[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/idp.properties idp-conf/src/main/resource...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Dec  9 20:57:08 2016
New Revision: 8579

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8579&view=rev
Log:
IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.

https://issues.shibboleth.net/jira/browse/IDP-627

Install response-munging filter and add a hook for HSTS.

Modified:
    trunk/idp-conf/src/main/resources/conf/idp.properties
    trunk/idp-conf/src/main/resources/system/conf/global-system.xml
    trunk/idp-parent/pom.xml
    trunk/idp-war/src/main/webapp/WEB-INF/web.xml

Modified: trunk/idp-conf/src/main/resources/conf/idp.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/idp.properties?rev=8579&r1=8578&r2=8579&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/idp.properties	(original)
+++ trunk/idp-conf/src/main/resources/conf/idp.properties	Fri Dec  9 20:57:08 2016
@@ -13,6 +13,9 @@
 #idp.cookie.domain =
 #idp.cookie.path =
 #idp.cookie.maxAge = 31536000
+
+# HSTS response header policy
+#idp.hsts.maxAge = 0
 
 # Set the location of user-supplied web flow definitions
 #idp.webflows = %{idp.home}/flows

Modified: trunk/idp-conf/src/main/resources/system/conf/global-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/global-system.xml?rev=8579&r1=8578&r2=8579&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/global-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/global-system.xml	Fri Dec  9 20:57:08 2016
@@ -132,6 +132,20 @@
     <bean id="shibboleth.HttpServletRequest" class="net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletRequestProxy" />
     <bean id="shibboleth.HttpServletResponse" class="net.shibboleth.utilities.java.support.net.ThreadLocalHttpServletResponseProxy" />
 
+    <bean id="shibboleth.DefaultResponseHeaderMap"
+            class="org.springframework.beans.factory.config.MapFactoryBean">
+        <property name="sourceMap">
+            <map>
+                <entry key="Strict-Transport-Security" value="max-age=%{idp.hsts.maxAge:0}" />
+            </map>
+        </property>
+    </bean>
+
+    <bean id="shibboleth.ResponseHeaderFilter"
+        class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter"
+        p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
+        p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />
+
     <bean id="shibboleth.BuilderFactory" factory-method="getBuilderFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
     <bean id="shibboleth.MarshallerFactory" factory-method="getMarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
     <bean id="shibboleth.UnmarshallerFactory" factory-method="getUnmarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />

Modified: trunk/idp-parent/pom.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-parent/pom.xml?rev=8579&r1=8578&r2=8579&view=diff
==============================================================================
--- trunk/idp-parent/pom.xml	(original)
+++ trunk/idp-parent/pom.xml	Fri Dec  9 20:57:08 2016
@@ -65,7 +65,7 @@
         <duoweb.version>1.1</duoweb.version>
         <u2flib.version>0.16.0</u2flib.version>
         <idwsfconsumer.version>1.0.0</idwsfconsumer.version>
-        <java-support.version>7.3.1-SNAPSHOT</java-support.version>
+        <java-support.version>7.4.0-SNAPSHOT</java-support.version>
         <opensaml.groupId>org.opensaml</opensaml.groupId>
         <opensaml.version>3.4.0-SNAPSHOT</opensaml.version>
         <spring-extensions.version>5.3.1-SNAPSHOT</spring-extensions.version>

Modified: trunk/idp-war/src/main/webapp/WEB-INF/web.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-war/src/main/webapp/WEB-INF/web.xml?rev=8579&r1=8578&r2=8579&view=diff
==============================================================================
--- trunk/idp-war/src/main/webapp/WEB-INF/web.xml	(original)
+++ trunk/idp-war/src/main/webapp/WEB-INF/web.xml	Fri Dec  9 20:57:08 2016
@@ -44,6 +44,15 @@
     <filter>
         <filter-name>CookieBufferingFilter</filter-name>
         <filter-class>net.shibboleth.utilities.java.support.net.CookieBufferingFilter</filter-class>
+    </filter>
+    <!-- Allows control of response headers from within Spring beans. -->
+    <filter>
+        <filter-name>DynamicResponseHeaderFilter</filter-name>
+        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
+        <init-param>
+            <param-name>targetBeanName</param-name>
+            <param-value>shibboleth.ResponseHeaderFilter</param-value>
+        </init-param>

[... 15 lines stripped ...]