[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/idp.properties idp-conf/src/main/resource...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Jun  2 22:57:15 2014
New Revision: 6038

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6038&view=rev
Log:
IDP-416 - Add option to override message channel flags for artifact bindings.

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContextsTest.java

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6038&r1=6037&r2=6038&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Mon Jun  2 22:57:15 2014
@@ -124,5 +124,8 @@
 idp.policy.messageLifetime = PT3M
 idp.policy.clockSkew = PT3M
 
+# Suppresses typical signing/encryption when artifact binding used
+idp.artifact.secureChannel = true
+
 # Access control for status page
 idp.status.allowedAddresses = '127.0.0.1/32', '::1/128'

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml?rev=6038&r1=6037&r2=6038&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml (original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml-abstract-beans.xml Mon Jun  2 22:57:15 2014
@@ -88,7 +88,8 @@
     <bean id="PopulateBindingAndEndpointContexts"
         class="net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts" scope="prototype"
         p:endpointResolver-ref="shibboleth.EndpointResolver"
-        p:bindings-ref="shibboleth.OutgoingBindings" />
+        p:bindings-ref="shibboleth.OutgoingBindings"
+        p:artifactImpliesSecureChannel="${idp.artifact.secureChannel}" />
 
     <bean id="PopulateDecryptionParameters"
         class="org.opensaml.profile.action.impl.PopulateDecryptionParameters" scope="prototype"

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java?rev=6038&r1=6037&r2=6038&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java (original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/impl/PopulateBindingAndEndpointContexts.java Mon Jun  2 22:57:15 2014
@@ -40,6 +40,7 @@
 
 import org.opensaml.core.xml.XMLObjectBuilder;
 import org.opensaml.core.xml.util.XMLObjectSupport;
+import org.opensaml.messaging.context.MessageChannelSecurityContext;
 import org.opensaml.messaging.context.navigate.ChildContextLookup;
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
@@ -129,6 +130,9 @@
     /** Strategy function for access to {@link SAMLArtifactContext} to populate. */
     @Nonnull private Function<ProfileRequestContext,SAMLArtifactContext> artifactContextLookupStrategy;
     
+    /** Whether an artifact-based binding implies the use of a secure channel. */
+    private boolean artifactImpliesSecureChannel;
+    
     /** Builder for template endpoints. */
     @NonnullAfterInit private XMLObjectBuilder<?> endpointBuilder;
     
@@ -170,6 +174,8 @@
                 new ChildContextLookup<>(SAMLEndpointContext.class, true),
                 Functions.compose(new ChildContextLookup<>(SAMLPeerEntityContext.class, true),
                         new OutboundMessageContextLookup()));
+        
+        artifactImpliesSecureChannel = true;
     }
     
     /**
@@ -269,6 +275,23 @@
         
         artifactContextLookupStrategy = Constraint.isNotNull(strategy,
                 "SAMLArtifactContext lookup strategy cannot be null");
+    }
+    
+    /**
+     * Set whether an artifact-based binding implies that the eventual channel for SAML message exchange
+     * will be secured, overriding the integrity and confidentiality properties of the current channel.
+     * 
+     * <p>This has the effect of suppressing signing and encryption when an artifact binding is used,
+     * which is normally desirable.</p>
+     * 
+     * <p>Defaults to true.</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setArtifactImpliesSecureChannel(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        

[... 52 lines stripped ...]