[java-identity-provider] branch master updated: IDP-1275 - Deferred decryption of private key
Scott Cantor
cantor.2 at osu.edu
Wed Aug 1 15:27:40 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=138d740f07dcccb0b3b2f58417d157004b76d299
The following commit(s) were added to refs/heads/master by this push:
new 138d740 IDP-1275 - Deferred decryption of private key
138d740 is described below
commit 138d740f07dcccb0b3b2f58417d157004b76d299
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Aug 1 15:27:37 2018 -0400
IDP-1275 - Deferred decryption of private key
https://issues.shibboleth.net/jira/browse/IDP-1275
Some template nits, add one-time behavior to flow.
---
.../admin/OneTimeAdministrativeFlowDescriptor.java | 64 ++++++++++++++++++++++
.../main/resources/conf/admin/general-admin.xml | 2 +-
.../resources/system/conf/general-admin-system.xml | 7 ++-
.../system/flows/admin/unlock-keys-flow.xml | 8 ++-
.../src/main/resources/views/admin/unlock-keys.vm | 2 +-
5 files changed, 79 insertions(+), 4 deletions(-)
diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/admin/OneTimeAdministrativeFlowDescriptor.java b/idp-admin-api/src/main/java/net/shibboleth/idp/admin/OneTimeAdministrativeFlowDescriptor.java
new file mode 100644
index 0000000..0c9d385
--- /dev/null
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/admin/OneTimeAdministrativeFlowDescriptor.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.admin;
+
+import javax.annotation.Nonnull;
+
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Descriptor for an administrative flow that tracks whether it's been run or not to
+ * limit use.
+ *
+ * <p>This is primarily for flows that are used to initialize the system in some fashion.</p>
+ *
+ * @since 3.4.0
+ */
+public class OneTimeAdministrativeFlowDescriptor extends BasicAdministrativeFlowDescriptor {
+
+ /** Execution flag. */
+ private boolean flowExecuted;
+
+ /**
+ * Constructor.
+ *
+ * @param id profile identifier
+ */
+ public OneTimeAdministrativeFlowDescriptor(@Nonnull @NotEmpty final String id) {
+ super(id);
+ }
+
+ /**
+ * Get whether the flow has been executed.
+ *
+ * @return execution flag
+ */
+ public boolean isFlowExecuted() {
+ return flowExecuted;
+ }
+
+ /**
+ * Set whether the flow has been executed.
+ *
+ * @param flag flag to set
+ */
+ public void setFlowExecuted(final boolean flag) {
+ flowExecuted = flag;
+ }
+
+}
\ No newline at end of file
diff --git a/idp-conf/src/main/resources/conf/admin/general-admin.xml b/idp-conf/src/main/resources/conf/admin/general-admin.xml
index ca1d877..2abda9f 100644
--- a/idp-conf/src/main/resources/conf/admin/general-admin.xml
+++ b/idp-conf/src/main/resources/conf/admin/general-admin.xml
@@ -62,7 +62,7 @@
<!-- Attended Startup Unlock -->
<!--
- <bean parent="shibboleth.AdminFlow"
+ <bean parent="shibboleth.OneTimeAdminFlow"
c:id="http://shibboleth.net/ns/profiles/unlock-keys"
p:loggingId="UnlockKeys"
p:authenticated="true"
diff --git a/idp-conf/src/main/resources/system/conf/general-admin-system.xml b/idp-conf/src/main/resources/system/conf/general-admin-system.xml
index 1404dc6..2bc855c 100644
--- a/idp-conf/src/main/resources/system/conf/general-admin-system.xml
+++ b/idp-conf/src/main/resources/system/conf/general-admin-system.xml
@@ -16,13 +16,18 @@
<import resource="../../conf/admin/metrics.xml" />
<import resource="conditional:${idp.home}/conf/admin/unlock-keys.xml" />
- <!-- A parent bean to default some of the flow boilerplate. -->
+ <!-- Parent beans to default some of the flow boilerplate. -->
<bean id="shibboleth.AdminFlow" abstract="true"
class="net.shibboleth.idp.admin.BasicAdministrativeFlowDescriptor"
p:servletRequest-ref="shibboleth.HttpServletRequest"
p:nonBrowserSupported="false" />
+ <bean id="shibboleth.OneTimeAdminFlow" abstract="true"
+ class="net.shibboleth.idp.admin.OneTimeAdministrativeFlowDescriptor"
+ p:servletRequest-ref="shibboleth.HttpServletRequest"
+ p:nonBrowserSupported="false" />
+
<!-- Function for returning custom access control policies for access to metrics. -->
<bean id="shibboleth.metrics.AccessPolicyStrategy" parent="shibboleth.ContextFunctions.Expression"
diff --git a/idp-conf/src/main/resources/system/flows/admin/unlock-keys-flow.xml b/idp-conf/src/main/resources/system/flows/admin/unlock-keys-flow.xml
index 7a25554..ef21d73 100644
--- a/idp-conf/src/main/resources/system/flows/admin/unlock-keys-flow.xml
+++ b/idp-conf/src/main/resources/system/flows/admin/unlock-keys-flow.xml
@@ -20,8 +20,13 @@
<evaluate expression="PostResponsePopulateAuditContext" />
<evaluate expression="'proceed'" />
- <transition on="proceed" to="PromptForPasswords" />
+ <transition on="proceed" to="CheckIfDone" />
</action-state>
+
+ <decision-state id="CheckIfDone">
+ <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).getProfileConfig().isFlowExecuted()"
+ then="end" else="PromptForPasswords" />
+ </decision-state>
<view-state id="PromptForPasswords" view="admin/unlock-keys">
<on-render>
@@ -50,6 +55,7 @@
<end-state id="end" view="admin/unlock-keys">
<on-entry>
+ <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.profile.context.RelyingPartyContext)).getProfileConfig().setFlowExecuted(true)" />
<evaluate expression="WriteAuditLog" />
<evaluate expression="environment" result="requestScope.environment" />
<evaluate expression="opensamlProfileRequestContext" result="requestScope.profileRequestContext" />
diff --git a/idp-conf/src/main/resources/views/admin/unlock-keys.vm b/idp-conf/src/main/resources/views/admin/unlock-keys.vm
index e91123e..3b15f3e 100644
--- a/idp-conf/src/main/resources/views/admin/unlock-keys.vm
+++ b/idp-conf/src/main/resources/views/admin/unlock-keys.vm
@@ -33,7 +33,7 @@
<div class="content">
#if ($state == "end")
<strong>#springMessageText("idp.unlock-keys.complete", "The system is unlocked and ready for use.")</strong>
- <p><a hef="$request.getContextPath()/profile/SAML2/SSO/Unsolicited?providerId=https://sp.example.org/shibboleth">Validation Link</a></p>
+ <p><a href="$request.getContextPath()/profile/SAML2/Unsolicited/SSO?providerId=https://sp.example.org/shibboleth">Validation Link</a></p>
#else
#if ($eventId == "InvalidMessage")
<p class="form-element form-error">
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list