @Nonnull @NotEmpty static final String RECIPIENT_ATTRIB_NAME = "Recipient";
 
     /** InResponseTo attribute name. */
-    @Nonnull static final String IN_RESPONSE_TO_ATTRIB_NAME = "InResponseTo";
+    @Nonnull @NotEmpty static final String IN_RESPONSE_TO_ATTRIB_NAME = "InResponseTo";
 
     /** Address attribute name. */
-    @Nonnull static final String ADDRESS_ATTRIB_NAME = "Address";
+    @Nonnull @NotEmpty static final String ADDRESS_ATTRIB_NAME = "Address";
 
     /**
      * Gets the time before which this subject is not valid.
      * 
      * @return the time before which this subject is not valid
      */
-    Instant getNotBefore();
+    @Nullable Instant getNotBefore();
 
     /**
      * Sets the time before which this subject is not valid.
      * 
      * @param newNotBefore the time before which this subject is not valid
      */
-    void setNotBefore(Instant newNotBefore);
+    void setNotBefore(@Nullable final Instant newNotBefore);
 
     /**
      * Gets the time at, or after, which this subject is not valid.
      * 
      * @return the time at, or after, which this subject is not valid
      */
-    Instant getNotOnOrAfter();
+    @Nullable Instant getNotOnOrAfter();
 
     /**
      * Sets the time at, or after, which this subject is not valid.
      * 
      * @param newNotOnOrAfter the time at, or after, which this subject is not valid
      */
-    void setNotOnOrAfter(Instant newNotOnOrAfter);
+    void setNotOnOrAfter(@Nullable final Instant newNotOnOrAfter);
 
     /**
      * Gets the recipient of this subject.
      * 
      * @return the recipient of this subject
      */
-    String getRecipient();
+    @Nullable String getRecipient();
 
     /**
      * Sets the recipient of this subject.
      * 
      * @param newRecipient the recipient of this subject
      */
-    void setRecipient(String newRecipient);
+    void setRecipient(@Nullable final String newRecipient);
 
     /**
      * Gets the message ID this is in response to.
      * 
      * @return the message ID this is in response to
      */
-    String getInResponseTo();
+    @Nullable String getInResponseTo();
 
     /**
      * Sets the message ID this is in response to.
      * 
      * @param newInResponseTo the message ID this is in response to
      */
-    void setInResponseTo(String newInResponseTo);
+    void setInResponseTo(@Nullable final String newInResponseTo);
 
     /**
      * Gets the IP address to which this information may be pressented.
      * 
      * @return the IP address to which this information may be pressented
      */
-    String getAddress();
+    @Nullable String getAddress();
 
     /**
      * Sets the IP address to which this information may be pressented.
      * 
      * @param newAddress the IP address to which this information may be pressented
      */
-    void setAddress(String newAddress);
+    void setAddress(@Nullable final String newAddress);
+    
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectLocality.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectLocality.java
index 3a02cbcbf..219238471 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectLocality.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectLocality.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.core;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -31,50 +32,50 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SubjectLocality extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectLocality";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectLocality";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SubjectLocalityType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SubjectLocalityType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20_PREFIX);
 
     /** Address attribute name. */
-    @Nonnull @NotEmpty public static final String ADDRESS_ATTRIB_NAME = "Address";
+    @Nonnull @NotEmpty static final String ADDRESS_ATTRIB_NAME = "Address";
 
     /** DNSName attribute name. */
-    @Nonnull @NotEmpty public static final String DNS_NAME_ATTRIB_NAME = "DNSName";
+    @Nonnull @NotEmpty static final String DNS_NAME_ATTRIB_NAME = "DNSName";
 
     /**
      * Gets the IP address of the system from which the subject was authenticated.
      * 
      * @return the IP address of the system from which the subject was authenticated
      */
-    public String getAddress();
+    @Nullable String getAddress();
 
     /**
      * Sets the IP address of the system from which the subject was authenticated.
      * 
      * @param newAddress the IP address of the system from which the subject was authenticated
      */
-    public void setAddress(String newAddress);
+    void setAddress(@Nullable final String newAddress);
 
     /**
      * Gets the DNSName of the system from which the subject was authenticated.
      * 
      * @return the DNSName of the system from which the subject was authenticated
      */
-    public String getDNSName();
+    @Nullable String getDNSName();
 
     /**
      * Sets the DNSName of the system from which the subject was authenticated.
      * 
      * @param newDNSName the DNSName of the system from which the subject was authenticated
      */
-    public void setDNSName(String newDNSName);
+    void setDNSName(@Nullable final String newDNSName);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectQuery.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectQuery.java
index 47c396b4a..bad8e5726 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectQuery.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/SubjectQuery.java
@@ -35,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SubjectQuery extends RequestAbstractType {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectQuery";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectQuery";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SubjectQueryAbstractType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SubjectQueryAbstractType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /**
@@ -53,13 +53,13 @@ public interface SubjectQuery extends RequestAbstractType {
      * 
      * @return the Subject of this request
      */
-    @Nullable public Subject getSubject();
+    @Nullable Subject getSubject();
 
     /**
      * Sets the Subject of this request.
      * 
      * @param newSubject the Subject of this request
      */
-    public void setSubject(@Nullable Subject newSubject);
+    void setSubject(@Nullable final Subject newSubject);
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Terminate.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Terminate.java
index 729133dd2..bf9eb2b3d 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Terminate.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/core/Terminate.java
@@ -35,16 +35,16 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Terminate extends SAMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Terminate";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Terminate";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20P_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "TerminateType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "TerminateType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20P_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20P_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RelayState.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RelayState.java
index 9490f589a..5243fd76f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RelayState.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RelayState.java
@@ -34,17 +34,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface RelayState extends XSString, SAMLObject, MustUnderstandBearing, ActorBearing {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "RelayState";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "RelayState";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
         new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20ECP_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "RelayStateType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "RelayStateType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME =
+    @Nonnull static final QName TYPE_NAME =
         new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20ECP_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Request.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Request.java
index c8dc59fc7..94f0cdd7b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Request.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Request.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.ecp;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
@@ -36,93 +37,93 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Request extends SAMLObject, MustUnderstandBearing, ActorBearing {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Request";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Request";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
         new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20ECP_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "RequestType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "RequestType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME =
+    @Nonnull static final QName TYPE_NAME =
         new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20ECP_PREFIX);
 
     /** ProviderName attribute name. */
-    @Nonnull @NotEmpty public static final String PROVIDER_NAME_ATTRIB_NAME = "ProviderName";
+    @Nonnull @NotEmpty static final String PROVIDER_NAME_ATTRIB_NAME = "ProviderName";
 
     /** IsPassive attribute name. */
-    @Nonnull @NotEmpty public static final String IS_PASSIVE_NAME_ATTRIB_NAME = "IsPassive";
+    @Nonnull @NotEmpty static final String IS_PASSIVE_NAME_ATTRIB_NAME = "IsPassive";
     
     /**
      * Get the Issuer child elemet.
      * 
      * @return the Issuer child element
      */
-    public Issuer getIssuer();
+    @Nullable Issuer getIssuer();
     
     /**
      * Set the Issuer child elemet.
      * 
      * @param newIssuer the new Issuer child element
      */
-    public void setIssuer(Issuer newIssuer);
+    void setIssuer(@Nullable final Issuer newIssuer);
     
     /**
      * Get the IDPList child element.
      * 
      * @return the IDPList child element
      */
-    public IDPList getIDPList();
+    @Nullable IDPList getIDPList();
     
     /**
      * Set the IDPList child element.
      * 
      * @param newIDPList the new IDPList child element
      */
-    public void setIDPList(IDPList newIDPList);
+    void setIDPList(@Nullable final IDPList newIDPList);
     
     /**
      * Get the ProviderName attribute value.
      * 
      * @return the ProviderName attribute value
      */
-    public String getProviderName();
+    @Nullable String getProviderName();
     
     /**
      * Set the ProviderName attribute value.
      * 
      * @param newProviderName the new ProviderName attribute value
      */
-    public void setProviderName(String newProviderName);
+    void setProviderName(@Nullable final String newProviderName);
     
     /**
      * Get the IsPassive attribute value.
      * 
      * @return the IsPassive attribute value
      */
-    public Boolean isPassive();
+    @Nullable Boolean isPassive();
     
     /**
      * Get the IsPassive attribute value.
      * 
      * @return the IsPassive attribute value
      */
-    public XSBooleanValue isPassiveXSBoolean();
+    @Nullable XSBooleanValue isPassiveXSBoolean();
     
     /**
      * Set the IsPassive attribute value.
      * 
      * @param newIsPassive the new IsPassive attribute value
      */
-    public void setPassive(Boolean newIsPassive);
+    void setPassive(@Nullable final Boolean newIsPassive);
     
