[java-identity-provider] branch main updated: IDP-2069 - Null Handling Task
Scott Cantor
cantor.2 at osu.edu
Mon Mar 27 16:40:42 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=0795bf2a35fd263c4d30afeca0622386748dab9d
The following commit(s) were added to refs/heads/main by this push:
new 0795bf2a3 IDP-2069 - Null Handling Task
0795bf2a3 is described below
commit 0795bf2a35fd263c4d30afeca0622386748dab9d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 27 12:40:38 2023 -0400
IDP-2069 - Null Handling Task
https://shibboleth.atlassian.net/browse/IDP-2069
SAML 2 XMLObject null cleanup.
---
.../cas/proxy/impl/HttpClientProxyValidator.java | 2 +-
.../cas/service/impl/ReloadingServiceRegistry.java | 3 +-
.../cas/service/impl/ServiceEntityDescriptor.java | 61 +++++++++--------
.../flows/saml1/SAML1AttributeQueryFlowTest.java | 11 +--
.../flows/saml1/SAML1TestResponseValidator.java | 4 +-
.../flows/saml2/SAML2AttributeQueryFlowTest.java | 4 +-
.../flows/saml2/SAML2TestResponseValidator.java | 43 +++++++-----
.../SAML2TestStatusResponseTypeValidator.java | 27 +++++---
.../saml/nameid/AbstractSAML2NameIDGenerator.java | 12 ++--
.../AbstractProxyRestrictionAuditExtractor.java | 6 +-
.../audit/impl/AuthnContextAuditExtractor.java | 18 +++--
.../idp/saml/audit/impl/NameIDAuditExtractor.java | 79 +++++++++++++++-------
.../audit/impl/NameIDFormatAuditExtractor.java | 76 ++++++++++++---------
.../impl/NameIDPolicyFormatAuditExtractor.java | 14 ++--
.../NameIDPolicySPNameQualifierAuditExtractor.java | 13 ++--
.../audit/impl/SPNameQualifierAuditExtractor.java | 52 ++++++++------
.../audit/impl/ScopingIdPListAuditExtractor.java | 14 ++--
.../saml/audit/impl/StatusCodeAuditExtractor.java | 14 ++--
.../audit/impl/StatusMessageAuditExtractor.java | 12 ++--
.../audit/impl/SubStatusCodeAuditExtractor.java | 18 +++--
.../idp/saml/audit/impl/WriteFTICKSLog.java | 4 --
.../nameid/impl/BaseCryptoTransientDecoder.java | 5 --
.../idp/saml/nameid/impl/BaseTransientDecoder.java | 7 --
.../saml/nameid/impl/LegacyCanonicalization.java | 2 -
.../saml/nameid/impl/NameIDCanonicalization.java | 9 ++-
.../impl/NameIdentifierCanonicalization.java | 10 ++-
.../BaseIdPInitiatedSSORequestMessageDecoder.java | 3 +-
.../impl/InitializeAuthenticationContext.java | 20 ++++--
.../impl/InitializeOutboundMessageContext.java | 2 +-
.../InitializeOutboundMessageContextForError.java | 2 +-
.../impl/PopulateBindingAndEndpointContexts.java | 3 +-
.../PopulateInboundMessageContextWithSAMLSelf.java | 7 +-
.../impl/SpringAwareMessageDecoderFactory.java | 4 +-
.../impl/SpringAwareMessageEncoderFactory.java | 2 +-
.../AddAuthenticationStatementToAssertion.java | 7 +-
.../impl/FilterByQueriedAttributeDesignators.java | 11 ++-
.../impl/IdPInitiatedSSORequestMessageDecoder.java | 3 +-
.../impl/AddAttributeStatementToAssertion.java | 1 +
.../profile/impl/ContinueSAMLAuthentication.java | 35 +++-------
.../profile/impl/FilterByQueriedAttributes.java | 8 ++-
.../profile/impl/PopulateEncryptionParameters.java | 14 ++--
.../impl/ProcessAssertionsForAuthentication.java | 54 ++++++---------
.../saml2/profile/impl/ProcessLogoutRequest.java | 35 ++++++----
.../profile/impl/ProcessRequestedAuthnContext.java | 13 ++--
.../saml2/profile/impl/SAMLAuthnController.java | 6 +-
.../saml/saml2/profile/impl/SOAPLogoutRequest.java | 10 +--
.../profile/impl/ValidateSAMLAuthentication.java | 38 +++++++----
.../idp/saml/session/impl/AddLogoutRequest.java | 5 --
.../impl/BestMatchLocationLookupStrategy.java | 2 +-
.../session/impl/SAML1SPSessionSerializer.java | 2 +-
.../impl/SAML2SPSessionCreationStrategy.java | 17 +++--
.../session/impl/SAML2SPSessionSerializer.java | 4 +-
.../impl/CryptoTransientNameIDDecoderTest.java | 1 -
.../CryptoTransientNameIdentifierDecoderTest.java | 1 -
.../nameid/impl/StoredPersistentIdDecoderTest.java | 26 ++++---
.../saml/nameid/impl/TransformingDecoderTest.java | 4 +-
.../idp/saml/nameid/impl/TransientDecoderTest.java | 2 -
.../impl/ExtractSubjectFromRequestTest.java | 24 ++++---
.../impl/InitializeAuthenticationContextTest.java | 5 +-
...itializeOutboundMessageContextForErrorTest.java | 3 +-
.../impl/InitializeOutboundMessageContextTest.java | 3 +-
.../impl/AddAttributeStatementToAssertionTest.java | 8 ++-
.../saml2/profile/impl/AddAuthnRequestTest.java | 61 +++++++++++------
.../impl/AddAuthnStatementToAssertionTest.java | 29 +++++---
.../IdPInitiatedSSORequestMessageDecoderTest.java | 7 +-
.../profile/impl/PreProcessLogoutMessageTest.java | 6 +-
.../ProcessAssertionsForAuthenticationTest.java | 37 +++++-----
.../impl/ProcessRequestedAuthnContextTest.java | 5 +-
.../idp/ui/context/RelyingPartyUIContext.java | 14 ++--
69 files changed, 603 insertions(+), 461 deletions(-)
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
index 1083ae0b3..b096b97e4 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidator.java
@@ -67,7 +67,7 @@ import org.opensaml.security.x509.TrustedNamesCriterion;
import org.slf4j.Logger;
/**
- * Authenticates a CAS proxy callback endpoint using an {@link org.apache.hc.client5.http.classic.HttpClient} instance to establish
+ * Authenticates a CAS proxy callback endpoint using an {@HttpClient} instance to establish
* the connection and a {@link TrustEngine} to verify the TLS certificate presented by the remote peer. The endpoint
* is validated if and only if the following requirements are met:
*
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java
index 7cef52940..b8b6a58df 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ReloadingServiceRegistry.java
@@ -1,6 +1,5 @@
/*
- * Licensed to the Unive
-import net.shibboleth.shared.primitive.LoggerFactory;rsity Corporation for Advanced Internet Development,
+ * Licensed to the University Corporation for Advanced Internet Development,
* Inc. (UCAID) under one or more contributor license agreements. See the
* NOTICE file distributed with this work for additional information regarding
* copyright ownership. The UCAID licenses this file to You under the Apache
diff --git a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java
index a1eb6a8e9..8eb8fa212 100644
--- a/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java
+++ b/idp-cas-impl/src/main/java/net/shibboleth/idp/cas/service/impl/ServiceEntityDescriptor.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.cas.service.impl;
import java.time.Duration;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -28,6 +27,7 @@ import javax.annotation.Nullable;
import javax.xml.namespace.QName;
import net.shibboleth.idp.cas.service.Service;
+import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.StringSupport;
@@ -53,14 +53,15 @@ import org.opensaml.xmlsec.signature.Signature;
/**
* Adapts CAS protocol service metadata onto SAML metadata.
- *
- * @author Marvin S. Addison
+ *
+ * <p>Note that this is not a "usable" object in the sense that it raises exceptions on
+ * many operations and returns immutable collections that will throw if modified.</p>
*/
public class ServiceEntityDescriptor extends AbstractXMLObject implements EntityDescriptor {
/** Underlying CAS service. */
@Nonnull private final Service svc;
-
+
/**
* Creates a new instance that wraps the given CAS service.
*
@@ -87,7 +88,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
*
* {@inheritDoc}
*/
- public void setEntityID(final String id) {
+ public void setEntityID(@Nullable final String id) {
throw new UnsupportedOperationException();
}
@@ -101,7 +102,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
*
* {@inheritDoc}
*/
- public void setID(final String newID) {
+ public void setID(@Nullable final String newID) {
throw new UnsupportedOperationException();
}
@@ -115,47 +116,49 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
*
* {@inheritDoc}
*/
- public void setExtensions(final Extensions extensions) {
+ public void setExtensions(@Nullable final Extensions extensions) {
throw new UnsupportedOperationException();
}
/** {@inheritDoc} */
- public List<RoleDescriptor> getRoleDescriptors() {
- return Collections.emptyList();
+ @Nonnull @Live public List<RoleDescriptor> getRoleDescriptors() {
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- public List<RoleDescriptor> getRoleDescriptors(final QName typeOrName) {
- return Collections.emptyList();
+ @Nonnull @Live public List<RoleDescriptor> getRoleDescriptors(@Nonnull final QName typeOrName) {
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- public List<RoleDescriptor> getRoleDescriptors(final QName typeOrName, final String supportedProtocol) {
- return Collections.emptyList();
+ @Nonnull @Live public List<RoleDescriptor> getRoleDescriptors(@Nonnull final QName typeOrName,
+ @Nonnull final String supportedProtocol) {
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- public IDPSSODescriptor getIDPSSODescriptor(final String supportedProtocol) {
+ @Nullable public IDPSSODescriptor getIDPSSODescriptor(@Nonnull final String supportedProtocol) {
return null;
}
/** {@inheritDoc} */
- public SPSSODescriptor getSPSSODescriptor(final String supportedProtocol) {
+ @Nullable public SPSSODescriptor getSPSSODescriptor(@Nonnull final String supportedProtocol) {
return null;
}
/** {@inheritDoc} */
- public AuthnAuthorityDescriptor getAuthnAuthorityDescriptor(final String supportedProtocol) {
+ @Nullable public AuthnAuthorityDescriptor getAuthnAuthorityDescriptor(@Nonnull final String supportedProtocol) {
return null;
}
/** {@inheritDoc} */
- public AttributeAuthorityDescriptor getAttributeAuthorityDescriptor(final String supportedProtocol) {
+ @Nullable public AttributeAuthorityDescriptor getAttributeAuthorityDescriptor(
+ @Nonnull final String supportedProtocol) {
return null;
}
/** {@inheritDoc} */
- public PDPDescriptor getPDPDescriptor(final String supportedProtocol) {
+ @Nullable public PDPDescriptor getPDPDescriptor(@Nonnull final String supportedProtocol) {
return null;
}
@@ -165,12 +168,12 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
}
/** {@inheritDoc} */
- public void setAffiliationDescriptor(final AffiliationDescriptor descriptor) {
+ public void setAffiliationDescriptor(@Nullable final AffiliationDescriptor descriptor) {
throw new UnsupportedOperationException();
}
/** {@inheritDoc} */
- public Organization getOrganization() {
+ @Nullable public Organization getOrganization() {
return null;
}
@@ -179,17 +182,17 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
*
* {@inheritDoc}
*/
- public void setOrganization(final Organization organization) {
+ public void setOrganization(@Nullable final Organization organization) {
throw new UnsupportedOperationException();
}
/** {@inheritDoc} */
- public List<ContactPerson> getContactPersons() {
+ @Nonnull @Live public List<ContactPerson> getContactPersons() {
return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- public List<AdditionalMetadataLocation> getAdditionalMetadataLocations() {
+ @Nonnull @Live public List<AdditionalMetadataLocation> getAdditionalMetadataLocations() {
return CollectionSupport.emptyList();
}
@@ -199,7 +202,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
}
/** {@inheritDoc} */
- public Duration getCacheDuration() {
+ @Nullable public Duration getCacheDuration() {
return null;
}
@@ -208,7 +211,7 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
*
* {@inheritDoc}
*/
- public void setCacheDuration(final @Nullable Duration duration) {
+ public void setCacheDuration(@Nullable final Duration duration) {
throw new UnsupportedOperationException();
}
@@ -242,19 +245,19 @@ public class ServiceEntityDescriptor extends AbstractXMLObject implements Entity
}
/** {@inheritDoc} */
- public Instant getValidUntil() {
+ @Nullable public Instant getValidUntil() {
return Instant.now().plus(1, ChronoUnit.DAYS);
}
/** {@inheritDoc} */
- public void setValidUntil(final @Nullable Instant validUntil) {
+ public void setValidUntil(@Nullable final Instant validUntil) {
throw new UnsupportedOperationException();
}
/** {@inheritDoc} */
@Override
- public List<XMLObject> getOrderedChildren() {
- return CollectionSupport.emptyList();
+ @Nullable public List<XMLObject> getOrderedChildren() {
+ return null;
}
}
\ No newline at end of file
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1AttributeQueryFlowTest.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1AttributeQueryFlowTest.java
index 1e58e46de..8eb896e5a 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1AttributeQueryFlowTest.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1AttributeQueryFlowTest.java
@@ -32,6 +32,7 @@ import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
import org.opensaml.core.xml.io.Marshaller;
import org.opensaml.saml.common.SAMLObjectBuilder;
import org.opensaml.saml.saml1.core.AttributeDesignator;
+import org.opensaml.saml.saml1.core.AttributeQuery;
import org.opensaml.saml.saml1.core.ConfirmationMethod;
import org.opensaml.saml.saml1.core.NameIdentifier;
import org.opensaml.saml.saml1.core.Request;
@@ -152,8 +153,10 @@ public class SAML1AttributeQueryFlowTest extends AbstractSAML1FlowTest {
final Subject subject = SAML1ActionTestingSupport.buildSubject("jdoe");
final Request attributeQuery = SAML1ActionTestingSupport.buildAttributeQueryRequest(subject);
+ final AttributeQuery query = attributeQuery.getAttributeQuery();
+ assert query != null;
attributeQuery.setIssueInstant(Instant.now());
- attributeQuery.getAttributeQuery().setResource(SP_ENTITY_ID);
+ query.setResource(SP_ENTITY_ID);
attributeQuery.setID(IdentifierGenerationStrategy.getInstance(ProviderType.SECURE).generateIdentifier());
if (includeDesignators) {
@@ -164,17 +167,17 @@ public class SAML1AttributeQueryFlowTest extends AbstractSAML1FlowTest {
AttributeDesignator designator = designatorBuilder.buildObject();
designator.setAttributeNamespace(SAMLConstants.SAML1_ATTR_NAMESPACE_URI);
designator.setAttributeName("urn:mace:dir:attribute-def:eduPersonScopedAffiliation");
- attributeQuery.getAttributeQuery().getAttributeDesignators().add(designator);
+ query.getAttributeDesignators().add(designator);
designator = designatorBuilder.buildObject();
designator.setAttributeNamespace(SAMLConstants.SAML1_ATTR_NAMESPACE_URI);
designator.setAttributeName("urn:mace:dir:attribute-def:mail");
- attributeQuery.getAttributeQuery().getAttributeDesignators().add(designator);
+ query.getAttributeDesignators().add(designator);
designator = designatorBuilder.buildObject();
designator.setAttributeNamespace(SAMLConstants.SAML1_ATTR_NAMESPACE_URI);
designator.setAttributeName("urn:mace:dir:attribute-def:foo");
- attributeQuery.getAttributeQuery().getAttributeDesignators().add(designator);
+ query.getAttributeDesignators().add(designator);
}
final Envelope envelope = buildSOAP11Envelope(attributeQuery);
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1TestResponseValidator.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1TestResponseValidator.java
index 789d0bc7f..79f8c5335 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1TestResponseValidator.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml1/SAML1TestResponseValidator.java
@@ -431,8 +431,8 @@ public class SAML1TestResponseValidator {
