[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/access-control.xml idp-conf/src/main/reso...

[noreply at shibboleth.net]

Author: scantor
Date: Sat Jul 19 01:22:33 2014
New Revision: 6315

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6315&view=rev
Log:
- Add configuration for access control policies
- Rework flow action to generically handle any access control service
- Redo status flow and properties to use a general IP access rule

Added:
    trunk/idp-conf/src/main/resources/conf/access-control.xml   (with props)
    trunk/idp-conf/src/main/resources/system/conf/access-control-system.xml   (with props)
    trunk/idp-core/src/main/java/net/shibboleth/idp/security/AccessControlService.java   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/conf/services.xml
    trunk/idp-conf/src/main/resources/system/conf/services-system.xml
    trunk/idp-conf/src/main/resources/system/flows/status/status-beans.xml
    trunk/idp-core/src/main/java/net/shibboleth/idp/security/ReloadingAccessControlService.java

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6315&r1=6314&r2=6315&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Sat Jul 19 01:22:33 2014
@@ -138,6 +138,10 @@
 #idp.service.nameidGeneration.failFast=false
 idp.service.nameidGeneration.checkInterval=PT5M
 
+# NameID generation
+#idp.service.access.failFast=true
+idp.service.access.checkInterval=PT5M
+
 # LDAP attribute configuration, see attribute-resolver.xml
 idp.attribute.resolver.myLDAP.ldapURL             = ldap://localhost:10389
 idp.attribute.resolver.myLDAP.baseDN              = ou=people,dc=example,dc=org 
@@ -154,5 +158,5 @@
 # May differ to direct SAML 2 artifact lookups to specific server nodes
 #idp.artifact.endpointIndex = 1
 
-# Access control for status page
-idp.status.allowedAddresses = '127.0.0.1/32', '::1/128'
+# Name of access control policy for status page
+idp.status.accessPolicy = AccessByIPAddress

Modified: trunk/idp-conf/src/main/resources/conf/services.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/services.xml?rev=6315&r1=6314&r2=6315&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/services.xml (original)
+++ trunk/idp-conf/src/main/resources/conf/services.xml Sat Jul 19 01:22:33 2014
@@ -93,5 +93,10 @@
         <value>%{idp.home}/conf/saml-nameid.xml</value>
         <value>%{idp.home}/system/conf/saml-nameid-system.xml</value>
     </util:list>
+    
+    <util:list id="shibboleth.AccessControlResources">
+        <value>%{idp.home}/conf/access-control.xml</value>
+        <value>%{idp.home}/system/conf/access-control-system.xml</value>
+    </util:list>
 
 </beans>

Modified: trunk/idp-conf/src/main/resources/system/conf/services-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/services-system.xml?rev=6315&r1=6314&r2=6315&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/services-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/services-system.xml Sat Jul 19 01:22:33 2014
@@ -86,6 +86,13 @@
         </property>
     </bean>
 
+    <bean id="shibboleth.ReloadableAccessControlService" class="net.shibboleth.idp.service.ReloadableSpringService"
+        c:claz="net.shibboleth.utilities.java.support.security.AccessControlService" 
+        p:serviceConfigurations-ref="shibboleth.AccessControlResources"
+        p:failFast="%{idp.service.access.failFast:true}"
+        p:reloadCheckDelay="%{idp.service.access.checkInterval:0}"
+        p:reloadTaskTimer="shibboleth.TaskTimer" />
+
     <!--
     These are proxies/facades that expose a service-unaware interface to client components.
     Services without such facades are being consumed directly in a service-aware way.
@@ -98,5 +105,9 @@
     <bean id="shibboleth.MetadataResolver"
         class="net.shibboleth.idp.saml.metadata.impl.ReloadingRelyingPartyMetadataProvider"
         c:resolverService-ref="shibboleth.MetadataResolverService" />
+        
+    <bean id="shibboleth.AccessControlService"
+        class="net.shibboleth.idp.security.AccessControlService"
+        c:acService-ref="shibboleth.ReloadableAccessControlService" />
 
  </beans>

Modified: trunk/idp-conf/src/main/resources/system/flows/status/status-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/status/status-beans.xml?rev=6315&r1=6314&r2=6315&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/status/status-beans.xml (original)

[... 106 lines stripped ...]