[java-identity-provider] branch master updated: IDP-1196 Add authCert=, authKey= and authKeyPassword= to LDAP connector
Rod Widdowson
rdw at steadingsoftware.com
Sun Aug 27 07:19:20 EDT 2017
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5460ba40f6bc039f800534496cab1963f45b01f3
The following commit(s) were added to refs/heads/master by this push:
new 5460ba4 IDP-1196 Add authCert=, authKey= and authKeyPassword= to LDAP connector
5460ba4 is described below
commit 5460ba40f6bc039f800534496cab1963f45b01f3
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sun Aug 27 12:16:46 2017 +0100
IDP-1196 Add authCert=, authKey= and authKeyPassword= to LDAP connector
https://issues.shibboleth.net/jira/browse/IDP-1196
---
.../dc/ldap/impl/LDAPDataConnectorParser.java | 62 ++++++++++------
.../dc/ldap/LDAPDataConnectorParserTest.java | 50 +++++++++----
.../resolver/ldap-attribute-resolver-v2-nosec.xml | 83 ++++++++++++++++++++++
.../schema/shibboleth-attribute-resolver.xsd | 24 +++++++
4 files changed, 184 insertions(+), 35 deletions(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index bcb5b71..75af157 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -24,25 +24,6 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.xml.namespace.QName;
-import net.shibboleth.ext.spring.util.SpringSupport;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder;
-import net.shibboleth.idp.attribute.resolver.spring.dc.impl.AbstractWarningDataConnectorParser;
-import net.shibboleth.idp.attribute.resolver.spring.dc.impl.CacheConfigParser;
-import net.shibboleth.idp.attribute.resolver.spring.dc.impl.DataConnectorNamespaceHandler;
-import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
-import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
-import net.shibboleth.utilities.java.support.annotation.Duration;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import net.shibboleth.utilities.java.support.xml.AttributeSupport;
-import net.shibboleth.utilities.java.support.xml.ElementSupport;
-import net.shibboleth.utilities.java.support.xml.XMLConstants;
-
import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.ConnectionConfig;
import org.ldaptive.Credential;
@@ -73,6 +54,25 @@ import org.springframework.beans.factory.support.ManagedMap;
import org.springframework.beans.factory.xml.ParserContext;
import org.w3c.dom.Element;
+import net.shibboleth.ext.spring.util.SpringSupport;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder;
+import net.shibboleth.idp.attribute.resolver.spring.dc.impl.AbstractWarningDataConnectorParser;
+import net.shibboleth.idp.attribute.resolver.spring.dc.impl.CacheConfigParser;
+import net.shibboleth.idp.attribute.resolver.spring.dc.impl.DataConnectorNamespaceHandler;
+import net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverNamespaceHandler;
+import net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean;
+import net.shibboleth.utilities.java.support.annotation.Duration;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
+import net.shibboleth.utilities.java.support.primitive.StringSupport;
+import net.shibboleth.utilities.java.support.xml.AttributeSupport;
+import net.shibboleth.utilities.java.support.xml.ElementSupport;
+import net.shibboleth.utilities.java.support.xml.XMLConstants;
+
/**
* Bean definition Parser for a {@link LDAPDataConnector}. <em>Note</em> That parsing the V2 configuration will set some
* beans with hard wired defaults. See {@link #doParseV2(Element, ParserContext, BeanDefinitionBuilder)}.