public void assertNameIdentifier(@Nullable final NameIdentifier identifier) {
assert identifier!=null;
Assert.assertNotNull(identifier.getValue());
- if (nameIdentifier.getFormat() != null
- && !nameIdentifier.getFormat().equals(SAMLConstants.SAML1_NAMEID_TRANSIENT)) {
+ final String format = nameIdentifier.getFormat();
+ if (format != null && !format.equals(SAMLConstants.SAML1_NAMEID_TRANSIENT)) {
Assert.assertEquals(identifier.getValue(), nameIdentifier.getValue());
}
Assert.assertEquals(identifier.getFormat(), nameIdentifier.getFormat());
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java
index bec8cff99..c0a9e2163 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2AttributeQueryFlowTest.java
@@ -161,9 +161,9 @@ public class SAML2AttributeQueryFlowTest extends AbstractSAML2FlowTest {
final Subject subject = SAML2ActionTestingSupport.buildSubject("jdoe");
final AttributeQuery attributeQuery = SAML2ActionTestingSupport.buildAttributeQueryRequest(subject);
- attributeQuery.setIssueInstant(Instant.now());
- attributeQuery.getIssuer().setValue(SP_ENTITY_ID);
attributeQuery.setID(IdentifierGenerationStrategy.getInstance(ProviderType.SECURE).generateIdentifier());
+ attributeQuery.setIssueInstant(Instant.now());
+ attributeQuery.setIssuer(SAML2ActionTestingSupport.buildIssuer(SP_ENTITY_ID));
if (includeDesignators) {
final SAMLObjectBuilder<Attribute> designatorBuilder = (SAMLObjectBuilder<Attribute>)
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java
index c30517db7..6a7789a19 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestResponseValidator.java
@@ -48,6 +48,7 @@ import org.opensaml.saml.saml2.core.AuthnContextClassRef;
import org.opensaml.saml.saml2.core.AuthnStatement;
import org.opensaml.saml.saml2.core.Conditions;
import org.opensaml.saml.saml2.core.EncryptedAssertion;
+import org.opensaml.saml.saml2.core.Issuer;
import org.opensaml.saml.saml2.core.NameID;
import org.opensaml.saml.saml2.core.Response;
import org.opensaml.saml.saml2.core.Status;
@@ -288,15 +289,15 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
*
* @param subject the subject
*/
- public void validateSubject(@Nonnull final Subject subject) {
+ public void validateSubject(@Nullable final Subject subject) {
assertSubject(subject);
- assertNameID(subject.getNameID());
- assertSubjectConfirmations(subject.getSubjectConfirmations());
- final SubjectConfirmation subjectConfirmation = subject.getSubjectConfirmations().get(0);
+ assertNameID(subject != null ? subject.getNameID() : null);
+ assertSubjectConfirmations(subject != null ? subject.getSubjectConfirmations() : null);
+ final SubjectConfirmation subjectConfirmation = subject != null ? subject.getSubjectConfirmations().get(0) : null;
assertSubjectConfirmation(subjectConfirmation);
assertSubjectConfirmationMethod(subjectConfirmation);
if (validateSubjectConfirmationData) {
- assertSubjectConfirmationData(subjectConfirmation.getSubjectConfirmationData());
+ assertSubjectConfirmationData(subjectConfirmation != null ? subjectConfirmation.getSubjectConfirmationData() : null);
}
}
@@ -318,6 +319,7 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
final Conditions conditions = assertion.getConditions();
assertConditions(conditions);
+ assert conditions != null;
final List<AudienceRestriction> audienceRestrictions = conditions.getAudienceRestrictions();
assertAudienceRestrictions(audienceRestrictions);
@@ -344,7 +346,7 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
final AuthnStatement authnStatement = authnStatements.get(0);
assertAuthnStatement(authnStatement);
- assertAuthnContextClassRef(authnStatement.getAuthnContext().getAuthnContextClassRef());
+ assertAuthnContextClassRef(authnStatement.getAuthnContext());
}
/**
@@ -397,11 +399,13 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
*/
public void assertAssertion(@Nullable final Assertion assertion) {
assert assertion!=null;
- Assert.assertNotNull(assertion.getID());
- Assert.assertFalse(assertion.getID().isEmpty());
+ final String id = assertion.getID();
+ Assert.assertTrue(id != null && !id.isEmpty());
Assert.assertNotNull(assertion.getIssueInstant());
Assert.assertEquals(assertion.getVersion(), SAMLVersion.VERSION_20);
- Assert.assertEquals(assertion.getIssuer().getValue(), idpEntityID);
+ final Issuer issuer = assertion.getIssuer();
+ assert issuer != null;
+ Assert.assertEquals(issuer.getValue(), idpEntityID);
}
/**
@@ -474,7 +478,6 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
// TODO only in some cases ? Assert.assertNotNull(subjectConfirmationData.getNotBefore());
Assert.assertNotNull(subjectConfirmationData.getNotOnOrAfter());
Assert.assertNotNull(subjectConfirmationData.getRecipient());
- Assert.assertFalse(subjectConfirmationData.getRecipient().isEmpty());
}
/**
@@ -494,7 +497,8 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
public void assertNameID(@Nullable final NameID id) {
assert id!=null;
Assert.assertNotNull(id.getValue());
- if (nameID.getFormat() != null && !nameID.getFormat().equals(NameID.TRANSIENT)) {
+ final String format = id.getFormat();
+ if (format != null && !format.equals(NameID.TRANSIENT)) {
Assert.assertEquals(id.getValue(), nameID.getValue());
}
Assert.assertEquals(id.getFormat(), nameID.getFormat());
@@ -559,8 +563,10 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
assert authnStatement!=null;
Assert.assertNotNull(authnStatement.getAuthnInstant());
// TODO check authn instant time ?
- Assert.assertNotNull(authnStatement.getAuthnContext());
- Assert.assertNotNull(authnStatement.getAuthnContext().getAuthnContextClassRef());
+
+ final AuthnContext context = authnStatement.getAuthnContext();
+ assert context != null;
+ Assert.assertNotNull(context.getAuthnContextClassRef());
}
/**
@@ -568,8 +574,11 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
*
* @param authnContext the authn context
*/
- public void assertAuthnContextClassRef(@Nonnull final AuthnContextClassRef authnContext) {
- Assert.assertEquals(authnContext.getURI(), authnContextClassRef);
+ public void assertAuthnContextClassRef(@Nullable final AuthnContext authnContext) {
+ assert authnContext != null;
+ final AuthnContextClassRef ref = authnContext.getAuthnContextClassRef();
+ assert ref != null;
+ Assert.assertEquals(ref.getURI(), authnContextClassRef);
}
/**
@@ -638,8 +647,8 @@ public class SAML2TestResponseValidator extends SAML2TestStatusResponseTypeValid
* @param nameFormat the attribute name format
* @param friendlyName the attribute friendly name
*/
- public void assertAttributeName(@Nullable final Attribute attribute, @Nonnull final String name,
- @Nonnull final String nameFormat, @Nonnull final String friendlyName) {
+ public void assertAttributeName(@Nullable final Attribute attribute, @Nullable final String name,
+ @Nullable final String nameFormat, @Nullable final String friendlyName) {
assert attribute!=null;
Assert.assertEquals(attribute.getName(), name);
Assert.assertEquals(attribute.getNameFormat(), nameFormat);
diff --git a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestStatusResponseTypeValidator.java b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestStatusResponseTypeValidator.java
index 1b4e3be7d..7e8ff4d5e 100644
--- a/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestStatusResponseTypeValidator.java
+++ b/idp-conf/src/test/java/net/shibboleth/idp/test/flows/saml2/SAML2TestStatusResponseTypeValidator.java
@@ -21,8 +21,10 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.saml.common.SAMLVersion;
+import org.opensaml.saml.saml2.core.Issuer;
import org.opensaml.saml.saml2.core.Status;
import org.opensaml.saml.saml2.core.StatusCode;
+import org.opensaml.saml.saml2.core.StatusMessage;
import org.opensaml.saml.saml2.core.StatusResponseType;
import org.testng.Assert;
@@ -82,11 +84,13 @@ public class SAML2TestStatusResponseTypeValidator {
*/
public void assertResponse(@Nullable final StatusResponseType response) {
assert response!=null;
- Assert.assertNotNull(response.getID());
- Assert.assertFalse(response.getID().isEmpty());
+ final String id = response.getID();
+ Assert.assertTrue(id != null && !id.isEmpty());
Assert.assertNotNull(response.getIssueInstant());
Assert.assertEquals(response.getVersion(), (SAMLVersion.VERSION_20));
- Assert.assertEquals(response.getIssuer().getValue(), idpEntityID);
+ final Issuer issuer = response.getIssuer();
+ assert issuer != null;
+ Assert.assertEquals(issuer.getValue(), idpEntityID);
if (destination != null) {
Assert.assertEquals(response.getDestination(), destination);
}
@@ -106,13 +110,18 @@ public class SAML2TestStatusResponseTypeValidator {
*/
public void assertStatus(@Nullable final Status status) {
assert status!=null;
- Assert.assertNotNull(status.getStatusCode());
- Assert.assertEquals(status.getStatusCode().getValue(), statusCode);
+ final StatusCode code = status.getStatusCode();
+ assert code != null;
+ Assert.assertEquals(code.getValue(), statusCode);
if (statusCode != StatusCode.SUCCESS) {
- Assert.assertEquals(status.getStatusMessage().getValue(), statusMessage);
- if (status.getStatusCode().getStatusCode() != null) {
- Assert.assertEquals(status.getStatusCode().getStatusCode().getValue(), statusCodeNested);
+ final StatusMessage msg = status.getStatusMessage();
+ assert msg != null;
+ Assert.assertEquals(msg.getValue(), statusMessage);
+ final StatusCode nested = code.getStatusCode();
+ if (nested != null) {
+ Assert.assertEquals(nested.getValue(), statusCodeNested);
}
}
}
-}
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java
index fec155a6a..a2cb9ffb1 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/nameid/AbstractSAML2NameIDGenerator.java
@@ -27,6 +27,7 @@ import org.opensaml.messaging.context.navigate.MessageLookup;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
import com.google.common.base.Strings;
@@ -88,10 +89,13 @@ public class AbstractSAML2NameIDGenerator extends org.opensaml.saml.saml2.profil
// Override the default behavior if the SP specifies a qualifier in its request,
// matching the original base class behavior. SP request trumps local configuration.
final AuthnRequest request = requestLookupStrategy.apply(profileRequestContext);
- if (request != null && request.getNameIDPolicy() != null) {
- final String qual = request.getNameIDPolicy().getSPNameQualifier();
- if (!Strings.isNullOrEmpty(qual)) {
- return qual;
+ if (request != null) {
+ final NameIDPolicy policy = request.getNameIDPolicy();
+ if (policy != null) {
+ final String qual = policy.getSPNameQualifier();
+ if (!Strings.isNullOrEmpty(qual)) {
+ return qual;
+ }
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java
index 3d5ec6d5e..e8486b26b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AbstractProxyRestrictionAuditExtractor.java
@@ -26,6 +26,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.Assertion;
+import org.opensaml.saml.saml2.core.Conditions;
import org.opensaml.saml.saml2.core.ProxyRestriction;
import org.opensaml.saml.saml2.core.Response;
@@ -65,8 +66,9 @@ public abstract class AbstractProxyRestrictionAuditExtractor<T> implements Funct
if (response instanceof Response) {
for (final Assertion assertion : ((Response) response).getAssertions()) {
- if (assertion.getConditions() != null) {
- final ProxyRestriction condition = assertion.getConditions().getProxyRestriction();
+ final Conditions conditions = assertion.getConditions();
+ if (conditions != null) {
+ final ProxyRestriction condition = conditions.getProxyRestriction();
if (condition != null) {
return doApply(condition);
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AuthnContextAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AuthnContextAuditExtractor.java
index b45656895..fef5bac87 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AuthnContextAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/AuthnContextAuditExtractor.java
@@ -27,6 +27,8 @@ import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.saml1.core.AuthenticationStatement;
import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.AuthnContext;
+import org.opensaml.saml.saml2.core.AuthnContextClassRef;
+import org.opensaml.saml.saml2.core.AuthnContextDeclRef;
import org.opensaml.saml.saml2.core.AuthnStatement;
import net.shibboleth.shared.logic.Constraint;
@@ -65,12 +67,16 @@ public class AuthnContextAuditExtractor implements Function<ProfileRequestContex
for (final org.opensaml.saml.saml2.core.Assertion assertion
: ((org.opensaml.saml.saml2.core.Response) response).getAssertions()) {
for (final AuthnStatement statement : assertion.getAuthnStatements()) {
- if (statement.getAuthnContext() != null) {
- final AuthnContext ac = statement.getAuthnContext();
- if (ac.getAuthnContextClassRef() != null) {
- return ac.getAuthnContextClassRef().getURI();
- } else if (ac.getAuthnContextDeclRef() != null) {
- return ac.getAuthnContextDeclRef().getURI();
+ final AuthnContext ac = statement.getAuthnContext();
+ if (ac != null) {
+ final AuthnContextClassRef acClass = ac.getAuthnContextClassRef();
+ if (acClass != null && acClass.getURI() != null) {
+ return acClass.getURI();
+ }
+
+ final AuthnContextDeclRef acDecl = ac.getAuthnContextDeclRef();
+ if (acDecl != null && acDecl.getURI() != null) {
+ return acDecl.getURI();
}
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDAuditExtractor.java
index 1a8d0ca07..9ab9e265d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDAuditExtractor.java
@@ -27,10 +27,12 @@ import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.saml1.core.AttributeStatement;
import org.opensaml.saml.saml1.core.AuthenticationStatement;
import org.opensaml.saml.saml1.core.AuthorizationDecisionStatement;
+import org.opensaml.saml.saml1.core.NameIdentifier;
import org.opensaml.saml.saml1.core.SubjectStatement;
import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.LogoutRequest;
+import org.opensaml.saml.saml2.core.NameID;
import net.shibboleth.shared.logic.Constraint;
@@ -38,7 +40,7 @@ import net.shibboleth.shared.logic.Constraint;
public class NameIDAuditExtractor implements Function<ProfileRequestContext,String> {
/** Lookup strategy for message to read from. */
- @Nonnull private final Function<ProfileRequestContext,SAMLObject> responseLookupStrategy;
+ @Nonnull private final Function<ProfileRequestContext,SAMLObject> messageLookupStrategy;
/**
* Constructor.
@@ -46,18 +48,18 @@ public class NameIDAuditExtractor implements Function<ProfileRequestContext,Stri
* @param strategy lookup strategy for message
*/
public NameIDAuditExtractor(@Nonnull final Function<ProfileRequestContext,SAMLObject> strategy) {
- responseLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
+ messageLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
}
-// Checkstyle: CyclomaticComplexity OFF
+// Checkstyle: CyclomaticComplexity|ReturnCount|MethodLength OFF
/** {@inheritDoc} */
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
- SAMLObject msg = responseLookupStrategy.apply(input);
+ SAMLObject msg = messageLookupStrategy.apply(input);
if (msg != null) {
// Step down into ArtifactResponses.
