[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/idp.properties system/conf/global-system....

[noreply at shibboleth.net]

Author: scantor
Date: Thu Aug 21 12:11:10 2014
New Revision: 6455

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6455&view=rev
Log:
Move trust engines into RP config.

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml
    trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6455&r1=6454&r2=6455&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Thu Aug 21 12:11:10 2014
@@ -33,6 +33,15 @@
 
 # To default to SHA-1, set to shibboleth.SigningConfiguration.SHA1
 #idp.signing.config = shibboleth.SigningConfiguration.SHA256
+
+# Configures trust evaluation of keys used by services at runtime
+# Defaults to supporting both explicit key and PKIX using SAML metadata.
+#idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine
+# To pick only one set to one of:
+#   shibboleth.ExplicitKeySignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine
+#idp.trust.certificates = shibboleth.ChainingX509TrustEngine
+# To pick only one set to one of:
+#   shibboleth.ExplicitKeyX509TrustEngine, shibboleth.PKIXX509TrustEngine
 
 # If true, encryption will happen whenever a key to use can be located, but
 # failure to encrypt won't result in request failure.

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=6455&r1=6454&r2=6455&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml Thu Aug 21 12:11:10 2014
@@ -175,6 +175,11 @@
     <bean id="shibboleth.ClientTLSValidationParametersResolver"
         class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver" />
 
+    <!--
+    The beans below are primarily used by trust engines in relying-party-system.xml, but also in the
+    resolver for encryption parameters above.
+    -->
+    
     <bean id="shibboleth.RoleDescriptorResolver" class="org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver"
         c:mdResolver-ref="shibboleth.MetadataResolver" />
     
@@ -183,34 +188,7 @@
          p:keyInfoCredentialResolver-ref="shibboleth.KeyInfoCredentialResolver">
     </bean>
     
-    <bean id="shibboleth.MetadataPKIXValidationInformationResolver" class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
-         c:resolver-ref="shibboleth.RoleDescriptorResolver" />
-    
     <bean id="shibboleth.KeyInfoCredentialResolver" class="org.opensaml.xmlsec.config.DefaultSecurityConfigurationBootstrap"
         factory-method="buildBasicInlineKeyInfoCredentialResolver" />
-
-    <bean id="shibboleth.SignatureTrustEngine" class="org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine">
-        <constructor-arg>
-            <util:list>
-                <bean class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"
-                    c:resolver-ref="shibboleth.MetadataCredentialResolver"
-                    c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
-                <bean class="org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine" 
-                    c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver"
-                    c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
-            </util:list>
-        </constructor-arg>
-    </bean>
-
-    <bean id="shibboleth.X509TrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
-        <constructor-arg>
-            <util:list>
-                <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
-                    c:resolver-ref="shibboleth.MetadataCredentialResolver" />
-                <bean class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine"
-                    c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver" />
-            </util:list>
-        </constructor-arg>
-    </bean>
-    
+        
  </beans>

Modified: trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml?rev=6455&r1=6454&r2=6455&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml (original)

[... 179 lines stripped ...]