[java-identity-provider] branch master updated: IDP-1170 - REST DataConnector
Scott Cantor
cantor.2 at osu.edu
Fri Aug 11 13:19:40 EDT 2017
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5d7a9a52251e5ca9fecc25dc5b128f31f897ad17
The following commit(s) were added to refs/heads/master by this push:
new 5d7a9a5 IDP-1170 - REST DataConnector
5d7a9a5 is described below
commit 5d7a9a52251e5ca9fecc25dc5b128f31f897ad17
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Aug 11 13:19:38 2017 -0400
IDP-1170 - REST DataConnector
https://issues.shibboleth.net/jira/browse/IDP-1170
Add client TLS shortcut.
---
.../dc/http/impl/HTTPDataConnectorParser.java | 23 ++++++++++++++--
.../dc/http/HTTPDataConnectorParserTest.java | 32 ++++++++++++++++++++++
.../attribute/resolver/spring/dc/http/client.crt | 14 ++++++++++
.../attribute/resolver/spring/dc/http/client.key | 15 ++++++++++
.../http/http-attribute-resolver-v2-clientcert.xml | 19 +++++++++++++
.../resolver/spring/dc/http/spring-beans.xml | 8 ++++++
.../factory/BasicX509CredentialFactoryBean.java | 5 ++++
7 files changed, 113 insertions(+), 3 deletions(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java
index dcd0b09..55cc330 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/impl/HTTPDataConnectorParser.java
@@ -30,6 +30,7 @@ import net.shibboleth.idp.attribute.resolver.dc.http.impl.TemplatedURLBuilder;
import net.shibboleth.idp.attribute.resolver.spring.dc.AbstractDataConnectorParser;
import net.shibboleth.idp.attribute.resolver.spring.dc.impl.CacheConfigParser;
import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
+import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
import net.shibboleth.idp.profile.spring.factory.StaticExplicitKeyFactoryBean;
import net.shibboleth.idp.profile.spring.factory.StaticPKIXFactoryBean;
import net.shibboleth.idp.profile.spring.relyingparty.metadata.ScriptTypeBeanParser;
@@ -302,14 +303,14 @@ public class HTTPDataConnectorParser extends AbstractDataConnectorParser {
*/
@Nullable public BeanDefinition buildHttpClientSecurityParams(@Nullable final String id) {
BeanDefinitionBuilder builder = null;
- final String certificate =
+ final String serverCertificate =
StringSupport.trimOrNull(configElement.getAttributeNS(null, "serverCertificate"));
- if (certificate != null) {
+ if (serverCertificate != null) {
log.debug("Auto-configuring connector {} with a server certificate to authenticate", id);
builder = BeanDefinitionBuilder.genericBeanDefinition(HttpClientSecurityParameters.class);
final BeanDefinitionBuilder explicitTrust =
BeanDefinitionBuilder.genericBeanDefinition(StaticExplicitKeyFactoryBean.class);
- explicitTrust.addPropertyValue("certificates", certificate);
+ explicitTrust.addPropertyValue("certificates", serverCertificate);
builder.addPropertyValue("tLSTrustEngine", explicitTrust.getBeanDefinition());
}
@@ -330,6 +331,22 @@ public class HTTPDataConnectorParser extends AbstractDataConnectorParser {
}
}
+ final String clientPrivateKey =
+ StringSupport.trimOrNull(configElement.getAttributeNS(null, "clientPrivateKey"));
+ final String clientCertificate =
+ StringSupport.trimOrNull(configElement.getAttributeNS(null, "clientCertificate"));
+ if (clientPrivateKey != null && clientCertificate != null) {
+ log.debug("Auto-configuring connector {} with client TLS credential", id);
+ if (builder == null) {
+ builder = BeanDefinitionBuilder.genericBeanDefinition(HttpClientSecurityParameters.class);
+ }
+ final BeanDefinitionBuilder credentialBuilder =
+ BeanDefinitionBuilder.genericBeanDefinition(BasicX509CredentialFactoryBean.class);
+ credentialBuilder.addPropertyValue("privateKey", clientPrivateKey);
+ credentialBuilder.addPropertyValue("certificates", clientCertificate);
+ builder.addPropertyValue("clientTLSCredential", credentialBuilder.getBeanDefinition());
+ }
+
return builder != null ? builder.getBeanDefinition() : null;
}
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/HTTPDataConnectorParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/HTTPDataConnectorParserTest.java
index 548268c..c2fac3e 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/HTTPDataConnectorParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/http/HTTPDataConnectorParserTest.java
@@ -261,6 +261,38 @@ public class HTTPDataConnectorParserTest {
connector.resolve(context);
}
+ @Test public void v2ClientCertificate() throws Exception {
+
+ // Could use a better test for this end to end.