     /**
      * Set the IsPassive attribute value.
      * 
      * @param newIsPassive the new IsPassive attribute value
      */
-    public void setPassive(XSBooleanValue newIsPassive);
+    void setPassive(@Nullable final XSBooleanValue newIsPassive);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RequestAuthenticated.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RequestAuthenticated.java
index 35569c3c0..0d268e8ec 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RequestAuthenticated.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/RequestAuthenticated.java
@@ -34,17 +34,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface RequestAuthenticated extends SAMLObject, MustUnderstandBearing, ActorBearing {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "RequestAuthenticated";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "RequestAuthenticated";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20ECP_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "RequestAuthenticatedType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "RequestAuthenticatedType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20ECP_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Response.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Response.java
index e9292d7d3..05a9f9aa0 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Response.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/Response.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.ecp;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -33,34 +34,34 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Response extends SAMLObject, MustUnderstandBearing, ActorBearing {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Response";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Response";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
         new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20ECP_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ResponseType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ResponseType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME =
+    @Nonnull static final QName TYPE_NAME =
         new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME, SAMLConstants.SAML20ECP_PREFIX);
 
     /** ProviderName attribute name. */
-    @Nonnull @NotEmpty public static final String ASSERTION_CONSUMER_SERVICE_URL_ATTRIB_NAME = "AssertionConsumerServiceURL";
+    @Nonnull @NotEmpty static final String ASSERTION_CONSUMER_SERVICE_URL_ATTRIB_NAME = "AssertionConsumerServiceURL";
     
     /**
      * Get the AssertionConsumerServiceURL attribute value.
      * 
      * @return the AssertionConsumerServiceURL attribute value
      */
-    public String getAssertionConsumerServiceURL();
+    @Nullable String getAssertionConsumerServiceURL();
 
     /**
      * Get the AssertionConsumerServiceURL attribute value.
      * 
      * @param newAssertionConsumerServiceURL the new AssertionConsumerServiceURL attribute value
      */
-    public void setAssertionConsumerServiceURL(String newAssertionConsumerServiceURL);
+    void setAssertionConsumerServiceURL(@Nullable final String newAssertionConsumerServiceURL);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/SubjectConfirmation.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/SubjectConfirmation.java
index 827aa8230..7da1bf794 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/SubjectConfirmation.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/ecp/SubjectConfirmation.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.ecp;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -35,42 +36,42 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SubjectConfirmation extends SAMLObject, MustUnderstandBearing, ActorBearing {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectConfirmation";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SubjectConfirmation";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20ECP_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20ECP_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SubjectConfirmationType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SubjectConfirmationType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20ECP_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20ECP_PREFIX);
 
     /** Method attribute name. */
-    @Nonnull @NotEmpty public static final String METHOD_ATTRIB_NAME = "Method";
+    @Nonnull @NotEmpty static final String METHOD_ATTRIB_NAME = "Method";
     
     /**
      * Get the method used to confirm this subject.
      * 
      * @return the method used to confirm this subject
      */
-    public String getMethod();
+    @Nullable String getMethod();
 
     /**
      * Sets the method used to confirm this subject.
      * 
      * @param newMethod the method used to confirm this subject
      */
-    public void setMethod(String newMethod);
+    void setMethod(@Nullable final String newMethod);
 
     /**
      * Gets the data about how this subject was confirmed or constraints on the confirmation.
      * 
      * @return the data about how this subject was confirmed or constraints on the confirmation
      */
-    public SubjectConfirmationData getSubjectConfirmationData();
+    @Nullable SubjectConfirmationData getSubjectConfirmationData();
 
     /**
      * Sets the data about how this subject was confirmed or constraints on the confirmation.
@@ -78,5 +79,5 @@ public interface SubjectConfirmation extends SAMLObject, MustUnderstandBearing,
      * @param newSubjectConfirmationData the data about how this subject was confirmed or constraints on the
      *            confirmation
      */
-    public void setSubjectConfirmationData(SubjectConfirmationData newSubjectConfirmationData);
+    void setSubjectConfirmationData(@Nullable final SubjectConfirmationData newSubjectConfirmationData);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java
index 4cdae7bf5..222a5a736 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/encryption/Decrypter.java
@@ -35,6 +35,7 @@ import org.opensaml.saml.saml2.core.EncryptedID;
 import org.opensaml.saml.saml2.core.NewEncryptedID;
 import org.opensaml.saml.saml2.core.NewID;
 import org.opensaml.xmlsec.DecryptionParameters;
+import org.opensaml.xmlsec.encryption.EncryptedData;
 import org.opensaml.xmlsec.encryption.support.DecryptionException;
 import org.opensaml.xmlsec.encryption.support.EncryptedKeyResolver;
 import org.opensaml.xmlsec.keyinfo.KeyInfoCredentialResolver;
@@ -172,13 +173,14 @@ public class Decrypter extends org.opensaml.xmlsec.encryption.support.Decrypter
      */
     private SAMLObject decryptData(@Nonnull final EncryptedElementType encElement) throws DecryptionException {
         
-        if (encElement.getEncryptedData() == null) {
+        final EncryptedData encryptedData = encElement.getEncryptedData();
+        if (encryptedData == null) {
             throw new DecryptionException("Element had no EncryptedData child");
         }
         
         XMLObject xmlObject = null;
         try {
-            xmlObject = decryptData(encElement.getEncryptedData(), isRootInNewDocument());
+            xmlObject = decryptData(encryptedData, isRootInNewDocument());
         } catch (final DecryptionException e) {
             log.error("SAML Decrypter encountered an error decrypting element content: {}", e.getMessage());
             throw e; 
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java
index bfd7d7424..8c9000d43 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AffiliationDescriptor.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
@@ -28,6 +29,7 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.common.CacheableSAMLObject;
 import org.opensaml.saml.saml2.common.TimeBoundSAMLObject;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -37,78 +39,78 @@ public interface AffiliationDescriptor extends SignableSAMLObject, TimeBoundSAML
         AttributeExtensibleXMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AffiliationDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AffiliationDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AffiliationDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AffiliationDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "affiliationOwnerID" attribute's local name. */
-    @Nonnull @NotEmpty public static final String OWNER_ID_ATTRIB_NAME = "affiliationOwnerID";
+    @Nonnull @NotEmpty static final String OWNER_ID_ATTRIB_NAME = "affiliationOwnerID";
 
     /** ID attribute's local name. */
-    @Nonnull @NotEmpty public static final String ID_ATTRIB_NAME = "ID";
+    @Nonnull @NotEmpty static final String ID_ATTRIB_NAME = "ID";
 
     /**
      * Gets the ID of the owner of this affiliation. The owner may, or may not, be a member of the affiliation.
      * 
      * @return the ID of the owner of this affiliation
      */
-    public String getOwnerID();
+    @Nullable String getOwnerID();
 
     /**
      * Gets the ID of this Descriptor.
      * 
      * @return the ID of this Descriptor
      */
-    public String getID();
+    @Nullable String getID();
 
     /**
      * Gets the Extensions child of this object.
      * 
      * @return the Extensions child of this object
      */
-    public Extensions getExtensions();
+    @Nullable Extensions getExtensions();
 
     /**
      * Sets the Extensions child of this object.
      * 
      * @param extensions the Extensions child of this object
      */
-    public void setExtensions(Extensions extensions);
+    void setExtensions(@Nullable final Extensions extensions);
 
     /**
      * Sets the ID of the owner of this affiliation.
      * 
      * @param ownerID the ID of the owner of this affiliation
      */
-    public void setOwnerID(String ownerID);
+    void setOwnerID(@Nullable final String ownerID);
 
     /**
      * Sets the ID of this descriptor.
      * 
      * @param newID the ID of this descriptor
      */
-    public void setID(String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets a list of the members of this affiliation.
      * 
      * @return a list of affiliate members
      */
-    public List<AffiliateMember> getMembers();
+    @Nonnull @Live List<AffiliateMember> getMembers();
 
