[java-oidc-common] branch main updated: More null cleanup.
Scott Cantor
cantor.2 at osu.edu
Thu Nov 2 19:27:18 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=0054ce616a1f1e40f1a7e73078f5aa69baf8f9f6
The following commit(s) were added to refs/heads/main by this push:
new 0054ce6 More null cleanup.
0054ce6 is described below
commit 0054ce616a1f1e40f1a7e73078f5aa69baf8f9f6
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Nov 2 15:27:15 2023 -0400
More null cleanup.
---
.../net/shibboleth/oidc/jwk/RemoteJwkSetCache.java | 9 +-
.../impl/BasicJOSEObjectCredentialResolver.java | 25 ++--
.../impl/ClientInformationCredentialResolver.java | 36 +++---
.../ClientSecretCriterionCredentialResolver.java | 39 ++++---
.../CollectionJOSEObjectCredentialResolver.java | 8 +-
.../impl/DataEncryptionAlgorithmCriterion.java | 13 +--
.../impl/EvaluableKeyIDCredentialCriterion.java | 55 +++++----
.../EvaluableMACKeyLengthCredentialCriterion.java | 34 +++---
.../impl/KeyManagmentAlgorithmCriterion.java | 15 ++-
.../impl/LocalJOSEObjectCredentialResolver.java | 55 ++++-----
.../impl/ProviderMetadataCredentialResolver.java | 41 +++----
...nAllCollectionJOSEObjectCredentialResolver.java | 11 +-
...AbstractEncryptionAlgorithmsLookupStrategy.java | 11 +-
.../impl/BaseJWTSignatureSecurityHandler.java | 34 +++---
.../security/impl/BaseSignedJWTTrustEngine.java | 27 ++---
.../CheckClientJWTDecryptionConfiguration.java | 12 +-
.../CheckClientJWTSignatureAlgorithmHandler.java | 12 +-
.../impl/ClientInformationJWTTrustEngine.java | 36 +++---
.../shibboleth/oidc/security/impl/DecryptJWE.java | 16 +--
.../oidc/security/impl/EncryptJWTHandler.java | 7 +-
.../impl/ExplicitKeySignedJWTTrustEngine.java | 25 ++--
.../security/impl/ExplicitKeyTrustEvaluator.java | 6 +-
.../oidc/security/impl/JWETokenDecrypter.java | 87 ++++++++------
.../impl/JWTMessageSignatureSecurityHandler.java | 23 ++--
.../security/impl/JWTSignatureValidationUtil.java | 15 ++-
.../jose/impl/BasicEncryptionConfiguration.java | 16 +--
.../impl/BasicSignatureSigningConfiguration.java | 21 ++--
.../BasicSignatureSigningParametersResolver.java | 79 ++++++++-----
...BasicSignatureValidationParametersResolver.java | 45 ++++----
...tionDataEncryptionAlgorithmsLookupStrategy.java | 20 ++--
...ransportEncryptionAlgorithmsLookupStrategy.java | 20 ++--
...ormationSignatureSigningParametersResolver.java | 28 +++--
...aultDataEncryptionAlgorithmsLookupStrategy.java | 34 ++++--
.../impl/DefaultDecryptionParametersResolver.java | 50 ++++----
.../impl/DefaultEncryptionParametersResolver.java | 127 ++++++++++++++-------
...ransportEncryptionAlgorithmsLookupStrategy.java | 31 +++--
...dataDataEncryptionAlgorithmsLookupStrategy.java | 22 ++--
...ransportEncryptionAlgorithmsLookupStrategy.java | 13 ++-
.../RelyingPartySigningParametersResolver.java | 36 ++----
.../jwt/claims/impl/AccessTokenHashValidator.java | 2 +-
.../jwt/claims/impl/AudienceClaimsValidator.java | 8 +-
.../impl/AuthTimeRequestedActivationCondition.java | 7 +-
.../AuthenticationAudienceClaimsValidator.java | 4 +-
.../impl/AuthenticationTimeClaimsValidator.java | 19 +--
.../claims/impl/ChainingJWTClaimsValidator.java | 15 +--
.../impl/ClaimExistsActivationCondition.java | 7 +-
.../jwt/claims/impl/ExactMatchClaimsValidator.java | 5 +-
.../ForcedAuthenticationActivationCondition.java | 8 +-
.../impl/NonceValidationActivationCondition.java | 9 +-
.../NumberOfClaimValuesActivationCondition.java | 10 +-
.../jwt/claims/impl/ProhibitedClaimsValidator.java | 10 +-
.../RequestedEssentialACRClaimsLookupStrategy.java | 12 +-
.../jwt/claims/impl/RequiredClaimsValidator.java | 11 +-
.../impl/BaseMetadataCredentialResolverTest.java | 3 +
.../ClientInformationCredentialResolverTest.java | 9 +-
...lientSecretCriterionCredentialResolverTest.java | 32 +++---
...CollectionJOSEObjectCredentialResolverTest.java | 34 ++----
...aluableMACKeyLengthCredentialCriterionTest.java | 21 ++--
.../LocalJOSEObjectCredentialResolverTest.java | 67 ++++++++---
.../ProviderMetadataCredentialResolverTest.java | 1 +
.../CheckClientJWTDecryptionConfigurationTest.java | 1 +
.../impl/ClientInformationJWTTrustEngineTest.java | 24 ++--
.../oidc/security/impl/EncryptJWTHandlerTest.java | 50 ++++----
.../impl/ExplicitKeySignedJWTTrustEngineTest.java | 31 ++---
.../oidc/security/impl/JWETokenDecrypterTest.java | 110 +++++++++---------
.../oidc/security/impl/JWSTokenSignerTest.java | 1 +
.../impl/JWTSignatureValidationUtilTest.java | 1 +
.../impl/MockEmptyListCredentialResolver.java | 14 ++-
.../impl/MockFunctionalCredentialResolver.java | 15 +--
...DataEncryptionAlgorithmsLookupStrategyTest.java | 24 ++--
...portEncryptionAlgorithmsLookupStrategyTest.java | 28 ++---
.../oidc/security/impl/SignJWTHandlerTest.java | 35 +++---
...asicSignatureSigningParametersResolverTest.java | 1 +
...tionSignatureSigningParametersResolverTest.java | 1 +
...DataEncryptionAlgorithmsLookupStrategyTest.java | 1 +
.../DefaultEncryptionParametersResolverTest.java | 1 +
...portEncryptionAlgorithmsLookupStrategyTest.java | 1 +
.../RelyingPartySigningParametersResolverTest.java | 1 +
78 files changed, 1024 insertions(+), 804 deletions(-)
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwk/RemoteJwkSetCache.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwk/RemoteJwkSetCache.java
index 22d6d8a..17fdb62 100644
--- a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwk/RemoteJwkSetCache.java
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwk/RemoteJwkSetCache.java
@@ -129,7 +129,7 @@ public class RemoteJwkSetCache extends AbstractIdentifiableInitializableComponen
*
* @since 2.2.0
*/
- public JWKSet fetch(@Nonnull final URI uri, @Nonnull final String keyId, @Nonnull final Instant expires) {
+ @Nullable public JWKSet fetch(@Nonnull final URI uri, @Nonnull final String keyId, @Nonnull final Instant expires) {
return fetch(CONTEXT_NAME, uri, keyId, expires);
}
@@ -141,7 +141,7 @@ public class RemoteJwkSetCache extends AbstractIdentifiableInitializableComponen
*
* @return JWK set, null if not found from the cache and cannot be fetched.
*/
- public JWKSet fetch(@Nonnull final URI uri, @Nonnull final Instant expires) {
+ @Nullable public JWKSet fetch(@Nonnull final URI uri, @Nonnull final Instant expires) {
return fetch(CONTEXT_NAME, uri, expires);
}
@@ -157,6 +157,7 @@ public class RemoteJwkSetCache extends AbstractIdentifiableInitializableComponen
@Nullable public JWKSet fetch(@Nonnull @NotEmpty final String context, @Nonnull final URI uri,
@Nonnull final Instant expires) {
final String key = uri.toString();
+ assert key != null;
final StorageCapabilities caps = storage.getCapabilities();
if (context.length() > caps.getContextSize()) {
@@ -228,6 +229,7 @@ public class RemoteJwkSetCache extends AbstractIdentifiableInitializableComponen
@Nullable public JWKSet fetch(@Nonnull @NotEmpty final String context, @Nonnull final URI uri,
@Nonnull final String keyId, @Nonnull final Instant expires) {
final String key = uri.toString();
+ assert key != null;
final StorageCapabilities caps = storage.getCapabilities();
if (context.length() > caps.getContextSize()) {
@@ -263,4 +265,5 @@ public class RemoteJwkSetCache extends AbstractIdentifiableInitializableComponen
return null;
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
index c58058f..3dbadc4 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/BasicJOSEObjectCredentialResolver.java
@@ -26,7 +26,6 @@ import org.opensaml.security.credential.UsageType;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.opensaml.security.criteria.UsageCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.Header;
@@ -49,6 +48,7 @@ import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.jose.criterion.JOSEObjectCriterion;
import net.shibboleth.oidc.security.jose.criterion.KeyIdCriterion;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -59,8 +59,7 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
implements JOSEObjectCredentialResolver {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(BasicJOSEObjectCredentialResolver.class);
-
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicJOSEObjectCredentialResolver.class);
@Override
@Nonnull @NonnullElements protected Iterable<Credential> resolveFromSource(
@@ -218,13 +217,18 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
* @return a KeyId if one exists, {@code null} otherwise
*/
@Nullable protected String extractKeyIdFromCriteria(@Nonnull final CriteriaSet criteriaSet) {
- if (criteriaSet.contains(EvaluableKeyIDCredentialCriterion.class)) {
- return criteriaSet.get(EvaluableKeyIDCredentialCriterion.class).getKeyId();
- } else if (criteriaSet.contains(KeyIdCriterion.class)) {
- return criteriaSet.get(KeyIdCriterion.class).getKeyId();
- } else {
- return null;
+
+ final EvaluableKeyIDCredentialCriterion evalCrit = criteriaSet.get(EvaluableKeyIDCredentialCriterion.class);
+ if (evalCrit != null) {
+ return evalCrit.getKeyId();
}
+
+ final KeyIdCriterion keyIdCrit = criteriaSet.get(KeyIdCriterion.class);
+ if (keyIdCrit != null) {
+ return keyIdCrit.getKeyId();
+ }
+
+ return null;
}
/**
@@ -323,4 +327,5 @@ public class BasicJOSEObjectCredentialResolver extends AbstractCriteriaFiltering
}
return null;
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
index 538b70c..c089dec 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
@@ -17,15 +17,14 @@ package net.shibboleth.oidc.security.credential.impl;
import java.time.Duration;
import java.time.Instant;
import java.util.Collection;
-import java.util.Collections;
import java.util.LinkedHashSet;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
@@ -39,9 +38,11 @@ import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.Positive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.component.InitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -87,8 +88,8 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
* @param interval The remote key refresh interval
*/
public ClientInformationCredentialResolver(
- @Nonnull final @ParameterName(name="remoteJwkSetCache") RemoteJwkSetCache jwkSetCache,
- @Nonnull @Positive @ParameterName(name="keyFetchInterval") Duration interval) {
+ @Nonnull @ParameterName(name="remoteJwkSetCache") final RemoteJwkSetCache jwkSetCache,
+ @Nonnull @Positive @ParameterName(name="keyFetchInterval") final Duration interval) {
remoteJwkSetCache = Constraint.isNotNull(jwkSetCache, "The remote JWK set cache cannot be null");
Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
@@ -109,19 +110,18 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
/** {@inheritDoc} */
@Override
- protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
-
- Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
- if (criteriaSet.contains(ClientInformationCriterion.class)) {
- final OIDCClientInformation information =
- criteriaSet.get(ClientInformationCriterion.class).getOidcClientInformation();
- return resolveFromMetadata(criteriaSet, information);
-
- } else {
- log.debug("Criteria did not contain a ClientInformationCriterion could not perform resolution");
- return Collections.emptySet();
+ if (criteriaSet != null) {
+ final ClientInformationCriterion clientCrit = criteriaSet.get(ClientInformationCriterion.class);
+ if (clientCrit != null) {
+ return resolveFromMetadata(criteriaSet, clientCrit.getOidcClientInformation());
+ }
}
+
+ log.debug("Criteria did not contain a ClientInformationCriterion could not perform resolution");
+ return CollectionSupport.emptySet();
}
/**
@@ -159,7 +159,8 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
final String keyIdFromCriteria = extractKeyIdFromCriteria(criteriaSet);
if (StringSupport.trimOrNull(keyIdFromCriteria) != null) {
- keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),keyIdFromCriteria,
+ assert keyIdFromCriteria != null;
+ keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(), keyIdFromCriteria,
Instant.now().plus(keyFetchInterval));
} else {
keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),
@@ -180,4 +181,5 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
return credentials;
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
index 84637e8..031c6f7 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolver.java
@@ -14,18 +14,16 @@
package net.shibboleth.oidc.security.credential.impl;
-import java.util.Collections;
-import java.util.List;
-
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
-import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -43,21 +41,24 @@ public class ClientSecretCriterionCredentialResolver extends BasicJOSEObjectCred
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(ClientSecretCriterionCredentialResolver.class);
+ /** {@inheritDoc} */
@Override
- @Nonnull protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet)
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
throws ResolverException {
- Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
-
- if (criteriaSet.contains(ClientSecretCredentialCriterion.class)) {
- final ClientSecretCredentialCriterion credentialCriterion =
- criteriaSet.get(ClientSecretCredentialCriterion.class);
- final ClientSecretCredential secretCred = credentialCriterion.getCredential();
- log.trace("Found client secret credential");
- final Credential derivedCredential = deriveClientSecretCredential(secretCred, criteriaSet);
- return derivedCredential != null ? List.of(derivedCredential) : Collections.emptyList();
- } else {
- log.debug("Criteria did not contain a StaticClientSecretCredentialCriterion");
- return Collections.emptyList();
+
+ if (criteriaSet != null) {
+ final ClientSecretCredentialCriterion secretCrit = criteriaSet.get(ClientSecretCredentialCriterion.class);
+ if (secretCrit != null) {
+ final ClientSecretCredential secretCred = secretCrit.getCredential();
+ log.trace("Found client secret credential");
+ final Credential derivedCredential = deriveClientSecretCredential(secretCred, criteriaSet);
+ return derivedCredential != null ? CollectionSupport.listOf(derivedCredential)
+ : CollectionSupport.emptyList();
+ }
}
+
+ log.debug("Criteria did not contain a StaticClientSecretCredentialCriterion");
+ return CollectionSupport.emptyList();
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
index c5d60ce..41ebb4d 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolver.java
@@ -27,6 +27,7 @@ import org.opensaml.security.credential.Credential;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -57,7 +58,9 @@ public class CollectionJOSEObjectCredentialResolver extends BasicJOSEObjectCrede
public CollectionJOSEObjectCredentialResolver(
@Nonnull @ParameterName(name="credentials") final List<Credential> credentials) {
Constraint.isNotNull(credentials, "Input credentials list cannot be null");
- collection = credentials.stream().filter(Objects::nonNull).collect(Collectors.toList());
+ collection = credentials.stream()
+ .filter(Objects::nonNull)
+ .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
}
/**
@@ -73,10 +76,11 @@ public class CollectionJOSEObjectCredentialResolver extends BasicJOSEObjectCrede
collection.add(credential);
}
+ /** {@inheritDoc} */
@Override
@Nonnull @NonnullElements public Iterable<Credential> resolveFromSource(
@Nullable final CriteriaSet criteria) throws ResolverException {
return collection;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/DataEncryptionAlgorithmCriterion.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/DataEncryptionAlgorithmCriterion.java
index 25a4ec6..8e4dbc6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/DataEncryptionAlgorithmCriterion.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/DataEncryptionAlgorithmCriterion.java
@@ -37,7 +37,8 @@ public final class DataEncryptionAlgorithmCriterion implements Criterion {
* @param algorithm key algorithm
*/
public DataEncryptionAlgorithmCriterion(@Nonnull final String algorithm) {
- setEncAlgorithm(algorithm);
+ final String trimmed = StringSupport.trimOrNull(algorithm);
+ encAlgorithm = Constraint.isNotNull(trimmed, "Encryption algorithm criteria cannot be null or empty");
}
/**
@@ -56,9 +57,7 @@ public final class DataEncryptionAlgorithmCriterion implements Criterion {
*/
public void setEncAlgorithm(@Nonnull final String algorithm) {
final String trimmed = StringSupport.trimOrNull(algorithm);
- Constraint.isNotNull(trimmed, "Encryption algorithm criteria cannot be null or empty");
-
- encAlgorithm = trimmed;
+ encAlgorithm = Constraint.isNotNull(trimmed, "Encryption algorithm criteria cannot be null or empty");
}
/** {@inheritDoc} */
@@ -88,11 +87,11 @@ public final class DataEncryptionAlgorithmCriterion implements Criterion {
return false;
}
- if (obj instanceof DataEncryptionAlgorithmCriterion) {
- return encAlgorithm.equals(((DataEncryptionAlgorithmCriterion) obj).encAlgorithm);
+ if (obj instanceof DataEncryptionAlgorithmCriterion c) {
+ return encAlgorithm.equals(c.encAlgorithm);
}
return false;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java
index 51e8a10..fef5e62 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableKeyIDCredentialCriterion.java
@@ -20,12 +20,14 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Strings;
import net.shibboleth.oidc.security.credential.JWKCredential;
import net.shibboleth.oidc.security.jose.criterion.KeyIdCriterion;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -37,53 +39,62 @@ public class EvaluableKeyIDCredentialCriterion extends AbstractTriStatePredicate
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableKeyIDCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableKeyIDCredentialCriterion.class);
/** Base criteria. */
- private final String keyId;
+ @Nonnull private final String keyId;
/**
* Constructor.
*
* @param criteria the criteria which is the basis for evaluation
*/
- public EvaluableKeyIDCredentialCriterion(@Nonnull final KeyIdCriterion criteria) {
- keyId = Constraint.isNotNull(criteria, "Criterion instance cannot be null").getKeyId();
- }
+ public EvaluableKeyIDCredentialCriterion(@Nonnull final KeyIdCriterion criteria) {
+ keyId = Constraint.isNotNull(criteria, "Criterion instance cannot be null").getKeyId();
+ }
/**
* Constructor.
*
* @param newKeyId the criteria value which is the basis for evaluation
*/
- public EvaluableKeyIDCredentialCriterion(@Nonnull final String newKeyId) {
- final String trimmed = StringSupport.trimOrNull(newKeyId);
- Constraint.isNotNull(trimmed, "Key id cannot be null or empty");
-
- keyId = trimmed;
- }
+ public EvaluableKeyIDCredentialCriterion(@Nonnull final String newKeyId) {
+ final String trimmed = StringSupport.trimOrNull(newKeyId);
+ keyId = Constraint.isNotNull(trimmed, "Key id cannot be null or empty");
+ }
/**
* Get the keyId.
*
* @return the keyId
*/
- @Nonnull public String getKeyId() {
- return keyId;
- }
+ @Nonnull public String getKeyId() {
+ return keyId;
+ }
- @Override
+ /** {@inheritDoc} */
public boolean test(@Nullable final Credential target) {
+
if (target == null) {
log.error("Credential target was null");
return isNullInputSatisfies();
}
- if (!(target instanceof JWKCredential) ||
- ((JWKCredential)target).getKid() == null || ((JWKCredential)target).getKid().isEmpty()) {
+
+ final JWKCredential jwk;
+ if (target instanceof JWKCredential downcast) {
+ jwk = downcast;
+ } else {
+ log.info("Could not evaluate criteria, credential was not a JWK");
+ return isUnevaluableSatisfies();
+ }
+
+ final String kid = jwk.getKid();
+ if (Strings.isNullOrEmpty(kid)) {
log.info("Could not evaluate criteria, credential contained no key ID");
return isUnevaluableSatisfies();
}
- return ((JWKCredential)target).getKid().equals(keyId);
+
+ return keyId.equals(kid);
}
/** {@inheritDoc} */
@@ -113,11 +124,11 @@ public class EvaluableKeyIDCredentialCriterion extends AbstractTriStatePredicate
return false;
}
- if (obj instanceof EvaluableKeyIDCredentialCriterion) {
- return keyId.equals(((EvaluableKeyIDCredentialCriterion) obj).keyId);
+ if (obj instanceof EvaluableKeyIDCredentialCriterion c) {
+ return keyId.equals(c.keyId);
}
return false;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterion.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterion.java
index 14deaf4..58d2065 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterion.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterion.java
@@ -16,11 +16,11 @@ package net.shibboleth.oidc.security.credential.impl;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSAlgorithm;
@@ -28,6 +28,7 @@ import net.shibboleth.oidc.security.credential.JWACredentialSupport;
import net.shibboleth.shared.logic.AbstractTriStatePredicate;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Instance of evaluable credential criteria for evaluating if the key length of the secret key inside the credential
@@ -39,35 +40,38 @@ public class EvaluableMACKeyLengthCredentialCriterion extends AbstractTriStatePr
implements EvaluableCredentialCriterion {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(EvaluableMACKeyLengthCredentialCriterion.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableMACKeyLengthCredentialCriterion.class);
/** Base criteria. */
- private final JWSAlgorithm alg;
+ @Nonnull private final JWSAlgorithm alg;
/**
* Constructor.
*
* @param algorithm the algorithm which is the basis for evaluation. MUST be a MAC algorithm.
