[java-identity-provider COMMIT] in /trunk/idp-conf/src/main/resources/system: conf/saml-binding-config.xml flows/logo...

[noreply at shibboleth.net]

Author: scantor
Date: Sat Oct 31 18:07:14 2015
New Revision: 7914

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7914&view=rev
Log:
Conditionalize outbound XML signing based on binding capability.

Modified:
    trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml
    trunk/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml1/artifact-resolution-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml1/attribute-query-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml1/sso-abstract-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/artifact-resolution-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/attribute-query-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/slo-front-abstract-beans.xml
    trunk/idp-conf/src/main/resources/system/flows/saml/saml2/sso-abstract-beans.xml

Modified: trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml?rev=7914&r1=7913&r2=7914&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/saml-binding-config.xml	Sat Oct 31 18:07:14 2015
@@ -38,18 +38,18 @@
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
             p:encoderBeanId="shibboleth.Encoders.SAML2PostEncoder" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
-            p:encoderBeanId="shibboleth.Encoders.SAML2PostSimpleSignEncoder" />
+            p:encoderBeanId="shibboleth.Encoders.SAML2PostSimpleSignEncoder" p:signatureCapable="true" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
             p:encoderBeanId="shibboleth.Encoders.SAML2ArtifactEncoder" p:artifact="true" />
     </util:list>
 
     <util:list id="shibboleth.OutgoingSAML2SLOBindings">
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-            p:encoderBeanId="shibboleth.Encoders.SAML2RedirectEncoder" />
+            p:encoderBeanId="shibboleth.Encoders.SAML2RedirectEncoder" p:signatureCapable="true" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
             p:encoderBeanId="shibboleth.Encoders.SAML2PostEncoder" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
-            p:encoderBeanId="shibboleth.Encoders.SAML2PostSimpleSignEncoder" />
+            p:encoderBeanId="shibboleth.Encoders.SAML2PostSimpleSignEncoder" p:signatureCapable="true" />
         <bean parent="shibboleth.BindingDescriptor" p:id="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
             p:encoderBeanId="shibboleth.Encoders.SAML2ArtifactEncoder" p:artifact="true" />
     </util:list>

Modified: trunk/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml?rev=7914&r1=7913&r2=7914&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/flows/logout/propagation/saml2-beans.xml	Sat Oct 31 18:07:14 2015
@@ -63,11 +63,20 @@
     <bean id="shibboleth.PreEncodeMessageHandler"
             class="org.opensaml.messaging.handler.impl.BasicMessageHandlerChain" scope="prototype">
         <property name="handlers">
-            <util:list>
+            <list>
                 <bean class="org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler" scope="prototype"/>
                 <bean class="org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler" scope="prototype"/>
-                <bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" />
-            </util:list>
+                <bean class="org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler" scope="prototype"
+                        p:signErrorResponses="%{idp.errors.signed:true}">
+                    <property name="activationCondition">
+                        <bean parent="shibboleth.Conditions.NOT">
+                            <constructor-arg>
+                                <bean class="org.opensaml.saml.common.messaging.logic.SignatureCapableBindingPredicate" />
+                            </constructor-arg>
+                        </bean>

[... 219 lines stripped ...]