     /**
-     * Gets an immutable list of KeyDescriptors for this affiliation.
+     * Gets a list of KeyDescriptors for this affiliation.
      * 
      * @return list of {@link KeyDescriptor}s for this affiliation
      */
-    public List<KeyDescriptor> getKeyDescriptors();
+    @Nonnull @Live List<KeyDescriptor> getKeyDescriptors();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ArtifactResolutionService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ArtifactResolutionService.java
index 565b90c42..aeeb0f131 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ArtifactResolutionService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ArtifactResolutionService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ArtifactResolutionService extends IndexedEndpoint {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ArtifactResolutionService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ArtifactResolutionService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionConsumerService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionConsumerService.java
index 9619762cf..b49e5b84b 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionConsumerService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionConsumerService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AssertionConsumerService extends IndexedEndpoint {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AssertionConsumerService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AssertionConsumerService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionIDRequestService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionIDRequestService.java
index ef0c43228..9e8003cbe 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionIDRequestService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AssertionIDRequestService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AssertionIDRequestService extends Endpoint {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AssertionIDRequestService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AssertionIDRequestService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeAuthorityDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeAuthorityDescriptor.java
index 51d4204ce..da07305e8 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeAuthorityDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeAuthorityDescriptor.java
@@ -26,6 +26,7 @@ import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.core.Attribute;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -34,17 +35,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AttributeAuthorityDescriptor extends SAMLObject, RoleDescriptor {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeAuthorityDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeAuthorityDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AttributeAuthorityDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AttributeAuthorityDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /**
@@ -52,33 +53,33 @@ public interface AttributeAuthorityDescriptor extends SAMLObject, RoleDescriptor
      * 
      * @return list of attributes services
      */
-    public List<AttributeService> getAttributeServices();
+    @Nonnull @Live List<AttributeService> getAttributeServices();
 
     /**
      * Gets a list of Assertion ID request services.
      * 
      * @return list of Assertion ID request services
      */
-    public List<AssertionIDRequestService> getAssertionIDRequestServices();
+    @Nonnull @Live List<AssertionIDRequestService> getAssertionIDRequestServices();
 
     /**
      * Gets a list of NameID formats supported by this authority.
      * 
      * @return list of NameID formats supported by this authority
      */
-    public List<NameIDFormat> getNameIDFormats();
+    @Nonnull @Live List<NameIDFormat> getNameIDFormats();
 
     /**
      * Gets a list of Attribute profiles supported by this authority.
      * 
      * @return list of Attribute profiles supported by this authority
      */
-    public List<AttributeProfile> getAttributeProfiles();
+    @Nonnull @Live List<AttributeProfile> getAttributeProfiles();
 
     /**
      * Gets the list of attribute available from this authority.
      * 
      * @return list of attribute available from this authority
      */
-    public List<Attribute> getAttributes();
+    @Nonnull @Live List<Attribute> getAttributes();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeConsumingService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeConsumingService.java
index fced389a5..5881684a3 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeConsumingService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeConsumingService.java
@@ -20,12 +20,14 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -34,52 +36,52 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AttributeConsumingService extends SAMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeConsumingService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeConsumingService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AttributeConsumingServiceType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AttributeConsumingServiceType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "index" attribute's local name. */
-    @Nonnull @NotEmpty public static final String INDEX_ATTRIB_NAME = "index";
+    @Nonnull @NotEmpty static final String INDEX_ATTRIB_NAME = "index";
 
     /** "isDefault" attribute's local name. */
-    @Nonnull @NotEmpty public static final String IS_DEFAULT_ATTRIB_NAME = "isDefault";
+    @Nonnull @NotEmpty static final String IS_DEFAULT_ATTRIB_NAME = "isDefault";
 
     /**
      * Gets the index for this service.
      * 
      * @return the index for this service
      */
-    public int getIndex();
+    int getIndex();
 
     /**
      * Sets the index for this service.
      * 
      * @param index the index for this service
      */
-    public void setIndex(int index);
+    void setIndex(int index);
 
     /**
      * Checks if this is the default service for the service provider.
      * 
      * @return true if this is the default service, false if not
      */
-    public Boolean isDefault();
+    @Nullable Boolean isDefault();
 
     /**
      * Checks if this is the default service for the service provider.
      * 
      * @return true if this is the default service, false if not
      */
-    public XSBooleanValue isDefaultXSBoolean();
+    @Nullable XSBooleanValue isDefaultXSBoolean();
 
     /**
      * Sets if this is the default service for the service provider. Boolean values will be marshalled to either "true"
@@ -87,33 +89,33 @@ public interface AttributeConsumingService extends SAMLObject {
      * 
      * @param newIsDefault true if this is the default service, false if not
      */
-    public void setIsDefault(Boolean newIsDefault);
+    void setIsDefault(@Nullable final Boolean newIsDefault);
 
     /**
      * Sets if this is the default service for the service provider.
      * 
      * @param newIsDefault true if this is the default service, false if not
      */
-    public void setIsDefault(XSBooleanValue newIsDefault);
+    void setIsDefault(@Nullable final XSBooleanValue newIsDefault);
 
     /**
      * Gets the list of names this service has.
      * 
      * @return list of names this service has
      */
-    public List<ServiceName> getNames();
+    @Nonnull @Live List<ServiceName> getNames();
 
     /**
      * Gets the descriptions for this service.
      * 
      * @return descriptions for this service
      */
-    public List<ServiceDescription> getDescriptions();
+    @Nonnull @Live List<ServiceDescription> getDescriptions();
 
     /**
      * Gets the attributes this service requests.
      * 
      * @return attributes this service requests
      */
-    public List<RequestedAttribute> getRequestedAttributes();
+    @Nonnull @Live List<RequestedAttribute> getRequestedAttributes();
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeService.java
index ff3c9160a..e8ddb7414 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AttributeService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AttributeService extends Endpoint {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AttributeService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnAuthorityDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnAuthorityDescriptor.java
index fe4a96022..64db0da42 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnAuthorityDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnAuthorityDescriptor.java
@@ -25,6 +25,7 @@ import javax.xml.namespace.QName;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -33,17 +34,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthnAuthorityDescriptor extends SAMLObject, RoleDescriptor {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnAuthorityDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnAuthorityDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "AuthnAuthorityDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "AuthnAuthorityDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /**
@@ -51,19 +52,19 @@ public interface AuthnAuthorityDescriptor extends SAMLObject, RoleDescriptor {
      * 
      * @return list of authentication query services
      */
-    public List<AuthnQueryService> getAuthnQueryServices();
+    @Nonnull @Live List<AuthnQueryService> getAuthnQueryServices();
 
     /**
      * Gets the list of assertion ID request services for this authority.
      * 
      * @return assertion ID request services for this authority
      */
-    public List<AssertionIDRequestService> getAssertionIDRequestServices();
+    @Nonnull @Live List<AssertionIDRequestService> getAssertionIDRequestServices();
 
     /**
      * Gets the list of supported name ID formats for this authority.
      * 
      * @return supported name ID formats for this authority
      */
-    public List<NameIDFormat> getNameIDFormats();
+    @Nonnull @Live List<NameIDFormat> getNameIDFormats();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnQueryService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnQueryService.java
index fe562d7c4..0b16bbcff 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnQueryService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthnQueryService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthnQueryService extends Endpoint {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnQueryService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthnQueryService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthzService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthzService.java
index 9a08d5023..07f4b80db 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthzService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/AuthzService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface AuthzService extends Endpoint {
 
     /** Default element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthzService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "AuthzService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ContactPerson.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ContactPerson.java
index 15740728c..babc14135 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ContactPerson.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ContactPerson.java
@@ -20,12 +20,14 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -34,103 +36,103 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ContactPerson extends SAMLObject, AttributeExtensibleXMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ContactPerson";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ContactPerson";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ContactPersonType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ContactPersonType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "contactType" attribute's local name. */
-    @Nonnull @NotEmpty public static final String CONTACT_TYPE_ATTRIB_NAME = "contactType";
+    @Nonnull @NotEmpty static final String CONTACT_TYPE_ATTRIB_NAME = "contactType";
 
     /**
      * Gets the type of contact this person.
      * 
      * @return the type of contact this person
      */
-    public ContactPersonTypeEnumeration getType();
+    @Nullable ContactPersonTypeEnumeration getType();
 
     /**
      * Sets the type of contact this person.
      * 
      * @param type the type of contact this person
      */
-    public void setType(ContactPersonTypeEnumeration type);
+    void setType(@Nullable final ContactPersonTypeEnumeration type);
 
     /**
      * Gets the Extensions child of this object.
      * 
      * @return the Extensions child of this object
      */
-    public Extensions getExtensions();
+    @Nullable Extensions getExtensions();
 
     /**
      * Sets the Extensions child of this object.
      * 
      * @param extensions the Extensions child of this object
      */
-    public void setExtensions(Extensions extensions);
+    void setExtensions(@Nullable final Extensions extensions);
 
     /**
      * Gets the company this contact person is associated with.
      * 
      * @return the company this contact person is associated with
      */
-    public Company getCompany();
+    @Nullable Company getCompany();
 
     /**
      * Sets the company this contact person is associated with.
      * 
      * @param company the company this contact person is associated with
      */
-    public void setCompany(Company company);
+    void setCompany(@Nullable final Company company);
 
     /**
      * Gets the given name for this person.
      * 
      * @return the given name for this person
      */
-    public GivenName getGivenName();
+    @Nullable GivenName getGivenName();
 
     /**
      * Sets the given name for this person.
      * 
      * @param name the given name for this person
      */
-    public void setGivenName(GivenName name);
+    void setGivenName(@Nullable final GivenName name);
 
