[java-identity-provider COMMIT] /trunk/idp-conf/src/main/resources/system/conf/global-system.xml

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Jun 20 13:34:08 2014
New Revision: 6129

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6129&view=rev
Log:
Convert trust engine wiring to use a chaining variants, with existing explicit key ones as chain.
This is prep for adding PKIX trust engine support.

Modified:
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=6129&r1=6128&r2=6129&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml Fri Jun 20 13:34:08 2014
@@ -161,8 +161,6 @@
         class="org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver"
         c:resolver-ref="shibboleth.MetadataCredentialResolver" />
 
-    <!-- TODO: all this is probably wrong, but need it to get something working -->
-    
     <bean id="shibboleth.RoleDescriptorResolver" class="org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver"
         c:mdResolver-ref="shibboleth.MetadataResolver" />
     
@@ -174,13 +172,23 @@
     <bean id="shibboleth.KeyInfoCredentialResolver" class="org.opensaml.xmlsec.config.DefaultSecurityConfigurationBootstrap"
         factory-method="buildBasicInlineKeyInfoCredentialResolver" />
 
-    <bean id="shibboleth.SignatureTrustEngine" class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine">
-        <constructor-arg ref="shibboleth.MetadataCredentialResolver" />
-        <constructor-arg ref="shibboleth.KeyInfoCredentialResolver" />
+    <bean id="shibboleth.SignatureTrustEngine" class="org.opensaml.xmlsec.signature.support.impl.ChainingSignatureTrustEngine">
+        <constructor-arg>
+            <util:list>
+                <bean class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"
+                    c:resolver-ref="shibboleth.MetadataCredentialResolver"
+                    c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
+            </util:list>
+        </constructor-arg>
     </bean>
 
-    <bean id="shibboleth.X509TrustEngine" class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine">
-        <constructor-arg ref="shibboleth.MetadataCredentialResolver" />
+    <bean id="shibboleth.X509TrustEngine" class="org.opensaml.security.trust.impl.ChainingTrustEngine">
+        <constructor-arg>
+            <util:list>
+                <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
+                    c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+            </util:list>
+        </constructor-arg>
     </bean>
-
+    
  </beans>