[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/idp.properties idp-conf/src/main/resource...

[noreply at shibboleth.net]

Author: scantor
Date: Mon Nov 17 15:37:23 2014
New Revision: 6922

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6922&view=rev
Log:
- Separate session and persistent cookie storage use cases.
- Add properties for cookie behavior.

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml
    trunk/idp-conf/src/main/resources/system/conf/profile-intercept-system.xml
    trunk/idp-conf/src/main/resources/system/conf/session-manager-system.xml
    trunk/idp-war/src/main/webapp/WEB-INF/web.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=6922&r1=6921&r2=6922&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties Mon Nov 17 15:37:23 2014
@@ -6,6 +6,13 @@
 
 # Set the scope used in the attribute resolver for scoped attributes 
 idp.scope = example.org
+
+# General cookie properties (maxAge only applies to persistent cookies)
+#idp.cookie.secure = false
+#idp.cookie.httpOnly = true
+#idp.cookie.domain =
+#idp.cookie.path =
+#idp.cookie.maxAge = 31536000
 
 # Set the location of Velocity view templates
 #idp.views = %{idp.home}/views
@@ -52,9 +59,6 @@
 #idp.storage.StorageService = org.opensaml.storage.impl.MemoryStorageService
 #idp.storage.cleanupInterval = PT10M
 
-# Configures the primary client-side storage plugin
-#idp.storage.ClientStorageService = org.opensaml.storage.impl.ServletRequestScopedStorageService
-
 # Set to true to expose more detailed errors in responses to SPs
 #idp.errors.detailed = false
 
@@ -67,8 +71,8 @@
 # Set to false to disable the IdP session layer
 #idp.session.enabled = true
 
-# Set to "shibboleth.StorageService" for server-side storage
-#idp.session.StorageService = shibboleth.ClientStorageService
+# Set to "shibboleth.StorageService" for server-side storage of user sessions
+#idp.session.StorageService = shibboleth.ClientSessionStorageService
 
 # Size of session IDs
 #idp.session.idSize = 32
@@ -86,9 +90,6 @@
 #idp.session.secondaryServiceIndex = false
 # Length of time to track SP sessions
 #idp.session.defaultSPlifetime = PT2H
-
-# Select alternate implementation for step that determines what results are active
-#idp.session.activeResultExtraction = net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults
 
 # Regular expression matching login flows to enable, e.g. IPAddress|Password
 idp.authn.flows = Password
@@ -113,6 +114,9 @@
 # doesn't match the identity in a pre-existing session.
 #idp.authn.identitySwitchIsError = false
 
+# Set to "shibboleth.StorageService" for server-side storage of user consent
+#idp.consent.StorageService = shibboleth.ClientPersistentStorageService
+
 # Whether to lookup metadata, etc. for every SP involved in a logout
 # for use by user interface logic; adds overhead so off by default.
 #idp.logout.elaboration = false

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=6922&r1=6921&r2=6922&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml Mon Nov 17 15:37:23 2014
@@ -118,7 +118,20 @@
     <bean id="shibboleth.CookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
         p:httpServletRequest-ref="shibboleth.HttpServletRequest"
         p:httpServletResponse-ref="shibboleth.HttpServletResponse"
-        p:secure="false" />
+        p:secure="%{idp.cookie.secure:false}"
+        p:httpOnly="%{idp.cookie.httpOnly:true}"
+        p:cookieDomain="%{idp.cookie.domain:}"
+        p:cookiePath="%{idp.cookie.path:}"
+        p:maxAge="-1" />
+
+    <bean id="shibboleth.PersistentCookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
+        p:httpServletRequest-ref="shibboleth.HttpServletRequest"
+        p:httpServletResponse-ref="shibboleth.HttpServletResponse"
+        p:secure="%{idp.cookie.secure:false}"
+        p:httpOnly="%{idp.cookie.httpOnly:true}"
+        p:cookieDomain="%{idp.cookie.domain:}"
+        p:cookiePath="%{idp.cookie.path:}"
+        p:maxAge="%{idp.cookie.maxAge:31536000}" />
     
     <bean id="shibboleth.DataSealer" class="net.shibboleth.utilities.java.support.security.DataSealer">
         <property name="keyStrategy">
@@ -142,11 +155,20 @@
         p:cleanupInterval="%{idp.storage.cleanupInterval:PT10M}"
         p:cleanupTaskTimer-ref="shibboleth.TaskTimer" />
 
-    <bean id="shibboleth.ClientStorageService"
+    <bean id="shibboleth.ClientSessionStorageService"

[... 108 lines stripped ...]