     /**
      * Gets the surname for this person.
      * 
      * @return the surname for this person
      */
-    public SurName getSurName();
+    @Nullable SurName getSurName();
 
     /**
      * Sets the surname for this person.
      * 
      * @param name the surname for this person
      */
-    public void setSurName(SurName name);
+    void setSurName(@Nullable final SurName name);
 
     /**
      * Gets a list of email addresses for this person.
      * 
      * @return list of email addresses for this person
      */
-    public List<EmailAddress> getEmailAddresses();
+    @Nonnull @Live List<EmailAddress> getEmailAddresses();
 
     /**
      * Gets an immutable list of telephone numbers for this person.
      * 
      * @return list of telephone numbers for this person
      */
-    public List<TelephoneNumber> getTelephoneNumbers();
+    @Nonnull @Live List<TelephoneNumber> getTelephoneNumbers();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EncryptionMethod.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EncryptionMethod.java
index 6e0c5e62e..567097d9e 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EncryptionMethod.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EncryptionMethod.java
@@ -31,10 +31,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface EncryptionMethod extends org.opensaml.xmlsec.encryption.EncryptionMethod, SAMLObject {
     
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptionMethod";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "EncryptionMethod";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = 
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = 
         new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Endpoint.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Endpoint.java
index 6faf948fa..2d4467bbc 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Endpoint.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Endpoint.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.metadata;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
@@ -33,67 +34,67 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Endpoint extends SAMLObject, ElementExtensibleXMLObject, AttributeExtensibleXMLObject {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Endpoint";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Endpoint";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "EndpointType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "EndpointType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "Binding" attribute name. */
-    @Nonnull @NotEmpty public static final String BINDING_ATTRIB_NAME = "Binding";
+    @Nonnull @NotEmpty static final String BINDING_ATTRIB_NAME = "Binding";
 
     /** "Location" attribute name. */
-    @Nonnull @NotEmpty public static final String LOCATION_ATTRIB_NAME = "Location";
+    @Nonnull @NotEmpty static final String LOCATION_ATTRIB_NAME = "Location";
 
     /** "ResponseLocation" attribute name. */
-    @Nonnull @NotEmpty public static final String RESPONSE_LOCATION_ATTRIB_NAME = "ResponseLocation";
+    @Nonnull @NotEmpty static final String RESPONSE_LOCATION_ATTRIB_NAME = "ResponseLocation";
 
     /**
      * Gets the URI identifier for the binding supported by this Endpoint.
      * 
      * @return the URI identifier for the binding supported by this Endpoint
      */
-    public String getBinding();
+    @Nullable String getBinding();
 
     /**
      * Sets the URI identifier for the binding supported by this Endpoint.
      * 
      * @param binding the URI identifier for the binding supported by this Endpoint
      */
-    public void setBinding(String binding);
+    void setBinding(@Nullable final String binding);
 
     /**
      * Gets the URI, usually a URL, for the location of this Endpoint.
      * 
      * @return the location of this Endpoint
      */
-    public String getLocation();
+    @Nullable String getLocation();
 
     /**
      * Sets the URI, usually a URL, for the location of this Endpoint.
      * 
      * @param location the location of this Endpoint
      */
-    public void setLocation(String location);
+    void setLocation(@Nullable final String location);
 
     /**
      * Gets the URI, usually a URL, responses should be sent to this for this Endpoint.
      * 
      * @return the URI responses should be sent to this for this Endpoint
      */
-    public String getResponseLocation();
+    @Nullable String getResponseLocation();
 
     /**
      * Sets the URI, usually a URL, responses should be sent to this for this Endpoint.
      * 
      * @param location the URI responses should be sent to this for this Endpoint
      */
-    public void setResponseLocation(String location);
+    void setResponseLocation(@Nullable final String location);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntitiesDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntitiesDescriptor.java
index bc11b8c5f..6ae62e978 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntitiesDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntitiesDescriptor.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SignableSAMLObject;
@@ -27,6 +28,7 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.common.CacheableSAMLObject;
 import org.opensaml.saml.saml2.common.TimeBoundSAMLObject;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -37,81 +39,81 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface EntitiesDescriptor extends SignableSAMLObject, TimeBoundSAMLObject, CacheableSAMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "EntitiesDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "EntitiesDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "EntitiesDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "EntitiesDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Element QName, no prefix. */
-    @Nonnull public static final QName ELEMENT_QNAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME);
+    @Nonnull static final QName ELEMENT_QNAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME);
 
     /** "ID" attribute name. */
-    @Nonnull @NotEmpty public static final String ID_ATTRIB_NAME = "ID";
+    @Nonnull @NotEmpty static final String ID_ATTRIB_NAME = "ID";
 
     /** "Name" attribute name. */
-    @Nonnull @NotEmpty public static final String NAME_ATTRIB_NAME = "Name";
+    @Nonnull @NotEmpty static final String NAME_ATTRIB_NAME = "Name";
 
     /**
      * Gets the name of this entity group.
      * 
      * @return the name of this entity group
      */
-    public String getName();
+    @Nullable String getName();
 
     /**
      * Sets the name of this entity group.
      * 
      * @param name the name of this entity group
      */
-    public void setName(String name);
+    void setName(@Nullable final String name);
 
     /**
      * Gets the ID of this entity group.
      * 
      * @return the id of this entity group
      */
-    public String getID();
+    @Nullable String getID();
 
     /**
      * Sets the ID of this entity group.
      * 
      * @param newID the ID of this entity group
      */
-    public void setID(String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets the Extensions child of this object.
      * 
      * @return the Extensions child of this object
      */
-    public Extensions getExtensions();
+    @Nullable Extensions getExtensions();
 
     /**
      * Sets the Extensions child of this object.
      * 
      * @param extensions the Extensions child of this object
      */
-    public void setExtensions(Extensions extensions);
+    void setExtensions(@Nullable final Extensions extensions);
 
     /**
      * Gets a list of child {@link EntitiesDescriptor}s.
      * 
      * @return list of descriptors
      */
-    public List<EntitiesDescriptor> getEntitiesDescriptors();
+    @Nonnull @Live List<EntitiesDescriptor> getEntitiesDescriptors();
 
     /**
      * Gets a list of child {@link EntityDescriptor}s.
      * 
      * @return list of child descriptors
      */
-    public List<EntityDescriptor> getEntityDescriptors();
+    @Nonnull @Live List<EntityDescriptor> getEntityDescriptors();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntityDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntityDescriptor.java
index 729195721..7900ca5da 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntityDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/EntityDescriptor.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
@@ -28,7 +29,10 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.common.CacheableSAMLObject;
 import org.opensaml.saml.saml2.common.TimeBoundSAMLObject;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 /**
  * SAML 2.0 Metadata EntityDescriptor.
@@ -37,76 +41,76 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
         AttributeExtensibleXMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "EntityDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "EntityDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "EntityDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "EntityDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Element QName, no prefix. */
-    @Nonnull public static final QName ELEMENT_QNAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME);
+    @Nonnull static final QName ELEMENT_QNAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME);
 
     /** "ID" attribute name. */
-    @Nonnull @NotEmpty public static final String ID_ATTRIB_NAME = "ID";
+    @Nonnull @NotEmpty static final String ID_ATTRIB_NAME = "ID";
 
     /** "Name" attribute name. */
-    @Nonnull @NotEmpty public static final String ENTITY_ID_ATTRIB_NAME = "entityID";
+    @Nonnull @NotEmpty static final String ENTITY_ID_ATTRIB_NAME = "entityID";
 
     /**
      * Gets the entity ID for this entity descriptor.
      * 
      * @return the entity ID for this entity descriptor
      */
-    public String getEntityID();
+    @Nullable String getEntityID();
 
     /**
      * Sets the entity ID for this entity descriptor.
      * 
      * @param id the entity ID for this entity descriptor
      */
-    public void setEntityID(String id);
+    void setEntityID(@Nullable final String id);
 
     /**
      * Gets the ID for this entity descriptor.
      * 
      * @return the ID for this entity descriptor
      */
-    public String getID();
+    @Nullable String getID();
 
     /**
      * Sets the ID for this entity descriptor.
      * 
      * @param newID the ID for this entity descriptor
      */
-    public void setID(String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets the Extensions child of this object.
      * 
      * @return the Extensions child of this object
      */
-    public Extensions getExtensions();
+    @Nullable Extensions getExtensions();
 
     /**
      * Sets the Extensions child of this object.
      * 
      * @param extensions the Extensions child of this object
      */
-    public void setExtensions(Extensions extensions);
+    void setExtensions(@Nullable final Extensions extensions);
 
     /**
      * Gets all the role descriptors for this entity descriptor.
      * 
      * @return the role descriptors for this entity descriptor
      */
-    public List<RoleDescriptor> getRoleDescriptors();
+    @Nonnull @Live List<RoleDescriptor> getRoleDescriptors();
 
