[java-shib-attribute] branch main updated: OSJ-391: Default supported TLS protocols appears too broad

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-shib-attribute.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-attribute.git;a=commit;h=2ee26715dce2485db129af54d48f1b70dcc59fbf

The following commit(s) were added to refs/heads/main by this push:
     new 2ee26715d OSJ-391: Default supported TLS protocols appears too broad
2ee26715d is described below

commit 2ee26715dce2485db129af54d48f1b70dcc59fbf
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Fri Feb 9 16:19:44 2024 -0500

    OSJ-391: Default supported TLS protocols appears too broad
    
    Add asserts in test against HttpClientSecurityParameters instance that
    is wired by parser on HTTP data connector.
---
 .../dc/http/impl/HTTPDataConnectorParserTest.java       | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/shib-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParserTest.java b/shib-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParserTest.java
index a9831f1e5..3ce3b7406 100644
--- a/shib-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParserTest.java
+++ b/shib-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParserTest.java
@@ -22,15 +22,19 @@ import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
 
 import javax.annotation.Nonnull;
 
+import org.opensaml.security.httpclient.HttpClientSecurityParameters;
 import org.springframework.context.support.GenericApplicationContext;
 import org.springframework.core.env.PropertySource;
 import org.springframework.core.io.ResourceLoader;
 import org.springframework.mock.env.MockPropertySource;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.testng.Assert;
 import org.testng.annotations.AfterMethod;
 import org.testng.annotations.Test;
 
@@ -117,6 +121,19 @@ public class HTTPDataConnectorParserTest {
                         "net/shibboleth/idp/attribute/resolver/spring/dc/http/http-attribute-resolver-v2-goodprotocols-ref.xml");
         assertNotNull(connector);
         
+        //Test the merged security params instance
+        assert connector != null;
+        final HttpClientSecurityParameters securityParams = (HttpClientSecurityParameters) ReflectionTestUtils.getField(connector, "httpClientSecurityParameters");
+        assert securityParams != null;
+        Assert.assertNotNull(securityParams);
+        Assert.assertNotNull(securityParams.getTLSTrustEngine());
+        final List<String> protocols = securityParams.getTLSProtocols();
+        assert protocols != null;
+        Assert.assertNotNull(securityParams.getTLSProtocols());
+        Assert.assertEquals(protocols.size(), 2);
+        Assert.assertTrue(protocols.contains("TLSv1.3"));
+        Assert.assertTrue(protocols.contains("TLSv1.2"));
+        
         final AttributeResolutionContext context =
                 TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
                         TestSources.SP_ENTITY_ID);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.