@@ -383,7 +383,29 @@ public class LDAPDataConnectorParser extends AbstractWarningDataConnectorParser
new QName(DataConnectorNamespaceHandler.NAMESPACE, "StartTLSAuthenticationCredential"));
authElements.addAll(ElementSupport.getChildElements(configElement,
new QName(AttributeResolverNamespaceHandler.NAMESPACE, "StartTLSAuthenticationCredential")));
- if (!authElements.isEmpty()) {
+ final String authKey =
+ StringSupport.trimOrNull(AttributeSupport.getAttributeValue(configElement, null, "authKey"));
+ final String authCert =
+ StringSupport.trimOrNull(AttributeSupport.getAttributeValue(configElement, null, "authCert"));
+
+ if (authKey != null|| authCert != null) {
+
+ if (!authElements.isEmpty()) {
+ log.warn("{} StartTLSAuthenticationCredential and"
+ + " authKey/authCert= are incompatible. authCert/authKey used.",
+ getLogPrefix());
+ }
+ final BeanDefinitionBuilder authCred =
+ BeanDefinitionBuilder.genericBeanDefinition(BasicX509CredentialFactoryBean.class);
+ authCred.addPropertyValue("certificateResource", authCert);
+ authCred.addPropertyValue("privateKeyResource", authKey);
+ authCred.addPropertyValue("privateKeyPassword",
+ AttributeSupport.getAttributeValue(configElement, null, "authKeyPassword"));
+
+
+ result.addPropertyValue("authCredential", authCred.getBeanDefinition());
+
+ } else if (!authElements.isEmpty()) {
if (authElements.size() > 1) {
log.warn("{} Too many StartTLSAuthenticationCredential elements in {};"
+ " only the first has been consulted", getLogPrefix(),
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
index dded785..f7bf71a 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
@@ -24,21 +24,6 @@ import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
-import net.shibboleth.ext.spring.config.DurationToLongConverter;
-import net.shibboleth.ext.spring.config.StringToIPRangeConverter;
-import net.shibboleth.ext.spring.config.StringToResourceConverter;
-import net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext;
-import net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader;
-import net.shibboleth.idp.attribute.IdPAttribute;
-import net.shibboleth.idp.attribute.resolver.ResolutionException;
-import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
-import net.shibboleth.idp.attribute.resolver.dc.impl.ExecutableSearchBuilder;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector;
-import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy;
-import net.shibboleth.idp.attribute.resolver.spring.dc.ldap.impl.LDAPDataConnectorParser;
-import net.shibboleth.idp.saml.impl.TestSources;
-
import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.ConnectionConfig;
import org.ldaptive.DefaultConnectionFactory;
@@ -76,6 +61,21 @@ import com.unboundid.util.ssl.KeyStoreKeyManager;
import com.unboundid.util.ssl.SSLUtil;
import com.unboundid.util.ssl.TrustStoreTrustManager;
+import net.shibboleth.ext.spring.config.DurationToLongConverter;
+import net.shibboleth.ext.spring.config.StringToIPRangeConverter;
+import net.shibboleth.ext.spring.config.StringToResourceConverter;
+import net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext;
+import net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader;
+import net.shibboleth.idp.attribute.IdPAttribute;
+import net.shibboleth.idp.attribute.resolver.ResolutionException;
+import net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext;
+import net.shibboleth.idp.attribute.resolver.dc.impl.ExecutableSearchBuilder;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector;
+import net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy;
+import net.shibboleth.idp.attribute.resolver.spring.dc.ldap.impl.LDAPDataConnectorParser;
+import net.shibboleth.idp.saml.impl.TestSources;
+
/** Test for {@link LDAPDataConnectorParser}. */
public class LDAPDataConnectorParserTest {
@@ -165,7 +165,27 @@ public class LDAPDataConnectorParserTest {
Assert.assertNotNull(attrs);
Assert.assertNotNull(attrs.get("entryDN"));
}
+
+ @Test public void v2NoSec() throws Exception {
+ final LDAPDataConnector dataConnector =
+ getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-nosec.xml"});
+ Assert.assertNotNull(dataConnector);
+ doTest(dataConnector);
+ final StringAttributeValueMappingStrategy mappingStrategy =
+ (StringAttributeValueMappingStrategy) dataConnector.getMappingStrategy();
+ Assert.assertEquals(mappingStrategy.getResultRenamingMap().size(), 1);
+ Assert.assertEquals(mappingStrategy.getResultRenamingMap().get("homephone"), "phonenumber");
+
