[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/system/conf/legacy-relying-party-defaults.xml ...

[noreply at shibboleth.net]

Author: scantor
Date: Thu Aug 21 19:12:42 2014
New Revision: 6456

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6456&view=rev
Log:
- Implement default trust engines for legacy RP configs
- Rename legacy default beans for clarity

Added:
    trunk/idp-conf/src/main/resources/system/conf/legacy-relying-party-defaults.xml
      - copied, changed from r6453, trunk/idp-conf/src/main/resources/system/conf/profile-defaults.xml
Modified:
    trunk/idp-conf/src/main/resources/system/conf/profile-defaults.xml
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/RelyingPartyGroupParser.java
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/security/trustengine/UnsupportedTrustEngineParser.java
    trunk/idp-profile-spring/src/test/java/net/shibboleth/idp/profile/spring/relyingparty/RelyingPartyGroupTest.java
    trunk/idp-profile-spring/src/test/resources/net/shibboleth/idp/profile/spring/relyingparty/beans.xml

Copied: trunk/idp-conf/src/main/resources/system/conf/legacy-relying-party-defaults.xml (from r6453, trunk/idp-conf/src/main/resources/system/conf/profile-defaults.xml)
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/legacy-relying-party-defaults.xml?p2=trunk/idp-conf/src/main/resources/system/conf/legacy-relying-party-defaults.xml&p1=trunk/idp-conf/src/main/resources/system/conf/profile-defaults.xml&r1=6453&r2=6456&rev=6456&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/profile-defaults.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/legacy-relying-party-defaults.xml Thu Aug 21 19:12:42 2014
@@ -11,11 +11,9 @@
     <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"
         p:placeholderPrefix="%{" p:placeholderSuffix="}" />
 	
-	<!-- The profile defaults. Firstly the artifact and InboundFlowId parameters 
-
-            TODO establish correct values for Logout InboundFlowId 
     
-     -->
+    
+	<!-- TODO establish correct values for Logout InboundFlowId -->
 
     <!--  SAML2 -->
     <bean id="shibboleth.SAML2.Artifact.InboundFlowId" class="java.lang.String"
@@ -56,5 +54,36 @@
         c:_0="%{idp.artifact.endpointIndex:1}" />
     <bean id="shibboleth.SAML1.BrowserSSO.InboundFlowId" class="java.lang.String"
         c:_0="security-policy/shibboleth-sso" />
-            
+
+    <bean id="shibboleth.MetadataPKIXValidationInformationResolver"
+        class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
+        c:resolver-ref="shibboleth.RoleDescriptorResolver" />
+
+    <!-- Trust Engines -->
+
+    <bean id="shibboleth.SignatureTrustEngine"
+            class="org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine">
+        <constructor-arg>
+            <list>
+                <bean class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"
+                    c:resolver-ref="shibboleth.MetadataCredentialResolver"
+                    c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
+                <bean class="org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine" 
+                    c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver"
+                    c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
+            </list>
+        </constructor-arg>
+    </bean>
+
+    <bean id="shibboleth.X509TrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
+        <constructor-arg>
+            <list>
+                <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
+                    c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+                <bean class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine"
+                    c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver" />
+            </list>
+        </constructor-arg>
+    </bean>
+    
 </beans>

Modified: trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/RelyingPartyGroupParser.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/RelyingPartyGroupParser.java?rev=6456&r1=6455&r2=6456&view=diff
==============================================================================
--- trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/RelyingPartyGroupParser.java (original)
+++ trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/RelyingPartyGroupParser.java Thu Aug 21 19:12:42 2014
@@ -23,12 +23,15 @@
 import javax.xml.namespace.QName;
 
 import net.shibboleth.ext.spring.util.SpringSupport;
+import net.shibboleth.idp.profile.config.SecurityConfiguration;

[... 185 lines stripped ...]