[java-opensaml] branch main updated: IDP-2069 - Null Handling Task
Scott Cantor
cantor.2 at osu.edu
Tue Mar 28 14:53:27 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=829baf4a79626f518ef3bc88617b16c2f72a98c7
The following commit(s) were added to refs/heads/main by this push:
new 829baf4a7 IDP-2069 - Null Handling Task
829baf4a7 is described below
commit 829baf4a79626f518ef3bc88617b16c2f72a98c7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 28 10:53:20 2023 -0400
IDP-2069 - Null Handling Task
https://shibboleth.atlassian.net/browse/IDP-2069
Clean opensaml-security-impl.
Annotation tweaks to X509Support.
---
.../security/x509/PKIXValidationOptions.java | 7 ++-
.../org/opensaml/security/x509/X509Support.java | 37 +++++--------
.../security/x509/tls/CertificateNameOptions.java | 37 ++++++-------
.../impl/EvaluableCredentialCriteriaRegistry.java | 2 +-
.../impl/EvaluableUsageCredentialCriterion.java | 6 +--
...aluableX509CertSelectorCredentialCriterion.java | 15 ++----
.../EvaluableX509DigestCredentialCriterion.java | 15 ++----
...aluableX509IssuerSerialCredentialCriterion.java | 13 ++---
...509SubjectKeyIdentifierCredentialCriterion.java | 10 ++--
...valuableX509SubjectNameCredentialCriterion.java | 10 ++--
.../impl/AbstractChainingCredentialResolver.java | 9 ++--
...bstractCriteriaFilteringCredentialResolver.java | 8 +--
.../impl/CollectionCredentialResolver.java | 4 +-
.../impl/KeyStoreCredentialResolver.java | 55 ++++++++++---------
.../credential/impl/StaticCredentialResolver.java | 2 +-
.../BasicHttpClientSecurityParametersResolver.java | 25 +++++----
.../impl/SecurityEnhancedTLSSocketFactory.java | 8 +--
.../impl/BaseClientCertAuthSecurityHandler.java | 48 ++++++++++-------
.../impl/BaseTrustEngineSecurityHandler.java | 5 +-
...opulateHttpClientSecurityParametersHandler.java | 15 +++---
.../security/trust/impl/ChainingTrustEngine.java | 7 +--
.../trust/impl/ExplicitKeyTrustEngine.java | 13 ++---
.../trust/impl/ExplicitKeyTrustEvaluator.java | 6 ++-
.../impl/ExplicitX509CertificateTrustEngine.java | 13 ++---
.../ExplicitX509CertificateTrustEvaluator.java | 17 ++----
.../trust/impl/TrustEngineX509TrustManager.java | 3 +-
.../impl/BasicX509CredentialNameEvaluator.java | 21 ++++----
.../x509/impl/CertPathPKIXTrustEvaluator.java | 9 ++--
.../impl/DummyX509CredentialNameEvaluator.java | 3 +-
.../x509/impl/KeyStoreX509CredentialAdapter.java | 26 +++++----
.../x509/impl/PKIXX509CredentialTrustEngine.java | 27 ++++------
.../StaticPKIXValidationInformationResolver.java | 16 +++---
.../impl/X509KeyManagerX509CredentialAdapter.java | 12 ++---
.../BasicClientTLSValidationConfiguration.java | 4 +-
...BasicClientTLSValidationParametersResolver.java | 37 ++++++-------
.../tls/impl/StaticX509CredentialKeyManager.java | 19 +++----
.../impl/ThreadLocalX509CredentialKeyManager.java | 25 +++++----
.../impl/ThreadLocalX509TrustEngineContext.java | 12 ++---
.../impl/ThreadLocalX509TrustEngineSupport.java | 14 +++--
.../x509/tls/impl/ThreadLocalX509TrustManager.java | 8 +--
...tTLSValidationConfigurationInitializerTest.java | 3 +-
.../EvaluableEntityIDCredentialCriterionTest.java | 14 +++--
...aluableKeyAlgorithmCredentialCriterionTest.java | 16 +++---
.../EvaluableKeyLengthCredentialCriterionTest.java | 15 ++----
.../EvaluableKeyNameCredentialCriterionTest.java | 17 +++---
.../EvaluablePublicKeyCredentialCriterionTest.java | 17 +++---
.../EvaluableUsageCredentialCriterionTest.java | 19 +++----
...bleX509CertSelectorCredentialCriterionTest.java | 10 ++--
...EvaluableX509DigestCredentialCriterionTest.java | 28 +++++-----
...bleX509IssuerSerialCredentialCriterionTest.java | 22 ++++----
...ubjectKeyIdentifierCredentialCriterionTest.java | 29 +++++-----
...ableX509SubjectNameCredentialCriterionTest.java | 22 ++++----
.../impl/ChainingCredentialResolverTest.java | 19 ++++---
.../security/crypto/dh/tests/BaseDHTest.java | 5 ++
.../security/crypto/dh/tests/DHSupportTest.java | 4 +-
.../crypto/ec/curves/tests/NamedCurvesTest.java | 55 ++++++++++---------
.../crypto/ec/tests/BaseNamedCurveTest.java | 5 ++
.../security/crypto/ec/tests/ECSupportTest.java | 23 ++++----
.../ec/tests/EnhancedECParameterSpecTest.java | 8 ++-
.../crypto/ec/tests/NamedCurveRegistryTest.java | 40 +++++++-------
.../BasicHttpClientSecurityConfigurationTest.java | 10 ++--
...icHttpClientSecurityParametersResolverTest.java | 28 +++++-----
.../security/httpclient/impl/MockSSLSession.java | 13 +++--
.../security/httpclient/impl/MockSSLSocket.java | 9 +++-
.../httpclient/impl/MockTLSSocketFactory.java | 21 ++++++--
.../impl/SecurityEnhancedTLSSocketFactoryTest.java | 11 ++--
...ateHttpClientSecurityParametersHandlerTest.java | 63 ++++++++++++----------
.../trust/impl/ChainingTrustEngineTest.java | 16 +++---
.../trust/impl/ExplicitKeyTrustEngineTest.java | 1 +
.../ExplicitX509CertificateTrustEngineTest.java | 1 +
.../impl/BasicX509CredentialNameEvaluatorTest.java | 1 +
.../x509/impl/CertPathPKIXTrustEvaluatorTest.java | 1 +
.../impl/PKIXX509CredentialTrustEngineTest.java | 1 +
...taticPKIXValidationInformationResolverTest.java | 1 +
.../BasicClientTLSValidationConfigurationTest.java | 1 +
...cClientTLSValidationParametersResolverTest.java | 9 ++--
.../tls/impl/ThreadLocalX509TrustManagerTest.java | 35 ++++++++----
77 files changed, 607 insertions(+), 609 deletions(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
index 7a18c41b3..b4ffa8672 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
@@ -36,7 +36,7 @@ public class PKIXValidationOptions {
private boolean processCredentialCRLs;
/** Default verification depth. */
- private Integer defaultVerificationDepth;
+ @Nonnull private Integer defaultVerificationDepth;
/** Constructor. */
public PKIXValidationOptions() {
@@ -121,7 +121,7 @@ public class PKIXValidationOptions {
*
* @return Returns the defaultVerificationDepth.
*/
- public Integer getDefaultVerificationDepth() {
+ @Nonnull public Integer getDefaultVerificationDepth() {
return defaultVerificationDepth;
}
@@ -134,8 +134,7 @@ public class PKIXValidationOptions {
* @param depth default verification depth to set
*/
public void setDefaultVerificationDepth(@Nonnull final Integer depth) {
- Constraint.isNotNull(depth, "Default verification depth cannot be null");
- this.defaultVerificationDepth = depth;
+ defaultVerificationDepth = Constraint.isNotNull(depth, "Default verification depth cannot be null");
}
}
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
index a48479037..6750ede43 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
@@ -132,11 +132,8 @@ public class X509Support {
* @since 1.2
*/
@Nullable public static X509Certificate determineEntityCertificate(
- @Nullable final Collection<X509Certificate> certs, @Nullable final PrivateKey privateKey)
+ @Nonnull final Collection<X509Certificate> certs, @Nonnull final PrivateKey privateKey)
throws SecurityException {
- if (certs == null || privateKey == null) {
- return null;
- }
for (final X509Certificate certificate : certs) {
try {
@@ -165,10 +162,7 @@ public class X509Support {
*
* @return the common names that appear in the DN in the order they appear, or null if the given DN is null
*/
- @Nullable public static List<String> getCommonNames(@Nullable final X500Principal dn) {
- if (dn == null) {
- return null;
- }
+ @Nonnull public static List<String> getCommonNames(@Nonnull final X500Principal dn) {
LOG.debug("Extracting CNs from the following DN: {}", dn.toString());
final RDNSequence attrs = NameReader.readX500Principal(dn);
@@ -190,11 +184,8 @@ public class X509Support {
*
* @return the alt names, of the given type, within the cert
*/
- @Nullable public static List<?> getAltNames(@Nullable final X509Certificate certificate,
- @Nullable final Integer[] nameTypes) {
- if (certificate == null || nameTypes == null || nameTypes.length == 0) {
- return null;
- }
+ @Nonnull public static List<?> getAltNames(@Nonnull final X509Certificate certificate,
+ @Nonnull @NotEmpty final Integer[] nameTypes) {
final List<Object> altNames = new LinkedList<>();
final GeneralNameType[] types = new GeneralNameType[nameTypes.length];
@@ -224,19 +215,17 @@ public class X509Support {
*
* @return list of subject names in the certificate
*/
- @Nullable public static List<?> getSubjectNames(@Nullable final X509Certificate certificate,
- @Nullable final Integer[] altNameTypes) {
+ @Nonnull public static List<?> getSubjectNames(@Nonnull final X509Certificate certificate,
+ @Nonnull @NotEmpty final Integer[] altNameTypes) {
final List<Object> issuerNames = new LinkedList<>();
- if (certificate != null) {
- final List<String> entityCertCNs = X509Support.getCommonNames(certificate.getSubjectX500Principal());
- if (entityCertCNs != null && !entityCertCNs.isEmpty()) {
- issuerNames.add(entityCertCNs.get(0));
- }
- final List<?> entityAltNames = X509Support.getAltNames(certificate, altNameTypes);
- if (entityAltNames != null) {
- issuerNames.addAll(entityAltNames);
- }
+ final List<String> entityCertCNs = X509Support.getCommonNames(certificate.getSubjectX500Principal());
+ if (entityCertCNs != null && !entityCertCNs.isEmpty()) {
+ issuerNames.add(entityCertCNs.get(0));
+ }
+ final List<?> entityAltNames = X509Support.getAltNames(certificate, altNameTypes);
+ if (entityAltNames != null) {
+ issuerNames.addAll(entityAltNames);
}
return issuerNames;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
index a1094c519..9c24d3572 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
@@ -17,7 +17,6 @@
package org.opensaml.security.x509.tls;
-import java.util.Collections;
import java.util.LinkedHashSet;
import java.util.Set;
@@ -30,6 +29,8 @@ import org.opensaml.security.x509.X500DNHandler;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
/**
* Options for deriving message context issuer names from an client TLS X.509 certificate.
@@ -43,20 +44,20 @@ public class CertificateNameOptions implements Cloneable {
private boolean evaluateSubjectCommonName;
/** The set of types of subject alternative names evaluate as derived issuer entity ID names. */
- private Set<Integer> subjectAltNames;
+ @Nonnull private Set<Integer> subjectAltNames;
/**
* Responsible for serializing X.500 names to strings from certificate-derived
* {@link javax.security.auth.x500.X500Principal} instances.
*/
- private X500DNHandler x500DNHandler;
+ @Nonnull private X500DNHandler x500DNHandler;
/** The format specifier for serializing X.500 subject names to strings. */
- private String x500SubjectDNFormat;
+ @Nonnull private String x500SubjectDNFormat;
/** Constructor. */
public CertificateNameOptions() {
- subjectAltNames = Collections.emptySet();
+ subjectAltNames = CollectionSupport.emptySet();
x500DNHandler = new InternalX500DNHandler();
x500SubjectDNFormat = X500DNHandler.FORMAT_RFC2253;
}
@@ -115,9 +116,9 @@ public class CertificateNameOptions implements Cloneable {
*/
public void setSubjectAltNames(@Nullable @NonnullElements final Set<Integer> names) {
if (names == null) {
- subjectAltNames = Collections.emptySet();
+ subjectAltNames = CollectionSupport.emptySet();
} else {
- subjectAltNames = Set.copyOf(names);
+ subjectAltNames = CollectionSupport.copyToSet(names);
}
}
@@ -127,7 +128,7 @@ public class CertificateNameOptions implements Cloneable {
*
* @return Returns the x500DNHandler.
*/
- public X500DNHandler getX500DNHandler() {
+ @Nonnull public X500DNHandler getX500DNHandler() {
return x500DNHandler;
}
@@ -137,11 +138,8 @@ public class CertificateNameOptions implements Cloneable {
*
* @param handler the new x500DNHandler value.
*/
- public void setX500DNHandler(final X500DNHandler handler) {
- if (handler == null) {
- throw new IllegalArgumentException("X500DNHandler may not be null");
- }
- x500DNHandler = handler;
+ public void setX500DNHandler(@Nonnull final X500DNHandler handler) {
+ x500DNHandler = Constraint.isNotNull(handler, "X500DNHandler cannot be null");
}
/**
@@ -149,7 +147,7 @@ public class CertificateNameOptions implements Cloneable {
*
* @return Returns the x500SubjectDNFormat.
*/
- public String getX500SubjectDNFormat() {
+ @Nonnull public String getX500SubjectDNFormat() {
return x500SubjectDNFormat;
}
@@ -158,8 +156,8 @@ public class CertificateNameOptions implements Cloneable {
*
* @param format the new x500SubjectDNFormat value.
*/
- public void setX500SubjectDNFormat(final String format) {
- x500SubjectDNFormat = format;
+ public void setX500SubjectDNFormat(@Nonnull final String format) {
+ x500SubjectDNFormat = Constraint.isNotNull(format, "X.500 Subject DN Format cannot be null");
}
/** {@inheritDoc} */
@@ -173,12 +171,11 @@ public class CertificateNameOptions implements Cloneable {
}
clonedOptions.subjectAltNames = new LinkedHashSet<>();
- clonedOptions.subjectAltNames.addAll(this.subjectAltNames);
+ clonedOptions.subjectAltNames.addAll(subjectAltNames);
- clonedOptions.x500DNHandler = this.x500DNHandler.clone();
+ clonedOptions.x500DNHandler = x500DNHandler.clone();
return clonedOptions;
}
-}
-
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java
index dd1c5776d..6545b2c54 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java
@@ -31,10 +31,10 @@ import javax.annotation.Nullable;
import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
import org.opensaml.security.SecurityException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.Criterion;
/**
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
index d79bd514b..066f4f757 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
@@ -22,12 +22,12 @@ import javax.annotation.Nullable;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.UsageType;
import org.opensaml.security.criteria.UsageCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Instance of evaluable credential criteria for evaluating whether a credential contains a particular usage specifier.
