[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources/system/flows/saml/saml2: idwsf-ssos-security-be...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Aug 19 23:42:46 2015
New Revision: 7693

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7693&view=rev
Log:
More work on wiring up Liberty delegation flow and related beans.

Modified:
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-flow.xml

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml?rev=7693&r1=7692&r2=7693&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml	Wed Aug 19 23:42:46 2015
@@ -19,11 +19,10 @@
     
     <import resource="../security-beans.xml" />
     
-    <!-- TODO: these 2 constants are copied over from commons-beans.xml for now, pending where everything winds up. -->
-    <util:constant id="shibboleth.MetadataLookup.Protocol"
+    <util:constant id="shibboleth.Delegation.MetadataLookup.Protocol"
         static-field="org.opensaml.saml.common.xml.SAMLConstants.SAML20P_NS" />
 
-    <util:constant id="shibboleth.MetadataLookup.Role"
+    <util:constant id="shibboleth.Delegation.MetadataLookup.Role"
         static-field="org.opensaml.saml.saml2.metadata.SPSSODescriptor.DEFAULT_ELEMENT_NAME" />
     
     <!-- TODO: these probably don't belong here. -->
@@ -98,8 +97,8 @@
         <constructor-arg name="messageHandler">
             <bean class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" scope="prototype"
                 p:entityContextClass="org.opensaml.saml.common.messaging.context.SAMLPresenterEntityContext"
-                p:protocol-ref="shibboleth.MetadataLookup.Protocol"
-                p:role-ref="shibboleth.MetadataLookup.Role" />
+                p:protocol-ref="shibboleth.Delegation.MetadataLookup.Protocol"
+                p:role-ref="shibboleth.Delegation.MetadataLookup.Role" />
         </constructor-arg>
     </bean>
     
@@ -151,5 +150,70 @@
             <util:constant static-field="org.opensaml.profile.action.EventIds.MESSAGE_AUTHN_ERROR" />
         </property>
     </bean>
+    
+    <!-- TODO need to figure out a long-term strategy for this. To account for multiples, 
+         probably have to put this list up in conf/credentials.xml and make the deployer maintain it. 
+         Note: the credential beans are currently NOT loaded in any visible Spring context.  credentials.xml is just pulled into
+         the RelyingPartyConfigurationResolver. Or can we just get these directly from the RPCR? -->
+    <util:list id="shibboleth.Delegation.IdPSigningCredentials" >
+        <!-- TODO this doesn't work b/c it's not actually loaded as a bean that's visible.
+        <ref bean="shibboleth.DefaultSigningCredential" />
+        -->
+    </util:list>
+    
+    <bean id="shibboleth.Delegation.AssertionSignatureTrustEngine" class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine">
+        <constructor-arg>
+            <bean class="org.opensaml.security.credential.impl.StaticCredentialResolver" 
+                c:_0-ref="shibboleth.Delegation.IdPSigningCredentials" />
+        </constructor-arg>
+        <constructor-arg ref="shibboleth.KeyInfoCredentialResolver" />
+    </bean>
+    
+    <bean id="shibboleth.Delegation.SAML2AssertionTokenValidator" class="org.opensaml.saml.saml2.assertion.SAML20AssertionValidator">
+        <!-- Condition validators. -->
+        <constructor-arg index="0">
+            <util:list>
+                <bean class="org.opensaml.saml.saml2.assertion.impl.AudienceRestrictionConditionValidator" />
+                <bean class="org.opensaml.saml.saml2.assertion.impl.OneTimeUseConditionValidator">
+                    <constructor-arg ref="shibboleth.ReplayCache" />
+                    <constructor-arg value="#{null}" />
+                </bean>
+            </util:list>
+        </constructor-arg>
+        <!-- SubjectConfirmation validators. -->
+        <constructor-arg index="1">
+            <util:list>
+                <bean class="org.opensaml.saml.saml2.assertion.impl.HolderOfKeySubjectConfirmationValidator" />
+            </util:list>
+        </constructor-arg>
+        <!-- Statement validators. -->
+        <constructor-arg index="2">
+            <util:list>
+                <!--Expected to be empty.  -->
+            </util:list>
+        </constructor-arg>
+        <constructor-arg index="3" ref="shibboleth.Delegation.AssertionSignatureTrustEngine" />
+        <constructor-arg index="4">
+            <bean class="org.opensaml.saml.security.impl.SAMLSignatureProfileValidator" />
+        </constructor-arg>
+    </bean>
+    
+    <bean id="WSSecuritySAML20AssertionTokenSecurityHandler"

[... 45 lines stripped ...]