{
log.trace("resolveAuthSegment - segment='" + segment + "'");
ArrayList selectedServices = new ArrayList();
XRDS xrdsOut = processAuthRefs(selectedServices, parent, segment, trustType, followRefs, state);
if (maxRequests >= 0 && state.getNumRequests() >= maxRequests) {
XRD finalXRD = xrdsOut.getFinalXRD();
if (finalXRD == null) {
finalXRD = createErrorXRD(segment.toURINormalForm(true), Status.LIMIT_EXCEEDED, "Maximum of authority resolution requests exceeded");
xrdsOut.add(finalXRD);
}
else {
finalXRD.setStatus(new Status(Status.LIMIT_EXCEEDED, "Maximum of authority resolution requests exceeded"));
}
throw new PartialResolutionException(xrdsOut);
}
///// Try each URI in each selected service in turn
Exception savedException = null;
Iterator srvIterator = selectedServices.iterator();
while (srvIterator.hasNext()) {
Service srv = (Service)srvIterator.next();
Iterator uriIterator = srv.getPrioritizedURIs().iterator();
///// try each selected service URI in turn (skip only if nothing was read)
while (uriIterator.hasNext()) {
SEPUri sepURI = (SEPUri)uriIterator.next();
URI uri = sepURI.getURI();
log.trace("resolveAuthSegment - trying URI='" + uri + "'");
// skip non-HTTPS URIs if HTTPS was requested
if (trustType.isHTTPS() && !uri.getScheme().equals(HTTPS)) {
log.trace("resolveAuthSegment - skipping non HTTPS URI");
continue;
}
URI newURI;
try
{
newURI = constructAuthResURI(uri.toString(), segment.toURINormalForm(true));
log.trace("resolveAuthSegment - newURI = " + newURI);
}
catch (java.net.URISyntaxException oEx)
{
// oops! invalid authority URI
savedException = new InvalidAuthorityURIException(
"Could not create URI to access based on " + uri +
". Trying to resolve " + segment, oEx);
continue; // try next URI
}
XRDS newXRDS = null;
// now that we've constructed the new URI, try to return the stream from it
try {
InputStream in = getDataFromURI(segment.toString(), newURI, trustType, state);
newXRDS = readXRDS(in);
log.debug("Got XRDS = " + newXRDS.toString());
}
catch (Exception e) {
log.trace("resolveAuthSegment - bad URI");
savedException = e;
continue;
}
// set ourselves up for the next multi-pass
for (int d = 0; d < newXRDS.getNumChildren() && d < segment.getNumSubSegments(); d++)
{
XRD xrd = newXRDS.getDescriptorAt(d);
// status is not success
Status stat = xrd.getStatus();
if (stat == null) {
xrd = createErrorXRD(segment.getSubSegmentAt(d).toString(),
Status.UNEXPECTED_XRD, "Status code was missing in original XRD");
}
// check the basic properties of the descriptor
boolean bValid = xrd.isValid();
if (!bValid) {
xrd = createErrorXRD(segment.getSubSegmentAt(d).toString(),
Status.UNEXPECTED_XRD, "Invalid XRD (stale?) received");
}
/*
// if we need to do trusted resolution checking
if (trustType.isSAML())
{
// Each descriptor must be validated independently as well as
// against the one that preceded (described) it in the
// descriptor chain.
// TODO: there could be more than one Authority Resolution Service
// in the final XRD
bValid =
isTrustedDescriptor(
oAuth.getSubSegmentAt(iSubSeg), xrd,
oChain.getFinalXRIDescriptor().getFirstServiceByType(Tags.SERVICE_AUTH_RES));
// bail if the descriptor is not valid
if (!bValid)
throw new XRIResolutionException("Signature verification failed");
}
*/
xrdsOut.add(xrd);
if (!xrd.getStatus().getCode().equals(Status.SUCCESS)) {
throw new PartialResolutionException(xrdsOut);
}
}
// in case we are not able to parse the XRDS, or no XRD in there
if (newXRDS.getNumChildren() < 1) {
XRD xrd = createErrorXRD(segment.getSubSegmentAt(0).toString(),
Status.AUTH_RES_ERROR, "No XRD element returned from endpoint");
xrdsOut.add(xrd);
throw new PartialResolutionException(xrdsOut);
}
if (newXRDS.getNumChildren() >= segment.getNumSubSegments()) {
// we're done!
return xrdsOut;
}
// not done yet, recursively resolve
XRISegment remainder = segment.getRemainder(newXRDS.getNumChildren());
XRDS remainderXRDS = null;
try {
remainderXRDS = resolveAuthSegment(newXRDS.getDescriptorAt(newXRDS.getNumChildren()-1), remainder, trustType, followRefs, state);
}
catch (PartialResolutionException e) {