@@ -36,10 +36,10 @@ public class EvaluableUsageCredentialCriterion extends AbstractTriStatePredicate
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableUsageCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableUsageCredentialCriterion.class);
/** Base criteria. */
- private final UsageType usage;
+ @Nonnull private final UsageType usage;
/**
* Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
index 87cd075bf..0efc0615e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
@@ -18,18 +18,17 @@
package org.opensaml.security.credential.criteria.impl;
import java.security.cert.X509CertSelector;
-import java.security.cert.X509Certificate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Instance of evaluable credential criteria for evaluating whether a credential's certificate meets the criteria
@@ -40,10 +39,10 @@ public class EvaluableX509CertSelectorCredentialCriterion extends AbstractTriSta
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableX509CertSelectorCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509CertSelectorCredentialCriterion.class);
/** Base criteria. */
- private final X509CertSelector certSelector;
+ @Nonnull private final X509CertSelector certSelector;
/**
* Constructor.
@@ -64,13 +63,7 @@ public class EvaluableX509CertSelectorCredentialCriterion extends AbstractTriSta
return false;
}
- final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
- if (entityCert == null) {
- log.info("X509Credential did not contain an entity certificate, cannot evaluate X509CertSelector criteria");
- return false;
- }
-
- return certSelector.match(entityCert);
+ return certSelector.match(((X509Credential) target).getEntityCertificate());
}
/** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
index 1156ba875..499922dd3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
@@ -29,6 +29,7 @@ import javax.annotation.Nullable;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import org.apache.commons.codec.binary.Hex;
@@ -36,7 +37,6 @@ import org.opensaml.security.credential.Credential;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509DigestCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
@@ -47,13 +47,13 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableX509DigestCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509DigestCredentialCriterion.class);
/** Digest algorithm. */
- private final String algorithm;
+ @Nonnull private final String algorithm;
/** X.509 certificate digest. */
- private final byte[] x509digest;
+ @Nonnull private final byte[] x509digest;
/**
* Constructor.
@@ -74,8 +74,7 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
public EvaluableX509DigestCredentialCriterion(@Nonnull final String alg, @Nonnull final byte[] digest) {
x509digest = Constraint.isNotEmpty(digest, "X.509 digest cannot be null or empty");
final String trimmed = StringSupport.trimOrNull(alg);
- Constraint.isNotNull(trimmed, "Certificate digest algorithm cannot be null or empty");
- algorithm = trimmed;
+ algorithm = Constraint.isNotNull(trimmed, "Certificate digest algorithm cannot be null or empty");
}
/** {@inheritDoc} */
@@ -89,10 +88,6 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
}
final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
- if (entityCert == null) {
- log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
- return false;
- }
try {
final MessageDigest hasher = MessageDigest.getInstance(algorithm);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
index 7346997c9..906914885 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
@@ -26,12 +26,12 @@ import javax.security.auth.x500.X500Principal;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509IssuerSerialCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Instance of evaluable credential criteria for evaluating whether a credential's certificate contains a particular
@@ -41,13 +41,13 @@ public class EvaluableX509IssuerSerialCredentialCriterion extends AbstractTriSta
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableX509IssuerSerialCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509IssuerSerialCredentialCriterion.class);
/** Base criteria. */
- private final X500Principal issuer;
+ @Nonnull private final X500Principal issuer;
/** Base criteria. */
- private final BigInteger serialNumber;
+ @Nonnull private final BigInteger serialNumber;
/**
* Constructor.
@@ -82,11 +82,6 @@ public class EvaluableX509IssuerSerialCredentialCriterion extends AbstractTriSta
}
final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
- if (entityCert == null) {
- log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
- return false;
- }
-
return issuer.equals(entityCert.getIssuerX500Principal()) && serialNumber.equals(entityCert.getSerialNumber());
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
index ead0ffb7f..f505a5365 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.apache.commons.codec.binary.Hex;
import org.opensaml.security.credential.Credential;
@@ -32,7 +33,6 @@ import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509SubjectKeyIdentifierCriterion;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Instance of evaluable credential criteria for evaluating whether a credential's certificate contains a particular
@@ -42,10 +42,10 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectKeyIdentifierCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectKeyIdentifierCredentialCriterion.class);
/** Base criteria. */
- private final byte[] ski;
+ @Nonnull private final byte[] ski;
/**
* Constructor.
@@ -77,10 +77,6 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
}
final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
- if (entityCert == null) {
- log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
- return false;
- }
final byte[] credSKI = X509Support.getSubjectKeyIdentifier(entityCert);
if (credSKI == null || credSKI.length == 0) {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
index 5a764a538..cc42615fa 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
@@ -25,12 +25,12 @@ import javax.security.auth.x500.X500Principal;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509SubjectNameCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* Instance of evaluable credential criteria for evaluating whether a credential's certificate contains a particular
@@ -40,10 +40,10 @@ public class EvaluableX509SubjectNameCredentialCriterion extends AbstractTriStat
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectNameCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectNameCredentialCriterion.class);
/** Base criteria. */
- private final X500Principal subjectName;
+ @Nonnull private final X500Principal subjectName;
/**
* Constructor.
@@ -74,10 +74,6 @@ public class EvaluableX509SubjectNameCredentialCriterion extends AbstractTriStat
}
final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
- if (entityCert == null) {
- log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
- return false;
- }
return subjectName.equals(entityCert.getSubjectX500Principal());
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
index 75d89a600..b3cfba4e8 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
@@ -27,14 +27,15 @@ import javax.annotation.Nullable;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialResolver;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* An abstract implementation of {@link CredentialResolver} which chains together one or more underlying credential
@@ -58,7 +59,7 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
* @param credResolvers the list of chained credential resolvers
*/
public AbstractChainingCredentialResolver(@Nonnull @NonnullElements final List<ResolverType> credResolvers) {
- resolvers = List.copyOf(Constraint.isNotNull(credResolvers, "CredentialResolver list cannot be null"));
+ resolvers = CollectionSupport.copyToList(Constraint.isNotNull(credResolvers, "CredentialResolver list cannot be null"));
}
/**
@@ -85,10 +86,10 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
public class CredentialIterable implements Iterable<Credential> {
/** The chaining credential resolver which owns this instance. */
- private AbstractChainingCredentialResolver<ResolverType> parent;
+ @Nonnull private AbstractChainingCredentialResolver<ResolverType> parent;
/** The criteria set on which to base resolution. */
- private CriteriaSet critSet;
+ @Nullable private CriteriaSet critSet;
/**
* Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java
index ba4963c88..2dd612a44 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java
@@ -17,7 +17,6 @@
package org.opensaml.security.credential.impl;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
import java.util.function.Predicate;
@@ -25,6 +24,7 @@ import java.util.function.Predicate;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
@@ -53,7 +53,6 @@ public abstract class AbstractCriteriaFilteringCredentialResolver extends Abstra
* Constructor.
*/
public AbstractCriteriaFilteringCredentialResolver() {
- super();
satisfyAllPredicates = true;
}
@@ -113,13 +112,14 @@ public abstract class AbstractCriteriaFilteringCredentialResolver extends Abstra
* @throws ResolverException thrown if there is an error obtaining an instance of EvaluableCredentialCriterion
* from the EvaluableCredentialCriteriaRegistry
*/
- private Set<Predicate<Credential>> getPredicates(@Nullable final CriteriaSet criteriaSet)
+ @Nonnull private Set<Predicate<Credential>> getPredicates(@Nullable final CriteriaSet criteriaSet)
throws ResolverException {
if (criteriaSet == null) {
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
final Set<Predicate<Credential>> predicates = new HashSet<>(criteriaSet.size());
for (final Criterion criteria : criteriaSet) {
+ assert criteria != null;
if (criteria instanceof EvaluableCredentialCriterion) {
predicates.add((EvaluableCredentialCriterion) criteria);
} else {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
index 5d0f6f247..37008f694 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
@@ -42,7 +42,7 @@ import net.shibboleth.shared.resolver.ResolverException;
public class CollectionCredentialResolver extends AbstractCriteriaFilteringCredentialResolver {
/** The collection of credentials which is the underlying store for the resolver. */
- private final Collection<Credential> collection;
+ @Nonnull private final Collection<Credential> collection;
/**
* Constructor.
@@ -51,7 +51,6 @@ public class CollectionCredentialResolver extends AbstractCriteriaFilteringCrede
*
*/
public CollectionCredentialResolver() {
- super();
collection = new ArrayList<>();
}
@@ -61,7 +60,6 @@ public class CollectionCredentialResolver extends AbstractCriteriaFilteringCrede
* @param credentials the credential collection which is the backing store for the resolver
*/
public CollectionCredentialResolver(@Nonnull final Collection<Credential> credentials) {
- super();
collection = credentials;
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
index d30a5048c..43c6d3bb4 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
@@ -25,13 +25,14 @@ import java.security.UnrecoverableEntryException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Arrays;
-import java.util.Collections;
import java.util.Map;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -43,7 +44,6 @@ import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
/**
* A {@link org.opensaml.security.credential.CredentialResolver} that extracts {@link Credential}'s from a key store.
@@ -56,16 +56,16 @@ import org.slf4j.LoggerFactory;
public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredentialResolver {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(KeyStoreCredentialResolver.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(KeyStoreCredentialResolver.class);
/** Key store credentials are retrieved from. */
- private final KeyStore keyStore;
+ @Nonnull private final KeyStore keyStore;
/** Passwords for keys. The key must be the entityID, the value the password. */
- private final Map<String, String> keyPasswords;
+ @Nonnull private final Map<String, String> keyPasswords;
/** Usage type of all keys in the store. */
- private final UsageType keystoreUsage;
+ @Nonnull private final UsageType keystoreUsage;
/**
* Constructor.
@@ -110,10 +110,11 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
@Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
throws ResolverException {
- checkCriteriaRequirements(criteriaSet);
+ ;
- final String entityID = criteriaSet.get(EntityIdCriterion.class).getEntityId();
- final UsageCriterion usageCriteria = criteriaSet.get(UsageCriterion.class);
+ final String entityID = checkCriteriaRequirements(criteriaSet).getEntityId();
+
+ final UsageCriterion usageCriteria = criteriaSet != null ? criteriaSet.get(UsageCriterion.class) : null;
final UsageType usage;
if (usageCriteria != null) {
usage = usageCriteria.getUsage();
@@ -123,7 +124,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
if (!matchUsage(keystoreUsage, usage)) {
log.debug("Specified usage criteria {} does not match keystore usage {}", usage, keystoreUsage);
log.debug("Can not resolve credentials from this keystore");
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
KeyStore.PasswordProtection keyPassword = null;
@@ -146,23 +147,30 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
if (keyStoreEntry == null) {
log.debug("Keystore entry for entityID (keystore alias) {} does not exist", entityID);
- return Collections.emptySet();
+ return CollectionSupport.emptySet();
}
final Credential credential = buildCredential(keyStoreEntry, entityID, keystoreUsage);
- return Collections.singleton(credential);
+ return CollectionSupport.singleton(credential);
}
/**
* Check that required credential criteria are available.
*
* @param criteriaSet the credential criteria set to evaluate
+ *
+ * @return the required {@link EntityIdCriterion}.