*/
- public EvaluableMACKeyLengthCredentialCriterion(@Nonnull final JWSAlgorithm algorithm) {
- alg = Constraint.isNotNull(algorithm, "MAC Algorithm can not be null");
- if (!JWSAlgorithm.Family.HMAC_SHA.contains(algorithm)) {
- throw new ConstraintViolationException(
+ public EvaluableMACKeyLengthCredentialCriterion(@Nonnull final JWSAlgorithm algorithm) {
+ alg = Constraint.isNotNull(algorithm, "MAC Algorithm can not be null");
+ if (!JWSAlgorithm.Family.HMAC_SHA.contains(algorithm)) {
+ throw new ConstraintViolationException(
"EvaluableMACKeyLengthCredentialCriterion only usable for MAC algorithms");
- }
- }
+ }
+ }
- @Override
+ /** {@inheritDoc} */
public boolean test(@Nullable final Credential target) {
+
if (target == null) {
log.error("Credential target was null");
return isNullInputSatisfies();
}
- if (target.getSecretKey() == null) {
+
+ final SecretKey key = target.getSecretKey();
+ if (key == null) {
log.error("Credential does not contain a secret key, can not be evaluated for key length");
return isUnevaluableSatisfies();
}
- return JWACredentialSupport.keyLengthSupportsMACAlgorithm(alg, target.getSecretKey());
+ return JWACredentialSupport.keyLengthSupportsMACAlgorithm(alg, key);
}
@@ -98,11 +102,11 @@ public class EvaluableMACKeyLengthCredentialCriterion extends AbstractTriStatePr
return false;
}
- if (obj instanceof EvaluableMACKeyLengthCredentialCriterion) {
- return alg.equals(((EvaluableMACKeyLengthCredentialCriterion) obj).alg);
+ if (obj instanceof EvaluableMACKeyLengthCredentialCriterion c) {
+ return alg.equals(c.alg);
}
return false;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/KeyManagmentAlgorithmCriterion.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/KeyManagmentAlgorithmCriterion.java
index 26e7ea9..2c879ca 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/KeyManagmentAlgorithmCriterion.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/KeyManagmentAlgorithmCriterion.java
@@ -28,7 +28,7 @@ import net.shibboleth.shared.resolver.Criterion;
public final class KeyManagmentAlgorithmCriterion implements Criterion {
/** Key algorithm type of resolved credentials. */
- private String algorithmName;
+ @Nonnull private String algorithmName;
/**
* Constructor.
@@ -36,7 +36,8 @@ public final class KeyManagmentAlgorithmCriterion implements Criterion {
* @param algorithm key algorithm
*/
public KeyManagmentAlgorithmCriterion(@Nonnull final String algorithm) {
- setAlgorithm(algorithm);
+ final String trimmed = StringSupport.trimOrNull(algorithm);
+ algorithmName = Constraint.isNotNull(trimmed, "Key Management algorithm criteria cannot be null or empty");
}
/**
@@ -55,9 +56,7 @@ public final class KeyManagmentAlgorithmCriterion implements Criterion {
*/
public void setAlgorithm(@Nonnull final String algorithm) {
final String trimmed = StringSupport.trimOrNull(algorithm);
- Constraint.isNotNull(trimmed, "Key Management algorithm criteria cannot be null or empty");
-
- algorithmName = trimmed;
+ algorithmName = Constraint.isNotNull(trimmed, "Key Management algorithm criteria cannot be null or empty");
}
/** {@inheritDoc} */
@@ -87,11 +86,11 @@ public final class KeyManagmentAlgorithmCriterion implements Criterion {
return false;
}
- if (obj instanceof KeyManagmentAlgorithmCriterion) {
- return algorithmName.equals(((KeyManagmentAlgorithmCriterion) obj).algorithmName);
+ if (obj instanceof KeyManagmentAlgorithmCriterion c) {
+ return algorithmName.equals(c.algorithmName);
}
return false;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
index baffda6..50547d7 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolver.java
@@ -14,6 +14,7 @@
package net.shibboleth.oidc.security.credential.impl;
+import java.security.PublicKey;
import java.util.ArrayList;
import java.util.List;
import java.util.stream.Collectors;
@@ -25,7 +26,6 @@ import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.criteria.PublicKeyCriterion;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Predicates;
import com.nimbusds.jose.Header;
@@ -38,7 +38,9 @@ import net.shibboleth.oidc.security.impl.JWETokenDecrypter;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.Live;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -82,10 +84,10 @@ import net.shibboleth.shared.resolver.ResolverException;
public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredentialResolver {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(LocalJOSEObjectCredentialResolver.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(LocalJOSEObjectCredentialResolver.class);
/** The resolver which is used to resolve local credentials. */
- private final JOSEObjectCredentialResolver localCredResolver;
+ @Nonnull private final JOSEObjectCredentialResolver localCredResolver;
/**
* Constructor.
@@ -111,9 +113,8 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
}
@Override
- protected void postProcess(@Nullable final CriteriaSet criteriaSet,
- @Nonnull final JOSEObject joseObject, @Nonnull final List<Credential> credentials)
- throws ResolverException {
+ protected void postProcess(@Nullable final CriteriaSet criteriaSet, @Nonnull final JOSEObject joseObject,
+ @Nonnull final List<Credential> credentials) throws ResolverException {
final List<Credential> results = new ArrayList<>();
@@ -124,24 +125,26 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
// TODO this is impossible in the JOSE case implemented here?
log.debug("Input credential was local, including in results");
results.add(inputCred);
- } else if (inputCred.getPublicKey() != null) {
-
- final CriteriaSet criteria = new CriteriaSet();
- // Add public key criterion
- criteria.add(new PublicKeyCriterion(inputCred.getPublicKey()));
-
- if (kid != null) {
- // Also filter public key by keyID if one exists in the 'kid' parameter.
- // This is also caught upstream, so add in-case resolver needs it and filter
- // anyway.
- log.trace("Adding 'kid' value '{}' to credential resolver", kid);
- criteria.add(new EvaluableKeyIDCredentialCriterion(kid));
- }
- final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
- log.trace("Matched {} local credential(s) from {} input credential(s) on 'public key' and optionally "
- + "'kid' criterion", localCredentials.size(), credentials.size());
- if (!localCredentials.isEmpty()) {
- results.addAll(localCredentials);
+ } else {
+ final PublicKey pkey = inputCred.getPublicKey();
+ if (pkey != null) {
+ final CriteriaSet criteria = new CriteriaSet();
+ // Add public key criterion
+ criteria.add(new PublicKeyCriterion(pkey));
+
+ if (kid != null) {
+ // Also filter public key by keyID if one exists in the 'kid' parameter.
+ // This is also caught upstream, so add in-case resolver needs it and filter
+ // anyway.
+ log.trace("Adding 'kid' value '{}' to credential resolver", kid);
+ criteria.add(new EvaluableKeyIDCredentialCriterion(kid));
+ }
+ final List<Credential> localCredentials = resolveLocalCredentialsByCriteria(criteria);
+ log.trace("Matched {} local credential(s) from {} input credential(s) on 'public key' and optionally "
+ + "'kid' criterion", localCredentials.size(), credentials.size());
+ if (!localCredentials.isEmpty()) {
+ results.addAll(localCredentials);
+ }
}
}
}
@@ -180,7 +183,7 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
return credentialsToFilter.stream().filter(Predicates.not(lc -> credentialsToFilterOn.stream()
.anyMatch(r -> lc.getPrivateKey().equals(r.getPrivateKey())
&& lc.getPublicKey().equals(r.getPublicKey()))))
- .collect(Collectors.toList());
+ .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
}
@@ -236,4 +239,4 @@ public class LocalJOSEObjectCredentialResolver extends BasicJOSEObjectCredential
return credential.getPrivateKey() != null || credential.getSecretKey() != null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
index c1b7bd8..1504953 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolver.java
@@ -17,15 +17,14 @@ package net.shibboleth.oidc.security.credential.impl;
import java.time.Duration;
import java.time.Instant;
import java.util.Collection;
-import java.util.Collections;
import java.util.LinkedHashSet;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -34,9 +33,11 @@ import net.shibboleth.oidc.jwk.RemoteJwkSetCache;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.annotation.constraint.Positive;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.component.InitializableComponent;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -70,7 +71,7 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
* @param jwkSetCache The cache for remote JWK key sets.
*/
public ProviderMetadataCredentialResolver(
- @Nonnull final @ParameterName(name="remoteJwkSetCache") RemoteJwkSetCache jwkSetCache) {
+ @Nonnull @ParameterName(name="remoteJwkSetCache") final RemoteJwkSetCache jwkSetCache) {
this(jwkSetCache, Duration.ofMinutes(30));
}
@@ -81,8 +82,8 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
* @param interval The remote key refresh interval
*/
public ProviderMetadataCredentialResolver(
- @Nonnull final @ParameterName(name="remoteJwkSetCache") RemoteJwkSetCache jwkSetCache,
- @Nonnull @Positive @ParameterName(name="keyFetchInterval") Duration interval) {
+ @Nonnull @ParameterName(name="remoteJwkSetCache") final RemoteJwkSetCache jwkSetCache,
+ @Nonnull @Positive @ParameterName(name="keyFetchInterval") final Duration interval) {
remoteJwkSetCache = Constraint.isNotNull(jwkSetCache, "The remote JWK set cache cannot be null");
Constraint.isFalse(interval == null || interval.isNegative(), "Remote key refresh must be greater than 0");
@@ -90,30 +91,29 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
}
/** {@inheritDoc} */
- @Override
public boolean isInitialized() {
return isInitialized;
}
/** {@inheritDoc} */
- @Override
public void initialize() throws ComponentInitializationException {
isInitialized = true;
}
+ /** {@inheritDoc} */
@Override
- protected Iterable<Credential> resolveFromSource(@Nonnull final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
- Constraint.isNotNull(criteriaSet, "CriteriaSet was null");
-
- if (criteriaSet.contains(ProviderMetadataCriterion.class)) {
- final OIDCProviderMetadata metadata = criteriaSet.get(ProviderMetadataCriterion.class).getMetadata();
- return resolveFromMetadata(criteriaSet, metadata);
-
- } else {
- log.debug("Criteria did not contain a ProviderMetadataCriterion could not perform resolution");
- return Collections.emptySet();
+ if (criteriaSet != null) {
+ final ProviderMetadataCriterion mc = criteriaSet.get(ProviderMetadataCriterion.class);
+ if (mc != null) {
+ return resolveFromMetadata(criteriaSet, mc.getMetadata());
+ }
}
+
+ log.debug("Criteria did not contain a ProviderMetadataCriterion could not perform resolution");
+ return CollectionSupport.emptySet();
}
/**
@@ -142,7 +142,8 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
JWKSet keySet = null;
if (StringSupport.trimOrNull(keyIdFromCriteria) != null) {
- keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),keyIdFromCriteria,
+ assert keyIdFromCriteria != null;
+ keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(), keyIdFromCriteria,
Instant.now().plus(keyFetchInterval));
} else {
keySet = remoteJwkSetCache.fetch(metadata.getJWKSetURI(),
@@ -151,7 +152,7 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
if (keySet == null) {
log.debug("Remote keys could not be fetched, unable to resolve credentials");
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
populateCredentialsFromKeySet(keySet, credentials);
@@ -161,4 +162,4 @@ public class ProviderMetadataCredentialResolver extends BasicJOSEObjectCredentia
return credentials;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ReturnAllCollectionJOSEObjectCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ReturnAllCollectionJOSEObjectCredentialResolver.java
index 6bcb622..5b09f20 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ReturnAllCollectionJOSEObjectCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ReturnAllCollectionJOSEObjectCredentialResolver.java
@@ -19,6 +19,7 @@ import java.util.Collection;
import java.util.List;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
@@ -69,13 +70,13 @@ public class ReturnAllCollectionJOSEObjectCredentialResolver implements JOSEObje
collection.add(credential);
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
+ /** {@inheritDoc} */
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
return collection;
}
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ /** {@inheritDoc} */
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final Iterable<Credential> creds = resolve(criteria);
if (creds.iterator().hasNext()) {
return creds.iterator().next();
@@ -83,4 +84,4 @@ public class ReturnAllCollectionJOSEObjectCredentialResolver implements JOSEObje
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/AbstractEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/AbstractEncryptionAlgorithmsLookupStrategy.java
index 22bad86..f84c908 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/AbstractEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/AbstractEncryptionAlgorithmsLookupStrategy.java
@@ -26,6 +26,7 @@ import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.opensaml.xmlsec.impl.AlgorithmRuntimeSupportedPredicate;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -48,7 +49,7 @@ public abstract class AbstractEncryptionAlgorithmsLookupStrategy
*/
protected AbstractEncryptionAlgorithmsLookupStrategy(@Nullable final AlgorithmRegistry registry) {
if (registry == null) {
- algorithmRegistry = AlgorithmSupport.getGlobalAlgorithmRegistry();
+ algorithmRegistry = AlgorithmSupport.ensureGlobalAlgorithmRegistry();
} else {
algorithmRegistry = registry;
}
@@ -69,7 +70,7 @@ public abstract class AbstractEncryptionAlgorithmsLookupStrategy
*
* @return the algorithm registry
*/
- protected AlgorithmRegistry getAlgorithmRegistry() {
+ @Nonnull protected AlgorithmRegistry getAlgorithmRegistry() {
return algorithmRegistry;
}
@@ -85,8 +86,10 @@ public abstract class AbstractEncryptionAlgorithmsLookupStrategy
*/
@Nonnull protected List<String> findAlgorithmIntersection(@Nonnull final List<String> providerAlgorithms,
@Nonnull final List<String> configAlgorithms){
- return configAlgorithms.stream().filter(providerAlgorithms::contains).collect(Collectors.toList());
+ return configAlgorithms.stream()
+ .filter(providerAlgorithms::contains)
+ .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
index 6bd7db4..efb769d 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseJWTSignatureSecurityHandler.java
@@ -29,7 +29,6 @@ import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.security.messaging.impl.BaseTrustEngineSecurityHandler;
import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
import com.nimbusds.jwt.SignedJWT;
@@ -42,6 +41,7 @@ import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableClientProfileConfiguration;
import net.shibboleth.oidc.profile.oauth2.config.OAuth2ClientAuthenticableProfileConfiguration;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
+import net.shibboleth.oidc.security.jose.SignatureValidationParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriterion;
@@ -50,6 +50,7 @@ import net.shibboleth.oidc.security.jose.criterion.SignatureValidationParameters
import net.shibboleth.profile.context.RelyingPartyContext;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -72,8 +73,7 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
= new ParentProfileRequestContextLookup<>();
/** Class logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(BaseJWTSignatureSecurityHandler.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BaseJWTSignatureSecurityHandler.class);
/**
* Function that looks up provider metadata from the given message context. Can return {@literal null}
@@ -175,16 +175,20 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
return peerContext;
}
+ /** {@inheritDoc} */
@Override
- @Nullable protected TrustEngine<SignedJWT> resolveTrustEngine(final MessageContext messageContext) {
+ @Nullable protected TrustEngine<SignedJWT> resolveTrustEngine(@Nonnull final MessageContext messageContext) {
final SecurityParametersContext secParams =
messageContext.getSubcontext(SecurityParametersContext.class);
- if (secParams == null || secParams.getSignatureValidationParameters() == null) {
+ final SignatureValidationParameters valParams =
+ secParams != null ? secParams.getSignatureValidationParameters() : null;
+ if (valParams == null) {
return null;
}
- return secParams.getSignatureValidationParameters().getSignatureTrustEngine();
+ return valParams.getSignatureTrustEngine();
}
+ /** {@inheritDoc} */
@Override
protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
@@ -206,6 +210,7 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
return true;
}
+ /** {@inheritDoc} */
@Override
protected CriteriaSet buildCriteriaSet(@Nullable final String entityID,
@Nonnull final MessageContext messageContext) throws MessageHandlerException {
@@ -241,7 +246,11 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
if (secParams == null) {
throw new MessageHandlerException("Security parameters context could not be found, must be set");
}
- criteriaSet.add(new SignatureValidationParametersCriterion(secParams.getSignatureValidationParameters()));
+
+ final SignatureValidationParameters valParams = secParams.getSignatureValidationParameters();
+ if (valParams != null) {
+ criteriaSet.add(new SignatureValidationParametersCriterion(valParams));
+ }
return criteriaSet;
}
@@ -255,13 +264,10 @@ public abstract class BaseJWTSignatureSecurityHandler extends BaseTrustEngineSec
*
* @param <T> the output type of the functions
*/
- @Nullable protected <T> Function<MessageContext, T> adapt(
- @Nullable final Function<ProfileRequestContext, T> function) {
- if (function == null) {
- return null;
- }
+ @SuppressWarnings("null")
+ @Nonnull protected <T> Function<MessageContext, T> adapt(
+ @Nonnull final Function<ProfileRequestContext, T> function) {
return function.compose(PRC_LOOKUP);
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
index 55e3396..8db90b0 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/BaseSignedJWTTrustEngine.java
@@ -28,7 +28,6 @@ import org.opensaml.security.credential.Credential;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JOSEException;
@@ -45,6 +44,7 @@ import net.shibboleth.oidc.security.credential.JWKCredential;
import net.shibboleth.oidc.security.jose.criterion.JOSEObjectCriterion;
import net.shibboleth.oidc.security.jose.criterion.SignatureValidationParametersCriterion;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -58,10 +58,10 @@ import net.shibboleth.shared.resolver.ResolverException;
public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustEngine<SignedJWT> {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(BaseSignedJWTTrustEngine.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BaseSignedJWTTrustEngine.class);
/** Resolver of credentials from JOSEObject headers. */
- private final JOSEObjectCredentialResolver joseObjectCredentialResolver;
+ @Nonnull private final JOSEObjectCredentialResolver joseObjectCredentialResolver;
/**
* Constructor.
@@ -73,17 +73,18 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
"JOSEObject credential resolver cannot be null");
}
- @Override
+ /** {@inheritDoc} */
public boolean validate(@Nonnull final SignedJWT signedJWT,
- @Nonnull final CriteriaSet trustBasisCriteria) throws SecurityException {
+ @Nullable final CriteriaSet trustBasisCriteria) throws SecurityException {
checkParams(signedJWT, trustBasisCriteria);
+ assert trustBasisCriteria != null;
/*
* TODO - need correct components, and/or to account for diffs between XML and JOSE algorithm identifiers
- */
- final SignatureValidationParametersCriterion validationCriterion =
- trustBasisCriteria.get(SignatureValidationParametersCriterion.class);
+ */
+ final SignatureValidationParametersCriterion validationCriterion = trustBasisCriteria != null
+ ? trustBasisCriteria.get(SignatureValidationParametersCriterion.class) : null;
if (validationCriterion != null) {
log.debug("Performing signature algorithm include/exclude validation using params from CriteriaSet");
// Algorithm can not be null on the header
@@ -108,9 +109,8 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
* @return true if signature is valid and trusted, false otherwise
* @throws SecurityException if there is a fatal error evaluating the signature
*/
- protected abstract boolean doValidate(
- @Nonnull final SignedJWT signedJWT, @Nonnull final CriteriaSet trustBasisCriteria)
- throws SecurityException ;
+ protected abstract boolean doValidate(@Nonnull final SignedJWT signedJWT,
+ @Nonnull final CriteriaSet trustBasisCriteria) throws SecurityException;
/**
* Attempt to establish trust by resolving token verification credentials from the token itself. If any
@@ -133,6 +133,7 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
if (!tokenCredentials.isEmpty()) {
log.debug("Resolved {} token-derived credentials", tokenCredentials.size());
for (final Credential tokenCred : tokenCredentials) {
+ assert tokenCred != null;
if (verifySignature(signedJWT, tokenCred)) {
log.debug("Successfully verified signature using token-derived credential");
log.debug("Attempting to establish trust of token-derived credential");
@@ -233,7 +234,7 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
* @param trustBasisCriteria the set of trusted credential criteria
* @throws SecurityException thrown if required values are absent or otherwise invalid
*/
- protected void checkParams(@Nonnull final SignedJWT signedJWT, @Nonnull final CriteriaSet trustBasisCriteria)
+ protected void checkParams(@Nullable final SignedJWT signedJWT, @Nullable final CriteriaSet trustBasisCriteria)
throws SecurityException {
if (signedJWT == null) {
@@ -266,4 +267,4 @@ public abstract class BaseSignedJWTTrustEngine<TrustBasisType> implements TrustE
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
index f7a9542..408cd97 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfiguration.java
@@ -23,7 +23,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.action.ActionSupport;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWEHeader;
import com.nimbusds.jwt.EncryptedJWT;
@@ -32,8 +31,10 @@ import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.idp.profile.AbstractProfileAction;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -64,7 +65,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
@NonnullAfterInit private String errorEventId;
/** The extracted encrypted JWT that is to be processed. */
- @Nullable private EncryptedJWT encryptedJwt;
+ @NonnullBeforeExec private EncryptedJWT encryptedJwt;
/** Whether encryption is optional. */
private boolean encryptionOptional;
@@ -169,7 +170,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
/** {@inheritDoc} */
@Override
- protected boolean doPreExecute(final ProfileRequestContext profileRequestContext) {
+ protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
if (!super.doPreExecute(profileRequestContext)) {
return false;
}
@@ -196,7 +197,7 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
/** {@inheritDoc} */
@Override
- protected void doExecute(final ProfileRequestContext profileRequestContext) {
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
final JWEHeader jweHeader = encryptedJwt.getHeader();
final OIDCClientInformation clientInformation = clientInformationLookupStrategy.apply(profileRequestContext);
@@ -232,4 +233,5 @@ public class CheckClientJWTDecryptionConfiguration extends AbstractProfileAction
ActionSupport.buildEvent(profileRequestContext, errorEventId);
}
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java
index b21805c..396bb03 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CheckClientJWTSignatureAlgorithmHandler.java
@@ -24,14 +24,15 @@ import org.opensaml.messaging.handler.AbstractMessageHandler;
import org.opensaml.messaging.handler.MessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.SignedJWT;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -41,8 +42,7 @@ import net.shibboleth.shared.primitive.StringSupport;
public class CheckClientJWTSignatureAlgorithmHandler extends AbstractMessageHandler {
/** Logger. */
- @Nonnull private final Logger log =
- LoggerFactory.getLogger(CheckClientJWTSignatureAlgorithmHandler.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(CheckClientJWTSignatureAlgorithmHandler.class);
/** Function that looks up a signed JWT token from the given message context to validate .*/
@NonnullAfterInit private Function<MessageContext, SignedJWT> jwtTokenLookupStrategy;
@@ -57,7 +57,7 @@ public class CheckClientJWTSignatureAlgorithmHandler extends AbstractMessageHand
@NonnullAfterInit private Function<OIDCClientInformation, String> signatureAlgorithmLookupStrategy;
/** The extracted signed JWT that is to be validated.*/
- @Nullable private SignedJWT signedJwt;
+ @NonnullBeforeExec private SignedJWT signedJwt;
/** The default algorithm value used if lookup strategy returned null. */
@Nullable private String defaultAlgorithmValue;
@@ -130,7 +130,7 @@ public class CheckClientJWTSignatureAlgorithmHandler extends AbstractMessageHand
/** {@inheritDoc} */
@Override
- protected boolean doPreInvoke(final MessageContext messageContext) throws MessageHandlerException {
+ protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
if (!super.doPreInvoke(messageContext)) {
return false;
}
@@ -146,7 +146,7 @@ public class CheckClientJWTSignatureAlgorithmHandler extends AbstractMessageHand
/** {@inheritDoc} */
@Override
- protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
+ protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
final String tokenAlgorithm = signedJwt.getHeader().getAlgorithm().getName();
final String expectedAlgorithm = getExpectedAlgorithm(clientInformationLookupStrategy.apply(messageContext));
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngine.java
index 3cf1b2e..08ece09 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngine.java
@@ -23,7 +23,6 @@ import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.trust.TrustedCredentialTrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JOSEObject;
import com.nimbusds.jwt.SignedJWT;
@@ -33,6 +32,7 @@ import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -53,7 +53,7 @@ public class ClientInformationJWTTrustEngine extends ExplicitKeySignedJWTTrustEn
implements TrustedCredentialTrustEngine<SignedJWT> {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ClientInformationJWTTrustEngine.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ClientInformationJWTTrustEngine.class);
/** A lookup function for the signature algorithm in the client metadata. */
@Nonnull private final Function<OIDCClientInformation, String> signatureAlgorithmLookupStrategy;
@@ -84,26 +84,33 @@ public class ClientInformationJWTTrustEngine extends ExplicitKeySignedJWTTrustEn
@Override
protected boolean doValidate(@Nonnull final SignedJWT signedJWT, @Nonnull final CriteriaSet trustBasisCriteria)
throws SecurityException {
+
if (super.doValidate(signedJWT, trustBasisCriteria)) {
final String tokenAlgorithm = signedJWT.getHeader().getAlgorithm().getName();
+
final String expectedAlgorithm;
- if (trustBasisCriteria.contains(ClientInformationCriterion.class)) {
- expectedAlgorithm = getExpectedAlgorithm(trustBasisCriteria.get(ClientInformationCriterion.class));
+ final ClientInformationCriterion clientInfo = trustBasisCriteria.get(ClientInformationCriterion.class);
+ if (clientInfo != null) {
+ expectedAlgorithm = getExpectedAlgorithm(clientInfo);
} else {
log.debug("No client information given, using default value {}", defaultAlgorithmValue);
expectedAlgorithm = defaultAlgorithmValue;
}
+
if (expectedAlgorithm == null) {
log.debug("No expected algorithm defined, accepting {} from the token", tokenAlgorithm);
return true;
}
+
if (tokenAlgorithm.equals(expectedAlgorithm)) {
log.debug("The algorithnm specified in the token was expected {}", tokenAlgorithm);
return true;
}
+
log.warn("The algorithnm specified in the token {} was not expected {}", tokenAlgorithm, expectedAlgorithm);
return false;
}
+
return false;
}
@@ -115,19 +122,14 @@ public class ClientInformationJWTTrustEngine extends ExplicitKeySignedJWTTrustEn
*/
@Nullable protected String getExpectedAlgorithm(@Nonnull final ClientInformationCriterion criterion) {
final OIDCClientInformation metadata = criterion.getOidcClientInformation();
- if (metadata != null) {
- final String storedAlgorithm = signatureAlgorithmLookupStrategy.apply(metadata);
- if (StringSupport.trimOrNull(storedAlgorithm) == null) {
- log.debug("No algorithm value specified in metadata, using default value {}", defaultAlgorithmValue);
- return defaultAlgorithmValue;
- } else {
- log.debug("Found the expected algorithm from metadata: {}", storedAlgorithm);
- return storedAlgorithm;
- }
- } else {
- log.debug("No client information given, using default value {}", defaultAlgorithmValue);
+ final String storedAlgorithm = signatureAlgorithmLookupStrategy.apply(metadata);
+ if (StringSupport.trimOrNull(storedAlgorithm) == null) {
+ log.debug("No algorithm value specified in metadata, using default value {}", defaultAlgorithmValue);
return defaultAlgorithmValue;
+ } else {
+ log.debug("Found the expected algorithm from metadata: {}", storedAlgorithm);
+ return storedAlgorithm;
}
-
}
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java
index 6f1c8ce..bd6854e 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/DecryptJWE.java
@@ -19,7 +19,6 @@ import java.util.function.BiConsumer;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
@@ -28,7 +27,6 @@ import org.opensaml.profile.context.ProfileRequestContext;
import org.opensaml.profile.context.navigate.InboundMessageContextLookup;
import org.opensaml.xmlsec.encryption.support.DecryptionException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.EncryptedJWT;
import com.nimbusds.jwt.JWT;
@@ -38,8 +36,10 @@ import net.shibboleth.oidc.profile.core.OidcEventIds;
import net.shibboleth.oidc.security.jose.DecryptionParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Decrypt the located JWE using the decryption parameters stored in the security context.