- if (msg instanceof ArtifactResponse) {
- msg = ((ArtifactResponse) msg).getMessage();
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
}
if (msg instanceof org.opensaml.saml.saml2.core.Response) {
@@ -71,22 +73,24 @@ public class NameIDAuditExtractor implements Function<ProfileRequestContext,Stri
}
}
- } else if (msg instanceof LogoutRequest) {
-
- if (((LogoutRequest) msg).getNameID() != null) {
- return ((LogoutRequest) msg).getNameID().getValue();
+ } else if (msg instanceof LogoutRequest logout) {
+ final NameID nameID = logout.getNameID();
+ if (nameID != null) {
+ return nameID.getValue();
}
- } else if (msg instanceof AuthnRequest) {
- if (((AuthnRequest) msg).getSubject() != null &&
- ((AuthnRequest) msg).getSubject().getNameID() != null) {
- return ((AuthnRequest) msg).getSubject().getNameID().getValue();
+ } else if (msg instanceof AuthnRequest ar) {
+ final org.opensaml.saml.saml2.core.Subject subject = ar.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getValue();
+ }
}
- } else if (msg instanceof org.opensaml.saml.saml1.core.Response) {
+ } else if (msg instanceof org.opensaml.saml.saml1.core.Response resp) {
- for (final org.opensaml.saml.saml1.core.Assertion assertion
- : ((org.opensaml.saml.saml1.core.Response) msg).getAssertions()) {
+ for (final org.opensaml.saml.saml1.core.Assertion assertion : resp.getAssertions()) {
assert assertion != null;
final String id = apply(assertion);
if (id != null) {
@@ -94,17 +98,37 @@ public class NameIDAuditExtractor implements Function<ProfileRequestContext,Stri
}
}
- } else if (msg instanceof org.opensaml.saml.saml2.core.Assertion) {
- return apply((org.opensaml.saml.saml2.core.Assertion) msg);
- } else if (msg instanceof org.opensaml.saml.saml1.core.Assertion) {
- return apply((org.opensaml.saml.saml1.core.Assertion) msg);
+ } else if (msg instanceof org.opensaml.saml.saml2.core.SubjectQuery q) {
+
+ final org.opensaml.saml.saml2.core.Subject subject = q.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getValue();
+ }
+ }
+
+ } else if (msg instanceof org.opensaml.saml.saml1.core.SubjectQuery q) {
+
+ final org.opensaml.saml.saml1.core.Subject subject = q.getSubject();
+ if (subject != null) {
+ final NameIdentifier nameID = subject.getNameIdentifier();
+ if (nameID != null) {
+ return nameID.getValue();
+ }
+ }
+
+ } else if (msg instanceof org.opensaml.saml.saml2.core.Assertion a) {
+ return apply(a);
+ } else if (msg instanceof org.opensaml.saml.saml1.core.Assertion a) {
+ return apply(a);
}
}
return null;
}
-// Checkstyle: CyclomaticComplexity ON
-
+// Checkstyle: CyclomaticComplexity|ReturnCount|MethodLength ON
+
/**
* Apply function to an assertion.
*
@@ -113,9 +137,14 @@ public class NameIDAuditExtractor implements Function<ProfileRequestContext,Stri
* @return the identifier, or null
*/
@Nullable private String apply(@Nonnull final org.opensaml.saml.saml2.core.Assertion assertion) {
- if (assertion.getSubject() != null && assertion.getSubject().getNameID() != null) {
- return assertion.getSubject().getNameID().getValue();
+ final org.opensaml.saml.saml2.core.Subject subject = assertion.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getValue();
+ }
}
+
return null;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java
index d8ef5aef5..5b100e29b 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDFormatAuditExtractor.java
@@ -27,10 +27,12 @@ import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.saml1.core.AttributeStatement;
import org.opensaml.saml.saml1.core.AuthenticationStatement;
import org.opensaml.saml.saml1.core.AuthorizationDecisionStatement;
+import org.opensaml.saml.saml1.core.NameIdentifier;
import org.opensaml.saml.saml1.core.SubjectStatement;
import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.LogoutRequest;
+import org.opensaml.saml.saml2.core.NameID;
import net.shibboleth.shared.logic.Constraint;
@@ -49,15 +51,15 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
messageLookupStrategy = Constraint.isNotNull(strategy, "Response lookup strategy cannot be null");
}
-// Checkstyle: CyclomaticComplexity|ReturnCount OFF
+// Checkstyle: CyclomaticComplexity|ReturnCount|MethodLength OFF
/** {@inheritDoc} */
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
SAMLObject msg = messageLookupStrategy.apply(input);
if (msg != null) {
// Step down into ArtifactResponses.
- if (msg instanceof ArtifactResponse) {
- msg = ((ArtifactResponse) msg).getMessage();
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
}
if (msg instanceof org.opensaml.saml.saml2.core.Response) {
@@ -71,53 +73,60 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
}
}
- } else if (msg instanceof LogoutRequest) {
-
- if (((LogoutRequest) msg).getNameID() != null) {
- return ((LogoutRequest) msg).getNameID().getFormat();
+ } else if (msg instanceof LogoutRequest logout) {
+ final NameID nameID = logout.getNameID();
+ if (nameID != null) {
+ return nameID.getFormat();
}
- } else if (msg instanceof AuthnRequest) {
-
- if (((AuthnRequest) msg).getSubject() != null &&
- ((AuthnRequest) msg).getSubject().getNameID() != null) {
- return ((AuthnRequest) msg).getSubject().getNameID().getFormat();
+ } else if (msg instanceof AuthnRequest ar) {
+ final org.opensaml.saml.saml2.core.Subject subject = ar.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getFormat();
+ }
}
- } else if (msg instanceof org.opensaml.saml.saml1.core.Response) {
+ } else if (msg instanceof org.opensaml.saml.saml1.core.Response resp) {
- for (final org.opensaml.saml.saml1.core.Assertion assertion
- : ((org.opensaml.saml.saml1.core.Response) msg).getAssertions()) {
+ for (final org.opensaml.saml.saml1.core.Assertion assertion : resp.getAssertions()) {
assert assertion != null;
final String format = apply(assertion);
if (format != null) {
return format;
}
}
- } else if (msg instanceof org.opensaml.saml.saml2.core.SubjectQuery) {
+ } else if (msg instanceof org.opensaml.saml.saml2.core.SubjectQuery q) {
- if (((org.opensaml.saml.saml2.core.SubjectQuery) msg).getSubject() != null &&
- ((org.opensaml.saml.saml2.core.SubjectQuery) msg).getSubject().getNameID() != null) {
- return ((org.opensaml.saml.saml2.core.SubjectQuery) msg).getSubject().getNameID().getFormat();
+ final org.opensaml.saml.saml2.core.Subject subject = q.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getFormat();
+ }
}
- } else if (msg instanceof org.opensaml.saml.saml1.core.SubjectQuery) {
+
+ } else if (msg instanceof org.opensaml.saml.saml1.core.SubjectQuery q) {
- if (((org.opensaml.saml.saml1.core.SubjectQuery) msg).getSubject() != null &&
- ((org.opensaml.saml.saml1.core.SubjectQuery) msg).getSubject().getNameIdentifier() != null) {
- return ((org.opensaml.saml.saml1.core.SubjectQuery)
- msg).getSubject().getNameIdentifier().getFormat();
+ final org.opensaml.saml.saml1.core.Subject subject = q.getSubject();
+ if (subject != null) {
+ final NameIdentifier nameID = subject.getNameIdentifier();
+ if (nameID != null) {
+ return nameID.getFormat();
+ }
}
- } else if (msg instanceof org.opensaml.saml.saml2.core.Assertion) {
- return apply((org.opensaml.saml.saml2.core.Assertion) msg);
- } else if (msg instanceof org.opensaml.saml.saml1.core.Assertion) {
- return apply((org.opensaml.saml.saml1.core.Assertion) msg);
+ } else if (msg instanceof org.opensaml.saml.saml2.core.Assertion a) {
+ return apply(a);
+ } else if (msg instanceof org.opensaml.saml.saml1.core.Assertion a) {
+ return apply(a);
}
}
return null;
}
-// Checkstyle: CyclomaticComplexity|ReturnCount ON
+// Checkstyle: CyclomaticComplexity|ReturnCount|MethodLength ON
/**
* Apply function to an assertion.
@@ -127,9 +136,14 @@ public class NameIDFormatAuditExtractor implements Function<ProfileRequestContex
* @return the format, or null
*/
@Nullable private String apply(@Nonnull final org.opensaml.saml.saml2.core.Assertion assertion) {
- if (assertion.getSubject() != null && assertion.getSubject().getNameID() != null) {
- return assertion.getSubject().getNameID().getFormat();
+ final org.opensaml.saml.saml2.core.Subject subject = assertion.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getFormat();
+ }
}
+
return null;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java
index b8304ad06..f4e858fe4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicyFormatAuditExtractor.java
@@ -26,6 +26,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
import net.shibboleth.shared.logic.Constraint;
@@ -50,16 +51,15 @@ public class NameIDPolicyFormatAuditExtractor implements Function<ProfileRequest
if (msg != null) {
// Step down into ArtifactResponses.
- if (msg instanceof ArtifactResponse) {
- msg = ((ArtifactResponse) msg).getMessage();
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
}
- if (msg instanceof AuthnRequest) {
- if (((AuthnRequest) msg).getNameIDPolicy() != null &&
- ((AuthnRequest) msg).getNameIDPolicy().getFormat() != null) {
- return ((AuthnRequest) msg).getNameIDPolicy().getFormat();
+ if (msg instanceof AuthnRequest ar) {
+ final NameIDPolicy policy = ar.getNameIDPolicy();
+ if (policy != null) {
+ return policy.getFormat();
}
-
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java
index 9169528a4..af4f1487d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/NameIDPolicySPNameQualifierAuditExtractor.java
@@ -26,6 +26,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.SAMLObject;
import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
import net.shibboleth.shared.logic.Constraint;
@@ -51,14 +52,14 @@ public class NameIDPolicySPNameQualifierAuditExtractor implements Function<Profi
if (msg != null) {
// Step down into ArtifactResponses.
- if (msg instanceof ArtifactResponse) {
- msg = ((ArtifactResponse) msg).getMessage();
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
}
- if (msg instanceof AuthnRequest) {
- if (((AuthnRequest) msg).getNameIDPolicy() != null &&
- ((AuthnRequest) msg).getNameIDPolicy().getSPNameQualifier() != null) {
- return ((AuthnRequest) msg).getNameIDPolicy().getSPNameQualifier();
+ if (msg instanceof AuthnRequest ar) {
+ final NameIDPolicy policy = ar.getNameIDPolicy();
+ if (policy != null) {
+ return policy.getSPNameQualifier();
}
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java
index 620c11d5b..4523ac223 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SPNameQualifierAuditExtractor.java
@@ -28,7 +28,9 @@ import org.opensaml.saml.saml2.core.ArtifactResponse;
import org.opensaml.saml.saml2.core.Assertion;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.LogoutRequest;
+import org.opensaml.saml.saml2.core.NameID;
import org.opensaml.saml.saml2.core.Response;
+import org.opensaml.saml.saml2.core.Subject;
import org.opensaml.saml.saml2.core.SubjectQuery;
import net.shibboleth.shared.logic.Constraint;
@@ -55,34 +57,42 @@ public class SPNameQualifierAuditExtractor implements Function<ProfileRequestCon
if (msg != null) {
// Step down into ArtifactResponses.
- if (msg instanceof ArtifactResponse) {
- msg = ((ArtifactResponse) msg).getMessage();
+ if (msg instanceof ArtifactResponse ar) {
+ msg = ar.getMessage();
}
- if (msg instanceof Response) {
- for (final Assertion assertion : ((Response) msg).getAssertions()) {
+ if (msg instanceof Response resp) {
+ for (final Assertion assertion : resp.getAssertions()) {
+ assert assertion != null;
final String qualifier = apply(assertion);
if (qualifier != null) {
return qualifier;
}
}
- } else if (msg instanceof LogoutRequest) {
- if (((LogoutRequest) msg).getNameID() != null) {
- return ((LogoutRequest) msg).getNameID().getSPNameQualifier();
+ } else if (msg instanceof LogoutRequest logout) {
+ final NameID nameID = logout.getNameID();
+ if (nameID != null) {
+ return nameID.getSPNameQualifier();
}
- } else if (msg instanceof AuthnRequest) {
- if (((AuthnRequest) msg).getSubject() != null &&
- ((AuthnRequest) msg).getSubject().getNameID() != null) {
- return ((AuthnRequest) msg).getSubject().getNameID().getSPNameQualifier();
+ } else if (msg instanceof AuthnRequest ar) {
+ final Subject subject = ar.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getSPNameQualifier();
+ }
}
- } else if (msg instanceof SubjectQuery) {
- if (((SubjectQuery) msg).getSubject() != null &&
- ((SubjectQuery) msg).getSubject().getNameID() != null) {
- return ((SubjectQuery) msg).getSubject().getNameID().getSPNameQualifier();
+ } else if (msg instanceof SubjectQuery q) {
+ final Subject subject = q.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getSPNameQualifier();
+ }
}
- } else if (msg instanceof Assertion) {
- return apply((Assertion) msg);
+ } else if (msg instanceof Assertion a) {
+ return apply(a);
}
}
@@ -98,8 +108,12 @@ public class SPNameQualifierAuditExtractor implements Function<ProfileRequestCon
* @return the format, or null
*/
@Nullable private String apply(@Nonnull final Assertion assertion) {
- if (assertion.getSubject() != null && assertion.getSubject().getNameID() != null) {
- return assertion.getSubject().getNameID().getSPNameQualifier();
+ final Subject subject = assertion.getSubject();
+ if (subject != null) {
+ final NameID nameID = subject.getNameID();
+ if (nameID != null) {
+ return nameID.getFormat();
+ }
}
return null;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
index c2316e744..c5d0d5712 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/ScopingIdPListAuditExtractor.java
@@ -27,6 +27,7 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.IDPEntry;
+import org.opensaml.saml.saml2.core.IDPList;
import org.opensaml.saml.saml2.core.Scoping;
/**
@@ -48,11 +49,14 @@ public class ScopingIdPListAuditExtractor extends AbstractScopingAuditExtractor<
/** {@inheritDoc} */
@Override
@Nullable protected Collection<String> doApply(@Nullable final Scoping scoping) {
- if (scoping != null && scoping.getIDPList() != null) {
- return scoping.getIDPList().getIDPEntrys().stream()
- .map(IDPEntry::getProviderID)
- .filter(s -> s != null)
- .collect(Collectors.toUnmodifiableList());
+ if (scoping != null) {
+ final IDPList idpList = scoping.getIDPList();
+ if (idpList != null) {
+ return idpList.getIDPEntrys().stream()
+ .map(IDPEntry::getProviderID)
+ .filter(s -> s != null)
+ .collect(Collectors.toUnmodifiableList());
+ }
}
return null;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusCodeAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusCodeAuditExtractor.java
index f0abe94da..979d60ad2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusCodeAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusCodeAuditExtractor.java
@@ -48,17 +48,15 @@ public class StatusCodeAuditExtractor implements Function<ProfileRequestContext,
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
final SAMLObject response = responseLookupStrategy.apply(input);
if (response != null) {
- if (response instanceof Response) {
- final org.opensaml.saml.saml1.core.StatusCode sc =
- ((Response) response).getStatus() != null
- ? ((Response) response).getStatus().getStatusCode() : null;
+ if (response instanceof Response r) {
+ final org.opensaml.saml.saml1.core.Status status = r.getStatus();
+ final org.opensaml.saml.saml1.core.StatusCode sc = status != null ? status.getStatusCode() : null;
if (sc != null && sc.getValue() != null) {
return sc.getValue().getLocalPart();
}
- } else if (response instanceof StatusResponseType) {
- final org.opensaml.saml.saml2.core.StatusCode sc =
- ((StatusResponseType) response).getStatus() != null
- ? ((StatusResponseType) response).getStatus().getStatusCode() : null;
+ } else if (response instanceof StatusResponseType srt) {
+ final org.opensaml.saml.saml2.core.Status status = srt.getStatus();
+ final org.opensaml.saml.saml2.core.StatusCode sc = status != null ? status.getStatusCode() : null;
if (sc != null) {
return sc.getValue();
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusMessageAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusMessageAuditExtractor.java
index f5be0e975..a1612d362 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusMessageAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/StatusMessageAuditExtractor.java
@@ -48,17 +48,17 @@ public class StatusMessageAuditExtractor implements Function<ProfileRequestConte
@Nullable public String apply(@Nullable final ProfileRequestContext input) {
final SAMLObject response = responseLookupStrategy.apply(input);
if (response != null) {
- if (response instanceof Response) {
+ if (response instanceof Response r) {