*/
- protected void checkCriteriaRequirements(@Nullable final CriteriaSet criteriaSet) {
- if (criteriaSet == null || criteriaSet.get(EntityIdCriterion.class) == null) {
+ @Nonnull protected EntityIdCriterion checkCriteriaRequirements(@Nullable final CriteriaSet criteriaSet) {
+
+ final EntityIdCriterion criterion = criteriaSet != null ? criteriaSet.get(EntityIdCriterion.class) : null;
+
+ if (criterion == null) {
log.error("EntityIDCriterion was not specified in the criteria set, resolution cannot be attempted");
throw new IllegalArgumentException("No EntityIDCriterion was available in criteria set");
}
+
+ return criterion;
}
/**
@@ -193,13 +201,12 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
log.debug("Building credential from keystore entry for entityID {}, usage type {}", entityID, usage);
- if (keyStoreEntry instanceof KeyStore.PrivateKeyEntry) {
- return processPrivateKeyEntry((KeyStore.PrivateKeyEntry) keyStoreEntry, entityID, keystoreUsage);
- } else if (keyStoreEntry instanceof KeyStore.TrustedCertificateEntry) {
- return processTrustedCertificateEntry((KeyStore.TrustedCertificateEntry) keyStoreEntry, entityID,
- keystoreUsage);
- } else if (keyStoreEntry instanceof KeyStore.SecretKeyEntry) {
- return processSecretKeyEntry((KeyStore.SecretKeyEntry) keyStoreEntry, entityID, keystoreUsage);
+ if (keyStoreEntry instanceof KeyStore.PrivateKeyEntry entry) {
+ return processPrivateKeyEntry(entry, entityID, keystoreUsage);
+ } else if (keyStoreEntry instanceof KeyStore.TrustedCertificateEntry entry) {
+ return processTrustedCertificateEntry(entry, entityID, keystoreUsage);
+ } else if (keyStoreEntry instanceof KeyStore.SecretKeyEntry entry) {
+ return processSecretKeyEntry(entry, entityID, keystoreUsage);
} else {
throw new ResolverException("KeyStore entry was of an unsupported type: "
+ keyStoreEntry.getClass().getName());
@@ -214,7 +221,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
* @param usage the usage type to set
* @return new X509Credential instance
*/
- protected X509Credential processTrustedCertificateEntry(
+ @Nonnull protected X509Credential processTrustedCertificateEntry(
@Nonnull final KeyStore.TrustedCertificateEntry trustedCertEntry, @Nonnull final String entityID,
@Nonnull final UsageType usage) {
@@ -241,7 +248,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
* @param usage the usage type to set
* @return new X509Credential instance
*/
- protected X509Credential processPrivateKeyEntry(@Nonnull final KeyStore.PrivateKeyEntry privateKeyEntry,
+ @Nonnull protected X509Credential processPrivateKeyEntry(@Nonnull final KeyStore.PrivateKeyEntry privateKeyEntry,
@Nonnull final String entityID, @Nonnull final UsageType usage) {
log.debug("Processing PrivateKeyEntry from keystore");
@@ -265,7 +272,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
* @param usage the usage type to set
* @return new Credential instance
*/
- protected Credential processSecretKeyEntry(@Nonnull final SecretKeyEntry secretKeyEntry,
+ @Nonnull protected Credential processSecretKeyEntry(@Nonnull final SecretKeyEntry secretKeyEntry,
@Nonnull final String entityID, @Nonnull final UsageType usage) {
log.debug("Processing SecretKeyEntry from keystore");
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
index 3a371fceb..e1a7a5ba6 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
@@ -43,7 +43,7 @@ import net.shibboleth.shared.resolver.ResolverException;
public class StaticCredentialResolver extends AbstractCredentialResolver {
/** List of credentials held by this resolver. */
- private List<Credential> creds;
+ @Nonnull private final List<Credential> creds;
/**
* Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
index 326dba3a5..2942f26b9 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
@@ -18,10 +18,10 @@
package org.opensaml.security.httpclient.impl;
import java.security.Key;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.CredentialSupport;
import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
@@ -34,6 +34,7 @@ import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.ObjectSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -55,20 +56,23 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
private Logger log = LoggerFactory.getLogger(BasicHttpClientSecurityParametersResolver.class);
/** {@inheritDoc} */
- public Iterable<HttpClientSecurityParameters> resolve(@Nonnull final CriteriaSet criteria)
+ @Nonnull public Iterable<HttpClientSecurityParameters> resolve(@Nullable final CriteriaSet criteria)
throws ResolverException {
final HttpClientSecurityParameters params = resolveSingle(criteria);
if (params != null) {
- return Collections.singletonList(params);
+ return CollectionSupport.singletonList(params);
} else {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
}
/** {@inheritDoc} */
- public HttpClientSecurityParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
+ @Nullable public HttpClientSecurityParameters resolveSingle(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
Constraint.isNotNull(criteria, "CriteriaSet was null");
+ assert criteria != null;
+
Constraint.isNotNull(criteria.get(HttpClientSecurityConfigurationCriterion.class),
"Resolver requires an instance of HttpClientSecurityConfigurationCriterion");
@@ -93,8 +97,10 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
protected void resolveAndPopulateParams(@Nonnull final HttpClientSecurityParameters params,
@Nonnull final CriteriaSet criteria) {
- final List<HttpClientSecurityConfiguration> configs =
- criteria.get(HttpClientSecurityConfigurationCriterion.class).getConfigurations();
+ final HttpClientSecurityConfigurationCriterion httpCriterion =
+ criteria.get(HttpClientSecurityConfigurationCriterion.class);
+ assert httpCriterion != null;
+ final List<HttpClientSecurityConfiguration> configs = httpCriterion.getConfigurations();
for (final HttpClientSecurityConfiguration config : configs) {
params.setClientTLSCredential(ObjectSupport.firstNonNull(params.getClientTLSCredential(),
@@ -113,8 +119,9 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
config.isServerTLSFailureFatal()));
}
- if (criteria.contains(TLSCriteriaSetCriterion.class)) {
- params.setTLSCriteriaSet(criteria.get(TLSCriteriaSetCriterion.class).getCriteria());
+ final TLSCriteriaSetCriterion tlsCriterion = criteria.get(TLSCriteriaSetCriterion.class);
+ if (tlsCriterion != null) {
+ params.setTLSCriteriaSet(tlsCriterion.getCriteria());
}
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 79a371696..97246aea8 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -44,10 +44,10 @@ import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustEngineContext;
import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustEngineSupport;
import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustManager;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.httpclient.HttpClientSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -110,15 +110,15 @@ import net.shibboleth.shared.resolver.CriteriaSet;
public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocketFactory {
/** Instance of {@link ThreadLocalClientTLSCredentialHandler} to use. */
- private static final ThreadLocalServerTLSHandler SERVER_TLS_HANDLER =
+ @Nonnull private static final ThreadLocalServerTLSHandler SERVER_TLS_HANDLER =
new ThreadLocalServerTLSHandler();
/** Instance of {@link ThreadLocalClientTLSCredentialHandler} to use. */
- private static final ThreadLocalClientTLSCredentialHandler CLIENT_TLS_HANDLER =
+ @Nonnull private static final ThreadLocalClientTLSCredentialHandler CLIENT_TLS_HANDLER =
new ThreadLocalClientTLSCredentialHandler();
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(SecurityEnhancedTLSSocketFactory.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(SecurityEnhancedTLSSocketFactory.class);
/** The HttpClient socket factory instance wrapped by this implementation. */
@Nonnull private LayeredConnectionSocketFactory wrappedFactory;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
index 5153d0a28..529ac462a 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
@@ -37,8 +37,8 @@ import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509Support;
import org.opensaml.security.x509.tls.CertificateNameOptions;
+import org.opensaml.security.x509.tls.ClientTLSValidationParameters;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
@@ -48,6 +48,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.codec.Base64Support;
import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.NonnullSupplier;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -157,10 +158,13 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
@Nonnull final MessageContext messageContext) {
final ClientTLSSecurityParametersContext secContext =
messageContext.getSubcontext(ClientTLSSecurityParametersContext.class);
- if (secContext == null || secContext.getValidationParameters() == null) {
- return null;
+
+ final ClientTLSValidationParameters params = secContext != null ? secContext.getValidationParameters() : null;
+ if (params != null) {
+ return params.getX509TrustEngine();
}
- return secContext.getValidationParameters().getX509TrustEngine();
+
+ return null;
}
/** {@inheritDoc} */
@@ -178,11 +182,12 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
getLogPrefix());
return false;
}
- if (secContext == null || secContext.getValidationParameters() == null
- || secContext.getValidationParameters().getCertificateNameOptions() == null) {
+
+ final ClientTLSValidationParameters params = secContext != null ? secContext.getValidationParameters() : null;
+ if (params == null || params.getCertificateNameOptions() == null) {
throw new MessageHandlerException("CertificateNameOptions was not available from the MessageContext");
}
- certNameOptions = secContext.getValidationParameters().getCertificateNameOptions();
+ certNameOptions = params.getCertificateNameOptions();
return true;
}
@@ -315,6 +320,7 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
final CriteriaSet criteriaSet = new CriteriaSet();
if (!Strings.isNullOrEmpty(entityID)) {
+ assert entityID != null;
criteriaSet.add(new EntityIdCriterion(entityID));
}
@@ -375,26 +381,29 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
* @throws MessageHandlerException thrown if there is error during processing
*/
@Nullable protected String evaluateCertificateNameDerivedPresenters(
- @Nullable final X509Credential requestCredential, @Nonnull final MessageContext messageContext)
+ @Nonnull final X509Credential requestCredential, @Nonnull final MessageContext messageContext)
throws MessageHandlerException {
String candidatePresenter = null;
- if (getCertificateNameOptions().evaluateSubjectDN()) {
+ final CertificateNameOptions localOptions = certNameOptions;
+ assert localOptions != null;
+
+ if (localOptions.evaluateSubjectDN()) {
candidatePresenter = evaluateSubjectDN(requestCredential, messageContext);
if (candidatePresenter != null) {
return candidatePresenter;
}
}
- if (!getCertificateNameOptions().getSubjectAltNames().isEmpty()) {
+ if (!localOptions.getSubjectAltNames().isEmpty()) {
candidatePresenter = evaluateSubjectAltNames(requestCredential, messageContext);
if (candidatePresenter != null) {
return candidatePresenter;
}
}
- if (getCertificateNameOptions().evaluateSubjectCommonName()) {
+ if (localOptions.evaluateSubjectCommonName()) {
candidatePresenter = evaluateSubjectCommonName(requestCredential, messageContext);
if (candidatePresenter != null) {
return candidatePresenter;
@@ -472,7 +481,8 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
log.debug("{} Evaluating client cert by deriving presenter from subject alt names", getLogPrefix());
final X509Certificate certificate = requestCredential.getEntityCertificate();
- for (final Integer altNameType : getCertificateNameOptions().getSubjectAltNames()) {
+ assert certNameOptions != null;
+ for (final Integer altNameType : certNameOptions.getSubjectAltNames()) {
log.debug("{} Evaluating alt names of type: {}", getLogPrefix(), altNameType.toString());
final List<String> altNames = getAltNames(certificate, altNameType);
for (final String altName : altNames) {
@@ -511,16 +521,16 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
* @return the subject name
*/
@Nullable protected String getSubjectName(@Nonnull final X509Certificate cert) {
- if (cert == null) {
- return null;
- }
+ final CertificateNameOptions localOptions = certNameOptions;
+ assert localOptions != null;
+
String name = null;
- if (!Strings.isNullOrEmpty(getCertificateNameOptions().getX500SubjectDNFormat())) {
+ if (!Strings.isNullOrEmpty(localOptions.getX500SubjectDNFormat())) {
name =
- getCertificateNameOptions().getX500DNHandler().getName(cert.getSubjectX500Principal(),
- getCertificateNameOptions().getX500SubjectDNFormat());
+ localOptions.getX500DNHandler().getName(cert.getSubjectX500Principal(),
+ localOptions.getX500SubjectDNFormat());
} else {
- name = getCertificateNameOptions().getX500DNHandler().getName(cert.getSubjectX500Principal());
+ name = localOptions.getX500DNHandler().getName(cert.getSubjectX500Principal());
}
log.debug("{} Extracted subject name from certificate: {}", getLogPrefix(), name);
return name;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
index 1905146e5..dd723462e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
@@ -26,8 +26,8 @@ import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.security.SecurityException;
import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -124,7 +124,8 @@ public abstract class BaseTrustEngineSecurityHandler<TokenType> extends Abstract
protected boolean evaluate(@Nonnull final TokenType token, @Nullable final CriteriaSet criteriaSet)
throws MessageHandlerException {
try {
- return getTrustEngine().validate(token, criteriaSet);
+ assert trustEngine != null;
+ return trustEngine.validate(token, criteriaSet);
} catch (final SecurityException e) {
log.error("{} There was an error evaluating the request's token using the trust engine: {}", getLogPrefix(),
e.getMessage());
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
index 42d1ff79d..d4175dc9c 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
@@ -17,7 +17,6 @@
package org.opensaml.security.messaging.impl;
-import java.util.Collections;
import java.util.List;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -37,11 +36,12 @@ import org.opensaml.security.httpclient.TLSCriteriaSetCriterion;
import org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration;
import org.opensaml.security.messaging.HttpClientSecurityContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -155,7 +155,7 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
// is semi-required (depending on usage), and that can't be defaulted anyway.
//
// Just return an empty instance to satisfy contract requirements.
- return Collections.<HttpClientSecurityConfiguration>singletonList(
+ return CollectionSupport.singletonList(
new BasicHttpClientSecurityConfiguration());
}
};
@@ -206,8 +206,9 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
final CriteriaSet criteria = new CriteriaSet(new HttpClientSecurityConfigurationCriterion(configs));
- if (paramsCtx.getTLSCriteriaSetStrategy() != null) {
- final CriteriaSet tlsCriteriaSet = paramsCtx.getTLSCriteriaSetStrategy().apply(messageContext);
+ final Function<MessageContext,CriteriaSet> criteriaStrategy = paramsCtx.getTLSCriteriaSetStrategy();
+ if (criteriaStrategy != null) {
+ final CriteriaSet tlsCriteriaSet = criteriaStrategy.apply(messageContext);
if (tlsCriteriaSet != null) {
criteria.add(new TLSCriteriaSetCriterion(tlsCriteriaSet));
}
@@ -234,9 +235,9 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
* @param params the parameters to process
*/
protected void postProcessParams(@Nonnull final MessageContext messageContext,
- @Nonnull final HttpClientSecurityParameters params) {
+ @Nullable final HttpClientSecurityParameters params) {
- if (clientTLSPredicate != null) {
+ if (params != null && clientTLSPredicate != null) {
if (!clientTLSPredicate.test(messageContext)) {
log.debug("Configured client TLS predicate indicates to exclude client TLS credential");
params.setClientTLSCredential(null);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
index e60e3cd88..6fb2db23d 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
@@ -25,13 +25,14 @@ import javax.annotation.Nullable;
import org.opensaml.security.SecurityException;
import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -46,7 +47,7 @@ public class ChainingTrustEngine<TokenType> implements TrustEngine<TokenType> {
@Nonnull private final Logger log = LoggerFactory.getLogger(ChainingTrustEngine.class);
/** The chain of subordinate trust engines. */
- @Nonnull @NonnullElements private List<TrustEngine<? super TokenType>> engines;
+ @Nonnull private List<TrustEngine<? super TokenType>> engines;
/**
* Constructor.
@@ -55,7 +56,7 @@ public class ChainingTrustEngine<TokenType> implements TrustEngine<TokenType> {
*/
public ChainingTrustEngine(
@Nonnull @NonnullElements @ParameterName(name="chain") final List<TrustEngine<? super TokenType>> chain) {
- engines = List.copyOf(Constraint.isNotNull(chain, "TrustEngine list cannot be null"));
+ engines = CollectionSupport.copyToList(Constraint.isNotNull(chain, "TrustEngine list cannot be null"));
}
/**
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java
index cb9b50652..b13fde70e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java
@@ -25,10 +25,10 @@ import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.trust.TrustedCredentialTrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -42,13 +42,13 @@ import net.shibboleth.shared.resolver.ResolverException;
public class ExplicitKeyTrustEngine implements TrustedCredentialTrustEngine<Credential> {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEngine.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEngine.class);
/** Resolver used for resolving trusted credentials. */
- private final CredentialResolver credentialResolver;
+ @Nonnull private final CredentialResolver credentialResolver;
/** Trust evaluator. */
- private final ExplicitKeyTrustEvaluator trustEvaluator;
+ @Nonnull private final ExplicitKeyTrustEvaluator trustEvaluator;
/**
* Constructor.
@@ -72,11 +72,6 @@ public class ExplicitKeyTrustEngine implements TrustedCredentialTrustEngine<Cred
public boolean validate(@Nonnull final Credential untrustedCredential,
@Nullable final CriteriaSet trustBasisCriteria) throws SecurityException {
- if (untrustedCredential == null) {
- log.error("Credential was null, unable to perform validation");
- return false;
- }
-
log.debug("Attempting to validate untrusted credential");
try {
final Iterable<Credential> trustedCredentials = getCredentialResolver().resolve(trustBasisCriteria);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java
index 71c6ee2d8..cacd66815 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java
@@ -23,7 +23,8 @@ import javax.annotation.Nonnull;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Auxillary trust evaluator for evaluating an untrusted key or credential against a trusted key or credential. Trust is
@@ -33,7 +34,7 @@ import org.slf4j.LoggerFactory;
public class ExplicitKeyTrustEvaluator {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEvaluator.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEvaluator.class);
/**
* Evaluate trust.
@@ -109,6 +110,7 @@ public class ExplicitKeyTrustEvaluator {
@Nonnull final Iterable<Credential> trustedCredentials) {
for (final Credential trustedCredential : trustedCredentials) {
+ assert trustedCredential != null;
if (validate(untrustedCredential, trustedCredential)) {
return true;
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java
index 6f0ffd1fc..387c3dd90 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java
@@ -26,10 +26,10 @@ import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.trust.TrustedCredentialTrustEngine;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -44,13 +44,13 @@ import net.shibboleth.shared.resolver.ResolverException;
public class ExplicitX509CertificateTrustEngine implements TrustedCredentialTrustEngine<X509Credential> {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEngine.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEngine.class);
/** Resolver used for resolving trusted credentials. */
- private final CredentialResolver credentialResolver;
+ @Nonnull private final CredentialResolver credentialResolver;
/** Trust evaluator. */
- private final ExplicitX509CertificateTrustEvaluator trustEvaluator;
+ @Nonnull private final ExplicitX509CertificateTrustEvaluator trustEvaluator;
/**
* Constructor.