+
+ final MockPropertySource propSource = singletonPropertySource("serviceURL", TEST_URL);
+ propSource.setProperty("scriptPath", (isV8() ? SCRIPT_PATH_V8 : SCRIPT_PATH) + "test.js");
+ propSource.setProperty("key", "net/shibboleth/idp/attribute/resolver/spring/dc/http/client.key");
+ propSource.setProperty("certificate", "net/shibboleth/idp/attribute/resolver/spring/dc/http/client.crt");
+
+ final HTTPDataConnector connector =
+ getDataConnector(propSource,
+ "net/shibboleth/idp/attribute/resolver/spring/dc/http/http-attribute-resolver-v2-clientcert.xml");
+ Assert.assertNotNull(connector);
+
+ final AttributeResolutionContext context =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+
+ connector.resolve(context);
+
+ final Map<String,IdPAttribute> attrs = connector.resolve(context);
+
+ Assert.assertEquals(attrs.size(), 2);
+
+ Assert.assertEquals(attrs.get("foo").getValues().size(), 1);
+ Assert.assertEquals(attrs.get("foo").getValues().get(0).getValue(), "foo1");
+
+ Assert.assertEquals(attrs.get("bar").getValues().size(), 2);
+ Assert.assertEquals(attrs.get("bar").getValues().get(0).getValue(), "bar1");
+ Assert.assertEquals(attrs.get("bar").getValues().get(1).getValue(), "bar2");
+ }
+
@Test public void hybridConfig() throws Exception {
final MockPropertySource propSource = singletonPropertySource("serviceURL", TEST_URL);
propSource.setProperty("scriptPath", (isV8() ? SCRIPT_PATH_V8 : SCRIPT_PATH) + "test.js");
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/client.crt b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/client.crt
new file mode 100644
index 0000000..a2bdba4
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/client.crt
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICDTCCAXYCCQC22l+nTFYy/zANBgkqhkiG9w0BAQUFADBLMRMwEQYKCZImiZPy
+LGQBGRYDbmV0MRowGAYKCZImiZPyLGQBGRYKc2hpYmJvbGV0aDEYMBYGA1UEAxMP
+aWRwLWxkYXAtY2xpZW50MB4XDTEzMDkxOTA0NDg0OFoXDTIzMDkxNzA0NDg0OFow
+SzETMBEGCgmSJomT8ixkARkWA25ldDEaMBgGCgmSJomT8ixkARkWCnNoaWJib2xl
+dGgxGDAWBgNVBAMTD2lkcC1sZGFwLWNsaWVudDCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEAoKBYEwcn0PzvHqP0dCblSP4cStw64b1LCoIj5n4avQFq/Sg6Xg5x
++ylETiw0pT52nAzuP6zWvwK/v0kJYN291XvFCMk4UHNvquG1CvfP/WXqF7RqEY2M
+sCk+VpuU2oy7tLNIwq+sIKLNPC8Q1SkqtI/m+As4ttup0MBMPYfwOYcCAwEAATAN
+BgkqhkiG9w0BAQUFAAOBgQBATKJh82zRv6PmdC6F0I7CbbN29cqNfQS4l6Tor4qh
+OxzyGlf4ipt0ABPpl/Ya9EyyU5pmdZLRXiIC52RvTRqhkgl9r+n9eQOJEwCTQuRN
+bBCAV2pcgLknNbPHmpKUGgWtYGDAchmRrGfg+nRnj+X3Pt55a1CuGpuDuDVzZl73
+2g==
+-----END CERTIFICATE-----
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/client.key b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/client.key
new file mode 100644
index 0000000..1ef42df
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/client.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQCgoFgTByfQ/O8eo/R0JuVI/hxK3DrhvUsKgiPmfhq9AWr9KDpe
+DnH7KUROLDSlPnacDO4/rNa/Ar+/SQlg3b3Ve8UIyThQc2+q4bUK98/9ZeoXtGoR
+jYywKT5Wm5TajLu0s0jCr6wgos08LxDVKSq0j+b4Czi226nQwEw9h/A5hwIDAQAB
+AoGAboqq0j2Ea1EGhwGyhBUYiklG00YIx73r3Ml/R2rVn+lP5fU/ZedvDbhyp5HI
