[java-identity-provider] 04/08: More SOAP client wiring.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=246131884725401bad6de2dda8103e9b8b9b44c6

commit 246131884725401bad6de2dda8103e9b8b9b44c6
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Sep 20 00:11:24 2018 -0400

    More SOAP client wiring.
---
 idp-conf/src/main/resources/system/conf/global-system.xml        | 5 ++++-
 idp-conf/src/main/resources/system/conf/relying-party-system.xml | 5 +++++
 idp-conf/src/main/resources/system/conf/soap-client.xml          | 6 +++---
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index dafb418..8cf6d43 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -287,7 +287,7 @@
         </property>
     </bean>
 
-    <!-- Parent beans for Signature/Encryption/TLS Configuration objects. -->
+    <!-- Parent beans for Signature/Encryption/TLS/HttpClientSecurity Configuration objects. -->
         
     <bean id="shibboleth.BasicSignatureValidationConfiguration" abstract="true"
         class="org.opensaml.xmlsec.impl.BasicSignatureValidationConfiguration"
@@ -297,6 +297,9 @@
     <bean id="shibboleth.BasicClientTLSValidationConfiguration" abstract="true"
         class="org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration" />
     
+    <bean id="shibboleth.BasicHttpClientSecurityConfiguration" abstract="true"
+        class="org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration" />
+    
     <bean id="shibboleth.BasicSignatureSigningConfiguration" abstract="true"
         class="org.opensaml.xmlsec.impl.BasicSignatureSigningConfiguration"
         p:whitelistedAlgorithms="#{getObject('shibboleth.SignatureWhitelist')}"
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-system.xml b/idp-conf/src/main/resources/system/conf/relying-party-system.xml
index 429f285..d2b259a 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-system.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-system.xml
@@ -148,6 +148,11 @@
                 p:x509TrustEngine-ref="#{'%{idp.trust.certificates:shibboleth.ChainingX509TrustEngine}'.trim()}" />
         </property>
         
+        <property name="httpClientSecurityConfiguration">
+            <bean parent="shibboleth.BasicHttpClientSecurityConfiguration"
+                p:TLSTrustEngine-ref="#{'%{idp.trust.httpClient.tls:shibboleth.ChainingX509TrustEngine}'.trim()}" />
+        </property>
+        
         <property name="encryptionConfiguration">
             <ref bean="#{'%{idp.encryption.config:shibboleth.EncryptionConfiguration.CBC}'.trim()}" />
         </property>
diff --git a/idp-conf/src/main/resources/system/conf/soap-client.xml b/idp-conf/src/main/resources/system/conf/soap-client.xml
index 7b51feb..afe2261 100644
--- a/idp-conf/src/main/resources/system/conf/soap-client.xml
+++ b/idp-conf/src/main/resources/system/conf/soap-client.xml
@@ -95,6 +95,8 @@
                 <property name="handlers">
                     <util:list>
                     
+                        <bean scope="prototype" class="org.opensaml.saml.common.binding.security.impl.CheckAndRecordServerTLSEntityAuthenticationtHandler" />
+
                         <!--  TODO -->
                         <bean scope="prototype" class="org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler" >
                             <property name="protocol">
@@ -155,10 +157,8 @@
         class="net.shibboleth.idp.profile.messaging.impl.SelectProfileConfiguration" scope="prototype"
         p:profiledIdLookupStrategy-ref="SOAPClient.SOAPClientSecurityProfileIdLookup" />
         
-    <!-- TODO probably not we want in the end, just for initial testing. -->
     <bean id="SOAPClient.HttpClient" parent="shibboleth.NonCachingHttpClient"
-        p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLSOnly" />
-    
+        p:tLSSocketFactory-ref="shibboleth.SecurityEnhancedTLSSocketFactoryWithClientTLS" />
     
 
 </beans>
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.