@@ -66,10 +66,10 @@ public class DecryptJWE extends AbstractProfileAction {
@Nonnull private String errorEventId;
/** The extracted encrypted JWT that is to be validated.*/
- @Nullable private EncryptedJWT encryptedJwt;
+ @NonnullBeforeExec private EncryptedJWT encryptedJwt;
/** The decryption object. */
- @Nullable private JWETokenDecrypter decrypter;
+ @NonnullBeforeExec private JWETokenDecrypter decrypter;
/** Strategy used to locate the {@link SecurityParametersContext}. */
@Nonnull private Function<ProfileRequestContext, SecurityParametersContext> securityParamsLookupStrategy;
@@ -133,6 +133,7 @@ public class DecryptJWE extends AbstractProfileAction {
errorEventId = Constraint.isNotEmpty(id, "Error event identifier cannot be empty");
}
+ /** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -160,19 +161,20 @@ public class DecryptJWE extends AbstractProfileAction {
}
final SecurityParametersContext paramsCtx = securityParamsLookupStrategy.apply(profileRequestContext);
- if (paramsCtx == null || paramsCtx.getDecryptionParameters() == null) {
+ final DecryptionParameters params = paramsCtx != null ? paramsCtx.getDecryptionParameters() : null;
+
+ if (params == null) {
log.debug("{} No security parameter context or decryption parameters", getLogPrefix());
ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_SEC_CFG);
return false;
} else {
- final DecryptionParameters params = paramsCtx.getDecryptionParameters();
decrypter = new JWETokenDecrypter(params);
}
-
return true;
}
+ /** {@inheritDoc} */
@Override
protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/EncryptJWTHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/EncryptJWTHandler.java
index bad169a..40b7557 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/EncryptJWTHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/EncryptJWTHandler.java
@@ -30,7 +30,6 @@ import org.opensaml.messaging.handler.MessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.JWEAlgorithm;
@@ -48,9 +47,11 @@ import net.shibboleth.oidc.security.CredentialConversionUtil;
import net.shibboleth.oidc.security.jose.EncryptionParameters;
import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -74,7 +75,7 @@ public class EncryptJWTHandler extends AbstractMessageHandler {
@NonnullAfterInit private BiConsumer<JWT, MessageContext> jwtUpdateConsumer;
/** The signature signing parameters. */
- @Nullable private EncryptionParameters encryptionParameters;
+ @NonnullBeforeExec private EncryptionParameters encryptionParameters;
/** A friendly name to log as the subject of encryption.*/
@Nonnull private String logName;
@@ -280,4 +281,4 @@ public class EncryptJWTHandler extends AbstractMessageHandler {
getLogPrefix(), logName, keyID, alg, enc);
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
index f1ab519..06ddc45 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngine.java
@@ -15,6 +15,7 @@
package net.shibboleth.oidc.security.impl;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.Credential;
@@ -25,7 +26,6 @@ import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.security.trust.TrustedCredentialTrustEngine;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
import com.nimbusds.jose.JOSEObject;
@@ -38,6 +38,7 @@ import net.shibboleth.oidc.security.credential.impl.EvaluableMACKeyLengthCredent
import net.shibboleth.oidc.security.jose.criterion.KeyIdCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -58,10 +59,10 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
implements TrustedCredentialTrustEngine<SignedJWT> {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ExplicitKeySignedJWTTrustEngine.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeySignedJWTTrustEngine.class);
/** Resolver used for resolving trusted credentials. */
- private final CredentialResolver credentialResolver;
+ @Nonnull private final CredentialResolver credentialResolver;
/** The external explicit key trust engine to use as a basis for trust in this implementation. */
private final ExplicitKeyTrustEvaluator keyTrust;
@@ -80,10 +81,12 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
}
/** {@inheritDoc} */
- @Override @Nonnull public CredentialResolver getCredentialResolver() {
+ @Override
+ @Nonnull public CredentialResolver getCredentialResolver() {
return credentialResolver;
}
+ /** {@inheritDoc} */
@Override
protected boolean doValidate(@Nonnull final SignedJWT signedJWT, @Nonnull final CriteriaSet trustBasisCriteria)
throws SecurityException {
@@ -97,12 +100,14 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
final String jcaAlgorithm = AlgorithmSupport.getKeyAlgorithm(sigAlg.getName());
if (!Strings.isNullOrEmpty(jcaAlgorithm)) {
+ assert jcaAlgorithm != null;
criteriaSet.add(new KeyAlgorithmCriterion(jcaAlgorithm), true);
}
// Add the kid from the JOSE header if available
final String kid = signedJWT.getHeader().getKeyID();
if (!Strings.isNullOrEmpty(kid)) {
+ assert kid != null;
criteriaSet.add(new EvaluableKeyIDCredentialCriterion(new KeyIdCriterion(kid)));
}
@@ -128,6 +133,7 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
log.debug("Attempting to verify signature using trusted credentials");
for (final Credential trustedCredential : trustedCredentials) {
+ assert trustedCredential != null;
if (verifySignature(signedJWT, trustedCredential)) {
log.debug("Successfully verified signature using resolved trusted credential");
return true;
@@ -137,11 +143,16 @@ public class ExplicitKeySignedJWTTrustEngine extends BaseSignedJWTTrustEngine<It
return false;
}
+ /** {@inheritDoc} */
@Override
protected boolean evaluateTrust(@Nonnull final Credential untrustedCredential,
- @Nonnull final Iterable<Credential> trustedCredentials) throws SecurityException {
+ @Nullable final Iterable<Credential> trustedCredentials) throws SecurityException {
- return keyTrust.validate(untrustedCredential, trustedCredentials);
+ if (trustedCredentials != null) {
+ return keyTrust.validate(untrustedCredential, trustedCredentials);
+ } else {
+ return false;
+ }
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeyTrustEvaluator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeyTrustEvaluator.java
index 32e68f2..57709ca 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeyTrustEvaluator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/ExplicitKeyTrustEvaluator.java
@@ -20,7 +20,8 @@ import javax.annotation.Nonnull;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Auxillary trust evaluator for evaluating an untrusted key or credential against a trusted key or credential. Trust is
@@ -32,7 +33,7 @@ import org.slf4j.LoggerFactory;
public class ExplicitKeyTrustEvaluator {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEvaluator.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEvaluator.class);
/**
* Evaluate trust.
@@ -108,6 +109,7 @@ public class ExplicitKeyTrustEvaluator {
@Nonnull final Iterable<Credential> trustedCredentials) {
for (final Credential trustedCredential : trustedCredentials) {
+ assert trustedCredential != null;
if (validate(untrustedCredential, trustedCredential)) {
return true;
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
index 38da9cb..4771916 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
@@ -21,8 +21,10 @@ import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.security.credential.UsageType;
import org.opensaml.security.criteria.KeyAlgorithmCriterion;
import org.opensaml.security.criteria.KeyLengthCriterion;
@@ -30,7 +32,6 @@ import org.opensaml.security.criteria.UsageCriterion;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.opensaml.xmlsec.encryption.support.DecryptionException;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
import com.nimbusds.jose.EncryptionMethod;
@@ -54,7 +55,9 @@ import net.shibboleth.oidc.security.credential.impl.KeyManagmentAlgorithmCriteri
import net.shibboleth.oidc.security.jose.DecryptionParameters;
import net.shibboleth.oidc.security.jose.criterion.JOSEObjectCriterion;
import net.shibboleth.oidc.security.jose.criterion.KeyIdCriterion;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
@@ -72,7 +75,7 @@ import net.shibboleth.shared.resolver.ResolverException;
public class JWETokenDecrypter {
/** Class logger. */
- private final Logger log = LoggerFactory.getLogger(JWETokenDecrypter.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(JWETokenDecrypter.class);
/** The JWT decryption parameters. */
@Nonnull private final DecryptionParameters params;
@@ -270,9 +273,11 @@ public class JWETokenDecrypter {
if (Strings.isNullOrEmpty(algorithmURI)) {
return null;
}
-
+ assert algorithmURI != null;
+
final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(algorithmURI);
if (!Strings.isNullOrEmpty(jcaKeyAlgorithm)) {
+ assert jcaKeyAlgorithm != null;
return new KeyAlgorithmCriterion(jcaKeyAlgorithm);
}
@@ -289,6 +294,7 @@ public class JWETokenDecrypter {
if (Strings.isNullOrEmpty(encAlgorithmURI)) {
return null;
}
+ assert encAlgorithmURI != null;
final Integer keyLength = AlgorithmSupport.getKeyLength(encAlgorithmURI);
if (keyLength != null) {
@@ -312,19 +318,21 @@ public class JWETokenDecrypter {
*
* @throws DecryptionException if any of the resolved credentials could not be used to decrypt the JWT.
*/
- private void decryptUsingKeyAgreement(final EncryptedJWT encryptedObject) throws DecryptionException {
+ private void decryptUsingKeyAgreement(@Nonnull final EncryptedJWT encryptedObject) throws DecryptionException {
log.debug("Attempting decryption of JWE using Key Agreement managment mode");
- if (params.getKEKCredentialResolver()== null) {
+ final CredentialResolver kekResolver = params.getKEKCredentialResolver();
+ if (kekResolver == null) {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
final CriteriaSet criteria =
- buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ buildCriteria(encryptedObject, CollectionSupport.singletonList(new UsageCriterion(UsageType.ENCRYPTION)));
buildKeyManagementAlgorithmCriteria(criteria, encryptedObject);
try {
- for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
+ for (final Credential cred : kekResolver.resolve(criteria)) {
+ assert cred != null;
if (!(cred instanceof JWKCredential)) {
if (log.isTraceEnabled()) {
log.trace("JWT decryption requires a JWK credential, resolved credential '{}' was not",
@@ -369,16 +377,17 @@ public class JWETokenDecrypter {
private void decryptUsingKeyWrapping(@Nonnull final EncryptedJWT encryptedObject) throws DecryptionException {
log.debug("Attempting decryption of JWE using Key Wrapping managment mode");
- if (params.getKEKCredentialResolver()== null) {
+ final CredentialResolver kekResolver = params.getKEKCredentialResolver();
+ if (kekResolver == null) {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
final CriteriaSet criteria =
- buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ buildCriteria(encryptedObject, CollectionSupport.singletonList(new UsageCriterion(UsageType.ENCRYPTION)));
buildKeyManagementAlgorithmCriteria(criteria, encryptedObject);
try {
- for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
+ for (final Credential cred : kekResolver.resolve(criteria)) {
if (!(cred instanceof JWKCredential)) {
if (log.isTraceEnabled()) {
log.trace("JWT decryption requires a JWK credential, resolved credential '{}' was not",
@@ -420,19 +429,20 @@ public class JWETokenDecrypter {
*
* @throws DecryptionException if the resolved credentials could not be used to decrypt the JWT.
*/
- private void decryptUsingKeyEncryption(final EncryptedJWT encryptedObject) throws DecryptionException {
+ private void decryptUsingKeyEncryption(@Nonnull final EncryptedJWT encryptedObject) throws DecryptionException {
log.debug("Attempting decryption of JWE using Key Encryption managment mode");
- if (params.getKEKCredentialResolver()== null) {
+ final CredentialResolver kekResolver = params.getKEKCredentialResolver();
+ if (kekResolver == null) {
throw new DecryptionException("Decryption can not be attempted, KEK resolver is not available");
}
final CriteriaSet criteria =
- buildCriteria(encryptedObject, List.of(new UsageCriterion(UsageType.ENCRYPTION)));
+ buildCriteria(encryptedObject, CollectionSupport.singletonList(new UsageCriterion(UsageType.ENCRYPTION)));
buildKeyManagementAlgorithmCriteria(criteria, encryptedObject);
try {
- for (final Credential cred : params.getKEKCredentialResolver().resolve(criteria)) {
+ for (final Credential cred : kekResolver.resolve(criteria)) {
if (!(cred instanceof JWKCredential)) {
if (log.isTraceEnabled()) {
log.trace("JWT decryption requires a JWK credential, resolved credential '{}' was not",
@@ -478,7 +488,8 @@ public class JWETokenDecrypter {
throws DecryptionException {
log.debug("Attempting decryption of JWE using Direct Encryption managment mode");
- if (params.getContentEncryptionKeyCredentialResolver() == null) {
+ final CredentialResolver cekResolver = params.getContentEncryptionKeyCredentialResolver();
+ if (cekResolver == null) {
throw new DecryptionException("Decryption can not be attempted, CEK resolver is not available");
}
@@ -489,7 +500,8 @@ public class JWETokenDecrypter {
buildContentEncryptionKeyAlgorithmCriteria(criteria, encryptedObject);
try {
- for (final Credential cred : params.getContentEncryptionKeyCredentialResolver().resolve(criteria)) {
+ for (final Credential cred : cekResolver.resolve(criteria)) {
+ assert cred != null;
if (!(cred instanceof JWKCredential)) {
if (log.isTraceEnabled()) {
log.trace("JWT decryption requires a JWK credential, resolved credential '{}' was not",
@@ -529,8 +541,8 @@ public class JWETokenDecrypter {
* @throws DecryptionException if there is an algorithm mismatch.
*/
// Checkstyle: CyclomaticComplexity OFF
- private JWEAlgorithm validateKeyManagmentAlgorithm(
- @Nonnull final EncryptedJWT encryptedObject, @Nonnull final JWKCredential cred) throws DecryptionException {
+ @Nonnull private JWEAlgorithm validateKeyManagmentAlgorithm(@Nonnull final EncryptedJWT encryptedObject,
+ @Nonnull final JWKCredential cred) throws DecryptionException {
if (encryptedObject.getHeader() == null) {
throw new DecryptionException("JWE did not contain a JOSE header, is in an illegal state");
@@ -541,12 +553,13 @@ public class JWETokenDecrypter {
if (cred.getAlgorithm() != null) {
if (!headerAlg.equals(cred.getAlgorithm())) {
- throw new DecryptionException("Credential algorithm '"+cred.getAlgorithm()+"' "
+ throw new DecryptionException("Credential algorithm '" + cred.getAlgorithm() + "' "
+ "was not a match for the "
- + "algorithm '"+encryptedObject.getHeader().getAlgorithm()+"'");
+ + "algorithm '" + encryptedObject.getHeader().getAlgorithm() + "'");
}
}
+
// Now check key is of the correct type
if (JWEAlgorithm.Family.RSA.contains(headerAlg) && !(cred.getPrivateKey() instanceof RSAPrivateKey)) {
throw new DecryptionException("Credential did not contain an RSA private key");
@@ -554,9 +567,11 @@ public class JWETokenDecrypter {
if (JWEAlgorithm.Family.ECDH_ES.contains(headerAlg) && !(cred.getPrivateKey() instanceof ECPrivateKey)) {
throw new DecryptionException("Credential did not contain an EC private key");
}
- if ((JWEAlgorithm.Family.AES_GCM_KW.contains(headerAlg) || JWEAlgorithm.Family.AES_KW.contains(headerAlg))
- && (cred.getSecretKey() == null || !"AES".equals(cred.getSecretKey().getAlgorithm()))) {
- throw new DecryptionException("Credential did not contain an AES secret key");
+ if (JWEAlgorithm.Family.AES_GCM_KW.contains(headerAlg) || JWEAlgorithm.Family.AES_KW.contains(headerAlg)) {
+ final SecretKey skey = cred.getSecretKey();
+ if (skey == null || !"AES".equals(skey.getAlgorithm())) {
+ throw new DecryptionException("Credential did not contain an AES secret key");
+ }
}
if (JWEAlgorithm.DIR.equals(headerAlg) && cred.getSecretKey() == null) {
throw new DecryptionException("Credential did not contain a direct encryption secret key");
@@ -577,8 +592,8 @@ public class JWETokenDecrypter {
*
* @throws DecryptionException if there is an algorithm mismatch.
*/
- @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(
- @Nonnull final EncryptedJWT encryptedObject) throws DecryptionException {
+ @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(@Nonnull final EncryptedJWT encryptedObject)
+ throws DecryptionException {
if (encryptedObject.getHeader() == null) {
throw new DecryptionException("JWE did not contain a JOSE header, is in an illegal state");
@@ -608,22 +623,23 @@ public class JWETokenDecrypter {
@Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(
@Nonnull final EncryptedJWT encryptedObject, @Nonnull final JWKCredential cred) throws DecryptionException {
- if (cred.getSecretKey() == null) {
+ final SecretKey skey = cred.getSecretKey();
+ if (skey == null) {
throw new DecryptionException("Credential does not contain a content encryption secret key");
}
final EncryptionMethod enc = validateContentEncryptionAlgorithm(encryptedObject);
- final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(StringSupport.trimOrNull(enc.getName()));
-
+ final String encAlg = StringSupport.trimOrNull(enc.getName());
+ final String jcaKeyAlgorithm = encAlg != null ? AlgorithmSupport.getKeyAlgorithm(encAlg) : null;
if (jcaKeyAlgorithm == null) {
throw new DecryptionException("JOSE Header 'enc' algorithm is not supported by the "
+ "algorithm registry");
}
- if (!jcaKeyAlgorithm.equals(cred.getSecretKey().getAlgorithm())) {
- throw new DecryptionException("JOSE Header 'enc' algorithm "
- +jcaKeyAlgorithm+" does not match credential algorithm "+cred.getSecretKey().getAlgorithm());
+ if (!jcaKeyAlgorithm.equals(skey.getAlgorithm())) {
+ throw new DecryptionException("JOSE Header 'enc' algorithm " + jcaKeyAlgorithm +
+ " does not match credential algorithm " + skey.getAlgorithm());
}
// Otherwise, all fine.