@@ -75,11 +75,6 @@ public class ExplicitX509CertificateTrustEngine implements TrustedCredentialTrus
public boolean validate(@Nonnull final X509Credential untrustedCredential,
@Nullable final CriteriaSet trustBasisCriteria) throws SecurityException {
- if (untrustedCredential == null) {
- log.error("X.509 credential was null, unable to perform validation");
- return false;
- }
-
log.debug("Attempting to validate untrusted credential");
try {
final Iterable<Credential> trustedCredentials = getCredentialResolver().resolve(trustBasisCriteria);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java
index c36cacc24..5699ba9b0 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java
@@ -24,7 +24,8 @@ import javax.annotation.Nonnull;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Auxillary trust evaluator for evaluating an untrusted X509 certificate or credential against a trusted certificate or
@@ -35,7 +36,7 @@ import org.slf4j.LoggerFactory;
public class ExplicitX509CertificateTrustEvaluator {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEvaluator.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEvaluator.class);
/**
* Evaluate trust.
@@ -77,17 +78,7 @@ public class ExplicitX509CertificateTrustEvaluator {
public boolean validate(@Nonnull final X509Credential untrustedCredential,
@Nonnull final X509Credential trustedCredential) {
- final X509Certificate untrustedCertificate = untrustedCredential.getEntityCertificate();
- final X509Certificate trustedCertificate = trustedCredential.getEntityCertificate();
- if (untrustedCertificate == null) {
- log.debug("Untrusted credential contained no entity certificate, unable to evaluate");
- return false;
- } else if (trustedCertificate == null) {
- log.debug("Trusted credential contained no entity certificate, unable to evaluate");
- return false;
- }
-
- if (validate(untrustedCertificate, trustedCertificate)) {
+ if (validate(untrustedCredential.getEntityCertificate(), trustedCredential.getEntityCertificate())) {
log.debug("Successfully validated untrusted credential against trusted certificate");
return true;
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java
index 73d7bdb7f..701d145dc 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java
@@ -33,8 +33,8 @@ import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -98,6 +98,7 @@ public class TrustEngineX509TrustManager implements X509TrustManager {
}
try {
+ assert tlsTrustEngine != null;
if (tlsTrustEngine.validate(credential, criteriaSet)) {
log.debug("Credential evaluated as trusted");
} else {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
index 5d36fde01..167692b61 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
@@ -18,9 +18,6 @@
package org.opensaml.security.x509.impl;
import java.security.cert.X509Certificate;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
import java.util.List;
import java.util.Set;
@@ -31,7 +28,9 @@ import javax.security.auth.x500.X500Principal;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import org.opensaml.security.SecurityException;
import org.opensaml.security.x509.InternalX500DNHandler;
@@ -39,7 +38,6 @@ import org.opensaml.security.x509.X500DNHandler;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
@@ -73,7 +71,7 @@ import com.google.common.base.Strings;
public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvaluator {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(BasicX509CredentialNameEvaluator.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicX509CredentialNameEvaluator.class);
/** Flag as to whether to perform name checking using credential's subject alt names. */
private boolean checkSubjectAltNames;
@@ -85,10 +83,10 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
private boolean checkSubjectDN;
/** The set of types of subject alternative names to process. */
- private Set<Integer> subjectAltNameTypes;
+ @Nonnull private Set<Integer> subjectAltNameTypes;
/** Responsible for parsing and serializing X.500 names to/from {@link X500Principal} instances. */
- private X500DNHandler x500DNHandler;
+ @Nonnull private X500DNHandler x500DNHandler;
/** Constructor. */
public BasicX509CredentialNameEvaluator() {
@@ -99,7 +97,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
setCheckSubjectAltNames(true);
setCheckSubjectDNCommonName(true);
setCheckSubjectDN(true);
- setSubjectAltNameTypes(new HashSet<>(Arrays.asList(X509Support.DNS_ALT_NAME, X509Support.URI_ALT_NAME)));
+ subjectAltNameTypes = CollectionSupport.setOf(X509Support.DNS_ALT_NAME, X509Support.URI_ALT_NAME);
}
/**
@@ -119,7 +117,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
*
* @return the immutable set of alt name identifiers
*/
- @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<Integer> getSubjectAltNameTypes() {
+ @Nonnull @NotLive @Unmodifiable public Set<Integer> getSubjectAltNameTypes() {
return subjectAltNameTypes;
}
@@ -133,9 +131,9 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
*/
public void setSubjectAltNameTypes(@Nullable @NonnullElements final Set<Integer> nameTypes) {
if (nameTypes == null) {
- subjectAltNameTypes = Collections.emptySet();
+ subjectAltNameTypes = CollectionSupport.emptySet();
} else {
- subjectAltNameTypes = Set.copyOf(nameTypes);
+ subjectAltNameTypes = CollectionSupport.copyToSet(nameTypes);
}
}
@@ -346,6 +344,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
log.debug("Extracted X500Principal from certificate: {}", x500DNHandler.getName(subjectPrincipal));
}
for (final String trustedName : trustedNames) {
+ assert trustedName != null;
X500Principal trustedNamePrincipal = null;
try {
trustedNamePrincipal = x500DNHandler.parse(trustedName);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
index ebc5d45ff..146d65609 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
@@ -50,10 +50,10 @@ import org.opensaml.security.x509.X500DNHandler;
import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.X509Support;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An implementation of {@link PKIXTrustEvaluator} that is based on the Java CertPath API.
@@ -61,16 +61,16 @@ import net.shibboleth.shared.logic.Constraint;
public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(CertPathPKIXTrustEvaluator.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(CertPathPKIXTrustEvaluator.class);
/**
* Responsible for parsing and serializing X.500 names to/from
* {@link javax.security.auth.x500.X500Principal} instances.
*/
- private X500DNHandler x500DNHandler;
+ @Nonnull private X500DNHandler x500DNHandler;
/** Options influencing processing behavior. */
- private PKIXValidationOptions options;
+ @Nonnull private PKIXValidationOptions options;
/** Constructor. */
public CertPathPKIXTrustEvaluator() {
@@ -290,6 +290,7 @@ public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
log.trace("Constructing trust anchors for PKIX validation");
final Set<TrustAnchor> trustAnchors = new HashSet<>();
for (final X509Certificate cert : validationCertificates) {
+ assert cert != null;
trustAnchors.add(buildTrustAnchor(cert));
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java
index 610d176ae..a164c96e3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java
@@ -25,7 +25,8 @@ import javax.annotation.Nullable;
import org.opensaml.security.SecurityException;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A dummy implementation of {@link X509CredentialNameEvaluator} which always returns true.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
index 1ff5ca527..811c7fdfe 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
@@ -28,7 +28,6 @@ import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -39,26 +38,27 @@ import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.UsageType;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/** A wrapper that changes a {@link KeyStore} in to a {@link X509Credential}. */
public class KeyStoreX509CredentialAdapter extends AbstractCredential implements X509Credential {
/** Class logger. */
- private Logger log = LoggerFactory.getLogger(KeyStoreX509CredentialAdapter.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(KeyStoreX509CredentialAdapter.class);
/** Keystore that contains the credential to be exposed. */
- private final KeyStore keyStore;
+ @Nonnull private final KeyStore keyStore;
/** Alias to the credential to be exposed. */
- private final String credentialAlias;
+ @Nonnull private final String credentialAlias;
/** Password for the key to be exposed. */
- private final char[] keyPassword;
+ @Nullable private final char[] keyPassword;
/**
* Constructor.
@@ -69,7 +69,7 @@ public class KeyStoreX509CredentialAdapter extends AbstractCredential implements
*/
public KeyStoreX509CredentialAdapter(@Nonnull @ParameterName(name="store") final KeyStore store,
@Nonnull @ParameterName(name="alias") final String alias,
- @Nullable @ParameterName(name="password") final char[] password) {
+ @Nullable @ParameterName(name="password") final char[] password) {
keyStore = Constraint.isNotNull(store, "Keystore cannot be null");
credentialAlias = Constraint.isNotNull(StringSupport.trimOrNull(alias),
"Keystore alias cannot be null or empty");
@@ -79,24 +79,28 @@ public class KeyStoreX509CredentialAdapter extends AbstractCredential implements
/** {@inheritDoc} */
@Override
@Nullable public Collection<X509CRL> getCRLs() {
- return Collections.EMPTY_LIST;
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
@Override
@Nonnull public X509Certificate getEntityCertificate() {
try {
- return (X509Certificate) keyStore.getCertificate(credentialAlias);
+ final Certificate cert = keyStore.getCertificate(credentialAlias);
+ if (cert instanceof X509Certificate c) {
+ return c;
+ }
+ throw new KeyStoreException("Certificate entry was not an X509Certificate");
} catch (final KeyStoreException e) {
log.error("Error accessing {} certificates in keystore", credentialAlias, e);
- return null;
+ throw new IllegalStateException("Error accessing certificate in keystore");
}
}
/** {@inheritDoc} */
@Override
@Nonnull public Collection<X509Certificate> getEntityCertificateChain() {
- List<X509Certificate> certsCollection = Collections.EMPTY_LIST;
+ List<X509Certificate> certsCollection = CollectionSupport.emptyList();
try {
final Certificate[] certs = keyStore.getCertificateChain(credentialAlias);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
index 55b1a5af8..c7981d162 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
@@ -29,10 +29,10 @@ import org.opensaml.security.x509.PKIXValidationInformation;
import org.opensaml.security.x509.PKIXValidationInformationResolver;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -43,16 +43,16 @@ import net.shibboleth.shared.resolver.ResolverException;
public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Credential> {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(PKIXX509CredentialTrustEngine.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(PKIXX509CredentialTrustEngine.class);
/** Resolver used for resolving trusted credentials. */
- private final PKIXValidationInformationResolver pkixResolver;
+ @Nonnull private final PKIXValidationInformationResolver pkixResolver;
/** The external PKIX trust evaluator used to establish trust. */
- private final PKIXTrustEvaluator pkixTrustEvaluator;
+ @Nonnull private final PKIXTrustEvaluator pkixTrustEvaluator;
/** The external credential name evaluator used to establish trusted name compliance. */
- private final X509CredentialNameEvaluator credNameEvaluator;
+ @Nullable private final X509CredentialNameEvaluator credNameEvaluator;
/**
* Constructor.
@@ -136,15 +136,6 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
log.debug("Attempting PKIX validation of untrusted credential");
- // Nulls here technically violate the method constraints anyway
- if (untrustedCredential == null) {
- log.error("X.509 credential was null, unable to perform validation");
- return false;
- } else if (untrustedCredential.getEntityCertificate() == null) {
- log.error("Untrusted X.509 credential's entity certificate was null, unable to perform validation");
- return false;
- }
-
Set<String> trustedNames = null;
if (getPKIXResolver().supportsTrustedNameResolution()) {
try {
@@ -189,6 +180,7 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
}
for (final PKIXValidationInformation validationInfo : validationInfoSet) {
+ assert validationInfo != null;
try {
if (getPKIXTrustEvaluator().validate(validationInfo, untrustedX509Credential)) {
log.debug("Credential trust established via PKIX validation");
@@ -216,14 +208,15 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
protected boolean checkNames(@Nullable final Set<String> trustedNames,
@Nonnull final X509Credential untrustedCredential) throws SecurityException {
- if (getX509CredentialNameEvaluator() == null) {
+ if (credNameEvaluator == null) {
log.debug("No credential name evaluator was available, skipping trusted name evaluation");
- return true;
+ return true;
} else if (trustedNames == null) {
log.debug("Trusted names was null, signalling PKIX resolver does not support trusted names resolution, "
+ "skipping trusted name evaluation");
- return true;
+ return true;
} else {
+ assert credNameEvaluator != null;
return credNameEvaluator.evaluate(untrustedCredential, trustedNames);
}
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
index 17e5e3c07..0431346bf 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
@@ -18,7 +18,6 @@
package org.opensaml.security.x509.impl;
import java.util.ArrayList;
-import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
@@ -31,9 +30,8 @@ import org.opensaml.security.x509.PKIXValidationInformation;
import org.opensaml.security.x509.PKIXValidationInformationResolver;
import org.opensaml.security.x509.TrustedNamesCriterion;
-import com.google.common.collect.ImmutableSet;
-
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -44,10 +42,10 @@ import net.shibboleth.shared.resolver.ResolverException;
public class StaticPKIXValidationInformationResolver implements PKIXValidationInformationResolver {
/** The PKIX validation information to return. */
- private final List<PKIXValidationInformation> pkixInfo;
+ @Nonnull private final List<PKIXValidationInformation> pkixInfo;
/** The set of trusted names to return. */
- private final Set<String> trustedNames;
+ @Nonnull private final Set<String> trustedNames;
/** Flag indicating whether dynamic trusted names should be extracted from criteria set. */
private boolean supportDynamicTrustedNames;
@@ -81,13 +79,13 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
if (info != null) {
pkixInfo = new ArrayList<>(info);
} else {
- pkixInfo = Collections.emptyList();
+ pkixInfo = CollectionSupport.emptyList();
}
if (names != null) {
trustedNames = new HashSet<>(names);
} else {
- trustedNames = Collections.emptySet();
+ trustedNames = CollectionSupport.emptySet();
}
supportDynamicTrustedNames = supportDynamicNames;
@@ -97,7 +95,7 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
@Override
@Nonnull public Set<String> resolveTrustedNames(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
if (criteriaSet == null) {
- return ImmutableSet.copyOf(trustedNames);
+ return CollectionSupport.copyToSet(trustedNames);
}
final HashSet<String> temp = new HashSet<>(trustedNames);
@@ -113,7 +111,7 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
}
}
- return ImmutableSet.copyOf(temp);
+ return CollectionSupport.copyToSet(temp);
}
/** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java
index 4e7d801f5..f007ae516 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java
@@ -23,7 +23,6 @@ import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collection;
-import java.util.Collections;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -35,6 +34,7 @@ import org.opensaml.security.credential.UsageType;
import org.opensaml.security.x509.X509Credential;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.StringSupport;
@@ -42,10 +42,10 @@ import net.shibboleth.shared.primitive.StringSupport;
public class X509KeyManagerX509CredentialAdapter extends AbstractCredential implements X509Credential {
/** Alias used to reference the credential in the key manager. */
- private final String credentialAlias;
+ @Nonnull private final String credentialAlias;
/** Wrapped key manager. */
- private final X509KeyManager keyManager;
+ @Nonnull private final X509KeyManager keyManager;
/**
* Constructor.
