[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/credentials.xml idp-conf/src/main/resourc...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Aug 21 19:48:13 2015
New Revision: 7698

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7698&view=rev
Log:
Support resolution of signing credentials for delegation.

Added a new CredentialResolver impl which resolves the signing creds exposed on DefaultRelyingPartyConfiguratonResolver,
obtained from the relevant Spring reloadable service.  For now this is deliberately just on the impl class and not
defined on the RelyingPartyConfigurationResolver interface.

Added:
    trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/SigningCredentialsResolver.java   (with props)
Modified:
    trunk/idp-conf/src/main/resources/conf/credentials.xml
    trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml
    trunk/idp-profile-impl/src/main/java/net/shibboleth/idp/relyingparty/impl/DefaultRelyingPartyConfigurationResolver.java

Modified: trunk/idp-conf/src/main/resources/conf/credentials.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/credentials.xml?rev=7698&r1=7697&r2=7698&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/credentials.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/credentials.xml	Fri Aug 21 19:48:13 2015
@@ -21,6 +21,14 @@
     all your credentials here for convenience.
     -->
 
+    <!--
+    The list of ALL of your IdP's signing credentials. If you define additional signing credentials,
+    for example for specific relying parties or different key types, make sure to include them within this list.
+    -->
+    <util:list id="shibboleth.SigningCredentials">
+        <ref bean="shibboleth.DefaultSigningCredential" />
+    </util:list>
+    
     <!-- Your IdP's default signing key, set via property file. -->
     <bean id="shibboleth.DefaultSigningCredential"
         class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"

Modified: trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml?rev=7698&r1=7697&r2=7698&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/relying-party-system.xml	Fri Aug 21 19:48:13 2015
@@ -20,7 +20,8 @@
         p:unverifiedConfiguration-ref="shibboleth.UnverifiedRelyingParty"
         p:defaultConfiguration-ref="shibboleth.DefaultRelyingParty"
         p:relyingPartyConfigurations-ref="shibboleth.RelyingPartyOverrides"
-        p:defaultSecurityConfiguration-ref="%{idp.security.config:shibboleth.DefaultSecurityConfiguration}" />
+        p:defaultSecurityConfiguration-ref="%{idp.security.config:shibboleth.DefaultSecurityConfiguration}" 
+        p:signingCredentials="#{getObject('shibboleth.SigningCredentials')}" />
 
     <!-- Parent bean for generic RelyingParty overrides that establishes defaults. -->
     <bean id="RelyingParty" abstract="true" class="net.shibboleth.idp.relyingparty.RelyingPartyConfiguration"

Modified: trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml?rev=7698&r1=7697&r2=7698&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/saml/saml2/idwsf-ssos-security-beans.xml	Fri Aug 21 19:48:13 2015
@@ -151,20 +151,10 @@
         </property>
     </bean>
     
-    <!-- TODO need to figure out a long-term strategy for this. To account for multiples, 
-         probably have to put this list up in conf/credentials.xml and make the deployer maintain it. 
-         Note: the credential beans are currently NOT loaded in any visible Spring context.  credentials.xml is just pulled into
-         the RelyingPartyConfigurationResolver. Or can we just get these directly from the RPCR? -->
-    <util:list id="shibboleth.Delegation.IdPSigningCredentials" >
-        <!-- TODO this doesn't work b/c it's not actually loaded as a bean that's visible.
-        <ref bean="shibboleth.DefaultSigningCredential" />
-        -->
-    </util:list>
-    
     <bean id="shibboleth.Delegation.AssertionSignatureTrustEngine" class="org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine">
         <constructor-arg>
-            <bean class="org.opensaml.security.credential.impl.StaticCredentialResolver" 
-                c:_0-ref="shibboleth.Delegation.IdPSigningCredentials" />

[... 66 lines stripped ...]