@@ -636,7 +652,12 @@ public class JWETokenDecrypter {
* @param algorithmURI the algorithm URI to evaluate
* @throws DecryptionException if the algorithm URI does not satisfy the include/exclude policy
*/
- private void validateAlgorithmURI(@Nonnull final String algorithmURI) throws DecryptionException {
+ private void validateAlgorithmURI(@Nullable final String algorithmURI) throws DecryptionException {
+
+ if (algorithmURI == null) {
+ throw new DecryptionException("Algorithm was null, failed include/exclude validation");
+ }
+
log.debug("Validating algorithm URI against include and exclude lists: "
+ "algorithm: {}, included: {}, excluded: {}",
algorithmURI, params.getIncludedAlgorithms(), params.getExcludedAlgorithms());
@@ -648,4 +669,4 @@ public class JWETokenDecrypter {
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
index 54c1c96..97714ae 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTMessageSignatureSecurityHandler.java
@@ -18,23 +18,22 @@ import java.text.ParseException;
import java.util.function.Function;
import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
import org.opensaml.messaging.context.MessageContext;
import org.opensaml.messaging.handler.MessageHandler;
import org.opensaml.messaging.handler.MessageHandlerException;
import org.opensaml.security.trust.TrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSObject.State;
-import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A {@link MessageHandler} that uses a {@link TrustEngine} to evaluate the signature of a signed JWT.
@@ -54,10 +53,7 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
@NonnullAfterInit private Function<MessageContext, SignedJWT> jwtTokenLookupStrategy;
/** The extracted signed JWT that is to be validated.*/
- @Nullable private SignedJWT signedJwt;
-
- /** The stashed claims set belonging to the JWT.*/
- @Nullable private JWTClaimsSet claimsSet;
+ @NonnullBeforeExec private SignedJWT signedJwt;
/**
* Set the strategy used to look up a {@link SignedJWT signed JWT token}.
@@ -72,6 +68,7 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
"JwtToken lookup strategy cannot be null");
}
+ /** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -81,8 +78,9 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
}
}
+ /** {@inheritDoc} */
@Override
- protected boolean doPreInvoke(final MessageContext messageContext) throws MessageHandlerException {
+ protected boolean doPreInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
if (!super.doPreInvoke(messageContext)) {
return false;
}
@@ -93,8 +91,10 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
getLogPrefix());
throw new MessageHandlerException("Signed JWT was missing or unpopulated");
}
+
try {
- claimsSet = signedJwt.getJWTClaimsSet();
+ // Test parse of claims.
+ signedJwt.getJWTClaimsSet();
} catch (final ParseException e) {
throw new MessageHandlerException("Signed JWT did not have any claims, signature check failed");
}
@@ -103,8 +103,9 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
}
+ /** {@inheritDoc} */
@Override
- protected void doInvoke(final MessageContext messageContext) throws MessageHandlerException {
+ protected void doInvoke(@Nonnull final MessageContext messageContext) throws MessageHandlerException {
if (signedJwt.getState() != State.SIGNED && signedJwt.getState() != State.VERIFIED) {
@@ -132,4 +133,4 @@ public class JWTMessageSignatureSecurityHandler extends BaseJWTSignatureSecurity
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtil.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtil.java
index 588691c..723874d 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtil.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtil.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.Algorithm;
import com.nimbusds.jose.JOSEException;
@@ -36,6 +35,7 @@ import com.nimbusds.jose.crypto.RSASSAVerifier;
import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.credential.JWKCredential;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Generic utility class for helping JWT signature validation.
@@ -68,10 +68,9 @@ public final class JWTSignatureValidationUtil {
final Iterator<? extends Credential> it = credentials.iterator();
while (it.hasNext()) {
final Credential credential = it.next();
- if (credential instanceof JWKCredential && ((JWKCredential) credential).getAlgorithm() != null
- && !algorithm.equals(((JWKCredential) credential).getAlgorithm())) {
- log.debug("Credential alg {} not matching jwt header alg {}",
- ((JWKCredential) credential).getAlgorithm().getName(), algorithm.getName());
+ if (credential instanceof JWKCredential jwk && jwk.getAlgorithm() != null
+ && !algorithm.equals(jwk.getAlgorithm())) {
+ log.debug("Credential alg {} not matching jwt header alg {}", jwk.getAlgorithm(), algorithm.getName());
continue;
}
@@ -111,8 +110,8 @@ public final class JWTSignatureValidationUtil {
* @return A corresponding verifier, or null if no supported found.
* @throws JOSEException If the credential doesn't meet the verifier requirements.
*/
- private static JWSVerifier initializeVerifier(final Algorithm algorithm, final Credential credential)
- throws JOSEException {
+ @Nullable private static JWSVerifier initializeVerifier(@Nonnull final Algorithm algorithm,
+ @Nonnull final Credential credential) throws JOSEException {
if (JWSAlgorithm.Family.HMAC_SHA.contains(algorithm) && credential.getSecretKey() != null) {
return new MACVerifier(credential.getSecretKey());
}
@@ -125,4 +124,4 @@ public final class JWTSignatureValidationUtil {
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicEncryptionConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicEncryptionConfiguration.java
index 49ab0a8..168cbf6 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicEncryptionConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicEncryptionConfiguration.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.security.jose.impl;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -27,6 +26,7 @@ import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -51,8 +51,8 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
/** Constructor. */
public BasicEncryptionConfiguration() {
- dataEncryptionAlgorithms = Collections.emptyList();
- keyTransportEncryptionAlgorithms = Collections.emptyList();
+ dataEncryptionAlgorithms = CollectionSupport.emptyList();
+ keyTransportEncryptionAlgorithms = CollectionSupport.emptyList();
}
@Override
@@ -97,9 +97,10 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
*/
public void setDataEncryptionAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
if (algorithms == null) {
- dataEncryptionAlgorithms = Collections.emptyList();
+ dataEncryptionAlgorithms = CollectionSupport.emptyList();
} else {
- dataEncryptionAlgorithms = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+ dataEncryptionAlgorithms =
+ CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
}
}
@@ -116,9 +117,10 @@ public class BasicEncryptionConfiguration extends BasicAlgorithmPolicyConfigurat
*/
public void setKeyTransportEncryptionAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
if (algorithms == null) {
- keyTransportEncryptionAlgorithms = Collections.emptyList();
+ keyTransportEncryptionAlgorithms = CollectionSupport.emptyList();
} else {
- keyTransportEncryptionAlgorithms = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+ keyTransportEncryptionAlgorithms =
+ CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningConfiguration.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningConfiguration.java
index 33b5a50..2dfb7ae 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningConfiguration.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningConfiguration.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.security.jose.impl;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -22,13 +21,12 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.xmlsec.impl.BasicAlgorithmPolicyConfiguration;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.jose.SignatureSigningConfiguration;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -39,9 +37,6 @@ import net.shibboleth.shared.primitive.StringSupport;
public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConfiguration
implements SignatureSigningConfiguration {
- /** Class logger. */
- @Nonnull private final Logger log = LoggerFactory.getLogger(BasicSignatureSigningConfiguration.class);
-
/** Signing credentials. */
@Nonnull @NonnullElements @Unmodifiable @NotLive private List<Credential> signingCredentials;
@@ -50,8 +45,8 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
/** Constructor. */
public BasicSignatureSigningConfiguration() {
- signingCredentials = Collections.emptyList();
- signatureAlgorithms = Collections.emptyList();
+ signingCredentials = CollectionSupport.emptyList();
+ signatureAlgorithms = CollectionSupport.emptyList();
}
/** {@inheritDoc} */
@@ -67,9 +62,9 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
*/
public void setSigningCredentials(@Nullable @NonnullElements final List<Credential> credentials) {
if (credentials == null) {
- signingCredentials = Collections.emptyList();
+ signingCredentials = CollectionSupport.emptyList();
} else {
- signingCredentials = List.copyOf(credentials);
+ signingCredentials = CollectionSupport.copyToList(credentials);
}
}
@@ -86,10 +81,10 @@ public class BasicSignatureSigningConfiguration extends BasicAlgorithmPolicyConf
*/
public void setSignatureAlgorithms(@Nullable @NonnullElements final List<String> algorithms) {
if (algorithms == null) {
- signatureAlgorithms = Collections.emptyList();
+ signatureAlgorithms = CollectionSupport.emptyList();
} else {
- signatureAlgorithms = List.copyOf(StringSupport.normalizeStringCollection(algorithms));
+ signatureAlgorithms = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(algorithms));
}
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
index 8fd648d..36d3bb8 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolver.java
@@ -19,7 +19,6 @@ import java.security.interfaces.ECKey;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.RSAPrivateKey;
import java.util.ArrayList;
-import java.util.Collections;
import java.util.List;
import java.util.function.Predicate;
@@ -33,7 +32,6 @@ import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
import org.opensaml.xmlsec.impl.AlgorithmRuntimeSupportedPredicate;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
@@ -45,8 +43,10 @@ import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
import net.shibboleth.shared.resolver.ResolverException;
@@ -73,10 +73,10 @@ public class BasicSignatureSigningParametersResolver
implements SignatureSigningParametersResolver {
/** Class logger.*/
- private final Logger log = LoggerFactory.getLogger(BasicSignatureSigningParametersResolver.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicSignatureSigningParametersResolver.class);
/** The AlgorithmRegistry used when processing algorithm URIs. */
- private AlgorithmRegistry algorithmRegistry;
+ @Nullable private AlgorithmRegistry algorithmRegistry;
/** Constructor. */
public BasicSignatureSigningParametersResolver() {
@@ -89,11 +89,12 @@ public class BasicSignatureSigningParametersResolver
*
* @return the algorithm registry instance
*/
- public AlgorithmRegistry getAlgorithmRegistry() {
+ @Nonnull public AlgorithmRegistry getAlgorithmRegistry() {
// Handle case where this resolver was constructed before the library was properly initialized.
if (algorithmRegistry == null) {
- return AlgorithmSupport.getGlobalAlgorithmRegistry();
+ return AlgorithmSupport.ensureGlobalAlgorithmRegistry();
}
+ assert algorithmRegistry != null;
return algorithmRegistry;
}
@@ -107,23 +108,26 @@ public class BasicSignatureSigningParametersResolver
algorithmRegistry = Constraint.isNotNull(registry, "AlgorithmRegistry was null");
}
- @Override
- @Nonnull
- public Iterable<SignatureSigningParameters> resolve(
- @Nonnull final CriteriaSet criteria) throws ResolverException {
+ /** {@inheritDoc} */
+ @Nonnull public Iterable<SignatureSigningParameters> resolve(
+ @Nullable final CriteriaSet criteria) throws ResolverException {
final SignatureSigningParameters params = resolveSingle(criteria);
if (params != null) {
- return Collections.singletonList(params);
+ return CollectionSupport.singletonList(params);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
- @Override
- @Nullable
- public SignatureSigningParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(SignatureSigningConfigurationCriterion.class),
- "Resolver requires an instance of SignatureSigningConfigurationCriterion");
+ /** {@inheritDoc} */
+ @Nullable public SignatureSigningParameters resolveSingle(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
+
+ final SignatureSigningConfigurationCriterion signingCrit =
+ criteria != null ? criteria.get(SignatureSigningConfigurationCriterion.class) : null;
+ if (signingCrit == null) {
+ throw new ResolverException("Resolver requires an instance of SignatureSigningConfigurationCriterion");
+ }
+ assert criteria != null;
final Predicate<String> includeExcludePredicate = getIncludeExcludePredicate(criteria);
@@ -147,7 +151,8 @@ public class BasicSignatureSigningParametersResolver
if (log.isDebugEnabled()) {
log.debug("Resolved SignatureSigningParameters:");
- final Key signingKey = CredentialSupport.extractSigningKey(params.getSigningCredential());
+ final Credential signingCred = params.getSigningCredential();
+ final Key signingKey = signingCred != null ? CredentialSupport.extractSigningKey(signingCred) : null;
if (signingKey != null) {
log.debug("\tSigning credential with key algorithm: {}", signingKey.getAlgorithm());
} else {
@@ -186,8 +191,12 @@ public class BasicSignatureSigningParametersResolver
* @return include/exclude predicate instance
*/
@Nonnull protected Predicate<String> getIncludeExcludePredicate(@Nonnull final CriteriaSet criteria) {
- return resolveIncludeExcludePredicate(criteria,
- criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations());
+
+ final SignatureSigningConfigurationCriterion signingCrit =
+ criteria.get(SignatureSigningConfigurationCriterion.class);
+ // Ensured earlier...
+ assert signingCrit != null;
+ return resolveIncludeExcludePredicate(criteria, signingCrit.getConfigurations());
}
/**
@@ -201,7 +210,7 @@ public class BasicSignatureSigningParametersResolver
*/
protected void resolveAndPopulateCredentialAndSignatureAlgorithm(
@Nonnull final SignatureSigningParameters params,
- @Nonnull final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+ @Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
final List<Credential> credentials = getEffectiveSigningCredentials(criteria);
final List<String> algorithms = getEffectiveSignatureAlgorithms(criteria, includeExcludePredicate);
@@ -219,12 +228,14 @@ public class BasicSignatureSigningParametersResolver
* @param credentials the credentials to find compatibility with
* @param params the parameters to add a compatible algorithm and credential too.
*/
- protected void findCompatibleAlgorithmAndCredential(final List<String> algorithms,
- final List<Credential> credentials, @Nonnull final SignatureSigningParameters params) {
+ protected void findCompatibleAlgorithmAndCredential(@Nonnull final List<String> algorithms,
+ @Nonnull final List<Credential> credentials, @Nonnull final SignatureSigningParameters params) {
// Pick the first credential that matches one of the supported algorithms. Take algorithm priority.
for (final String algorithm : algorithms) {
+ assert algorithm != null;
for (final Credential credential : credentials) {
+ assert credential != null;
if (log.isTraceEnabled()) {
final Key key = CredentialSupport.extractSigningKey(credential);
log.trace("Evaluating signing credential '{}' of type '{}' against algorithm: {}",
@@ -312,9 +323,14 @@ public class BasicSignatureSigningParametersResolver
* @return the list of credentials
*/
@Nonnull protected List<Credential> getEffectiveSigningCredentials(@Nonnull final CriteriaSet criteria) {
+
+ final SignatureSigningConfigurationCriterion signingCrit =
+ criteria.get(SignatureSigningConfigurationCriterion.class);
+ // Ensured earlier...
+ assert signingCrit != null;
+
final ArrayList<Credential> accumulator = new ArrayList<>();
- for (final SignatureSigningConfiguration config :
- criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations()) {
+ for (final SignatureSigningConfiguration config : signingCrit.getConfigurations()) {
accumulator.addAll(config.getSigningCredentials());
@@ -332,9 +348,14 @@ public class BasicSignatureSigningParametersResolver
*/
@Nonnull protected List<String> getEffectiveSignatureAlgorithms(@Nonnull final CriteriaSet criteria,
@Nonnull final Predicate<String> includeExcludePredicate) {
+
+ final SignatureSigningConfigurationCriterion signingCrit =
+ criteria.get(SignatureSigningConfigurationCriterion.class);
+ // Ensured earlier...
+ assert signingCrit != null;
+
final ArrayList<String> accumulator = new ArrayList<>();
- for (final SignatureSigningConfiguration config :
- criteria.get(SignatureSigningConfigurationCriterion.class).getConfigurations()) {
+ for (final SignatureSigningConfiguration config : signingCrit.getConfigurations()) {
config.getSignatureAlgorithms()
.stream()
@@ -344,4 +365,4 @@ public class BasicSignatureSigningParametersResolver
return accumulator;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureValidationParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureValidationParametersResolver.java
index 8fe4009..eebc759 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureValidationParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureValidationParametersResolver.java
@@ -14,8 +14,6 @@
package net.shibboleth.oidc.security.jose.impl;
-import java.util.Collections;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -23,7 +21,6 @@ import org.opensaml.security.trust.TrustEngine;
import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
import org.opensaml.xmlsec.signature.support.SignatureTrustEngine;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.SignedJWT;
@@ -31,7 +28,8 @@ import net.shibboleth.oidc.security.jose.SignatureValidationConfiguration;
import net.shibboleth.oidc.security.jose.SignatureValidationParameters;
import net.shibboleth.oidc.security.jose.SignatureValidationParametersResolver;
import net.shibboleth.oidc.security.jose.criterion.SignatureValidationConfigurationCriterion;
-import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
import net.shibboleth.shared.resolver.ResolverException;
@@ -53,36 +51,35 @@ public class BasicSignatureValidationParametersResolver
implements SignatureValidationParametersResolver {
/** Logger. */
- @Nonnull
- private final Logger log =
- LoggerFactory.getLogger(BasicSignatureValidationParametersResolver.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(BasicSignatureValidationParametersResolver.class);
/** {@inheritDoc} */
- @Override
@Nonnull
- public Iterable<SignatureValidationParameters> resolve(@Nonnull final CriteriaSet criteria)
+ public Iterable<SignatureValidationParameters> resolve(@Nullable final CriteriaSet criteria)
throws ResolverException {
final SignatureValidationParameters params = resolveSingle(criteria);
if (params != null) {
- return Collections.singletonList(params);
+ return CollectionSupport.singletonList(params);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
/** {@inheritDoc} */
- @Override
@Nullable
public SignatureValidationParameters resolveSingle(
- @Nonnull final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(SignatureValidationConfigurationCriterion.class),
- "Resolver requires an instance of SignatureValidationConfigurationCriterion");
+ @Nullable final CriteriaSet criteria) throws ResolverException {
+
+ final SignatureValidationConfigurationCriterion validationCrit =
+ criteria != null ? criteria.get(SignatureValidationConfigurationCriterion.class) : null;
+ if (validationCrit == null) {
+ throw new ResolverException("Resolver requires an instance of SignatureValidationConfigurationCriterion");
+ }
+ assert criteria != null;
final SignatureValidationParameters params = new SignatureValidationParameters();
- resolveAndPopulateIncludesExcludes(params, criteria,
- criteria.get(SignatureValidationConfigurationCriterion.class).getConfigurations());
+ resolveAndPopulateIncludesExcludes(params, criteria, validationCrit.getConfigurations());
params.setSignatureTrustEngine(resolveSignatureTrustEngine(criteria));
@@ -114,11 +111,13 @@ public class BasicSignatureValidationParametersResolver
*
* @return the effective resolver, or null
*/
- @Nullable
- protected TrustEngine<SignedJWT> resolveSignatureTrustEngine(@Nonnull final CriteriaSet criteria) {
+ @Nullable protected TrustEngine<SignedJWT> resolveSignatureTrustEngine(@Nonnull final CriteriaSet criteria) {
+
+ final SignatureValidationConfigurationCriterion validationCrit =
+ criteria.get(SignatureValidationConfigurationCriterion.class);
+ assert validationCrit != null;
- for (final SignatureValidationConfiguration config : criteria
- .get(SignatureValidationConfigurationCriterion.class).getConfigurations()) {
+ for (final SignatureValidationConfiguration config : validationCrit.getConfigurations()) {
if (config.getSignatureTrustEngine() != null) {
return config.getSignatureTrustEngine();
}
@@ -126,4 +125,4 @@ public class BasicSignatureValidationParametersResolver
return null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java
index 07d6ce5..30b7857 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationDataEncryptionAlgorithmsLookupStrategy.java
@@ -24,13 +24,13 @@ import javax.annotation.Nullable;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -41,18 +41,17 @@ import net.shibboleth.shared.resolver.CriteriaSet;
* those supported by local configuration and the one configured for the RP. </p>
*/
public class ClientInformationDataEncryptionAlgorithmsLookupStrategy
- extends DefaultDataEncryptionAlgorithmsLookupStrategy {
+ extends DefaultDataEncryptionAlgorithmsLookupStrategy {
/** Logger. */
- @Nonnull private final Logger log =
+ @Nonnull private final Logger log =
LoggerFactory.getLogger(ClientInformationDataEncryptionAlgorithmsLookupStrategy.class);
/**
* A strategy to locate the encryption method ('enc') appropriate for the JWT to be encrypted.
* Can return {@code null} if the metadata does not contain a value (which is means no encryption should be done).
*/
- @Nonnull
- private final Function<OIDCClientInformation, String> clientEncryptionMethodLookupStrategy;
+ @Nonnull private final Function<OIDCClientInformation, String> clientEncryptionMethodLookupStrategy;
/**
* Constructor.
@@ -84,12 +83,12 @@ public class ClientInformationDataEncryptionAlgorithmsLookupStrategy
/** {@inheritDoc} */
@Override
- public List<String> apply(final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+ @Nullable public List<String> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final Predicate<String> includeExcludePredicate) {
- OIDCClientInformation metadata = null;
- if (criteria.contains(ClientInformationCriterion.class)) {
- metadata = criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
- }
+ final ClientInformationCriterion clientCrit =
+ criteria != null ? criteria.get(ClientInformationCriterion.class) : null;
+ final OIDCClientInformation metadata = clientCrit != null ? clientCrit.getOidcClientInformation() : null;
if (metadata == null) {
log.debug("No client metadata, falling back to default local behaviour");
return super.apply(criteria, includeExcludePredicate);
@@ -113,4 +112,5 @@ public class ClientInformationDataEncryptionAlgorithmsLookupStrategy
log.warn("No supported data encryption method. Client metadata and configuration are not compatible");
return Collections.emptyList();
}
+
}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java
index bdf0f32..f0ab63b 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy.java
@@ -24,13 +24,14 @@ import javax.annotation.Nullable;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -41,7 +42,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
* those supported by local configuration and the one configured for RP. </p>
*/
public class ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy
- extends DefaultKeyTransportEncryptionAlgorithmsLookupStrategy {
+ extends DefaultKeyTransportEncryptionAlgorithmsLookupStrategy {
/** Logger. */
@Nonnull private final Logger log =
@@ -83,13 +84,13 @@ public class ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy
}
/** {@inheritDoc} */
- @Override @Nonnull
- public List<String> apply(final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+ @Override
+ @Nullable public List<String> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final Predicate<String> includeExcludePredicate) {
- OIDCClientInformation metadata = null;
- if (criteria.contains(ClientInformationCriterion.class)) {
- metadata = criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
- }
+ final ClientInformationCriterion clientCrit =
+ criteria != null ? criteria.get(ClientInformationCriterion.class) : null;
+ final OIDCClientInformation metadata = clientCrit != null ? clientCrit.getOidcClientInformation() : null;
if (metadata == null) {
log.debug("No client metadata, falling back to default local behaviour");
return super.apply(criteria, includeExcludePredicate);
@@ -112,6 +113,7 @@ public class ClientInformationKeyTransportEncryptionAlgorithmsLookupStrategy
return List.of(keyTransportAlgorithm);
}
log.warn("No supported key transport algorithm. Client metadata and configuration are not compatible");
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
+
}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
index 07a07ed..6016814 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolver.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.security.jose.impl;
-import java.util.Collections;
import java.util.List;
import java.util.function.Function;
import java.util.function.Predicate;
@@ -24,7 +23,6 @@ import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
@@ -32,7 +30,9 @@ import net.shibboleth.oidc.security.credential.DefaultClientSecretCredential;
import net.shibboleth.oidc.security.jose.SignatureSigningParametersResolver;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -46,13 +46,14 @@ public class ClientInformationSignatureSigningParametersResolver
implements SignatureSigningParametersResolver {
/** Class logger.*/
- private final Logger log = LoggerFactory.getLogger(ClientInformationSignatureSigningParametersResolver.class);
+ @Nonnull private final Logger log =
+ LoggerFactory.getLogger(ClientInformationSignatureSigningParametersResolver.class);
/** A lookup function for the signature algorithm. */
- private final Function<OIDCClientInformation, String> signatureAlgorithmLookupStrategy;
+ @Nonnull private final Function<OIDCClientInformation, String> signatureAlgorithmLookupStrategy;
/** The default algorithm value used if lookup strategy returned null. */
- private final String defaultAlgorithmValue;
+ @Nullable private final String defaultAlgorithmValue;
/**
* Constructor.