+kUgRfIdxlyStjTqpF01+RMmVkDShWkF4LZ+VWcVNL1NBU5rZhk4boQxHfeG6Xc45
+vofAdz5YR+w8eIkoGo1ZbzbScx17HN/xnQYfqFmMTta2l4ECQQDRhPERyOus1YUC
+MaEGjXEp2PmKDfxj1yzm8Vn55Wf7pbT9zS4k8CIwRDTyObMbktgvGu0B5VwEsZ/9
+1XCfiu5hAkEAxEKqHoVGMdnKisyHYDMmR+l4TYRxqPCQrnkUsc7MLsKcyFdXzjhU
+GcgFvgbXrEv2H/ymisgVGwhRrHiuwycg5wJAPq+f0MpkeNmJahafLu6ypOqd/ogg
+s151uMMNQI86hTgW5ri0zahrEjXWAYLx65YLyEwuDRsqZN0gGTn68EEJAQJALuVv
+GRPnjgnop/nvb0FJqG1VXdCECEZTjB1KoKI1kAbYx9Z3GMPE9NQi6yFfb8BG86W/
+dfIReQAn4/qCaAd1iQJBAKQPV3DSh7n13+gtnaAnXPhd1WOXNrfvjGetNV/RV3JL
+hxPWpoWR+kaNulD+obePk4VNKo1sDgq+sMxjt2YsMmk=
+-----END RSA PRIVATE KEY-----
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/http-attribute-resolver-v2-clientcert.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/http-attribute-resolver-v2-clientcert.xml
new file mode 100644
index 0000000..75b8ffc
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/http-attribute-resolver-v2-clientcert.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AttributeResolver
+ xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
+
+ <DataConnector id="myHTTP" xsi:type="HTTP"
+ httpClientRef="ClientTLSHttpClient"
+ clientPrivateKey="%{key}"
+ clientCertificate="%{certificate}">
+
+ <URLTemplate>%{serviceURL}</URLTemplate>
+
+ <ResponseMapping>
+ <ScriptFile>%{scriptPath}</ScriptFile>
+ </ResponseMapping>
+
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/spring-beans.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/spring-beans.xml
index 45c4b20..96e995c 100644
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/spring-beans.xml
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/http/spring-beans.xml
@@ -16,6 +16,14 @@
class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean"
p:TLSSocketFactory-ref="SecurityEnhancedTLSSocketFactory" />
+ <bean id="ClientTLSSocketFactory"
+ class="org.opensaml.security.httpclient.impl.SecurityEnhancedHttpClientSupport"
+ factory-method="buildTLSSocketFactoryWithClientTLSOnly" />
+
+ <bean id="ClientTLSHttpClient"
+ class="net.shibboleth.idp.profile.spring.relyingparty.metadata.HttpClientFactoryBean"
+ p:TLSSocketFactory-ref="ClientTLSSocketFactory" />
+
<bean id="BadProtocolParameters"
class="org.opensaml.security.httpclient.HttpClientSecurityParameters"
p:TLSProtocols="SSLv3" />
diff --git a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java
index 4643156..bdb8817 100644
--- a/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java
+++ b/idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/factory/BasicX509CredentialFactoryBean.java
@@ -172,6 +172,11 @@ public class BasicX509CredentialFactoryBean extends AbstractX509CredentialFactor
/** {@inheritDoc} */
@Override @Nonnull protected List<X509Certificate> getCertificates() {
+
+ if (certificateResources == null) {
+ return Collections.emptyList();
+ }
+
final List<X509Certificate> certificates = new LazyList<>();
for (final Resource r : certificateResources) {
try(InputStream is = r.getInputStream()) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list