[java-identity-provider COMMIT] /trunk/idp-conf/src/main/resources/system/conf/global-system.xml

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Jun 20 13:46:39 2014
New Revision: 6130

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6130&view=rev
Log:
Add PKIX trust engines to chains for signature and client TLS cert eval.

Modified:
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=6130&r1=6129&r2=6130&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml Fri Jun 20 13:46:39 2014
@@ -169,6 +169,9 @@
          p:keyInfoCredentialResolver-ref="shibboleth.KeyInfoCredentialResolver">
     </bean>
     
+    <bean id="shibboleth.MetadataPKIXValidationInformationResolver" class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
+         c:resolver-ref="shibboleth.RoleDescriptorResolver" />
+    
     <bean id="shibboleth.KeyInfoCredentialResolver" class="org.opensaml.xmlsec.config.DefaultSecurityConfigurationBootstrap"
         factory-method="buildBasicInlineKeyInfoCredentialResolver" />
 
@@ -178,6 +181,9 @@
                 <bean class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine"
                     c:resolver-ref="shibboleth.MetadataCredentialResolver"
                     c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
+                <bean class="org.opensaml.xmlsec.signature.support.impl.PKIXSignatureTrustEngine" 
+                    c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver"
+                    c:keyInfoResolver-ref="shibboleth.KeyInfoCredentialResolver" />
             </util:list>
         </constructor-arg>
     </bean>
@@ -187,6 +193,8 @@
             <util:list>
                 <bean class="org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine"
                     c:resolver-ref="shibboleth.MetadataCredentialResolver" />
+                <bean class="org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine"
+                    c:resolver-ref="shibboleth.MetadataPKIXValidationInformationResolver" />
             </util:list>
         </constructor-arg>
     </bean>