@@ -64,7 +65,6 @@ public class ClientInformationSignatureSigningParametersResolver
@Nonnull @ParameterName(name="signatureAlgorithmLookupStrategy")
final Function<OIDCClientInformation, String> strategy,
@Nullable @ParameterName(name = "defaultAlgorithmValue") final String defaultValue) {
- super();
signatureAlgorithmLookupStrategy = Constraint.isNotNull(strategy, "The signature algorithm lookup strategy "
+ "can not be null");
defaultAlgorithmValue = defaultValue;
@@ -87,20 +87,23 @@ public class ClientInformationSignatureSigningParametersResolver
if (metadata == null) {
if (StringSupport.trimOrNull(defaultAlgorithmValue) != null) {
log.debug("No client information found from the criteria set, using default");
+ assert defaultAlgorithmValue != null;
return convertIntoListIfEnabled(defaultAlgorithmValue, accumulator);
}
log.error("No client information found from the criteria set");
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
final String algorithm = signatureAlgorithmLookupStrategy.apply(metadata);
if (StringSupport.trimOrNull(algorithm) == null) {
if (StringSupport.trimOrNull(defaultAlgorithmValue) != null) {
log.debug("No signature algorithm specified in the metadata, using default");
+ assert defaultAlgorithmValue != null;
return convertIntoListIfEnabled(defaultAlgorithmValue, accumulator);
}
log.error("No signature algorith or default value specified, returning empty list");
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
+ assert algorithm != null;
return convertIntoListIfEnabled(algorithm, accumulator);
}
@@ -111,8 +114,9 @@ public class ClientInformationSignatureSigningParametersResolver
* @return the client information if it existed, null otherwise
*/
@Nullable protected OIDCClientInformation getClientInformation(@Nonnull final CriteriaSet criteria) {
- if (criteria.contains(ClientInformationCriterion.class)) {
- return criteria.get(ClientInformationCriterion.class).getOidcClientInformation();
+ final ClientInformationCriterion clientCrit = criteria.get(ClientInformationCriterion.class);
+ if (clientCrit != null) {
+ return clientCrit.getOidcClientInformation();
}
return null;
}
@@ -148,10 +152,10 @@ public class ClientInformationSignatureSigningParametersResolver
@Nonnull protected List<String> convertIntoListIfEnabled(@Nonnull final String algorithm,
@Nonnull final List<String> enabledAlgorithms) {
if (enabledAlgorithms.contains(algorithm)) {
- return List.of(algorithm);
+ return CollectionSupport.listOf(algorithm);
} else {
log.warn("The algorithm {} is not enabled, returning empty list", algorithm);
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java
index 7adca79..a5cc518 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategy.java
@@ -26,6 +26,9 @@ import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import net.shibboleth.oidc.security.impl.AbstractEncryptionAlgorithmsLookupStrategy;
import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -48,9 +51,9 @@ public class DefaultDataEncryptionAlgorithmsLookupStrategy extends AbstractEncry
super(registry);
}
- @Override
- @Nonnull public List<String> apply(@Nonnull final CriteriaSet criteria,
- @Nonnull final Predicate<String> includeExcludePredicate) {
+ /** {@inheritDoc} */
+ @Nullable public List<String> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final Predicate<String> includeExcludePredicate) {
return getDataEncryptionAlgorithmsFromConfiguration(criteria, includeExcludePredicate);
}
@@ -63,19 +66,28 @@ public class DefaultDataEncryptionAlgorithmsLookupStrategy extends AbstractEncry
*
* @return the data/content encryption algorithms from the configuration, an empty list otherwise
*/
- @Nonnull protected List<String> getDataEncryptionAlgorithmsFromConfiguration(@Nonnull final CriteriaSet criteria,
- @Nonnull final Predicate<String> includeExcludePredicate){
+ @Nonnull @NotLive @Unmodifiable protected List<String> getDataEncryptionAlgorithmsFromConfiguration(
+ @Nullable final CriteriaSet criteria, @Nullable final Predicate<String> includeExcludePredicate){
+
+ final EncryptionConfigurationCriterion configCrit = criteria != null ?
+ criteria.get(EncryptionConfigurationCriterion.class) : null;
+
+ if (configCrit == null) {
+ return CollectionSupport.emptyList();
+ }
+
final ArrayList<String> accumulator = new ArrayList<>();
- for (final EncryptionConfiguration config
- : criteria.get(EncryptionConfigurationCriterion.class).getConfigurations()) {
-
+
+ for (final EncryptionConfiguration config : configCrit.getConfigurations()) {
config.getDataEncryptionAlgorithms()
.stream()
- .filter(PredicateSupport.and(getAlgorithmRuntimeSupportedPredicate(), includeExcludePredicate))
+ .filter(includeExcludePredicate != null ?
+ PredicateSupport.and(getAlgorithmRuntimeSupportedPredicate(), includeExcludePredicate) :
+ getAlgorithmRuntimeSupportedPredicate())
.forEach(accumulator::add);
}
+
return accumulator;
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDecryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDecryptionParametersResolver.java
index 0589e67..23ca3cf 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDecryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultDecryptionParametersResolver.java
@@ -14,22 +14,20 @@
package net.shibboleth.oidc.security.jose.impl;
-import java.util.Collections;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.credential.CredentialResolver;
import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.jose.DecryptionConfiguration;
import net.shibboleth.oidc.security.jose.DecryptionParameters;
import net.shibboleth.oidc.security.jose.DecryptionParametersResolver;
import net.shibboleth.oidc.security.jose.criterion.DecryptionConfigurationCriterion;
-import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
import net.shibboleth.shared.resolver.ResolverException;
@@ -50,27 +48,31 @@ public class DefaultDecryptionParametersResolver extends AbstractSecurityParamet
implements DecryptionParametersResolver {
/** Logger. */
- private final Logger log = LoggerFactory.getLogger(DefaultDecryptionParametersResolver.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(DefaultDecryptionParametersResolver.class);
- @Override
- public Iterable<DecryptionParameters> resolve(final CriteriaSet criteria) throws ResolverException {
+ /** {@inheritDoc} */
+ @Nonnull public Iterable<DecryptionParameters> resolve(@Nullable final CriteriaSet criteria)
+ throws ResolverException {
final DecryptionParameters params = resolveSingle(criteria);
if (params != null) {
- return Collections.singletonList(params);
+ return CollectionSupport.singletonList(params);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
- @Override
- public DecryptionParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(DecryptionConfigurationCriterion.class),
- "Resolver requires an instance of DecryptionConfigurationCriterion");
-
+ /** {@inheritDoc} */
+ @Nullable public DecryptionParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
+
+ final DecryptionConfigurationCriterion configCrit =
+ criteria != null ? criteria.get(DecryptionConfigurationCriterion.class) : null;
+ if (configCrit == null) {
+ throw new ResolverException("Resolver requires an instance of DecryptionConfigurationCriterion");
+ }
+ assert criteria != null;
+
final DecryptionParameters params = new DecryptionParameters();
- resolveAndPopulateIncludesExcludes(params, criteria,
- criteria.get(DecryptionConfigurationCriterion.class).getConfigurations());
+ resolveAndPopulateIncludesExcludes(params, criteria, configCrit.getConfigurations());
params.setContentEncryptionKeyCredentialResolver(resolveContentEncryptionKeyCredentialResolver(criteria));
params.setKEKCredentialResolver(resolveKEKCredentialResolver(criteria));
@@ -96,8 +98,11 @@ public class DefaultDecryptionParametersResolver extends AbstractSecurityParamet
@Nullable protected JOSEObjectCredentialResolver resolveKEKCredentialResolver(
@Nonnull final CriteriaSet criteria) {
- for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
- .getConfigurations()) {
+ final DecryptionConfigurationCriterion configCrit = criteria.get(DecryptionConfigurationCriterion.class);
+ // Checked earlier...
+ assert configCrit != null;
+
+ for (final DecryptionConfiguration config : configCrit.getConfigurations()) {
if (config.getKEKCredentialResolver() != null) {
return config.getKEKCredentialResolver();
}
@@ -115,8 +120,11 @@ public class DefaultDecryptionParametersResolver extends AbstractSecurityParamet
@Nullable protected JOSEObjectCredentialResolver resolveContentEncryptionKeyCredentialResolver(
@Nonnull final CriteriaSet criteria) {
- for (final DecryptionConfiguration config : criteria.get(DecryptionConfigurationCriterion.class)
- .getConfigurations()) {
+ final DecryptionConfigurationCriterion configCrit = criteria.get(DecryptionConfigurationCriterion.class);
+ // Checked earlier...
+ assert configCrit != null;
+
+ for (final DecryptionConfiguration config : configCrit.getConfigurations()) {
if (config.getContentEncryptionKeyCredentialResolver() != null) {
return config.getContentEncryptionKeyCredentialResolver();
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
index fb6f5ad..4d58720 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
@@ -16,7 +16,6 @@ package net.shibboleth.oidc.security.jose.impl;
import java.security.Key;
import java.util.ArrayList;
-import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.function.BiFunction;
@@ -33,13 +32,13 @@ import org.opensaml.security.credential.UsageType;
import org.opensaml.security.credential.criteria.impl.EvaluableKeyAlgorithmCredentialCriterion;
import org.opensaml.security.criteria.KeyAlgorithmCriterion;
import org.opensaml.security.criteria.UsageCriterion;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.opensaml.xmlsec.criterion.EncryptionOptionalCriterion;
import org.opensaml.xmlsec.impl.AbstractSecurityParametersResolver;
import org.opensaml.xmlsec.impl.AlgorithmRuntimeSupportedPredicate;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.google.common.base.Strings;
import com.nimbusds.jose.Algorithm;
@@ -56,7 +55,9 @@ import net.shibboleth.oidc.security.jose.EncryptionParametersResolver;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
import net.shibboleth.shared.resolver.ResolverException;
@@ -98,7 +99,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nonnull private final Logger log = LoggerFactory.getLogger(DefaultEncryptionParametersResolver.class);
/** The AlgorithmRegistry used when processing algorithm URIs. */
- @Nonnull private AlgorithmRegistry algorithmRegistry;
+ @Nullable private AlgorithmRegistry algorithmRegistry;
/**
* A lookup strategy to locate data encryption algorithms from the given criteria set and
@@ -156,8 +157,9 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nonnull public AlgorithmRegistry getAlgorithmRegistry() {
// Handle case where this resolver was ctored before the library was properly initialized.
if (algorithmRegistry == null) {
- return AlgorithmSupport.getGlobalAlgorithmRegistry();
+ return AlgorithmSupport.ensureGlobalAlgorithmRegistry();
}
+ assert algorithmRegistry != null;
return algorithmRegistry;
}
@@ -171,22 +173,25 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
algorithmRegistry = Constraint.isNotNull(registry, "AlgorithmRegistry was null");
}
- @Override
- @Nonnull public Iterable<EncryptionParameters> resolve(@Nonnull final CriteriaSet criteria)
+ /** {@inheritDoc} */
+ @Nonnull public Iterable<EncryptionParameters> resolve(@Nullable final CriteriaSet criteria)
throws ResolverException {
final EncryptionParameters params = resolveSingle(criteria);
if (params != null) {
- return Collections.singletonList(params);
+ return CollectionSupport.singletonList(params);
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
- @Override
- @Nullable public EncryptionParameters resolveSingle(@Nonnull final CriteriaSet criteria)
- throws ResolverException {
- Constraint.isNotNull(criteria, "CriteriaSet was null");
- Constraint.isNotNull(criteria.get(EncryptionConfigurationCriterion.class),
- "Resolver requires an instance of JWTEncryptionConfigurationCriterion");
+ /** {@inheritDoc} */
+ @Nullable public EncryptionParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
+
+ final EncryptionConfigurationCriterion encCrit =
+ criteria != null ? criteria.get(EncryptionConfigurationCriterion.class) : null;
+ if (encCrit == null) {
+ throw new ResolverException("Resolver requires an instance of JWTEncryptionConfigurationCriterion");
+ }
+ assert criteria != null;
final Predicate<String> includeExcludePredicate = getIncludeExcludePredicate(criteria);
@@ -216,9 +221,12 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
*/
@Nullable protected CredentialResolver resolveKEKCredentialResolver(
@Nonnull final CriteriaSet criteria) {
-
- for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
- .getConfigurations()) {
+
+ final EncryptionConfigurationCriterion encCrit = criteria.get(EncryptionConfigurationCriterion.class);
+ // Checked earlier...
+ assert encCrit != null;
+
+ for (final EncryptionConfiguration config : encCrit.getConfigurations()) {
if (config.getKEKCredentialResolver() != null) {
return config.getKEKCredentialResolver();
}
@@ -235,8 +243,11 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nullable protected CredentialResolver resolveContentEncryptionKeyCredentialResolver(
@Nonnull final CriteriaSet criteria) {
- for (final EncryptionConfiguration config : criteria.get(EncryptionConfigurationCriterion.class)
- .getConfigurations()) {
+ final EncryptionConfigurationCriterion encCrit = criteria.get(EncryptionConfigurationCriterion.class);
+ // Checked earlier...
+ assert encCrit != null;
+
+ for (final EncryptionConfiguration config : encCrit.getConfigurations()) {
if (config.getContentEncryptionKeyCredentialResolver() != null) {
return config.getContentEncryptionKeyCredentialResolver();
}
@@ -340,8 +351,11 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
* @return a include/exclude predicate instance
*/
@Nonnull protected Predicate<String> getIncludeExcludePredicate(@Nonnull final CriteriaSet criteria) {
- return resolveIncludeExcludePredicate(criteria,
- criteria.get(EncryptionConfigurationCriterion.class).getConfigurations());
+ final EncryptionConfigurationCriterion encCrit = criteria.get(EncryptionConfigurationCriterion.class);
+ // Checked earlier...
+ assert encCrit != null;
+
+ return resolveIncludeExcludePredicate(criteria, encCrit.getConfigurations());
}
/**
@@ -354,8 +368,10 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
*/
protected void resolveAndPopulateCredentialsAndAlgorithms(@Nonnull final EncryptionParameters params,
@Nonnull final CriteriaSet criteria, @Nonnull final Predicate<String> includeExcludePredicate) {
-
- if (!criteria.contains(EncryptionConfigurationCriterion.class)) {
+
+ final EncryptionConfigurationCriterion encCrit = criteria.get(EncryptionConfigurationCriterion.class);
+
+ if (encCrit == null) {
log.debug("No encryption configuration criterion, encryption parameters can not be resolved");
return;
}
@@ -374,9 +390,13 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
log.trace("Resolved effective data encryption algorithms: {}", dataEncryptionAlgorithms);
- resolveCredentialForSupportedAlgorithm(criteria,
- convertStringAlgorithmURIsToJwkAlgorithms(keyTransportAlgorithms),
- convertStringEncryptionMethodURIsToEncryptionMethods(dataEncryptionAlgorithms), params);
+ resolveCredentialForSupportedAlgorithm(
+ criteria,
+ convertStringAlgorithmURIsToJwkAlgorithms(
+ keyTransportAlgorithms != null ? keyTransportAlgorithms : CollectionSupport.emptyList()),
+ convertStringEncryptionMethodURIsToEncryptionMethods(
+ dataEncryptionAlgorithms != null ? dataEncryptionAlgorithms : CollectionSupport.emptyList()),
+ params);
}
/**
@@ -398,6 +418,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nonnull final EncryptionParameters params) {
for (final JWEAlgorithm algorithm : keyTransportAlgorithms) {
+ assert algorithm != null;
if (JWEAlgorithm.DIR.equals(algorithm)) {
// Direct content encryption
@@ -441,6 +462,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
log.debug("Looking for encryption parameters for algorithm '{}'", algorithm);
for (final EncryptionMethod method : dataEncryptionAlgorithms) {
+ assert method != null;
// Resolution must occur for each 'enc' method tested, as the derived direct encryption could be different
// for each.
@@ -451,6 +473,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
dataEncryptionCredentials.size(), algorithm.getName(), method.getName());
for (final Credential credential : dataEncryptionCredentials) {
+ assert credential != null;
if (checkCredentialSupportsAlgorithm(credential, algorithm) &&
checkCredentialSupportsEncryptionMethod(credential, method)) {
@@ -490,7 +513,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
log.debug("Looking for encryption parameters for algorithm '{}'", algorithm);
for (final EncryptionMethod method : dataEncryptionAlgorithms) {
-
+ assert method != null;
final CriteriaSet credentialCriteria = buildKeyManagmentAlgorithmCriteria(criteria, algorithm, method);
final List<Credential> keyTransportCredentials = getEffectiveKeyTransportCredentials(credentialCriteria);
@@ -498,7 +521,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
keyTransportCredentials.size(), algorithm.getName(), method.getName());
for (final Credential credential : keyTransportCredentials) {
-
+ assert credential != null;
if (checkCredentialSupportsAlgorithm(credential, algorithm)) {
if (log.isDebugEnabled()) {
log.debug("Resolved compatible key '{}' for 'alg={}' and 'enc={}'",
@@ -544,7 +567,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
keyTransportCredentials.size(), algorithm.getName());
for (final Credential credential : keyTransportCredentials) {
-
+ assert credential != null;
if (checkCredentialSupportsAlgorithm(credential, algorithm)) {
if (log.isDebugEnabled()) {
log.debug("Resolved compatible key '{}' for 'alg={}' and 'enc={}'",
@@ -572,7 +595,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
*
* @return a criteria set with algorithm specific criterion
*/
- private CriteriaSet buildKeyManagmentAlgorithmCriteria(@Nonnull final CriteriaSet existingCriteria,
+ @Nonnull private CriteriaSet buildKeyManagmentAlgorithmCriteria(@Nonnull final CriteriaSet existingCriteria,
@Nonnull final JWEAlgorithm alg, @Nonnull final EncryptionMethod enc) {
final CriteriaSet credentialCriteria = new CriteriaSet();
@@ -583,6 +606,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(alg.getName());
if (!Strings.isNullOrEmpty(jcaKeyAlgorithm)) {
+ assert jcaKeyAlgorithm != null;
credentialCriteria.add(new EvaluableKeyAlgorithmCredentialCriterion(
new KeyAlgorithmCriterion(jcaKeyAlgorithm)));
}
@@ -600,7 +624,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
*
* @return a criteria set with algorithm specific criterion
*/
- private CriteriaSet buildEncryptionKeyAlgorithmCriteria(@Nonnull final CriteriaSet existingCriteria,
+ @Nonnull private CriteriaSet buildEncryptionKeyAlgorithmCriteria(@Nonnull final CriteriaSet existingCriteria,
@Nonnull final JWEAlgorithm alg, @Nonnull final EncryptionMethod enc) {
final CriteriaSet credentialCriteria = new CriteriaSet();
@@ -611,6 +635,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
final String jcaEncAlgorithm = AlgorithmSupport.getKeyAlgorithm(enc.getName());
if (!Strings.isNullOrEmpty(jcaEncAlgorithm)) {
+ assert jcaEncAlgorithm != null;
credentialCriteria.add(new EvaluableKeyAlgorithmCredentialCriterion(
new KeyAlgorithmCriterion(jcaEncAlgorithm)));
}
@@ -671,7 +696,16 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nonnull final EncryptionMethod encMethod) {
final Key key = CredentialSupport.extractEncryptionKey(credential);
- return AlgorithmSupport.checkKeyAlgorithmAndLength(key, getAlgorithmRegistry().get(encMethod.getName()));
+ if (key == null) {
+ return false;
+ }
+
+ final AlgorithmDescriptor descriptor = getAlgorithmRegistry().get(encMethod.getName());
+ if (descriptor == null) {
+ return false;
+ }
+
+ return AlgorithmSupport.checkKeyAlgorithmAndLength(key, descriptor);
}
/**
@@ -692,6 +726,10 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
}
// Else check key type
final Key key = CredentialSupport.extractEncryptionKey(credential);
+ if (key == null) {
+ log.debug("Extracted encryption key was null");
+ return false;
+ }
if (JWEAlgorithm.Family.RSA.contains(algorithm) && key.getAlgorithm().equals("RSA")) {
return true;
@@ -714,7 +752,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nonnull protected List<Credential> getEffectiveDataEncryptionCredentials(@Nonnull final CriteriaSet criteria) {
final CredentialResolver resolver = resolveContentEncryptionKeyCredentialResolver(criteria);
if (resolver == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
try {
final List<Credential> credentialsAsList = new ArrayList<>();
@@ -723,7 +761,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
return credentialsAsList;
} catch (final ResolverException e) {
log.warn("Unable to resolve data encryption credentials", e);
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
}
@@ -738,7 +776,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
@Nonnull protected List<Credential> getEffectiveKeyTransportCredentials(@Nonnull final CriteriaSet criteria) {
final CredentialResolver resolver = resolveKEKCredentialResolver(criteria);
if (resolver == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
try {
final List<Credential> credentialsAsList = new ArrayList<>();
@@ -747,7 +785,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
return credentialsAsList;
} catch (final ResolverException e) {
log.warn("Unable to resolve data encryption credentials", e);
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
}
@@ -775,7 +813,10 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
* @return the converted algorithms
*/
@Nonnull protected List<JWEAlgorithm> convertStringAlgorithmURIsToJwkAlgorithms(@Nonnull final List<String> algos) {
- return algos.stream().filter(Objects::nonNull).map(JWEAlgorithm::parse).collect(Collectors.toList());
+ return algos.stream()
+ .filter(Objects::nonNull)
+ .map(JWEAlgorithm::parse)
+ .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
}
/**
@@ -788,7 +829,10 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
*/
@Nonnull protected List<EncryptionMethod> convertStringEncryptionMethodURIsToEncryptionMethods(
@Nonnull final List<String> encMethods) {
- return encMethods.stream().filter(Objects::nonNull).map(EncryptionMethod::parse).collect(Collectors.toList());
+ return encMethods.stream()
+ .filter(Objects::nonNull)
+ .map(EncryptionMethod::parse)
+ .collect(CollectionSupport.nonnullCollector(Collectors.toList())).get();
}
@@ -835,7 +879,12 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
return false;
}
- final boolean valid = AlgorithmSupport.checkKeyAlgorithmAndLength(key, getAlgorithmRegistry().get(algorithm));
+ final AlgorithmDescriptor descriptor = getAlgorithmRegistry().get(algorithm);
+ if (descriptor == null) {
+ return false;
+ }
+
+ final boolean valid = AlgorithmSupport.checkKeyAlgorithmAndLength(key, descriptor);
if (!valid) {
log.trace("Key '{}' does not match algorithm and key length requirement for '{}'",
CredentialConversionUtil.resolveKid(credential), algorithm);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java
index 40966da..373b6ef 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategy.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.security.jose.impl;
import java.util.ArrayList;
-import java.util.Collections;
import java.util.List;
import java.util.function.Predicate;
@@ -27,6 +26,9 @@ import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import net.shibboleth.oidc.security.impl.AbstractEncryptionAlgorithmsLookupStrategy;
import net.shibboleth.oidc.security.jose.EncryptionConfiguration;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
@@ -49,9 +51,9 @@ public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategy extends Abstr
super(registry);
}
- @Override
- @Nonnull public List<String> apply(
- final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+ /** {@inheritDoc} */
+ @Nullable public List<String> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final Predicate<String> includeExcludePredicate) {
return getKeyTransportAlgorithmsFromConfiguration(criteria, includeExcludePredicate);
}
@@ -65,21 +67,26 @@ public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategy extends Abstr
*
* @return the key transport algorithms from the configuration, an empty list otherwise
*/
- @Nonnull protected List<String> getKeyTransportAlgorithmsFromConfiguration(final CriteriaSet criteria,
- final Predicate<String> includeExcludePredicate){
- if (!criteria.contains(EncryptionConfigurationCriterion.class)) {
- return Collections.emptyList();
+ @Nonnull @NotLive @Unmodifiable protected List<String> getKeyTransportAlgorithmsFromConfiguration(
+ @Nullable final CriteriaSet criteria, @Nullable final Predicate<String> includeExcludePredicate){
+
+ final EncryptionConfigurationCriterion configCrit =
+ criteria != null ? criteria.get(EncryptionConfigurationCriterion.class) : null;
+ if (configCrit == null) {
+ return CollectionSupport.emptyList();
}
+
final ArrayList<String> accumulator = new ArrayList<>();
- for (final EncryptionConfiguration config
- : criteria.get(EncryptionConfigurationCriterion.class).getConfigurations()) {
+ for (final EncryptionConfiguration config : configCrit.getConfigurations()) {
config.getKeyTransportEncryptionAlgorithms()
.stream()
- .filter(PredicateSupport.and(getAlgorithmRuntimeSupportedPredicate(), includeExcludePredicate))
+ .filter(includeExcludePredicate != null ?
