Merge pull request #84 from miszobi/issue/83-fix-concurrent-validation

fixes #83: don't share a SchemaFactory between instances

Author: pitbulk

core/src/main/java/com/onelogin/saml2/util/SchemaFactory.java

@@ -13,15 +13,13 @@
  * A class that read SAML schemas that will be used to validate XMLs of the OneLogin's Java Toolkit 
  */ 
 public abstract class SchemaFactory {
-	public static final javax.xml.validation.SchemaFactory schemaFactory = javax.xml.validation.SchemaFactory
-			.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
-
 	public static final URL SAML_SCHEMA_METADATA_2_0 = SchemaFactory.class
 			.getResource("/schemas/saml-schema-metadata-2.0.xsd");
 	public static final URL SAML_SCHEMA_PROTOCOL_2_0 = SchemaFactory.class
 			.getResource("/schemas/saml-schema-protocol-2.0.xsd");
 
 	public static Schema loadFromUrl(URL schemaUrl) throws SAXException {
-		return schemaFactory.newSchema(schemaUrl);
+		return javax.xml.validation.SchemaFactory
+                .newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI).newSchema(schemaUrl);
 	}
 }

core/src/test/java/com/onelogin/saml2/test/authn/AuthnResponseTest.java

@@ -1,32 +1,38 @@
 package com.onelogin.saml2.test.authn;
 
+import com.onelogin.saml2.authn.SamlResponse;
+import com.onelogin.saml2.http.HttpRequest;
+import com.onelogin.saml2.model.SamlResponseStatus;
+import com.onelogin.saml2.settings.Saml2Settings;
+import com.onelogin.saml2.settings.SettingsBuilder;
+import com.onelogin.saml2.util.Constants;
+import com.onelogin.saml2.util.Util;
+import org.hamcrest.Matchers;
+import org.joda.time.Instant;
+import org.junit.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-
-import org.joda.time.Instant;
-import org.junit.Test;
-import org.w3c.dom.Document;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-
-import com.onelogin.saml2.authn.SamlResponse;
-import com.onelogin.saml2.http.HttpRequest;
-import com.onelogin.saml2.model.SamlResponseStatus;
-import com.onelogin.saml2.settings.Saml2Settings;
-import com.onelogin.saml2.settings.SettingsBuilder;
-import com.onelogin.saml2.util.Constants;
-import com.onelogin.saml2.util.Util;
-
 public class AuthnResponseTest {
 	private static final String ACS_URL = "http://localhost:8080/java-saml-jspsample/acs.jsp";
 
@@ -1127,6 +1133,42 @@ public void testIsValidSubjectConfirmation_multipleIssues() throws Exception {
 						"\n[2] SubjectConfirmationData is no longer valid");
 	}
 
+	@Test
+	public void testIsValid_multipleThreads() throws Exception {
+		// having
+		final int jobCount = 100;
+		final int threadCount = 5;
+		final ExecutorService executor = Executors.newFixedThreadPool(threadCount);
+		final List<Throwable> errors = new CopyOnWriteArrayList<>();
+		final AtomicInteger successCount = new AtomicInteger();
+
+		// when
+		for (int i = 0; i < jobCount; i++) {
+			executor.submit(new Runnable() {
+				@Override
+				public void run() {
+					try {
+						Saml2Settings settings = new SettingsBuilder().fromFile("config/config.my.properties").build();
+						settings.setWantAssertionsSigned(false);
+						settings.setWantMessagesSigned(true);
+						final String samlResponseEncoded = loadSignMessageAndEncode("data/responses/valid_idp_initiated_response.xml");
+
+						assertResponseValid(settings, samlResponseEncoded, true, true, null);
+						successCount.incrementAndGet();
+					} catch (Throwable e) {
+						errors.add(e);
+					}
+				}
+			});
+		}
+		executor.shutdown();
+		executor.awaitTermination(30, TimeUnit.SECONDS);
+
+		// then
+		assertThat(errors, Matchers.empty());
+		assertThat(successCount.get(), is(jobCount));
+	}
+
 	/**
 	 * Tests the isValid method of SamlResponse
 	 * Case: Datetime with Miliseconds