+ dataConnector.initialize();
+ final AttributeResolutionContext context =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+ final Map<String, IdPAttribute> attrs = dataConnector.resolve(context);
+ Assert.assertNotNull(attrs);
+ Assert.assertNotNull(attrs.get("entryDN"));
+ }
+
@Test public void v2ResolverOtherDups() throws Exception {
final LDAPDataConnector dataConnector =
getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-multi.xml",
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-nosec.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-nosec.xml
new file mode 100644
index 0000000..9d4b150
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-nosec.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AttributeResolver xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="urn:mace:shibboleth:2.0:security"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
+ urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">
+
+ <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
+ ldapURL="ldap://localhost:10389"
+ baseDN="ou=people,dc=shibboleth,dc=net"
+ principal="cn=Directory Manager"
+ principalCredential="password"
+ useStartTLS="true"
+ searchTimeLimit="PT7S"
+ noResultIsError="true"
+ multipleResultsIsError="true"
+ noRetryDelay="PT5M"
+ trustFile="net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap.crt"
+ authKey="src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/client.key"
+ authCert="src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/client.crt"
+ connectTimeout="PT2S"
+ responseTimeout="PT4S">
+
+ <FailoverDataConnector ref="2123"/>
+
+ <ResultCache elementTimeToLive="PT10S" maximumCachedElements="25"/>
+
+ <Column columnName="homephone" attributeID="phonenumber" />
+
+ <Dependency ref="321"/>
+
+ <ConnectionPool
+ minPoolSize="5"
+ maxPoolSize="10"
+ blockWaitTime="PT5S"
+ expirationTime="PT10M"
+ validatePeriodically="true"
+ validateTimerPeriod="PT15M"
+ validateDN="dc=shibboleth,dc=net"
+ validateFilter="(ou=people)"
+ failFastInitialize="false" />
+
+
+ <StartTLSAuthenticationCredential xsi:type="sec:X509ResourceBacked" id="IdPtoLDAPCredential">
+ <sec:PrivateKey>src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/client.key</sec:PrivateKey>
+ <sec:Certificate>src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/client.crt</sec:Certificate>
+ </StartTLSAuthenticationCredential>
+ <Dependency ref="321"/>
+
+ <LDAPProperty name="name2" value="value2"/>
+
+ <ReturnAttributes>a b g t</ReturnAttributes>
+
+ <LDAPProperty name="name1" value="value1"/>
+
+ <ReturnAttributes>a b g t</ReturnAttributes>
+
+ <FilterTemplate>
+ <![CDATA[
+ (uid=${resolutionContext.principal})
+ ]]>
+ </FilterTemplate>
+
+ <ResultCache maximumCachedElements="20"/>
+
+ <FilterTemplate>
+ <![CDATA[
+ (uid=${resolutionContext.principal})
+ ]]>
+ </FilterTemplate>
+
+ <ConnectionPool
+ minPoolSize="5"
+ maxPoolSize="10"
+ blockWaitTime="PT5S"
+ expirationTime="PT10M"
+ validatePeriodically="true"
+ validateTimerPeriod="PT15M"
+ validateDN="dc=shibboleth,dc=net"
+ validateFilter="(ou=people)"
+ failFastInitialize="false" />
+
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index ed0e360..8b0f923 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -927,6 +927,7 @@
<annotation>
<documentation>
The X.509 trust information to use when connecting to the directory over LDAPS or startTLS.
+ DEPRECATED in 3.4 Use trustFile=
</documentation>
</annotation>
</element>
@@ -934,6 +935,7 @@
<annotation>
<documentation>
The X.509 client authentication information to use when connecting to the directory over LDAPS or startTLS.
+ DEPRECATED in 3.4 Use authCert= and authKey
</documentation>
</annotation>
</element>
@@ -1098,6 +1100,28 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="authCert" type="string">
+ <annotation>
+ <documentation>
+ Path to a file with the X.509 trust client authentication certificate to use when connecting to the directory over LDAPS or startTLS
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="authKey" type="string">
+ <annotation>
+ <documentation>
+ Path to a file with the X.509 trust client authentication key to use when connecting to the directory over LDAPS or startTLS
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="authKeyPassword" type="string">
+ <annotation>
+ <documentation>
+ Password for the supplied authKey
+ </documentation>
+ </annotation>
+ </attribute>
+
</extension>
</complexContent>
</complexType>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list