+ PredicateSupport.and(getAlgorithmRuntimeSupportedPredicate(), includeExcludePredicate) :
+ getAlgorithmRuntimeSupportedPredicate())
.forEach(accumulator::add);
}
return accumulator;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java
index 28af40e..81b1b57 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategy.java
@@ -24,13 +24,13 @@ import javax.annotation.Nullable;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -55,8 +55,7 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategy
* A strategy to locate the encryption methods ('enc') appropriate for the JWT to be encrypted.
* Can return {@code null} if the metadata does not describe its support algorithms (which is optional).
*/
- @Nonnull
- private final Function<OIDCProviderMetadata, List<String>> providerEncryptionMethodsLookupStrategy;
+ @Nonnull private final Function<OIDCProviderMetadata, List<String>> providerEncryptionMethodsLookupStrategy;
/**
* Constructor.
@@ -88,13 +87,14 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategy
+ "lookup strategy can not be null");
}
+ /** {@inheritDoc} */
@Override
- public List<String> apply(final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+ @Nullable public List<String> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final Predicate<String> includeExcludePredicate) {
- OIDCProviderMetadata metadata = null;
- if (criteria.contains(ProviderMetadataCriterion.class)) {
- metadata = criteria.get(ProviderMetadataCriterion.class).getMetadata();
- }
+ final ProviderMetadataCriterion metaCrit =
+ criteria != null ? criteria.get(ProviderMetadataCriterion.class) : null;
+ final OIDCProviderMetadata metadata = metaCrit != null ? metaCrit.getMetadata() : null;
if (metadata == null) {
log.debug("No provider metadata, falling back to default local behaviour");
return super.apply(criteria, includeExcludePredicate);
@@ -125,7 +125,5 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategy
}
return supportedAndConfiguredDataEncryptionAlgorithms;
}
-
-
-
-}
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java
index 55422a6..86c98c7 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy.java
@@ -24,13 +24,13 @@ import javax.annotation.Nullable;
import org.opensaml.xmlsec.algorithm.AlgorithmRegistry;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
/**
@@ -88,13 +88,14 @@ public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy
+ "lookup strategy can not be null");
}
+ /** {@inheritDoc} */
@Override
- public List<String> apply(final CriteriaSet criteria, final Predicate<String> includeExcludePredicate) {
+ @Nullable public List<String> apply(@Nullable final CriteriaSet criteria,
+ @Nullable final Predicate<String> includeExcludePredicate) {
- OIDCProviderMetadata metadata = null;
- if (criteria.contains(ProviderMetadataCriterion.class)) {
- metadata = criteria.get(ProviderMetadataCriterion.class).getMetadata();
- }
+ final ProviderMetadataCriterion metaCrit =
+ criteria != null ? criteria.get(ProviderMetadataCriterion.class) : null;
+ final OIDCProviderMetadata metadata = metaCrit != null ? metaCrit.getMetadata() : null;
if (metadata == null) {
log.debug("No provider metadata, falling back to default local behaviour");
return super.apply(criteria, includeExcludePredicate);
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java
index 5380fa7..7115477 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolver.java
@@ -24,10 +24,7 @@ import javax.annotation.Nonnull;
import org.opensaml.security.credential.Credential;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.nimbusds.jose.Algorithm;
-import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
import net.shibboleth.oidc.security.credential.ClientSecretCredential;
@@ -36,6 +33,7 @@ import net.shibboleth.oidc.security.jose.criterion.ClientSecretCredentialCriteri
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.Criterion;
@@ -59,8 +57,7 @@ import net.shibboleth.shared.resolver.Criterion;
public class RelyingPartySigningParametersResolver extends BasicSignatureSigningParametersResolver {
/** Logger. */
- @Nonnull
- private final Logger log = LoggerFactory.getLogger(RelyingPartySigningParametersResolver.class);
+ @Nonnull private final Logger log = LoggerFactory.getLogger(RelyingPartySigningParametersResolver.class);
/**
* A strategy to pull out the correct set of supported algorithms from the {@link OIDCProviderMetadata}.
@@ -86,7 +83,7 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
Constraint.isNotNull(strategy, "ProviderMetadataAlgorithmLookupStrategy can not be null");
}
- // Checkstyle: CyclomaticComplexity|ReturnCount OFF
+ /** {@inheritDoc} */
@Override
protected void resolveAndPopulateCredentialAndSignatureAlgorithm(
@Nonnull final SignatureSigningParameters params,
@@ -95,9 +92,9 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
final List<Credential> allCredentials = new ArrayList<>();
// Add any static credentials from the criteria
- if (criteria.contains(ClientSecretCredentialCriterion.class)) {
- final ClientSecretCredential staticCred =
- criteria.get(ClientSecretCredentialCriterion.class).getCredential();
+ final ClientSecretCredentialCriterion secretCrit = criteria.get(ClientSecretCredentialCriterion.class);
+ if (secretCrit != null) {
+ final ClientSecretCredential staticCred = secretCrit.getCredential();
log.trace("Client secret signing credential found in criterion");
// Extract a key suitable for creating and validating MACs
allCredentials.add(staticCred.toSigningCredential());
@@ -118,17 +115,6 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
}
- /**
- * Convert the algorithms represented as strings, into Nimbus {@link Algorithm}s for later comparison.
- *
- * @param algos the algorithms to convert
- *
- * @return the converted algorithms
- */
- @Nonnull private List<JWSAlgorithm> convertSupportAlgorithmsToJwkAlgorithms(@Nonnull final List<String> algos) {
- return algos.stream().map(JWSAlgorithm::parse).collect(Collectors.toList());
- }
-
/**
* Filter the set of algorithms against the set supported by the OpenID Provider.
* Always returns a new list reference. The ordering of the input algorithms should be preserved.
@@ -141,10 +127,10 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
private List<String> filterForProviderSupportedAlgorithms(
@Nonnull final CriteriaSet criteria, @Nonnull final List<String> algorithms) {
- if (criteria.contains(ProviderMetadataCriterion.class)) {
- final OIDCProviderMetadata metadata = criteria.get(ProviderMetadataCriterion.class).getMetadata();
-
- final List<String> opSupportedAlgNames = providerMetadataAlgorithmLookupStrategy.apply(metadata);
+ final ProviderMetadataCriterion pmCrit = criteria.get(ProviderMetadataCriterion.class);
+ if (pmCrit != null) {
+ final List<String> opSupportedAlgNames =
+ providerMetadataAlgorithmLookupStrategy.apply(pmCrit.getMetadata());
log.trace("Provider metadata supports the following signature algorithms '{}'",opSupportedAlgNames);
if (opSupportedAlgNames == null) {
@@ -160,4 +146,4 @@ public class RelyingPartySigningParametersResolver extends BasicSignatureSigning
}
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
index 021d6fe..fc522a7 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AccessTokenHashValidator.java
@@ -20,7 +20,6 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -34,6 +33,7 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
/**
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
index 38c20d4..b73ad64 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AudienceClaimsValidator.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
-import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.Set;
@@ -32,6 +31,7 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
@@ -62,7 +62,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
/** Constructor. */
public AudienceClaimsValidator() {
- additionalAudiencesLookupStrategy = (prc, claims) -> Collections.emptySet();
+ additionalAudiencesLookupStrategy = (prc, claims) -> CollectionSupport.emptySet();
extraAudienceValidation = false;
}
@@ -148,7 +148,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
if (acceptedAudience == null) {
throw new JWTValidationException("Audience value not returned by lookup function");
}
- return Set.of(acceptedAudience);
+ return CollectionSupport.setOf(acceptedAudience);
}
/** {@inheritDoc} */
@@ -160,7 +160,7 @@ public class AudienceClaimsValidator extends AbstractClaimsValidator{
Set<String> additionalAudiences = additionalAudiencesLookupStrategy.apply(context, claims);
if (additionalAudiences == null) {
- additionalAudiences = Collections.emptySet();
+ additionalAudiences = CollectionSupport.emptySet();
}
final List<String> audList = claims.getAudience();
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationCondition.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationCondition.java
index 44f4e90..b4e5fc2 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationCondition.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthTimeRequestedActivationCondition.java
@@ -18,10 +18,10 @@ import java.util.function.BiPredicate;
import java.util.function.Function;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.openid.connect.sdk.OIDCClaimsRequest;
@@ -32,6 +32,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.annotation.ParameterName;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Has the auth_time claim been requested?
@@ -61,7 +62,7 @@ public final class AuthTimeRequestedActivationCondition implements BiPredicate<P
}
@Override
- public boolean test(@Nonnull final ProfileRequestContext prc, @Nonnull final JWTClaimsSet claims) {
+ public boolean test(@Nullable final ProfileRequestContext prc, @Nullable final JWTClaimsSet claims) {
final OIDCAuthenticationRequest authRequest = authenticationRequestLookupStrategy.apply(prc);
@@ -91,7 +92,7 @@ public final class AuthTimeRequestedActivationCondition implements BiPredicate<P
}
if (authTime.getClaimRequirement() == ClaimRequirement.VOLUNTARY) {
// Is voluntary, so check if it exists in the returned claims. If it does, make sure to check it.
- return claims.getClaim("auth_time") != null;
+ return claims != null && claims.getClaim("auth_time") != null;
}
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationAudienceClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationAudienceClaimsValidator.java
index f83d702..25d4b53 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationAudienceClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationAudienceClaimsValidator.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
-import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
@@ -31,6 +30,7 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.profile.context.navigate.IssuerLookupFunction;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.StringSupport;
@@ -62,7 +62,7 @@ public class AuthenticationAudienceClaimsValidator extends AudienceClaimsValidat
public AuthenticationAudienceClaimsValidator() {
super();
responderIdLookupStrategy = new IssuerLookupFunction();
- endpointTargets = Collections.emptyList();
+ endpointTargets = CollectionSupport.emptyList();
endpointReplacement = null;
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java
index d78e843..0c75fa3 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/AuthenticationTimeClaimsValidator.java
@@ -26,9 +26,7 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import com.google.common.base.Predicates;
import com.nimbusds.jwt.JWTClaimsSet;
import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
@@ -36,6 +34,8 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.logic.FunctionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Verifies the auth_time (when the End-User authentication took place):
@@ -84,7 +84,7 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
authnLifetimeLookupStrategy = prc -> Duration.ofSeconds(60);
clockSkew = Duration.ofSeconds(60);
authnRequestTimeLookupStrategy = prc -> Instant.now().minus(clockSkew);
- requested = Predicates.alwaysTrue();
+ requested = PredicateSupport.alwaysTrue();
}
/**
@@ -105,8 +105,7 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
*
* @since 2.2.0
*/
- public void setAuthnRequestTimeLookupStrategy(
- final Function<ProfileRequestContext, Instant> strategy) {
+ public void setAuthnRequestTimeLookupStrategy(@Nonnull final Function<ProfileRequestContext, Instant> strategy) {
ifInitializedThrowUnmodifiabledComponentException();
ifDestroyedThrowDestroyedComponentException();
@@ -122,7 +121,7 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
* @param isRequested has auth_time been requested.
*/
@Deprecated(forRemoval = true, since = "2.2.0")
- public void setRequested(final Predicate<ProfileRequestContext> isRequested) {
+ public void setRequested(@Nonnull final Predicate<ProfileRequestContext> isRequested) {
ifInitializedThrowUnmodifiabledComponentException();
requested = isRequested;
@@ -182,14 +181,6 @@ public class AuthenticationTimeClaimsValidator extends AbstractClaimsValidator {
if (authnLifetime.equals(Duration.ofSeconds(0))) {
// Now assume forced authentication semantics, the authentication must have happened after the
// authentication request was made to the OP
- if (authnRequestTimeLookupStrategy == null) {
- log.warn("Maximum authentication age of 0 seconds requested, but no "
- + "authentication request time lookup strategy set, can not check for a fresh "
- + "authentication");
- throw new JWTValidationException("Maximum authentication age of 0 seconds requested, but no "
- + "authentication request time lookup strategy set, can not check for a fresh "
- + "authentication");
- }
final Instant authnRequestTime = authnRequestTimeLookupStrategy.apply(context);
if (authnRequestTime == null) {
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidator.java
index 58f1835..a2c4caa 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ChainingJWTClaimsValidator.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
-import java.util.Collections;
import java.util.List;
import javax.annotation.Nonnull;
@@ -23,7 +22,6 @@ import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -32,8 +30,10 @@ import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A {@link ClaimsValidator} implementation that validates a JWT claims set from a chain
@@ -62,7 +62,8 @@ public class ChainingJWTClaimsValidator extends AbstractIdentifiableInitializabl
public ChainingJWTClaimsValidator() {
requireAll = true;
}
-
+
+ /** {@inheritDoc} */
@Override
protected void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -94,13 +95,13 @@ public class ChainingJWTClaimsValidator extends AbstractIdentifiableInitializabl
ifInitializedThrowUnmodifiabledComponentException();
if (validators != null) {
- claimValidators = List.copyOf(validators);
+ claimValidators = CollectionSupport.copyToList(validators);
} else {
- claimValidators = Collections.emptyList();
+ claimValidators = CollectionSupport.emptyList();
}
}
- @Override
+ /** {@inheritDoc} */
public void validate(@Nullable final JWTClaimsSet claims, @Nonnull final ProfileRequestContext context)
throws JWTValidationException {
@@ -136,7 +137,7 @@ public class ChainingJWTClaimsValidator extends AbstractIdentifiableInitializabl
if (!requireAll) {
log.debug("{}: JWT claims validation for subject '{}' failed, all validators failed", getId(),
claims.getSubject());
- throw failure;
+ throw failure != null ? failure : new JWTValidationException("Unspecified validation failure");
}
log.debug("{}: JWT claims validation for subject '{}' succeeded", getId(), claims.getSubject());
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ClaimExistsActivationCondition.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ClaimExistsActivationCondition.java
index 79b3ceb..6e76c13 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ClaimExistsActivationCondition.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ClaimExistsActivationCondition.java
@@ -17,6 +17,7 @@ package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.function.BiPredicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -46,8 +47,8 @@ public class ClaimExistsActivationCondition implements BiPredicate<ProfileReques
}
@Override
- public boolean test(@Nonnull final ProfileRequestContext context, @Nonnull final JWTClaimsSet claims) {
- return claims.getClaim(claimToCheck) != null;
+ public boolean test(@Nullable final ProfileRequestContext context, @Nullable final JWTClaimsSet claims) {
+ return claims != null && claims.getClaim(claimToCheck) != null;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java
index 3dba796..91a33fd 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ExactMatchClaimsValidator.java
@@ -20,7 +20,6 @@ import javax.annotation.Nonnull;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
import com.nimbusds.jwt.JWTClaimsSet;
@@ -31,6 +30,7 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* Validator that checks a JWT claim exactly matches (by Object equality) a value returned by a lookup strategy.
@@ -88,6 +88,7 @@ public class ExactMatchClaimsValidator extends AbstractClaimsValidator{
}
}
+ /** {@inheritDoc} */
@Override
protected void doValidate(@Nonnull final JWTClaimsSet claims, @Nonnull final ProfileRequestContext context)
throws JWTValidationException {
@@ -107,4 +108,4 @@ public class ExactMatchClaimsValidator extends AbstractClaimsValidator{
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ForcedAuthenticationActivationCondition.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ForcedAuthenticationActivationCondition.java
index 9c87fc9..47470ea 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ForcedAuthenticationActivationCondition.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ForcedAuthenticationActivationCondition.java
@@ -16,7 +16,7 @@ package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.function.BiPredicate;
-import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -32,10 +32,10 @@ import net.shibboleth.idp.authn.context.AuthenticationContext;
*/
public final class ForcedAuthenticationActivationCondition implements BiPredicate<ProfileRequestContext, JWTClaimsSet> {
- @Override
- public boolean test(@Nonnull final ProfileRequestContext prc, @Nonnull final JWTClaimsSet claims) {
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext prc, @Nullable final JWTClaimsSet claims) {
- final AuthenticationContext authnContext = prc.getSubcontext(AuthenticationContext.class);
+ final AuthenticationContext authnContext = prc != null ? prc.getSubcontext(AuthenticationContext.class) : null;
if (authnContext == null) {
return true;
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NonceValidationActivationCondition.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NonceValidationActivationCondition.java
index a016cc8..3a178f4 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NonceValidationActivationCondition.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NonceValidationActivationCondition.java
@@ -16,7 +16,7 @@ package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.function.BiPredicate;
-import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -29,13 +29,12 @@ import com.nimbusds.jwt.JWTClaimsSet;
public class NonceValidationActivationCondition implements BiPredicate<ProfileRequestContext, JWTClaimsSet>{
/** {@inheritDoc} */
- @Override
- public boolean test(@Nonnull final ProfileRequestContext context, @Nonnull final JWTClaimsSet claims) {
+ public boolean test(@Nullable final ProfileRequestContext context, @Nullable final JWTClaimsSet claims) {
- if (claims.getClaim(IDTokenClaims.NONCE.getClaimName()) != null) {
+ if (claims != null && claims.getClaim(IDTokenClaims.NONCE.getClaimName()) != null) {
return true;
}
return false;
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java
index 962c0b9..a8bb565 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/NumberOfClaimValuesActivationCondition.java
@@ -19,6 +19,7 @@ import java.util.function.BiPredicate;
import java.util.function.IntPredicate;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import org.opensaml.profile.context.ProfileRequestContext;
@@ -60,12 +61,13 @@ public class NumberOfClaimValuesActivationCondition implements BiPredicate<Profi
numberOfValuesPredicate = Constraint.isNotNull(predicate, "Has Size Predicate can not be null");
}
- @Override
- public boolean test(@Nonnull final ProfileRequestContext context, @Nonnull final JWTClaimsSet claims) {
+ /** {@inheritDoc} */
+ public boolean test(@Nullable final ProfileRequestContext context, @Nullable final JWTClaimsSet claims) {
- if (claims.getClaim(claimToCheck) == null) {
+ if (claims == null || claims.getClaim(claimToCheck) == null) {
return numberOfValuesPredicate.test(0);
}
+
final Object claimAsObject = claims.getClaim(claimToCheck);
final List<?> claimAsList;
@@ -81,4 +83,4 @@ public class NumberOfClaimValuesActivationCondition implements BiPredicate<Profi
}
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ProhibitedClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ProhibitedClaimsValidator.java
index a601290..73b81b1 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ProhibitedClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/ProhibitedClaimsValidator.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
@@ -30,6 +29,7 @@ import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -43,7 +43,7 @@ public class ProhibitedClaimsValidator extends AbstractClaimsValidator {
/** Constructor.*/
public ProhibitedClaimsValidator() {
- prohibitedClaims = Collections.emptySet();
+ prohibitedClaims = CollectionSupport.emptySet();
}
/**
@@ -55,9 +55,9 @@ public class ProhibitedClaimsValidator extends AbstractClaimsValidator {
ifInitializedThrowUnmodifiabledComponentException();
if (claims !=null) {
- prohibitedClaims = Set.copyOf(StringSupport.normalizeStringCollection(claims));
+ prohibitedClaims = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(claims));
} else {
- prohibitedClaims = Collections.emptySet();
+ prohibitedClaims = CollectionSupport.emptySet();
}
}
@@ -78,4 +78,4 @@ public class ProhibitedClaimsValidator extends AbstractClaimsValidator {
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
index 82b7a92..673b4af 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequestedEssentialACRClaimsLookupStrategy.java
@@ -14,7 +14,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
-import java.util.Collections;
import java.util.List;
import java.util.function.BiFunction;
import java.util.function.Function;
@@ -31,6 +30,7 @@ import com.nimbusds.openid.connect.sdk.claims.ClaimsSetRequest.Entry;
import net.shibboleth.oidc.profile.core.OIDCAuthenticationRequest;
import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.Constraint;
/**
@@ -64,7 +64,7 @@ public class RequestedEssentialACRClaimsLookupStrategy
final OIDCAuthenticationRequest authRequest = authenticationRequestLookupStrategy.apply(prc);
if (authRequest == null) {
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
@@ -73,19 +73,19 @@ public class RequestedEssentialACRClaimsLookupStrategy
final ClaimsSetRequest idTokenRequested = requestedClaims.getIDTokenClaimsRequest();
if (idTokenRequested == null) {
// Nothing requested
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
final Entry acrs = idTokenRequested.get("acr");
if (acrs != null && acrs.getClaimRequirement() == ClaimRequirement.ESSENTIAL) {
if (acrs.getValueAsString() != null) {
- return List.of(acrs.getValueAsString());
+ return CollectionSupport.listOf(acrs.getValueAsString());
} else if (acrs.getValuesAsListOfStrings() != null){
- return Collections.unmodifiableList(acrs.getValuesAsListOfStrings());
+ return CollectionSupport.copyToList(acrs.getValuesAsListOfStrings());
}
// Else we do not know what they are
}
}
- return Collections.emptyList();
+ return CollectionSupport.emptyList();
}
}
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequiredClaimsValidator.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequiredClaimsValidator.java
index 83e871c..b181a9f 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequiredClaimsValidator.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jwt/claims/impl/RequiredClaimsValidator.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.security.jwt.claims.impl;
import java.util.Collection;
-import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
@@ -30,6 +29,7 @@ import net.shibboleth.oidc.jwt.claims.AbstractClaimsValidator;
import net.shibboleth.oidc.jwt.claims.JWTValidationException;
import net.shibboleth.shared.annotation.constraint.NonnullElements;
import net.shibboleth.shared.annotation.constraint.ThreadSafeAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.primitive.StringSupport;
/**
@@ -43,7 +43,7 @@ public class RequiredClaimsValidator extends AbstractClaimsValidator{
/** Constructor.*/
public RequiredClaimsValidator() {
- requiredClaims = Collections.emptySet();
+ requiredClaims = CollectionSupport.emptySet();
}
/**
@@ -55,9 +55,9 @@ public class RequiredClaimsValidator extends AbstractClaimsValidator{
ifInitializedThrowUnmodifiabledComponentException();
if (claims !=null) {
- requiredClaims = Set.copyOf(StringSupport.normalizeStringCollection(claims));
+ requiredClaims = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(claims));
} else {
- requiredClaims = Collections.emptySet();
+ requiredClaims = CollectionSupport.emptySet();
}
}
@@ -74,5 +74,4 @@ public class RequiredClaimsValidator extends AbstractClaimsValidator{
}
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java
index d0eca61..0bc6a51 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/BaseMetadataCredentialResolverTest.java
@@ -57,7 +57,10 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Base unit test for the credential resolvers fetching the credentials from metadata.
