[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources: conf/services.properties system/conf/global-sy...

[noreply at shibboleth.net]

Author: putmanb
Date: Thu Feb 26 19:56:18 2015
New Revision: 7383

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7383&view=rev
Log:
Add bean and property toggles and SpEL for existing global-system.xml HttpClient builders to use a TrustEngineTLSSocketFactory. 

Modified:
    trunk/idp-conf/src/main/resources/conf/services.properties
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml

Modified: trunk/idp-conf/src/main/resources/conf/services.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/services.properties?rev=7383&r1=7382&r2=7383&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/services.properties (original)
+++ trunk/idp-conf/src/main/resources/conf/services.properties Thu Feb 26 19:56:18 2015
@@ -42,6 +42,7 @@
 # Parameters for pre-defined HttpClient instances which perform in-memory and filesystem caching.
 # These are used with components such as remote configuration resources that are explicitly wired
 # with these client instances, *not* by default with HTTP metadata resolvers.
+#idp.httpclient.useTrustEngineTLSSocketFactory = false
 #idp.httpclient.connectionDisregardTLSCertificate = false
 #idp.httpclient.connectionTimeout = -1
 #idp.httpclient.memorycaching.maxCacheEntries = 50

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=7383&r1=7382&r2=7383&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml (original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml Thu Feb 26 19:56:18 2015
@@ -255,6 +255,7 @@
     <bean id="shibboleth.FileCachingHttpClient"
         lazy-init="true"
         class="net.shibboleth.idp.profile.spring.relyingparty.metadata.FileCachingHttpClientFactoryBean"
+        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} ? @'shibboleth.TrustEngineTLSSocketFactory' : null }"
         p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
         p:connectionTimeout="%{idp.httpclient.connectionTimeout:-1}"
         p:cacheDirectory="%{idp.httpclient.filecaching.cacheDirectory}"
@@ -264,9 +265,21 @@
     <bean id="shibboleth.MemoryCachingHttpClient"
         lazy-init="true"
         class="net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean"
+        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} ? @'shibboleth.TrustEngineTLSSocketFactory' : null }"
         p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
         p:connectionTimeout="%{idp.httpclient.connectionTimeout:-1}"
         p:maxCacheEntries="%{idp.httpclient.memorycaching.maxCacheEntries:50}"
         p:maxCacheEntrySize="%{idp.httpclient.memorycaching.maxCacheEntrySize:1048576}" />
+        
+    <bean id="shibboleth.TrustEngineTLSSocketFactory" 
+        lazy-init="true"
+        class="org.opensaml.security.httpclient.impl.TrustEngineTLSSocketFactory">
+        <constructor-arg>
+            <bean factory-method="buildNoTrustSSLConnectionSocketFactory" class="net.shibboleth.utilities.java.support.httpclient.HttpClientSupport"/>
+        </constructor-arg>
+        <constructor-arg>
+            <bean class="org.apache.http.conn.ssl.StrictHostnameVerifier" />
+        </constructor-arg>
+    </bean>
     
  </beans>