     /**
      * Gets all the role descriptors for this entity descriptor that match the supplied QName parameter.
@@ -115,7 +119,7 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
      * 
      * @return the role descriptors for this entity descriptor
      */
-    public List<RoleDescriptor> getRoleDescriptors(QName typeOrName);
+    @Nonnull @Live List<RoleDescriptor> getRoleDescriptors(@Nonnull final QName typeOrName);
 
     /**
      * Gets all the role descriptors for this entity that support the given protocol.
@@ -125,7 +129,8 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
      * 
      * @return the list of role descriptors that support the given protocol
      */
-    public List<RoleDescriptor> getRoleDescriptors(QName typeOrName, String supportedProtocol);
+    @Nonnull @Unmodifiable @NotLive List<RoleDescriptor> getRoleDescriptors(@Nonnull final QName typeOrName,
+            @Nonnull @NotEmpty String supportedProtocol);
 
     /**
      * Gets the first {@link IDPSSODescriptor} role descriptor for this entity that supports the given protocol.
@@ -134,7 +139,7 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
      * 
      * @return the {@link IDPSSODescriptor} role descriptor
      */
-    public IDPSSODescriptor getIDPSSODescriptor(String supportedProtocol);
+    @Nullable IDPSSODescriptor getIDPSSODescriptor(@Nonnull @NotEmpty final String supportedProtocol);
 
     /**
      * Gets the first {@link SPSSODescriptor} role descriptor for this entity that supports the given protocol.
@@ -143,7 +148,7 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
 
      * @return the {@link SPSSODescriptor} role descriptor
      */
-    public SPSSODescriptor getSPSSODescriptor(String supportedProtocol);
+    @Nullable SPSSODescriptor getSPSSODescriptor(@Nonnull @NotEmpty final String supportedProtocol);
 
     /**
      * Gets the first {@link AuthnAuthorityDescriptor} role descriptor for this entity that supports the given protocol.
@@ -152,7 +157,8 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
      * 
      * @return the {@link AuthnAuthorityDescriptor} role descriptor
      */
-    public AuthnAuthorityDescriptor getAuthnAuthorityDescriptor(String supportedProtocol);
+    @Nullable AuthnAuthorityDescriptor getAuthnAuthorityDescriptor(
+            @Nonnull @NotEmpty final String supportedProtocol);
 
     /**
      * Gets the first {@link AttributeAuthorityDescriptor} role descriptor for this entity that supports the given
@@ -162,7 +168,8 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
      * 
      * @return the {@link AttributeAuthorityDescriptor} role descriptor
      */
-    public AttributeAuthorityDescriptor getAttributeAuthorityDescriptor(String supportedProtocol);
+    @Nullable AttributeAuthorityDescriptor getAttributeAuthorityDescriptor(
+            @Nonnull @NotEmpty final String supportedProtocol);
 
     /**
      * Gets the first {@link PDPDescriptor} role descriptor for this entity that supports the given protocol.
@@ -171,47 +178,47 @@ public interface EntityDescriptor extends SignableSAMLObject, TimeBoundSAMLObjec
      * 
      * @return the {@link PDPDescriptor} role descriptor
      */
-    public PDPDescriptor getPDPDescriptor(String supportedProtocol);
+    @Nullable PDPDescriptor getPDPDescriptor(@Nonnull @NotEmpty final String supportedProtocol);
 
     /**
      * Gets the affiliation descriptor for this entity.
      * 
      * @return the affiliation descriptor for this entity
      */
-    public AffiliationDescriptor getAffiliationDescriptor();
+    @Nullable AffiliationDescriptor getAffiliationDescriptor();
 
     /**
      * Sets the affiliation descriptor for this entity.
      * 
      * @param descriptor the affiliation descriptor for this entity
      */
-    public void setAffiliationDescriptor(AffiliationDescriptor descriptor);
+    void setAffiliationDescriptor(@Nullable final AffiliationDescriptor descriptor);
 
     /**
      * Gets the organization for this entity.
      * 
      * @return the organization for this entity
      */
-    public Organization getOrganization();
+    @Nullable Organization getOrganization();
 
     /**
      * Sets the organization for this entity.
      * 
      * @param organization the organization for this entity
      */
-    public void setOrganization(Organization organization);
+    void setOrganization(@Nullable final Organization organization);
 
     /**
      * Get the contact people for this entity.
      * 
      * @return the contact people for this entity
      */
-    public List<ContactPerson> getContactPersons();
+    @Nonnull @Live List<ContactPerson> getContactPersons();
 
     /**
      * Gets the additional metadata locations for this entity.
      * 
      * @return the additional metadata locations for this entity
      */
-    public List<AdditionalMetadataLocation> getAdditionalMetadataLocations();
+    @Nonnull @Live List<AdditionalMetadataLocation> getAdditionalMetadataLocations();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Extensions.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Extensions.java
index 9b3838ab8..83e4cde46 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Extensions.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Extensions.java
@@ -32,17 +32,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Extensions extends SAMLObject, ElementExtensibleXMLObject {
     
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Extensions";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Extensions";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "ExtensionsType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "ExtensionsType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/GivenName.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/GivenName.java
index 1bbc435bb..5fc94d085 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/GivenName.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/GivenName.java
@@ -35,7 +35,7 @@ public interface GivenName extends SAMLObject, XSString {
     @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "GivenName";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
             new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
     
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IDPSSODescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IDPSSODescriptor.java
index 94a76020a..9b53a4317 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IDPSSODescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IDPSSODescriptor.java
@@ -20,12 +20,14 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.core.Attribute;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -34,35 +36,35 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface IDPSSODescriptor extends SSODescriptor {
 
     /** Local name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "IDPSSODescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "IDPSSODescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "IDPSSODescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "IDPSSODescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "WantAuthnRequestSigned" attribute name. */
-    @Nonnull @NotEmpty public static final String WANT_AUTHN_REQ_SIGNED_ATTRIB_NAME = "WantAuthnRequestsSigned";
+    @Nonnull @NotEmpty static final String WANT_AUTHN_REQ_SIGNED_ATTRIB_NAME = "WantAuthnRequestsSigned";
 
     /**
      * Checks if the IDP SSO service wants authentication requests signed.
      * 
      * @return true is signing is desired, false if not
      */
-    public Boolean getWantAuthnRequestsSigned();
+    @Nullable Boolean getWantAuthnRequestsSigned();
 
     /**
      * Checks if the IDP SSO service wants authentication requests signed.
      * 
      * @return true is signing is desired, false if not
      */
-    public XSBooleanValue getWantAuthnRequestsSignedXSBoolean();
+    @Nullable XSBooleanValue getWantAuthnRequestsSignedXSBoolean();
 
     /**
      * Sets whether the IDP SSO service wants authentication requests signed. Boolean values will be marshalled to
@@ -70,47 +72,47 @@ public interface IDPSSODescriptor extends SSODescriptor {
      * 
      * @param newWantSigned true if request should be signed, false if not
      */
-    public void setWantAuthnRequestsSigned(Boolean newWantSigned);
+    void setWantAuthnRequestsSigned(@Nullable final Boolean newWantSigned);
 
     /**
      * Sets whether the IDP SSO service wants authentication requests signed.
      * 
      * @param newWantSigned true if request should be signed, false if not
      */
-    public void setWantAuthnRequestsSigned(XSBooleanValue newWantSigned);
+    void setWantAuthnRequestsSigned(@Nullable final XSBooleanValue newWantSigned);
 
     /**
      * Gets the list of single sign on services for this IDP.
      * 
      * @return list of single sign on services
      */
-    public List<SingleSignOnService> getSingleSignOnServices();
+    @Nonnull @Live List<SingleSignOnService> getSingleSignOnServices();
 
     /**
      * Gets the list of NameID mapping services for this service.
      * 
      * @return the list of NameID mapping services for this service
      */
-    public List<NameIDMappingService> getNameIDMappingServices();
+    @Nonnull @Live List<NameIDMappingService> getNameIDMappingServices();
 
     /**
      * Gets the list of assertion ID request services.
      * 
      * @return assertion ID request services
      */
-    public List<AssertionIDRequestService> getAssertionIDRequestServices();
+    @Nonnull @Live List<AssertionIDRequestService> getAssertionIDRequestServices();
 
     /**
      * Gets the list of attribute profiles supported by this IdP.
      * 
      * @return attribute profiles supported by this IdP
      */
-    public List<AttributeProfile> getAttributeProfiles();
+    @Nonnull @Live List<AttributeProfile> getAttributeProfiles();
 