+ *
+ * @param <T> credential type
*/
+ at SuppressWarnings("javadoc")
public abstract class BaseMetadataCredentialResolverTest<T extends BasicJOSEObjectCredentialResolver> {
/** A remote JWKSet.*/
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
index 18ce0ef..23e6880 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
@@ -20,6 +20,8 @@ import static org.testng.Assert.assertNotNull;
import java.util.ArrayList;
import java.util.List;
+import javax.annotation.Nonnull;
+
import org.mockito.Mockito;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.UsageType;
@@ -41,15 +43,16 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Unit tests for {@link ClientInformationCredentialResolver}.
*/
+ at SuppressWarnings("javadoc")
public class ClientInformationCredentialResolverTest extends BaseMetadataCredentialResolverTest<ClientInformationCredentialResolver> {
- private static final ClassPathResource CLIENT_INFORMATION_REMOTE_KEYS =
+ @Nonnull private static final ClassPathResource CLIENT_INFORMATION_REMOTE_KEYS =
new ClassPathResource("/metadata/test-resolver-client-information-remote-jwks.json");
- private static final ClassPathResource CLIENT_INFORMATION_INLINE_KEYS =
+ @Nonnull private static final ClassPathResource CLIENT_INFORMATION_INLINE_KEYS =
new ClassPathResource("/metadata/test-resolver-client-information-inline-jwks.json");
- private static final ClassPathResource CLIENT_INFORMATION_SECRET =
+ @Nonnull private static final ClassPathResource CLIENT_INFORMATION_SECRET =
new ClassPathResource("/metadata/test-resolver-client-information-secret.json");
@Override
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
index fe8534b..724c7aa 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientSecretCriterionCredentialResolverTest.java
@@ -10,6 +10,7 @@ import java.time.Instant;
import java.util.Date;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
@@ -43,9 +44,10 @@ import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/** Tests for {@link ClientSecretCriterionCredentialResolver}. */
+ at SuppressWarnings("javadoc")
public class ClientSecretCriterionCredentialResolverTest {
- private static final String CLIENT_SECRET = "aPdSgVkXp2s5v8y/B?E(H+MbQeThWmZq";
+ @Nonnull private static final String CLIENT_SECRET = "aPdSgVkXp2s5v8y/B?E(H+MbQeThWmZq";
/** Resolver to test. */
private ClientSecretCriterionCredentialResolver resolver;
@@ -63,9 +65,10 @@ public class ClientSecretCriterionCredentialResolverTest {
assertTrue(resolvedCredentials.iterator().hasNext());
final Credential cred = resolvedCredentials.iterator().next();
assertNotNull(cred);
- assertNotNull(cred.getSecretKey());
- assertEquals(cred.getSecretKey().getAlgorithm(), "NONE");
- assertEquals(cred.getSecretKey().getEncoded().length, 32);
+ final SecretKey skey = cred.getSecretKey();
+ assert skey != null;
+ assertEquals(skey.getAlgorithm(), "NONE");
+ assertEquals(skey.getEncoded().length, 32);
assertEquals(cred.getUsageType(), UsageType.SIGNING);
}
@@ -123,9 +126,10 @@ public class ClientSecretCriterionCredentialResolverTest {
assertTrue(resolvedCredentials.iterator().hasNext());
final Credential cred = resolvedCredentials.iterator().next();
assertNotNull(cred);
- assertNotNull(cred.getSecretKey());
- assertEquals(cred.getSecretKey().getAlgorithm(), "AES");
- assertEquals(cred.getSecretKey().getEncoded().length, 16);
+ final SecretKey skey = cred.getSecretKey();
+ assert skey != null;
+ assertEquals(skey.getAlgorithm(), "AES");
+ assertEquals(skey.getEncoded().length, 16);
assertEquals(cred.getUsageType(), UsageType.ENCRYPTION);
}
@@ -155,9 +159,10 @@ public class ClientSecretCriterionCredentialResolverTest {
assertTrue(resolvedCredentials.iterator().hasNext());
final Credential cred = resolvedCredentials.iterator().next();
assertNotNull(cred);
- assertNotNull(cred.getSecretKey());
- assertEquals(cred.getSecretKey().getAlgorithm(), "AES");
- assertEquals(cred.getSecretKey().getEncoded().length, 16);
+ final SecretKey skey = cred.getSecretKey();
+ assert skey != null;
+ assertEquals(skey.getAlgorithm(), "AES");
+ assertEquals(skey.getEncoded().length, 16);
assertEquals(cred.getUsageType(), UsageType.ENCRYPTION);
jweObject.encrypt(new AESEncrypter(cred.getSecretKey()));
@@ -210,9 +215,10 @@ public class ClientSecretCriterionCredentialResolverTest {
assertTrue(resolvedCredentials.iterator().hasNext());
final Credential cred = resolvedCredentials.iterator().next();
assertNotNull(cred);
- assertNotNull(cred.getSecretKey());
- assertEquals(cred.getSecretKey().getEncoded().length, 32);
- assertEquals(cred.getSecretKey().getAlgorithm(), "AES");
+ final SecretKey skey = cred.getSecretKey();
+ assert skey != null;
+ assertEquals(skey.getEncoded().length, 32);
+ assertEquals(skey.getAlgorithm(), "AES");
assertEquals(cred.getUsageType(), UsageType.ENCRYPTION);
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolverTest.java
index e819bb7..9e70423 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/CollectionJOSEObjectCredentialResolverTest.java
@@ -7,10 +7,10 @@ import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.ArrayList;
import java.util.Collection;
-import java.util.Collections;
import java.util.List;
import java.util.stream.StreamSupport;
+import javax.annotation.Nonnull;
import javax.crypto.SecretKey;
import org.opensaml.security.credential.Credential;
@@ -18,17 +18,17 @@ import org.opensaml.security.credential.CredentialContextSet;
import org.opensaml.security.credential.UsageType;
import org.testng.annotations.Test;
-import net.shibboleth.shared.logic.ConstraintViolationException;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/** Tests for the CollectionJOSEObjectCredentialResolver.*/
+ at SuppressWarnings("javadoc")
public class CollectionJOSEObjectCredentialResolverTest {
/** The resolver to test.*/
private CollectionJOSEObjectCredentialResolver resolver;
-
@Test
public void testCredentialsAreAdded() throws ResolverException {
@@ -68,61 +68,45 @@ public class CollectionJOSEObjectCredentialResolverTest {
@Test
public void testNoCredentials_EmptyList() throws ResolverException {
- resolver = new CollectionJOSEObjectCredentialResolver(Collections.emptyList());
+ resolver = new CollectionJOSEObjectCredentialResolver(CollectionSupport.emptyList());
final var resolved = resolver.resolve(new CriteriaSet());
final var count = StreamSupport.stream(resolved.spliterator(), false).count();
assertEquals(count, 0);
- }
-
- @Test(expectedExceptions = ConstraintViolationException.class)
- public void testNullCredentials() throws ResolverException {
-
- final List<Credential> creds = null;
- resolver = new CollectionJOSEObjectCredentialResolver(creds);
- }
-
+ }
/** A no-op mock credential.*/
private static class MockCredential implements Credential {
- @Override
public String getEntityId() {
return null;
}
- @Override
public UsageType getUsageType() {
return null;
}
- @Override
- public Collection<String> getKeyNames() {
- return null;
+ @Nonnull public Collection<String> getKeyNames() {
+ return CollectionSupport.emptyList();
}
- @Override
public PublicKey getPublicKey() {
return null;
}
- @Override
public PrivateKey getPrivateKey() {
return null;
}
- @Override
public SecretKey getSecretKey() {
return null;
}
- @Override
public CredentialContextSet getCredentialContextSet() {
return null;
}
- @Override
- public Class<? extends Credential> getCredentialType() {
- return null;
+ @Nonnull public Class<? extends Credential> getCredentialType() {
+ return MockCredential.class;
}
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterionTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterionTest.java
index 1ea99d0..8cd75ee 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterionTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/EvaluableMACKeyLengthCredentialCriterionTest.java
@@ -8,6 +8,7 @@ import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.Collection;
+import javax.annotation.Nonnull;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
@@ -19,8 +20,10 @@ import org.testng.annotations.Test;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.util.StandardCharset;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.logic.ConstraintViolationException;
+ at SuppressWarnings("javadoc")
public class EvaluableMACKeyLengthCredentialCriterionTest {
/** A 256 bit client_secret.*/
@@ -64,46 +67,38 @@ public class EvaluableMACKeyLengthCredentialCriterionTest {
secret = sec;
}
- @Override
public String getEntityId() {
return null;
}
- @Override
public UsageType getUsageType() {
return null;
}
- @Override
- public Collection<String> getKeyNames() {
- return null;
+ @Nonnull public Collection<String> getKeyNames() {
+ return CollectionSupport.emptyList();
}
- @Override
public PublicKey getPublicKey() {
return null;
}
- @Override
public PrivateKey getPrivateKey() {
return null;
}
- @Override
public SecretKey getSecretKey() {
return new SecretKeySpec(secret.getBytes(StandardCharset.UTF_8), "NONE");
}
- @Override
public CredentialContextSet getCredentialContextSet() {
return null;
}
- @Override
- public Class<? extends Credential> getCredentialType() {
- return null;
+ @Nonnull public Class<? extends Credential> getCredentialType() {
+ return MockCredential.class;
}
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
index a92c173..1ec93dc 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/LocalJOSEObjectCredentialResolverTest.java
@@ -11,6 +11,9 @@ import java.util.List;
import java.util.stream.Collectors;
import java.util.stream.StreamSupport;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.AbstractCriteriaFilteringCredentialResolver;
import org.testng.Assert;
@@ -39,6 +42,7 @@ import com.nimbusds.jwt.SignedJWT;
import net.shibboleth.oidc.security.credential.BasicJWKCredential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.jose.criterion.JOSEObjectCriterion;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -53,6 +57,11 @@ public class LocalJOSEObjectCredentialResolverTest {
private RSAKey localRSAKey;
+ /**
+ * Test set up.
+ *
+ * @throws Exception
+ */
@BeforeMethod
public void setup() throws Exception {
@@ -88,8 +97,12 @@ public class LocalJOSEObjectCredentialResolverTest {
.build();
}
- /* Resolve a credential using the public key found in the JOSEHeaders. The public component of
- * the JWK in the header is different than the one resolved locally.*/
+ /**
+ * Resolve a credential using the public key found in the JOSEHeaders. The public component of
+ * the JWK in the header is different than the one resolved locally.
+ *
+ * @throws Exception
+ */
@Test
public void testSuccessful_PublicKeyInJOSEHeaderMatchesLocal() throws Exception {
@@ -106,13 +119,17 @@ public class LocalJOSEObjectCredentialResolverTest {
final CriteriaSet criteria = new CriteriaSet(new JOSEObjectCriterion(jwe));
final Credential resolvedCredential = resolver.resolveSingle(criteria);
- assertNotNull(resolvedCredential);
+ assert resolvedCredential != null;
assertNotNull(resolvedCredential.getPrivateKey());
assertTrue(resolvedCredential.getKeyNames().contains("mock-key"));
}
- /* Resolve a credential using the public key found in the JOSEHeaders. The public component of
- * the JWK in the header is different than the one resolved locally.*/
+ /**
+ * Resolve a credential using the public key found in the JOSEHeaders. The public component of
+ * the JWK in the header is different than the one resolved locally.
+ *
+ * @throws Exception
+ */
@Test
public void testUnsuccessful_PublicKeyInJOSEHeaderDoesNotMatchLocal() throws Exception {
final RSAKey keyInJoseHeader = new RSAKeyGenerator(2048)
@@ -137,7 +154,11 @@ public class LocalJOSEObjectCredentialResolverTest {
assertNull(resolvedCredential);
}
- /* Just 'kid' no 'jwk'.*/
+ /**
+ * Just 'kid' no 'jwk'.
+ *
+ * @throws Exception
+ */
@Test
public void testSuccessful_KeyIDInJOSEHeader() throws Exception {
final JWEObject jweObject =
@@ -159,7 +180,11 @@ public class LocalJOSEObjectCredentialResolverTest {
assertTrue(resolvedCredential.get(0).getKeyNames().contains("mock-key"));
}
- /* There is no KID to use for filtering, but a credential should be returned anyway. */
+ /**
+ * There is no KID to use for filtering, but a credential should be returned anyway.
+ *
+ * @throws Exception
+ */
@Test
public void testSuccessful_NoKeyIDInJOSEHeader() throws Exception {
final JWEObject jweObject =
@@ -182,7 +207,11 @@ public class LocalJOSEObjectCredentialResolverTest {
assertTrue(resolvedCredential.get(0).getKeyNames().contains("mock-key"));
}
- /* Just 'kid' no 'jwk'.*/
+ /**
+ * Just 'kid' no 'jwk'.
+ *
+ * @throws Exception
+ */
@Test
public void testUnSuccessful_KeyIDInJOSEHeaderDifferentThanLocalCred() throws Exception {
final JWEObject jweObject =
@@ -202,7 +231,11 @@ public class LocalJOSEObjectCredentialResolverTest {
//TODO test kid in header different than JWK should match? (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4)
- /* There is a 'kid' in the header and a 'jwk', the 'kid' matches the key. Resolve the key once.*/
+ /**
+ * There is a 'kid' in the header and a 'jwk', the 'kid' matches the key. Resolve the key once.
+ *
+ * @throws Exception
+ */
@Test
public void testSuccessful_KeyIDInJOSEHeader_And_JWK() throws Exception {
final JWEObject jweObject =
@@ -225,7 +258,11 @@ public class LocalJOSEObjectCredentialResolverTest {
assertTrue(resolvedCredential.get(0).getKeyNames().contains("mock-key"));
}
- /* There is a 'kid' in the header and 'jwk', and the 'kid' is different than the kid of the 'jwk'.*/
+ /**
+ * There is a 'kid' in the header and 'jwk', and the 'kid' is different than the kid of the 'jwk'.
+ *
+ * @throws Exception
+ */
@Test
public void testUnsuccessful_KeyIDInJOSEHeader_And_JWK_KidDoesNotMatch() throws Exception {
final JWEObject jweObject =
@@ -246,7 +283,7 @@ public class LocalJOSEObjectCredentialResolverTest {
assertEquals(resolvedCredential.size(),0);
}
- /** Mock RSA credential resolver that is filterable.*/
+ /** Mock RSA credential resolver that is filterable. */
private static class MockRSACriteriaFilteringCredentialResolver extends AbstractCriteriaFilteringCredentialResolver
implements JOSEObjectCredentialResolver {
@@ -256,8 +293,8 @@ public class LocalJOSEObjectCredentialResolverTest {
key = theKey;
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.RSA_OAEP_256);
jwkCredential.getKeyNames().add("mock-key");
@@ -269,9 +306,9 @@ public class LocalJOSEObjectCredentialResolverTest {
Assert.fail();
}
- return List.of(jwkCredential);
+ return CollectionSupport.listOf(jwkCredential);
}
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
index 48339b7..749c7de 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ProviderMetadataCredentialResolverTest.java
@@ -35,6 +35,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
/**
* Unit tests for {@link ProviderMetadataCredentialResolver}.
*/
+ at SuppressWarnings("javadoc")
public class ProviderMetadataCredentialResolverTest extends BaseMetadataCredentialResolverTest<ProviderMetadataCredentialResolver> {
/**
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java
index d0309e0..a6a4b62 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/CheckClientJWTDecryptionConfigurationTest.java
@@ -36,6 +36,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
/**
* Unit tests for {@link CheckClientJWTDecryptionConfiguration}.
*/
+ at SuppressWarnings("javadoc")
public class CheckClientJWTDecryptionConfigurationTest {
protected CheckClientJWTDecryptionConfiguration action;
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngineTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngineTest.java
index 1e7dfc5..5382b80 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngineTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ClientInformationJWTTrustEngineTest.java
@@ -19,9 +19,11 @@ import static org.testng.Assert.assertTrue;
import static org.testng.Assert.fail;
import java.security.KeyException;
-import java.util.List;
import java.util.function.Function;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialResolver;
@@ -45,12 +47,14 @@ import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/**
* Tests for the {@link ClientInformationJWTTrustEngine}.