@@ -62,7 +62,7 @@ public class X509KeyManagerX509CredentialAdapter extends AbstractCredential impl
/** {@inheritDoc} */
@Override
@Nullable public Collection<X509CRL> getCRLs() {
- return Collections.EMPTY_LIST;
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
@@ -73,7 +73,7 @@ public class X509KeyManagerX509CredentialAdapter extends AbstractCredential impl
return certs[0];
}
- return null;
+ throw new IllegalStateException("Error accessing certificate in key manager");
}
/** {@inheritDoc} */
@@ -84,7 +84,7 @@ public class X509KeyManagerX509CredentialAdapter extends AbstractCredential impl
return Arrays.asList(certs);
}
- return null;
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
index 0912d5bd4..16d3f2594 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
@@ -36,7 +36,6 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
@Nullable private CertificateNameOptions certificateNameOptions;
/** {@inheritDoc} */
- @Override
@Nullable public TrustEngine<? super X509Credential> getX509TrustEngine() {
return x509TrustEngine;
}
@@ -51,7 +50,6 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
}
/** {@inheritDoc} */
- @Override
@Nullable public CertificateNameOptions getCertificateNameOptions() {
return certificateNameOptions;
}
@@ -65,4 +63,4 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
certificateNameOptions = options;
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
index cfa5792df..9709ec8d3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
@@ -17,12 +17,10 @@
package org.opensaml.security.x509.tls.impl;
-import java.util.Collections;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -48,26 +46,25 @@ import org.opensaml.security.x509.tls.ClientTLSValidationParametersResolver;
public class BasicClientTLSValidationParametersResolver implements ClientTLSValidationParametersResolver {
/** {@inheritDoc} */
- @Nonnull @NonnullElements public Iterable<ClientTLSValidationParameters> resolve(final CriteriaSet criteria)
+ @Nonnull public Iterable<ClientTLSValidationParameters> resolve(@Nullable final CriteriaSet criteria)
throws ResolverException {
final ClientTLSValidationParameters params = resolveSingle(criteria);
if (params != null) {
- return Collections.singletonList(params);
+ return CollectionSupport.singletonList(params);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- @Nonnull public ClientTLSValidationParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(ClientTLSValidationConfigurationCriterion.class),
- "Resolver requires an instance of ClientTLSValidationConfigurationCriterion");
+ @Nullable public ClientTLSValidationParameters resolveSingle(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
+ final CriteriaSet localCriteria = Constraint.isNotNull(criteria, "CriteriaSet was null");
final ClientTLSValidationParameters params = new ClientTLSValidationParameters();
- params.setX509TrustEngine(resolveTrustEngine(criteria));
+ params.setX509TrustEngine(resolveTrustEngine(localCriteria));
- params.setCertificateNameOptions(resolveNameOptions(criteria));
+ params.setCertificateNameOptions(resolveNameOptions(localCriteria));
return params;
}
@@ -82,8 +79,10 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
*/
@Nullable protected TrustEngine<? super X509Credential> resolveTrustEngine(@Nonnull final CriteriaSet criteria) {
- for (final ClientTLSValidationConfiguration config :
- criteria.get(ClientTLSValidationConfigurationCriterion.class).getConfigurations()) {
+ final var tlsCriterion = Constraint.isNotNull(criteria.get(ClientTLSValidationConfigurationCriterion.class),
+ "Resolver requires an instance of ClientTLSValidationConfigurationCriterion");
+
+ for (final ClientTLSValidationConfiguration config : tlsCriterion.getConfigurations()) {
if (config.getX509TrustEngine() != null) {
return config.getX509TrustEngine();
}
@@ -99,9 +98,11 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
* @return the effective name options, or null
*/
@Nullable protected CertificateNameOptions resolveNameOptions(@Nonnull final CriteriaSet criteria) {
-
- for (final ClientTLSValidationConfiguration config :
- criteria.get(ClientTLSValidationConfigurationCriterion.class).getConfigurations()) {
+
+ final var tlsCriterion = Constraint.isNotNull(criteria.get(ClientTLSValidationConfigurationCriterion.class),
+ "Resolver requires an instance of ClientTLSValidationConfigurationCriterion");
+
+ for (final ClientTLSValidationConfiguration config : tlsCriterion.getConfigurations()) {
if (config.getCertificateNameOptions() != null) {
return config.getCertificateNameOptions();
}
@@ -109,4 +110,4 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
return null;
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java
index 1ae0665eb..aa12b2e43 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java
@@ -23,13 +23,14 @@ import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.Collection;
+import javax.annotation.Nonnull;
import javax.net.ssl.X509KeyManager;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An implementation of {@link X509KeyManager} based on a single statically configured
@@ -39,16 +40,16 @@ import net.shibboleth.shared.logic.Constraint;
public class StaticX509CredentialKeyManager implements X509KeyManager {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(StaticX509CredentialKeyManager.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(StaticX509CredentialKeyManager.class);
/** The private key instance. */
- private PrivateKey privateKey;
+ @Nonnull private PrivateKey privateKey;
/** The certificate chain instance. */
- private java.security.cert.X509Certificate[] certificateChain;
+ @Nonnull private java.security.cert.X509Certificate[] certificateChain;
/** The alias representing the supplied static credential. */
- private String internalAlias = "internalAlias-" + this.toString();
+ @Nonnull private String internalAlias = "internalAlias-" + this.toString();
/**
* Constructor.
@@ -56,13 +57,10 @@ public class StaticX509CredentialKeyManager implements X509KeyManager {
* @param credential the static credential managed by this key manager
*/
public StaticX509CredentialKeyManager(final X509Credential credential) {
- super();
Constraint.isNotNull(credential, "Credential may not be null");
- privateKey = Constraint.isNotNull(credential.getPrivateKey(),
- "Credential PrivateKey may not be null");
+ privateKey = Constraint.isNotNull(credential.getPrivateKey(), "Credential PrivateKey may not be null");
certificateChain = Constraint.isNotNull(credential.getEntityCertificateChain(),
- "Credential certificate chain may not be null")
- .toArray(new X509Certificate[0]);
+ "Credential certificate chain may not be null").toArray(new X509Certificate[0]);
log.trace("Generated static internal alias was: {}", internalAlias);
}
@@ -73,7 +71,6 @@ public class StaticX509CredentialKeyManager implements X509KeyManager {
* @param chain the certificate chain managed by this key manager
*/
public StaticX509CredentialKeyManager(final PrivateKey key, final Collection<X509Certificate> chain) {
- super();
privateKey = Constraint.isNotNull(key, "PrivateKey may not be null");
certificateChain = Constraint.isNotNull(chain,
"Certificate chain may not be null").toArray(new X509Certificate[0]);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java
index db32bb769..c8d606a48 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java
@@ -22,10 +22,13 @@ import java.security.Principal;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
import javax.net.ssl.X509KeyManager;
+import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An implementation of {@link X509KeyManager} which returns data based on the thread-local credential
@@ -34,10 +37,10 @@ import org.slf4j.LoggerFactory;
public class ThreadLocalX509CredentialKeyManager implements X509KeyManager {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(ThreadLocalX509CredentialKeyManager.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(ThreadLocalX509CredentialKeyManager.class);
/** The alias representing the supplied static credential. */
- private String internalAlias = "internalAlias-ThreadLocal";
+ @Nonnull private String internalAlias = "internalAlias-ThreadLocal";
/** {@inheritDoc} */
public String chooseClientAlias(final String[] arg0, final Principal[] arg1, final Socket arg2) {
@@ -54,16 +57,20 @@ public class ThreadLocalX509CredentialKeyManager implements X509KeyManager {
/** {@inheritDoc} */
public X509Certificate[] getCertificateChain(final String arg0) {
log.trace("In getCertificateChain");
- return internalAlias.equals(arg0) && ThreadLocalX509CredentialContext.haveCurrent()
- ? ThreadLocalX509CredentialContext.getCredential().getEntityCertificateChain()
- .toArray(new X509Certificate[0]) : null;
+
+ final X509Credential cred = ThreadLocalX509CredentialContext.getCredential();
+
+ return internalAlias.equals(arg0) &&
+ cred != null ? cred.getEntityCertificateChain().toArray(new X509Certificate[0]) : null;
}
/** {@inheritDoc} */
public PrivateKey getPrivateKey(final String arg0) {
log.trace("In getPrivateKey");
- return internalAlias.equals(arg0) && ThreadLocalX509CredentialContext.haveCurrent()
- ? ThreadLocalX509CredentialContext.getCredential().getPrivateKey() : null;
+
+ final X509Credential cred = ThreadLocalX509CredentialContext.getCredential();
+
+ return internalAlias.equals(arg0) && cred != null ? cred.getPrivateKey() : null;
}
/** {@inheritDoc} */
@@ -78,4 +85,4 @@ public class ThreadLocalX509CredentialKeyManager implements X509KeyManager {
return new String[] {internalAlias};
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java
index 708dd9c01..501cac9b3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java
@@ -38,16 +38,16 @@ public final class ThreadLocalX509TrustEngineContext {
private static final class Data {
/** Trust engine. */
- private TrustEngine<? super X509Credential> trustEngine;
+ @Nonnull private TrustEngine<? super X509Credential> trustEngine;
/** Criteria. */
- private CriteriaSet criteriaSet;
+ @Nonnull private CriteriaSet criteriaSet;
/** Whether evaluation target was trusted. */
- private Boolean trusted;
+ @Nullable private Boolean trusted;
/** Whether trust engine evaluation failure should be treated as fatal. Defaults to true. */
- private Boolean failureFatal;
+ @Nonnull private Boolean failureFatal;
/**
* Constructor.
@@ -67,7 +67,7 @@ public final class ThreadLocalX509TrustEngineContext {
}
/** ThreadLocal storage for trust engine. */
- private static ThreadLocal<Data> current = new ThreadLocal<>();
+ @Nonnull private static ThreadLocal<Data> current = new ThreadLocal<>();
/** Constructor. */
private ThreadLocalX509TrustEngineContext() { }
@@ -151,4 +151,4 @@ public final class ThreadLocalX509TrustEngineContext {
}
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java
index ddc8e3976..4340bc98d 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java
@@ -31,9 +31,9 @@ import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -43,7 +43,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
public final class ThreadLocalX509TrustEngineSupport {
/** Logger. */
- private static final Logger LOG = LoggerFactory.getLogger(ThreadLocalX509TrustEngineSupport.class);
+ @Nonnull private static final Logger LOG = LoggerFactory.getLogger(ThreadLocalX509TrustEngineSupport.class);
/** Constructor. */
private ThreadLocalX509TrustEngineSupport() { }
@@ -98,9 +98,13 @@ public final class ThreadLocalX509TrustEngineSupport {
LOG.trace("Evaluating X509Certificate[] chain against ThreadLocalX509TrustEngineContext");
- if (performTrustEval(chain,
- ThreadLocalX509TrustEngineContext.getTrustEngine(),
- ThreadLocalX509TrustEngineContext.getCriteria())) {
+ final var trustEngine = ThreadLocalX509TrustEngineContext.getTrustEngine();
+ final var criteria = ThreadLocalX509TrustEngineContext.getCriteria();
+ // Due to haveCurrent() above, these should be non-null.