+ final org.opensaml.saml.saml1.core.Status status = r.getStatus();
final org.opensaml.saml.saml1.core.StatusMessage msg =
- ((Response) response).getStatus() != null
- ? ((Response) response).getStatus().getStatusMessage() : null;
+ status != null ? status.getStatusMessage() : null;
if (msg != null) {
return msg.getValue();
}
- } else if (response instanceof StatusResponseType) {
+ } else if (response instanceof StatusResponseType srt) {
+ final org.opensaml.saml.saml2.core.Status status = srt.getStatus();
final org.opensaml.saml.saml2.core.StatusMessage msg =
- ((StatusResponseType) response).getStatus() != null
- ? ((StatusResponseType) response).getStatus().getStatusMessage() : null;
+ status != null ? status.getStatusMessage() : null;
if (msg != null) {
return msg.getValue();
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java
index 5eaa4e59e..e639d39f6 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/SubStatusCodeAuditExtractor.java
@@ -52,10 +52,9 @@ public class SubStatusCodeAuditExtractor implements Function<ProfileRequestConte
@Nullable public Collection<String> apply(@Nullable final ProfileRequestContext input) {
final SAMLObject response = responseLookupStrategy.apply(input);
if (response != null) {
- if (response instanceof Response) {
- org.opensaml.saml.saml1.core.StatusCode sc =
- ((Response) response).getStatus() != null
- ? ((Response) response).getStatus().getStatusCode() : null;
+ if (response instanceof Response r) {
+ final org.opensaml.saml.saml1.core.Status status = r.getStatus();
+ org.opensaml.saml.saml1.core.StatusCode sc = status != null ? status.getStatusCode() : null;
if (sc != null && sc.getStatusCode() != null) {
final Collection<String> values = new ArrayList<>(1);
do {
@@ -66,18 +65,17 @@ public class SubStatusCodeAuditExtractor implements Function<ProfileRequestConte
} while (sc.getStatusCode() != null);
return values;
}
- } else if (response instanceof StatusResponseType) {
- org.opensaml.saml.saml2.core.StatusCode sc =
- ((StatusResponseType) response).getStatus() != null
- ? ((StatusResponseType) response).getStatus().getStatusCode() : null;
+ } else if (response instanceof StatusResponseType srt) {
+ final org.opensaml.saml.saml2.core.Status status = srt.getStatus();
+ org.opensaml.saml.saml2.core.StatusCode sc = status != null ? status.getStatusCode() : null;
if (sc != null && sc.getStatusCode() != null) {
final Collection<String> values = new ArrayList<>(1);
do {
sc = sc.getStatusCode();
- if (sc.getValue() != null) {
+ if (sc != null && sc.getValue() != null) {
values.add(sc.getValue());
}
- } while (sc.getStatusCode() != null);
+ } while (sc != null && sc.getStatusCode() != null);
return values;
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
index 6deb877f2..71dfdd7ba 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/audit/impl/WriteFTICKSLog.java
@@ -32,7 +32,6 @@ import org.opensaml.saml.common.SAMLObject;
import net.shibboleth.idp.authn.context.SubjectContext;
import net.shibboleth.idp.authn.context.navigate.SubjectContextPrincipalLookupFunction;
import net.shibboleth.idp.profile.AbstractProfileAction;
-import net.shibboleth.profile.context.AuditContext;
import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
@@ -52,9 +51,6 @@ public class WriteFTICKSLog extends AbstractProfileAction {
/** Logging category to use. */
@Nonnull @NotEmpty public static final String FTICKS_LOG_CATEGORY = "Shibboleth-FTICKS";
-
- /** Strategy used to locate the {@link AuditContext} associated with a given {@link ProfileRequestContext}. */
- private Function<ProfileRequestContext,AuditContext> auditContextLookupStrategy;
/** Federation ID for log. */
@NonnullAfterInit @NotEmpty private String federationId;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
index bb1bee12e..618166279 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseCryptoTransientDecoder.java
@@ -81,11 +81,6 @@ public abstract class BaseCryptoTransientDecoder extends AbstractIdentifiableIni
@Nullable @NotEmpty protected String decode(@Nonnull final String transientId,
@Nonnull @NotEmpty final String requesterId) throws NameDecoderException {
checkComponentActive();
- if (null == transientId) {
- throw new NameDecoderException(getLogPrefix() + " Transient identifier was null");
- } else if (Strings.isNullOrEmpty(requesterId)) {
- throw new NameDecoderException(getLogPrefix() + " Requester ID was null");
- }
final String decodedId;
try {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java
index 484473e53..70ee3135d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/BaseTransientDecoder.java
@@ -26,8 +26,6 @@ import org.opensaml.storage.StorageRecord;
import org.opensaml.storage.StorageService;
import org.slf4j.Logger;
-import com.google.common.base.Strings;
-
import net.shibboleth.idp.saml.nameid.NameDecoderException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
@@ -81,11 +79,6 @@ public abstract class BaseTransientDecoder extends AbstractIdentifiableInitializ
@Nullable public String decode(@Nonnull final String transientId, @Nonnull @NotEmpty final String requesterId)
throws NameDecoderException {
checkComponentActive();
- if (null == transientId) {
- throw new NameDecoderException(getLogPrefix() + " Transient identifier was null");
- } else if (Strings.isNullOrEmpty(requesterId)) {
- throw new NameDecoderException(getLogPrefix() + " Requester ID was null");
- }
try {
final StorageRecord<?> record = idStore.read(TransientIdParameters.CONTEXT, transientId);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
index 35e04b16c..da492364a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/LegacyCanonicalization.java
@@ -23,8 +23,6 @@ import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import com.google.common.base.Predicates;
-
import net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalization.java
index 7f3fa2117..9761f0ad7 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalization.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIDCanonicalization.java
@@ -27,6 +27,7 @@ import javax.security.auth.Subject;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.NameIDType;
import org.opensaml.saml.saml2.profile.SAML2ObjectSupport;
import org.slf4j.Logger;
@@ -228,7 +229,13 @@ public class NameIDCanonicalization extends AbstractSubjectCanonicalizationActio
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT);
}
return false;
- } else if (!formatMatches(nameIDs.iterator().next().getNameID().getFormat(), c14nContext)) {
+ }
+
+ String format = nameIDs.iterator().next().getNameID().getFormat();
+ if (format == null) {
+ format = NameIDType.UNSPECIFIED;
+ }
+ if (!formatMatches(format, c14nContext)) {
c14nContext.setException(new SubjectCanonicalizationException("Format not supported"));
if (duringAction) {
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierCanonicalization.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierCanonicalization.java
index 545fb29d4..cba433d16 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierCanonicalization.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/NameIdentifierCanonicalization.java
@@ -229,8 +229,14 @@ public class NameIdentifierCanonicalization extends AbstractSubjectCanonicalizat
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT);
}
return false;
- } else if (!formatMatches(nameIdentifiers.iterator().next().getNameIdentifier().getFormat(),
- c14nContext)) {
+ }
+
+ String format = nameIdentifiers.iterator().next().getNameIdentifier().getFormat();
+ if (format == null) {
+ format = NameIdentifier.UNSPECIFIED;
+ }
+
+ if (!formatMatches(format, c14nContext)) {
c14nContext.setException(new SubjectCanonicalizationException("Format not supported"));
if (duringAction) {
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_SUBJECT);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseIdPInitiatedSSORequestMessageDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseIdPInitiatedSSORequestMessageDecoder.java
index 1d8ff3ae5..be4ee86ed 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseIdPInitiatedSSORequestMessageDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/BaseIdPInitiatedSSORequestMessageDecoder.java
@@ -65,7 +65,8 @@ public abstract class BaseIdPInitiatedSSORequestMessageDecoder extends AbstractH
@Nonnull private final Logger protocolMessageLog = LoggerFactory.getLogger("PROTOCOL_MESSAGE");
/** ID generator. */
- @Nonnull private final IdentifierGenerationStrategy idGenerator = IdentifierGenerationStrategy.getInstance(ProviderType.UUID);
+ @Nonnull private final IdentifierGenerationStrategy idGenerator =
+ IdentifierGenerationStrategy.getInstance(ProviderType.UUID);
/**
* Get an optional {@link BindingDescriptor} to inject into
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
index df53f8709..56a68f3e2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContext.java
@@ -35,6 +35,7 @@ import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.IDPEntry;
import org.opensaml.saml.saml2.core.IDPList;
import org.opensaml.saml.saml2.core.Scoping;
+import org.opensaml.saml.saml2.core.Subject;
import org.slf4j.Logger;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.idp.authn.config.navigate.ForceAuthnProfileConfigPredicate;
@@ -176,12 +177,20 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
if (!processScoping(profileRequestContext, authnCtx)) {
return;
}
- authnCtx.setForceAuthn(ar.isForceAuthn());
- authnCtx.setIsPassive(ar.isPassive());
+
+ Boolean flag = ar.isForceAuthn();
+ if (flag != null) {
+ authnCtx.setForceAuthn(flag);
+ }
+ flag = ar.isPassive();
+ if (flag != null) {
+ authnCtx.setIsPassive(flag);
+ }
// On an inbound Subject, migrate the populated SubjectContext into the required name
// field in the new AuthenticationContext.
- if (ar.getSubject() != null && ar.getSubject().getNameID() != null) {
+ final Subject requestedSubject = ar.getSubject();
+ if (requestedSubject != null && requestedSubject.getNameID() != null) {
final SubjectContext subjectCtx = profileRequestContext.getSubcontext(SubjectContext.class);
if (subjectCtx != null && subjectCtx.getPrincipalName() != null) {
authnCtx.setRequiredName(subjectCtx.getPrincipalName());
@@ -265,8 +274,9 @@ public class InitializeAuthenticationContext extends AbstractProfileAction {
authenticationContext.getProxiableAuthorities().addAll(requestedAuthorities);
}
- if (scoping.getProxyCount() != null) {
- authenticationContext.setProxyCount(Integer.max(0, scoping.getProxyCount()));
+ final Integer proxyCount = scoping.getProxyCount();
+ if (proxyCount != null) {
+ authenticationContext.setProxyCount(Integer.max(0, proxyCount));
}
return true;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
index ce6e5767a..d6be5c915 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContext.java
@@ -132,7 +132,7 @@ public class InitializeOutboundMessageContext extends AbstractProfileAction {
selfContext.setEntityId(selfIdentityLookupStrategy.apply(profileRequestContext));
final SAMLPeerEntityContext peerContext = msgCtx.ensureSubcontext(SAMLPeerEntityContext.class);
- SAMLPeerEntityContext pec = peerEntityCtx;
+ final SAMLPeerEntityContext pec = peerEntityCtx;
assert pec!=null;
peerContext.setEntityId(pec.getEntityId());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java
index ae1429f63..3082e23b5 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForError.java
@@ -173,7 +173,7 @@ public class InitializeOutboundMessageContextForError extends AbstractProfileAct
// Copy SAML peer context and metadata if it exists.
if (peerEntityCtx != null) {
final SAMLPeerEntityContext peerContext = msgCtx.ensureSubcontext(SAMLPeerEntityContext.class);
- SAMLPeerEntityContext pec = peerEntityCtx;
+ final SAMLPeerEntityContext pec = peerEntityCtx;
assert pec!=null;
peerContext.setEntityId(pec.getEntityId());
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
index c7b00152e..ecb699e02 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
@@ -358,7 +358,8 @@ public class PopulateBindingAndEndpointContexts extends AbstractProfileAction {
inboundMessage instanceof AuthnRequest
&& ssoConfig.isSkipEndpointValidationWhenSigned(profileRequestContext)
&& !ssoConfig.isIgnoreRequestSignatures(profileRequestContext)
- && SAMLBindingSupport.isMessageSigned(Constraint.isNotNull(imc, "No Inboud Message Context"));
+ && SAMLBindingSupport.isMessageSigned(
+ Constraint.isNotNull(imc, "No Inboud Message Context"));
}
}
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateInboundMessageContextWithSAMLSelf.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateInboundMessageContextWithSAMLSelf.java
index fd054f1c0..1693434f6 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateInboundMessageContextWithSAMLSelf.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateInboundMessageContextWithSAMLSelf.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.profile.impl;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.action.ActionSupport;
@@ -70,9 +69,8 @@ public class PopulateInboundMessageContextWithSAMLSelf extends AbstractProfileAc
/** {@inheritDoc} */
@Override protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
- final MessageContext msgCtx = Constraint.isNotNull(profileRequestContext.getInboundMessageContext(), "No Inbound Message Context");
-
- final SAMLSelfEntityContext selfContext = msgCtx.ensureSubcontext(SAMLSelfEntityContext.class);
+ final SAMLSelfEntityContext selfContext =
+ profileRequestContext.ensureInboundMessageContext().ensureSubcontext(SAMLSelfEntityContext.class);
selfContext.setEntityId(selfIdentityLookupStrategy.apply(profileRequestContext));
log.debug("{} Populated inbound message context with SAML self entityID: {}", getLogPrefix(),
@@ -83,4 +81,5 @@ public class PopulateInboundMessageContextWithSAMLSelf extends AbstractProfileAc
}
}
+
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageDecoderFactory.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageDecoderFactory.java
index 4c576366c..b30a4da80 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageDecoderFactory.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageDecoderFactory.java
@@ -17,7 +17,6 @@
package net.shibboleth.idp.saml.profile.impl;
-import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;
@@ -33,6 +32,7 @@ import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.StringSupport;
@@ -57,7 +57,7 @@ public class SpringAwareMessageDecoderFactory extends AbstractInitializableCompo
/** Constructor. */
public SpringAwareMessageDecoderFactory() {
- beanMappings = Collections.emptyMap();
+ beanMappings = CollectionSupport.emptyMap();
}
/**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageEncoderFactory.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageEncoderFactory.java
index 591dd7094..3125260af 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageEncoderFactory.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/SpringAwareMessageEncoderFactory.java
@@ -70,7 +70,7 @@ public class SpringAwareMessageEncoderFactory extends AbstractInitializableCompo
}
final SAMLBindingContext bindingContext = obmc.getSubcontext(SAMLBindingContext.class);
- Object desc = bindingContext == null ? null : bindingContext.getBindingDescriptor();
+ final Object desc = bindingContext == null ? null : bindingContext.getBindingDescriptor();
if (bindingContext == null || desc == null || !(desc instanceof BindingDescriptor)) {
log.warn("BindingDescriptor was not available, unable to lookup message encoder");
return null;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java
index 02c7b2cd8..8692bbdc2 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/AddAuthenticationStatementToAssertion.java
@@ -46,7 +46,6 @@ import net.shibboleth.idp.saml.profile.impl.BaseAddAuthenticationStatementToAsse
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.security.IdentifierGenerationStrategy;
/**
* Action that builds an {@link AuthenticationStatement} and adds it to an {@link Assertion} returned by a lookup
@@ -80,9 +79,6 @@ public class AddAuthenticationStatementToAssertion extends BaseAddAuthentication
/** Strategy used to determine the AuthenticationMethod attribute. */
@NonnullAfterInit private Function<ProfileRequestContext,AuthenticationMethodPrincipal> methodLookupStrategy;
-
- /** The generator to use. */
- @Nullable private IdentifierGenerationStrategy idGenerator;
/**
* Set the strategy used to locate the {@link Assertion} to operate on.
