[java-identity-provider COMMIT] in /trunk/idp-conf/src: main/resources/conf/cas-protocol.xml main/resources/system/co...

[noreply at shibboleth.net]

Author: serac
Date: Wed Aug 24 09:18:27 2016
New Revision: 8349

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8349&view=rev
Log:
IDP-1018 Facilitate switching TicketService impls.

https://issues.shibboleth.net/jira/browse/IDP-1018
Provide mechanism for easily switching between new default TicketService
and previous one.

Modified:
    trunk/idp-conf/src/main/resources/conf/cas-protocol.xml
    trunk/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ProxyFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ProxyValidateFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/SamlValidateFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ServiceValidateFlowTest.java
    trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/ValidateFlowTest.java
    trunk/idp-conf/src/test/resources/test/test-cas-error-beans.xml

Modified: trunk/idp-conf/src/main/resources/conf/cas-protocol.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/cas-protocol.xml?rev=8349&r1=8348&r2=8349&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/cas-protocol.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/cas-protocol.xml	Wed Aug 24 09:18:27 2016
@@ -36,6 +36,27 @@
     </bean>
 
     <!--
+       | The default ticket service as of 3.3.0 serializes ticket data into the opaque section of the ticket ID
+       | for service tickets and proxy tickets. Proxy-granting tickets still require server-side storage, and
+       | a StorageService defined by the idp.cas.StorageService is used. Thus for deployers that do not require
+       | CAS proxy capabilities, no stateful storage mechanism is required; that means no memcached or database
+       | is required for HA deployments that want CAS (without proxy) support. A notable limitation of the new
+       | component is that the one-time use feature of service and proxy tickets is not available due to the lack
+       | of a ticket-tracking mechanism. Instead, tickets expire when their expiration period is exceeded.
+       | If this limitation is of concern, one may consider decreasing ticketValidityPeriod on the profile
+       | configuration from the default 15000ms.
+       -->
+    <alias name="encodingTicketService" alias="cas.TicketService" />
+
+    <!--
+       | Uncomment the following element and comment out the above to enable the previous default ticket service
+       | that uses a StorageService for ticket persistence. Use this if the one-time use limitation of
+       | EncodingTicketService is problematic and can't be mitigated by decreasing ticketValidityPeriod.
+       -->
+    <!--<alias name="simpleTicketService" alias="cas.TicketService" /> -->
+
+
+    <!--
        | Advanced CAS configuration.
        |
        | Override default CAS components by creating aliases to custom components where the alias

Modified: trunk/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml?rev=8349&r1=8348&r2=8349&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/cas-protocol-system.xml	Wed Aug 24 09:18:27 2016
@@ -10,12 +10,16 @@
 	   default-init-method="initialize"
        default-destroy-method="destroy">
 
-    <import resource="../../conf/cas-protocol.xml" />
 
-    <bean id="cas.TicketService" class="net.shibboleth.idp.cas.ticket.impl.EncodingTicketService"
+    <bean id="simpleTicketService" class="net.shibboleth.idp.cas.ticket.impl.SimpleTicketService"
+          c:service-ref="#{'%{idp.cas.StorageService:shibboleth.StorageService}'.trim()}" />
+
+    <bean id="encodingTicketService" class="net.shibboleth.idp.cas.ticket.impl.EncodingTicketService"
           c:service-ref="#{'%{idp.cas.StorageService:shibboleth.StorageService}'.trim()}"
           c:sealer-ref="shibboleth.DataSealer"/>
 
     <bean id="cas.ProxyAuthenticator" class="net.shibboleth.idp.cas.proxy.impl.HttpClientProxyAuthenticator" />
 
+    <import resource="../../conf/cas-protocol.xml" />
+
 </beans>

Modified: trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/test/java/net/shibboleth/idp/test/flows/cas/LoginFlowInitialAuthnTest.java?rev=8349&r1=8348&r2=8349&view=diff
==============================================================================

[... 160 lines stripped ...]