+ assert trustEngine != null;
+ assert criteria != null;
+
+ if (performTrustEval(chain, trustEngine, criteria)) {
ThreadLocalX509TrustEngineContext.setTrusted(true);
} else {
ThreadLocalX509TrustEngineContext.setTrusted(false);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java
index 130a39dd8..1ea380f83 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java
@@ -20,10 +20,12 @@ package org.opensaml.security.x509.tls.impl;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
import javax.net.ssl.X509TrustManager;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* An implementation of {@link X509TrustManager} which performs its evaluation using trust engine and criteria
@@ -32,7 +34,7 @@ import org.slf4j.LoggerFactory;
public class ThreadLocalX509TrustManager implements X509TrustManager {
/** Logger. */
- private Logger log = LoggerFactory.getLogger(ThreadLocalX509TrustManager.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(ThreadLocalX509TrustManager.class);
/** {@inheritDoc} */
public X509Certificate[] getAcceptedIssuers() {
@@ -72,4 +74,4 @@ public class ThreadLocalX509TrustManager implements X509TrustManager {
ThreadLocalX509TrustEngineSupport.evaluate(chain);
}
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java
index 3910d7970..6cabba75f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java
@@ -24,6 +24,7 @@ import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
import org.testng.Assert;
import org.testng.annotations.Test;
+ at SuppressWarnings("javadoc")
public class ClientTLSValidationConfigurationInitializerTest extends InitializerBaseTestCase {
@Test
@@ -35,7 +36,7 @@ public class ClientTLSValidationConfigurationInitializerTest extends Initializer
initializer.init();
config = ConfigurationService.get(ClientTLSValidationConfiguration.class);
- Assert.assertNotNull(config, "Config was null");
+ assert config != null;
Assert.assertNotNull(config.getCertificateNameOptions());
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java
index 79e29d9eb..c71ade89b 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java
@@ -24,9 +24,7 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableEntityIDCredentialCriterionTest {
private BasicCredential credential;
@@ -47,28 +45,28 @@ public class EvaluableEntityIDCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
+ final EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria = new EntityIdCriterion("OTHER");
- EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
+ final EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testCanNotEvaluate() {
credential.setEntityId(null);
- EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
+ final EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java
index 55b23c5c4..675899006 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java
@@ -21,15 +21,11 @@ import org.testng.annotations.Test;
import org.testng.annotations.BeforeMethod;
import org.testng.Assert;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableKeyAlgorithmCredentialCriterion;
import org.opensaml.security.criteria.KeyAlgorithmCriterion;
import org.opensaml.security.crypto.KeySupport;
-/**
- *
- */
+
+ at SuppressWarnings("javadoc")
public class EvaluableKeyAlgorithmCredentialCriterionTest {
private BasicCredential credential;
@@ -48,21 +44,21 @@ public class EvaluableKeyAlgorithmCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
+ final EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setKeyAlgorithm("SomeOtherKeyAlgo");
- EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
+ final EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java
index dc7794cff..bfbe6cd6a 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java
@@ -21,15 +21,10 @@ import org.testng.annotations.Test;
import org.testng.annotations.BeforeMethod;
import org.testng.Assert;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableKeyLengthCredentialCriterion;
import org.opensaml.security.criteria.KeyLengthCriterion;
import org.opensaml.security.crypto.KeySupport;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableKeyLengthCredentialCriterionTest {
private BasicCredential credential;
@@ -50,21 +45,21 @@ public class EvaluableKeyLengthCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
+ final EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setKeyLength(keyLength * 2);
- EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
+ final EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java
index 13d90f8d0..e1f7daff7 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java
@@ -21,15 +21,10 @@ import org.testng.annotations.Test;
import org.testng.annotations.BeforeMethod;
import org.testng.Assert;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableKeyNameCredentialCriterion;
import org.opensaml.security.criteria.KeyNameCriterion;
import org.opensaml.security.crypto.KeySupport;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableKeyNameCredentialCriterionTest {
private BasicCredential credential;
@@ -52,28 +47,28 @@ public class EvaluableKeyNameCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
+ final EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setKeyName(keyName + "OTHER");
- EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
+ final EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testCanNotEvaluate() {
credential.getKeyNames().clear();
- EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
+ final EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java
index 1a76324f4..3cd895a14 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java
@@ -25,15 +25,10 @@ import java.security.NoSuchProviderException;
import java.security.PublicKey;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluablePublicKeyCredentialCriterion;
import org.opensaml.security.criteria.PublicKeyCriterion;
import org.opensaml.security.crypto.KeySupport;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluablePublicKeyCredentialCriterionTest {
private BasicCredential credential;
@@ -55,28 +50,28 @@ public class EvaluablePublicKeyCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
+ final EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfyDifferentKey() throws NoSuchAlgorithmException, NoSuchProviderException {
criteria.setPublicKey(KeySupport.generateKeyPair(keyAlgo, 1024, null).getPublic());
- EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
+ final EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testCanNotEvaluate() {
//Only unevaluable case is null credential
- EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
+ final EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
Assert.assertEquals(evalCrit.test(null), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java
index 072c1cc79..9738819ab 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java
@@ -22,15 +22,10 @@ import org.testng.annotations.BeforeMethod;
import org.testng.Assert;
import org.opensaml.security.credential.BasicCredential;
import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion;
import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.security.crypto.KeySupport;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableUsageCredentialCriterionTest {
private BasicCredential credential;
@@ -51,35 +46,35 @@ public class EvaluableUsageCredentialCriterionTest {
@Test
public void testSatisfyExactMatch() {
- EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+ final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testSatisfyWithUnspecifiedCriteria() {
criteria.setUsage(UsageType.UNSPECIFIED);
- EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+ final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testSatisfyWithUnspecifiedCredential() {
credential.setUsageType(UsageType.UNSPECIFIED);
- EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+ final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setUsage(UsageType.ENCRYPTION);
- EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+ final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java
index e5ae3050a..e13879d86 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java
@@ -25,17 +25,15 @@ import java.security.NoSuchProviderException;
import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
import javax.security.auth.x500.X500Principal;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509CertSelectorCredentialCriterion;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509Support;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableX509CertSelectorCredentialCriterionTest {
private BasicX509Credential credential;
@@ -44,7 +42,7 @@ public class EvaluableX509CertSelectorCredentialCriterionTest {
private EvaluableX509CertSelectorCredentialCriterion evalCrit;
private X509Certificate entityCert;
- private String entityCertBase64 =
+ @Nonnull private String entityCertBase64 =
"MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
"cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
"DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -112,7 +110,7 @@ public class EvaluableX509CertSelectorCredentialCriterionTest {
@Test
public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
certSelector.setCertificate(entityCert);
- BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+ final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java
index 561c4454d..d4254d4fe 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java
@@ -28,29 +28,27 @@ import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
+
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509DigestCriterion;
import org.opensaml.security.x509.X509Support;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableX509DigestCredentialCriterionTest {
private BasicX509Credential credential;
- private String digestAlgorithm = "SHA-256";
- private String entityCertDigestBase64 = "z+OxxIy+EZxLN6PbDEXPmOutQhaYbcJYKDrIyFSuE0I=";
+ @Nonnull private String digestAlgorithm = "SHA-256";
+ @Nonnull private String entityCertDigestBase64 = "z+OxxIy+EZxLN6PbDEXPmOutQhaYbcJYKDrIyFSuE0I=";
private byte[] entityCertDigest;
private X509DigestCriterion criteria;
private X509Certificate entityCert;
- private String entityCertBase64 =
+ @Nonnull private String entityCertBase64 =
"MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
"cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
"DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -90,35 +88,35 @@ public class EvaluableX509DigestCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+ final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setAlgorithm("SHA-1");
- EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+ final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
- BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
- EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+ final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+ final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testCanNotEvaluate() {
criteria.setAlgorithm("SHA0");
- EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+ final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java
index b846fac04..545ef08ff 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java
@@ -25,20 +25,16 @@ import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
import javax.security.auth.x500.X500Principal;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509IssuerSerialCredentialCriterion;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509IssuerSerialCriterion;
import org.opensaml.security.x509.X509Support;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableX509IssuerSerialCredentialCriterionTest {
private BasicX509Credential credential;
@@ -47,7 +43,7 @@ public class EvaluableX509IssuerSerialCredentialCriterionTest {
private X509IssuerSerialCriterion criteria;
private X509Certificate entityCert;
- private String entityCertBase64 =
+ @Nonnull private String entityCertBase64 =
"MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
"cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
"DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -88,28 +84,28 @@ public class EvaluableX509IssuerSerialCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
+ final EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setSerialNumber(new BigInteger("100"));
- EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
+ final EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
- BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
- EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
+ final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+ final EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java
index cc5ff1d1d..8c60b359d 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java
@@ -28,29 +28,26 @@ import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
+
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509SubjectKeyIdentifierCredentialCriterion;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509SubjectKeyIdentifierCriterion;
import org.opensaml.security.x509.X509Support;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableX509SubjectKeyIdentifierCredentialCriterionTest {
private BasicX509Credential credential;
- private String entityCertSKIBase64 = "OBGBOSNoqgroOhl9RniD0sMlRa4=";
+ @Nonnull private String entityCertSKIBase64 = "OBGBOSNoqgroOhl9RniD0sMlRa4=";
private byte[] subjectKeyIdentifier;
private X509SubjectKeyIdentifierCriterion criteria;
private X509Certificate entityCert;
- private String entityCertBase64 =
+ @Nonnull private String entityCertBase64 =
"MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
"cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
"DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -74,7 +71,7 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterionTest {
"+hcVyvCXs5XtFTFWDAVYvzQ6";
private X509Certificate entityCertNoSKI;
- private String entityCertNoSKIBase64 =
+ @Nonnull private String entityCertNoSKIBase64 =
"MIIBwjCCASugAwIBAgIJAMrW6QSeKNBJMA0GCSqGSIb3DQEBBAUAMCMxITAfBgNV" +
"BAMTGG5vZXh0ZW5zaW9ucy5leGFtcGxlLm9yZzAeFw0wNzA1MTkxNzU2NTVaFw0w" +
"NzA2MTgxNzU2NTVaMCMxITAfBgNVBAMTGG5vZXh0ZW5zaW9ucy5leGFtcGxlLm9y" +
@@ -105,35 +102,35 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+ final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setSubjectKeyIdentifier("abcdef123456".getBytes());
- EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+ final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
- BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
- EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+ final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+ final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testCanNotEvaluate() {
credential.setEntityCertificate(entityCertNoSKI);
- EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+ final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java
index 8946ef704..86e92bdea 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java
@@ -25,20 +25,16 @@ import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.cert.X509Certificate;
+import javax.annotation.Nonnull;
import javax.security.auth.x500.X500Principal;
import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509SubjectNameCredentialCriterion;
import org.opensaml.security.crypto.KeySupport;
import org.opensaml.security.x509.BasicX509Credential;
import org.opensaml.security.x509.X509SubjectNameCriterion;
import org.opensaml.security.x509.X509Support;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EvaluableX509SubjectNameCredentialCriterionTest {
private BasicX509Credential credential;
@@ -46,7 +42,7 @@ public class EvaluableX509SubjectNameCredentialCriterionTest {
private X509SubjectNameCriterion criteria;
private X509Certificate entityCert;
- private String entityCertBase64 =
+ @Nonnull private String entityCertBase64 =
"MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
"cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
"DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -86,28 +82,28 @@ public class EvaluableX509SubjectNameCredentialCriterionTest {
@Test
public void testSatisfy() {
- EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
+ final EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
@Test
public void testNotSatisfy() {
criteria.setSubjectName( new X500Principal("cn=SomeOtherName, o=SomeOtherOrg"));
- EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
+ final EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
- BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
- EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
+ final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+ final EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
}
@Test
public void testRegistry() throws Exception {
- EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
- Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+ final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+ assert evalCrit != null;
Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java
index fa654f78d..8930c5639 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java
@@ -18,8 +18,6 @@
package org.opensaml.security.credential.impl;
import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
import java.util.Iterator;
import java.util.List;
import java.util.NoSuchElementException;
@@ -32,6 +30,7 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -88,7 +87,7 @@ public class ChainingCredentialResolverTest {
*/
@Test
public void testOneEmptyMember() throws ResolverException {
- chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolverEmpty));
+ chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolverEmpty));
final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
checkResolved(resolved, 0);
@@ -101,7 +100,7 @@ public class ChainingCredentialResolverTest {
*/
@Test
public void testMultipleEmptyMember() throws ResolverException {
- chainingResolver = new ChainingCredentialResolver(Arrays.asList(staticResolverEmpty, staticResolverEmpty, staticResolverEmpty));
+ chainingResolver = new ChainingCredentialResolver(CollectionSupport.listOf(staticResolverEmpty, staticResolverEmpty, staticResolverEmpty));
final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
checkResolved(resolved, 0);
@@ -114,7 +113,7 @@ public class ChainingCredentialResolverTest {
*/
@Test
public void testOneMember() throws ResolverException {
- chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolver12));
+ chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolver12));
final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
checkResolved(resolved, 2, cred1, cred2);
@@ -128,7 +127,7 @@ public class ChainingCredentialResolverTest {
@Test
public void testMultipleMembers() throws ResolverException {
chainingResolver = new ChainingCredentialResolver(
- Arrays.asList(staticResolver12, staticResolver3, staticResolverEmpty, staticResolver45));
+ CollectionSupport.listOf(staticResolver12, staticResolver3, staticResolverEmpty, staticResolver45));
final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
checkResolved(resolved, 5, cred1, cred2, cred3, cred4, cred5);
@@ -143,7 +142,7 @@ public class ChainingCredentialResolverTest {
@Test
public void testOrderingMultipleMembers() throws ResolverException {
chainingResolver = new ChainingCredentialResolver(
- Arrays.asList(staticResolverEmpty, staticResolver45, staticResolverEmpty, staticResolver3, staticResolver12));
+ CollectionSupport.listOf(staticResolverEmpty, staticResolver45, staticResolverEmpty, staticResolver3, staticResolver12));
final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
checkResolved(resolved, 5, cred1, cred2, cred3, cred4, cred5);
@@ -173,7 +172,7 @@ public class ChainingCredentialResolverTest {
*/
@Test(expectedExceptions=UnsupportedOperationException.class)
public void testRemove() throws ResolverException {
- chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolver12));
+ chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolver12));
final Iterator<Credential> iter = chainingResolver.resolve(criteriaSet).iterator();
Assert.assertTrue(iter.hasNext(), "Iterator was empty");
@@ -188,7 +187,7 @@ public class ChainingCredentialResolverTest {
*/
@Test(expectedExceptions=NoSuchElementException.class)
public void testNoMoreMembers() throws ResolverException {
- chainingResolver = new ChainingCredentialResolver(Arrays.asList(staticResolver12, staticResolver3));
+ chainingResolver = new ChainingCredentialResolver(CollectionSupport.listOf(staticResolver12, staticResolver3));
final Iterator<Credential> iter = chainingResolver.resolve(criteriaSet).iterator();
Assert.assertTrue(iter.hasNext(), "Should have next member");
@@ -204,7 +203,7 @@ public class ChainingCredentialResolverTest {
@Test(expectedExceptions=UnsupportedOperationException.class)
public void testChainUnmodifiable() {
- chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolver12));
+ chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolver12));
chainingResolver.getResolverChain().add(staticResolver3);
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java
index 95ad15747..3a31be735 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java
@@ -25,6 +25,11 @@ import org.testng.annotations.DataProvider;
*/
public class BaseDHTest extends OpenSAMLInitBaseTestCase {
+ /**
+ * Get key sizes.
+ *
+ * @return key sizes
+ */
@DataProvider
public Object[][] dhKeySizes() {
return new Object[][] {
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java
index 7699d3a7b..101218267 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java
@@ -30,9 +30,7 @@ import org.opensaml.security.crypto.dh.DHSupport;
import org.testng.Assert;
import org.testng.annotations.Test;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class DHSupportTest extends BaseDHTest {
@Test(dataProvider="dhKeySizes")
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java
index a6a8fe09d..5844bd317 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java
@@ -22,6 +22,8 @@ import java.security.spec.ECGenParameterSpec;
import java.security.spec.ECParameterSpec;
import java.util.Set;
+import javax.annotation.Nonnull;
+
import org.bouncycastle.jce.ECNamedCurveTable;
import org.opensaml.security.crypto.JCAConstants;
import org.opensaml.security.crypto.KeySupport;
@@ -32,41 +34,42 @@ import org.opensaml.security.crypto.ec.NamedCurveRegistry;
import org.opensaml.security.crypto.ec.curves.AbstractNamedCurve;
import org.opensaml.security.crypto.ec.tests.BaseNamedCurveTest;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import org.testng.Assert;
import org.testng.annotations.Test;
-/**
- *
- */
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+ at SuppressWarnings("javadoc")
public class NamedCurvesTest extends BaseNamedCurveTest {
- private Logger log = LoggerFactory.getLogger(NamedCurvesTest.class);
+ @Nonnull private Logger log = LoggerFactory.getLogger(NamedCurvesTest.class);
@Test(dataProvider = "namedCurves")
public void globalRegistryCurves(String namedCurve) throws Exception {
- NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
- Assert.assertNotNull(registry);
+ final NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
+ assert registry != null;
- ECParameterSpec bcSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
- Assert.assertNotNull(bcSpec);
+ final ECParameterSpec bcSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
+ assert bcSpec != null;
- Assert.assertNotNull(registry.getByName(namedCurve));
- Assert.assertEquals(registry.getByName(namedCurve).getName(), namedCurve);
+ NamedCurve curve = registry.getByName(namedCurve);
+ assert curve != null;
+ Assert.assertEquals(curve.getName(), namedCurve);
+
+ curve = registry.getByParameterSpec(bcSpec);
+ assert curve != null;
- Assert.assertNotNull(registry.getByParameterSpec(bcSpec));
// Use Enhanced- as a simple way to test equality via #equals(...).
// Wrap both. It seems TestNG does expected.equals(actual), but that may not always be true.
