[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/services.properties idp-conf/src/main/res...

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Nov  4 17:03:55 2015
New Revision: 7935

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7935&view=rev
Log:
Refactoring of security-enhanced HttpClient TLS trust engine support.

Deprecate existing TrustEngine TLS socket factory in favor a unified implementation
which supports both (existing) TrustEngine eval and (new) client TLS via thread-local
KeyManager.
Remove the monolithic client TLS one, since never released.
Update all code and wiring to use the new SecurityEnhancedTLSSocketFactory.

Modified:
    trunk/idp-conf/src/main/resources/conf/services.properties
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/AbstractDynamicHTTPMetadataProviderParser.java
    trunk/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/impl/HTTPMetadataProviderParser.java

Modified: trunk/idp-conf/src/main/resources/conf/services.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/services.properties?rev=7935&r1=7934&r2=7935&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/services.properties	(original)
+++ trunk/idp-conf/src/main/resources/conf/services.properties	Wed Nov  4 17:03:55 2015
@@ -47,6 +47,7 @@
 # These are used with components such as remote configuration resources that are explicitly wired
 # with these client instances, *not* by default with HTTP metadata resolvers.
 #idp.httpclient.useTrustEngineTLSSocketFactory = false
+#idp.httpclient.useSecurityEnhancedTLSSocketFactory = false
 #idp.httpclient.connectionDisregardTLSCertificate = false
 #idp.httpclient.connectionTimeout = -1
 #idp.httpclient.memorycaching.maxCacheEntries = 50

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=7935&r1=7934&r2=7935&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml	Wed Nov  4 17:03:55 2015
@@ -276,14 +276,14 @@
     <bean id="shibboleth.NonCachingHttpClient"
         lazy-init="true"
         class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean"
-        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} ? @'shibboleth.TrustEngineTLSSocketFactory' : null }"
+        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
         p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
         p:connectionTimeout="%{idp.httpclient.connectionTimeout:-1}" />
     
     <bean id="shibboleth.FileCachingHttpClient"
         lazy-init="true"
         class="net.shibboleth.idp.profile.spring.relyingparty.metadata.FileCachingHttpClientFactoryBean"
-        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} ? @'shibboleth.TrustEngineTLSSocketFactory' : null }"
+        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
         p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
         p:connectionTimeout="%{idp.httpclient.connectionTimeout:-1}"
         p:cacheDirectory="%{idp.httpclient.filecaching.cacheDirectory}"
@@ -293,15 +293,15 @@
     <bean id="shibboleth.MemoryCachingHttpClient"
         lazy-init="true"
         class="net.shibboleth.idp.profile.spring.relyingparty.metadata.InMemoryCachingHttpClientFactoryBean"
-        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} ? @'shibboleth.TrustEngineTLSSocketFactory' : null }"
+        p:tLSSocketFactory="#{ %{idp.httpclient.useTrustEngineTLSSocketFactory:false} or %{idp.httpclient.useSecurityEnhancedTLSSocketFactory:false} ? @'shibboleth.SecurityEnhancedTLSSocketFactory' : null }"
         p:connectionDisregardTLSCertificate="%{idp.httpclient.connectionDisregardTLSCertificate:false}"
         p:connectionTimeout="%{idp.httpclient.connectionTimeout:-1}"
         p:maxCacheEntries="%{idp.httpclient.memorycaching.maxCacheEntries:50}"
         p:maxCacheEntrySize="%{idp.httpclient.memorycaching.maxCacheEntrySize:1048576}" />
         
-    <bean id="shibboleth.TrustEngineTLSSocketFactory" 
+    <bean id="shibboleth.SecurityEnhancedTLSSocketFactory" name="shibboleth.TrustEngineTLSSocketFactory" 
         lazy-init="true"
-        class="org.opensaml.security.httpclient.impl.TrustEngineTLSSocketFactory">

[... 53 lines stripped ...]