}
}
}
private void assertHttps(AssertionInfoMap aim, Collection<AssertionInfo> ais, Message message) {
for (AssertionInfo ai : ais) {
HttpsToken token = (HttpsToken)ai.getAssertion();
String scheme = (String)message.get("http.scheme");
ai.setAsserted(true);
Map<String, List<String>> headers = getSetProtocolHeaders(message);
if ("https".equals(scheme)) {
if (token.getAuthenticationType()
== HttpsToken.AuthenticationType.RequireClientCertificate) {
final MessageTrustDecider orig = message.get(MessageTrustDecider.class);
MessageTrustDecider trust = new MessageTrustDecider() {
public void establishTrust(String conduitName,
URLConnectionInfo connectionInfo,
Message message)
throws UntrustedURLConnectionIOException {
if (orig != null) {
orig.establishTrust(conduitName, connectionInfo, message);
}
HttpsURLConnectionInfo info = (HttpsURLConnectionInfo)connectionInfo;
if (info.getLocalCertificates() == null
|| info.getLocalCertificates().length == 0) {
throw new UntrustedURLConnectionIOException(
"RequireClientCertificate is set, "
+ "but no local certificates were negotiated. Is"
+ " the server set to ask for client authorization?");
}
}
};
message.put(MessageTrustDecider.class, trust);
NegotiationUtils.assertPolicy(aim, SPConstants.REQUIRE_CLIENT_CERTIFICATE);
}
if (token.getAuthenticationType() == HttpsToken.AuthenticationType.HttpBasicAuthentication) {
List<String> auth = headers.get("Authorization");
if (auth == null || auth.size() == 0
|| !auth.get(0).startsWith("Basic")) {
ai.setNotAsserted("HttpBasicAuthentication is set, but not being used");
} else {
NegotiationUtils.assertPolicy(aim, SPConstants.HTTP_BASIC_AUTHENTICATION);
}
}
if (token.getAuthenticationType() == HttpsToken.AuthenticationType.HttpDigestAuthentication) {
List<String> auth = headers.get("Authorization");
if (auth == null || auth.size() == 0
|| !auth.get(0).startsWith("Digest")) {
ai.setNotAsserted("HttpDigestAuthentication is set, but not being used");
} else {