     /**
      * Gets the list of attributes supported by this IdP.
      * 
      * @return attributes supported by this IdP
      */
-    public List<Attribute> getAttributes();
+    @Nonnull @Live List<Attribute> getAttributes();
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IndexedEndpoint.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IndexedEndpoint.java
index 0c0a1098e..7f83b38a8 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IndexedEndpoint.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/IndexedEndpoint.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.metadata;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
@@ -31,52 +32,52 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface IndexedEndpoint extends Endpoint {
 
     /** Local name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "IndexedEndpoint";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "IndexedEndpoint";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "IndexedEndpointType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "IndexedEndpointType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** index attribute name. */
-    @Nonnull @NotEmpty public static final String INDEX_ATTRIB_NAME = "index";
+    @Nonnull @NotEmpty static final String INDEX_ATTRIB_NAME = "index";
 
     /** isDeault attribute name. */
-    @Nonnull @NotEmpty public static final String IS_DEFAULT_ATTRIB_NAME = "isDefault";
+    @Nonnull @NotEmpty static final String IS_DEFAULT_ATTRIB_NAME = "isDefault";
 
     /**
      * Gets the index of the endpoint.
      * 
      * @return index of the endpoint
      */
-    public Integer getIndex();
+    @Nullable Integer getIndex();
 
     /**
      * Sets the index of the endpoint.
      * 
      * @param index index of the endpoint
      */
-    public void setIndex(Integer index);
+    void setIndex(@Nullable final Integer index);
 
     /**
      * Gets whether this is the default endpoint in a list.
      * 
      * @return whether this is the default endpoint in a list
      */
-    public Boolean isDefault();
+    @Nullable Boolean isDefault();
 
     /**
      * Gets whether this is the default endpoint in a list.
      * 
      * @return whether this is the default endpoint in a list
      */
-    public XSBooleanValue isDefaultXSBoolean();
+    @Nullable XSBooleanValue isDefaultXSBoolean();
 
     /**
      * Sets whether this is the default endpoint in a list. Boolean values will be marshalled to either "true" or
@@ -84,12 +85,12 @@ public interface IndexedEndpoint extends Endpoint {
      * 
      * @param newIsDefault whether this is the default endpoint in a list
      */
-    public void setIsDefault(Boolean newIsDefault);
+    void setIsDefault(@Nullable final Boolean newIsDefault);
 
     /**
      * Sets whether this is the default endpoint in a list.
      * 
      * @param newIsDefault whether this is the default endpoint in a list
      */
-    public void setIsDefault(XSBooleanValue newIsDefault);
+    void setIsDefault(@Nullable final XSBooleanValue newIsDefault);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/KeyDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/KeyDescriptor.java
index 8e0e8a4a8..d1e371259 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/KeyDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/KeyDescriptor.java
@@ -20,6 +20,7 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.SAMLObject;
@@ -27,6 +28,7 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.xmlsec.signature.KeyInfo;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -35,54 +37,54 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface KeyDescriptor extends SAMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "KeyDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "KeyDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "KeyDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "KeyDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "use" attribute's local name. */
-    @Nonnull @NotEmpty public static final String USE_ATTRIB_NAME = "use";
+    @Nonnull @NotEmpty static final String USE_ATTRIB_NAME = "use";
 
     /**
      * Gets the use of this key.
      * 
      * @return the use of this key
      */
-    public UsageType getUse();
+    @Nullable UsageType getUse();
 
     /**
      * Sets the use of this key.
      * 
      * @param newType the use of this key
      */
-    public void setUse(UsageType newType);
+    void setUse(@Nullable final UsageType newType);
 
     /**
      * Gets information about the key, including the key itself.
      * 
      * @return information about the key, including the key itself
      */
-    public KeyInfo getKeyInfo();
+    @Nullable KeyInfo getKeyInfo();
 
     /**
      * Sets information about the key, including the key itself.
      * 
      * @param newKeyInfo information about the key, including the key itself
      */
-    public void setKeyInfo(KeyInfo newKeyInfo);
+    void setKeyInfo(@Nullable final KeyInfo newKeyInfo);
 
     /**
      * Gets the encryption methods that are supported by the entity.
      * 
      * @return the encryption methods that are supported by the entity
      */
-    public List<EncryptionMethod> getEncryptionMethods();
+    @Nonnull @Live List<EncryptionMethod> getEncryptionMethods();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ManageNameIDService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ManageNameIDService.java
index a946af064..9da8e4f29 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ManageNameIDService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/ManageNameIDService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface ManageNameIDService extends Endpoint {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "ManageNameIDService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "ManageNameIDService";
     
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME =
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
             new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/NameIDMappingService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/NameIDMappingService.java
index a36b7dd98..35e6e2aac 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/NameIDMappingService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/NameIDMappingService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface NameIDMappingService extends Endpoint {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDMappingService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "NameIDMappingService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Organization.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Organization.java
index 8b66c97bd..5b69e5880 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Organization.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/Organization.java
@@ -20,12 +20,14 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
 import org.opensaml.saml.common.SAMLObject;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -34,17 +36,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface Organization extends SAMLObject, AttributeExtensibleXMLObject {
 
     /** Local name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "Organization";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "Organization";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull  public static final String TYPE_LOCAL_NAME = "OrganizationType";
+    @Nonnull  static final String TYPE_LOCAL_NAME = "OrganizationType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /**
@@ -52,33 +54,33 @@ public interface Organization extends SAMLObject, AttributeExtensibleXMLObject {
      * 
      * @return the Extensions child of this object
      */
-    public Extensions getExtensions();
+    @Nullable Extensions getExtensions();
 
     /**
      * Sets the Extensions child of this object.
      * 
      * @param extensions the Extensions child of this object
      */
-    public void setExtensions(Extensions extensions);
+    void setExtensions(@Nullable final Extensions extensions);
 
     /**
      * Gets a list of names for this organization.
      * 
      * @return list of names for this organization
      */
-    public List<OrganizationName> getOrganizationNames();
+    @Nonnull @Live List<OrganizationName> getOrganizationNames();
 
     /**
      * Gets a list of display names for this organization.
      * 
      * @return list of display names for this organization
      */
-    public List<OrganizationDisplayName> getDisplayNames();
+    @Nonnull @Live List<OrganizationDisplayName> getDisplayNames();
 
     /**
      * Gets a list of URLs for this organization.
      * 
      * @return list of URLs for this organization
      */
-    public List<OrganizationURL> getURLs();
+    @Nonnull @Live List<OrganizationURL> getURLs();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/OrganizationDisplayName.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/OrganizationDisplayName.java
index ee7457c14..ebd8fab62 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/OrganizationDisplayName.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/OrganizationDisplayName.java
@@ -30,10 +30,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface OrganizationDisplayName extends LocalizedName {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "OrganizationDisplayName";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "OrganizationDisplayName";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/PDPDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/PDPDescriptor.java
index fd7c3fb07..f758af02f 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/PDPDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/PDPDescriptor.java
@@ -24,6 +24,7 @@ import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -32,17 +33,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface PDPDescriptor extends RoleDescriptor {
 
     /** Local name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "PDPDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "PDPDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "PDPDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "PDPDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /**
@@ -50,19 +51,19 @@ public interface PDPDescriptor extends RoleDescriptor {
      * 
      * @return list of authz services for this service
      */
-    public List<AuthzService> getAuthzServices();
+    @Nonnull @Live List<AuthzService> getAuthzServices();
 
     /**
      * Gets the list of assertion ID request services for this PDP.
      * 
      * @return list of assertion ID request services for this PDP
      */
-    public List<AssertionIDRequestService> getAssertionIDRequestServices();
+    @Nonnull @Live List<AssertionIDRequestService> getAssertionIDRequestServices();
 
     /**
      * Gets the list of NameID formats this service supports.
      * 
      * @return NameID formats this service supports
      */
-    public List<NameIDFormat> getNameIDFormats();
+    @Nonnull @Live List<NameIDFormat> getNameIDFormats();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RequestedAttribute.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RequestedAttribute.java
index be201b362..d585d1cdf 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RequestedAttribute.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RequestedAttribute.java
@@ -18,6 +18,7 @@
 package org.opensaml.saml.saml2.metadata;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
@@ -32,47 +33,47 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface RequestedAttribute extends Attribute {
 
     /** Local name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "RequestedAttribute";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "RequestedAttribute";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "RequestedAttributeType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "RequestedAttributeType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "isRequired" attribute's local name. */
-    @Nonnull @NotEmpty public static final String IS_REQUIRED_ATTRIB_NAME = "isRequired";
+    @Nonnull @NotEmpty static final String IS_REQUIRED_ATTRIB_NAME = "isRequired";
 
     /**
      * Checks to see if this requested attribute is also required.
      * 
      * @return true if this attribute is required
      */
-    public Boolean isRequired();
+    @Nullable Boolean isRequired();
 
     /**
      * Checks to see if this requested attribute is also required.
      * 
      * @return true if this attribute is required
      */
-    public XSBooleanValue isRequiredXSBoolean();
+    @Nullable XSBooleanValue isRequiredXSBoolean();
 