@@ -160,7 +156,8 @@ public class AddAuthenticationStatementToAssertion extends BaseAddAuthentication
final AuthenticationStatement statement = statementBuilder.buildObject();
statement.setAuthenticationInstant(getAuthenticationResult().getAuthenticationInstant());
- final Principal matchingPrincipal = requestedPrincipalContext != null ? requestedPrincipalContext.getMatchingPrincipal() : null;
+ final Principal matchingPrincipal =
+ requestedPrincipalContext != null ? requestedPrincipalContext.getMatchingPrincipal() : null;
if (matchingPrincipal != null && matchingPrincipal instanceof AuthenticationMethodPrincipal) {
statement.setAuthenticationMethod(matchingPrincipal.getName());
} else {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
index c75615e2d..8705be40a 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/FilterByQueriedAttributeDesignators.java
@@ -65,9 +65,6 @@ import net.shibboleth.shared.service.ServiceableComponent;
*/
public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
- /** Unused?. */
- private static final String List = null;
-
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(FilterByQueriedAttributeDesignators.class);
@@ -88,9 +85,11 @@ public class FilterByQueriedAttributeDesignators extends AbstractProfileAction {
/** Constructor. */
public FilterByQueriedAttributeDesignators() {
- final Function<ProfileRequestContext,AttributeContext> acls = new ChildContextLookup<>(AttributeContext.class).compose(
- new ChildContextLookup<>(RelyingPartyContext.class));
- final Function<ProfileRequestContext,Request> rls = new MessageLookup<>(Request.class).compose(new InboundMessageContextLookup());
+ final Function<ProfileRequestContext,AttributeContext> acls =
+ new ChildContextLookup<>(AttributeContext.class).compose(
+ new ChildContextLookup<>(RelyingPartyContext.class));
+ final Function<ProfileRequestContext,Request> rls =
+ new MessageLookup<>(Request.class).compose(new InboundMessageContextLookup());
assert acls != null && rls != null;
attributeContextLookupStrategy = acls;
requestLookupStrategy = rls;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoder.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoder.java
index ee8856870..dbc7d4f49 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoder.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml1/profile/impl/IdPInitiatedSSORequestMessageDecoder.java
@@ -79,7 +79,8 @@ public class IdPInitiatedSSORequestMessageDecoder extends BaseIdPInitiatedSSOReq
*/
protected void populateBindingContext(@Nonnull final MessageContext messageContext)
throws MessageDecodingException {
- final IdPInitiatedSSORequest message = Constraint.isNotNull((IdPInitiatedSSORequest) messageContext.getMessage(), "No message");
+ final IdPInitiatedSSORequest message =
+ Constraint.isNotNull((IdPInitiatedSSORequest) messageContext.getMessage(), "No message");
final String relayState = message.getRelayState();
if (relayState == null) {
throw new MessageDecodingException("Legacy Shibboleth authentication requests require a target parameter");
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
index 3b5d352fe..54744bf45 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
@@ -162,6 +162,7 @@ public class AddAttributeStatementToAssertion extends BaseAddAttributeStatementT
final AttributeStatement statement = statementBuilder.buildObject();
for (final Attribute attribute : encodedAttributes) {
+ assert attribute != null;
final Attribute existing = findExistingAttribute(statement, attribute);
if (existing != null) {
final Iterator<XMLObject> newValues = attribute.getAttributeValues().iterator();
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java
index 08954e636..b60472664 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ContinueSAMLAuthentication.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.saml2.profile.impl;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
@@ -53,35 +52,23 @@ public class ContinueSAMLAuthentication extends AbstractAuthenticationAction {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ContinueSAMLAuthentication.class);
-
- /** Context containing the result to examine. */
- @Nullable private ExternalAuthenticationContext extContext;
-
+
+// Checkstyle: CyclomaticComplexity OFF
/** {@inheritDoc} */
@Override
- protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
-
- if (!super.doPreExecute(profileRequestContext, authenticationContext)) {
- return false;
- }
-
- extContext = authenticationContext.getSubcontext(ExternalAuthenticationContext.class);
+
+ final ExternalAuthenticationContext extContext =
+ authenticationContext.getSubcontext(ExternalAuthenticationContext.class);
if (extContext == null) {
log.debug("{} No ExternalAuthenticationContext available within authentication context", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_AUTHN_CTX);
- return false;
+ return;
}
-
- return true;
- }
-
- /** {@inheritDoc} */
- @Override
- protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
- @Nonnull final AuthenticationContext authenticationContext) {
- final MessageContext imc = profileRequestContext != null ? profileRequestContext.getInboundMessageContext() : null;
- final ExternalAuthenticationContext extContext = this.extContext;
+
+ final MessageContext imc =
+ profileRequestContext != null ? profileRequestContext.getInboundMessageContext() : null;
assert extContext!= null;
final String authnError = extContext.getAuthnError();
if (authnError != null) {
@@ -117,5 +104,5 @@ public class ContinueSAMLAuthentication extends AbstractAuthenticationAction {
return;
}
}
-
+// Checkstyle: CyclomaticComplexity ON
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
index 29bcce955..d34cd48da 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/FilterByQueriedAttributes.java
@@ -143,7 +143,8 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
return false;
}
- final AttributeQuery localQuery = query = queryLookupStrategy.apply(profileRequestContext);
+ query = queryLookupStrategy.apply(profileRequestContext);
+ final AttributeQuery localQuery = query;
if (localQuery == null || localQuery.getAttributes().isEmpty()) {
log.debug("No queried Attributes found, nothing to do ");
@@ -170,13 +171,15 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final Multimap<String,IdPAttribute> mapped = HashMultimap.create();
+ assert mapped != null;
final AttributeQuery localQuery = query;
- AttributeContext localAttributeContext = attributeContext;
+ final AttributeContext localAttributeContext = attributeContext;
assert localQuery!=null && localAttributeContext!=null;
try (final ServiceableComponent<AttributeTranscoderRegistry> component =
transcoderRegistry.getServiceableComponent()) {
for (final Attribute designator : localQuery.getAttributes()) {
+ assert designator != null;
try {
decodeAttribute(component.getComponent(), profileRequestContext, designator, mapped);
} catch (final AttributeDecodingException e) {
@@ -239,6 +242,7 @@ public class FilterByQueriedAttributes extends AbstractProfileAction {
}
for (final TranscodingRule rules : transcodingRules) {
+ assert rules != null;
final AttributeTranscoder<Attribute> transcoder = TranscoderSupport.getTranscoder(rules);
final IdPAttribute decodedAttribute = transcoder.decode(profileRequestContext, input, rules);
if (decodedAttribute != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
index 7abbd2ee2..46c2d6560 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/PopulateEncryptionParameters.java
@@ -39,6 +39,7 @@ import org.opensaml.saml.criterion.ProtocolCriterion;
import org.opensaml.saml.criterion.RoleDescriptorCriterion;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.NameID;
+import org.opensaml.saml.saml2.core.NameIDPolicy;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
import org.opensaml.saml.saml2.profile.context.EncryptionContext;
import org.opensaml.xmlsec.EncryptionConfiguration;
@@ -255,15 +256,15 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
msg = imc.getMessage();
}
- if (msg instanceof AuthnRequest) {
- final AuthnRequest request = (AuthnRequest) msg;
- if (request.getNameIDPolicy() != null) {
- final String requestedFormat = request.getNameIDPolicy().getFormat();
+ if (msg instanceof AuthnRequest req) {
+ final NameIDPolicy policy = req.getNameIDPolicy();
+ if (policy != null) {
+ final String requestedFormat = policy.getFormat();
if (requestedFormat != null && NameID.ENCRYPTED.equals(requestedFormat)) {
log.debug("{} Request asked for encrypted identifier, disregarding installed predicate");
encryptIdentifiers = true;
}
- }
+ }
} else if (msg != null && rpContext.getProfileConfig() instanceof SingleLogoutProfileConfiguration) {
log.debug("{} Inbound logout message, nothing to do", getLogPrefix());
return false;
@@ -359,7 +360,8 @@ public class PopulateEncryptionParameters extends AbstractProfileAction {
*
* @return the criteria set to use
*/
- @Nonnull private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext, @Nonnull List<EncryptionConfiguration> configurations) {
+ @Nonnull private CriteriaSet buildCriteriaSet(@Nonnull final ProfileRequestContext profileRequestContext,
+ @Nonnull final List<EncryptionConfiguration> configurations) {
final CriteriaSet criteria = new CriteriaSet(new EncryptionConfigurationCriterion(configurations));
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
index ff61535ae..4394f8bfc 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthentication.java
@@ -46,8 +46,6 @@ import org.slf4j.Logger;
import net.shibboleth.idp.authn.AbstractAuthenticationAction;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
-import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -58,7 +56,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAction {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(ProcessAssertionsForAuthentication.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ProcessAssertionsForAuthentication.class);
/** The resolver for the response to be processed. */
@Nonnull private Function<ProfileRequestContext, Response> responseResolver;
@@ -73,17 +71,15 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
@Nonnull private Function<Assertion,AuthnStatement> authnStatementSelectionStrategy;
/** The Response to process. */
- private Response response;
+ @Nullable private Response response;
/** The SAML authentication context. */
- private SAMLAuthnContext samlAuthnContext;
+ @Nullable private SAMLAuthnContext samlAuthnContext;
/**
* Constructor.
*/
public ProcessAssertionsForAuthentication() {
- super();
-
responseResolver = new DefaultResponseResolver().compose(
new ChildContextLookup<>(ProfileRequestContext.class).compose(
new ChildContextLookup<>(AuthenticationContext.class)));
@@ -121,7 +117,8 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
*/
public void setAuthnAssertionSelectionStrategy(@Nonnull final Function<List<Assertion>, Assertion> strategy) {
checkSetterPreconditions();
- authnAssertionSelectionStrategy = strategy;
+ authnAssertionSelectionStrategy =
+ Constraint.isNotNull(strategy, "Authentication assertion selection strategy cannot be null");
}
/**
@@ -131,7 +128,8 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
*/
public void setAuthnStatementSelectionStrategy(@Nonnull final Function<Assertion, AuthnStatement> strategy) {
checkSetterPreconditions();
- authnStatementSelectionStrategy = strategy;
+ authnStatementSelectionStrategy =
+ Constraint.isNotNull(strategy, "Authentication statement selection strategy cannot be null");
}
/**
@@ -141,7 +139,7 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
*/
public void setResponseResolver(@Nonnull final Function<ProfileRequestContext, Response> strategy) {
checkSetterPreconditions();
- responseResolver = strategy;
+ responseResolver = Constraint.isNotNull(strategy, "Response resolver strategy cannot be null");
}
/**
@@ -152,25 +150,7 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
public void setSAMLAuthnContextLookupStrategy(
@Nonnull final Function<ProfileRequestContext,SAMLAuthnContext> strategy) {
checkSetterPreconditions();
- samlContextLookupStrategy = strategy;
- }
-
- /** {@inheritDoc} */
- protected void doInitialize() throws ComponentInitializationException {
- super.doInitialize();
-
- if (authnAssertionSelectionStrategy == null) {
- throw new ComponentInitializationException("Authentication Assertion selection strategy cannot be null");
- }
- if (authnStatementSelectionStrategy == null) {
- throw new ComponentInitializationException("AuthnStatement selection strategy cannot be null");
- }
- if (responseResolver == null) {
- throw new ComponentInitializationException("Response resolver cannot be null");
- }
- if (samlContextLookupStrategy == null) {
- throw new ComponentInitializationException("SAMLAuthnContext lookup strategy cannot be null");
- }
+ samlContextLookupStrategy = Constraint.isNotNull(strategy, "SAMLAuthnContext lookup strategy cannot be null");
}
/** {@inheritDoc} */
@@ -182,7 +162,8 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
}
response = responseResolver.apply(profileRequestContext);
- if (response == null || response.getAssertions() == null || response.getAssertions().isEmpty()) {
+ final Response localResponse = response;
+ if (localResponse == null || localResponse.getAssertions() == null || localResponse.getAssertions().isEmpty()) {
log.info("{} Profile context contained no candidate Assertions to process. Skipping further processing",
getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.INVALID_CREDENTIALS);
@@ -203,18 +184,21 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final AuthenticationContext authenticationContext) {
+ final Response localResponse = response;
+ assert localResponse != null;
+
// Completely remove any non-valid Assertions from the Response
- final List<Assertion> nonValid = response.getAssertions().stream()
+ final List<Assertion> nonValid = localResponse.getAssertions().stream()
.filter(new AssertionIsValid().negate())
.collect(Collectors.toList());
log.debug("{} Removing {} non-valid Assertions from Response", getLogPrefix(), nonValid.size());
- response.getAssertions().removeAll(nonValid);
+ localResponse.getAssertions().removeAll(nonValid);
// For authn purposes, select only Assertions which contain at least 1 AuthnStatement and a confirmed Subject
final Predicate<Assertion> selector = new AssertionContainsAuthenticationStatement()
.and(new AssertionContainsConfirmedSubject());
- final List<Assertion> assertions = response.getAssertions().stream()
+ final List<Assertion> assertions = localResponse.getAssertions().stream()
.filter(selector)
.collect(Collectors.toList());
if (assertions.isEmpty()) {
@@ -254,8 +238,8 @@ public class ProcessAssertionsForAuthentication extends AbstractAuthenticationAc
}
}
- samlAuthnContext.setAuthnStatement(authnStatement);
- samlAuthnContext.setSubject(authnAssertion.getSubject());
+ assert samlAuthnContext != null;
+ samlAuthnContext.setAuthnStatement(authnStatement).setSubject(authnAssertion.getSubject());
}
/**
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
index d069947f8..a82995df0 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessLogoutRequest.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.saml2.profile.impl;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Set;
@@ -57,6 +56,7 @@ import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.saml.saml2.profile.config.navigate.QualifiedNameIDFormatsLookupFunction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -152,7 +152,7 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
qualifiedNameIDFormatsLookupStrategy = new QualifiedNameIDFormatsLookupFunction();
- qualifiedNameIDFormats = Collections.emptySet();
+ qualifiedNameIDFormats = CollectionSupport.emptySet();
setAssertingPartyLookupStrategy(new IssuerLookupFunction());
setRelyingPartyLookupStrategy(new RelyingPartyIdLookupFunction());
@@ -287,16 +287,20 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
return false;
}
- final LogoutRequest request = logoutRequest = logoutRequestLookupStrategy.apply(profileRequestContext);
+ logoutRequest = logoutRequestLookupStrategy.apply(profileRequestContext);
+ final LogoutRequest request = logoutRequest;
if (request == null) {
log.warn("{} No LogoutRequest found to process", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
return false;
- } else if (request.getNameID() == null) {
+ }
+
+ final NameID nid = request.getNameID();
+ if (nid == null) {
log.warn("{} LogoutRequest did not contain NameID", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return false;
- } else if (request.getNameID().getValue() == null) {
+ } else if (nid.getValue() == null) {
log.warn("{} LogoutRequest contained an empty (therefore invalid) NameID", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
return false;
@@ -405,12 +409,16 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
*/
private boolean sessionMatches(@Nonnull final ProfileRequestContext profileRequestContext,
@Nonnull final SPSession session) {
+
if (session instanceof SAML2SPSession) {
final SAML2SPSession saml2Session = (SAML2SPSession) session;
final LogoutRequest request = logoutRequest;
assert request != null;
+
+ final Issuer issuer = request.getIssuer();
+
// Make sure the SP matches.
