[java-identity-provider] branch master updated: A stab at wiring up inbound artifact property lookups.
Scott Cantor
cantor.2 at osu.edu
Mon Sep 24 17:13:48 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=a5cd0692f4c0b4c46af18cfd66bae1f2052b38f4
The following commit(s) were added to refs/heads/master by this push:
new a5cd069 A stab at wiring up inbound artifact property lookups.
a5cd069 is described below
commit a5cd0692f4c0b4c46af18cfd66bae1f2052b38f4
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Sep 24 17:13:45 2018 -0400
A stab at wiring up inbound artifact property lookups.
---
.../system/conf/relying-party-mddriven.xml | 91 ++++++++++++++++++++--
1 file changed, 86 insertions(+), 5 deletions(-)
diff --git a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
index 034c10b..c42f96b 100644
--- a/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
+++ b/idp-conf/src/main/resources/system/conf/relying-party-mddriven.xml
@@ -50,10 +50,6 @@
class="net.shibboleth.idp.saml.relyingparty.impl.RelyingPartyConfigurationSupport" factory-method="byTag"
c:trim="false" c:matchAll="false" />
- <bean id="shibboleth.AbstractMDDrivenProperty" abstract="true"
- p:metadataLookupStrategy-ref="shibboleth.MDDrivenMetadataLookup"
- p:profileAliases="#{getObject('shibboleth.MDProfileAliases') ?: getObject('shibboleth.DefaultMDProfileAliases')}" />
-
<bean id="shibboleth.DefaultMDProfileAliases"
class="org.springframework.beans.factory.config.ListFactoryBean">
<property name="sourceList">
@@ -63,6 +59,8 @@
</property>
</bean>
+ <!-- ProfileRequestContext-based access to metadata properties of various types. -->
+
<bean id="shibboleth.MDDrivenMetadataLookup" class="com.google.common.base.Functions" factory-method="compose">
<constructor-arg name="g">
<bean class="org.opensaml.saml.common.messaging.context.navigate.EntityDescriptorLookupFunction" />
@@ -71,7 +69,11 @@
<bean class="net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction" />
</constructor-arg>
</bean>
-
+
+ <bean id="shibboleth.AbstractMDDrivenProperty" abstract="true"
+ p:metadataLookupStrategy-ref="shibboleth.MDDrivenMetadataLookup"
+ p:profileAliases="#{getObject('shibboleth.MDProfileAliases') ?: getObject('shibboleth.DefaultMDProfileAliases')}" />
+
<bean id="shibboleth.MDDrivenStringProperty" abstract="true" parent="shibboleth.AbstractMDDrivenProperty"
class="net.shibboleth.idp.saml.profile.config.StringConfigurationLookupStrategy" />
<bean id="shibboleth.MDDrivenBoolProperty" abstract="true" parent="shibboleth.AbstractMDDrivenProperty"
@@ -93,6 +95,37 @@
<bean id="shibboleth.MDDrivenBeanProperty" abstract="true" parent="shibboleth.AbstractMDDrivenProperty"
class="net.shibboleth.idp.saml.profile.config.BeanConfigurationLookupStrategy" />
+ <!-- MessageContext-based access to metadata properties of various types. -->
+
+ <bean id="shibboleth.MDDrivenMessagingMetadataLookup" class="com.google.common.base.Functions" factory-method="compose">
+ <constructor-arg name="g">
+ <bean class="org.opensaml.saml.common.messaging.context.navigate.EntityDescriptorLookupFunction" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <bean class="net.shibboleth.idp.saml.profile.context.navigate.SAMLMetadataContextLookupFunction">
+ <property name="relyingPartyContextLookupStrategy">
+ <bean class="com.google.common.base.Functions" factory-method="compose">
+ <constructor-arg name="g">
+ <ref bean="shibboleth.ChildLookup.RelyingParty" />
+ </constructor-arg>
+ <constructor-arg name="f">
+ <ref bean="SOAPClient.OperationContextLookup" />
+ </constructor-arg>
+ </bean>
+ </property>
+ </bean>
+ </constructor-arg>
+ </bean>
+
+ <bean id="shibboleth.AbstractMDDrivenMessagingProperty" parent="shibboleth.AbstractMDDrivenProperty" abstract="true"
+ p:metadataLookupStrategy-ref="shibboleth.MDDrivenMessagingMetadataLookup"
+ p:profileIdLookupStrategy-ref="SOAPClient.SOAPClientSecurityProfileIdLookup" />
+
+ <bean id="shibboleth.MDDrivenBoolMessagingProperty" abstract="true" parent="shibboleth.AbstractMDDrivenMessagingProperty"
+ class="net.shibboleth.idp.saml.profile.config.BooleanConfigurationLookupStrategy" />
+
+ <!-- Wiring lookup strategies into the actual profile configurations of various types. -->
+
<bean id="AbstractMDDrivenProfile" parent="AbstractProfileConfig" abstract="true">
<property name="securityConfigurationLookupStrategy">
<bean parent="shibboleth.MDDrivenBeanProperty" p:propertyName="securityConfiguration"
@@ -283,6 +316,30 @@
class="net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration"
p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
p:inboundInterceptorFlows="security-policy/saml2-sso">
+ <property name="signArtifactRequests">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolMessagingProperty" p:propertyName="signArtifactRequests" />
+ </constructor-arg>
+ <constructor-arg>
+ <value>true</value>
+ <!-- TODO: switch default to something like this once it's available -->
+ <!-- <bean class="org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate" /> -->
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="clientTLSArtifactRequests">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolMessagingProperty" p:propertyName="clientTLSArtifactRequests" />
+ </constructor-arg>
+ <constructor-arg>
+ <value>false</value>
+ <!-- TODO: switch default to something like this once it's available, but wrap it in NOT -->
+ <!-- <bean class="org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate" /> -->
+ </constructor-arg>
+ </bean>
+ </property>
<property name="signResponses">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
@@ -369,6 +426,30 @@
class="net.shibboleth.idp.saml.saml2.profile.config.SingleLogoutProfileConfiguration"
p:artifactConfiguration-ref="shibboleth.DefaultArtifactConfiguration"
p:inboundInterceptorFlows="security-policy/saml2-slo">
+ <property name="signArtifactRequests">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolMessagingProperty" p:propertyName="signArtifactRequests" />
+ </constructor-arg>
+ <constructor-arg>
+ <value>true</value>
+ <!-- TODO: switch default to something like this once it's available -->
+ <!-- <bean class="org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate" /> -->
+ </constructor-arg>
+ </bean>
+ </property>
+ <property name="clientTLSArtifactRequests">
+ <bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
+ <constructor-arg>
+ <bean parent="shibboleth.MDDrivenBoolMessagingProperty" p:propertyName="clientTLSArtifactRequests" />
+ </constructor-arg>
+ <constructor-arg>
+ <value>false</value>
+ <!-- TODO: switch default to something like this once it's available, but wrap it in NOT -->
+ <!-- <bean class="org.opensaml.messaging.logic.NoIntegrityMessageChannelPredicate" /> -->
+ </constructor-arg>
+ </bean>
+ </property>
<property name="signRequests">
<bean class="net.shibboleth.utilities.java.support.logic.PredicateSupport" factory-method="fromFunction">
<constructor-arg>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list