- Assert.assertEquals(new EnhancedECParameterSpec(registry.getByParameterSpec(bcSpec).getParameterSpec()),
- new EnhancedECParameterSpec(bcSpec));
+ Assert.assertEquals(new EnhancedECParameterSpec(curve.getParameterSpec()), new EnhancedECParameterSpec(bcSpec));
- NamedCurve curve = registry.getByName(namedCurve);
+ curve = registry.getByName(namedCurve);
if (AbstractNamedCurve.class.isInstance(curve)) {
// Test the equality of the curve's spec #buildParameterSpec() against both BC and brute force from key pair generation
- ECParameterSpec curveSpec = AbstractNamedCurve.class.cast(curve).buildParameterSpec();
- Assert.assertNotNull(curveSpec);
+ final ECParameterSpec curveSpec = AbstractNamedCurve.class.cast(curve).buildParameterSpec();
+ assert curveSpec != null;
- ECParameterSpec jcaSpec = ECPublicKey.class.cast(
+ final ECParameterSpec jcaSpec = ECPublicKey.class.cast(
KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(namedCurve), null)
.getPublic()).getParams();
Assert.assertNotNull(jcaSpec);
@@ -92,18 +95,18 @@ public class NamedCurvesTest extends BaseNamedCurveTest {
*/
@Test
public void sanityCheckOIDAndNameAndParams() throws Exception {
- NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
- Assert.assertNotNull(registry);
+ final NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
+ assert registry != null;
- Set<NamedCurve> registeredCurves = registry.getRegisteredCurves();
+ final Set<NamedCurve> registeredCurves = registry.getRegisteredCurves();
for (NamedCurve curve : registeredCurves) {
log.debug("Testing OID and name for curve: impl {}", curve.getClass().getName());
- ECParameterSpec specByOID = ECSupport.convert(ECNamedCurveTable.getParameterSpec(curve.getObjectIdentifier()));
- Assert.assertNotNull(specByOID);
- ECParameterSpec specByName = ECSupport.convert(ECNamedCurveTable.getParameterSpec(mapBCCurveName(curve.getName())));
- Assert.assertNotNull(specByName);
+ final ECParameterSpec specByOID = ECSupport.convert(ECNamedCurveTable.getParameterSpec(curve.getObjectIdentifier()));
+ assert specByOID != null;
+ final ECParameterSpec specByName = ECSupport.convert(ECNamedCurveTable.getParameterSpec(mapBCCurveName(curve.getName())));
+ assert specByName != null;
// Params by OID and name match each other.
@@ -122,7 +125,7 @@ public class NamedCurvesTest extends BaseNamedCurveTest {
* @param standardName
* @return the corresponding BC curve name
*/
- private String mapBCCurveName(String standardName) {
+ @Nonnull private String mapBCCurveName(String standardName) {
if (standardName.startsWith("X9.62 ")) {
return standardName.substring(6);
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java
index 54a3c63b9..0ae98a417 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java
@@ -25,6 +25,11 @@ import org.testng.annotations.DataProvider;
*/
public class BaseNamedCurveTest extends OpenSAMLInitBaseTestCase {
+ /**
+ * Get curve names.
+ *
+ * @return curve names
+ */
@DataProvider
public Object[][] namedCurves() {
return new Object[][] {
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java
index 0cd95d8ab..acbc7570b 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java
@@ -35,9 +35,7 @@ import org.opensaml.security.crypto.ec.NamedCurve;
import org.testng.Assert;
import org.testng.annotations.Test;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class ECSupportTest extends BaseNamedCurveTest {
@Test(dataProvider="namedCurves")
@@ -47,7 +45,8 @@ public class ECSupportTest extends BaseNamedCurveTest {
final KeyPair origKeyPair = kpGenerator.generateKeyPair();
Assert.assertNotNull(origKeyPair);
Assert.assertTrue(ECPublicKey.class.isInstance(origKeyPair.getPublic()));
- ECPublicKey origPublicKey = ECPublicKey.class.cast(origKeyPair.getPublic());
+ final ECPublicKey origPublicKey = ECPublicKey.class.cast(origKeyPair.getPublic());
+ assert origPublicKey != null;
final KeyPair generatedKeyPair = ECSupport.generateCompatibleKeyPair(origPublicKey, null);
@@ -61,7 +60,7 @@ public class ECSupportTest extends BaseNamedCurveTest {
final KeyPairGenerator kpGenerator = KeyPairGenerator.getInstance(JCAConstants.KEY_ALGO_EC);
kpGenerator.initialize(new ECGenParameterSpec(namedCurve));
final KeyPair publicKeyPair = kpGenerator.generateKeyPair();
- ECPublicKey publicKey = ECPublicKey.class.cast(publicKeyPair.getPublic());
+ final ECPublicKey publicKey = ECPublicKey.class.cast(publicKeyPair.getPublic());
final KeyPair privateKeyPair = ECSupport.generateCompatibleKeyPair(publicKey, null);
@@ -73,11 +72,11 @@ public class ECSupportTest extends BaseNamedCurveTest {
@Test(dataProvider="namedCurves")
public void convertParameterSpec(String namedCurve) throws Exception {
- ECParameterSpec control = ECPublicKey.class.cast(
+ final ECParameterSpec control = ECPublicKey.class.cast(
KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(namedCurve), null).getPublic()).getParams();
- ECParameterSpec target = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
- Assert.assertNotNull(target);
+ final ECParameterSpec target = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
+ assert target != null;
Assert.assertNotSame(target, control);
@@ -90,14 +89,14 @@ public class ECSupportTest extends BaseNamedCurveTest {
@Test(dataProvider="namedCurves")
public void encodeAndDecodeECPoint(String namedCurve) throws Exception {
- ECParameterSpec spec = ECPublicKey.class.cast(
+ final ECParameterSpec spec = ECPublicKey.class.cast(
KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(namedCurve), null).getPublic()).getParams();
// Do this differently (and clearer) than in the actual code just so check the latter.
int fieldSizeBits = spec.getCurve().getField().getFieldSize();
int fieldSizeBytes = (fieldSizeBits % 8) == 0 ? (fieldSizeBits / 8) : (fieldSizeBits / 8) + 1;
- byte[] encoded = ECSupport.encodeECPointUncompressed(spec.getGenerator(), spec.getCurve());
+ final byte[] encoded = ECSupport.encodeECPointUncompressed(spec.getGenerator(), spec.getCurve());
Assert.assertNotNull(encoded);
Assert.assertEquals(encoded.length, (fieldSizeBytes * 2) + 1);
Assert.assertEquals(encoded[0], 0x04);
@@ -106,14 +105,14 @@ public class ECSupportTest extends BaseNamedCurveTest {
Assert.assertEquals(new BigInteger(1, encoded, fieldSizeBytes+1, fieldSizeBytes),
spec.getGenerator().getAffineY());
- ECPoint decoded = ECSupport.decodeECPoint(encoded, spec.getCurve());
+ final ECPoint decoded = ECSupport.decodeECPoint(encoded, spec.getCurve());
Assert.assertNotNull(decoded);
Assert.assertEquals(decoded, spec.getGenerator());
}
@Test
public void getCurvesFromBouncyCastle() {
- Set<NamedCurve> curves = ECSupport.getCurvesFromBouncyCastle();
+ final Set<NamedCurve> curves = ECSupport.getCurvesFromBouncyCastle();
Assert.assertNotNull(curves);
Assert.assertFalse(curves.isEmpty());
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java
index 70e7abb5f..df065f408 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java
@@ -29,9 +29,7 @@ import org.opensaml.security.crypto.ec.EnhancedECParameterSpec;
import org.testng.Assert;
import org.testng.annotations.Test;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class EnhancedECParameterSpecTest extends BaseNamedCurveTest {
@Test(dataProvider = "namedCurves")
@@ -40,8 +38,8 @@ public class EnhancedECParameterSpecTest extends BaseNamedCurveTest {
// the same object that whatever provider is in effect produces when generating a KeyPair, etc.
// SunEC seems to produce the same object instance for all key pairs of a given curve, presumably
// they have an internal table of name -> ECParameterSpec.
- ECParameterSpec controlInput = ECSupport.convert(ECNamedCurveTable.getParameterSpec(name));
- Assert.assertNotNull(controlInput);
+ final ECParameterSpec controlInput = ECSupport.convert(ECNamedCurveTable.getParameterSpec(name));
+ assert controlInput != null;
EnhancedECParameterSpec control = new EnhancedECParameterSpec(controlInput);
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java
index b89e959e2..dd71b06ee 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java
@@ -37,9 +37,7 @@ import org.testng.annotations.Test;
import net.shibboleth.shared.collection.CollectionSupport;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class NamedCurveRegistryTest extends BaseNamedCurveTest {
@Test
@@ -52,12 +50,12 @@ public class NamedCurveRegistryTest extends BaseNamedCurveTest {
secp521r1.initialize();
// To test lookup by a different param spec object instance
- ECParameterSpec secp256r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp256r1.getObjectIdentifier()));
- ECParameterSpec secp384r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp384r1.getObjectIdentifier()));
- ECParameterSpec secp521r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp521r1.getObjectIdentifier()));
- Assert.assertNotNull(secp256r1ParamSpec);
- Assert.assertNotNull(secp384r1ParamSpec);
- Assert.assertNotNull(secp521r1ParamSpec);
+ final ECParameterSpec secp256r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp256r1.getObjectIdentifier()));
+ final ECParameterSpec secp384r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp384r1.getObjectIdentifier()));
+ final ECParameterSpec secp521r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp521r1.getObjectIdentifier()));
+ assert secp256r1ParamSpec != null;
+ assert secp384r1ParamSpec != null;
+ assert secp521r1ParamSpec != null;
NamedCurveRegistry registry = new NamedCurveRegistry();
@@ -158,12 +156,12 @@ public class NamedCurveRegistryTest extends BaseNamedCurveTest {
@Test
public void globalRegistry() {
- NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
- Assert.assertNotNull(registry);
+ final NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
+ assert registry != null;
// Test that it has at least the 3 main ones.
Assert.assertTrue(registry.getRegisteredCurves().size() >= 3);
- Set<String> curveNames = registry.getRegisteredCurves().stream().map(NamedCurve::getName).collect(Collectors.toSet());
+ final Set<String> curveNames = registry.getRegisteredCurves().stream().map(NamedCurve::getName).collect(Collectors.toSet());
Assert.assertTrue(curveNames.contains("secp256r1"));
Assert.assertTrue(curveNames.contains("secp384r1"));
Assert.assertTrue(curveNames.contains("secp521r1"));
@@ -171,23 +169,25 @@ public class NamedCurveRegistryTest extends BaseNamedCurveTest {
@Test
public void registerBouncyCastleCurves() throws Exception {
- String propName = GlobalNamedCurveRegistryInitializer.CONFIG_PROPERTY_REGISTER_BOUNCY_CASTLE_CURVES;
- NamedCurveRegistry origRegistry = ECSupport.getGlobalNamedCurveRegistry();
+ final String propName = GlobalNamedCurveRegistryInitializer.CONFIG_PROPERTY_REGISTER_BOUNCY_CASTLE_CURVES;
+ final NamedCurveRegistry origRegistry = ECSupport.getGlobalNamedCurveRegistry();
+ assert origRegistry != null;
try {
- Properties props = new Properties();
+ final Properties props = new Properties();
props.setProperty(propName, "true");
ThreadLocalConfigurationPropertiesHolder.setProperties(props);
new GlobalNamedCurveRegistryInitializer().init();
- NamedCurveRegistry bcRegistry = ECSupport.getGlobalNamedCurveRegistry();
+ final NamedCurveRegistry bcRegistry = ECSupport.getGlobalNamedCurveRegistry();
+ assert bcRegistry != null;
Assert.assertNotSame(bcRegistry, origRegistry);
- Set<NamedCurve> origCurves = origRegistry.getRegisteredCurves();
- Set<NamedCurve> bcCurves = bcRegistry.getRegisteredCurves();
+ final Set<NamedCurve> origCurves = origRegistry.getRegisteredCurves();
+ final Set<NamedCurve> bcCurves = bcRegistry.getRegisteredCurves();
Assert.assertTrue(bcCurves.size() > origCurves.size());
- Set<String> origOIDs = origCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
- Set<String> bcOIDs = bcCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
+ final Set<String> origOIDs = origCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
+ final Set<String> bcOIDs = bcCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
Assert.assertTrue(bcOIDs.containsAll(origOIDs));
} finally {
ThreadLocalConfigurationPropertiesHolder.clear();
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
index 5eab2907b..33d656447 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
@@ -22,6 +22,9 @@ import java.net.URISyntaxException;
import java.security.cert.CertificateException;
import java.util.Collections;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
@@ -36,9 +39,7 @@ import org.testng.annotations.Test;
import net.shibboleth.shared.resolver.CriteriaSet;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class BasicHttpClientSecurityConfigurationTest {
private X509Credential x509Credential;
@@ -89,7 +90,8 @@ public class BasicHttpClientSecurityConfigurationTest {
// Helpers
public static class MockTrustEngine implements TrustEngine<X509Credential> {
- public boolean validate(X509Credential token, CriteriaSet trustBasisCriteria) throws SecurityException {
+ public boolean validate(@Nonnull final X509Credential token, @Nullable final CriteriaSet trustBasisCriteria)
+ throws SecurityException {
return false;
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index 54c77e068..3f5cc8142 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -23,6 +23,9 @@ import java.security.KeyException;
import java.security.cert.CertificateException;
import java.util.Collections;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
import org.opensaml.security.SecurityException;
@@ -41,9 +44,7 @@ import org.testng.annotations.Test;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
-/**
- *
- */
+ at SuppressWarnings("javadoc")
public class BasicHttpClientSecurityParametersResolverTest {
private BasicHttpClientSecurityParametersResolver resolver;
@@ -74,7 +75,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
@@ -93,7 +94,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNull(params.getAuthCache());
Assert.assertNull(params.getClientTLSCredential());
Assert.assertNull(params.getCredentialsProvider());
@@ -117,7 +118,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
@@ -135,7 +136,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
@@ -153,7 +154,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNull(params.getAuthCache());
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertNotNull(params.getCredentialsProvider());
@@ -181,7 +182,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertSame(params.getClientTLSCredential(), config1.getClientTLSCredential());
@@ -194,7 +195,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertSame(params.getClientTLSCredential(), config2.getClientTLSCredential());
@@ -207,7 +208,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNotNull(params.getClientTLSCredential());
Assert.assertSame(params.getClientTLSCredential(), config3.getClientTLSCredential());
}
@@ -220,7 +221,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
- Assert.assertNotNull(params);;
+ assert params != null;
Assert.assertNotNull(params.getTLSCriteriaSet());
}
@@ -240,7 +241,8 @@ public class BasicHttpClientSecurityParametersResolverTest {
}
public static class MockTrustEngine implements TrustEngine<X509Credential> {
- public boolean validate(X509Credential token, CriteriaSet trustBasisCriteria) throws SecurityException {
+ public boolean validate(@Nonnull final X509Credential token, @Nullable final CriteriaSet trustBasisCriteria)
+ throws SecurityException {
return false;
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java
index 14f5fee7d..cadc7584f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java
@@ -21,6 +21,7 @@ import java.security.Principal;
import java.security.cert.Certificate;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSessionContext;
@@ -30,10 +31,16 @@ import javax.net.ssl.SSLSessionContext;
*/
public class MockSSLSession implements SSLSession {
- private List<Certificate> peerCertificates;
- private String peerHost;
+ @Nonnull private final List<Certificate> peerCertificates;
+ @Nonnull private final String peerHost;
- public MockSSLSession(List<Certificate> certs, String host) {
+ /**
+ * Constructor.
+ *
+ * @param certs certs
+ * @param host peer host
+ */
+ public MockSSLSession(@Nonnull final List<Certificate> certs, @Nonnull final String host) {
this.peerCertificates = certs;
this.peerHost = host;
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java
index 9e6f2854f..52643ecc8 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java
@@ -21,6 +21,7 @@ import java.io.IOException;
import java.security.cert.Certificate;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.net.ssl.HandshakeCompletedListener;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
@@ -32,7 +33,13 @@ public class MockSSLSocket extends SSLSocket {
private SSLSession session;
- public MockSSLSocket(List<Certificate> certs, String host) {
+ /**
+ * Constructor.
