[java-identity-provider COMMIT] in /trunk: idp-conf/src/main/resources/conf/saml-nameid.properties idp-conf/src/main/...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Jan 20 17:50:09 2017
New Revision: 8599

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8599&view=rev
Log:
IDP-1111 - Provide a case-insensitive computed persistent ID strategy

https://issues.shibboleth.net/jira/browse/IDP-1111

Modified:
    trunk/idp-conf/src/main/resources/conf/saml-nameid.properties
    trunk/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml
    trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ComputedPersistentIdGenerationStrategy.java
    trunk/idp-saml-impl/src/test/java/net/shibboleth/idp/saml/nameid/impl/PersistentSAML2NameIDGeneratorTest.java

Modified: trunk/idp-conf/src/main/resources/conf/saml-nameid.properties
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/saml-nameid.properties?rev=8599&r1=8598&r2=8599&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/saml-nameid.properties	(original)
+++ trunk/idp-conf/src/main/resources/conf/saml-nameid.properties	Fri Jan 20 17:50:09 2017
@@ -24,6 +24,8 @@
 # Do *NOT* share the salt with other people, it's like divulging your private key.
 #idp.persistentId.algorithm = SHA
 #idp.persistentId.salt = changethistosomethingrandom
+# BASE64 will match V2 values, we recommend BASE32 encoding for new installs.
+idp.persistentId.encoding = BASE32
 
 # To use a database, use shibboleth.StoredPersistentIdGenerator
 #idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator

Modified: trunk/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml?rev=8599&r1=8598&r2=8599&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml	(original)
+++ trunk/idp-conf/src/main/resources/system/conf/saml-nameid-system.xml	Fri Jan 20 17:50:09 2017
@@ -61,7 +61,8 @@
         class="net.shibboleth.idp.saml.nameid.impl.ComputedPersistentIdGenerationStrategy"
         p:salt="%{idp.persistentId.salt:}"
         p:encodedSalt="%{idp.persistentId.encodedSalt:}"
-        p:algorithm="%{idp.persistentId.algorithm:SHA}" />
+        p:algorithm="%{idp.persistentId.algorithm:SHA}"
+        p:encoding="#{ T(net.shibboleth.idp.saml.nameid.impl.ComputedPersistentIdGenerationStrategy.Encoding).%{idp.persistentId.encoding:BASE64} }" />
 
     <bean id="shibboleth.StoredPersistentIdGenerator" lazy-init="true"
         class="net.shibboleth.idp.saml.nameid.impl.StoredPersistentIdGenerationStrategy"

Modified: trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ComputedPersistentIdGenerationStrategy.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ComputedPersistentIdGenerationStrategy.java?rev=8599&r1=8598&r2=8599&view=diff
==============================================================================
--- trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ComputedPersistentIdGenerationStrategy.java	(original)
+++ trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/nameid/impl/ComputedPersistentIdGenerationStrategy.java	Fri Jan 20 17:50:09 2017
@@ -25,6 +25,7 @@
 
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+import net.shibboleth.utilities.java.support.codec.Base32Support;
 import net.shibboleth.utilities.java.support.codec.Base64Support;
 import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -39,6 +40,10 @@
 /**
  * The basis of a {@link PersistentIdGenerationStrategy} that generates a unique ID by computing the hash of
  * a given attribute value, the entity ID of the inbound message issuer, and a provided salt.
+ * 
+ * <p>The original implementation and values in common use relied on base64 encoding of the result,
+ * but due to discovery of the lack of appropriate case handling of identifiers by applications, the
+ * ability to use base32 has been added to eliminate the possibility of case conflicts.</p> 
  */
 public class ComputedPersistentIdGenerationStrategy extends AbstractInitializableComponent
         implements PersistentIdGenerationStrategy {
@@ -46,15 +51,28 @@
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(ComputedPersistentIdGenerationStrategy.class);
 
+    /** Post-digest encoding types. */
+    public enum Encoding {
+        /** Use Base64 encoding. */
+        BASE64,
+        
+        /** Use Base32 encoding. */
+        BASE32,
+    };
+
     /** Salt used when computing the ID. */
     @NonnullAfterInit private byte[] salt;
 
     /** JCE digest algorithm name to use. */

[... 102 lines stripped ...]