- if (!saml2Session.getId().equals(request.getIssuer().getValue())) {
+ if (issuer == null || !saml2Session.getId().equals(issuer.getValue())) {
return false;
}
@@ -421,21 +429,24 @@ public class ProcessLogoutRequest extends AbstractProfileAction {
if (format == null) {
format = NameID.UNSPECIFIED;
}
+
+ final NameID requestedNameID = request.getNameID();
+ assert requestedNameID != null;
if (NameID.PERSISTENT.equals(format) || NameID.TRANSIENT.equals(format)
|| qualifiedNameIDFormats.contains(format)) {
- if (assertingParty == null) {
- assertingParty = Constraint.isNotNull(assertingPartyLookupStrategy, "assertingPartyLookupStrategy not set").apply(profileRequestContext);
+ if (assertingParty == null && assertingPartyLookupStrategy != null) {
+ assertingParty = assertingPartyLookupStrategy.apply(profileRequestContext);
}
- if (relyingParty == null) {
- relyingParty = Constraint.isNotNull(relyingPartyLookupStrategy, "relyingPartyLookupStrategy not set").apply(profileRequestContext);
+ if (relyingParty == null && relyingPartyLookupStrategy != null) {
+ relyingParty = relyingPartyLookupStrategy.apply(profileRequestContext);
}
- if (!SAML2ObjectSupport.areNameIDsEquivalent(request.getNameID(), saml2Session.getNameID(),
+ if (!SAML2ObjectSupport.areNameIDsEquivalent(requestedNameID, saml2Session.getNameID(),
assertingParty, relyingParty)) {
return false;
}
- } else if (!SAML2ObjectSupport.areNameIDsEquivalent(request.getNameID(), saml2Session.getNameID())) {
+ } else if (!SAML2ObjectSupport.areNameIDsEquivalent(requestedNameID, saml2Session.getNameID())) {
return false;
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
index 5f3ffe77b..4693d0f64 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContext.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
import java.security.Principal;
import java.util.ArrayList;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import java.util.Set;
import java.util.function.Function;
@@ -52,6 +51,7 @@ import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfigurati
import net.shibboleth.profile.config.ProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.StringSupport;
@@ -89,7 +89,7 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
public ProcessRequestedAuthnContext() {
relyingPartyContextLookupStrategy = new ChildContextLookup<>(RelyingPartyContext.class);
authnRequestLookupStrategy = new MessageLookup<>(AuthnRequest.class).compose(new InboundMessageContextLookup());
- ignoredContexts = Collections.singleton(AuthnContext.UNSPECIFIED_AUTHN_CTX);
+ ignoredContexts = CollectionSupport.singleton(AuthnContext.UNSPECIFIED_AUTHN_CTX);
}
/**
@@ -128,9 +128,9 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
final Collection<String> trimmed = StringSupport.normalizeStringCollection(contexts);
if (trimmed.isEmpty()) {
- ignoredContexts = Collections.emptySet();
+ ignoredContexts = CollectionSupport.emptySet();
} else {
- ignoredContexts = Set.copyOf(trimmed);
+ ignoredContexts = CollectionSupport.copyToSet(trimmed);
}
}
@@ -209,8 +209,9 @@ public class ProcessRequestedAuthnContext extends AbstractAuthenticationAction {
}
final RequestedPrincipalContext rpCtx = new RequestedPrincipalContext();
- if (requestedCtx.getComparison() != null) {
- rpCtx.setOperator(requestedCtx.getComparison().toString());
+ final var operator = requestedCtx.getComparison();
+ if (operator != null) {
+ rpCtx.setOperator(operator.toString());
} else {
rpCtx.setOperator(AuthnContextComparisonTypeEnumeration.EXACT.toString());
}
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
index 03847feff..29d6b65e4 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SAMLAuthnController.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
import java.io.IOException;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;
@@ -95,7 +94,7 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
samlContextLookupStrategy = new ChildContextLookup<>(SAMLAuthnContext.class).compose(
new ChildContextLookup<>(AuthenticationContext.class));
- bindingMap = Collections.emptyMap();
+ bindingMap = CollectionSupport.emptyMap();
}
/**
@@ -173,8 +172,7 @@ public class SAMLAuthnController extends AbstractInitializableComponent {
// Fill in the AuthnRequest's ACS URL and set RelayState to the EA key.
final MessageContext nestedOmc = nestedPRC.getOutboundMessageContext();
- if (nestedOmc != null && nestedOmc.getMessage() instanceof AuthnRequest) {
- final AuthnRequest authnRequest = Constraint.isNotNull((AuthnRequest) nestedOmc.getMessage(), "Outbound messages was null");
+ if (nestedOmc != null && nestedOmc.getMessage() instanceof AuthnRequest authnRequest) {
SAMLBindingSupport.setRelayState(nestedOmc, key);
final StringBuffer url = httpRequest.getRequestURL();
authnRequest.setAssertionConsumerServiceURL(
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java
index 1a1a7a030..5d390d5f1 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/SOAPLogoutRequest.java
@@ -266,12 +266,14 @@ public class SOAPLogoutRequest extends AbstractProfileAction {
final Endpoint ep = ctx.getEndpoint();
final LogoutRequest lReq = logoutRequest;
assert ep != null && lReq != null && opContext != null;
- lReq.setDestination(ep.getLocation());
+
+ final String dest = ep.getLocation();
+ assert dest != null;
+ lReq.setDestination(dest);
- log.debug("{} Executing LogoutRequest over SOAP 1.1 binding to endpoint: {}", getLogPrefix(),
- lReq.getDestination());
+ log.debug("{} Executing LogoutRequest over SOAP 1.1 binding to endpoint: {}", getLogPrefix(), dest);
- soapClient.send(lReq.getDestination(), opContext);
+ soapClient.send(dest, opContext);
final MessageContext opImc = opContext.getInboundMessageContext();
assert opImc != null;
final Object response = opImc.getMessage();
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
index 87f44ae2d..861b5a51d 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/ValidateSAMLAuthentication.java
@@ -43,7 +43,11 @@ import org.opensaml.saml.saml2.core.AttributeStatement;
import org.opensaml.saml.saml2.core.Audience;
import org.opensaml.saml.saml2.core.AuthenticatingAuthority;
import org.opensaml.saml.saml2.core.AuthnContext;
+import org.opensaml.saml.saml2.core.AuthnContextClassRef;
+import org.opensaml.saml.saml2.core.AuthnContextDeclRef;
import org.opensaml.saml.saml2.core.AuthnStatement;
+import org.opensaml.saml.saml2.core.Conditions;
+import org.opensaml.saml.saml2.core.Issuer;
import org.opensaml.saml.saml2.core.NameID;
import org.opensaml.saml.saml2.core.ProxyRestriction;
import org.opensaml.saml.saml2.core.Response;
@@ -328,8 +332,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
assert samlAuthnContext != null;
final org.opensaml.saml.saml2.core.Subject samlSubject = samlAuthnContext.getSubject();
- if (nameToLog == null && samlSubject != null && samlSubject .getNameID() != null) {
- nameToLog = samlSubject.getNameID().getValue();
+ if (nameToLog == null && samlSubject != null) {
+ final NameID id = samlSubject.getNameID();
+ nameToLog = id != null ? id.getValue() : null;
}
log.info("{} SAML authentication succeeded for '{}'", getLogPrefix(), nameToLog);
@@ -342,7 +347,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
final SAMLAuthnContext localSamlAuthnContext = samlAuthnContext;
final AttributeContext localAttributeContext = attributeContext;
- assert localSamlAuthnContext != null && localAttributeContext!=null;;
+ assert localSamlAuthnContext != null && localAttributeContext!=null;
final BaseContext localSamlAuthnContextParent = localSamlAuthnContext.getParent();
assert localSamlAuthnContextParent!=null;
@@ -384,8 +389,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
}
if (!principalsAdded) {
- if (authnContext.getAuthnContextClassRef() != null) {
- final String classRef = authnContext.getAuthnContextClassRef().getURI();
+ final AuthnContextClassRef acClass = authnContext.getAuthnContextClassRef();
+ if (acClass != null) {
+ final String classRef = acClass.getURI();
if (classRef != null) {
subject.getPrincipals().add(new AuthnContextClassRefPrincipal(classRef));
log.debug("{} Added AuthnContextClassRef from assertion: {}", getLogPrefix(), classRef);
@@ -393,8 +399,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
principalsAdded = true;
}
- if (authnContext.getAuthnContextDeclRef() != null) {
- final String declRef = authnContext.getAuthnContextDeclRef().getURI();
+ final AuthnContextDeclRef acDecl = authnContext.getAuthnContextDeclRef();
+ if (acDecl != null) {
+ final String declRef = acDecl.getURI();
if (declRef != null) {
subject.getPrincipals().add(new AuthnContextDeclRefPrincipal(declRef));
log.debug("{} Added AuthnContextDeclRef from assertion: {}", getLogPrefix(), declRef);
@@ -414,7 +421,9 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
subject.getPrincipals().addAll(
localAttributeContext.getIdPAttributes().values()
.stream()
- .map(a -> {assert a != null; return new IdPAttributePrincipal(a);})
+ .map(a -> {
+ assert a != null; return new IdPAttributePrincipal(a);
+ })
.collect(Collectors.toUnmodifiableList()));
}
@@ -434,7 +443,7 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
final ProxyAuthenticationPrincipal proxied = new ProxyAuthenticationPrincipal();
assert samlAuthnContext != null;
- AuthnStatement authnStatement = samlAuthnContext.getAuthnStatement();
+ final AuthnStatement authnStatement = samlAuthnContext.getAuthnStatement();
assert authnStatement != null;
final Assertion assertion = (Assertion) authnStatement.getParent();
assert assertion != null;
@@ -446,9 +455,14 @@ public class ValidateSAMLAuthentication extends AbstractValidationAction {
.filter(aa -> !Strings.isNullOrEmpty(aa))
.collect(Collectors.toUnmodifiableList()));
}
- proxied.getAuthorities().add(assertion.getIssuer().getValue());
-
- final ProxyRestriction condition = assertion.getConditions().getProxyRestriction();
+
+ final Issuer issuer = assertion.getIssuer();
+ if (issuer != null) {
+ proxied.getAuthorities().add(issuer.getValue());
+ }
+
+ final Conditions conditions = assertion.getConditions();
+ final ProxyRestriction condition = conditions != null ? conditions.getProxyRestriction() : null;
if (condition != null) {
proxied.setProxyCount(condition.getProxyCount());
final List<Audience> audiences = condition.getAudiences() ;
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/AddLogoutRequest.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/AddLogoutRequest.java
index 4cd165c1e..46219f2b8 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/AddLogoutRequest.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/AddLogoutRequest.java
@@ -198,11 +198,6 @@ public class AddLogoutRequest extends AbstractProfileAction {
saml2Session = (SAML2SPSession) logoutPropCtx.getSession();
assert saml2Session!=null;
- if (saml2Session.getId() == null) {
- log.debug("{} SAML2SPSession in logout propagation context did not contain a service ID", getLogPrefix());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_PROFILE_CTX);
- return false;
- }
outboundMessageCtx.setMessage(null);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java
index cbbfe3565..5b12fea73 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/BestMatchLocationLookupStrategy.java
@@ -67,7 +67,7 @@ public class BestMatchLocationLookupStrategy implements Function<ProfileRequestC
@Nullable public BestMatchLocationCriterion apply(@Nullable final ProfileRequestContext input) {
final LogoutPropagationContext propCtx = logoutPropagationContextLookupStrategy.apply(input);
- SPSession session = propCtx != null ? propCtx.getSession() : null;
+ final SPSession session = propCtx != null ? propCtx.getSession() : null;
if (session != null && session instanceof SAML2SPSession) {
final String acsLocation = ((SAML2SPSession) session).getACSLocation();
if (acsLocation != null) {
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionSerializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionSerializer.java
index 93f7b2bb9..c799ff7f9 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionSerializer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML1SPSessionSerializer.java
@@ -47,7 +47,7 @@ public class SAML1SPSessionSerializer extends AbstractSPSessionSerializer {
/** {@inheritDoc} */
@Override
- @Nonnull protected SPSession doDeserialize(final JsonObject obj, final String id,
+ @Nonnull protected SPSession doDeserialize(@Nonnull final JsonObject obj, @Nonnull final String id,
@Nonnull final Instant creation, @Nonnull final Instant expiration) throws IOException {
return new SAML1SPSession(id, creation, expiration);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java
index 46c795fe4..f9c984e52 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionCreationStrategy.java
@@ -34,7 +34,9 @@ import org.opensaml.saml.common.messaging.context.SAMLMetadataContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.saml2.core.Assertion;
import org.opensaml.saml.saml2.core.AuthnStatement;
+import org.opensaml.saml.saml2.core.NameID;
import org.opensaml.saml.saml2.core.Response;
+import org.opensaml.saml.saml2.core.Subject;
import org.opensaml.saml.saml2.core.SubjectConfirmation;
import org.opensaml.saml.saml2.core.SubjectConfirmationData;
import org.opensaml.saml.saml2.metadata.RoleDescriptor;
@@ -144,7 +146,9 @@ public class SAML2SPSessionCreationStrategy implements Function<ProfileRequestCo
}
String acsLocation = null;
- final List<SubjectConfirmation> sc = first.getSubject().getSubjectConfirmations();
+ final Subject subject = first.getSubject();
+ assert subject != null;
+ final List<SubjectConfirmation> sc = subject.getSubjectConfirmations();
if (sc != null && !sc.isEmpty()) {
final SubjectConfirmationData scData = sc.get(0).getSubjectConfirmationData();
if (scData != null) {
@@ -166,8 +170,12 @@ public class SAML2SPSessionCreationStrategy implements Function<ProfileRequestCo
}
}
- return new SAML2SPSession(issuer, now, expiration, first.getSubject().getNameID(),
- second.getSessionIndex(), acsLocation, supportLogoutPropagation);
+ // Thse guarantees come from the getAssertionAndStatement method.