+ *
+ * @param certs certs
+ * @param host peer host
+ */
+ public MockSSLSocket(@Nonnull final List<Certificate> certs, @Nonnull final String host) {
session = new MockSSLSession(certs, host);
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java
index ea80e9e48..63fe18a3f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java
@@ -24,6 +24,8 @@ import java.net.UnknownHostException;
import java.security.cert.Certificate;
import java.util.List;
+import javax.annotation.Nonnull;
+
import org.apache.hc.client5.http.socket.LayeredConnectionSocketFactory;
import org.apache.hc.core5.http.HttpHost;
import org.apache.hc.core5.http.protocol.HttpContext;
@@ -34,31 +36,40 @@ import org.apache.hc.core5.util.TimeValue;
*/
public class MockTLSSocketFactory implements LayeredConnectionSocketFactory {
- private Socket socket;
+ @Nonnull private final Socket socket;
+ /**
+ * Constructor.
+ */
public MockTLSSocketFactory() {
socket = new Socket();
}
- public MockTLSSocketFactory(List<Certificate> certs, String host) {
+ /**
+ * Constructor.
+ *
+ * @param certs certs
+ * @param host peer host
+ */
+ public MockTLSSocketFactory(@Nonnull final List<Certificate> certs, @Nonnull final String host) {
socket = new MockSSLSocket(certs, host);
}
/** {@inheritDoc} */
public Socket createSocket(HttpContext context) throws IOException {
- return this.socket;
+ return socket;
}
/** {@inheritDoc} */
public Socket connectSocket(TimeValue connectTimeout, Socket sock, HttpHost host, InetSocketAddress remoteAddress,
InetSocketAddress localAddress, HttpContext context) throws IOException {
- return this.socket;
+ return socket;
}
/** {@inheritDoc} */
public Socket createLayeredSocket(Socket socket, String target, int port, HttpContext context) throws IOException,
UnknownHostException {
- return this.socket;
+ return socket;
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
index 8a0202bc4..f009acc3f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
@@ -22,7 +22,6 @@ import java.io.InputStream;
import java.net.Socket;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
-import java.util.Collections;
import java.util.HashSet;
import java.util.List;
@@ -44,9 +43,11 @@ import org.testng.annotations.AfterMethod;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.httpclient.HttpClientSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class SecurityEnhancedTLSSocketFactoryTest {
private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
@@ -89,7 +90,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
X509Credential cred = getCredential("foo-1A1-good.crt");
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+ CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
@@ -110,7 +111,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+ CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
@@ -137,7 +138,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET, criteria);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+ CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
@@ -165,7 +166,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET, criteria);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+ CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
index f78b23277..25dcd1c70 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
@@ -22,8 +22,9 @@ import java.security.PublicKey;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.util.Collection;
-import java.util.Collections;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.crypto.SecretKey;
import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
@@ -43,13 +44,14 @@ import org.testng.annotations.Test;
import com.google.common.base.Predicates;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/** Unit test for {@link PopulateHttpClientSecurityParametersHandler}. */
+ at SuppressWarnings("javadoc")
public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLInitBaseTestCase {
private MessageContext messageContext;
@@ -66,19 +68,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
handler.initialize();
}
- @Test(expectedExceptions=ConstraintViolationException.class)
- public void testNoContext() throws Exception {
- handler.setHttpClientSecurityParametersResolver(new MockResolver(false));
- handler.initialize();
-
- handler.invoke(null);
- }
-
@Test(expectedExceptions=MessageHandlerException.class)
public void testResolverError() throws Exception {
handler.setHttpClientSecurityParametersResolver(new MockResolver(true));
handler.initialize();
+ assert messageContext != null;
handler.invoke(messageContext);
}
@@ -86,9 +81,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
handler.setHttpClientSecurityParametersResolver(new MockResolver(false));
handler.initialize();
+ assert messageContext != null;
handler.invoke(messageContext);
- Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
- Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+
+ final HttpClientSecurityParameters params = messageContext.ensureSubcontext(HttpClientSecurityContext.class).getSecurityParameters();
+ assert params != null;
+ Assert.assertNotNull(params.getClientTLSCredential());
}
@Test public void testSuccessIncludeClientTLS() throws Exception {
@@ -96,9 +94,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
handler.setClientTLSPredicate(Predicates.<MessageContext>alwaysTrue());
handler.initialize();
+ assert messageContext != null;
handler.invoke(messageContext);
- Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
- Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+
+ final HttpClientSecurityParameters params = messageContext.ensureSubcontext(HttpClientSecurityContext.class).getSecurityParameters();
+ assert params != null;
+ Assert.assertNotNull(params.getClientTLSCredential());
}
@Test public void testSuccessExcludeClientTLS() throws Exception {
@@ -106,9 +107,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
handler.setClientTLSPredicate(Predicates.<MessageContext>alwaysFalse());
handler.initialize();
+ assert messageContext != null;
handler.invoke(messageContext);
- Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
- Assert.assertNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+
+ final HttpClientSecurityParameters params = messageContext.ensureSubcontext(HttpClientSecurityContext.class).getSecurityParameters();
+ assert params != null;
+ Assert.assertNull(params.getClientTLSCredential());
}
private class MockResolver implements HttpClientSecurityParametersResolver {
@@ -120,18 +124,19 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
}
/** {@inheritDoc} */
- @Override
- public Iterable<HttpClientSecurityParameters> resolve(CriteriaSet criteria) throws ResolverException {
- return Collections.singletonList(resolveSingle(criteria));
+ @Nonnull public Iterable<HttpClientSecurityParameters> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final HttpClientSecurityParameters params = resolveSingle(criteria);
+ assert params != null;
+ return CollectionSupport.singletonList(params);
}
/** {@inheritDoc} */
- @Override
- public HttpClientSecurityParameters resolveSingle(CriteriaSet criteria) throws ResolverException {
+ @Nullable public HttpClientSecurityParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
if (throwException) {
throw new ResolverException();
}
+ assert criteria != null;
Constraint.isNotNull(criteria.get(HttpClientSecurityConfigurationCriterion.class), "Criterion was null");
HttpClientSecurityParameters params = new HttpClientSecurityParameters();
params.setClientTLSCredential(new MockX509Credential());
@@ -153,8 +158,8 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
}
/** {@inheritDoc} */
- public Collection<String> getKeyNames() {
- return null;
+ @Nonnull public Collection<String> getKeyNames() {
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
@@ -178,18 +183,18 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
}
/** {@inheritDoc} */
- public Class<? extends Credential> getCredentialType() {
- return null;
+ @Nonnull public Class<? extends Credential> getCredentialType() {
+ return getClass();
}
/** {@inheritDoc} */
- public X509Certificate getEntityCertificate() {
- return null;
+ @Nonnull public X509Certificate getEntityCertificate() {
+ throw new IllegalStateException();
}
/** {@inheritDoc} */
- public Collection<X509Certificate> getEntityCertificateChain() {
- return null;
+ @Nonnull public Collection<X509Certificate> getEntityCertificateChain() {
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java
index b2682919b..cea1a1e28 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java
@@ -20,7 +20,9 @@ package org.opensaml.security.trust.impl;
import java.util.ArrayList;
import java.util.List;
-import net.shibboleth.shared.logic.ConstraintViolationException;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import net.shibboleth.shared.resolver.CriteriaSet;
import org.opensaml.core.criterion.EntityIdCriterion;
@@ -33,6 +35,7 @@ import org.testng.annotations.Test;
/**
* Test the chaining trust engine.
*/
+ at SuppressWarnings("javadoc")
public class ChainingTrustEngineTest {
private CriteriaSet criteriaSet;
@@ -95,11 +98,6 @@ public class ChainingTrustEngineTest {
engine.validate(token, criteriaSet);
}
- @Test(expectedExceptions=ConstraintViolationException.class)
- public void testNullChain() {
- engine = new ChainingTrustEngine<>(null);
- }
-
/** Mock token types. */
private class SuperToken {
@@ -118,7 +116,8 @@ public class ChainingTrustEngineTest {
}
/** {@inheritDoc} */
- public boolean validate(FooToken token1, CriteriaSet trustBasisCriteria) throws SecurityException {
+ public boolean validate(@Nonnull final FooToken token1, @Nullable final CriteriaSet trustBasisCriteria)
+ throws SecurityException {
if (trusted == null) {
throw new SecurityException("This means an error happened");
}
@@ -137,7 +136,8 @@ public class ChainingTrustEngineTest {
}
/** {@inheritDoc} */
- public boolean validate(SuperToken token1, CriteriaSet trustBasisCriteria) throws SecurityException {
+ public boolean validate(@Nonnull final SuperToken token1, @Nullable final CriteriaSet trustBasisCriteria)
+ throws SecurityException {
if (trusted == null) {
throw new SecurityException("This means an error happened");
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java
index cf452173d..8a1b73fea 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java
@@ -41,6 +41,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Test the explicit key trust engine.
*/
+ at SuppressWarnings("javadoc")
public class ExplicitKeyTrustEngineTest {
private RSAPublicKey entityPubKey;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java
index 7b1598439..ea73d0bb6 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java
@@ -41,6 +41,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Test the explicit key trust engine.
*/
+ at SuppressWarnings("javadoc")
public class ExplicitX509CertificateTrustEngineTest {
private RSAPublicKey entityPubKey;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
index 1efe65f30..774fc3a65 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
@@ -35,6 +35,7 @@ import org.testng.annotations.Test;
/**
* Tests the {@link CertPathPKIXTrustEvaluator} implementation.
*/
+ at SuppressWarnings("javadoc")
public class BasicX509CredentialNameEvaluatorTest extends XMLObjectBaseTestCase {
private X509Certificate entityCert3AltNamesDNS_URL_IP;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
index d18fd1e4f..ae1f2a5cd 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
@@ -41,6 +41,7 @@ import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
/**
* Tests the {@link CertPathPKIXTrustEvaluator} implementation.
*/
+ at SuppressWarnings("javadoc")
public class CertPathPKIXTrustEvaluatorTest extends XMLObjectBaseTestCase {
private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
index 1e5e4b721..58bac4246 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
@@ -42,6 +42,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Tests the {@link PKIXX509CredentialTrustEngine} implementation.
*/
+ at SuppressWarnings("javadoc")
public class PKIXX509CredentialTrustEngineTest extends XMLObjectBaseTestCase {
private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
index f317c5cf3..c83788990 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
@@ -31,6 +31,7 @@ import org.testng.annotations.Test;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+ at SuppressWarnings("javadoc")
public class StaticPKIXValidationInformationResolverTest {
@Test
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java
index 72714f57c..2982dd570 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java
@@ -30,6 +30,7 @@ import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+ at SuppressWarnings("javadoc")
public class BasicClientTLSValidationConfigurationTest {
private BasicClientTLSValidationConfiguration config;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java
index 5ec5b2635..0793b2792 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java
@@ -33,13 +33,12 @@ import org.opensaml.security.x509.X509Credential;
import org.opensaml.security.x509.tls.CertificateNameOptions;
import org.opensaml.security.x509.tls.ClientTLSValidationConfigurationCriterion;
import org.opensaml.security.x509.tls.ClientTLSValidationParameters;
-import org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration;
-import org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
+ at SuppressWarnings("javadoc")
public class BasicClientTLSValidationParametersResolverTest {
private BasicClientTLSValidationParametersResolver resolver;
@@ -138,7 +137,7 @@ public class BasicClientTLSValidationParametersResolverTest {
Assert.assertTrue(iterator.hasNext());
- ClientTLSValidationParameters params = iterator.next();
+ final ClientTLSValidationParameters params = iterator.next();
Assert.assertNotNull(params);
Assert.assertTrue(params.getX509TrustEngine() == controlTrustEngine1);
@@ -151,9 +150,9 @@ public class BasicClientTLSValidationParametersResolverTest {
config1.setX509TrustEngine(controlTrustEngine1);
config1.setCertificateNameOptions(controlNameOpts1);
- ClientTLSValidationParameters params = resolver.resolveSingle(criteriaSet);
+ final ClientTLSValidationParameters params = resolver.resolveSingle(criteriaSet);
- Assert.assertNotNull(params);
+ assert params != null;
Assert.assertTrue(params.getX509TrustEngine() == controlTrustEngine1);
Assert.assertTrue(params.getCertificateNameOptions() == controlNameOpts1);
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java
index a320d1fe6..e646fb9e8 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java
@@ -34,6 +34,7 @@ import org.testng.annotations.Test;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class ThreadLocalX509TrustManagerTest {
private ThreadLocalX509TrustManager trustManager = new ThreadLocalX509TrustManager();
@@ -67,7 +68,9 @@ public class ThreadLocalX509TrustManagerTest {
trustManager.checkServerTrusted(chain, "RSA");
- Assert.assertTrue(ThreadLocalX509TrustEngineContext.getTrusted());
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertTrue(trusted);
}
@Test
@@ -77,8 +80,10 @@ public class ThreadLocalX509TrustManagerTest {
try {
trustManager.checkServerTrusted(chain, "RSA");
Assert.fail("Trust manager should have thrown");
- } catch (CertificateException e) {
- Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+ } catch (final CertificateException e) {
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertFalse(trusted);
}
}
@@ -87,7 +92,9 @@ public class ThreadLocalX509TrustManagerTest {
ThreadLocalX509TrustEngineContext.loadCurrent(new MockTrustEngine<>(false), criteria, false);
trustManager.checkServerTrusted(chain, "RSA");
- Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertFalse(trusted);
}
@Test
@@ -97,8 +104,10 @@ public class ThreadLocalX509TrustManagerTest {
try {
trustManager.checkServerTrusted(chain, "RSA");
Assert.fail("Trust manager should have thrown");
- } catch (CertificateException e) {
- Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+ } catch (final CertificateException e) {
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertFalse(trusted);
}
}
@@ -107,7 +116,9 @@ public class ThreadLocalX509TrustManagerTest {
ThreadLocalX509TrustEngineContext.loadCurrent(new MockTrustEngine<>(new SecurityException()), criteria, false);
trustManager.checkServerTrusted(chain, "RSA");
- Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertFalse(trusted);
}
@Test
@@ -117,8 +128,10 @@ public class ThreadLocalX509TrustManagerTest {
try {
trustManager.checkServerTrusted(chain, "RSA");
Assert.fail("Trust manager should have thrown");
- } catch (CertificateException e) {
- Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+ } catch (final CertificateException e) {
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertFalse(trusted);
}
}
@@ -128,7 +141,9 @@ public class ThreadLocalX509TrustManagerTest {
ThreadLocalX509TrustEngineContext.loadCurrent(new MockTrustEngine<>(new RuntimeException()), criteria, false);
trustManager.checkServerTrusted(chain, "RSA");
- Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+ final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+ assert trusted != null;
+ Assert.assertFalse(trusted);
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list