[java-identity-provider] branch master updated: Add beans and property for AES-GCM encryption.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=87d0faa71dfb0bb4e5ff3473edbabbb725e00b03

The following commit(s) were added to refs/heads/master by this push:
       new  87d0faa   Add beans and property for AES-GCM encryption.
87d0faa is described below

commit 87d0faa71dfb0bb4e5ff3473edbabbb725e00b03
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Sep 20 20:45:35 2018 -0400

    Add beans and property for AES-GCM encryption.
---
 idp-conf/src/main/resources/conf/idp.properties    |  5 +-
 .../resources/system/conf/relying-party-system.xml | 55 ++++++++++++++++------
 2 files changed, 45 insertions(+), 15 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index e4eda76..f0a06d6 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -60,9 +60,12 @@ idp.encryption.cert = %{idp.home}/credentials/idp-encryption.crt
 # Sets the bean ID to use as a default security configuration set
 #idp.security.config = shibboleth.DefaultSecurityConfiguration
 
-# To default to SHA-1, set to shibboleth.SigningConfiguration.SHA1
+# To downgrade to SHA-1, set to shibboleth.SigningConfiguration.SHA1
 #idp.signing.config = shibboleth.SigningConfiguration.SHA256
 
+# To upgrade to AES-GCM encryption, set to shibboleth.EncryptionConfiguration.GCM
+#idp.encryption.config = shibboleth.EncryptionConfiguration.CBC
+
 # Configures trust evaluation of keys used by services at runtime
 # Defaults to supporting both explicit key and PKIX using SAML metadata.
 #idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-system.xml b/idp-conf/src/main/resources/system/conf/relying-party-system.xml
index 4183b74..429f285 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-system.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-system.xml
@@ -149,20 +149,7 @@
         </property>
         
         <property name="encryptionConfiguration">
-            <bean parent="shibboleth.BasicEncryptionConfiguration">
-                <property name="dataEncryptionAlgorithms">
-                    <list>
-                        <util:constant
-                            static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128" />
-                    </list>
-                </property>
-                <property name="keyTransportEncryptionAlgorithms">
-                    <list>
-                        <util:constant
-                            static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP" />
-                    </list>
-                </property>
-            </bean>
+            <ref bean="#{'%{idp.encryption.config:shibboleth.EncryptionConfiguration.CBC}'.trim()}" />
         </property>
 
         <property name="decryptionConfiguration">
@@ -219,6 +206,46 @@
         </property>
     </bean>
 
+    <!-- Convenience beans for directly injecting AES-CBC or AES-GCM usage.  -->
+    
+    <bean id="shibboleth.SecurityConfiguration.CBC" parent="shibboleth.DefaultSecurityConfiguration" lazy-init="true"
+        p:encryptionConfiguration-ref="shibboleth.EncryptionConfiguration.CBC" />
+
+    <bean id="shibboleth.SecurityConfiguration.GCM" parent="shibboleth.DefaultSecurityConfiguration" lazy-init="true"
+        p:encryptionConfiguration-ref="shibboleth.EncryptionConfiguration.GCM" />
+
+    <!-- Actual encryption configurations for AES-CBC and AES-GCM. -->
+
+    <bean id="shibboleth.EncryptionConfiguration.CBC" parent="shibboleth.BasicEncryptionConfiguration">
+        <property name="dataEncryptionAlgorithms">
+            <list>
+                <util:constant
+                    static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128" />
+            </list>
+        </property>
+        <property name="keyTransportEncryptionAlgorithms">
+            <list>
+                <util:constant
+                    static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP" />
+            </list>
+        </property>
+    </bean>
+
+    <bean id="shibboleth.EncryptionConfiguration.GCM" parent="shibboleth.BasicEncryptionConfiguration">
+        <property name="dataEncryptionAlgorithms">
+            <list>
+                <util:constant
+                    static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM" />
+            </list>
+        </property>
+        <property name="keyTransportEncryptionAlgorithms">
+            <list>
+                <util:constant
+                    static-field="org.opensaml.xmlsec.encryption.support.EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP" />
+            </list>
+        </property>
+    </bean>
+
     <bean id="shibboleth.MetadataPKIXValidationInformationResolver"
         class="net.shibboleth.idp.saml.security.impl.MetadataPKIXValidationInformationResolver"
         c:resolver-ref="shibboleth.RoleDescriptorResolver" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.