[java-identity-provider] branch master updated: IDP-1189 Set default key size to be 3072

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6cd098c11961b12577d2f26eec391ecf1ae57c51

The following commit(s) were added to refs/heads/master by this push:
       new  6cd098c   IDP-1189 Set default key size to be 3072
6cd098c is described below

commit 6cd098c11961b12577d2f26eec391ecf1ae57c51
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Jun 29 10:54:09 2018 +0100

    IDP-1189 Set default key size to be 3072
    
    https://issues.shibboleth.net/jira/browse/IDP-1189
    
    But allow it to be controlled from the command line.
---
 idp-distribution/src/main/resources/bin/build.xml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/idp-distribution/src/main/resources/bin/build.xml b/idp-distribution/src/main/resources/bin/build.xml
index 8a69f54..9762548 100644
--- a/idp-distribution/src/main/resources/bin/build.xml
+++ b/idp-distribution/src/main/resources/bin/build.xml
@@ -186,6 +186,11 @@
         <property name="idp.scope" value="${DOMAIN}"/>
     </target>
 
+    <target name="setkeysize" if="idp.set.keysize" depends="checkproperties">
+        <TGT>setkeysize</TGT>
+        <property name="idp.keysize" value="3072"/>
+    </target>
+
     <target name="askscope" if="idp.ask.scope" depends="checkproperties">
         <TGT>askscope</TGT>
         <input message="Attribute Scope:" addproperty="idp.scope" defaultvalue="${DOMAIN}" />
@@ -202,7 +207,7 @@
      KEY MANAGEMENT
     -->
 
-    <target name="genkeys" depends="init, preload, checkproperties, signing-key, encryption-key, backchannel-key, sealer" />
+    <target name="genkeys" depends="init, preload, checkproperties, setkeysize, signing-key, encryption-key, backchannel-key, sealer" />
 
     <target name="checkproperties" depends="gettarget, v2detect, target-properties">
         <TGT>checkproperties</TGT>
@@ -293,6 +298,12 @@
             </and>
         </condition>
 
+        <condition property="idp.set.keysize">
+            <not>
+                <isset property="idp.keysize"/>
+            </not>
+		</condition>
+
         <condition property="idp.write.scope">
             <!-- We write the scope if we set it, ask for it, or if it's supplied -->
             <or>
@@ -416,7 +427,7 @@
         <TGT>signing-key</TGT>
         <echo>Generating Signing Key, CN = ${idp.host.name} URI = ${idp.uri.subject.alt.name} ...</echo>
         <mkdir dir="${idp.target.dir}/credentials"/>
-        <selfsignedcert hostname="${idp.host.name}" privateKeyFile="${idp.target.dir}/credentials/idp-signing.key" certificateFile="${idp.target.dir}/credentials/idp-signing.crt" uriSubjectAltNames="${idp.uri.subject.alt.name}" />
+        <selfsignedcert hostname="${idp.host.name}" privateKeyFile="${idp.target.dir}/credentials/idp-signing.key" certificateFile="${idp.target.dir}/credentials/idp-signing.crt" uriSubjectAltNames="${idp.uri.subject.alt.name}"  keysize="${idp.keysize}"/>
         <echo>...done</echo>
     </target>
 
@@ -424,7 +435,7 @@
         <TGT>encryption-key</TGT>
         <echo>Creating Encryption Key, CN = ${idp.host.name} URI = ${idp.uri.subject.alt.name} ...</echo>
         <mkdir dir="${idp.target.dir}/credentials"/>
-        <selfsignedcert hostname="${idp.host.name}" privateKeyFile="${idp.target.dir}/credentials/idp-encryption.key" certificateFile="${idp.target.dir}/credentials/idp-encryption.crt" uriSubjectAltNames="${idp.uri.subject.alt.name}" />
+        <selfsignedcert hostname="${idp.host.name}" privateKeyFile="${idp.target.dir}/credentials/idp-encryption.key" certificateFile="${idp.target.dir}/credentials/idp-encryption.crt" uriSubjectAltNames="${idp.uri.subject.alt.name}"  keysize="${idp.keysize}"/>
         <echo>...done</echo>
     </target>
 
@@ -432,7 +443,7 @@
         <TGT>backchannel-key</TGT>
         <echo>Creating Backchannel keystore, CN = ${idp.host.name} URI = ${idp.uri.subject.alt.name} ...</echo>
         <mkdir dir="${idp.target.dir}/credentials"/>
-        <selfsignedcert hostname="${idp.host.name}" keystoreFile="${idp.target.dir}/credentials/idp-backchannel.p12" certificateFile="${idp.target.dir}/credentials/idp-backchannel.crt" keystorePassword="${idp.keystore.password}" uriSubjectAltNames="${idp.uri.subject.alt.name}" />
+        <selfsignedcert hostname="${idp.host.name}" keystoreFile="${idp.target.dir}/credentials/idp-backchannel.p12" certificateFile="${idp.target.dir}/credentials/idp-backchannel.crt" keystorePassword="${idp.keystore.password}" uriSubjectAltNames="${idp.uri.subject.alt.name}" keysize="${idp.keysize}" />
         <echo>...done</echo>
     </target>
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.