+ final NameID nameID = subject.getNameID();
+ final String index = second.getSessionIndex();
+ assert nameID != null;
+ assert index != null;
+ return new SAML2SPSession(issuer, now, expiration, nameID, index, acsLocation, supportLogoutPropagation);
}
// Checkstyle: CyclomaticComplexity ON
@@ -189,7 +197,8 @@ public class SAML2SPSessionCreationStrategy implements Function<ProfileRequestCo
}
for (final Assertion assertion : response.getAssertions()) {
- if (assertion.getSubject() != null && assertion.getSubject().getNameID() != null) {
+ final Subject subject = assertion.getSubject();
+ if (subject != null && subject.getNameID() != null) {
for (final AuthnStatement statement : assertion.getAuthnStatements()) {
if (statement.getSessionIndex() != null) {
return new Pair<>(assertion, statement);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java
index 6800f9dd5..5069b8611 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/session/impl/SAML2SPSessionSerializer.java
@@ -21,7 +21,6 @@ import java.io.IOException;
import java.io.StringReader;
import java.time.Duration;
import java.time.Instant;
-import java.util.Collections;
import java.util.Map;
import javax.annotation.Nonnull;
@@ -43,6 +42,7 @@ import net.shibboleth.idp.session.SPSession;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.xml.ParserPool;
import net.shibboleth.shared.xml.SerializeSupport;
@@ -140,7 +140,7 @@ public class SAML2SPSessionSerializer extends AbstractSPSessionSerializer {
}
static {
- NO_XML_DECL_PARAMS = Collections.<String,Object>singletonMap("xml-declaration", Boolean.FALSE);
+ NO_XML_DECL_PARAMS = CollectionSupport.<String,Object>singletonMap("xml-declaration", Boolean.FALSE);
}
}
\ No newline at end of file
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
index 6cb8d3443..db3f29b38 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIDDecoderTest.java
@@ -20,7 +20,6 @@ package net.shibboleth.idp.saml.nameid.impl;
import java.io.IOException;
import java.time.Duration;
import java.time.Instant;
-import java.util.Collections;
import javax.security.auth.Subject;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
index 08802dfd2..aed6b093a 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/CryptoTransientNameIdentifierDecoderTest.java
@@ -18,7 +18,6 @@
package net.shibboleth.idp.saml.nameid.impl;
import java.time.Duration;
-import java.util.Collections;
import javax.security.auth.Subject;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java
index 6eec32cb4..4490c024b 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/StoredPersistentIdDecoderTest.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.saml.nameid.impl;
import java.io.IOException;
import java.sql.SQLException;
-import java.util.Collections;
import javax.sql.DataSource;
@@ -44,6 +43,7 @@ import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.idp.saml.impl.testing.TestSources;
import net.shibboleth.idp.saml.nameid.NameDecoderException;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.testing.DatabaseTestingSupport;
@@ -76,7 +76,7 @@ public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
generator = new PersistentSAML2NameIDGenerator();
generator.setId("test");
generator.setPersistentIdStore(store);
- generator.setAttributeSourceIds(Collections.singletonList("SOURCE"));
+ generator.setAttributeSourceIds(CollectionSupport.singletonList("SOURCE"));
decoder = new StoredPersistentIdDecoder();
decoder.setId("test");
@@ -95,7 +95,9 @@ public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
scc.setResponderId(TestSources.IDP_ENTITY_ID);
final Subject subject = SAML2ActionTestingSupport.buildSubject("foo");
- Assert.assertNull(decoder.decode(scc, subject.getNameID()));
+ final NameID n = subject.getNameID();
+ assert n != null;
+ Assert.assertNull(decoder.decode(scc, n));
}
@Test(expectedExceptions={NameDecoderException.class})
@@ -104,7 +106,9 @@ public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
final SubjectCanonicalizationContext scc = prc.ensureSubcontext(SubjectCanonicalizationContext.class);
final Subject subject = SAML2ActionTestingSupport.buildSubject("foo");
- decoder.decode(scc, subject.getNameID());
+ final NameID n = subject.getNameID();
+ assert n != null;
+ decoder.decode(scc, n);
}
@Test
@@ -115,11 +119,11 @@ public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
Assert.assertNull(generator.generate(prc, NameID.PERSISTENT));
final IdPAttribute source = new IdPAttribute("SOURCE");
- source.setValues(Collections.singletonList(new StringAttributeValue(TestSources.COMMON_ATTRIBUTE_VALUE_STRING)));
+ source.setValues(CollectionSupport.singletonList(new StringAttributeValue(TestSources.COMMON_ATTRIBUTE_VALUE_STRING)));
final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
assert rpc!=null;
rpc.ensureSubcontext(AttributeContext.class).setUnfilteredIdPAttributes(
- Collections.singleton(source));
+ CollectionSupport.singleton(source));
final NameID id = generator.generate(prc, NameID.PERSISTENT);
assert id!=null;
Assert.assertNotNull(id.getValue());
@@ -143,13 +147,13 @@ public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
Assert.assertNull(generator.generate(prc, NameID.PERSISTENT));
final IdPAttribute source = new IdPAttribute("SOURCE");
- source.setValues(Collections.singletonList(new StringAttributeValue(TestSources.COMMON_ATTRIBUTE_VALUE_STRING)));
+ source.setValues(CollectionSupport.singletonList(new StringAttributeValue(TestSources.COMMON_ATTRIBUTE_VALUE_STRING)));
final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
assert rpc!=null;
rpc.ensureSubcontext(AttributeContext.class).setUnfilteredIdPAttributes(
- Collections.singleton(source));
+ CollectionSupport.singleton(source));
final NameID id = generator.generate(prc, NameID.PERSISTENT);
- assert id!=null;
+ assert id != null;
Assert.assertNotNull(id.getValue());
Assert.assertEquals(id.getFormat(), NameID.PERSISTENT);
Assert.assertEquals(id.getNameQualifier(), TestSources.IDP_ENTITY_ID);
@@ -172,11 +176,11 @@ public class StoredPersistentIdDecoderTest extends OpenSAMLInitBaseTestCase {
Assert.assertNull(generator.generate(prc, NameID.PERSISTENT));
final IdPAttribute source = new IdPAttribute("SOURCE");
- source.setValues(Collections.singletonList(new StringAttributeValue(TestSources.COMMON_ATTRIBUTE_VALUE_STRING)));
+ source.setValues(CollectionSupport.singletonList(new StringAttributeValue(TestSources.COMMON_ATTRIBUTE_VALUE_STRING)));
final RelyingPartyContext rpc = prc.getSubcontext(RelyingPartyContext.class);
assert rpc!=null;
rpc.ensureSubcontext(AttributeContext.class).setUnfilteredIdPAttributes(
- Collections.singleton(source));
+ CollectionSupport.singleton(source));
final NameID id = generator.generate(prc, NameID.PERSISTENT);
assert id!=null;
Assert.assertNotNull(id.getValue());
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java
index 852d9d8d8..a23134604 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransformingDecoderTest.java
@@ -18,8 +18,8 @@
package net.shibboleth.idp.saml.nameid.impl;
import java.util.Arrays;
-import java.util.Collections;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.collection.Pair;
import net.shibboleth.shared.component.UninitializedComponentException;
@@ -51,7 +51,7 @@ public class TransformingDecoderTest {
@Test public void testStrip() throws Exception {
final MockTransformingDecoder decode = new MockTransformingDecoder();
decode.setId("Decoder");
- decode.setTransforms(Collections.singletonList(new Pair<>("(.+)@foo.edu", "$1")));
+ decode.setTransforms(CollectionSupport.singletonList(new Pair<>("(.+)@foo.edu", "$1")));
decode.initialize();
Assert.assertEquals(decode.decode(PRINCIPAL), "ThePrincipalName");
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java
index 4a447ff89..115e79c88 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/TransientDecoderTest.java
@@ -17,8 +17,6 @@
package net.shibboleth.idp.saml.nameid.impl;
-import java.util.Collections;
-
import javax.security.auth.Subject;
import net.shibboleth.idp.authn.context.SubjectCanonicalizationContext;
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequestTest.java
index 7f28774bd..030900b7d 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/ExtractSubjectFromRequestTest.java
@@ -28,6 +28,7 @@ import net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest.SubjectNam
import net.shibboleth.profile.context.navigate.RelyingPartyIdLookupFunction;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
import javax.security.auth.Subject;
@@ -35,6 +36,7 @@ import org.opensaml.core.testing.XMLObjectBaseTestCase;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.common.profile.logic.DefaultNameIDPolicyPredicate;
+import org.opensaml.saml.saml1.core.NameIdentifier;
import org.opensaml.saml.saml1.core.Request;
import org.opensaml.saml.saml1.testing.SAML1ActionTestingSupport;
import org.opensaml.saml.saml2.core.AuthnRequest;
@@ -108,17 +110,19 @@ public class ExtractSubjectFromRequestTest extends XMLObjectBaseTestCase {
assert imc!=null;
imc.setMessage(request);
- request.getSubject().getNameID().setFormat(NameID.TRANSIENT);
- request.getSubject().getNameID().setNameQualifier("foo");
+ final NameID nameID = Constraint.isNotNull(request.getSubject(), "Subject null").getNameID();
+ assert nameID != null;
+ nameID.setFormat(NameID.TRANSIENT);
+ nameID.setNameQualifier("foo");
Event event = action.execute(rc);
ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_SUBJECT);
- request.getSubject().getNameID().setNameQualifier(ActionTestingSupport.OUTBOUND_MSG_ISSUER);
- request.getSubject().getNameID().setSPNameQualifier("foo");
+ nameID.setNameQualifier(ActionTestingSupport.OUTBOUND_MSG_ISSUER);
+ nameID.setSPNameQualifier("foo");
event = action.execute(rc);
ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_SUBJECT);
- request.getSubject().getNameID().setSPNameQualifier(ActionTestingSupport.INBOUND_MSG_ISSUER);
+ nameID.setSPNameQualifier(ActionTestingSupport.INBOUND_MSG_ISSUER);
event = action.execute(rc);
ActionTestingSupport.assertProceedEvent(event);
@@ -140,12 +144,16 @@ public class ExtractSubjectFromRequestTest extends XMLObjectBaseTestCase {
assert imc!=null;
imc.setMessage(request);
- request.getAttributeQuery().getSubject().getNameIdentifier().setFormat(NameID.TRANSIENT);
- request.getAttributeQuery().getSubject().getNameIdentifier().setNameQualifier("foo");
+ final org.opensaml.saml.saml1.core.Subject s = Constraint.isNotNull(request.getAttributeQuery(), "Query was null").getSubject();
+ assert s != null;
+ final NameIdentifier nameID = s.getNameIdentifier();
+
+ nameID.setFormat(NameID.TRANSIENT);
+ nameID.setNameQualifier("foo");
Event event = action.execute(rc);
ActionTestingSupport.assertEvent(event, AuthnEventIds.INVALID_SUBJECT);
- request.getAttributeQuery().getSubject().getNameIdentifier().setNameQualifier(ActionTestingSupport.OUTBOUND_MSG_ISSUER);
+ nameID.setNameQualifier(ActionTestingSupport.OUTBOUND_MSG_ISSUER);
event = action.execute(rc);
ActionTestingSupport.assertProceedEvent(event);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
index 1cc199f9e..ab5d6b89f 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeAuthenticationContextTest.java
@@ -26,6 +26,7 @@ import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.messaging.context.MessageContext;
@@ -40,8 +41,6 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.google.common.base.Predicates;
-
/** {@link InitializeAuthenticationContext} unit test. */
@SuppressWarnings("javadoc")
public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCase {
@@ -160,7 +159,7 @@ public class InitializeAuthenticationContextTest extends OpenSAMLInitBaseTestCas
action = new InitializeAuthenticationContext();
action.setProxyCountLookupStrategy(FunctionSupport.constant(1));
- action.setIgnoreScopingPredicate(Predicates.alwaysTrue());
+ action.setIgnoreScopingPredicate(PredicateSupport.alwaysTrue());
action.initialize();
final Event event = action.execute(requestCtx);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForErrorTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForErrorTest.java
index e8fed419b..ab279e0d5 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForErrorTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextForErrorTest.java
@@ -23,6 +23,7 @@ import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.saml.binding.BindingDescriptor;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.messaging.context.MessageContext;
@@ -129,7 +130,7 @@ public class InitializeOutboundMessageContextForErrorTest extends OpenSAMLInitBa
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class);
assert rpCtx!=null;
rpCtx.setRelyingPartyIdContextTree(ctx);
- attributeQuery.getAttributeQuery().setResource("issuer");
+ Constraint.isNotNull(attributeQuery.getAttributeQuery(), "Query was null").setResource("issuer");
final Event event = action.execute(src);
ActionTestingSupport.assertProceedEvent(event);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextTest.java
index 489fae396..3f68c4787 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/InitializeOutboundMessageContextTest.java
@@ -23,6 +23,7 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.Constraint;
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.messaging.context.MessageContext;
@@ -97,7 +98,7 @@ public class InitializeOutboundMessageContextTest extends OpenSAMLInitBaseTestCa
final RelyingPartyContext rpCtx = prc.getSubcontext(RelyingPartyContext.class);
assert rpCtx!=null;
rpCtx.setRelyingPartyIdContextTree(ctx);
- attributeQuery.getAttributeQuery().setResource("issuer");
+ Constraint.isNotNull(attributeQuery.getAttributeQuery(), "Query was null").setResource("issuer");
final Event event = action.execute(src);
ActionTestingSupport.assertProceedEvent(event);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertionTest.java
index 13a869a4c..9e12b20fe 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertionTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertionTest.java
@@ -436,17 +436,19 @@ public class AddAttributeStatementToAssertionTest extends OpenSAMLInitBaseTestCa
boolean one = false, altone = false, two = false;
for (final Attribute samlAttr : attributeStatement.getAttributes()) {
- if (samlAttr.getName().equals(MY_NAME_1)) {
+ final String attrName = samlAttr.getName();
+ assert attrName != null;
+ if (attrName.equals(MY_NAME_1)) {
Assert.assertEquals(samlAttr.getAttributeValues().size(), 1);
final XMLObject xmlObject = samlAttr.getAttributeValues().get(0);
Assert.assertEquals(((XSStringImpl) xmlObject).getValue(), MY_VALUE_1);
one = true;
- } else if (samlAttr.getName().equals(MY_NAME_2)) {
+ } else if (attrName.equals(MY_NAME_2)) {
Assert.assertEquals(samlAttr.getAttributeValues().size(), 1);
final XMLObject xmlObject = samlAttr.getAttributeValues().get(0);
Assert.assertEquals(((XSStringImpl) xmlObject).getValue(), MY_VALUE_2);
altone = true;
- } else if (samlAttr.getName().equals(MY_ALTNAME_1)) {
+ } else if (attrName.equals(MY_ALTNAME_1)) {
Assert.assertEquals(samlAttr.getAttributeValues().size(), 2);
final String val1 = ((XSStringImpl) samlAttr.getAttributeValues().get(0)).getValue();
final String val2 = ((XSStringImpl) samlAttr.getAttributeValues().get(1)).getValue();
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
index 9f0d143bd..d2907ce6e 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnRequestTest.java
@@ -42,7 +42,10 @@ import org.opensaml.saml.saml2.core.Attribute;
import org.opensaml.saml.saml2.core.AuthnContext;
import org.opensaml.saml.saml2.core.AuthnContextComparisonTypeEnumeration;
import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.Extensions;
import org.opensaml.saml.saml2.core.IDPEntry;
+import org.opensaml.saml.saml2.core.IDPList;
+import org.opensaml.saml.saml2.core.Issuer;
import org.opensaml.saml.saml2.core.NameIDPolicy;
import org.opensaml.saml.saml2.core.NameIDType;
import org.opensaml.saml.saml2.core.RequestedAuthnContext;
@@ -151,21 +154,27 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
- assertEquals(request.getIssuer().getValue(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
- assertFalse(request.isForceAuthn());
- assertFalse(request.isPassive());
+ final Issuer issuer = request.getIssuer();
+ assert issuer != null;
+ assertEquals(issuer.getValue(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
+ final Boolean force = request.isForceAuthn();
+ assertFalse(force == null || force);
+ final Boolean passive = request.isPassive();
+ assertFalse(passive == null || passive);
assertNull(request.getAttributeConsumingServiceIndex());
assertNull(request.getExtensions());
final NameIDPolicy nid = request.getNameIDPolicy();
- assertNotNull(nid);
+ assert nid != null;
assertNull(nid.getFormat());
assertNull(nid.getSPNameQualifier());
- assertTrue(nid.getAllowCreate());
+ final Boolean allowCreate = nid.getAllowCreate();
+ assertTrue(allowCreate != null && allowCreate);
assertNull(request.getRequestedAuthnContext());
final Scoping scoping = request.getScoping();
+ assert scoping != null;
assertEquals(scoping.getRequesterIDs().get(0).getURI(), ActionTestingSupport.INBOUND_MSG_ISSUER);
}
@@ -184,9 +193,14 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
- assertEquals(request.getIssuer().getValue(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
- assertTrue(request.isForceAuthn());
- assertTrue(request.isPassive());
+
+ final Issuer issuer = request.getIssuer();
+ assert issuer != null;
+ assertEquals(issuer.getValue(), ActionTestingSupport.OUTBOUND_MSG_ISSUER);
+ final Boolean force = request.isForceAuthn();
+ assertTrue(force != null && force);
+ final Boolean passive = request.isPassive();
+ assertTrue(passive != null && passive);
omc.setMessage(null);
BrowserSSOProfileConfiguration bspc = (BrowserSSOProfileConfiguration) rpc.getProfileConfig();
@@ -197,7 +211,8 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
ActionTestingSupport.assertProceedEvent(event);
final AuthnRequest ar =(AuthnRequest) omc.getMessage();
assert ar!=null;
- assertFalse(ar.isForceAuthn());
+ final Boolean force2 = ar.isForceAuthn();
+ assertFalse(force2 == null || force2);
}
/** Test that the action works with a NameID format set. */
@@ -218,9 +233,10 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
final NameIDPolicy nid = request.getNameIDPolicy();
- assertNotNull(nid);