     /**
      * Sets if this requested attribute is also required. Boolean values will be marshalled to either "true" or "false".
      * 
      * @param newIsRequire true if this attribute is required
      */
-    public void setIsRequired(Boolean newIsRequire);
+    void setIsRequired(@Nullable final Boolean newIsRequire);
 
     /**
      * Sets if this requested attribute is also required.
      * 
      * @param newIsRequire true if this attribute is required
      */
-    public void setIsRequired(XSBooleanValue newIsRequire);
+    void setIsRequired(@Nullable final XSBooleanValue newIsRequire);
 }
\ No newline at end of file
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RoleDescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RoleDescriptor.java
index 5d2266c50..af1bc6a70 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RoleDescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/RoleDescriptor.java
@@ -21,6 +21,7 @@ import java.util.Collection;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.AttributeExtensibleXMLObject;
@@ -29,7 +30,10 @@ import org.opensaml.saml.common.xml.SAMLConstants;
 import org.opensaml.saml.saml2.common.CacheableSAMLObject;
 import org.opensaml.saml.saml2.common.TimeBoundSAMLObject;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
 /**
  * SAML 2.0 Metadata RoleDescriptor.
@@ -38,48 +42,48 @@ public interface RoleDescriptor extends SignableSAMLObject, TimeBoundSAMLObject,
         AttributeExtensibleXMLObject {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "RoleDescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "RoleDescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "RoleDescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "RoleDescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "ID" attribute's local name. */
-    @Nonnull @NotEmpty public static final String ID_ATTRIB_NAME = "ID";
+    @Nonnull @NotEmpty static final String ID_ATTRIB_NAME = "ID";
 
     /** "protocolEnumeration" attribute's local name. */
-    @Nonnull @NotEmpty public static final String PROTOCOL_ENUMERATION_ATTRIB_NAME = "protocolSupportEnumeration";
+    @Nonnull @NotEmpty static final String PROTOCOL_ENUMERATION_ATTRIB_NAME = "protocolSupportEnumeration";
 
     /** "errorURL" attribute's local name. */
-    @Nonnull @NotEmpty public static final String ERROR_URL_ATTRIB_NAME = "errorURL";
+    @Nonnull @NotEmpty static final String ERROR_URL_ATTRIB_NAME = "errorURL";
 
     /**
      * Gets the ID of this role descriptor.
      * 
      * @return the ID of this role descriptor
      */
-    public String getID();
+    @Nullable String getID();
 
     /**
      * Sets the ID of this role descriptor.
      * 
      * @param newID the ID of this role descriptor
      */
-    public void setID(String newID);
+    void setID(@Nullable final String newID);
 
     /**
      * Gets an immutable list of protocol URIs supported by this role.
      * 
      * @return list of protocol URIs supported by this role
      */
-    public List<String> getSupportedProtocols();
+    @Nonnull @NotLive @Unmodifiable List<String> getSupportedProtocols();
 
     /**
      * Chckes to see if the given protocol is supported by this role.
@@ -88,97 +92,97 @@ public interface RoleDescriptor extends SignableSAMLObject, TimeBoundSAMLObject,
      * 
      * @return true if the protocol is supported, false if not
      */
-    public boolean isSupportedProtocol(String protocol);
+    boolean isSupportedProtocol(@Nonnull @NotEmpty final String protocol);
 
     /**
      * Adds a protocol to the list of supported protocols for this role.
      * 
      * @param protocol the protocol
      */
-    public void addSupportedProtocol(String protocol);
+    void addSupportedProtocol(@Nonnull @NotEmpty final String protocol);
 
     /**
      * Removes a protocol to the list of supported protocols for this role.
      * 
      * @param protocol the protocol
      */
-    public void removeSupportedProtocol(String protocol);
+    void removeSupportedProtocol(@Nonnull @NotEmpty final String protocol);
 
     /**
      * Removes a list of protocols to the list of supported protocols for this role.
      * 
      * @param protocols the protocol
      */
-    public void removeSupportedProtocols(Collection<String> protocols);
+    void removeSupportedProtocols(@Nonnull Collection<String> protocols);
 
     /**
      * Removes all the supported protocols from this role.
      * 
      */
-    public void removeAllSupportedProtocols();
+    void removeAllSupportedProtocols();
 
     /**
      * Gets the URI users should be sent to in the event of an error.
      * 
      * @return the URI users should be sent to in the event of an error
      */
-    public String getErrorURL();
+    @Nullable String getErrorURL();
 
     /**
      * Sets the URI users should be sent to in the event of an error.
      * 
      * @param errorURL the URI users should be sent to in the event of an error
      */
-    public void setErrorURL(String errorURL);
+    void setErrorURL(@Nullable final String errorURL);
 
     /**
      * Gets the Extensions child of this object.
      * 
      * @return the Extensions child of this object
      */
-    public Extensions getExtensions();
+    @Nullable Extensions getExtensions();
 
     /**
      * Sets the Extensions child of this object.
      * 
      * @param extensions the Extensions child of this object
      */
-    public void setExtensions(Extensions extensions);
+    void setExtensions(@Nullable final Extensions extensions);
 
     /**
      * Gets the key descriptors for this role.
      * 
      * @return the key descriptors for this role
      */
-    public List<KeyDescriptor> getKeyDescriptors();
+    @Nonnull @Live List<KeyDescriptor> getKeyDescriptors();
 
     /**
      * Gets the organization responsible for this role.
      * 
      * @return the organization responsible for this role
      */
-    public Organization getOrganization();
+    @Nullable Organization getOrganization();
 
     /**
      * Sets the organization responsible for this role.
      * 
      * @param organization the organization responsible for this role
      */
-    public void setOrganization(Organization organization);
+    void setOrganization(@Nullable final Organization organization);
 
     /**
-     * Gets an immutable list of {@link ContactPerson}s for this role.
+     * Gets list of {@link ContactPerson}s for this role.
      * 
      * @return list of {@link ContactPerson}s for this role
      */
-    public List<ContactPerson> getContactPersons();
+    @Nonnull @Live List<ContactPerson> getContactPersons();
 
     /**
-     * Gets a read-only list of endpoints for this role.
+     * Gets immutable list of endpoints for this role.
      * 
      * @return immutable list of endpoints for this role
      */
-    public List<Endpoint> getEndpoints();
+    @Nonnull @NotLive @Unmodifiable List<Endpoint> getEndpoints();
 
     /**
      * Gets a read-only list of endpoints for this role for the given type.
@@ -187,5 +191,5 @@ public interface RoleDescriptor extends SignableSAMLObject, TimeBoundSAMLObject,
      * 
      * @return immutable list of endpoints for this role
      */
-    public List<Endpoint> getEndpoints(QName type);
+    @Nonnull @NotLive @Unmodifiable List<Endpoint> getEndpoints(@Nonnull final QName type);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SPSSODescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SPSSODescriptor.java
index 18c703241..7297cb30c 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SPSSODescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SPSSODescriptor.java
@@ -20,99 +20,102 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.core.xml.schema.XSBooleanValue;
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
  * SAML 2.0 Metadata SPSSODescriptorType.
  */
 public interface SPSSODescriptor extends SSODescriptor {
+    
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SPSSODescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SPSSODescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SPSSODescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SPSSODescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /** "AuthnRequestsSigned" attribute's local name. */
-    @Nonnull @NotEmpty public static final String AUTH_REQUESTS_SIGNED_ATTRIB_NAME = "AuthnRequestsSigned";
+    @Nonnull @NotEmpty static final String AUTH_REQUESTS_SIGNED_ATTRIB_NAME = "AuthnRequestsSigned";
 
     /** "WantAssertionsSigned" attribute's local name. */
-    @Nonnull @NotEmpty public static final String WANT_ASSERTIONS_SIGNED_ATTRIB_NAME = "WantAssertionsSigned";
+    @Nonnull @NotEmpty static final String WANT_ASSERTIONS_SIGNED_ATTRIB_NAME = "WantAssertionsSigned";
 
     /**
      * Gets whether this service signs AuthN requests.
      * 
      * @return true of this service signs requests, false if not
      */
-    public Boolean isAuthnRequestsSigned();
+    @Nullable Boolean isAuthnRequestsSigned();
 
     /**
      * Gets whether this service signs AuthN requests.
      * 
      * @return true of this service signs requests, false if not
      */
-    public XSBooleanValue isAuthnRequestsSignedXSBoolean();
+    @Nullable XSBooleanValue isAuthnRequestsSignedXSBoolean();
 
     /**
      * Sets whether this service signs AuthN requests. Boolean values will be marshalled to either "true" or "false".
      * 
      * @param newIsSigned true of this service signs requests, false if not
      */
-    public void setAuthnRequestsSigned(Boolean newIsSigned);
+    void setAuthnRequestsSigned(@Nullable final Boolean newIsSigned);
 
