[java-idp-jetty-base] branch 9.4 updated: IDP-1110 - Modify the Jetty SSL context rather than create new

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch 9.4
in repository java-idp-jetty-base.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-jetty-base.git;a=commit;h=aeadb317c8bfb33bebfb7a5e310ebd94e5eb1998

The following commit(s) were added to refs/heads/9.4 by this push:
       new  aeadb31   IDP-1110 - Modify the Jetty SSL context rather than create new
aeadb31 is described below

commit aeadb317c8bfb33bebfb7a5e310ebd94e5eb1998
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Mon Jul 16 19:36:56 2018 -0500

    IDP-1110 - Modify the Jetty SSL context rather than create new
    
    Configuration, for example of allowed protocols and cipher suites,
    should be the same.
---
 .../resources/jetty-base/etc/idp-ssl-context.xml   | 26 +++++++++++++++
 .../resources/jetty-base/etc/jetty-ssl-context.xml | 39 ----------------------
 src/main/resources/jetty-base/modules/idp.mod      |  3 ++
 src/main/resources/jetty-base/start.d/idp.ini      | 17 ++++++++--
 4 files changed, 43 insertions(+), 42 deletions(-)

diff --git a/src/main/resources/jetty-base/etc/idp-ssl-context.xml b/src/main/resources/jetty-base/etc/idp-ssl-context.xml
new file mode 100644
index 0000000..4c729d3
--- /dev/null
+++ b/src/main/resources/jetty-base/etc/idp-ssl-context.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
+<Configure id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
+    <Set name="excludeProtocols">
+      <Array type="String">
+        <Item>SSL</Item>
+        <Item>SSLv2</Item>
+        <Item>SSLv3</Item>
+      </Array>
+    </Set>
+    <Set name="IncludeCipherSuites">
+      <Array type="String">
+        <Item>TLS_ECDHE.*</Item>
+        <Item>TLS_RSA.*</Item>
+      </Array>
+    </Set>
+    <Set name="ExcludeCipherSuites">
+      <Array type="String">
+        <Item>.*NULL.*</Item>
+        <Item>.*RC4.*</Item>
+        <Item>.*MD5.*</Item>
+        <Item>.*DES.*</Item>
+        <Item>.*DSS.*</Item>
+      </Array>
+    </Set>
+</Configure>
\ No newline at end of file
diff --git a/src/main/resources/jetty-base/etc/jetty-ssl-context.xml b/src/main/resources/jetty-base/etc/jetty-ssl-context.xml
deleted file mode 100644
index 00e9d58..0000000
--- a/src/main/resources/jetty-base/etc/jetty-ssl-context.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<?xml version="1.0"?>
-<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
-<Configure id="Server" class="org.eclipse.jetty.server.Server">
-  <!-- ============================================================= -->
-  <!-- TLS context factory without client auth                       -->
-  <!-- ============================================================= -->
-  <New id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
-    <Set name="KeyStorePath"><Property name="jetty.sslContext.keyStorePath" default="../credentials/idp-userfacing.p12" /></Set>
-    <Set name="KeyStoreType"><Property name="jetty.sslContext.keyStoreType" default="PKCS12" /></Set>
-    <Set name="KeyStorePassword"><Property name="jetty.sslContext.keyStorePassword" default="changeit" /></Set>
-    <Set name="EndpointIdentificationAlgorithm"></Set>
-    <Set name="NeedClientAuth"><Property name="jetty.sslContext.needClientAuth" default="false"/></Set>
-    <Set name="WantClientAuth"><Property name="jetty.sslContext.wantClientAuth" default="false"/></Set>
-    <Set name="useCipherSuitesOrder"><Property name="jetty.sslContext.useCipherSuitesOrder" default="true"/></Set>
-    <Set name="renegotiationAllowed">false</Set>
-    <Set name="excludeProtocols">
-      <Array type="String">
-        <Item>SSL</Item>
-        <Item>SSLv2</Item>
-        <Item>SSLv3</Item>
-      </Array>
-    </Set>
-    <Set name="IncludeCipherSuites">
-      <Array type="String">
-        <Item>TLS_ECDHE.*</Item>
-        <Item>TLS_RSA.*</Item>
-      </Array>
-    </Set>
-    <Set name="ExcludeCipherSuites">
-      <Array type="String">
-        <Item>.*NULL.*</Item>
-        <Item>.*RC4.*</Item>
-        <Item>.*MD5.*</Item>
-        <Item>.*DES.*</Item>
-        <Item>.*DSS.*</Item>
-      </Array>
-    </Set>
-  </New>
-</Configure>
\ No newline at end of file
diff --git a/src/main/resources/jetty-base/modules/idp.mod b/src/main/resources/jetty-base/modules/idp.mod
index 601dd45..b7f57c0 100644
--- a/src/main/resources/jetty-base/modules/idp.mod
+++ b/src/main/resources/jetty-base/modules/idp.mod
@@ -16,3 +16,6 @@ ssl
 
 [files]
 tmp/
+
+[xml]
+etc/idp-ssl-context.xml
diff --git a/src/main/resources/jetty-base/start.d/idp.ini b/src/main/resources/jetty-base/start.d/idp.ini
index e22eeaa..fca68a2 100644
--- a/src/main/resources/jetty-base/start.d/idp.ini
+++ b/src/main/resources/jetty-base/start.d/idp.ini
@@ -5,13 +5,24 @@
 --module=idp
 
 ## Keystore file path (relative to $jetty.base)
-# jetty.sslContext.keyStorePath=../credentials/idp-userfacing.p12
+jetty.sslContext.keyStorePath=../credentials/idp-userfacing.p12
+## Truststore file path (relative to $jetty.base)
+jetty.sslContext.trustStorePath=../credentials/idp-userfacing.p12
 
 ## Keystore type
-# jetty.sslContext.keyStoreType=PKCS12
+jetty.sslContext.keyStoreType=PKCS12
+## Truststore type and provider
+jetty.sslContext.trustStoreType=PKCS12
 
 ## Keystore password
-# jetty.sslContext.keyStorePassword=changeit
+jetty.sslContext.keyStorePassword=changeit
+## Truststore password
+jetty.sslContext.trustStorePassword=changeit
+## KeyManager password
+jetty.sslContext.keyManagerPassword=changeit
+
+## Deny SSL renegotiation
+jetty.sslContext.renegotiationAllowed=false
 
 ## Connector host/address to bind to
 # jetty.ssl.host=0.0.0.0

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.