*/
+ at SuppressWarnings("javadoc")
public class ClientInformationJWTTrustEngineTest {
private ClientInformationJWTTrustEngine engine;
@@ -75,8 +79,7 @@ public class ClientInformationJWTTrustEngineTest {
final CredentialResolver credResolver = new CredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(key.getAlgorithm());
jwkCredential.setKid(key.getKeyID());
@@ -88,9 +91,9 @@ public class ClientInformationJWTTrustEngineTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
};
@@ -103,8 +106,7 @@ public class ClientInformationJWTTrustEngineTest {
public void setupSymmetric(final String defaultAlgValue, Function<OIDCClientInformation, String> sigAlgLookup) {
final CredentialResolver credResolver = new CredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
try {
return TestCredentialHelper
.createClientSecretCredential(CLIENT_SECRET).toSigningCredential();
@@ -114,9 +116,9 @@ public class ClientInformationJWTTrustEngineTest {
}
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
};
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java
index d10469f..8f07521 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/EncryptJWTHandlerTest.java
@@ -62,6 +62,7 @@ import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
*
* <p>Note, These tests encrypt a RequestObject. </p>
*/
+ at SuppressWarnings("javadoc")
public class EncryptJWTHandlerTest extends AbstractHandlerTest {
/** A client_secret to use.*/
@@ -81,11 +82,13 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
encrypter.setPayloadToEncryptLookupStrategy(mc -> {
final OIDCAuthenticationRequest authnRequest = (OIDCAuthenticationRequest)mc.getMessage();
- if (authnRequest.getRequestObject() instanceof SignedJWT) {
+ if (authnRequest != null && authnRequest.getRequestObject() instanceof SignedJWT) {
return new Payload((SignedJWT) authnRequest.getRequestObject());
- } else if (authnRequest.getRequestObject() instanceof PlainJWT) {
+ } else if (authnRequest != null && authnRequest.getRequestObject() instanceof PlainJWT) {
try {
- return new Payload(authnRequest.getRequestObject().getJWTClaimsSet().getClaims());
+ final JWT obj = authnRequest.getRequestObject();
+ assert obj != null;
+ return new Payload(obj.getJWTClaimsSet().getClaims());
} catch (final ParseException e) {
fail();
}
@@ -94,6 +97,7 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
});
encrypter.setJwtUpdateConsumer((jwt, mc) -> {
final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
+ assert ar != null;
ar.setRequestObject(jwt);
});
@@ -105,7 +109,7 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
.build();
request.setRequestObject(new PlainJWT(claims));
- prc.getOutboundMessageContext().setMessage(request);
+ prc.ensureOutboundMessageContext().setMessage(request);
}
private void assertStandardClaimsExist(final EncryptedJWT jwt) {
@@ -133,11 +137,12 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
+ assert jwt != null;
assertTrue(JWEAlgorithm.Family.RSA.contains(jwt.getHeader().getAlgorithm()));
assertTrue(jwt instanceof EncryptedJWT);
@@ -167,11 +172,12 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
+ assert jwt != null;
assertTrue(JWEAlgorithm.Family.ECDH_ES.contains(jwt.getHeader().getAlgorithm()));
assertTrue(jwt instanceof EncryptedJWT);
@@ -197,11 +203,12 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
+ assert jwt != null;
assertTrue(JWEAlgorithm.DIR.equals(jwt.getHeader().getAlgorithm()));
assertTrue(jwt instanceof EncryptedJWT);
@@ -228,11 +235,12 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
+ assert jwt != null;
assertTrue(JWEAlgorithm.A256KW.equals(jwt.getHeader().getAlgorithm()));
assertTrue(jwt instanceof EncryptedJWT);
@@ -258,10 +266,10 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
}
@@ -269,7 +277,7 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
@Test
public void testFail_NoEncryptionContext() throws Exception {
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof PlainJWT);
@@ -279,10 +287,10 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
@Test
public void testFail_NoEncryptionParams() throws Exception {
final SecurityParametersContext secParamCtx = new SecurityParametersContext();
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof PlainJWT);
@@ -307,10 +315,10 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyAgreementCredential(key));
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof PlainJWT);
@@ -331,10 +339,10 @@ public class EncryptJWTHandlerTest extends AbstractHandlerTest {
params.setKeyTransportEncryptionCredential(TestCredentialHelper.createKeyEncryptionCredential(key));
secParamCtx.setEncryptionParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
encrypter.initialize();
- encrypter.invoke(prc.getOutboundMessageContext());
+ encrypter.invoke(prc.ensureOutboundMessageContext());
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
index 31c225f..100b1f7 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
@@ -24,6 +24,7 @@ import java.security.KeyException;
import java.text.ParseException;
import java.util.List;
+import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.opensaml.security.SecurityException;
@@ -54,6 +55,7 @@ import net.shibboleth.oidc.security.credential.impl.BasicJOSEObjectCredentialRes
import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
import net.shibboleth.oidc.security.jose.SignatureValidationParameters;
import net.shibboleth.oidc.security.jose.criterion.SignatureValidationParametersCriterion;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -67,6 +69,7 @@ import net.shibboleth.shared.resolver.ResolverException;
* <p>We can not test a JWT with an in-line symmetric key (oct type) JWK as Nimbus will not (correctly)
* parse it. Hence we assume the trust engine could never be passed such an invalid JWT.</p>
*/
+ at SuppressWarnings("javadoc")
public class ExplicitKeySignedJWTTrustEngineTest {
private ExplicitKeySignedJWTTrustEngine engine;
@@ -77,7 +80,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
private JOSEObjectCredentialResolver joseObjectCredResolver;
- private final String CVE_2016_10555_SIGNING_CERT_PUBLIC_KEY =
+ @Nonnull private final String CVE_2016_10555_SIGNING_CERT_PUBLIC_KEY =
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtJSHqzkdHPY62Mvn80Wc\n"
+ "vriYxHhh6N/x6mK0hd+J/awNqZm8se6LG0Pv35Xx1aftefLGnlgPho49Jf82NMT/\n"
+ "MczlsHQesAFwotPr1rbqyvmNrbQTqxrAzoN2b5Cpu9ZPcFznOdtUWv+g+M/Xoqdp\n"
@@ -90,7 +93,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
* This is a forged JWT that contains a 'secret' inside the JWK header. This should
* never happen, but we want to test that we can not create a SignedJWT from it.
*/
- private final String JWT_WITH_INLINE_SHARED_SECRET_JWK =
+ @Nonnull private final String JWT_WITH_INLINE_SHARED_SECRET_JWK =
"eyJraWQiOiIxMjMiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImp3ayI6eyJrdHkiO"
+ "iJvY3QiLCJraWQiOiIxMjMiLCJrIjoiV0hBeWN6VjJPSGt2UWo5RktFZ3JUV0pSWlZSb"
+ "1YyMVpjVE4wTm5jNWVpUSIsImFsZyI6IkhTMjU2In19.eyJpc3MiOiJodHRwczpcL1wv"
@@ -183,8 +186,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
credResolver = new MockAbstractFunctionalCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
try {
return TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET).toSigningCredential();
} catch (final KeyException e) {
@@ -193,9 +195,10 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
- return List.of(resolveSingle(criteriaSet));
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
};
@@ -220,8 +223,7 @@ public class ExplicitKeySignedJWTTrustEngineTest {
credResolver = new MockAbstractFunctionalCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
try {
return TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET).toSigningCredential();
} catch (final KeyException e) {
@@ -230,9 +232,10 @@ public class ExplicitKeySignedJWTTrustEngineTest {
}
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
- return List.of(resolveSingle(criteriaSet));
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
};
@@ -565,7 +568,5 @@ public class ExplicitKeySignedJWTTrustEngineTest {
signedJWT.sign(new ECDSASigner(signingKey.toECPrivateKey()));
return signedJWT;
}
-
-
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
index dc96ed9..3ffaca7 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWETokenDecrypterTest.java
@@ -16,6 +16,9 @@ import java.util.ArrayList;
import java.util.Date;
import java.util.List;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
import org.opensaml.core.config.InitializationException;
import org.opensaml.security.credential.BasicCredential;
import org.opensaml.security.credential.Credential;
@@ -62,10 +65,12 @@ import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
import net.shibboleth.oidc.security.credential.JWKCredential;
import net.shibboleth.oidc.security.impl.support.TestCredentialHelper;
import net.shibboleth.oidc.security.jose.DecryptionParameters;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/** Tests for the {@link JWETokenDecrypter}.*/
+ at SuppressWarnings("javadoc")
public class JWETokenDecrypterTest {
private JWETokenDecrypter decrypter;
@@ -139,8 +144,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
try {
return TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
.toEncryptionCredential(JWEAlgorithm.A256KW, EncryptionMethod.A256GCM);
@@ -150,9 +154,9 @@ public class JWETokenDecrypterTest {
}
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -202,8 +206,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
try {
final KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
generator.initialize(2048);
@@ -215,9 +218,9 @@ public class JWETokenDecrypterTest {
}
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -245,8 +248,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
try {
return TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
.toEncryptionCredential(JWEAlgorithm.DIR, EncryptionMethod.A256GCM);
@@ -256,9 +258,9 @@ public class JWETokenDecrypterTest {
}
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -288,8 +290,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicExpiringJWKCredential jwkCredential = new BasicExpiringJWKCredential();
jwkCredential.getKeyNames().add("mock-key");
jwkCredential.setKid("mock-key");
@@ -297,9 +298,9 @@ public class JWETokenDecrypterTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -347,8 +348,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.DIR);
jwkCredential.getKeyNames().add("mock-key");
@@ -362,9 +362,9 @@ public class JWETokenDecrypterTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
@@ -395,8 +395,7 @@ public class JWETokenDecrypterTest {
// Wrong credential type used here
params.setContentEncryptionKeyCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.A128KW);
jwkCredential.getKeyNames().add("mock-key");
@@ -410,9 +409,9 @@ public class JWETokenDecrypterTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
try {
@@ -439,8 +438,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.A128KW);
jwkCredential.getKeyNames().add("mock-key");
@@ -454,9 +452,9 @@ public class JWETokenDecrypterTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -487,8 +485,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.RSA_OAEP_256);
jwkCredential.getKeyNames().add(key.getKeyID());
@@ -503,9 +500,9 @@ public class JWETokenDecrypterTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -631,8 +628,7 @@ public class JWETokenDecrypterTest {
final var params = new DecryptionParameters();
params.setKEKCredentialResolver(new JOSEObjectCredentialResolver() {
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException {
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.ECDH_ES_A256KW);
jwkCredential.getKeyNames().add(key.getKeyID());
@@ -647,9 +643,9 @@ public class JWETokenDecrypterTest {
return jwkCredential;
}
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
});
decrypter = new JWETokenDecrypter(params);
@@ -694,8 +690,8 @@ public class JWETokenDecrypterTest {
key = theKey;
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.RSA_OAEP_256);
jwkCredential.getKeyNames().add(key.getKeyID());
@@ -707,7 +703,7 @@ public class JWETokenDecrypterTest {
fail();
}
- return List.of(jwkCredential);
+ return CollectionSupport.listOf(jwkCredential);
}
}
@@ -722,8 +718,8 @@ public class JWETokenDecrypterTest {
keys = theKey;
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
final List<Credential> creds = new ArrayList<>();
for (final RSAKey key : keys) {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
@@ -758,14 +754,14 @@ public class JWETokenDecrypterTest {
enc = encryption;
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
try {
- return List.of(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
+ return CollectionSupport.listOf(TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET)
.toEncryptionCredential(alg, enc));
} catch (KeyException | JOSEException e) {
fail();
- return null;
+ throw new ResolverException(e);
}
}
@@ -780,8 +776,8 @@ public class JWETokenDecrypterTest {
key = theKey;
}
- @Override
- protected Iterable<Credential> resolveFromSource(final CriteriaSet criteriaSet) throws ResolverException {
+ @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+ throws ResolverException {
final BasicJWKCredential jwkCredential = new BasicJWKCredential();
jwkCredential.setAlgorithm(JWEAlgorithm.ECDH_ES_A256KW);
jwkCredential.getKeyNames().add(key.getKeyID());
@@ -793,7 +789,7 @@ public class JWETokenDecrypterTest {
fail();
}
- return List.of(jwkCredential);
+ return CollectionSupport.listOf(jwkCredential);
}
}
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWSTokenSignerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWSTokenSignerTest.java
index f557d5a..d2001ac 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWSTokenSignerTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWSTokenSignerTest.java
@@ -42,6 +42,7 @@ import net.shibboleth.oidc.security.jose.SignatureSigningParameters;
/**
* Tests for the {@link JWSTokenSigner}
*/
+ at SuppressWarnings("javadoc")
public class JWSTokenSignerTest {
/** A client_secret to use.*/
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtilTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtilTest.java
index a687f68..55cc134 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtilTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/JWTSignatureValidationUtilTest.java
@@ -48,6 +48,7 @@ import net.shibboleth.oidc.security.credential.BasicJWKCredential;
/**
* Unit tests for {@link JWTSignatureValidationUtil}.
*/
+ at SuppressWarnings("javadoc")
public class JWTSignatureValidationUtilTest {
final String invalidJwtEventId = "invalid_jwt";
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockEmptyListCredentialResolver.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockEmptyListCredentialResolver.java
index fdad84e..aa1fa08 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockEmptyListCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockEmptyListCredentialResolver.java
@@ -1,11 +1,13 @@
package net.shibboleth.oidc.security.impl;
-import java.util.Collections;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialResolver;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -15,13 +17,13 @@ import net.shibboleth.shared.resolver.ResolverException;
*/
public class MockEmptyListCredentialResolver implements CredentialResolver {
- @Override
- public Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return Collections.emptyList();
+ /** {@inheritDoc} */
+ @Nonnull public Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ return CollectionSupport.emptyList();
}
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException{
+ /** {@inheritDoc} */
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException{
return null;
};
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockFunctionalCredentialResolver.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockFunctionalCredentialResolver.java
index eaced04..53d0acb 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockFunctionalCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/MockFunctionalCredentialResolver.java
@@ -1,11 +1,13 @@
package net.shibboleth.oidc.security.impl;
-import java.util.List;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import org.opensaml.security.credential.Credential;
import net.shibboleth.oidc.security.credential.JOSEObjectCredentialResolver;
+import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
@@ -13,12 +15,11 @@ import net.shibboleth.shared.resolver.ResolverException;
@FunctionalInterface
public interface MockFunctionalCredentialResolver extends JOSEObjectCredentialResolver {
- @Override
- public default Iterable<Credential> resolve(final CriteriaSet criteria) throws ResolverException {
- return List.of(resolveSingle(criteria));
+ @Nonnull public default Iterable<Credential> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+ final Credential cred = resolveSingle(criteria);
+ return cred != null ? CollectionSupport.singletonList(cred) : CollectionSupport.emptyList();
}
- @Override
- public Credential resolveSingle(final CriteriaSet criteria) throws ResolverException;
+ @Nullable public Credential resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException;
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java
index 82c35a1..4366e93 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest.java
@@ -15,7 +15,6 @@
package net.shibboleth.oidc.security.impl;
import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.fail;
import java.io.InputStreamReader;
@@ -34,7 +33,6 @@ import org.springframework.util.FileCopyUtils;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.google.common.base.Predicates;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -48,8 +46,10 @@ import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriter
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration;
import net.shibboleth.oidc.security.jose.impl.ProviderMetadataDataEncryptionAlgorithmsLookupStrategy;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest {
private ProviderMetadataDataEncryptionAlgorithmsLookupStrategy strategy;
@@ -111,8 +111,8 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest {
@Test
public void testSuccess_AllConfiguredAlgsAreSupported() {
- final List<String> encAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(encAlgs);
+ final List<String> encAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert encAlgs != null;
assertEquals(encAlgs.size(), 4);
}
@@ -126,8 +126,8 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest {
//This one is not supported by the OP.
EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM));
- final List<String> encAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(encAlgs);
+ final List<String> encAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert encAlgs != null;
assertEquals(encAlgs.size(), 4);
}
@@ -136,15 +136,15 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest {
public void testSuccess_SomeAlgsExluded() {
final List<String> encAlgs = strategy.apply(
criteria, alg -> !EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256.equals(alg));
- assertNotNull(encAlgs);
+ assert encAlgs != null;
assertEquals(encAlgs.size(), 3);
}
@Test
public void testSuccess_NoSupportedAlgs() {
config.setDataEncryptionAlgorithms(Collections.emptyList());
- final List<String> encAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(encAlgs);
+ final List<String> encAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert encAlgs != null;
assertEquals(encAlgs.size(), 0);
}
@@ -156,9 +156,9 @@ public class ProviderMetadataDataEncryptionAlgorithmsLookupStrategyTest {
new ProviderMetadataDataEncryptionAlgorithmsLookupStrategy(
meta -> null, algorithmRegistry);
- final List<String> encAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(encAlgs);
+ final List<String> encAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert encAlgs != null;
assertEquals(encAlgs.size(), 4);
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
index 3c71fd5..14cb296 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
@@ -15,13 +15,11 @@
package net.shibboleth.oidc.security.impl;
import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.fail;
import java.io.InputStreamReader;
import java.io.Reader;
import java.nio.charset.StandardCharsets;
-import java.util.Collections;
import java.util.List;
import java.util.stream.Collectors;
@@ -34,7 +32,6 @@ import org.springframework.util.FileCopyUtils;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
-import com.google.common.base.Predicates;
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.oauth2.sdk.ParseException;
import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
@@ -48,8 +45,11 @@ import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriter
import net.shibboleth.oidc.security.jose.criterion.ProviderMetadataCriterion;
import net.shibboleth.oidc.security.jose.impl.BasicEncryptionConfiguration;
import net.shibboleth.oidc.security.jose.impl.ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.PredicateSupport;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest {
private ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy strategy;
@@ -110,8 +110,8 @@ public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest
@Test
public void testSuccess_AllConfiguredAlgsAreSupported() {
- final List<String> algs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(algs);
+ final List<String> algs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert algs != null;
assertEquals(algs.size(), 4);
}
@@ -125,8 +125,8 @@ public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest
//This one is not supported by the OP
KeyManagementConstants.ALGO_ID_ALG_RSA_1_5));
- final List<String> keyAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(keyAlgs);
+ final List<String> keyAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert keyAlgs != null;
assertEquals(keyAlgs.size(), 4);
}
@@ -135,15 +135,15 @@ public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest
public void testSuccess_SomeAlgsEcluded() {
final List<String> keyAlgs = strategy.apply(
criteria, alg -> !KeyManagementConstants.ALGO_ID_ALG_AES_128_KW.equals(alg));
- assertNotNull(keyAlgs);
+ assert keyAlgs != null;
assertEquals(keyAlgs.size(), 3);
}
@Test
public void testSuccess_NoSupportedAlgs() {
- config.setKeyTransportEncryptionAlgorithms(Collections.emptyList());
- final List<String> keyAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(keyAlgs);
+ config.setKeyTransportEncryptionAlgorithms(CollectionSupport.emptyList());
+ final List<String> keyAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert keyAlgs != null;
assertEquals(keyAlgs.size(), 0);
}
@@ -155,9 +155,9 @@ public class ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategyTest
new ProviderMetadataKeyTransportEncryptionAlgorithmsLookupStrategy(
meta -> null, algorithmRegistry);
- final List<String> keyAlgs = strategy.apply(criteria, Predicates.alwaysTrue());
- assertNotNull(keyAlgs);
+ final List<String> keyAlgs = strategy.apply(criteria, PredicateSupport.alwaysTrue());
+ assert keyAlgs != null;
assertEquals(keyAlgs.size(), 4);
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
index 2e06f55..1d410ee 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/SignJWTHandlerTest.java
@@ -49,6 +49,7 @@ import net.shibboleth.oidc.security.jose.context.SecurityParametersContext;
*
* <p>Note, These tests sign a RequestObject. </p>
*/
+ at SuppressWarnings("javadoc")
public class SignJWTHandlerTest extends AbstractHandlerTest {
/** A client_secret to use.*/
@@ -70,7 +71,10 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
signer.setClaimsToSignLookupStrategy(mc -> {
final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
try {
- return ar.getRequestObject().getJWTClaimsSet();
+ assert ar != null;
+ final JWT obj = ar.getRequestObject();
+ assert obj != null;
+ return obj.getJWTClaimsSet();
} catch (final ParseException e) {
fail();
}
@@ -78,6 +82,7 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
});
signer.setJwtUpdateConsumer((jwt, mc) -> {
final OIDCAuthenticationRequest ar = (OIDCAuthenticationRequest)mc.getMessage();
+ assert ar != null;
ar.setRequestObject(jwt);
});
@@ -89,7 +94,7 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
.build();
request.setRequestObject(new PlainJWT(claims));
- prc.getOutboundMessageContext().setMessage(request);
+ prc.ensureOutboundMessageContext().setMessage(request);
}
@Test
@@ -101,13 +106,14 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET).toSigningCredential());
params.setSignatureAlgorithm("HS256");
secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
+ signer.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof SignedJWT);
final var signedJWT = (SignedJWT)jwt;
+ assert signedJWT != null;
assertTrue(JWSAlgorithm.Family.HMAC_SHA.contains(signedJWT.getHeader().getAlgorithm()));
}
@@ -120,10 +126,10 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
TestCredentialHelper.createClientSecretCredential(CLIENT_SECRET).toSigningCredential());
params.setSignatureAlgorithm("RS256");
secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
+ signer.invoke(prc.ensureOutboundMessageContext());
}
@@ -139,13 +145,14 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(rsaKey));
params.setSignatureAlgorithm("RS256");
secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
+ signer.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof SignedJWT);
final var signedJWT = (SignedJWT)jwt;
+ assert signedJWT != null;
assertTrue(JWSAlgorithm.Family.RSA.contains(signedJWT.getHeader().getAlgorithm()));
}
@@ -161,13 +168,14 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(ecKey));
params.setSignatureAlgorithm("ES256");
secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
+ signer.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof SignedJWT);
final var signedJWT = (SignedJWT)jwt;
+ assert signedJWT != null;
assertTrue(JWSAlgorithm.Family.EC.contains(signedJWT.getHeader().getAlgorithm()));
}
@@ -183,14 +191,15 @@ public class SignJWTHandlerTest extends AbstractHandlerTest {
params.setSigningCredential(TestCredentialHelper.createAsymmetricSigningCredential(rsaKey));
params.setSignatureAlgorithm("PS256");
secParamCtx.setSignatureSigningParameters(params);
- prc.getOutboundMessageContext().addSubcontext(secParamCtx);
+ prc.ensureOutboundMessageContext().addSubcontext(secParamCtx);
signer.initialize();
- signer.invoke(prc.getOutboundMessageContext());
+ signer.invoke(prc.ensureOutboundMessageContext());
final JWT jwt = request.getRequestObject();
assertTrue(jwt instanceof SignedJWT);
final var signedJWT = (SignedJWT)jwt;
+ assert signedJWT != null;
assertTrue(JWSAlgorithm.Family.RSA.contains(signedJWT.getHeader().getAlgorithm()));
}
-}
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java
index 847f14a..9772823 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/BasicSignatureSigningParametersResolverTest.java
@@ -35,6 +35,7 @@ import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfiguration
import net.shibboleth.shared.resolver.CriteriaSet;
/** Tests for the {@link BasicSignatureSigningParametersResolver}.*/
+ at SuppressWarnings("javadoc")
public class BasicSignatureSigningParametersResolverTest {
/** The resolver to test.*/
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
index 3bef0b8..5145488 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/ClientInformationSignatureSigningParametersResolverTest.java
@@ -45,6 +45,7 @@ import net.shibboleth.oidc.security.jose.criterion.ClientInformationCriterion;
import net.shibboleth.oidc.security.jose.criterion.SignatureSigningConfigurationCriterion;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class ClientInformationSignatureSigningParametersResolverTest {
private static final ClassPathResource CLIENT_INFORMATION_SECRET =
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java
index 91aad62..b3e7993 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultDataEncryptionAlgorithmsLookupStrategyTest.java
@@ -33,6 +33,7 @@ import net.shibboleth.oidc.jwa.support.EncryptionConstants;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class DefaultDataEncryptionAlgorithmsLookupStrategyTest {
private DefaultDataEncryptionAlgorithmsLookupStrategy strategy;
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
index f259265..9a0cd51 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
@@ -57,6 +57,7 @@ import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriter
import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
+ at SuppressWarnings("javadoc")
public class DefaultEncryptionParametersResolverTest {
/** The mock symmetric key e.g. for keywrap.*/
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
index d8e8dff..6172eba 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest.java
@@ -33,6 +33,7 @@ import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
import net.shibboleth.oidc.security.jose.criterion.EncryptionConfigurationCriterion;
import net.shibboleth.shared.resolver.CriteriaSet;
+ at SuppressWarnings("javadoc")
public class DefaultKeyTransportEncryptionAlgorithmsLookupStrategyTest {
private DefaultKeyTransportEncryptionAlgorithmsLookupStrategy strategy;
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolverTest.java
index 1d356e0..8cb213b 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/RelyingPartySigningParametersResolverTest.java
@@ -62,6 +62,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
import net.shibboleth.shared.resolver.ResolverException;
/** Tests for RelyingPartyProxySigningParametersResolver.*/
+ at SuppressWarnings("javadoc")
public class RelyingPartySigningParametersResolverTest {
/** A 256 bit client_secret.*/
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list