     /**
      * Sets whether this service signs AuthN requests.
      * 
      * @param newIsSigned true of this service signs requests, false if not
      */
-    public void setAuthnRequestsSigned(XSBooleanValue newIsSigned);
+    void setAuthnRequestsSigned(@Nullable final XSBooleanValue newIsSigned);
 
     /**
      * Gets whether this service wants assertions signed.
      * 
      * @return true if this service wants assertions signed, false if not
      */
-    public Boolean getWantAssertionsSigned();
+    @Nullable Boolean getWantAssertionsSigned();
 
     /**
      * Gets whether this service wants assertions signed.
      * 
      * @return true if this service wants assertions signed, false if not
      */
-    public XSBooleanValue getWantAssertionsSignedXSBoolean();
+    @Nullable XSBooleanValue getWantAssertionsSignedXSBoolean();
 
     /**
      * Sets whether this service wants assertions signed. Boolean values will be marshalled to either "true" or "false".
      * 
      * @param newWantAssestionSigned true if this service wants assertions signed, false if not
      */
-    public void setWantAssertionsSigned(Boolean newWantAssestionSigned);
+    void setWantAssertionsSigned(@Nullable final Boolean newWantAssestionSigned);
 
     /**
      * Sets whether this service wants assertions signed.
      * 
      * @param newWantAssestionSigned true if this service wants assertions signed, false if not
      */
-    public void setWantAssertionsSigned(XSBooleanValue newWantAssestionSigned);
+    void setWantAssertionsSigned(@Nullable final XSBooleanValue newWantAssestionSigned);
 
     /**
-     * Gets an list of assertion consumer service {@link Endpoint}s for this service.
+     * Gets a list of assertion consumer service {@link Endpoint}s for this service.
      * 
      * @return list of assertion consumer service {@link Endpoint}s for this service
      */
-    public List<AssertionConsumerService> getAssertionConsumerServices();
+    @Nonnull @Live List<AssertionConsumerService> getAssertionConsumerServices();
 
     /**
      * Gets the default assertion consumer service.
@@ -128,14 +131,14 @@ public interface SPSSODescriptor extends SSODescriptor {
      * 
      * @return default assertion consumer service (or null if there are no assertion consumer services defined)
      */
-    public AssertionConsumerService getDefaultAssertionConsumerService();
+    @Nullable AssertionConsumerService getDefaultAssertionConsumerService();
 
     /**
-     * Gets an list of attribute consuming service descriptors for this service.
+     * Gets a list of attribute consuming service descriptors for this service.
      * 
      * @return list of attribute consuming service descriptors for this service
      */
-    public List<AttributeConsumingService> getAttributeConsumingServices();
+    @Nonnull @Live List<AttributeConsumingService> getAttributeConsumingServices();
 
     /**
      * Gets the default attribute consuming service.
@@ -151,5 +154,5 @@ public interface SPSSODescriptor extends SSODescriptor {
      * 
      * @return default attribute consuming service (or null if there are no attribute consuming services defined)
      */
-    public AttributeConsumingService getDefaultAttributeConsumingService();
+    @Nullable AttributeConsumingService getDefaultAttributeConsumingService();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SSODescriptor.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SSODescriptor.java
index 0c4f0fcd7..166da0c07 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SSODescriptor.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SSODescriptor.java
@@ -20,10 +20,12 @@ package org.opensaml.saml.saml2.metadata;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.xml.namespace.QName;
 
 import org.opensaml.saml.common.xml.SAMLConstants;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
@@ -32,17 +34,17 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SSODescriptor extends RoleDescriptor {
 
     /** Element name, no namespace. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SSODescriptor";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SSODescriptor";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
-            SAMLConstants.SAML20MD_PREFIX);
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME =
+            new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME, SAMLConstants.SAML20MD_PREFIX);
 
     /** Local name of the XSI type. */
-    @Nonnull @NotEmpty public static final String TYPE_LOCAL_NAME = "SSODescriptorType";
+    @Nonnull @NotEmpty static final String TYPE_LOCAL_NAME = "SSODescriptorType";
 
     /** QName of the XSI type. */
-    @Nonnull public static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
+    @Nonnull static final QName TYPE_NAME = new QName(SAMLConstants.SAML20MD_NS, TYPE_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 
     /**
@@ -50,7 +52,7 @@ public interface SSODescriptor extends RoleDescriptor {
      * 
      * @return list of artifact resolution services for this service
      */
-    public List<ArtifactResolutionService> getArtifactResolutionServices();
+    @Nonnull @Live List<ArtifactResolutionService> getArtifactResolutionServices();
 
     /**
      * Gets the default artifact resolution service.
@@ -67,26 +69,26 @@ public interface SSODescriptor extends RoleDescriptor {
      * @return default artifact resolution service (or null if there are no artifact resolution services defined)
      * 
      */
-    public ArtifactResolutionService getDefaultArtifactResolutionService();
+    @Nullable ArtifactResolutionService getDefaultArtifactResolutionService();
 
     /**
      * Gets a list of single logout services for this service.
      * 
      * @return list of single logout services for this service
      */
-    public List<SingleLogoutService> getSingleLogoutServices();
+    @Nonnull @Live List<SingleLogoutService> getSingleLogoutServices();
 
     /**
      * Gets a list of manage NameId services for this service.
      * 
      * @return list of manage NameId services for this service
      */
-    public List<ManageNameIDService> getManageNameIDServices();
+    @Nonnull @Live List<ManageNameIDService> getManageNameIDServices();
 
     /**
      * Gets the list of NameID formats this service supports.
      * 
      * @return NameID formats this service supports
      */
-    public List<NameIDFormat> getNameIDFormats();
+    @Nonnull @Live List<NameIDFormat> getNameIDFormats();
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleLogoutService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleLogoutService.java
index 50baed5e9..7edda89d6 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleLogoutService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleLogoutService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SingleLogoutService extends Endpoint {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SingleLogoutService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SingleLogoutService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleSignOnService.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleSignOnService.java
index 5727f211a..515c3f9a3 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleSignOnService.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/metadata/SingleSignOnService.java
@@ -30,9 +30,9 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface SingleSignOnService extends Endpoint {
 
     /** Element local name. */
-    @Nonnull @NotEmpty public static final String DEFAULT_ELEMENT_LOCAL_NAME = "SingleSignOnService";
+    @Nonnull @NotEmpty static final String DEFAULT_ELEMENT_LOCAL_NAME = "SingleSignOnService";
 
     /** Default element name. */
-    @Nonnull public static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
+    @Nonnull static final QName DEFAULT_ELEMENT_NAME = new QName(SAMLConstants.SAML20MD_NS, DEFAULT_ELEMENT_LOCAL_NAME,
             SAMLConstants.SAML20MD_PREFIX);
 }
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/AbstractSAML2NameIDGenerator.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/AbstractSAML2NameIDGenerator.java
index 09e05b89d..f8ebbadc4 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/AbstractSAML2NameIDGenerator.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/profile/AbstractSAML2NameIDGenerator.java
@@ -31,6 +31,7 @@ import org.opensaml.saml.common.SAMLObjectBuilder;
 import org.opensaml.saml.common.profile.AbstractNameIdentifierGenerator;
 import org.opensaml.saml.saml2.core.AuthnRequest;
 import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
 import org.slf4j.Logger;
 
 import com.google.common.base.Strings;
@@ -109,10 +110,13 @@ public abstract class AbstractSAML2NameIDGenerator extends AbstractNameIdentifie
         
         // Override the default behavior if the SP specifies a qualifier in its request.
         final AuthnRequest request = requestLookupStrategy.apply(profileRequestContext);
-        if (request != null && request.getNameIDPolicy() != null) {
-            final String qual = request.getNameIDPolicy().getSPNameQualifier();
-            if (!Strings.isNullOrEmpty(qual)) {
-                return qual;
+        if (request != null) {
+            final NameIDPolicy policy = request.getNameIDPolicy();
+            if (policy != null) {
+                final String qual = policy.getSPNameQualifier();
+                if (!Strings.isNullOrEmpty(qual)) {
+                    return qual;
+                }
             }
         }
         
diff --git a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java
index 58b4b548f..def929f39 100644
--- a/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java
+++ b/opensaml-saml-api/src/main/java/org/opensaml/saml/saml2/wssecurity/SAML20AssertionToken.java
@@ -31,7 +31,7 @@ import org.opensaml.soap.wssecurity.messaging.AbstractToken;
 public class SAML20AssertionToken extends AbstractToken<Assertion> {
     
     /** Get the successfully attested SubjectConfirmation. */
-    private SubjectConfirmation subjectConfirmation;
+    @Nullable private SubjectConfirmation subjectConfirmation;
 
     /**
      * Constructor.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list