+ assert nid != null;
assertEquals(nid.getFormat(), NameIDType.EMAIL);
- assertTrue(nid.getAllowCreate());
+ final Boolean allowCreate = nid.getAllowCreate();
+ assertTrue(allowCreate != null && allowCreate);
}
/** Test that the action works with SPNameQualifier set. */
@@ -240,7 +256,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
final NameIDPolicy nid = request.getNameIDPolicy();
- assertNotNull(nid);
+ assert nid != null;
assertEquals(nid.getSPNameQualifier(), ActionTestingSupport.INBOUND_MSG_ISSUER);
}
@@ -291,10 +307,11 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
- assertNotNull(request.getExtensions());
- assertEquals(request.getExtensions().getUnknownXMLObjects(RequestedAttributes.DEFAULT_ELEMENT_NAME).size(), 1);
+ final Extensions exts = request.getExtensions();
+ assert exts != null;
+ assertEquals(exts.getUnknownXMLObjects(RequestedAttributes.DEFAULT_ELEMENT_NAME).size(), 1);
final RequestedAttributes extension =
- (RequestedAttributes) request.getExtensions().getUnknownXMLObjects(RequestedAttributes.DEFAULT_ELEMENT_NAME).get(0);
+ (RequestedAttributes) exts.getUnknownXMLObjects(RequestedAttributes.DEFAULT_ELEMENT_NAME).get(0);
assertEquals(extension.getRequestedAttributes().size(), 2);
}
@@ -314,12 +331,14 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
final Scoping scoping = request.getScoping();
- assertNotNull(scoping);
+ assert scoping != null;
assertNull(scoping.getProxyCount());
assertNotNull(scoping.getIDPList());
assertEquals(scoping.getRequesterIDs().get(0).getURI(), ActionTestingSupport.INBOUND_MSG_ISSUER);
- final Set<String> requestedAuthorities = scoping.getIDPList().getIDPEntrys()
+ final IDPList idpList = scoping.getIDPList();
+ assert idpList != null;
+ final Set<String> requestedAuthorities = idpList.getIDPEntrys()
.stream()
.map(IDPEntry::getProviderID)
.filter(id -> id != null)
@@ -343,7 +362,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
final Scoping scoping = request.getScoping();
- assertNotNull(scoping);
+ assert scoping != null;
assertNull(scoping.getIDPList());
assertEquals(scoping.getProxyCount(), Integer.valueOf(0));
assertEquals(scoping.getRequesterIDs().get(0).getURI(), ActionTestingSupport.INBOUND_MSG_ISSUER);
@@ -364,7 +383,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
final Scoping scoping = request.getScoping();
- assertNotNull(scoping);
+ assert scoping != null;
assertNull(scoping.getIDPList());
assertEquals(scoping.getProxyCount(), Integer.valueOf(4));
assertEquals(scoping.getRequesterIDs().get(0).getURI(), ActionTestingSupport.INBOUND_MSG_ISSUER);
@@ -384,7 +403,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
final AuthnRequest request = (AuthnRequest) omc.getMessage();
assert request!=null;
final Scoping scoping = request.getScoping();
- assertNotNull(scoping);
+ assert scoping != null;
assertNull(scoping.getIDPList());
assertEquals(scoping.getProxyCount(), Integer.valueOf(0));
assertEquals(scoping.getRequesterIDs().get(0).getURI(), ActionTestingSupport.INBOUND_MSG_ISSUER);
@@ -415,7 +434,7 @@ public class AddAuthnRequestTest extends OpenSAMLInitBaseTestCase {
assertEquals(rac.getAuthnContextClassRefs().size(), 2);
assertEquals(rac.getAuthnContextClassRefs().get(0).getURI(), AuthnContext.KERBEROS_AUTHN_CTX);
assertEquals(rac.getAuthnContextClassRefs().get(1).getURI(), AuthnContext.X509_AUTHN_CTX);
- BrowserSSOProfileConfiguration bspc = (BrowserSSOProfileConfiguration) rpc.getProfileConfig();
+ final BrowserSSOProfileConfiguration bspc = (BrowserSSOProfileConfiguration) rpc.getProfileConfig();
assert bspc!=null;
bspc.setAuthnContextComparison(AuthnContextComparisonTypeEnumeration.EXACT);
bspc.setDefaultAuthenticationMethods(
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java
index 7b6ac57bf..628180d58 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAuthnStatementToAssertionTest.java
@@ -28,8 +28,10 @@ import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.saml.saml2.core.Assertion;
import org.opensaml.saml.saml2.core.AuthnContext;
+import org.opensaml.saml.saml2.core.AuthnContextClassRef;
import org.opensaml.saml.saml2.core.AuthnStatement;
import org.opensaml.saml.saml2.core.Response;
+import org.opensaml.saml.saml2.core.SubjectLocality;
import org.opensaml.storage.StorageSerializer;
import org.opensaml.xmlsec.config.BasicXMLSecurityConfiguration;
import org.springframework.mock.web.MockHttpServletRequest;
@@ -162,17 +164,21 @@ public class AddAuthnStatementToAssertionTest extends OpenSAMLInitBaseTestCase {
Assert.assertNotNull(assertion.getAuthnStatements().get(0));
final AuthnStatement authenticationStatement = assertion.getAuthnStatements().get(0);
- Assert.assertTrue(authenticationStatement.getAuthnInstant().isAfter(now));
+ assert authenticationStatement != null;
+ final Instant authnInstant = authenticationStatement.getAuthnInstant();
+ Assert.assertTrue(authnInstant != null && authnInstant.isAfter(now));
Assert.assertNotNull(authenticationStatement.getSessionIndex());
Assert.assertNull(authenticationStatement.getSessionNotOnOrAfter());
- Assert.assertNotNull(authenticationStatement.getSubjectLocality());
- Assert.assertEquals(authenticationStatement.getSubjectLocality().getAddress(), "127.0.0.1");
+ final SubjectLocality locality = authenticationStatement.getSubjectLocality();
+ assert locality != null;
+ Assert.assertEquals(locality.getAddress(), "127.0.0.1");
final AuthnContext authnContext = authenticationStatement.getAuthnContext();
- Assert.assertNotNull(authnContext);
- Assert.assertNotNull(authnContext.getAuthnContextClassRef());
- Assert.assertEquals(authnContext.getAuthnContextClassRef().getURI(), "Test");
+ assert authnContext != null;
+ final AuthnContextClassRef acClass = authnContext.getAuthnContextClassRef();
+ assert acClass != null;
+ Assert.assertEquals(acClass.getURI(), "Test");
Assert.assertTrue(authnContext.getAuthenticatingAuthorities().isEmpty());
}
@@ -234,9 +240,10 @@ public class AddAuthnStatementToAssertionTest extends OpenSAMLInitBaseTestCase {
final AuthnStatement authenticationStatement = assertion.getAuthnStatements().get(0);
final AuthnContext authnContext = authenticationStatement.getAuthnContext();
- Assert.assertNotNull(authnContext);
- Assert.assertNotNull(authnContext.getAuthnContextClassRef());
- Assert.assertEquals(authnContext.getAuthnContextClassRef().getURI(), "Bar");
+ assert authnContext != null;
+ final AuthnContextClassRef acClass = authnContext.getAuthnContextClassRef();
+ assert acClass != null;
+ Assert.assertEquals(acClass.getURI(), "Bar");
Assert.assertTrue(authnContext.getAuthenticatingAuthorities().isEmpty());
}
@@ -254,7 +261,7 @@ public class AddAuthnStatementToAssertionTest extends OpenSAMLInitBaseTestCase {
final Assertion assertion = response.getAssertions().get(0);
final AuthnStatement authenticationStatement = assertion.getAuthnStatements().get(0);
final AuthnContext authnContext = authenticationStatement.getAuthnContext();
- Assert.assertNotNull(authnContext);
+ assert authnContext != null;
Assert.assertEquals(authnContext.getAuthenticatingAuthorities().size(), 3);
Assert.assertEquals(authnContext.getAuthenticatingAuthorities().get(0).getURI(), "foo");
Assert.assertEquals(authnContext.getAuthenticatingAuthorities().get(1).getURI(), "bar");
@@ -282,7 +289,7 @@ public class AddAuthnStatementToAssertionTest extends OpenSAMLInitBaseTestCase {
final Assertion assertion = response.getAssertions().get(0);
final AuthnStatement authenticationStatement = assertion.getAuthnStatements().get(0);
final AuthnContext authnContext = authenticationStatement.getAuthnContext();
- Assert.assertNotNull(authnContext);
+ assert authnContext != null;
Assert.assertTrue(authnContext.getAuthenticatingAuthorities().isEmpty());
}
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java
index b16fdbb04..14aec9e83 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/IdPInitiatedSSORequestMessageDecoderTest.java
@@ -27,6 +27,7 @@ import org.opensaml.saml.common.messaging.context.SAMLBindingContext;
import org.opensaml.saml.common.messaging.context.SAMLMessageInfoContext;
import org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext;
import org.opensaml.saml.saml2.core.AuthnRequest;
+import org.opensaml.saml.saml2.core.Issuer;
import org.springframework.mock.web.MockHttpServletRequest;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
@@ -84,10 +85,12 @@ public class IdPInitiatedSSORequestMessageDecoderTest extends XMLObjectBaseTestC
final MessageContext messageContext = decoder.getMessageContext();
assert messageContext!=null;
- AuthnRequest authnRequest = (AuthnRequest) messageContext.getMessage();
+ final AuthnRequest authnRequest = (AuthnRequest) messageContext.getMessage();
assert authnRequest!=null;
- Assert.assertEquals(authnRequest.getIssuer().getValue(), entityId, "Incorrect decoded message entityId value");
+ final Issuer issuer = authnRequest.getIssuer();
+ assert issuer != null;
+ Assert.assertEquals(issuer.getValue(), entityId, "Incorrect decoded message entityId value");
Assert.assertEquals(authnRequest.getAssertionConsumerServiceURL(), acsUrl, "Incorrect decoded message ACS URL value");
Assert.assertEquals(authnRequest.getIssueInstant(), time.truncatedTo(ChronoUnit.SECONDS),
"Incorrect decoded message issue instant value");
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessageTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessageTest.java
index 156aa1bda..57e2688c6 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessageTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/PreProcessLogoutMessageTest.java
@@ -102,9 +102,9 @@ public class PreProcessLogoutMessageTest extends OpenSAMLInitBaseTestCase {
Asynchronous.DEFAULT_ELEMENT_NAME);
final LogoutRequest lr = (LogoutRequest)imc.getMessage();
assert lr!=null;
- lr.setExtensions(extsBuilder.buildObject());
- lr.getExtensions().getUnknownXMLObjects().add(
- asyncBuilder.buildObject());
+ final Extensions exts = extsBuilder.buildObject();
+ exts.getUnknownXMLObjects().add(asyncBuilder.buildObject());
+ lr.setExtensions(exts);
final Event event = action.execute(src);
ActionTestingSupport.assertEvent(event, PreProcessLogoutMessage.IS_LOGOUT_REQUEST_ASYNC);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java
index 85ff6afae..3d5adb0f7 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessAssertionsForAuthenticationTest.java
@@ -19,7 +19,6 @@ package net.shibboleth.idp.saml.saml2.profile.impl;
import java.time.Duration;
import java.time.Instant;
-import java.util.Collections;
import java.util.List;
import java.util.function.Function;
@@ -49,7 +48,9 @@ import org.testng.annotations.Test;
import net.shibboleth.idp.authn.AuthnEventIds;
import net.shibboleth.idp.authn.context.AuthenticationContext;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.testing.ConstantSupplier;
@@ -105,7 +106,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertProceedEvent(prc);
Assert.assertSame(samlAuthnContext.getSubject(), assertion1.getSubject());
Assert.assertSame(samlAuthnContext.getAuthnStatement(), assertion1.getAuthnStatements().get(0));
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -119,7 +120,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.emptyList());
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.emptyList());
}
@Test
@@ -133,7 +134,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.emptyList());
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.emptyList());
}
@Test
@@ -221,7 +222,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertProceedEvent(prc);
Assert.assertSame(samlAuthnContext.getSubject(), assertion1.getSubject());
Assert.assertSame(samlAuthnContext.getAuthnStatement(), assertion1.getAuthnStatements().get(0));
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -237,7 +238,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertProceedEvent(prc);
Assert.assertSame(samlAuthnContext.getSubject(), assertion1.getSubject());
Assert.assertSame(samlAuthnContext.getAuthnStatement(), assertion1.getAuthnStatements().get(1));
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -254,7 +255,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertProceedEvent(prc);
Assert.assertSame(samlAuthnContext.getSubject(), assertion1.getSubject());
Assert.assertSame(samlAuthnContext.getAuthnStatement(), assertion1.getAuthnStatements().get(0));
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -269,7 +270,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.emptyList());
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.emptyList());
}
@Test
@@ -280,7 +281,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.emptyList());
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.emptyList());
}
@Test
@@ -298,7 +299,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -312,7 +313,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.emptyList());
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.emptyList());
}
@Test
@@ -327,7 +328,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -343,7 +344,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertEvent(prc, AuthnEventIds.INVALID_CREDENTIALS);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
@Test
@@ -359,10 +360,10 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
ActionTestingSupport.assertProceedEvent(prc);
Assert.assertNull(samlAuthnContext.getSubject());
Assert.assertNull(samlAuthnContext.getAuthnStatement());
- Assert.assertEquals(samlResponse.getAssertions(), Collections.singletonList(assertion1));
+ Assert.assertEquals(samlResponse.getAssertions(), CollectionSupport.singletonList(assertion1));
}
- @Test(expectedExceptions = ComponentInitializationException.class)
+ @Test(expectedExceptions = ConstraintViolationException.class)
public void testNullAuthnAssertionStrategy() throws ComponentInitializationException {
final Assertion assertion1 = buildAssertion(ValidationResult.VALID);
samlResponse.getAssertions().add(assertion1);
@@ -372,7 +373,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
action.initialize();
}
- @Test(expectedExceptions = ComponentInitializationException.class)
+ @Test(expectedExceptions = ConstraintViolationException.class)
public void testNullAuthnStatementStrategy() throws ComponentInitializationException {
final Assertion assertion1 = buildAssertion(ValidationResult.VALID);
samlResponse.getAssertions().add(assertion1);
@@ -382,7 +383,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
action.initialize();
}
- @Test(expectedExceptions = ComponentInitializationException.class)
+ @Test(expectedExceptions = ConstraintViolationException.class)
public void testNullResponseResolver() throws ComponentInitializationException {
final Assertion assertion1 = buildAssertion(ValidationResult.VALID);
samlResponse.getAssertions().add(assertion1);
@@ -392,7 +393,7 @@ public class ProcessAssertionsForAuthenticationTest extends OpenSAMLInitBaseTest
action.initialize();
}
- @Test(expectedExceptions = ComponentInitializationException.class)
+ @Test(expectedExceptions = ConstraintViolationException.class)
public void testNullSAMLAuthnContextStrategy() throws ComponentInitializationException {
final Assertion assertion1 = buildAssertion(ValidationResult.VALID);
samlResponse.getAssertions().add(assertion1);
diff --git a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java
index 2c3a7b6a9..ee3036753 100644
--- a/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java
+++ b/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/saml2/profile/impl/ProcessRequestedAuthnContextTest.java
@@ -26,10 +26,9 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.idp.profile.testing.RequestContextBuilder;
import net.shibboleth.idp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration;
import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
-import java.util.Collections;
-
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
import org.opensaml.messaging.context.MessageContext;
@@ -267,7 +266,7 @@ public class ProcessRequestedAuthnContextTest extends OpenSAMLInitBaseTestCase {
rac.getAuthnContextClassRefs().add(ref);
action = new ProcessRequestedAuthnContext();
- action.setIgnoredContexts(Collections.singletonList(AuthnContext.PPT_AUTHN_CTX));
+ action.setIgnoredContexts(CollectionSupport.singletonList(AuthnContext.PPT_AUTHN_CTX));
action.initialize();
final Event event = action.execute(src);
diff --git a/idp-ui/src/main/java/net/shibboleth/idp/ui/context/RelyingPartyUIContext.java b/idp-ui/src/main/java/net/shibboleth/idp/ui/context/RelyingPartyUIContext.java
index 05738557a..1f855e6f5 100644
--- a/idp-ui/src/main/java/net/shibboleth/idp/ui/context/RelyingPartyUIContext.java
+++ b/idp-ui/src/main/java/net/shibboleth/idp/ui/context/RelyingPartyUIContext.java
@@ -38,8 +38,10 @@ import org.opensaml.saml.saml2.metadata.AttributeConsumingService;
import org.opensaml.saml.saml2.metadata.ContactPerson;
import org.opensaml.saml.saml2.metadata.ContactPersonTypeEnumeration;
import org.opensaml.saml.saml2.metadata.EntityDescriptor;
+import org.opensaml.saml.saml2.metadata.GivenName;
import org.opensaml.saml.saml2.metadata.Organization;
import org.opensaml.saml.saml2.metadata.SPSSODescriptor;
+import org.opensaml.saml.saml2.metadata.SurName;
import org.slf4j.Logger;
import jakarta.servlet.http.HttpServletRequest;
@@ -699,10 +701,8 @@ public final class RelyingPartyUIContext extends BaseContext {
@Nullable public String getContactSurName(@Nullable final String contactType) {
final ContactPerson contact = getContactPerson(getContactType(contactType));
- if (null == contact || null == contact.getSurName()) {
- return null;
- }
- return contact.getSurName().getValue();
+ final SurName surname = contact != null ? contact.getSurName() : null;
+ return surname != null ? surname.getValue() : null;
}
/**
@@ -714,10 +714,8 @@ public final class RelyingPartyUIContext extends BaseContext {
@Nullable public String getContactGivenName(@Nullable final String contactType) {
final ContactPerson contact = getContactPerson(getContactType(contactType));
- if (null == contact || null == contact.getGivenName()) {
- return null;
- }
- return contact.getGivenName().getValue();
+ final GivenName givenName = contact != null ? contact.getGivenName() : null;
+ return givenName != null ? givenName.getValue() : null;
}
/**
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list