[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/idp.properties idp-conf/src/main/resource...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Jul 29 12:54:58 2014
New Revision: 6353

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6353&view=rev
Log:
JSPT-47: key versioning revamp for DataSealer

Added:
    trunk/idp-conf/src/test/resources/creds/sealer.kver
Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml
    trunk/idp-conf/src/test/resources/creds/sealer.jks
    trunk/idp-distribution/src/main/resources/bin/creds.bat
    trunk/idp-distribution/src/main/resources/bin/creds.sh
    trunk/idp-parent/pom.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6353&r1=6352&r2=6353&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Tue Jul 29 12:54:58 2014
@@ -8,8 +8,10 @@
 
 # Settings for internal AES encryption key
 #idp.sealer.storeType = JCEKS
-#idp.sealer.aliasBase = idpSecretKey
+#idp.sealer.updateInterval = PT15M
+#idp.sealer.aliasBase = secret
 idp.sealer.storeResource = %{idp.home}/creds/sealer.jks
+idp.sealer.versionResource = %{idp.home}/creds/sealer.kver
 idp.sealer.storePassword = password
 idp.sealer.keyPassword = password
 
@@ -138,7 +140,7 @@
 #idp.service.nameidGeneration.failFast=false
 idp.service.nameidGeneration.checkInterval=PT5M
 
-# NameID generation
+# Admin access control
 #idp.service.access.failFast=true
 idp.service.access.checkInterval=PT5M
 

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=6353&r1=6352&r2=6353&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml Tue Jul 29 12:54:58 2014
@@ -126,16 +126,24 @@
         p:httpServletResponse-ref="shibboleth.HttpServletResponse"
         p:secure="false" />
     
-    <bean id="shibboleth.DataSealer" class="net.shibboleth.utilities.java.support.security.DataSealer"
-        p:keystoreType="%{idp.sealer.storeType:JCEKS}"
-        p:keystoreResource="%{idp.sealer.storeResource}"
-        p:keystorePassword="%{idp.sealer.storePassword}"
-        p:cipherKeyAlias="%{idp.sealer.aliasBase:idpSecretKey}"
-        p:cipherKeyPassword="%{idp.sealer.keyPassword}" />
+    <bean id="shibboleth.DataSealer" class="net.shibboleth.utilities.java.support.security.DataSealer">
+        <property name="keyStrategy">
+            <bean class="net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy"
+                p:keystoreType="%{idp.sealer.storeType:JCEKS}"
+                p:keystoreResource="%{idp.sealer.storeResource}"
+                p:keyVersionResource="%{idp.sealer.versionResource}"
+                p:keystorePassword="%{idp.sealer.storePassword}"
+                p:keyAlias="%{idp.sealer.aliasBase:secret}"
+                p:keyPassword="%{idp.sealer.keyPassword}"
+                p:updateInterval="%{idp.sealer.updateInterval:PT15M}"               
+                p:updateTaskTimer-ref="shibboleth.TaskTimer" />
+        </property>
+    </bean>
     
     <bean id="shibboleth.StorageService"
-        class="%{idp.storage.StorageService:org.opensaml.storage.impl.MemoryStorageService}"
-        p:cleanupInterval="%{idp.storage.cleanupInterval:PT10M}" />
+        class="%{idp.storage.StorageService:org.opensaml.storage.impl.MemoryStorageService}"        
+        p:cleanupInterval="%{idp.storage.cleanupInterval:PT10M}"
+        p:cleanupTaskTimer-ref="shibboleth.TaskTimer" />
 
     <bean id="shibboleth.ClientStorageService"
         class="%{idp.storage.ClientStorageService:org.opensaml.storage.impl.ServletRequestScopedStorageService}"

Modified: trunk/idp-conf/src/test/resources/creds/sealer.jks
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/test/resources/creds/sealer.jks?rev=6353&r1=6352&r2=6353&view=diff
==============================================================================
Binary files - no diff available.

Modified: trunk/idp-distribution/src/main/resources/bin/creds.bat
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-distribution/src/main/resources/bin/creds.bat?rev=6353&r1=6352&r2=6353&view=diff
==============================================================================
--- trunk/idp-distribution/src/main/resources/bin/creds.bat (original)
+++ trunk/idp-distribution/src/main/resources/bin/creds.bat Tue Jul 29 12:54:58 2014
@@ -15,4 +15,6 @@
 
 java -cp "bin\lib\*;war\WEB-INF\lib\*" %CLASS% --hostname %HOSTNAME% --storefile creds/idp-tls.p12 --storepass changeit --uriAltName %URI_ALT_NAME%
 

[... 34 lines stripped ...]